* refactor(mobile): group host catalog credentials descriptors and connection history
* refactor(mobile): import RPC sender and result types from defining owners
* refactor(mobile): colocate push delivery with registration operations
* refactor(mobile): point push recordings at delivery owner
* perf(mobile): let newer phone shells fetch the language catalog from the desktop instead of downloading all of them
* fix(mobile): hash only the buildId fields so phone readers can recompute it
* fix(mobile): use the catalog chunk when the generation still has it
* fix(desktop): give catalog reads their own read-slot budget
* feat(mobile): announce dictation to VoiceOver through the shell
* feat(mobile): speak dictation from the host, so leaving the session and the pill's toasts are announced too
* fix(mobile): say dictation outcomes where they are known, and re-read a repeated live message
* fix(mobile): leave a setup refusal to its setup sheet instead of reading the raw code
* fix(mobile): say cancelled when a kept recording is discarded
* feat(mobile): cancel dictation in place and show which device is transcribing
* fix(mobile): give each composer its own dictation cancel target
* fix(mobile): keep the dictating composer row on one line
* refactor(mobile): share the dictation mic face and measure the cancel target per platform
* refactor(mobile): give relay and encryption concrete owners
* refactor(mobile): organize session and review feature owners
* refactor(mobile): organize RPC and host ownership
* test(mobile): point render fixtures at concrete owners
* refactor(mobile): use explicit type-only owner imports
* feat(mobile): keep screen data on the phone between launches
* feat(mobile): keep the repo list snapshot id across launches
* fix(mobile): don't read a key again that the boot read just found empty
* fix(mobile): late-restored strips, revocation fence and reads never built on stored data
* test(mobile): give the session startup recording the late strip watch
* fix(mobile): remember Workspace options, keep the revocation fence until reauth, store no terminal output
* test(mobile): give the view settings recording its remember hook
* docs(mobile): say what a restored key means to a fetch
* style(mobile): format host-query after rebase onto Q11
* perf(mobile): open Jump back in and notifications inside the host document
* fix(mobile): gate open targets on page 3, keep notification suppression, fold double taps
* fix(mobile): report the shown session from host documents and only open this host's sessions
* test(mobile): ignore the page's location report in the agent-history notify check
* fix(mobile): let a Back before the paint gate settle the host stack
* refactor(mobile): build the route-param clear frame beside its name
* feat(mobile): keep chat drafts and unsent text in the device store
* test(mobile): give the send tests a real draft destination
* fix(mobile): confirm reopened sends past the loaded window and save the journal id with the clear
* fix(mobile): let an open chat claim a released send, and warn on a reopened command
* refactor(mobile): share the pausable unconfirmed-send deadline between chat holds
* fix(mobile): hold every lost structured send and replace a re-held deadline; use the shared store value codec
* fix(mobile): save chip-only drafts, save only a send's own chips, and keep hold time across outages
* fix(mobile): hash a draft key the device store would refuse as too long
* fix(mobile): drop a sent message's chips in the write that settles it
* fix(mobile): return a structured host command whose reply was lost to the box
* feat(mobile): define the on-device speech contract for the native audio module and page bridge
* feat(mobile): dictate on the phone first and replay to the computer when the phone fails
* refactor(mobile): type the on-device speech module without a cast
* fix(mobile): point dictation's finish ref at the committed callback
* test(mobile): wait on the takeover request instead of a fixed sleep
* fix(mobile): release each dictation request's own share of a replayed backlog
* fix(mobile): let the computer's text replace the phone's after a fallback
* perf(mobile): skip the Suspense fallback on page boot
* fix(mobile): keep open-target boots on the lazy path
* test(mobile): pin that the page waits for its held route chunk
* refactor(mobile): preload every page layout and keep screens apart
Slash and mention suggestion menus in the phone chat composer stay reachable above the on-screen keyboard while typing.
Co-authored-by: Guderlilian <73724370+qq2144@users.noreply.github.com>
* perf(mobile): reopen Source Control's Changes list from memory instead of rescanning
* fix(mobile): keep action errors through background status reads
* fix(mobile): let only explicit status reads clear Source Control's action error
* refactor(mobile): simplify the query layer and the Changes compare trigger
* fix(mobile): follow language switches in Changes' empty states
* feat(mobile): render math in Markdown with desktop chat's delimiter rules
Move the price, citation, closer and display rules plus the KaTeX settings
to src/shared/markdown-math-rules and point desktop chat at them. Mobile's
markdown-it gets the same grammar, and pages typeset formulas with KaTeX,
whose fonts ship as page assets. Mermaid's engine leaves katex external so
both share one katex chunk.
* build(mobile): count KaTeX fonts in the page budget and keep math to one chunk
Only the licensed terminal font keeps its own allowance; KaTeX's fonts
count toward the budget like code. The typesetter imports katex itself,
sharing mermaid's chunk, so math adds one chunk instead of four.
* fix(mobile): draw the PR line-count table's +/− glyphs at GitHub's size
github.com draws \Huge at \Large (1.44em), so the line-count table's
glyphs sit inline at text height. Cap the larger size commands the same
way, and let inline math take its height from KaTeX's struts so rows keep
normal height and numbers stay on the text baseline.
* test(mobile): pin math delimiters to desktop chat's results
* refactor(mobile): drop type assertions from the math tree nodes
* chore(mobile): register the math mdast nodes beside <details>
* fix(mobile): read bracket math only in chat, keep math parsing linear
GitHub text (PRs, Tasks, files) reads $ and $$ only, so \[Bug\] stays a
bracket; chat rows opt into desktop chat's \( and \[ too. Remember failed
block scans and skip dollar-run tails so hostile input stays linear, leave
unfinished math out of remend like desktop, bound the formula cache by bytes,
retry a failed KaTeX load, and count symbol commands in table widths.
* fix(mobile): copy formulas as TeX and keep GitHub's unclosed $$ as text
Share desktop's selection-to-TeX reader so a copied selection carries each
formula once, as its source. An unclosed $$ in GitHub text stays a
paragraph, chat's math delimiters reach HTML-derived Markdown and summaries,
failed block scans only skip openers inside the lines they read, unfinished
math anywhere in the streaming tail skips remend, and table widths no
longer spread every command into Math.max.
* refactor(mobile): share the formula copy handler and cap sizes only in GitHub text
Desktop and mobile copy through one shared handler. GitHub surfaces draw
\Huge as github.com does while chat keeps desktop chat's sizes, PR and file
text skip bracket scanning entirely, and the dollar-run scan and token
alias live in one place.
* chore(mobile): stop tracking the generated KaTeX stylesheet
#38611 committed it by mistake; postinstall writes it and .gitignore now
lists it.
* fix(mobile): follow desktop chat's new dollar rule through the shared module
#38651 changed desktop chat's inline $ rule (shell variables and prices stay
text, a single $ can span lines, $5+2$ is math). Move those checks into
src/shared/markdown-math-rules, point desktop at them, and give mobile's
markdown-it rule the same behaviour.
* feat(mobile): copy, save and share an image from the chat image viewer
* refactor(mobile): pass image viewer actions in so diagrams skip them
* fix(mobile): name the image verb native.image.act and serialize image actions
* fix(mobile): queue image actions per page and skip SVG links
* refactor(mobile): share the cache-folder helper and table the viewer's image actions
* fix(mobile): keep the toast's live region mounted so screen readers hear it
* test(mobile): re-record agent history goldens for the always-mounted toast region
* test(mobile): import the declared routes in the moved routes test
* fix(mobile): stop page bounce and input zoom; URL keyboard for new browser tabs
* feat(mobile): smoother motion, press feedback everywhere, reduced motion for sheets
Working rings and the tool-run pulse run as compositor animations on the
page. Sheets, the right panel, the page stack and the pager cross-fade under
Reduce Motion. The right panel shares the sheet's drag physics. The composer
cross-fades Send/Stop/Save and the mic, jump-to-latest and prompt cards ease
in, banners ease their height, and every Pressable shows a pressed state.
Pairing gets a success beat, and the clean state fades in after a commit.
Carries over #33221 and #33210. Replaces our #34484 Duo support with the community design, on top of main's rebuilt terminal key bar (#36166).
Fixes#33200
Co-authored-by: Takeshi Matsumoto <zytakeshi520@gmail.com>
Co-authored-by: Lars Keggenhoff <lars@kghf.io>
* feat(mobile): give every text input the chat composer's look
Adds shared MessageBox, TextField and ComposerSendButton built from the
composer's own styles, and moves chat, form, search, Tasks, PR, review and
commit inputs onto them. The commit message becomes multi-line, every input
is 16pt (no page zoom on focus), and focus rings are gone. The terminal and
browser typing docks are unchanged.
* feat(mobile): rebuild the terminal dock around Keys and Message modes
Agent tabs open in Message mode, where you write in the chat composer and
Send types it into the terminal. Shell tabs open in Keys mode, where each
letter goes straight to the terminal through the live field. A pick made on
an agent tab lasts until the agent quits. The shell/agent rule is the one
keyboard dismissal already used, now shared.
The key row carries sticky ctrl, alt and shift (tap for the next key,
double tap to lock) and one arrow pad (tap a side, or hold and drag to
repeat through the existing held-key repeat). Paste, attachments, the
display width, the remaining keys and custom keys move to a ⋯ sheet. Return
in the composer adds a line; Send sends.
* fix(mobile): read arrow-pad taps from the pad and keep every key reachable from ⋯
A touch on a chevron made the icon the touch target, so the side was
measured against the icon's box and most taps read as left. The ⋯ sheet
now leaves out only the keys the current row shows, so agent tabs get Tab
and shell tabs get Shift+Tab and Enter back.
* fix(mobile): keep the last changed files clear of a growing commit box
The file list's bottom inset was a fixed 196 pt, so a commit message several lines long hid the last rows behind the commit bar. The inset now follows the bar's measured height.
* test(mobile): give the file list test its bottom inset
* feat(mobile): add UI localization infrastructure
Mobile follows the phone's language (or an in-app choice under Settings > Appearance)
across the same 11 languages as desktop, switching live like the theme does.
- i18next with desktop's translate(key, fallback, options) call shape; catalogs in
mobile/src/i18n/locales load lazily, English fallbacks stay inline
- Hermes lacks Intl.PluralRules: load the FormatJS polyfill with the 11 languages' rules
- OTA pages get the shell's language through an optional bridge init field
- iOS permission prompts localized; iOS and Android 13+ per-app language pickers
- verify:mobile-localization and a coverage ratchet run in lint, check:changed and CI
* fix(mobile): mount pages after the newest language request; tighten localization gates
- Wait for the latest page language activation, not a superseded one
- Keep literal fallbacks when a key also has a dynamic one
- Count headerTitle as visible copy; select the mobile check when the runtime catalog generator changes
* feat(mobile): repaint themed components on language changes
Components that read the theme already subscribe for repaint; a language switch
repaints them too, so labels built by helpers during render follow it. RPC
recordings load the real i18next and JSON catalogs.
* fix(mobile): scope the translate() gate to render bodies and memos; prune stale keys on sync
Handlers and effects may call translate() when they run. sync:mobile-localization now
removes keys no code references from every catalog.
* fix(mobile): use node: imports in the locale config plugin; pass uiLocale in bridge hook test
* chore(mobile): refresh the localization coverage baseline
* fix(mobile): follow render callbacks in the translate() gate; keep used plural siblings on prune
Also let anonymous default-exported screens count as components, flag any plural
family a locale started, and mark JSON modules as ES modules in the recording loader.
* fix(mobile): treat async and named local callbacks as handlers in the translate() gate
* chore(mobile): refresh the localization coverage baseline
* chore(mobile): refresh the localization coverage baseline
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* feat(mobile): light and dark themes with desktop's palettes
Settings → Appearance offers System, Light and Dark. The shell passes the
resolved scheme to over-the-air pages in its init frame.
Fixes#22184
* fix(mobile): draw your chat messages in desktop's user bubble
Desktop uses a faint surface with a hairline border in both themes; the inverted fill went black in light.
* test(mobile): re-measure the page script sweep after the shared theme hooks
Every route now imports the theme hooks while the entry does not, so they emit one shared script (96 for the tree). Re-swept every route prefix; the worst route step is now 15.
* test(mobile): read themed stylesheets in the text-input font-size census
The census only unwrapped StyleSheet.create({...}); inputs styled through themedStyleSheet(() => ({...})) came back unread.
* fix(mobile): edit a queued message in a plain text field with compact cancel and save buttons
* fix(mobile): the queued edit field grows from one line to four in the phone's web page
* fix(mobile): the queued edit's cancel and save buttons take 44pt-tall taps, and the queue no longer jumps while typing
- Measure the edit field's height in a hidden copy of the textarea instead
of collapsing the live one: WebKit clamped the queue list's scroll
position on every keystroke. It also re-measures when the field's width
changes (rotation).
- react-native-web drops hitSlop, so the X and check were 28pt targets.
Each button is now a 44pt-tall target reaching its neighbours, with the
28pt square drawn inside; the layout looks the same.
- Announce saving with aria-busy, which react-native-web maps.
- List the new web sibling in web-overrides.json.
* refactor(native-chat): move the slash picker builder and upload chunking to shared
Mobile builds the same skill and command list as desktop.
* feat(mobile): redesign the chat composer with file attachments and inline skills
* fix(mobile): the composer field owns its input style
The page's font-size census cannot follow a style passed in as a prop.
* fix(mobile): break the transport and terminal-document import cycles and gate them after mobile's install
client-context re-exported the host-client hooks, which import client-context back: the re-export
barrel is gone and importers (and their test mocks) name host-client-hooks directly. In the terminal
document, the cell-metric getters move to a leaf cell-metrics module and select-mode entry/exit to
selection-mode, so fit, transform, overlay and range no longer import each other. pr.yml lints imports
before mobile's install, when mobile's tsconfig can't load, so Mobile verify now runs the same import
rules over mobile after its install with zero warnings allowed.
* fix(mobile): the browser-pane render harness imports useHostClient from host-client-hooks
Its route source is a template string, so no typecheck saw the removed client-context re-export; the mobile web bundle check did.
* fix(ci): the e2e typecheck ratchet counts the same with or without mobile's install
Specs reach mobile/src/transport, whose expo-crypto and async-storage imports resolve only after mobile's install and then load React Native's globals (numeric timers, a required NODE_ENV), adding errors in unrelated specs. An empty stub pins both, so the static job reads 232 either way.
Render committed branch changes as virtualized SectionList rows for clean and dirty working trees, keeping all files accessible without delaying Back. Share the existing sleek scrollbar rules with mobile web pages and retain explicit hidden-indicator settings.
Fixes#30170. Review reference: #30171; thanks to @zhangxaochen for the diagnosis and initial proposed fix.
Co-authored-by: zhangxaochen <zhangxaochen@163.com>
* fix(mobile): wall hosts that cannot serve the page instead of opening native screens
* refactor(mobile): drop the native-route state and the shell fallback prop; unknown routes say unavailable
* test(mobile): read the nullable page route refusal in its policy test
* refactor(mobile): every build is the OTA shell; drop the native/OTA build switch
The owner retired the native-screen fallback with no emergency native build, so
EXPO_PUBLIC_MOBILE_SHELL, mobileShellBuildKind, shellSwitchDecision, the Metro
cache-key suffix and both release workflows' shell input go. Every host route
mounts the shell; a route naming no screen the shell could open gets the
existing refusal screen instead of a native screen.
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): delete native screens the OTA shell no longer reaches
With every build the OTA shell, these native siblings run nowhere: the
native-executed closure (index.js plus every non-web route) does not reach
them, and the page resolves their .web siblings. Each .web sibling takes the
plain name, its web-overrides entry goes, and the native-only rich Markdown
editor and Mermaid WebView generators and their outputs go with them.
Kept: native siblings the node test suite still renders shared screens
through (terminal WebView, browser frame path, clipboard, dictation, media
picker, live input, snapshot budget, input styles).
Claude-Session: https://claude.ai/code/session_6cea92f6
* test(mobile): drop the phone-preview comparison the deleted native sibling held
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): drop the dead web route, flag-era comments and the one-value shell kind
The host route files no longer switch, so their comments say what they do now:
a route naming no screen shows the unavailable screen. app/h/[hostId]/web.tsx
duplicated index.tsx and nothing linked to it, so it and its stack entry go
(the bundle sweep is re-measured: 77 scripts at 15 routes). Diagnostics print
the bridge protocol on its own instead of a shell kind that has one value.
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): one host for the rich editor, plain Text, and drop two unused native deps
MobileSelectableText was react-native's Text, so callers use Text. The rich
Markdown editor's host-facing seams (messages, URL prompt, keyboard inset) are
required now that the page is its only host; the WebView defaults go. Comments
that described deleted native components are rewritten, and
expo-image-manipulator and react-native-uitextview leave package.json and the
lockfile.
Claude-Session: https://claude.ai/code/session_6cea92f6
* feat(mobile): draw the host Accounts screen from the desktop's page
Accounts was the last host screen the shell still drew natively, so its
changes needed a phone build. It is now a page route like Tasks: the
screen moves to src/accounts/MobileAccountsScreen.tsx, accounts.web.tsx
renders it on the page, and accounts.tsx mounts the shell for it.
What React Native Web needed: Alert.alert is a no-op there, so the
reset confirmation, its outcome and a failed account switch are
ConfirmModal drawers (ConfirmModal can now drop Cancel for a notice);
Back goes through the route handoff, which pops the shell's stack; and
the reset idempotency key is built from getRandomBytes, since
randomUUID needs a secure context the iOS custom scheme is not.
edit.tsx edits the phone's own pairing and never renders on the page,
so the route manifest leaves it out and the page's host stack does not
declare it. The script sweep is re-measured for the 14-route tree.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(accounts): answer a same-offer Codex reset retry with its recorded outcome; mobile mirrors the desktop
The desktop keeps no client journal for a reset credit: the host's ledger
owns the attempt. A remote client that lost a reply and retried the same
offer under a new key was refused with "already attempted" (or "unknown
outcome" while the provider call was unresolved), which is why the phone
carried its own durable journal to replay the old key.
The coordinator now answers a request for an offer an earlier key already
claimed as that attempt: the settled outcome, the running attempt, or a
resume of the pending one under its original key. A different offer for
the account is still refused while an outcome is unknown, so nothing can
spend twice. The reply shape is the one a same-key replay always had, so
installed clients with their journal read it unchanged.
With that, the Accounts page sends a fresh key per attempt like the
desktop and keeps nothing on the phone: the AsyncStorage journal, its
client singleflight and the retry-record warnings are deleted, and the
journal-resume recording goes with them.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(accounts): resume an account's unresolved Codex reset when the retry names a newer offer
Review follow-ups:
- Host: after an unknown provider outcome the usage refresh moves the
offer, so a retry names a newer one. The coordinator now answers it as
the account's unresolved attempt (resumed under its own key and scope),
as the desktop's consumeCurrent does, instead of refusing forever. One
ledger lookup finds own key, offer claimant, then unresolved attempt.
- Mobile: a reply is matched on target, account and account revision,
not the offer, so the resumed attempt's scope is accepted.
- The key is minted inside requestCodexResetCredit from randomV4Uuid, the
session helper moved to src/platform/random-v4-uuid.ts.
- RefreshControl goes; the header refresh stays. ConfirmModal's
onConfirm is optional for an OK-only notice.
- Stale journal comments and the mobile docs line are corrected.
- The edit.tsx page exclusion is dropped from this PR; the script sweep
is re-measured for 15 routes.
- Root oxlint: escape the apostrophe; zod v4 strictObject.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): secure UUID fallback from expo-crypto; pin reset retry routing
- randomV4Uuid never falls back to Math.random: without crypto.randomUUID
it builds the v4 UUID from ExpoCrypto.getRandomBytes, as the old reset
key did. Tests get Node's secure bytes for expo-crypto from the setup
file, since the native module has no Node build.
- Host tests: a new offer after a settled attempt spends again rather
than replaying, and a retry naming a newer offer joins a resumed
attempt in flight (one provider call, original key).
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* chore: restore main's bytes for files the merge's pre-commit format touched
The merge commit's lint-staged run reformatted 27 files this PR does not
change. Committed without the hook so they match origin/main exactly.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* test(mobile): stand in for expo-crypto with a Node alias, not a setup-file mock
Anti-slop forbids module mocking outside test files. The vitest config
now aliases expo-crypto to a faithful Node implementation of the names
shared code reaches; a test file's own mock still wins.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* docs(mobile): match the bridged-parity comments to the measured 795-golden tally
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): wall hosts that cannot serve the page instead of opening native screens
* refactor(mobile): drop the native-route state and the shell fallback prop; unknown routes say unavailable
* test(mobile): read the nullable page route refusal in its policy test
* refactor(mobile): every build is the OTA shell; drop the native/OTA build switch
The owner retired the native-screen fallback with no emergency native build, so
EXPO_PUBLIC_MOBILE_SHELL, mobileShellBuildKind, shellSwitchDecision, the Metro
cache-key suffix and both release workflows' shell input go. Every host route
mounts the shell; a route naming no screen the shell could open gets the
existing refusal screen instead of a native screen.
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): delete native screens the OTA shell no longer reaches
With every build the OTA shell, these native siblings run nowhere: the
native-executed closure (index.js plus every non-web route) does not reach
them, and the page resolves their .web siblings. Each .web sibling takes the
plain name, its web-overrides entry goes, and the native-only rich Markdown
editor and Mermaid WebView generators and their outputs go with them.
Kept: native siblings the node test suite still renders shared screens
through (terminal WebView, browser frame path, clipboard, dictation, media
picker, live input, snapshot budget, input styles).
Claude-Session: https://claude.ai/code/session_6cea92f6
* test(mobile): drop the phone-preview comparison the deleted native sibling held
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): drop the dead web route, flag-era comments and the one-value shell kind
The host route files no longer switch, so their comments say what they do now:
a route naming no screen shows the unavailable screen. app/h/[hostId]/web.tsx
duplicated index.tsx and nothing linked to it, so it and its stack entry go
(the bundle sweep is re-measured: 77 scripts at 15 routes). Diagnostics print
the bridge protocol on its own instead of a shell kind that has one value.
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): one host for the rich editor, plain Text, and drop two unused native deps
MobileSelectableText was react-native's Text, so callers use Text. The rich
Markdown editor's host-facing seams (messages, URL prompt, keyboard inset) are
required now that the page is its only host; the WebView defaults go. Comments
that described deleted native components are rewritten, and
expo-image-manipulator and react-native-uitextview leave package.json and the
lockfile.
Claude-Session: https://claude.ai/code/session_6cea92f6
* fix(mobile): wall hosts that cannot serve the page instead of opening native screens
* refactor(mobile): drop the native-route state and the shell fallback prop; unknown routes say unavailable
* test(mobile): read the nullable page route refusal in its policy test
* refactor(mobile): every build is the OTA shell; drop the native/OTA build switch
The owner retired the native-screen fallback with no emergency native build, so
EXPO_PUBLIC_MOBILE_SHELL, mobileShellBuildKind, shellSwitchDecision, the Metro
cache-key suffix and both release workflows' shell input go. Every host route
mounts the shell; a route naming no screen the shell could open gets the
existing refusal screen instead of a native screen.
Claude-Session: https://claude.ai/code/session_6cea92f6
* refactor(mobile): drop the dead web route, flag-era comments and the one-value shell kind
The host route files no longer switch, so their comments say what they do now:
a route naming no screen shows the unavailable screen. app/h/[hostId]/web.tsx
duplicated index.tsx and nothing linked to it, so it and its stack entry go
(the bundle sweep is re-measured: 77 scripts at 15 routes). Diagnostics print
the bridge protocol on its own instead of a shell kind that has one value.
Claude-Session: https://claude.ai/code/session_6cea92f6
* feat(mobile): let the page own the wide host area, one sidebar only
On wide layouts a detail route's page session ran app/h/_layout.tsx inside
the detail pane, judged itself wide, and drew a second host sidebar beside
the native one.
- The page draws the host sidebar only when init carries the new optional
`ownsHostArea` fact, never from its own width.
- The page manifest's `/h/[hostId]` route declares `canOwnHostArea`.
- On wide layouts the native host route mounts one host-area page session.
A declaring bundle serves it with every served route's grants, so hops
stay in the page, and the native layout drops its sidebar. Without the
declaration, or without a bundle, the session answers native-route and
every wide detail route stays native.
- The owner is recorded per host so the layout and switches agree and a
relaunch does not flash.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): decide the wide host area per session, without a stored owner
Round 1 kept a per-host owner record that the native layout trusted. When
the record said the page owned the area, a detail route opened natively
(deep link, notification, handoff, narrow-to-wide with a detail pushed)
showed no sidebar at all.
- Drop the record. A wide session decides from the manifest it already
read: it is served only when the host route declares canOwnHostArea,
and it rebuilds when the layout class changes.
- The native layout hides its sidebar only on the host route, while that
host's page session is serving, as the shell screen reports through a
layout context. Detail routes keep the native sidebar, and a page there
draws none, so there is exactly one.
- Phones read and render nothing new.
- The host-area page can read and write every workspace-scoped key of its
host (chat tabs, live-input handles), as a per-workspace session does.
Claude-Session: lane-ipad-page-owns-host
* test(mobile): type the layout-class doubles rather than assert them
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): keep detail pages through a layout flip, guard capped keys
- A wide/narrow flip rebuilds a session only on the host route or under a
bundle without canOwnHostArea, where the answer changes. A detail page
under a declaring bundle keeps its document, scroll and draft.
- In the host-area page, a workspace key the 32-entry init cap leaves out
is named in storageOversize, so the page cannot replace the device's
chat-tab list from a default. The init frame bounds that list to the
page's schema; the host still refuses every key in the full list.
- A leaving host-area session clears only its own report.
Claude-Session: lane-ipad-page-owns-host
* refactor(mobile): host-area ownership from the reducer, storage read on demand
- The serving report is a focus-scoped boolean, so a host pushed over
another no longer leaves the first one's area unclaimed after the pop.
- The reducer takes `layout-changed {wide}`: it keeps the session when the
route view is unchanged and restarts it otherwise; `routeViewOf` returns
`ownsHostArea`.
- One web override, `usePageOwnsHostArea`; the native rule is inline in the
host layout.
- A host-area page reads a host workspace key from the shell on demand
(`native.storage.read`, granted to that session only) instead of init
enumerating the store.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): host-area page reads back its own workspace-key writes
A page read right after a page write of the same key is answered from the
page's own value, not from a shell that may not have the notify yet. A
refused read crosses as an error, never as an unset key.
Claude-Session: lane-ipad-page-owns-host
* refactor(mobile): read-your-writes from the shell's mirror, final review fixes
- The shell answers a workspace-key read from the mirror, which every
shell-side write updates synchronously (removals held as known-absent),
and reads the store only on a miss. The page shim's written-keys set
goes.
- `onLayoutChanged` compares the route view field by field; the session
is created with its layout and the layout effect fires on `wide` alone.
- The device verb dispatcher's type excludes the storage read.
- The sidebar matrix mounts the real shell screen to decide the report.
Claude-Session: lane-ipad-page-owns-host
* feat(mobile): host-area page takes the whole screen from the download on
The native sidebar steps aside once the manifest says the page owns the
host area: fetching, activating, ready and the failure screens after them
are full screen, as on a phone. It stays while the host is being checked.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): host-area workspace-key read survives a write during it
On a mirror miss the read went through the mirror's hydrate, which drops
its answer when any mirrored write lands meanwhile, so a stored key read
as unset right after a relaunch. A miss now reads the store directly, and
a store failure rejects rather than reading as unset.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): a wide detail session hands the host route to the shell
A session opened on its own under a page that can own the host area
kept a hop to the host route in-page (a missing worktree's notice, or
leaving the session), drawing a second host list beside the native
sidebar. Its pairs now leave the host route out, so the hop goes to the
shell, which opens the area-owning session. Phones keep the hop in-page.
Claude-Session: lane-ipad-page-owns-host
* test(mobile): a phone mount's layout dispatch leaves the session alone
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): leaving a wide detail session returns to the host area
The leave-session chevron and the missing-worktree bounce hand the host
route to the shell on a wide layout, which pushed it: a second host-area
session over the session, with Back reopening the session. On a wide
layout the shell now dismisses to this host's route instead, taking the
href's params, or replaces the session when nothing is below it. Phones
still push.
Claude-Session: lane-ipad-page-owns-host
* fix(mobile): a narrow-wide flip restarts a detail session's page
The route view comparison now counts the paired routes, so a detail
session under a page that can own the host area restarts on a flip
instead of keeping the narrow pairs, whose host-route pair let the page
draw a second host list beside the native sidebar.
Claude-Session: lane-ipad-page-owns-host
* feat(native-chat): visual directive grammar and host read for a chat's visuals folder
A shared grammar for the ::orca-visual{file="..." title="..."} reply line,
the per-chat visuals folder location on the owning host, and the
agentSession.readVisual runtime method that reads one visual with lexical and
canonical containment, a 512 KiB bounded read and UTF-8 refusal.
* feat(native-chat): shared frame document for chat visuals
One string builder every client wraps a visual's HTML with: the policy
(CDN assets only, no fetch, frames, workers, forms or base rewrites),
the theme variables, and a prelude that reports height, routes links to
the parent and refuses navigation. Also the validated frame-to-parent
message reader and the live theme message.
* feat(mobile): render native-chat visuals inline in the phone's chat
A finished assistant reply's ::orca-visual line now shows the visual
inline, read from the chat's owning host through agentSession.readVisual.
The visual runs in an opaque sandboxed child of a trusted host document
inside the WebView; the app accepts only a token-checked height and an
http(s) link opened under user activation. Navigation away from the
visual's own document is refused, a dead web process reloads once, and
the visual opens full screen. The hybrid shell's page renders it sealed.
* feat(native-chat): render chat visuals inline and in the right sidebar
Native-chat assistant replies render a ::orca-visual{...} line as the chat's
HTML visual in an opaque, scripts-only sandboxed frame: CSP first, the host
frame navigation guard registered before content runs, live theme without a
reload, fitted height, links opened in the viewer's browser only from a real
gesture, lazy mount, and one muted line when the visual cannot be shown.
Open in sidebar shows the same frame in the right sidebar, widened while it
is open and restored after.
* fix(mobile): chat visuals use the shared shell; only the host page may message the app
Review round 1:
- use PR 1's shared visual shell and height governor instead of a second
builder; the app decides heights and pushes them to the host page
- react-native-webview patch: the message channel accepts only string
messages from the main frame on iOS and Android, so a visual in its
sandboxed child cannot reach it (or crash Android with a non-string)
- structured replies grow in place: while a turn works, a row holds back a
directive still being typed at its tail; finished lines mount
- links need child focus + activation, one per activation window
- a refused read takes the visual down and drops its cached bytes
- in-page anchors load; text spelling a placeholder renders no visuals
* refactor(native-chat): move the visual height governor to src/shared
The phone bundles only src/shared, so the governor the desktop frame uses
moves there unchanged and the mobile frame shares it.
* fix(native-chat): point the desktop and mobile frames at the moved governor
* fix(mobile): review round 2 for chat visuals
- host page relays only messages on the visual's own channel, as its own
copy, so a visual cannot push oversized fields through it; relay rate
halved; a link is validated before it uses up the link window
- the frame denies camera, microphone, geolocation, clipboard and display
capture; iOS media capture requests are denied
- react-native-webview patch: the iOS history-shim handler also accepts
only main-frame string messages
- only the newest assistant row of a working turn holds back an unfinished
directive; earlier finished rows show their visuals
- an error reply or older host is not a verdict: it keeps a visual on
screen and its cache, and retries; only a host refusal takes it down
* fix(mobile): a drag that starts on an inline visual scrolls the chat
iOS gives a scrollable frame its own scroll view, which took the drag;
the inline frame is sized to its content, so it no longer scrolls.
Full screen still does.
* fix(mobile): review round 3 for chat visuals
- hold back only the last block of the newest assistant row, and not
while a question or approval is open, so a visual followed by a tool
call or a pending question shows at once
- an older host (method_not_found) reads as unavailable without retries
- drop a stray @pnpm/exe lockfile block; only the patch hash changes
* test(mobile): list the visual frame's web sibling; mock it in the prompt-controller harness
* fix(mobile): an older desktop's mobile allowlist refusal reads as unavailable at once
* fix(native-chat): visual CI fixes, shared height governor, live-turn streaming hold
Registers agentSession.readVisual from the methods index so the structured
method file stays under its line budget, replaces reflective reads with checked
narrowing, moves the pure height governor to src/shared for mobile, and holds a
half-written directive tail while the turn works (structured text rows carry no
running state).
* fix(native-chat): harden the visual read and link opening
Re-checks after the open that the chat's visuals folder is still the real
directory at Orca's path, reports unexpected filesystem faults by code without
host paths, and lets one click in a visual open at most one page.
* fix(native-chat): keep visual lines out of plain-text reply surfaces; review fixes
One shared helper drops visual lines (outside fenced code) from reply text where
it becomes plain text: the structured status summary that feeds the sidebar row,
dashboard, notifications, phone rows and handoffs, and AI Vault reply previews.
Review fixes: height also counts a pinned body's overflow, only the live
frontier row holds a half-written visual line, the runaway-height stop needs the
same step repeated, and any host refusal evicts the cached revision.
* fix(native-chat): resolve the visuals folder without the removed journal-paths helper
Main removed the per-chat journal paths and the journal database's state
directory; the visuals folder keeps the same sha256 layout on its own and the
read method uses the profile state directory the chat host is opened in.
* fix(mobile): keep visual lines out of the worktree row and copied message text
A reply's ::orca-visual line renders only in the transcript. The
worktree list's agent row and the message actions sheet's copy text now
drop it with the shared helper; a reply that is only a visual falls back
to the prompt, as an empty one does.
* fix(native-chat): review round 2 fixes; copy a reply without its visual lines
Reply previews in Agent Session History drop visual lines per text part before
lines are folded; the frame adds a body's overflow only when the body really
overflows; fence tracking follows CommonMark closers and openers; the copy
button copies a reply without visual lines; a coded read fault keeps its cause.
* fix(native-chat): update the frame's theme ref after render; read the visuals folder pair at once
* test(native-chat): declare agentSession.readVisual on the cross-version agent-session surface
* fix(native-chat): copying a reply keeps its code blocks and indentation
Removing visual lines now closes only the gap each removal leaves, instead of
collapsing blank lines across the whole reply and trimming its indentation; the
visuals folder is checked parent first again so a broken path answers the same
way every time.
expo-router's Stack on web renders native-stack's web view, which flips display and ignores animation. The page's host stack now keeps expo-router's StackRouter under its public Navigator and draws the slide with the Web Animations API; a popped screen stays mounted until it has slid out. Native is a pure move.
* fix(mobile): the update-mobile wall opens the exact release
When the in-app checker knows the newest release, the update-mobile wall
offers "Get Orca <version>" and opens that release's page instead of the
generic releases list or a hand-built App Store link. Mounting the wall
runs the single-flight, bounded checker once. Dismissal is ignored here.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): keep the update checker out of the page closure
The wall now takes the offered release as a prop and opens it through
the external-link seam. A shell-only hook runs the checker once per
update-mobile wall and supplies the release; MobileWebShellScreen, which
no page route reaches, wires it. HostProtocolGate is in every page
closure, so it stays unwired pending a ruling.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): platform-split the wall's release offer and throttle its check
The hook is the one module whose behaviour differs by platform: the native
file runs the checker, the .web.ts sibling offers nothing, so both
HostProtocolGate and MobileWebShellScreen wire it the same way and the
page closure never carries the checker. A remount checks only when no
release is known and the last check is absent or over the retry interval
old, since each check is an unauthenticated GitHub call.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): let the checker decide whether the wall's check is due
The hook's own throttle read lastCheckedAt, which moves only on success,
so after a failed lookup every wall remount looked up again, and before
preferences loaded a cold-start wall looked up despite a fresh stored
result. The checker already owns the cadence: checkIfDue waits for the
stored state and checks only past the retry or daily interval.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* fix(mobile): the wall reads the known release and triggers nothing
The started checker's own timer, cold-start and foreground paths already
run every due check, so a check requested by the wall could never be due.
The hook now only returns the known release; the checker is back to main.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
* refactor(mobile): the wall reads its release through useWallAppUpdate
The .web.ts sibling alone keeps the page closure clean, so the screen
calls the hook itself and the optional prop, the gate wiring and the
shell wiring go. HostProtocolGate and MobileWebShellScreen are back to
their base content.
Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
The shell no longer shortens the WebView for the keyboard; it publishes the keyboard height like the safe-area insets, so native's keyboard lift, refit hold and dismiss key run on the page unchanged. Keyboard and inset arithmetic read the shell's OS through a host-os seam. One page-version floor (manifest pageVersion, shell floor 1) replaces per-feature accept negotiation; a page below the floor gets the existing update wall, a desktop with no bundle keeps native screens. iOS shell drops the form accessory bar and its own keyboard observers. Native session screens untouched.
Neil
Kelvin Amoaba
Brennan BensonandGuderlilian
OrcaWinandOrcaWin
Jinwoo Hong
