mirror of
https://github.com/stablyai/orca.git
synced 2026-09-29 16:02:50 +00:00
Jinwoo-H
d156826131
The hybrid WebView required a recent native-observed touch before a bridge capability could run. A scroll armed the window, so it gated nothing an attacker on the first-party page could not already reach, and no peer hybrid framework (Capacitor, Cordova, RN WebView) gates bridge calls this way. Removes the gesture module, its React authority hook, the shared requirement and its census, and all 20 gate sites: native.alert, clipboard write, external link open, terminal text-scale and custom-key updates, dictation start and model management, account select and reset-credit consume, agent-history resume, terminal clipboard paste and image attach, navigation reconnect, removeHost and terminal-settings route, and both workspace-creation writes. Each operation now just runs. The AppState foreground reporting the gesture hook also carried moves to use-mobile-web-app-foreground-authority. permission_required stays in the bridge error enum: it parses inbound responses, so narrowing it would break a new page paired with an older shell. Drops the G3 gesture-window e2e probe and renames its runner to run-hosted-ios-webview-app-bound-probe.mjs, which keeps the app-bound probe. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb