196 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Yaojia Wang	e254918b1c	feat(android): native Android client — full app parity build (A1–A36 + S1) ... Mirror the iOS P0+P1 client as a Gradle multi-module app. Pure-JVM (Kover ≥80% gated): :wire-protocol (frozen contract + HostEndpoint CSWSH origin + byte-exact codec), :session-core (SessionEngine + reconnect/ping/gate/digest reducers), :api-client, :client-tls (pure PKCS12/keymanager), :transport-okhttp (OkHttp WS+REST). Framework: :app (Compose M3 Adaptive, Hilt, FCM, 11 screens + NavGraph), :terminal-view (Termux terminal-emulator/-view via JitPack, Apache-2.0 — the renderer seam proven headless), :host-registry (DataStore), :client-tls-android (AndroidKeyStore + Tink). Highlights: single-key-home mTLS (non-exportable AndroidKeyStore key + re-reading X509KeyManager + connectionPool.evictAll on rotation, ping-pong single-commit so a failed rotation never clobbers the prior identity); FCM Allow/Deny trust split (Deny=BroadcastReceiver, Allow=trampoline Activity hosting BiometricPrompt); per-consumer-Channel EventBus (R10); config-surviving RetainedSessionHolder; byte-exact KeyByteMap; §5.4 pairing warning tiers. Verified: ~484 JVM tests + Kover ≥80% on the pure modules + :app assembles to an APK; all framework modules assemble. Device behaviors (rendering/IME/FCM/biometric/camera, E2E A34/A35, S2 real-handset FCM spike) deferred to android/DEVICE_QA_CHECKLIST.md per plan §7 (no emulator/Firebase here). Built via multi-agent orchestration (TDD builders → adversarial cross-review → fix → re-verify → independent gate); progress in android/PROGRESS_ANDROID.md.	2026-07-10 16:41:21 +02:00
Yaojia Wang	542fde9580	feat(push): FCM sender + /push/fcm-token route for the Android client (A33) ... Mirror src/push/apns.ts behind the same NotifyService seam (combineNotifyServices), so held-gate/done hook events fan out to Android via data-only high-priority FCM with zero new event paths. OAuth2 bearer via google-auth-library (R7); payload minimized to sessionId/cls/token (never cwd/command/bytes); intentionally-loose FCM-token validator; Origin-guarded + rate-limited POST/DELETE /push/fcm-token; FCM_* env all-or-disabled. Cross-review fix: dropped validateStatus:()=>true so google-auth-library's built-in 401 refresh-and-retry actually fires. 60 new tests; full server suite green; tsc clean.	2026-07-10 16:40:43 +02:00
Yaojia Wang	e7f3bd05f0	feat(tunnel): zero-touch tunnel enrollment — control-plane PKI, host agent, iOS, nginx isolation ... Customers install one command / log in once; hardware-generated keys never leave the device; CSRs return certs + subdomain; frpc + base-app run as durable services. No .p12, no manual cert import. Implements the MVP fast-path of docs/PLAN_TUNNEL_AUTOMATION.md. Control-plane / PKI (control-plane/): - ca/x509-assembler.ts: single KMS-signed real X.509 issuance primitive (Ed25519 + P-256) - ca/csr-ec.ts: P-256 PKCS#10 proof-of-possession (verifyCsrPoPEc) + CSR-key routing - ca/frpclient-issue.ts, ca/device-issue.ts: P-256 frp-client + device leaf signers - ca/rotate.ts + api/renew.ts: real-X.509 /renew + /device/:id/renew (mTLS current cert) - registry/devices.ts: device registry + per-account cap/rate-limit - auth/session.ts: device:enroll capability token mint/verify - api/device-enroll.ts: POST /device/enroll (ownership-gated, deny-by-default) - pairing/native-redeem.ts + shared gateAndConsumePairingCode; api/provision.ts native arm - boot/native-ca.ts + main.ts: wire two P-256 CAs + issuers + routers (dev / KMS fail-fast) Contracts: relay-contracts enroll right; relay-auth SPIFFE /device/ arm + spiffeIdFor(kind) Host agent (agent/): - transport/frpcToml.ts; provision/frpcBinary.ts + untar.ts (verify-download + traversal-safe extract) - keys P-256 keygen/CSR/loadIdentity; service two-unit install + BIND_HOST loopback S-GATE - net/loopbackLiteral.ts strict guard; health/probe.ts + transport/frpSupervise.ts; cli pair --install iOS (ios/Packages/ClientTLS): SecureEnclaveKey + CertificateSigningRequest + DeviceEnrollmentClient + Keychain enroll refactor (SecKey/Security.framework end-to-end, avoids the -25300 trap) Isolation (deploy/nginx): njs/getCertSub.js SAN parser + zone-anchored map -> 403 Verified: 758 tests green (control-plane 246, agent 267, relay-auth 133, relay-contracts 85, iOS ClientTLS 27), all tsc clean; real nginx+njs docker 403/200/400; Swift CSR accepted by the real control-plane verifier; frpc extract byte-identical to `tar -xO`. Cross-validation caught + fixed 5 real defects (1 critical, 4 high). Remaining = infra (KMS, nginx deploy, VPS frps, physical iPhone) per PROGRESS_LOG runbook. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-10 16:11:13 +02:00
Yaojia Wang	31054450fc	docs: zero-touch tunnel enrollment automation plan (research + 3-track design + cross-validation) ... Multi-agent plan (11 agents, 70 web sources): fully automate cert enrollment so customers never handle certs/keys. Chosen: authenticated-CSR REST (k8s TLS-bootstrap model) + RFC 8628 device grant for host bootstrap; hardware keygen (Secure Enclave / Android Keystore) + CSR for clients; Model-A→B via dNSName-SAN==Host binding at nginx :8470 (njs) + per-tenant name-constrained intermediate CAs; short-lived certs + passive revocation. Reuses control-plane CA, S2 install tooling, iOS ClientTLS.	2026-07-08 18:57:19 +02:00
Yaojia Wang	4fe1981997	chore(android): install Android SDK + wire AGP 9.2.1 (toolchain proven) ... Android SDK installed on this machine (cmdline-tools via brew; platform-tools + platforms;android-35 + build-tools;35.0.0), local.properties points Gradle at it (gitignored). Wired AGP 9.2.1 into the version catalog + google() repos; proved the full chain by building a throwaway android-library module against SDK 35 (AAR produced), then removed the probe. Groundwork for AW2+: AGP plugins in the catalog, google() in settings, and the working recipe in README (incl. the AGP-9-has-built-in-Kotlin gotcha — Android modules apply ONLY the android plugin, never kotlin.android). Pure JVM modules still green (218 tests). Framework module stubs stay gated until implemented.	2026-07-08 17:37:54 +02:00
Yaojia Wang	7b3fe1b124	docs(progress): log Android client AW0+AW1 pure-Kotlin foundation (218 tests green)	2026-07-08 13:45:54 +02:00
Yaojia Wang	4ea8f7862a	feat(android): pure-Kotlin foundation — AW0 scaffold + AW1 modules (218 tests green) ... Implements the verifiable pure-Kotlin core of the Android client per docs/ANDROID_CLIENT_PLAN.md, mirroring the iOS SPM package set as Gradle modules. Built + reviewed via multi-agent workflow (explore→implement→verify→review), then review findings fixed with regression tests. Modules (all pure JVM, kotlin("jvm"); Android-framework modules scaffolded but gated off in settings — no Android SDK in this env): - :wire-protocol — frozen wire contract (sealed Client/ServerMessage, enums, HostEndpoint CSWSH origin derivation, transport interfaces), hand-rolled codec byte-identical to the server's JSON.stringify + tolerant kotlinx decode. - :session-core — ReconnectMachine (1→2→4→8→16→30 backoff), PingScheduler, GateTracker (two-line epoch guard), AwayDigest, UnreadLedger, TitleSanitizer, KeyByteMap (byte-matches public/keybar.ts). - :api-client — all REST routes, tolerant decode, Origin-iff-guarded, prefs unknown-key preservation, pairing probe + host-tier classifier. - :client-tls — pure half: PKCS#12 parse, X509KeyManager alias logic, CertificateSummary, provider-agnostic wrong-passphrase classification. - :test-support — FakeTransport / FakeHttpTransport / virtual-clock fakes. Verify: ./gradlew clean test → 218 tests, 0 failures (wire-protocol 47, session-core 60, api-client 69, client-tls 27, test-support 15). Review (3 lenses, 8/10 each) findings fixed: sessionId JSON-injection escape, CancellationException propagation in PingScheduler, PairingProbe close-on-cancel leak, HostEndpoint trim, HostClassifier hoisted to :wire-protocol (type unified), BouncyCastle-portable wrong-passphrase detection, lone-surrogate escaping. Known gap (documented, deferred): /push/fcm-token has no server route yet — plan task A33 (src/push/fcm.ts) delivers it.	2026-07-08 13:45:07 +02:00
Yaojia Wang	cf88e7c588	docs(android-plan): lock user decisions R1 (accept best-effort FCM) + R7 (use google-auth-library) ... R1: accept best-effort FCM background delivery as a documented limitation. R7: server FCM sender uses google-auth-library (not hand-rolled RS256). All three open questions (incl. R2 license) now decided; nothing blocks AW3/AW5.	2026-07-08 11:38:38 +02:00
Yaojia Wang	34e4a88059	docs: Android client implementation plan (multi-agent explore + review) ... Phased build spec for an Android client at functional parity with the iOS client. Produced by a multi-agent workflow: 10 iOS-subsystem explorers + 2 Android-tech researchers -> architect synthesis -> 4-lens adversarial review -> finalize. Mirrors the iOS SPM package set as Gradle modules; 36 tasks across waves AW0-AW6 with Owns/Depends/Verify, two de-risking spikes. R2 (Termux license) independently re-verified and downgraded Critical->Low: terminal-view/terminal-emulator are Apache-2.0 and on JitPack, not GPL-vendor. Open questions for the user: R1 (FCM background-delivery acceptance), R7 (FCM OAuth2 dependency).	2026-07-08 11:31:30 +02:00
Yaojia Wang	99cafdbdbb	docs(readme): update test count (~1470) + document login-shell PATH behavior ... Explains why hooks reliably find nvm/brew-managed node (shells spawn as login shells) and how to recover an old session with a stale PATH.	2026-07-07 21:10:40 +02:00
Yaojia Wang	57725f7ef2	test: fix pre-existing failures — localStorage polyfill + prefs shape drift ... - jsdom 29's localStorage methods are undefined under this vitest config, so every frontend test calling localStorage.clear()/setItem() threw. Add a shared in-memory Web Storage polyfill via setupFiles (no-op when a working Storage exists / in node env). Fixes quick-reply, push, projects-panel (135 tests). - Update desktop prefs test: defaultPrefs gained remoteHosts/selectedHostId (remote-host mTLS work); sync EXPECTED_DEFAULTS and the round-trip fixture. Full suite now green: 1473 passed (was 142 failing).	2026-07-07 21:09:49 +02:00
Yaojia Wang	fc3b849a08	fix(session): spawn PTY as login shell so hooks find nvm node ... Spawn the shell with -l (POSIX only) so it loads the full profile chain and rebuilds PATH. Without it, a shell spawned by a GUI-launched app or a long-lived tmux keepalive server inherits a minimal PATH, so nvm-managed node (only on the login PATH) is missing and Claude Code hooks fail with 'node: command not found'. PowerShell (Windows) has no -l; skipped there. Applies to both the tmux new-session command and the direct-spawn path.	2026-07-07 21:03:35 +02:00
Yaojia Wang	a24465623e	docs: LE wildcard cert live — native tunnel M2-ready (public trust verified, no -k)	2026-07-07 20:57:27 +02:00
Yaojia Wang	a25633a63b	docs: native tunnel M1 achieved on VPS (frps + device-CA mTLS + nginx :8470 + SNI merge)	2026-07-07 20:28:27 +02:00
Yaojia Wang	5b9ca321d2	docs(deploy): master deployment guide — today's work + full VPS→client mTLS-tunnel runbook	2026-07-07 16:16:24 +02:00
Yaojia Wang	cb04516d52	docs: log native mTLS reverse-tunnel — four tracks landed + two HIGH fixups	2026-07-07 09:43:35 +02:00
Yaojia Wang	d0c249c739	feat(agent): inject S0 env into launchd/systemd via install CLI (S2) ... - launchd writer emits <EnvironmentVariables>; systemd writer emits EnvironmentFile/Environment; originConfig zone parameterized (default 'term' preserved for relay callers). - InstallOptions threaded CLI install -> createCliDeps -> installService seam -> writers, so generated units carry BIND_HOST (defaults 127.0.0.1 for tunnel hosts), ALLOWED_ORIGINS, PORT, SHELL_PATH, IDLE_TTL, USE_TMUX. systemd rejects control chars in env values. Verified: agent typecheck+build clean; vitest 166/166 (154 baseline + 12 new).	2026-07-07 09:42:12 +02:00
Yaojia Wang	bb0949553c	feat(desktop): remote-host mode + OS-store client-cert mTLS (D-1/D-2) ... - remote-hosts.ts + DesktopPrefs (remoteHosts/selectedHostId, immutable, back-compat) + tray host-picker. - will-navigate lock is now dynamic to the selected remote origin, fails closed on null (no open-redirect). - select-client-certificate handler: event.preventDefault() first, pick by issuer CN, non-silent missing-cert dialog + cert-less callback -> clean nginx rejection (Chromium sources certs from OS store). Verified: npm run typecheck exit 0; pure-helper assertions pass.	2026-07-07 09:42:12 +02:00
Yaojia Wang	e38e6d1689	feat(ios): device client-cert mTLS — ClientTLS package, transport wiring, install UX (C-iOS) ... - ios/Packages/ClientTLS: SecIdentity wrapper, PKCS12 importer (typed errors), keychain store (AfterFirstUnlockThisDeviceOnly), pure MutualTLSChallengeResponder truth table, cross-platform X.509 DER summary. 14/14 tests. - Both transports (SessionCore URLSessionTermTransport, App URLSessionHTTPTransport) + SessionThumbnail take a lazy @Sendable ()->ClientIdentity? provider: WS resolves per-connect, HTTP per client-cert challenge, so a freshly-imported cert applies without an app relaunch. AppEnvironment injects { store.loadedIdentityOrNil() }. - ClientCertScreen (.fileImporter([.pkcs12]) + passphrase -> import -> keychain), reachable via a 设备证书 entry in SessionListScreen.hostMenu. PairingViewModel gates tunnel-host probes on cert presence and re-maps mTLS-reject to a clientCertRejected message. Verified: ClientTLS 14/14, SessionCore 93/93, xcodegen + xcodebuild BUILD SUCCEEDED.	2026-07-07 09:42:12 +02:00
Yaojia Wang	5337281e85	feat(deploy): device client-CA + issuance/revocation + frp/nginx mTLS templates (V2/V7) ... Committable VPS artifacts for the native reverse-tunnel (no live-ops, no secrets): - gen-device-ca.sh: EC P-256 self-signed device CA (CA:TRUE pathlen:0, keyCertSign+cRLSign), openssl ca db + empty CRL, idempotent, --kind frp-client scaffolds the control-channel CA. - issue-device-cert.sh: P-256 leaf, EKU=clientAuth only, 825d, emits .p12 (-legacy) + .pem/.key/.fullchain, copy_extensions=none prevents CSR-injected serverAuth/CA:TRUE; CN traversal guard. - revoke-device.sh: openssl ca revoke -> regenerate crl.pem (revocation enforced via -crl_check). - frp/{frps.toml.example,frpc.example.toml}: control-channel mTLS+token, disableCustomTLSFirstByte=true. - nginx/frp-mtls.conf: :8470 TLS-term, ssl_verify_client on + device-CA + ssl_crl, WS-upgrade proxy to :7080. - nginx/stream-sni-additions.md: the two additive SNI map lines (merge-only, coexistence-safe). Verified: gen->issue->openssl verify->revoke->CRL chain green in a tmp dir (OpenSSL 3.0.18).	2026-07-07 09:42:12 +02:00
Yaojia Wang	6b8269c1c1	docs: multi-tenant mTLS reverse-tunnel dev plan (VPS + server + native clients) ... Generated via multi-agent workflow (3 planners → adversarial review → synthesis). Covers frp tunnel on shared :443, mTLS device-cert auth, and client-cert implementation for iOS/Android/desktop. Trust Model A (single-owner fleet) for v1.	2026-07-07 08:00:40 +02:00
Yaojia Wang	c1c837c54f	fix(relay-run): buffer early ws frames in wsToWebSocketLike ... The message listener was attached only when the mux consumer called onMessage — which happens inside attach(), AFTER the async mTLS-registry lookup. On loopback the agent's FIRST heartbeat ping arrived in that gap and ws dropped it (no listener), so the agent's heartbeat died on the first miss at 15s and the tunnel flapped forever. Attach the listener at construction and buffer early frames (and an early close) until the consumer wires up.	2026-07-07 04:59:53 +02:00
Yaojia Wang	89678c7949	fix(relay-run): agent-TLS ca must be full chain (intermediate+root), not intermediate-only ... Node/OpenSSL rejects an agent client leaf whose only trust anchor is a non-self-signed intermediate (no PARTIAL_CHAIN flag) → every agent was reset at the TLS layer before attach(), surfacing as a silent 1006. Pass the full agent-ca bundle and stop swallowing tlsClientError.	2026-07-07 04:49:38 +02:00
Yaojia Wang	7af4a68ef5	fix(control-plane): encode enroll hostContentSecret as base64url (agent decodes base64url)	2026-07-06 21:50:08 +02:00
Yaojia Wang	6efed9772e	feat(control-plane): real X.509 agent leaf issuance (closes enrollment↔mTLS gap) ... - ca/issue.ts: real X.509 v3 Ed25519 leaf with SPIFFE URI SAN, signed by the intermediate; SAN built via relay-auth spiffeIdFor so it can't drift - ca/csr.ts: parse real PKCS#10 (agent's PEM) + async PoP verify; decodeCsrWire accepts PEM or base64(DER) - main.ts/env.ts: real issuer when CA_INTERMEDIATE_KEY_PATH present, else dev fallback - interop.test.ts: oracle proving relay-auth verifyAgentCert accepts the leaf (6 tests) - deps: @peculiar/x509, reflect-metadata	2026-07-06 20:46:01 +02:00
Yaojia Wang	1a8984e851	feat(deploy): staging bootstrap script + manage-token minter for Phase-1 VPS deploy	2026-07-06 19:37:58 +02:00
Yaojia Wang	d77f1ff62c	fix(relay-run): declare package deps for standalone deploy ... relay-run imported bare specifiers (control-plane/relay-auth/relay-contracts/relay-e2e/ term-relay + ws/pg/ioredis) with an empty package.json, relying on a hand-populated node_modules from local dev. Declare them (file: siblings + runtime deps + tsx) so 'npm install' resolves relay-run on a clean host.	2026-07-06 19:25:44 +02:00
Yaojia Wang	5e7e4b22f2	fix(ios): safe-area-inset clearance so tab-bar/key-bar don't obscure terminal ... viewport-fit=cover spans the physical screen edges; add --safe-t/--safe-b from env(safe-area-inset-*) threaded through #tabbar/#term/#keybar/#approvalbar/#searchbox/ #settingspanel. Falls back to 0px (zero regression on non-safe-area platforms).	2026-07-06 16:51:03 +02:00
Yaojia Wang	bfe1be1dfe	feat(relay): B7 — close browser DPoP-subprotocol loop + harden staging mint ... - Read DPoP proof from term.dpop.<b64u> WS subprotocol (browsers can't set WS headers); header wins, else subprotocol. Fail-closed decoder. Unblocks real browser connect. - F1: rate-limit /auth/mint per-IP via Redis token bucket (salted-hash key, 429 on burst, before password compare). - F2: wire real per-tenant active WS count into activeSessionCount (was hardcoded 0). - F5: scrub error logs to e.message/.code (no DSN leak, INV9). relay-run: tsc clean, 92 tests pass (+18). F3/F4 -> Phase 2 backlog.	2026-07-06 16:26:05 +02:00
Yaojia Wang	aa1912b962	feat(relay): Phase1 waves A2-E — server entry, shared-store data plane, agent runtime, deploy artifacts ... RELAY-PHASE1 Wave A2/B/C/D/E (12-agent workflow, all tsc-clean, 314/314 tests pass): - A2: control-plane server.ts entry + boot/redis.ts revocation-bus wiring + start script. - B1: relay-run shared-store EnforceDeps (relay-auth ports over the SAME Postgres+Redis as P3). - B2: registry-backed MtlsVerifier (verifyAgentCert, fail-closed, INV14). - B3: store-backed RouteResolver (subdomain->hostId). - B4: Redis relay:revocations subscriber -> tunnel teardown (INV12). - B5: main-phase1.ts production entry (public bind, real TLS, async-mTLS prefetch bridge) + staging /auth/mint. - B6 (PARTIAL): relay-web operator login + browser DPoP; proof offered via term.dpop.<b64u> subprotocol. - C: agent dist/cli.js build (esbuild) + runTunnel run-loop + CliDeps. - D1: same-origin static serve of relay-web/public from the browser WSS. - E: systemd units + gen-ca/gen-capability-key/issue-tls-cert scripts + deploy/RUNBOOK.md. Adversarial review: all hard invariants PASS. Follow-ups (B7): close DPoP-subprotocol read on browser-server (blocks browser connect); rate-limit /auth/mint (F1); wire activeSessionCount (F2); scrub error logs (F5). Excludes unrelated public/style.css (concurrent iOS job).	2026-07-06 16:13:34 +02:00
Yaojia Wang	95b9cccf07	feat(relay): Phase1 foundation — P3 Postgres store + async capability verifier + compose ... RELAY-PHASE1 Wave A (2/3) + E1 infra: - A1: createPgStores() Postgres adapter for all 9 P3 store ports + runMigrations(); writable-CTE atomic INV8 status swaps; 0002_routes.sql. 23/23 pg tests, 96.72% cov. - A3: real capability verifier delegating to relay-auth verifyCapabilityToken; sync->async seam across authz/provision/main. Full CP suite 15 files/101 pass, tsc clean. - E1: deploy/docker-compose.yml (Postgres16+Redis7, loopback-only) + .env.example. - docs: PLAN_RELAY_PHASE1.md file-level execution spec; PROGRESS_LOG RELAY-PHASE1 section.	2026-07-06 14:51:37 +02:00
Yaojia Wang	242a4e0dc1	docs: log Orbit icon rollout across iOS/desktop/tray/web + desktop repackage	2026-07-06 11:54:48 +02:00
Yaojia Wang	86d100a9ad	feat(icons): Orbit app icon + template tray icon across all clients ... New brand icon (Orbit — a node circling a block-cursor core, amber-gold on warm-dark, matching the desktop theme): - iOS: Assets.xcassets/AppIcon.appiconset (opaque 1024, was no icon) - desktop: resources/icon.png (rounded 1024 → .icns at package time) - desktop tray: trayTemplate.png/@2x — a proper macOS TEMPLATE (black shapes on transparent, system-tinted) replacing the old white blob - web: public/icon.svg (vector favicon/PWA) Master SVGs rendered with rsvg-convert.	2026-07-06 11:49:06 +02:00
Yaojia Wang	3492f0cf1f	fix(projects): drop parent folders; attribute sessions to the deepest project ... The projects panel listed bare parent folders (~, ~/Documents) as projects and a single session lit up every ancestor project's 'Active now'. dropParentFolders filters non-git entries that merely contain other listed projects; assignSessions attributes each live session to the DEEPEST containing project (detail page keeps prefix matching). +3 tests; projects 29/29, tsc clean. Frontend unchanged.	2026-07-06 11:00:45 +02:00
Yaojia Wang	d36deb6922	fix(ios): dark-appearance-first + readable dirty badge (gold-on-light contrast) ... Amber-gold accent is designed for the desktop's warm-dark background; on light mode gold text/badges wash out. Match the desktop (dark theme by default): .preferredColorScheme(.dark) at the root. DirtyBadge becomes a soft filled capsule (amber on amber-18%) instead of amber-on-quaternary, readable in any mode.	2026-07-06 08:10:34 +02:00
Yaojia Wang	a887638557	docs: document native clients — full iOS/iPad feature README + root Clients section ... ios/README: add a comprehensive Features section (P0 pocket cockpit, P1 walk-away complete, iPad adaptive split, design system, verification status); note min iOS 17, both-idiom test commands, P1 server touch-points. root README: add a Clients section covering the iOS/iPad app, desktop Electron shell, and the pre-production relay stack (with Tailscale as the remote-access path today).	2026-07-06 08:10:33 +02:00
Yaojia Wang	d01a69eb72	feat(ios): switch accent to desktop amber-gold theme (was indigo) ... Match the desktop/web theme (public/style.css): accent #E3A64A gold (dark) / #C9892F (light) replacing the indigo, +onAccent #1A1305 dark ink for gold-fill buttons, +accentSoft. Status colors realigned to the web warm palette (#46D07F/#F5B14C/#FF6B6B). Terminal canvas fixed to the desktop warm-dark (#100F0D bg / #ECE9E3 fg) with gold caret/selection. DSButtonStyle primary now uses onAccent (dark) instead of white for contrast on gold. All via the single accent token + DS palette — no scattered edits. Verified: iPhone 16 290 + iPad Pro 11 290 tests green (DesignSystemTests assert the exact gold + web-status RGB in both schemes).	2026-07-06 07:25:32 +02:00
Yaojia Wang	c44725618c	docs(ios): log comprehensive UX/UI polish (design system, 8.5/10, 290 tests both sims)	2026-07-05 22:01:27 +02:00
Yaojia Wang	660a40491a	feat(ios): comprehensive iPhone+iPad UX polish — refined-native design system ... Freeze a shared design system (DesignSystem/{Tokens,Typography,StatusStyle, Primitives}.swift): indigo #7C8CFF accent (root .tint), semantic status colors, 2-4-8-12-16-20-24 spacing + sm8/md12/lg16 radii scale, SF Mono tabular numbers, reduce-motion-gated animations, haptics, reusable StatusBadge/TelemetryChip/Card/ SectionHeader/DSButtonStyle/ContinueLastBanner. Every changed view consumes tokens — no hardcoded colors/spacing. Applied across all surfaces (visual only — zero behavior/logic change, all suites green): session list rows + status system (shape+color, not color-alone) + telemetry chips + thumbnail placeholders; terminal gate card (≥44pt approve/reject) + keybar + reconnect + quick-reply + digest + SwiftTerm accent theme; pairing hero + warning tiers + Projects cards + Timeline/Diff; nav chrome + iPad split placeholder + privacy shade + motion. Chinese gate copy. UX finding fixed: timeline class colors now via DS.Palette (+timelineTool/timelineUser tokens). Design review 8.5/10. Verified: iPhone 16 290 + iPad Pro 11 290 tests green; packages + integration green; consistency audit ~clean; zero changes under ios/Packages, src/, public/.	2026-07-05 22:00:31 +02:00
Yaojia Wang	823432b1c8	feat(ipad): W1-W3 — adaptive split-view layout + finding fixes ... T-iPad-2: AdaptiveRootView/LayoutPolicy (sole size-class decision), SplitRootView (NavigationSplitView sidebar+detail), StackRootView (iPhone path verbatim, zero regression); privacy shade hoisted to shared ZStack top for both branches T-iPad-3: KeyBarVisibility predicate (hide when hardware keyboard present), pointer context menu (copy/new-in-cwd/kill, all via existing channels) T-iPad-4: Projects multi-column grid on iPad (idiom-gated), adaptive sheet detents T-iPad-5 findings (4/4 fixed): kill onKillSession thread-through + AppCoordinator.killCurrentSession; split route-gated to .sessions (iPad first-run pairing); continue-last banner in split sidebar; iPad XCUITest deferred (covered by SidebarSelectionTests) Verified: iPhone 16 277 + iPad Pro 11 278 tests green; packages 261 + integration 10; zero changes under ios/Packages, src/, public/	2026-07-05 19:58:30 +02:00
Yaojia Wang	77502ec4fe	feat(ipad): T-iPad-1 — device family [1,2] + iPad orientations + CI leg ... Opens WebTerm to iPhone + iPad: TARGETED_DEVICE_FAMILY 1→1,2 (project + all targets), iPad gets all four orientations (~ipad key), ios.yml gains an ipad-tests leg (iPad Pro 11 sim). Built plist verified UIDeviceFamily [1,2]; app launches natively full-screen on iPad Pro 11 sim (no letterbox). Adaptive layout (NavigationSplitView) lands in T-iPad-2. Plan: docs/PLAN_IOS_IPAD.md.	2026-07-05 18:29:30 +02:00
Yaojia Wang	9c0097a305	docs(ios): P1 complete — T-iOS-30 acceptance + security re-audit both PASS (zero findings) ... Part A: 261 pkg + 247 app + 10 integration re-run green; boot-crash fix re-verified (3 launches, 0 crashes, permission prompt reached); simctl push renders minimized WEBTERM_GATE banner; F-iOS-15 server-slice (distinct lastOutputAt) executed; old-server compat degradation verified against the user's live 127.0.0.1:3000 (no unread dot, stuck red dot, correct meta) Part B: APNs payload minimization holds; capability token clean end-to-end (validate→use→never persisted→single-use→zero in logs); deep-link 50+ fuzz all safe; lock-screen .authenticationRequired green; prefs empty-base guard intact; P1-B attack surface swept clean P1 total: 518 automated checks + server 1470 green; server changed only at the 2 declared §0.3 touch-points. Real-device/APNs items DEFERRED (need device + paid account)	2026-07-05 16:42:50 +02:00
Yaojia Wang	f40b8f9400	feat(ios): P1-B — W7 UI wave: deep links, timeline, quick-reply, diff, projects, session switcher, thumbnails, lock-screen push ... T-iOS-22: DeepLinkRouter (full-field whitelist, cold-start stash, route(from:) for push-tap reuse), 21 tests T-iOS-24: TimelineSheet mirroring web render() order; disabled→empty-state; reuses AwayDigest onExpand T-iOS-25: QuickReply chips (built-ins mirror quick-reply.ts via KeyByteMap; visible iff live gate && !readOnly) T-iOS-27: read-only DiffScreen + App-layer DiffFetcher (RO no-Origin; APIClient fold-in noted for T-iOS-38 owner) T-iOS-26: Projects list/detail — grouping byte-identical to web group keys (prefs-shared collapse state), prefs-clobber defenses (no blind PUT on empty base; adopt server echo), claude\r bootstrap T-iOS-23: UnreadLedger + TitleSanitizer (SessionCore, +15 tests), lastOutputAt decode, list-boundary re-sanitize T-iOS-29: new-in-cwd (untrusted cwd, no bootstrap re-injection) + exited-session reopen; fixes stale-controller SwiftTerm view bug via .id(controller.id) T-iOS-28: offscreen SwiftTerm thumbnail pipeline (LRU 32, concurrency gate 2, 256KiB cap, grid clamp) T-iOS-21: PushRegistrar (WEBTERM_GATE category: Allow=.authenticationRequired, no .foreground) + NotificationActionHandler (whitelisted payload, token never persisted, bg-task-wrapped POST, 403 fallback) CRITICAL fix (verify-found boot crash): @Sendable literals on UN completion closures — MainActor-inherited closures trapped Swift 6 executor check on UN's background queue; boot re-verified (no new crash reports, permission prompt reached, privacy shade correctly covering during system alert) Verified: 261 pkg + 247 app + 10 integration tests green; 7/7 semantics checks; Owns audit clean	2026-07-05 16:15:57 +02:00
Yaojia Wang	4871e8ac3d	feat(ios): P1-A — server touch-points (lastOutputAt, APNs sender+token endpoint) + APIClient P1 contract ... T-iOS-37: LiveSessionInfo.lastOutputAt additive-optional field + manager.list() mapping (+4 tests; web consumers unaffected) T-iOS-20: src/push/apns.ts — env-gated (all-or-disabled, no crash, zero key-material logging), hand-rolled ES256 JWT (node:crypto ieee-p1363, zero new deps), NEEDS-INPUT/DONE payloads with structural minimization, token store per subscription-store conventions, combineNotifyServices parallel to web-push, POST/DELETE /push/apns-token per frozen wire shape (G-guard, 5/min/IP, 8kb); 65 tests incl. dual-channel e2e vs local fake APNs T-iOS-38: APIClient builders — apns-token (client-side hex mirror, pre-network reject), projects/detail (lossy decode, single-point percent-encoding), prefs (unknown-key byte-exact round-trip preservation), public four-tier HostNetworkTier Coordination: webterminal:// CFBundleURLTypes pre-registered in project.yml for T-iOS-22 Verified: root 1470 tests + tsc clean; APIClient 76 tests, 95.26% coverage; wire-shape cross-check zero mismatches	2026-07-05 13:34:01 +02:00
Yaojia Wang	aa956fcbb4	feat(ios): W5 acceptance + finding fixes — XCUITest happy path, CI legs, privacy/device-family hardening ... T-iOS-18 (F-iOS-1..13 walkthrough) + T-iOS-19 (security audit vs built artifacts): both PASS_WITH_FINDINGS, 0 CRITICAL/HIGH; real-device items DEFERRED with manual checklists. Fixes (1 MED + 3 LOW, all closed): - WebTermUITests: the single scripted happy path (manual-entry pair → list → attach → KeyBar ^L → injected held gate via POST /hook/permission → tap Approve → server-side behavior==allow assertion). Green twice locally (fresh + already-paired branches). - ios.yml: ui-test leg (server boot + TEST_RUNNER_ env as PROCESS env) + iOS17-floor leg (loud-skip if runtime absent, hard-fail if present and red); dropped CODE_SIGNING_ALLOWED=NO from app-tests leg (unsigned hosts get -34018 from the real keychain — measured) - URLSessionHTTPTransport defaults to .ephemeral (no disk cache of preview terminal bytes) - TARGETED_DEVICE_FAMILY moved to target level (built plist now UIDeviceFamily [1] only) Final: 306 automated checks green (214 pkg + 76 app + 10 integration + XCUITest); server src/ untouched; P0 complete (19/19 tasks)	2026-07-05 02:16:52 +02:00
Yaojia Wang	cc4d3129cc	feat(ios): W4 app wiring — DI graph, event fan-out, lifecycle, privacy shade ... T-iOS-15: AppEnvironment production DI (real Keychain/probe/transports), EventFanOut (engine.events → TerminalVM + GateVM + activity bridge), scenePhase lifecycle (.background→close, suspend→rebuild+reopen reclaims size), privacy shade on != .active, spike screen deleted, cold-start routing Walkthrough proxies: hosted live-server smoke over the production DI graph (probe→store→ attach→echo→close) + real-Keychain kSecAttrAccessible assertion (closes T-iOS-7 deferral) Deviation closed: TerminalViewModel.lastSentDims (valid-only) + alive-engine .active → notifyForegrounded(dims:) (orchestrator fix on behalf of T-iOS-11 owner) Env finding: repo under ~/Documents → TCC blocks sim-spawned node; SimServerHarness dual-mode (self-bootstrap / WEBTERM_SERVER_URL via simctl launchctl setenv) Verified: 214 pkg + 76 app + 10 integration tests green; verify agent 8/8 PASS	2026-07-05 01:04:42 +02:00
Yaojia Wang	5098643355	feat(ios): W3 UI layer + integration CI + ntfy docs ... T-iOS-11: TerminalScreen/KeyBar/TerminalViewModel + KeyByteMap (byte-for-byte keybar.ts, arrows excluded from UIKeyCommand to preserve DECCKM) T-iOS-12: PairingScreen/VM — confirm-before-network (zero-call assertions), §5.4 four-tier warnings, Host construction per contract ruling T-iOS-13: SessionListScreen/VM — Tunables-paced polling with leak-free teardown, optimistic kill+rollback, pending via overlay (LiveSessionInfo has no pending field) T-iOS-14: GateBanner/PlanGateSheet/AwayDigestView/GateViewModel — three-way mapping from SessionCore Affordance single source, tap-epoch guard, per-epoch haptics T-iOS-16: IntegrationTests vs real Node server (10 tests: origin guards, mirror, kill-close vs exit-frame differential, 16MiB+ESC/C0 replay) + ios.yml own-sources coverage gate (red-once demoed) T-iOS-17: ios/README.md ntfy chapter (read-only verification, file:line cites) Verified: 224 unit + 10 integration tests green; 5/5 semantic spot-checks; zero Owns violations	2026-07-05 00:13:14 +02:00
Yaojia Wang	5c8c87fb7a	chore(ios): add WebTermTests unit-test bundle target (W3 coordination point) ... project.yml gains a bundle.unit-test target hosted by the app, wired to all 5 local packages (TestSupport test-doubles included) so T-iOS-11..14 VM tests run via xcodebuild test. Coverage gate still counts only the 4 packages (§9).	2026-07-04 23:00:11 +02:00
Yaojia Wang	a2b14ab6e7	feat(ios): W2 connection core — URLSessionTermTransport + SessionEngine actor ... T-iOS-9: TermTransport impl (Origin single-source, 16MiB from Tunables, re-arm loop, EMSGSIZE(40)/ENOBUFS(55)→typed replayTooLarge, delegate-driven state, RFC6455 scripted test server), 11 tests T-iOS-10: SessionEngine actor (attach-first ordering, generation guard, terminal states never backoff, exactly-once digest, gate canDecide second line, defensive input validation), 20 tests Verified: 209 tests green across 5 packages; SessionCore own-src coverage 96.68%; 4/4 semantic invariants audited in source; frozen contracts untouched	2026-07-04 22:55:56 +02:00
Yaojia Wang	95438cdc12	feat(ios): W1 leaf packages — ReconnectMachine/PingScheduler, GateState/AwayDigest, HostRegistry, APIClient+pairing probe ... T-iOS-5: pure reconnect reducer (1s→30s cap, mirrors terminal-session.ts) + 25s PingScheduler, 16 tests T-iOS-6: gate epoch tracker (rising-edge semantics, canDecide guard) + AwayDigest reducer, 25 tests T-iOS-7: HostRegistry with SecItemShim keychain seam, 30 tests, 88.1% own-src coverage T-iOS-8: APIClient (Origin iff-G invariant) + two-step pairing probe, 45 tests, 98.1% coverage Contract ruling: probe returns Result<HostEndpoint,_> (Host{id,name} built by pairing VM) — resolves frozen-contract contradiction reported via BLOCKED protocol; adds Tunables.pairingProbeTimeout(10s) Verified: 178 tests green across 5 packages; coverage gates pass; zero Owns violations	2026-07-04 21:53:41 +02:00