Sync feedback: Mobile runtime, clipboard, and model fixes

.github/workflows/ci.yml

@@ -34,20 +34,37 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Check out pro submodule (private; skipped on open-core forks)
-        # When the PRO_SUBMODULE_PAT secret is present (this org's CI), pull the private pro/
-        # submodule so the pro-dependent suites run against the REAL package — a green run then
-        # actually exercises pro, not a stub. It also matters to the other gates: tsc sees
-        # __tests__/pro/* importing @offgrid/pro/* (TS2307 without it), and knip/depcruise need it
-        # or their reachability graph is incomplete and reports false orphans. Forks without the
-        # secret skip this: proExists=false and jest runs the open-core suite instead.
+      # Pull the private pro/ so the pro-dependent suites run against the REAL package — a green run
+      # then actually exercises pro, not a stub. It also matters to the other gates: tsc sees
+      # __tests__/pro/* importing @offgrid/pro/* (TS2307 without it), and knip/depcruise need it or
+      # their reachability graph is incomplete and reports false orphans. Forks without the secret skip
+      # this: proExists=false and jest runs the open-core suite instead.
+      #
+      # An explicit checkout of the MATCHING branch, not `git submodule update --init`. The submodule
+      # pointer is deliberately a pin - it records which pro revision a core commit was verified against
+      # - but a pin is the wrong thing for CI to test: a coordinated core+pro change would run this
+      # branch's core against whatever commit the pointer happens to hold, so the two halves of one
+      # change are never seen together. Matching branch first, main as the fallback, exactly as the
+      # shared checkout below and as OGAD does it.
+      - name: Check out the matching pro branch
         if: ${{ env.PRO_SUBMODULE_PAT != '' }}
-        env:
-          PRO_PAT: ${{ env.PRO_SUBMODULE_PAT }}
-        run: |
-          git config --global url."https://x-access-token:${PRO_PAT}@github.com/".insteadOf "https://github.com/"
-          git submodule update --init --recursive pro
-          git config --global --unset url."https://x-access-token:${PRO_PAT}@github.com/".insteadOf || true
+        id: pro_branch
+        continue-on-error: true
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/mobile-pro
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: pro
+          ref: ${{ github.head_ref || github.ref_name }}
+          persist-credentials: false
+      - name: Fall back to pro main
+        if: ${{ env.PRO_SUBMODULE_PAT != '' && steps.pro_branch.outcome != 'success' }}
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/mobile-pro
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: pro
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -117,6 +134,10 @@ jobs:
           # reads src/, but tsc and metro read dist/). rag was never built at all before.
           npm --prefix ../shared/packages/sync run build
           npm --prefix ../shared/packages/rag run build
+          # speech too. It is a file: dep like the other two and six src files import it, but it was
+          # never built here - so every gate failed on "Cannot find module '@offgrid/speech'" (1966
+          # errors in one run) long before it reached anything real.
+          npm --prefix ../shared/packages/speech run build
 
       - name: Install dependencies
         id: install

.gitignore

@@ -77,6 +77,7 @@ fastlane/*.p8
 
 # testing
 /coverage
+/.artifacts
 
 # Yarn
 .yarn
@@ -94,3 +95,6 @@ docs/DEVICE_SESSION_COMMENTARY.md
 
 # Device wire-capture logs (raw, large, session-specific — kept locally, not versioned)
 docs/wire-captures/
+
+# Scratch renders derived from scripts/e2e/fixtures (regenerable, not versioned)
+/tmp/

App.tsx

@@ -17,6 +17,7 @@
 import { useAppStore, useAuthStore, useRemoteServerStore, useWhisperStore } from './src/stores';
 import { useDebugLogsStore } from './src/stores/debugLogsStore';
 import { initDebugLogFile, appendDebugLine } from './src/utils/debugLogFile';
+import { startStartupMemoryProbe } from './src/services/startupMemoryProbe';
 import { loadProFeatures } from './src/bootstrap/loadProFeatures';
 import { hydrateDownloadStore } from './src/services/downloadHydration';
 import { initActiveDownloadPersistence } from './src/services/activeDownloadPersistence';
@@ -56,6 +57,10 @@
   logger.warn = tap('warn');
   logger.error = tap('error');
   initDebugLogFile();
+  // Immediately after the sink exists, so the first sample lands before anything heavy runs. The app
+  // was being killed by iOS at launch with the log going silent half a second in; this says where it
+  // stops and what memory was doing when it did.
+  startStartupMemoryProbe();
 }
 
 const ensureRemoteServerStoreHydrated = async () => {
@@ -193,17 +198,19 @@
       await modelManager.reconcileFinishedImageDownloads(activeImageModelIds).catch((error) => {
         logger.error('[App] Image model reconciliation failed:', error);
       });
+      logger.log('[BOOT] refresh model lists');
       const { textModels, imageModels } = await modelManager.refreshModelLists();
       setDownloadedModels(textModels);
       setDownloadedImageModels(imageModels);
     })().catch((error) => {
       logger.error('[App] Download-state recovery failed:', error);
     });
   }, [setDownloadedModels, setDownloadedImageModels]);
 
   const initializeApp = useCallback(async () => {
     try {
       // Ensure persisted download metadata is loaded before restore logic reads it.
+      logger.log('[BOOT] app store hydrate');
       await ensureAppStoreHydrated();
 
       // Project the persisted "aggressive model loading" setting onto the residency
@@ -220,16 +227,19 @@
 
       // Phase 1: Quick initialization - get app ready to show UI
       // Initialize hardware detection
+      logger.log('[BOOT] device info');
       const deviceInfo = await hardwareService.getDeviceInfo();
       setDeviceInfo(deviceInfo);
 
       const recommendation = hardwareService.getModelRecommendation();
       setModelRecommendation(recommendation);
 
       // Initialize model manager and load downloaded models list
+      logger.log('[BOOT] modelManager.initialize');
       await modelManager.initialize();
 
       // Clean up any mmproj files that were incorrectly added as standalone models
+      logger.log('[BOOT] cleanup mmproj entries');
       await modelManager.cleanupMMProjEntries();
 
       // Scan for any models that may have been downloaded externally or
@@ -243,6 +253,7 @@
 
       // Ensure remote server store is hydrated before initializing providers,
       // so getServers() / activeServerId reads see persisted data.
+      logger.log('[BOOT] remote server hydrate');
       await ensureRemoteServerStoreHydrated();
 
       // Initialize remote server providers in the background — don't block
@@ -252,6 +263,7 @@
       });
 
       // Check if passphrase is set and lock app if needed
+      logger.log('[BOOT] auth passphrase check');
       const hasPassphrase = await authService.hasPassphrase();
       if (hasPassphrase && authEnabled) {
         setLocked(true);
@@ -265,12 +277,14 @@
         // read, then activate only the capabilities that entitlement permits.
         // loadProFeatures separately projects cached credential access from a
         // Debug developer unlock; Sync reconciliation owns device admission.
+        logger.log('[BOOT] load pro features');
         await loadProFeatures();
       } catch (proError) {
         logger.error('[App] Pro feature load failed, continuing without Pro:', proError);
       }
 
       // Show the UI immediately
+      logger.log('[BOOT] startup complete');
       setIsInitializing(false);
 
       // Reconcile downloaded Whisper models against disk at startup. presentModelIds

__tests__/hardening/batch3-documentAttach.test.ts

@@ -21,29 +21,31 @@
  * does not exhaustively assert.
  */
 
-import RNFS from 'react-native-fs';
+import { defaultNativeFileSystemBoundary } from '../harness/nativeFileSystem';
+
+jest.mock('react-native-fs', () => {
+  const { defaultNativeFileSystemBoundary: boundary } = require('../harness/nativeFileSystem');
+  return { __esModule: true, default: boundary.module, ...boundary.module };
+});
 
 jest.mock('../../src/services/pdfExtractor', () => ({
   pdfExtractor: { isAvailable: jest.fn(() => false), extractText: jest.fn() },
 }));
 
 import { documentService } from '../../src/services/documentService';
 
-const rnfs = RNFS as jest.Mocked<typeof RNFS>;
-
-/** Make RNFS behave as if `content` is a readable file of `size` bytes. */
-function stubReadableFile(content: string, size = content.length): void {
-  rnfs.exists.mockResolvedValue(true);
-  rnfs.stat.mockResolvedValue({ size, isFile: () => true } as any);
-  rnfs.readFile.mockResolvedValue(content);
-  rnfs.copyFile.mockResolvedValue(undefined as any);
-  rnfs.mkdir.mockResolvedValue(undefined as any);
-  rnfs.unlink.mockResolvedValue(undefined as any);
+/** Put one readable file on the fake device, with independent stored bytes and reported metadata. */
+function seedReadableFile(
+  path: string,
+  content: string,
+  size = content.length,
+): void {
+  defaultNativeFileSystemBoundary.seedTextFile(path, content, size);
 }
 
 describe('Batch3 · document attach validation (real documentService)', () => {
   beforeEach(() => {
-    jest.clearAllMocks();
+    defaultNativeFileSystemBoundary.reset();
   });
 
   // ── #14/#15/#2 + csv/code: the full supported accept-set ───────────────────
@@ -62,7 +64,7 @@
     });
 
     it.each(acceptedNames)('processDocumentFromPath() builds a document attachment for %s', async (name) => {
-      stubReadableFile('sample body', 11);
+      seedReadableFile(`/docs/${name}`, 'sample body', 11);
       const att = await documentService.processDocumentFromPath(`/docs/${name}`, name);
       expect(att).not.toBeNull();
       expect(att!.type).toBe('document');
@@ -84,7 +86,6 @@
     });
 
     it('processDocumentFromPath() throws an "Unsupported file type" error for .docx (no chip is added)', async () => {
-      stubReadableFile('ignored');
       await expect(
         documentService.processDocumentFromPath('/docs/report.docx', 'report.docx'),
       ).rejects.toThrow(/Unsupported file type/);
@@ -94,14 +95,14 @@
   // ── #13: oversized (>5MB) file rejected with a visible error ────────────────
   describe('oversized files are rejected (#13)', () => {
     it('rejects a file at 5MB + 1 byte with a "too large" error', async () => {
-      stubReadableFile('x', 5 * 1024 * 1024 + 1);
+      seedReadableFile('/docs/huge.txt', 'x', 5 * 1024 * 1024 + 1);
       await expect(
         documentService.processDocumentFromPath('/docs/huge.txt', 'huge.txt'),
       ).rejects.toThrow(/too large/i);
     });
 
     it('accepts a file exactly at the 5MB boundary', async () => {
-      stubReadableFile('ok', 5 * 1024 * 1024);
+      seedReadableFile('/docs/limit.txt', 'ok', 5 * 1024 * 1024);
       const att = await documentService.processDocumentFromPath('/docs/limit.txt', 'limit.txt');
       expect(att).not.toBeNull();
     });
@@ -120,8 +121,8 @@
   // service); per hardening rules we do NOT edit src, so the correct-behavior
   // assertion is skipped and the actual (buggy) behavior is pinned below.
   describe('URL-encoded filename display decode (#17)', () => {
     it.skip('BUG-FOUND: display fileName should be decoded (my%20notes.txt -> "my notes.txt")', async () => {
-      stubReadableFile('body');
+      seedReadableFile('/docs/my%20notes.txt', 'body');
       const att = await documentService.processDocumentFromPath(
         '/docs/my%20notes.txt',
         'my%20notes.txt',
@@ -130,8 +131,8 @@
       expect(att!.fileName).toBe('my notes.txt');
     });
 
     it.skip('pins ACTUAL behavior: the display fileName is returned un-decoded (documents the bug) — SKIP: do not enshrine the bug as passing; see the desired-behavior skip above', async () => {
-      stubReadableFile('body');
+      seedReadableFile('/docs/my%20notes.txt', 'body');
       const att = await documentService.processDocumentFromPath(
         '/docs/my%20notes.txt',
         'my%20notes.txt',
@@ -143,9 +144,12 @@
     it('resolves the file even when the PATH is URL-encoded (path decode works)', async () => {
       // The path decode DOES happen (resolveContentUri), so a file whose path
       // carries %20 still reads without error — the attach itself succeeds.
-      stubReadableFile('decoded path body');
+      seedReadableFile(
+        '/mock/documents/my notes.txt',
+        'decoded path body',
+      );
       const att = await documentService.processDocumentFromPath(
-        '/docs/my%20notes.txt',
+        '/mock/documents/my%20notes.txt',
         'my%20notes.txt',
       );
       expect(att).not.toBeNull();
@@ -156,14 +160,14 @@
   // ── #34/#35: multiple document attachments queue as distinct attachments ────
   describe('multiple document attachments queue (#34, #35)', () => {
     it('produces two distinct attachments with unique ids for two files', async () => {
-      stubReadableFile('py body');
+      seedReadableFile('/docs/a.py', 'py body');
       const first = await documentService.processDocumentFromPath('/docs/a.py', 'a.py');
 
       // Advance the clock so the second attachment gets a different id (id is Date.now()).
       const nowSpy = jest.spyOn(Date, 'now');
       const base = Date.now();
       nowSpy.mockReturnValue(base + 5);
-      rnfs.readFile.mockResolvedValue('ts body');
+      seedReadableFile('/docs/b.ts', 'ts body');
       const second = await documentService.processDocumentFromPath('/docs/b.ts', 'b.ts');
       nowSpy.mockRestore();