eleven / messenger Public

🤖 Native apps phase 2: one AppRegistry (lands #1268) (#1314)

* native: one AppRegistry — the lookup tables collapse, surfaces route from it (app-host phase 2)

Phase 2 of docs/native-apps.md: every "what is this app / where can it
live / how does it present" question becomes a registry read.

- Seed catalogue: tools/gen-app-catalog.mjs emits appCatalogReport() for
  every built-in app as ios/.../Seed/app-catalog.json (bundled, decoded by
  AppRegistry); test/appcatalog-seed.test.mjs drift-gates the committed
  seed against the live framework, the schema-copy shape. appstudio needs
  a DOM at module scope so the seed omits it (live pulls carry it).
  appCatalogReport() gains `blurb` (the app's one-line subtitle — the
  field ThreadStore.appDescriptions had been hand-mirroring).
- AppRegistry (LChatCore, per-origin): bundled seed ← persisted Keychain
  catalogue ← live reports, later winning per app. Answers titles/glyphs/
  blurbs, picker lists (personal/group/space), the install read-filter
  (known/knownSpace — place-aware, so folded installs of apps a client
  can't surface stay inert), and presentation(id) → flow | schema |
  companion(defaultView, chatOnly, chatReadOnly) | takeover.
- Live pulls: iOS WebBridge, Mac MacWebBridge, and the Mac command host
  pull window.lchatNative.appCatalog() when a page reports ready and
  re-pull (forced) on {catalogChanged} — so a space's custom and member
  apps register the first time any webview opens and stay current.
- Tables collapsed: ThreadStore.appTitles/appGlyphs/appDescriptions/
  personalApps, GroupApps.catalog+known, NativeChatView.companionApps,
  and the intros-as-companion-gate (iOS ChatView) are gone; GroupApps
  keeps only a nonisolated title map for chat projections until phase 5.
- Routing fixes that fall out: Admin gets Chat|View on the Mac and opens
  as its console on iOS (takeover/companion defaultView honoured in the
  FeedWebCache seed — the hard-coded view:"chat" was the bug); the
  whiteboard is addable to groups and passes the install filter (the old
  4-app catalog filtered it inert); unknown/custom apps appear with
  glyph+title everywhere instead of blanks.
- Pickers from the registry: Mac NewChatPopover (personal + group), iOS
  NewGroupView, GroupAppsSheet — and iOS gains the personal Apps section
  in New chat (Mac/web parity; iOS had no personal-apps picker at all).

swift test: 354 pass (6 new registry tests); npm test green (new seed
drift gate); Mac + iOS app targets build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native+web: pickers honour the connected-service gate (requiresService)

Field feedback (James, 2026-07-23): the native New-chat picker showed
GitHub/DNSimple/HubSpot/Linear/Stripe while the web correctly hides them
until their service is linked — the web's matchingApps gates on the app
spec's `requiresService` against GET /api/connected, and the manifest
never carried the field, so the registry pickers over-showed.

- appCatalogReport() gains `requiresService` ("" = ungated); seed
  regenerated; field pinned in test/appcatalog.test.mjs.
- AppRegistry holds the space's connectedServices set (updateConnected)
  and the picker lists filter gated apps against it — hidden until the
  set names the service, exactly the web's "no flash of a not-yet-usable
  app" rule. Missing field (a pre-bridge server's report) reads as
  ungated, preserving that server's behaviour.
- ThreadStore fetches /api/connected on refresh, throttled to once a
  minute (refresh refires on every socket frame).

swift test: 364 pass (1 new gate test); npm pins green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native: routing asks presentation(), not the bare companion flag

Field feedback (James, 2026-07-23): Eleven's welcome thread rendered as a
Chat|Split|View companion on the Mac — two copies of the same conversation
side by side. setup/welcome are chatOnly companions in the manifest, and
the Mac feed's isCompanion checked the bare flag BEFORE the flow branch
(the old {todo, remind} set never matched them).

isCompanion now asks registry.presentation(), which already encodes the
precedence: flow wins, schema surfaces split per their companion flag, and
a chat-only companion has no interface to split with. iOS's ChatView
toggle gets the same chatOnly guard (its flow routing was already first).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native: the group-apps filter refolds when the catalogue learns an app

Field feedback (James, 2026-07-23): a member app deployed mid-session
stayed invisible in a group's app switcher even after the registry learned
it — the read-time install filter (registry.known) only re-ran on fold
events, so a fresh install surfaced only when the next unrelated event
happened to arrive. ChatFeedModel now watches the registry's manifests and
refolds. Plus AppRegistry.invalidateLiveReport(), the hook the next phase
wires to apps_changed frames.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native: picker filters match the web exactly — `listed` was never the rule

Field feedback (James, 2026-07-23): a member app with places:["chat"]
showed in the web's Manage Apps but never natively. The web's pickers
gate on places alone — personalApps() is places∋you, groupCapableApps()
is places∋chat — and `listed` feeds a DIFFERENT surface (the Apps
directory). Member apps rarely set it, so the registry's extra listed
gate hid them from every native picker.

Also: GroupAppsSheet observes the registry in its own right — the
catalogue can learn an app while the sheet is open (the apps_changed
pull), and the model only publishes fold changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native+web: add flows fire an app's openEvent — the board stops adding empty

Field feedback (James, 2026-07-23): Whiteboard added from the NATIVE Apps
sheet mounted its pane but rendered nothing, web and native alike. The
board gates its content behind board.open (state.open); the web's
installGroupApp fires that openEvent right after the add, and native's
add paths never did — "silently present but empty", as board.js's own
comment warns.

openEvent joins the manifest report (+seed, +pin); sendGroupAppEvent and
the new-group seeding both fire it after groupapps.add, exactly like the
web.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native: catalogue decode is per-record tolerant, and the pull path logs

Field feedback (James, 2026-07-23): freshly deployed apps still not
reaching the native pickers even with the reload chain firing (verified
live — the host reloads and reports ready on apps_changed). Two hardening
moves to pin down and survive the failure:
- decode(reportJSON:) drops a malformed manifest instead of failing the
  whole array — one odd member-app record must not silently poison the
  entire catalogue.
- the pull and the registry update log their outcome (report size, app
  count, or why nothing landed), so the next field report can say which
  link broke instead of "never appeared".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native: pin the per-record-tolerant decode contract in AppCatalogTests

The tolerant decode (one malformed manifest drops alone) changed the
malformed-record case from nil to []; the test now pins exactly that —
undecodable INPUT still reads as "no report".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native: AppIdentity is decoration only — unknown apps wear their glyph

Field feedback (James, 2026-07-23): member apps in the Mac New-chat
picker (and every avatar surface) showed the generic grid symbol instead
of their emoji — symbol(for:) defaulted to "square.grid.2x2" for any app
outside its hand-kept table, and avatars let the symbol win over the
glyph. Per the registry design (docs/native-apps.md Layer 1), AppIdentity
is decoration keyed by registry id with the MANIFEST GLYPH as the
universal fallback: symbol(for:) now returns nil for unknown apps, and
every avatar call site already passes the glyph. The iOS menu call sites
keep their explicit grid default (Labels drop non-image icons there).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native+web: apps declare their own native chrome — AppIdentity's tables die

Field direction (James, 2026-07-23): the chrome icons must be defined
WHOLLY in the apps' JS, never hard-coded natively. The web already worked
that way (each spec carries its Lucide `logo`); only native kept twin
tables (AppIdentity.symbols/marks) to drift.

- Each first-party app's spec declares its native chrome beside its web
  logo: `symbol:` (the SF Symbols name) or `mark:` (the vendored template
  asset) — 17 specs updated; appCatalogReport carries both (+seed, +pin).
- AppIdentity becomes a pure RENDERER: a locked decoration snapshot the
  registry pushes on every catalogue load (seed at init, live reports
  after; merged so several spaces coexist). Only assets that actually
  ship in Marks/ render — a hostile mark name falls back to the glyph.
- ThreadStore.hydrate touches the registry before the first rows publish,
  so cold-start rows wear their chrome instead of flashing emoji.

swift test: 365 pass (1 new decoration pin); npm green (seed regenerated).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* native+web: any app may declare BOTH an emoji glyph and an SF symbol

Field direction (James, 2026-07-23): member apps must not be second-class
in native chrome — an app can declare `symbol:` (SF Symbols name) beside
its emoji glyph, exactly like a built-in, and wear it in native rows and
menus.

- The sandbox manifest accepts an optional `symbol` (validated: dotted
  lowercase, bounded) and the proxy carries it into the registry/report.
  `mark` stays deliberately OFF the member-app surface — naming a vendored
  brand asset would wear another product's logo.
- AppIdentity resolves the declared name against the OS (cached) and falls
  back to the glyph when it can't — a typo'd symbol never renders blank.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>