eleven / messenger Public

🤖 Native apps: app-host protocol phases 0–1 (web bridge + space installs survive natively) (#1256)

* docs+web: native apps as first-class app-platform clients — design + app-host protocol phase 0

The design brief (docs/native-apps.md): the native apps must recognise and
use ANY app in a space — built-in, admin custom, or member-built — with zero
per-app native code. It maps the platform contract a client implements, the
honest state of native today (three parallel subsystems, ~10 drifting per-app
lookup tables, no space-thread support at all), traces each user-visible
breakage to its root cause, and lays out the target architecture (AppRegistry
/ app-host protocol / registry-driven surfaces) in six small phases. No
server changes anywhere — the platform is already client-folded by design.

Phase 0 ships here, web-side (the part the native phases decode):
- appCatalogReport() in apps.js — every registered app's manifest facts
  (identity, places, presentation contract, commands) as plain JSON
- window.lchatNative.appCatalog() / commandItems() on the embed bridge — the
  catalogue and the per-thread commandCatalog rows, pull-based for
  evaluateJavaScript
- embeds now answer apps_changed with a {catalogChanged} post (native owns
  reloads) instead of falling through to the web reload banner
- test/appcatalog.test.mjs pins the shapes against the real framework

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AWjr7oU3uxP1RYCtB1qU6Y

* native: space-wide installs survive on iOS/Mac — SpaceApps fold + store (app-host phase 1)

Phase 1 of docs/native-apps.md, all in LChatCore + thin socket wiring:

- SpaceApps.swift — the pure fold half of the web's spaceapps registry
  (installsApp), GroupApps' twin one level up: Item carries the installer's
  uid (the admins-only policy filters by it at read time), parseSnapshot
  reads the unified "installs" snapshot key with the legacy "spaceapps"
  fallback. SpaceAppsVectorTests transcribes all 6 vectors from
  test/event-vectors/spaceapps.json plus horizon/order/wire-decode pins.
- SpaceAppsStore.swift — fetches GET /api/space-thread, unwraps open_key
  under the INSTANCE key (the existing OpenKeyPayload envelope), seeds from
  the encrypted slot-"apps" snapshot, pages the catch-up, folds live
  msg/delete frames, and parks the folded list in the Keychain per origin
  (the ThreadListSnapshot posture) — so kill + relaunch still lists a
  space's installs, offline included.
- AppCatalog.swift — AppManifest decodes appCatalogReport() (phase 0's
  bridge report) losslessly + per-origin Keychain persistence;
  AppCatalogTests is the Swift half of the contract test/appcatalog.test.mjs
  pins on the web side. Feed wiring (webview pull on {catalogChanged})
  lands with the registry consumers in phase 2.
- ChatSocket.Frame gains `kind` (apps_changed's payload); both platform
  sidebar sockets route space_thread prods and the space thread's own
  frames to the store (that thread never appears in /api/threads, so a
  refresh would learn nothing about it).
- GroupApps.parseSnapshot bug fix in passing: it read only the legacy
  "groupapps" key, so a slot-"apps" snapshot written by a current web
  client (unified "installs" key) seeded NOTHING natively — group installs
  only survived while old-key snapshots lingered.

swift test: 349 pass (15 new); Mac + iOS app targets build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>