feat(ios): add experimental SwiftUI client

[t3dotgg]

T3 Code's shipped mobile client is React Native. This experiment adds a standalone native SwiftUI client so the team can try its feel, performance, and connection workflows without replacing any existing surface.

The app lives entirely in apps/swift-ios, speaks the existing server contracts directly, and installs side by side as T3 Code (SwiftUI) with bundle ID com.t3tools.t3code.swiftui.

Try it

1. Open apps/swift-ios/T3Code.xcodeproj in Xcode.
2. Select the T3Code scheme and an iOS 17+ simulator or device.
3. Build and pair with an existing T3 Code server using its URL and code, pairing link, or QR code.

See apps/swift-ios/README.md for architecture, included functionality, and known gaps.

What to test

• Pairing, onboarding, and multiple environments
• Web V2 home behavior with large thread collections
• Message-first thread creation and model selection
• Long Markdown transcripts, composer states, approvals, and input requests
• Image attachments, reconnect behavior, project tools, and terminal sessions

Preview

Home	Thread

Verification

• 245 native simulator tests passed, 0 failed, 1 skipped

• Repeated A to B to C to A long-thread navigation verified against an isolated real-data snapshot

• Latest build compiled, installed, and launched on an iPhone 17 Pro simulator

• Signed latest build installed on Big O and DevPhone15; automatic launch deferred because both devices were locked

• Remove DO NOT MERGE only after explicit maintainer approval

This PR was built by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

High Risk
Adds a new native client with Clerk auth, DPoP, relay tokens, and managed-environment credentials—security-sensitive paths that must stay aligned with packages/contracts and server behavior.

Overview
Introduces a standalone native SwiftUI iOS app under apps/swift-ios that talks to T3 servers directly (separate from the React Native app in apps/mobile), with its own Xcode project, dev identity (T3 Swift Dev / t3code-swiftui-dev), and side-by-side install.

Adds T3 Connect cloud plumbing in Swift: Clerk session handling, device-bound DPoP signing, relay HTTP client, managed-environment token exchange, and runtime authorization wired into the native connection stack.

Contributor and agent docs now treat mobile as two clients—AGENTS.md, test-t3-mobile, test-t3-app, and ios-debugger-agent spell out when to build Metro/React Native vs native SwiftUI and warn against cross-client verification.

Adds CI via .github/workflows/swift-ios.yml: checks generated Swift wire fixtures (generate-swift-wire-fixtures.ts --check) and runs apps/swift-ios/Scripts/ci-test.sh on macOS when apps/swift-ios or contracts change.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add experimental native SwiftUI iOS client with widgets, share extension, and T3 Connect

• Introduces a full native SwiftUI iOS app under apps/swift-ios/ with core transport (WebSocket RPC, HTTP), pairing/T3 Connect DPoP auth, and a NativeFeatureClient composing all feature surfaces
• Adds SwiftUI screens for threads, composer, workspace, settings, connections, devices, usage, source control, reviews, files, and terminal (backed by GhosttyKit)\n- Ships WidgetKit extensions (recent-tasks widget + Live Activity) and a Share Services extension that stages shared text/images/files into a shared-inbox via the app group container
• Includes an extensive test suite covering wire contracts, transport reliability, pairing, usage, Markdown, voice input, attachments, and platform features
• Adds CI workflow (swift-ios.yml), wire-fixture generator (scripts/generate-swift-wire-fixtures.ts), and device install scripts
• Risk: this is a large new codebase with no backward-compatibility surface; the T3Code.xcodeproj embeds Widget and Share extensions whose app-group identifier depends on the T3CODE_APP_GROUP_IDENTIFIER build setting being correctly configured per environment

^{Macroscope summarized 459cc4e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 355f5cdf-7ba6-4194-ae4f-03b732623002

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a full SwiftUI iOS client with new transport, persistence, terminal, sharing, widget, notification, and T3 Connect authentication capabilities. Its broad runtime surface and changed product defaults, including access and notification behavior, require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Provider logo follow-up

Replaced the generic CPU and initial badges with the repository's official OpenAI, Claude, Cursor, Grok, and OpenCode SVG artwork. The same driver-keyed component now covers model rows, model configuration, settings/new-task controls, and the compact composer trigger. Unknown custom providers retain the initial fallback.

Before	After

OpenAI and OpenCode rendering:

Verification:

• Focused model-picker tests: 8 passed, 0 failed
• Simulator build and visual inspection passed
• Signed build installed and launched on DevPhone15

Commit: 8792d15f5

[t3dotgg]

Mobile interaction polish

This pass replaces the generic home-row sparkle with the resolved harness mark, keeps the latest transcript content visible when the software keyboard changes the viewport, makes keyboard dismissal immediate, constrains long thread headers, and reduces mobile prompt controls to model + reasoning in the composer and Automatic / Full access in the thread menu.

Previous home	Harness-aware home

Previous thread	Keyboard-pinned composer

Verification:

• 23 focused simulator tests passed, 0 failed
• Simulator build, software-keyboard transition, menu contents, title constraints, and composer layout inspected
• Signed 04ccb7a9c build installed and launched on DevPhone15

Commits: 5ab663449 through 04ccb7a9c

[cursor]

Stub models block image attachments

Medium Severity

ThreadComposerProviderCatalog injects a saved model as FeatureModel(id:name:) with default supportsImages of false. DailyUXModelOptions.supportsImages then treats that stub as authoritative whenever any discovered sibling model advertises images, so the thread composer disables attachments and blocks send for custom or temporarily undiscovered models. Previously a missing catalog entry fell through to the permissive unknown-model path.

^{Reviewed by Cursor Bugbot for commit 9d3d8d5. Configure here.}

[cursor]

DPoP proofs encode null ath

High Severity

Token-exchange DPoP proofs leave ath nil, and the synthesized Encodable payload writes "ath": null. The shared verifier treats ath as an omitted string key, so those proofs fail as malformed. Relay and environment token exchange both mint proofs without an access token, so T3 Connect cannot complete authorization against the real server.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectManagedAuthorization.swift#L99-L100
• apps/swift-ios/App/Cloud/T3ConnectRelayClient.swift#L307-L308

^{Reviewed by Cursor Bugbot for commit 1a59936. Configure here.}

[cursor]

Sign-out loses in-flight token refresh

High Severity

refreshCredential only registers credential(forEnvironmentID:) as an in-flight authorization operation. After that returns, descriptor fetch and DPoP token exchange keep running outside waitForAuthorizationOperations(). Sign-out can finish, revoke managed state, then the refresh completes and a later persist can reinstall a usable managed credential.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectCapability.swift#L233-L270
• apps/swift-ios/App/NativeFeatureClient.swift#L328-L341

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Onboarding succeeds while environment is down

Medium Severity

pair fails when the installed snapshot is disconnected, but setEnvironmentEnabled and T3 Connect handleConnect do not. Enabling a saved environment or completing a managed connect still reports success after a failed shell load, so onboarding can advance for an unreachable computer.

Additional Locations (2)

• apps/swift-ios/Features/Connection/ConnectionOnboardingView.swift#L622-L636
• apps/swift-ios/Features/Connection/T3ConnectView.swift#L354-L366

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Retry skips a fresh thread snapshot

Medium Severity

loadThread always calls retainActiveThread before the warm-resume gate, so Retry on an already-open thread writes a fresh threadResumeStates entry and then takes that path. The failed snapshot is not refetched until ensureDetailCatchUpFallback waits another catchUpDelay.

Additional Locations (2)

• apps/swift-ios/App/NativeFeatureClient.swift#L3617-L3629
• apps/swift-ios/Features/Chat/ThreadDetailView.swift#L541-L545

^{Reviewed by Cursor Bugbot for commit 7f6e659. Configure here.}

[cursor]

Workspace refresh omits provider instance

High Severity

refreshProviders sends cwd without instanceId. The server only loads a workspace snapshot when both are present, so this call runs a full provider refresh and never stores skills or slash commands for the current workspace. Thread and new-task composers therefore keep the machine catalog, or an empty one after another workspace snapshot exists.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2024-L2031

^{Reviewed by Cursor Bugbot for commit e706cdc. Configure here.}

[cursor]

Provider setup UI stays stale

Medium Severity

Sign-in, sign-out, install, and remove only store the returned event. The account and runtime controls still read provider.authStatus and provider.isInstalled, which stay stale until a manual catalog refresh. A finished sign-in can show Sign in again, and Sign in can stay disabled after a successful install.

Additional Locations (1)

• apps/swift-ios/Features/Settings/ProviderSetupView.swift#L111-L132

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

HTML file preview never runs

Low Severity

The new html/htm media-preview check sits inside the image, PDF, video, and document branch. FeatureFilePreviewKind.infer classifies those extensions as .source, so that branch never runs and HTML files still load as text instead of a media preview.

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

There are 50 total unresolved issues (including 47 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Preference saves can wipe catalogs

High Severity

updateServerPreferences fetches a full serverConfig for the capability check, then saveServerPreferences ignores it and rebuilds the cached snapshot from serverConfigsByEnvironmentID. A missing cache entry stores empty providers and publishes that snapshot, so changing an icon or shared preference can clear the model catalog until another refresh.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2142-L2150

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Mismatches miss uncached settings

Medium Severity

serverPreferences returns settings from the network without storing them, while sharedPreferenceMismatches only reads serverConfigsByEnvironmentID. After a cache miss the Preferences screen shows the loaded values but an empty difference list, so “Use this environment’s preferences” never appears until something else writes the cache.

Additional Locations (1)

• apps/swift-ios/Features/Settings/EnvironmentPreferencesView.swift#L76-L81

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Work-log icons drop later

Low Severity

Each work-log activity assigns toolPresentation from the current payload or that tool’s stored presentation, and a miss writes nil. A later generic tool therefore erases an earlier browser or computer icon, so the grouped work-log header loses its mark after ordinary file or command updates.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[t3dotgg]

T3 Code's shipped mobile client is React Native. This experiment adds a standalone native SwiftUI client so the team can try its feel, performance, and connection workflows without replacing any existing surface.

The app lives entirely in apps/swift-ios, speaks the existing server contracts directly, and installs side by side as T3 Code (SwiftUI) with bundle ID com.t3tools.t3code.swiftui.

Try it

1. Open apps/swift-ios/T3Code.xcodeproj in Xcode.
2. Select the T3Code scheme and an iOS 17+ simulator or device.
3. Build and pair with an existing T3 Code server using its URL and code, pairing link, or QR code.

See apps/swift-ios/README.md for architecture, included functionality, and known gaps.

What to test

• Pairing, onboarding, and multiple environments
• Web V2 home behavior with large thread collections
• Message-first thread creation and model selection
• Long Markdown transcripts, composer states, approvals, and input requests
• Image attachments, reconnect behavior, project tools, and terminal sessions

Preview

Home	Thread

Verification

• 245 native simulator tests passed, 0 failed, 1 skipped

• Repeated A to B to C to A long-thread navigation verified against an isolated real-data snapshot

• Latest build compiled, installed, and launched on an iPhone 17 Pro simulator

• Signed latest build installed on Big O and DevPhone15; automatic launch deferred because both devices were locked

• Remove DO NOT MERGE only after explicit maintainer approval

This PR was built by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

High Risk
Adds a new native client with Clerk auth, DPoP, relay tokens, and managed-environment credentials—security-sensitive paths that must stay aligned with packages/contracts and server behavior.

Overview
Introduces a standalone native SwiftUI iOS app under apps/swift-ios that talks to T3 servers directly (separate from the React Native app in apps/mobile), with its own Xcode project, dev identity (T3 Swift Dev / t3code-swiftui-dev), and side-by-side install.

Adds T3 Connect cloud plumbing in Swift: Clerk session handling, device-bound DPoP signing, relay HTTP client, managed-environment token exchange, and runtime authorization wired into the native connection stack.

Contributor and agent docs now treat mobile as two clients—AGENTS.md, test-t3-mobile, test-t3-app, and ios-debugger-agent spell out when to build Metro/React Native vs native SwiftUI and warn against cross-client verification.

Adds CI via .github/workflows/swift-ios.yml: checks generated Swift wire fixtures (generate-swift-wire-fixtures.ts --check) and runs apps/swift-ios/Scripts/ci-test.sh on macOS when apps/swift-ios or contracts change.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add experimental native SwiftUI iOS client with widgets, share extension, and T3 Connect

• Introduces a full native SwiftUI iOS app under apps/swift-ios/ with core transport (WebSocket RPC, HTTP), pairing/T3 Connect DPoP auth, and a NativeFeatureClient composing all feature surfaces
• Adds SwiftUI screens for threads, composer, workspace, settings, connections, devices, usage, source control, reviews, files, and terminal (backed by GhosttyKit)\n- Ships WidgetKit extensions (recent-tasks widget + Live Activity) and a Share Services extension that stages shared text/images/files into a shared-inbox via the app group container
• Includes an extensive test suite covering wire contracts, transport reliability, pairing, usage, Markdown, voice input, attachments, and platform features
• Adds CI workflow (swift-ios.yml), wire-fixture generator (scripts/generate-swift-wire-fixtures.ts), and device install scripts
• Risk: this is a large new codebase with no backward-compatibility surface; the T3Code.xcodeproj embeds Widget and Share extensions whose app-group identifier depends on the T3CODE_APP_GROUP_IDENTIFIER build setting being correctly configured per environment

^{Macroscope summarized 459cc4e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 355f5cdf-7ba6-4194-ae4f-03b732623002

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a full SwiftUI iOS client with new transport, persistence, terminal, sharing, widget, notification, and T3 Connect authentication capabilities. Its broad runtime surface and changed product defaults, including access and notification behavior, require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Provider logo follow-up

Replaced the generic CPU and initial badges with the repository's official OpenAI, Claude, Cursor, Grok, and OpenCode SVG artwork. The same driver-keyed component now covers model rows, model configuration, settings/new-task controls, and the compact composer trigger. Unknown custom providers retain the initial fallback.

Before	After

OpenAI and OpenCode rendering:

Verification:

• Focused model-picker tests: 8 passed, 0 failed
• Simulator build and visual inspection passed
• Signed build installed and launched on DevPhone15

Commit: 8792d15f5

[t3dotgg]

Mobile interaction polish

This pass replaces the generic home-row sparkle with the resolved harness mark, keeps the latest transcript content visible when the software keyboard changes the viewport, makes keyboard dismissal immediate, constrains long thread headers, and reduces mobile prompt controls to model + reasoning in the composer and Automatic / Full access in the thread menu.

Previous home	Harness-aware home

Previous thread	Keyboard-pinned composer

Verification:

• 23 focused simulator tests passed, 0 failed
• Simulator build, software-keyboard transition, menu contents, title constraints, and composer layout inspected
• Signed 04ccb7a9c build installed and launched on DevPhone15

Commits: 5ab663449 through 04ccb7a9c

[cursor]

Stub models block image attachments

Medium Severity

ThreadComposerProviderCatalog injects a saved model as FeatureModel(id:name:) with default supportsImages of false. DailyUXModelOptions.supportsImages then treats that stub as authoritative whenever any discovered sibling model advertises images, so the thread composer disables attachments and blocks send for custom or temporarily undiscovered models. Previously a missing catalog entry fell through to the permissive unknown-model path.

^{Reviewed by Cursor Bugbot for commit 9d3d8d5. Configure here.}

[cursor]

DPoP proofs encode null ath

High Severity

Token-exchange DPoP proofs leave ath nil, and the synthesized Encodable payload writes "ath": null. The shared verifier treats ath as an omitted string key, so those proofs fail as malformed. Relay and environment token exchange both mint proofs without an access token, so T3 Connect cannot complete authorization against the real server.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectManagedAuthorization.swift#L99-L100
• apps/swift-ios/App/Cloud/T3ConnectRelayClient.swift#L307-L308

^{Reviewed by Cursor Bugbot for commit 1a59936. Configure here.}

[cursor]

Sign-out loses in-flight token refresh

High Severity

refreshCredential only registers credential(forEnvironmentID:) as an in-flight authorization operation. After that returns, descriptor fetch and DPoP token exchange keep running outside waitForAuthorizationOperations(). Sign-out can finish, revoke managed state, then the refresh completes and a later persist can reinstall a usable managed credential.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectCapability.swift#L233-L270
• apps/swift-ios/App/NativeFeatureClient.swift#L328-L341

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Onboarding succeeds while environment is down

Medium Severity

pair fails when the installed snapshot is disconnected, but setEnvironmentEnabled and T3 Connect handleConnect do not. Enabling a saved environment or completing a managed connect still reports success after a failed shell load, so onboarding can advance for an unreachable computer.

Additional Locations (2)

• apps/swift-ios/Features/Connection/ConnectionOnboardingView.swift#L622-L636
• apps/swift-ios/Features/Connection/T3ConnectView.swift#L354-L366

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Retry skips a fresh thread snapshot

Medium Severity

loadThread always calls retainActiveThread before the warm-resume gate, so Retry on an already-open thread writes a fresh threadResumeStates entry and then takes that path. The failed snapshot is not refetched until ensureDetailCatchUpFallback waits another catchUpDelay.

Additional Locations (2)

• apps/swift-ios/App/NativeFeatureClient.swift#L3617-L3629
• apps/swift-ios/Features/Chat/ThreadDetailView.swift#L541-L545

^{Reviewed by Cursor Bugbot for commit 7f6e659. Configure here.}

[cursor]

Workspace refresh omits provider instance

High Severity

refreshProviders sends cwd without instanceId. The server only loads a workspace snapshot when both are present, so this call runs a full provider refresh and never stores skills or slash commands for the current workspace. Thread and new-task composers therefore keep the machine catalog, or an empty one after another workspace snapshot exists.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2024-L2031

^{Reviewed by Cursor Bugbot for commit e706cdc. Configure here.}

[cursor]

Provider setup UI stays stale

Medium Severity

Sign-in, sign-out, install, and remove only store the returned event. The account and runtime controls still read provider.authStatus and provider.isInstalled, which stay stale until a manual catalog refresh. A finished sign-in can show Sign in again, and Sign in can stay disabled after a successful install.

Additional Locations (1)

• apps/swift-ios/Features/Settings/ProviderSetupView.swift#L111-L132

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

HTML file preview never runs

Low Severity

The new html/htm media-preview check sits inside the image, PDF, video, and document branch. FeatureFilePreviewKind.infer classifies those extensions as .source, so that branch never runs and HTML files still load as text instead of a media preview.

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

There are 50 total unresolved issues (including 47 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Preference saves can wipe catalogs

High Severity

updateServerPreferences fetches a full serverConfig for the capability check, then saveServerPreferences ignores it and rebuilds the cached snapshot from serverConfigsByEnvironmentID. A missing cache entry stores empty providers and publishes that snapshot, so changing an icon or shared preference can clear the model catalog until another refresh.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2142-L2150

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Mismatches miss uncached settings

Medium Severity

serverPreferences returns settings from the network without storing them, while sharedPreferenceMismatches only reads serverConfigsByEnvironmentID. After a cache miss the Preferences screen shows the loaded values but an empty difference list, so “Use this environment’s preferences” never appears until something else writes the cache.

Additional Locations (1)

• apps/swift-ios/Features/Settings/EnvironmentPreferencesView.swift#L76-L81

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Work-log icons drop later

Low Severity

Each work-log activity assigns toolPresentation from the current payload or that tool’s stored presentation, and a miss writes nil. A later generic tool therefore erases an earlier browser or computer icon, so the grouped work-log header loses its mark after ordinary file or command updates.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[t3dotgg]

T3 Code's shipped mobile client is React Native. This experiment adds a standalone native SwiftUI client so the team can try its feel, performance, and connection workflows without replacing any existing surface.

The app lives entirely in apps/swift-ios, speaks the existing server contracts directly, and installs side by side as T3 Code (SwiftUI) with bundle ID com.t3tools.t3code.swiftui.

Try it

1. Open apps/swift-ios/T3Code.xcodeproj in Xcode.
2. Select the T3Code scheme and an iOS 17+ simulator or device.
3. Build and pair with an existing T3 Code server using its URL and code, pairing link, or QR code.

See apps/swift-ios/README.md for architecture, included functionality, and known gaps.

What to test

• Pairing, onboarding, and multiple environments
• Web V2 home behavior with large thread collections
• Message-first thread creation and model selection
• Long Markdown transcripts, composer states, approvals, and input requests
• Image attachments, reconnect behavior, project tools, and terminal sessions

Preview

Home	Thread

Verification

• 245 native simulator tests passed, 0 failed, 1 skipped

• Repeated A to B to C to A long-thread navigation verified against an isolated real-data snapshot

• Latest build compiled, installed, and launched on an iPhone 17 Pro simulator

• Signed latest build installed on Big O and DevPhone15; automatic launch deferred because both devices were locked

• Remove DO NOT MERGE only after explicit maintainer approval

This PR was built by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

High Risk
Adds a new native client with Clerk auth, DPoP, relay tokens, and managed-environment credentials—security-sensitive paths that must stay aligned with packages/contracts and server behavior.

Overview
Introduces a standalone native SwiftUI iOS app under apps/swift-ios that talks to T3 servers directly (separate from the React Native app in apps/mobile), with its own Xcode project, dev identity (T3 Swift Dev / t3code-swiftui-dev), and side-by-side install.

Adds T3 Connect cloud plumbing in Swift: Clerk session handling, device-bound DPoP signing, relay HTTP client, managed-environment token exchange, and runtime authorization wired into the native connection stack.

Contributor and agent docs now treat mobile as two clients—AGENTS.md, test-t3-mobile, test-t3-app, and ios-debugger-agent spell out when to build Metro/React Native vs native SwiftUI and warn against cross-client verification.

Adds CI via .github/workflows/swift-ios.yml: checks generated Swift wire fixtures (generate-swift-wire-fixtures.ts --check) and runs apps/swift-ios/Scripts/ci-test.sh on macOS when apps/swift-ios or contracts change.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add experimental native SwiftUI iOS client with widgets, share extension, and T3 Connect

• Introduces a full native SwiftUI iOS app under apps/swift-ios/ with core transport (WebSocket RPC, HTTP), pairing/T3 Connect DPoP auth, and a NativeFeatureClient composing all feature surfaces
• Adds SwiftUI screens for threads, composer, workspace, settings, connections, devices, usage, source control, reviews, files, and terminal (backed by GhosttyKit)\n- Ships WidgetKit extensions (recent-tasks widget + Live Activity) and a Share Services extension that stages shared text/images/files into a shared-inbox via the app group container
• Includes an extensive test suite covering wire contracts, transport reliability, pairing, usage, Markdown, voice input, attachments, and platform features
• Adds CI workflow (swift-ios.yml), wire-fixture generator (scripts/generate-swift-wire-fixtures.ts), and device install scripts
• Risk: this is a large new codebase with no backward-compatibility surface; the T3Code.xcodeproj embeds Widget and Share extensions whose app-group identifier depends on the T3CODE_APP_GROUP_IDENTIFIER build setting being correctly configured per environment

^{Macroscope summarized 459cc4e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 355f5cdf-7ba6-4194-ae4f-03b732623002

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a full SwiftUI iOS client with new transport, persistence, terminal, sharing, widget, notification, and T3 Connect authentication capabilities. Its broad runtime surface and changed product defaults, including access and notification behavior, require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Provider logo follow-up

Replaced the generic CPU and initial badges with the repository's official OpenAI, Claude, Cursor, Grok, and OpenCode SVG artwork. The same driver-keyed component now covers model rows, model configuration, settings/new-task controls, and the compact composer trigger. Unknown custom providers retain the initial fallback.

Before	After

OpenAI and OpenCode rendering:

Verification:

• Focused model-picker tests: 8 passed, 0 failed
• Simulator build and visual inspection passed
• Signed build installed and launched on DevPhone15

Commit: 8792d15f5

[t3dotgg]

Mobile interaction polish

This pass replaces the generic home-row sparkle with the resolved harness mark, keeps the latest transcript content visible when the software keyboard changes the viewport, makes keyboard dismissal immediate, constrains long thread headers, and reduces mobile prompt controls to model + reasoning in the composer and Automatic / Full access in the thread menu.

Previous home	Harness-aware home

Previous thread	Keyboard-pinned composer

Verification:

• 23 focused simulator tests passed, 0 failed
• Simulator build, software-keyboard transition, menu contents, title constraints, and composer layout inspected
• Signed 04ccb7a9c build installed and launched on DevPhone15

Commits: 5ab663449 through 04ccb7a9c

[cursor]

Stub models block image attachments

Medium Severity

ThreadComposerProviderCatalog injects a saved model as FeatureModel(id:name:) with default supportsImages of false. DailyUXModelOptions.supportsImages then treats that stub as authoritative whenever any discovered sibling model advertises images, so the thread composer disables attachments and blocks send for custom or temporarily undiscovered models. Previously a missing catalog entry fell through to the permissive unknown-model path.

^{Reviewed by Cursor Bugbot for commit 9d3d8d5. Configure here.}

[cursor]

DPoP proofs encode null ath

High Severity

Token-exchange DPoP proofs leave ath nil, and the synthesized Encodable payload writes "ath": null. The shared verifier treats ath as an omitted string key, so those proofs fail as malformed. Relay and environment token exchange both mint proofs without an access token, so T3 Connect cannot complete authorization against the real server.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectManagedAuthorization.swift#L99-L100
• apps/swift-ios/App/Cloud/T3ConnectRelayClient.swift#L307-L308

^{Reviewed by Cursor Bugbot for commit 1a59936. Configure here.}

[cursor]

Sign-out loses in-flight token refresh

High Severity

refreshCredential only registers credential(forEnvironmentID:) as an in-flight authorization operation. After that returns, descriptor fetch and DPoP token exchange keep running outside waitForAuthorizationOperations(). Sign-out can finish, revoke managed state, then the refresh completes and a later persist can reinstall a usable managed credential.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectCapability.swift#L233-L270
• apps/swift-ios/App/NativeFeatureClient.swift#L328-L341

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Onboarding succeeds while environment is down

Medium Severity

pair fails when the installed snapshot is disconnected, but setEnvironmentEnabled and T3 Connect handleConnect do not. Enabling a saved environment or completing a managed connect still reports success after a failed shell load, so onboarding can advance for an unreachable computer.

Additional Locations (2)

• apps/swift-ios/Features/Connection/ConnectionOnboardingView.swift#L622-L636
• apps/swift-ios/Features/Connection/T3ConnectView.swift#L354-L366

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Retry skips a fresh thread snapshot

Medium Severity

loadThread always calls retainActiveThread before the warm-resume gate, so Retry on an already-open thread writes a fresh threadResumeStates entry and then takes that path. The failed snapshot is not refetched until ensureDetailCatchUpFallback waits another catchUpDelay.

Additional Locations (2)

• apps/swift-ios/App/NativeFeatureClient.swift#L3617-L3629
• apps/swift-ios/Features/Chat/ThreadDetailView.swift#L541-L545

^{Reviewed by Cursor Bugbot for commit 7f6e659. Configure here.}

[cursor]

Workspace refresh omits provider instance

High Severity

refreshProviders sends cwd without instanceId. The server only loads a workspace snapshot when both are present, so this call runs a full provider refresh and never stores skills or slash commands for the current workspace. Thread and new-task composers therefore keep the machine catalog, or an empty one after another workspace snapshot exists.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2024-L2031

^{Reviewed by Cursor Bugbot for commit e706cdc. Configure here.}

[cursor]

Provider setup UI stays stale

Medium Severity

Sign-in, sign-out, install, and remove only store the returned event. The account and runtime controls still read provider.authStatus and provider.isInstalled, which stay stale until a manual catalog refresh. A finished sign-in can show Sign in again, and Sign in can stay disabled after a successful install.

Additional Locations (1)

• apps/swift-ios/Features/Settings/ProviderSetupView.swift#L111-L132

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

HTML file preview never runs

Low Severity

The new html/htm media-preview check sits inside the image, PDF, video, and document branch. FeatureFilePreviewKind.infer classifies those extensions as .source, so that branch never runs and HTML files still load as text instead of a media preview.

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

There are 50 total unresolved issues (including 47 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Preference saves can wipe catalogs

High Severity

updateServerPreferences fetches a full serverConfig for the capability check, then saveServerPreferences ignores it and rebuilds the cached snapshot from serverConfigsByEnvironmentID. A missing cache entry stores empty providers and publishes that snapshot, so changing an icon or shared preference can clear the model catalog until another refresh.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2142-L2150

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Mismatches miss uncached settings

Medium Severity

serverPreferences returns settings from the network without storing them, while sharedPreferenceMismatches only reads serverConfigsByEnvironmentID. After a cache miss the Preferences screen shows the loaded values but an empty difference list, so “Use this environment’s preferences” never appears until something else writes the cache.

Additional Locations (1)

• apps/swift-ios/Features/Settings/EnvironmentPreferencesView.swift#L76-L81

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Work-log icons drop later

Low Severity

Each work-log activity assigns toolPresentation from the current payload or that tool’s stored presentation, and a miss writes nil. A later generic tool therefore erases an earlier browser or computer icon, so the grouped work-log header loses its mark after ordinary file or command updates.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[t3dotgg]

T3 Code's shipped mobile client is React Native. This experiment adds a standalone native SwiftUI client so the team can try its feel, performance, and connection workflows without replacing any existing surface.

The app lives entirely in apps/swift-ios, speaks the existing server contracts directly, and installs side by side as T3 Code (SwiftUI) with bundle ID com.t3tools.t3code.swiftui.

Try it

1. Open apps/swift-ios/T3Code.xcodeproj in Xcode.
2. Select the T3Code scheme and an iOS 17+ simulator or device.
3. Build and pair with an existing T3 Code server using its URL and code, pairing link, or QR code.

See apps/swift-ios/README.md for architecture, included functionality, and known gaps.

What to test

• Pairing, onboarding, and multiple environments
• Web V2 home behavior with large thread collections
• Message-first thread creation and model selection
• Long Markdown transcripts, composer states, approvals, and input requests
• Image attachments, reconnect behavior, project tools, and terminal sessions

Preview

Home	Thread

Verification

• 245 native simulator tests passed, 0 failed, 1 skipped

• Repeated A to B to C to A long-thread navigation verified against an isolated real-data snapshot

• Latest build compiled, installed, and launched on an iPhone 17 Pro simulator

• Signed latest build installed on Big O and DevPhone15; automatic launch deferred because both devices were locked

• Remove DO NOT MERGE only after explicit maintainer approval

This PR was built by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

High Risk
Adds a new native client with Clerk auth, DPoP, relay tokens, and managed-environment credentials—security-sensitive paths that must stay aligned with packages/contracts and server behavior.

Overview
Introduces a standalone native SwiftUI iOS app under apps/swift-ios that talks to T3 servers directly (separate from the React Native app in apps/mobile), with its own Xcode project, dev identity (T3 Swift Dev / t3code-swiftui-dev), and side-by-side install.

Adds T3 Connect cloud plumbing in Swift: Clerk session handling, device-bound DPoP signing, relay HTTP client, managed-environment token exchange, and runtime authorization wired into the native connection stack.

Contributor and agent docs now treat mobile as two clients—AGENTS.md, test-t3-mobile, test-t3-app, and ios-debugger-agent spell out when to build Metro/React Native vs native SwiftUI and warn against cross-client verification.

Adds CI via .github/workflows/swift-ios.yml: checks generated Swift wire fixtures (generate-swift-wire-fixtures.ts --check) and runs apps/swift-ios/Scripts/ci-test.sh on macOS when apps/swift-ios or contracts change.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add experimental native SwiftUI iOS client with widgets, share extension, and T3 Connect

• Introduces a full native SwiftUI iOS app under apps/swift-ios/ with core transport (WebSocket RPC, HTTP), pairing/T3 Connect DPoP auth, and a NativeFeatureClient composing all feature surfaces
• Adds SwiftUI screens for threads, composer, workspace, settings, connections, devices, usage, source control, reviews, files, and terminal (backed by GhosttyKit)\n- Ships WidgetKit extensions (recent-tasks widget + Live Activity) and a Share Services extension that stages shared text/images/files into a shared-inbox via the app group container
• Includes an extensive test suite covering wire contracts, transport reliability, pairing, usage, Markdown, voice input, attachments, and platform features
• Adds CI workflow (swift-ios.yml), wire-fixture generator (scripts/generate-swift-wire-fixtures.ts), and device install scripts
• Risk: this is a large new codebase with no backward-compatibility surface; the T3Code.xcodeproj embeds Widget and Share extensions whose app-group identifier depends on the T3CODE_APP_GROUP_IDENTIFIER build setting being correctly configured per environment

^{Macroscope summarized 459cc4e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 355f5cdf-7ba6-4194-ae4f-03b732623002

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a full SwiftUI iOS client with new transport, persistence, terminal, sharing, widget, notification, and T3 Connect authentication capabilities. Its broad runtime surface and changed product defaults, including access and notification behavior, require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Provider logo follow-up

Replaced the generic CPU and initial badges with the repository's official OpenAI, Claude, Cursor, Grok, and OpenCode SVG artwork. The same driver-keyed component now covers model rows, model configuration, settings/new-task controls, and the compact composer trigger. Unknown custom providers retain the initial fallback.

Before	After

OpenAI and OpenCode rendering:

Verification:

• Focused model-picker tests: 8 passed, 0 failed
• Simulator build and visual inspection passed
• Signed build installed and launched on DevPhone15

Commit: 8792d15f5

[t3dotgg]

Mobile interaction polish

This pass replaces the generic home-row sparkle with the resolved harness mark, keeps the latest transcript content visible when the software keyboard changes the viewport, makes keyboard dismissal immediate, constrains long thread headers, and reduces mobile prompt controls to model + reasoning in the composer and Automatic / Full access in the thread menu.

Previous home	Harness-aware home

Previous thread	Keyboard-pinned composer

Verification:

• 23 focused simulator tests passed, 0 failed
• Simulator build, software-keyboard transition, menu contents, title constraints, and composer layout inspected
• Signed 04ccb7a9c build installed and launched on DevPhone15

Commits: 5ab663449 through 04ccb7a9c

[cursor]

Stub models block image attachments

Medium Severity

ThreadComposerProviderCatalog injects a saved model as FeatureModel(id:name:) with default supportsImages of false. DailyUXModelOptions.supportsImages then treats that stub as authoritative whenever any discovered sibling model advertises images, so the thread composer disables attachments and blocks send for custom or temporarily undiscovered models. Previously a missing catalog entry fell through to the permissive unknown-model path.

^{Reviewed by Cursor Bugbot for commit 9d3d8d5. Configure here.}

[cursor]

DPoP proofs encode null ath

High Severity

Token-exchange DPoP proofs leave ath nil, and the synthesized Encodable payload writes "ath": null. The shared verifier treats ath as an omitted string key, so those proofs fail as malformed. Relay and environment token exchange both mint proofs without an access token, so T3 Connect cannot complete authorization against the real server.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectManagedAuthorization.swift#L99-L100
• apps/swift-ios/App/Cloud/T3ConnectRelayClient.swift#L307-L308

^{Reviewed by Cursor Bugbot for commit 1a59936. Configure here.}

[cursor]

Sign-out loses in-flight token refresh

High Severity

refreshCredential only registers credential(forEnvironmentID:) as an in-flight authorization operation. After that returns, descriptor fetch and DPoP token exchange keep running outside waitForAuthorizationOperations(). Sign-out can finish, revoke managed state, then the refresh completes and a later persist can reinstall a usable managed credential.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectCapability.swift#L233-L270
• apps/swift-ios/App/NativeFeatureClient.swift#L328-L341

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Onboarding succeeds while environment is down

Medium Severity

pair fails when the installed snapshot is disconnected, but setEnvironmentEnabled and T3 Connect handleConnect do not. Enabling a saved environment or completing a managed connect still reports success after a failed shell load, so onboarding can advance for an unreachable computer.

Additional Locations (2)

• apps/swift-ios/Features/Connection/ConnectionOnboardingView.swift#L622-L636
• apps/swift-ios/Features/Connection/T3ConnectView.swift#L354-L366

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Retry skips a fresh thread snapshot

Medium Severity

loadThread always calls retainActiveThread before the warm-resume gate, so Retry on an already-open thread writes a fresh threadResumeStates entry and then takes that path. The failed snapshot is not refetched until ensureDetailCatchUpFallback waits another catchUpDelay.

Additional Locations (2)

• apps/swift-ios/App/NativeFeatureClient.swift#L3617-L3629
• apps/swift-ios/Features/Chat/ThreadDetailView.swift#L541-L545

^{Reviewed by Cursor Bugbot for commit 7f6e659. Configure here.}

[cursor]

Workspace refresh omits provider instance

High Severity

refreshProviders sends cwd without instanceId. The server only loads a workspace snapshot when both are present, so this call runs a full provider refresh and never stores skills or slash commands for the current workspace. Thread and new-task composers therefore keep the machine catalog, or an empty one after another workspace snapshot exists.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2024-L2031

^{Reviewed by Cursor Bugbot for commit e706cdc. Configure here.}

[cursor]

Provider setup UI stays stale

Medium Severity

Sign-in, sign-out, install, and remove only store the returned event. The account and runtime controls still read provider.authStatus and provider.isInstalled, which stay stale until a manual catalog refresh. A finished sign-in can show Sign in again, and Sign in can stay disabled after a successful install.

Additional Locations (1)

• apps/swift-ios/Features/Settings/ProviderSetupView.swift#L111-L132

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

HTML file preview never runs

Low Severity

The new html/htm media-preview check sits inside the image, PDF, video, and document branch. FeatureFilePreviewKind.infer classifies those extensions as .source, so that branch never runs and HTML files still load as text instead of a media preview.

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

There are 50 total unresolved issues (including 47 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Preference saves can wipe catalogs

High Severity

updateServerPreferences fetches a full serverConfig for the capability check, then saveServerPreferences ignores it and rebuilds the cached snapshot from serverConfigsByEnvironmentID. A missing cache entry stores empty providers and publishes that snapshot, so changing an icon or shared preference can clear the model catalog until another refresh.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2142-L2150

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Mismatches miss uncached settings

Medium Severity

serverPreferences returns settings from the network without storing them, while sharedPreferenceMismatches only reads serverConfigsByEnvironmentID. After a cache miss the Preferences screen shows the loaded values but an empty difference list, so “Use this environment’s preferences” never appears until something else writes the cache.

Additional Locations (1)

• apps/swift-ios/Features/Settings/EnvironmentPreferencesView.swift#L76-L81

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Work-log icons drop later

Low Severity

Each work-log activity assigns toolPresentation from the current payload or that tool’s stored presentation, and a miss writes nil. A later generic tool therefore erases an earlier browser or computer icon, so the grouped work-log header loses its mark after ordinary file or command updates.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[t3dotgg]

T3 Code's shipped mobile client is React Native. This experiment adds a standalone native SwiftUI client so the team can try its feel, performance, and connection workflows without replacing any existing surface.

The app lives entirely in apps/swift-ios, speaks the existing server contracts directly, and installs side by side as T3 Code (SwiftUI) with bundle ID com.t3tools.t3code.swiftui.

Try it

1. Open apps/swift-ios/T3Code.xcodeproj in Xcode.
2. Select the T3Code scheme and an iOS 17+ simulator or device.
3. Build and pair with an existing T3 Code server using its URL and code, pairing link, or QR code.

See apps/swift-ios/README.md for architecture, included functionality, and known gaps.

What to test

• Pairing, onboarding, and multiple environments
• Web V2 home behavior with large thread collections
• Message-first thread creation and model selection
• Long Markdown transcripts, composer states, approvals, and input requests
• Image attachments, reconnect behavior, project tools, and terminal sessions

Preview

Home	Thread

Verification

• 245 native simulator tests passed, 0 failed, 1 skipped

• Repeated A to B to C to A long-thread navigation verified against an isolated real-data snapshot

• Latest build compiled, installed, and launched on an iPhone 17 Pro simulator

• Signed latest build installed on Big O and DevPhone15; automatic launch deferred because both devices were locked

• Remove DO NOT MERGE only after explicit maintainer approval

This PR was built by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

High Risk
Adds a new native client with Clerk auth, DPoP, relay tokens, and managed-environment credentials—security-sensitive paths that must stay aligned with packages/contracts and server behavior.

Overview
Introduces a standalone native SwiftUI iOS app under apps/swift-ios that talks to T3 servers directly (separate from the React Native app in apps/mobile), with its own Xcode project, dev identity (T3 Swift Dev / t3code-swiftui-dev), and side-by-side install.

Adds T3 Connect cloud plumbing in Swift: Clerk session handling, device-bound DPoP signing, relay HTTP client, managed-environment token exchange, and runtime authorization wired into the native connection stack.

Contributor and agent docs now treat mobile as two clients—AGENTS.md, test-t3-mobile, test-t3-app, and ios-debugger-agent spell out when to build Metro/React Native vs native SwiftUI and warn against cross-client verification.

Adds CI via .github/workflows/swift-ios.yml: checks generated Swift wire fixtures (generate-swift-wire-fixtures.ts --check) and runs apps/swift-ios/Scripts/ci-test.sh on macOS when apps/swift-ios or contracts change.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add experimental native SwiftUI iOS client with widgets, share extension, and T3 Connect

• Introduces a full native SwiftUI iOS app under apps/swift-ios/ with core transport (WebSocket RPC, HTTP), pairing/T3 Connect DPoP auth, and a NativeFeatureClient composing all feature surfaces
• Adds SwiftUI screens for threads, composer, workspace, settings, connections, devices, usage, source control, reviews, files, and terminal (backed by GhosttyKit)\n- Ships WidgetKit extensions (recent-tasks widget + Live Activity) and a Share Services extension that stages shared text/images/files into a shared-inbox via the app group container
• Includes an extensive test suite covering wire contracts, transport reliability, pairing, usage, Markdown, voice input, attachments, and platform features
• Adds CI workflow (swift-ios.yml), wire-fixture generator (scripts/generate-swift-wire-fixtures.ts), and device install scripts
• Risk: this is a large new codebase with no backward-compatibility surface; the T3Code.xcodeproj embeds Widget and Share extensions whose app-group identifier depends on the T3CODE_APP_GROUP_IDENTIFIER build setting being correctly configured per environment

^{Macroscope summarized 459cc4e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 355f5cdf-7ba6-4194-ae4f-03b732623002

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a full SwiftUI iOS client with new transport, persistence, terminal, sharing, widget, notification, and T3 Connect authentication capabilities. Its broad runtime surface and changed product defaults, including access and notification behavior, require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Provider logo follow-up

Replaced the generic CPU and initial badges with the repository's official OpenAI, Claude, Cursor, Grok, and OpenCode SVG artwork. The same driver-keyed component now covers model rows, model configuration, settings/new-task controls, and the compact composer trigger. Unknown custom providers retain the initial fallback.

Before	After

OpenAI and OpenCode rendering:

Verification:

• Focused model-picker tests: 8 passed, 0 failed
• Simulator build and visual inspection passed
• Signed build installed and launched on DevPhone15

Commit: 8792d15f5

[t3dotgg]

Mobile interaction polish

This pass replaces the generic home-row sparkle with the resolved harness mark, keeps the latest transcript content visible when the software keyboard changes the viewport, makes keyboard dismissal immediate, constrains long thread headers, and reduces mobile prompt controls to model + reasoning in the composer and Automatic / Full access in the thread menu.

Previous home	Harness-aware home

Previous thread	Keyboard-pinned composer

Verification:

• 23 focused simulator tests passed, 0 failed
• Simulator build, software-keyboard transition, menu contents, title constraints, and composer layout inspected
• Signed 04ccb7a9c build installed and launched on DevPhone15

Commits: 5ab663449 through 04ccb7a9c

[cursor]

Stub models block image attachments

Medium Severity

ThreadComposerProviderCatalog injects a saved model as FeatureModel(id:name:) with default supportsImages of false. DailyUXModelOptions.supportsImages then treats that stub as authoritative whenever any discovered sibling model advertises images, so the thread composer disables attachments and blocks send for custom or temporarily undiscovered models. Previously a missing catalog entry fell through to the permissive unknown-model path.

^{Reviewed by Cursor Bugbot for commit 9d3d8d5. Configure here.}

[cursor]

DPoP proofs encode null ath

High Severity

Token-exchange DPoP proofs leave ath nil, and the synthesized Encodable payload writes "ath": null. The shared verifier treats ath as an omitted string key, so those proofs fail as malformed. Relay and environment token exchange both mint proofs without an access token, so T3 Connect cannot complete authorization against the real server.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectManagedAuthorization.swift#L99-L100
• apps/swift-ios/App/Cloud/T3ConnectRelayClient.swift#L307-L308

^{Reviewed by Cursor Bugbot for commit 1a59936. Configure here.}

[cursor]

Sign-out loses in-flight token refresh

High Severity

refreshCredential only registers credential(forEnvironmentID:) as an in-flight authorization operation. After that returns, descriptor fetch and DPoP token exchange keep running outside waitForAuthorizationOperations(). Sign-out can finish, revoke managed state, then the refresh completes and a later persist can reinstall a usable managed credential.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectCapability.swift#L233-L270
• apps/swift-ios/App/NativeFeatureClient.swift#L328-L341

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Onboarding succeeds while environment is down

Medium Severity

pair fails when the installed snapshot is disconnected, but setEnvironmentEnabled and T3 Connect handleConnect do not. Enabling a saved environment or completing a managed connect still reports success after a failed shell load, so onboarding can advance for an unreachable computer.

Additional Locations (2)

• apps/swift-ios/Features/Connection/ConnectionOnboardingView.swift#L622-L636
• apps/swift-ios/Features/Connection/T3ConnectView.swift#L354-L366

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Retry skips a fresh thread snapshot

Medium Severity

loadThread always calls retainActiveThread before the warm-resume gate, so Retry on an already-open thread writes a fresh threadResumeStates entry and then takes that path. The failed snapshot is not refetched until ensureDetailCatchUpFallback waits another catchUpDelay.

Additional Locations (2)

• apps/swift-ios/App/NativeFeatureClient.swift#L3617-L3629
• apps/swift-ios/Features/Chat/ThreadDetailView.swift#L541-L545

^{Reviewed by Cursor Bugbot for commit 7f6e659. Configure here.}

[cursor]

Workspace refresh omits provider instance

High Severity

refreshProviders sends cwd without instanceId. The server only loads a workspace snapshot when both are present, so this call runs a full provider refresh and never stores skills or slash commands for the current workspace. Thread and new-task composers therefore keep the machine catalog, or an empty one after another workspace snapshot exists.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2024-L2031

^{Reviewed by Cursor Bugbot for commit e706cdc. Configure here.}

[cursor]

Provider setup UI stays stale

Medium Severity

Sign-in, sign-out, install, and remove only store the returned event. The account and runtime controls still read provider.authStatus and provider.isInstalled, which stay stale until a manual catalog refresh. A finished sign-in can show Sign in again, and Sign in can stay disabled after a successful install.

Additional Locations (1)

• apps/swift-ios/Features/Settings/ProviderSetupView.swift#L111-L132

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

HTML file preview never runs

Low Severity

The new html/htm media-preview check sits inside the image, PDF, video, and document branch. FeatureFilePreviewKind.infer classifies those extensions as .source, so that branch never runs and HTML files still load as text instead of a media preview.

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

There are 50 total unresolved issues (including 47 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Preference saves can wipe catalogs

High Severity

updateServerPreferences fetches a full serverConfig for the capability check, then saveServerPreferences ignores it and rebuilds the cached snapshot from serverConfigsByEnvironmentID. A missing cache entry stores empty providers and publishes that snapshot, so changing an icon or shared preference can clear the model catalog until another refresh.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2142-L2150

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Mismatches miss uncached settings

Medium Severity

serverPreferences returns settings from the network without storing them, while sharedPreferenceMismatches only reads serverConfigsByEnvironmentID. After a cache miss the Preferences screen shows the loaded values but an empty difference list, so “Use this environment’s preferences” never appears until something else writes the cache.

Additional Locations (1)

• apps/swift-ios/Features/Settings/EnvironmentPreferencesView.swift#L76-L81

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Work-log icons drop later

Low Severity

Each work-log activity assigns toolPresentation from the current payload or that tool’s stored presentation, and a miss writes nil. A later generic tool therefore erases an earlier browser or computer icon, so the grouped work-log header loses its mark after ordinary file or command updates.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[t3dotgg]

T3 Code's shipped mobile client is React Native. This experiment adds a standalone native SwiftUI client so the team can try its feel, performance, and connection workflows without replacing any existing surface.

The app lives entirely in apps/swift-ios, speaks the existing server contracts directly, and installs side by side as T3 Code (SwiftUI) with bundle ID com.t3tools.t3code.swiftui.

Try it

1. Open apps/swift-ios/T3Code.xcodeproj in Xcode.
2. Select the T3Code scheme and an iOS 17+ simulator or device.
3. Build and pair with an existing T3 Code server using its URL and code, pairing link, or QR code.

See apps/swift-ios/README.md for architecture, included functionality, and known gaps.

What to test

• Pairing, onboarding, and multiple environments
• Web V2 home behavior with large thread collections
• Message-first thread creation and model selection
• Long Markdown transcripts, composer states, approvals, and input requests
• Image attachments, reconnect behavior, project tools, and terminal sessions

Preview

Home	Thread

Verification

• 245 native simulator tests passed, 0 failed, 1 skipped

• Repeated A to B to C to A long-thread navigation verified against an isolated real-data snapshot

• Latest build compiled, installed, and launched on an iPhone 17 Pro simulator

• Signed latest build installed on Big O and DevPhone15; automatic launch deferred because both devices were locked

• Remove DO NOT MERGE only after explicit maintainer approval

This PR was built by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

High Risk
Adds a new native client with Clerk auth, DPoP, relay tokens, and managed-environment credentials—security-sensitive paths that must stay aligned with packages/contracts and server behavior.

Overview
Introduces a standalone native SwiftUI iOS app under apps/swift-ios that talks to T3 servers directly (separate from the React Native app in apps/mobile), with its own Xcode project, dev identity (T3 Swift Dev / t3code-swiftui-dev), and side-by-side install.

Adds T3 Connect cloud plumbing in Swift: Clerk session handling, device-bound DPoP signing, relay HTTP client, managed-environment token exchange, and runtime authorization wired into the native connection stack.

Contributor and agent docs now treat mobile as two clients—AGENTS.md, test-t3-mobile, test-t3-app, and ios-debugger-agent spell out when to build Metro/React Native vs native SwiftUI and warn against cross-client verification.

Adds CI via .github/workflows/swift-ios.yml: checks generated Swift wire fixtures (generate-swift-wire-fixtures.ts --check) and runs apps/swift-ios/Scripts/ci-test.sh on macOS when apps/swift-ios or contracts change.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add experimental native SwiftUI iOS client with widgets, share extension, and T3 Connect

• Introduces a full native SwiftUI iOS app under apps/swift-ios/ with core transport (WebSocket RPC, HTTP), pairing/T3 Connect DPoP auth, and a NativeFeatureClient composing all feature surfaces
• Adds SwiftUI screens for threads, composer, workspace, settings, connections, devices, usage, source control, reviews, files, and terminal (backed by GhosttyKit)\n- Ships WidgetKit extensions (recent-tasks widget + Live Activity) and a Share Services extension that stages shared text/images/files into a shared-inbox via the app group container
• Includes an extensive test suite covering wire contracts, transport reliability, pairing, usage, Markdown, voice input, attachments, and platform features
• Adds CI workflow (swift-ios.yml), wire-fixture generator (scripts/generate-swift-wire-fixtures.ts), and device install scripts
• Risk: this is a large new codebase with no backward-compatibility surface; the T3Code.xcodeproj embeds Widget and Share extensions whose app-group identifier depends on the T3CODE_APP_GROUP_IDENTIFIER build setting being correctly configured per environment

^{Macroscope summarized 459cc4e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 355f5cdf-7ba6-4194-ae4f-03b732623002

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a full SwiftUI iOS client with new transport, persistence, terminal, sharing, widget, notification, and T3 Connect authentication capabilities. Its broad runtime surface and changed product defaults, including access and notification behavior, require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Provider logo follow-up

Replaced the generic CPU and initial badges with the repository's official OpenAI, Claude, Cursor, Grok, and OpenCode SVG artwork. The same driver-keyed component now covers model rows, model configuration, settings/new-task controls, and the compact composer trigger. Unknown custom providers retain the initial fallback.

Before	After

OpenAI and OpenCode rendering:

Verification:

• Focused model-picker tests: 8 passed, 0 failed
• Simulator build and visual inspection passed
• Signed build installed and launched on DevPhone15

Commit: 8792d15f5

[t3dotgg]

Mobile interaction polish

This pass replaces the generic home-row sparkle with the resolved harness mark, keeps the latest transcript content visible when the software keyboard changes the viewport, makes keyboard dismissal immediate, constrains long thread headers, and reduces mobile prompt controls to model + reasoning in the composer and Automatic / Full access in the thread menu.

Previous home	Harness-aware home

Previous thread	Keyboard-pinned composer

Verification:

• 23 focused simulator tests passed, 0 failed
• Simulator build, software-keyboard transition, menu contents, title constraints, and composer layout inspected
• Signed 04ccb7a9c build installed and launched on DevPhone15

Commits: 5ab663449 through 04ccb7a9c

[cursor]

Stub models block image attachments

Medium Severity

ThreadComposerProviderCatalog injects a saved model as FeatureModel(id:name:) with default supportsImages of false. DailyUXModelOptions.supportsImages then treats that stub as authoritative whenever any discovered sibling model advertises images, so the thread composer disables attachments and blocks send for custom or temporarily undiscovered models. Previously a missing catalog entry fell through to the permissive unknown-model path.

^{Reviewed by Cursor Bugbot for commit 9d3d8d5. Configure here.}

[cursor]

DPoP proofs encode null ath

High Severity

Token-exchange DPoP proofs leave ath nil, and the synthesized Encodable payload writes "ath": null. The shared verifier treats ath as an omitted string key, so those proofs fail as malformed. Relay and environment token exchange both mint proofs without an access token, so T3 Connect cannot complete authorization against the real server.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectManagedAuthorization.swift#L99-L100
• apps/swift-ios/App/Cloud/T3ConnectRelayClient.swift#L307-L308

^{Reviewed by Cursor Bugbot for commit 1a59936. Configure here.}

[cursor]

Sign-out loses in-flight token refresh

High Severity

refreshCredential only registers credential(forEnvironmentID:) as an in-flight authorization operation. After that returns, descriptor fetch and DPoP token exchange keep running outside waitForAuthorizationOperations(). Sign-out can finish, revoke managed state, then the refresh completes and a later persist can reinstall a usable managed credential.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectCapability.swift#L233-L270
• apps/swift-ios/App/NativeFeatureClient.swift#L328-L341

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Onboarding succeeds while environment is down

Medium Severity

pair fails when the installed snapshot is disconnected, but setEnvironmentEnabled and T3 Connect handleConnect do not. Enabling a saved environment or completing a managed connect still reports success after a failed shell load, so onboarding can advance for an unreachable computer.

Additional Locations (2)

• apps/swift-ios/Features/Connection/ConnectionOnboardingView.swift#L622-L636
• apps/swift-ios/Features/Connection/T3ConnectView.swift#L354-L366

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Retry skips a fresh thread snapshot

Medium Severity

loadThread always calls retainActiveThread before the warm-resume gate, so Retry on an already-open thread writes a fresh threadResumeStates entry and then takes that path. The failed snapshot is not refetched until ensureDetailCatchUpFallback waits another catchUpDelay.

Additional Locations (2)

• apps/swift-ios/App/NativeFeatureClient.swift#L3617-L3629
• apps/swift-ios/Features/Chat/ThreadDetailView.swift#L541-L545

^{Reviewed by Cursor Bugbot for commit 7f6e659. Configure here.}

[cursor]

Workspace refresh omits provider instance

High Severity

refreshProviders sends cwd without instanceId. The server only loads a workspace snapshot when both are present, so this call runs a full provider refresh and never stores skills or slash commands for the current workspace. Thread and new-task composers therefore keep the machine catalog, or an empty one after another workspace snapshot exists.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2024-L2031

^{Reviewed by Cursor Bugbot for commit e706cdc. Configure here.}

[cursor]

Provider setup UI stays stale

Medium Severity

Sign-in, sign-out, install, and remove only store the returned event. The account and runtime controls still read provider.authStatus and provider.isInstalled, which stay stale until a manual catalog refresh. A finished sign-in can show Sign in again, and Sign in can stay disabled after a successful install.

Additional Locations (1)

• apps/swift-ios/Features/Settings/ProviderSetupView.swift#L111-L132

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

HTML file preview never runs

Low Severity

The new html/htm media-preview check sits inside the image, PDF, video, and document branch. FeatureFilePreviewKind.infer classifies those extensions as .source, so that branch never runs and HTML files still load as text instead of a media preview.

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

There are 50 total unresolved issues (including 47 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Preference saves can wipe catalogs

High Severity

updateServerPreferences fetches a full serverConfig for the capability check, then saveServerPreferences ignores it and rebuilds the cached snapshot from serverConfigsByEnvironmentID. A missing cache entry stores empty providers and publishes that snapshot, so changing an icon or shared preference can clear the model catalog until another refresh.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2142-L2150

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Mismatches miss uncached settings

Medium Severity

serverPreferences returns settings from the network without storing them, while sharedPreferenceMismatches only reads serverConfigsByEnvironmentID. After a cache miss the Preferences screen shows the loaded values but an empty difference list, so “Use this environment’s preferences” never appears until something else writes the cache.

Additional Locations (1)

• apps/swift-ios/Features/Settings/EnvironmentPreferencesView.swift#L76-L81

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Work-log icons drop later

Low Severity

Each work-log activity assigns toolPresentation from the current payload or that tool’s stored presentation, and a miss writes nil. A later generic tool therefore erases an earlier browser or computer icon, so the grouped work-log header loses its mark after ordinary file or command updates.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[t3dotgg]

T3 Code's shipped mobile client is React Native. This experiment adds a standalone native SwiftUI client so the team can try its feel, performance, and connection workflows without replacing any existing surface.

The app lives entirely in apps/swift-ios, speaks the existing server contracts directly, and installs side by side as T3 Code (SwiftUI) with bundle ID com.t3tools.t3code.swiftui.

Try it

1. Open apps/swift-ios/T3Code.xcodeproj in Xcode.
2. Select the T3Code scheme and an iOS 17+ simulator or device.
3. Build and pair with an existing T3 Code server using its URL and code, pairing link, or QR code.

See apps/swift-ios/README.md for architecture, included functionality, and known gaps.

What to test

• Pairing, onboarding, and multiple environments
• Web V2 home behavior with large thread collections
• Message-first thread creation and model selection
• Long Markdown transcripts, composer states, approvals, and input requests
• Image attachments, reconnect behavior, project tools, and terminal sessions

Preview

Home	Thread

Verification

• 245 native simulator tests passed, 0 failed, 1 skipped

• Repeated A to B to C to A long-thread navigation verified against an isolated real-data snapshot

• Latest build compiled, installed, and launched on an iPhone 17 Pro simulator

• Signed latest build installed on Big O and DevPhone15; automatic launch deferred because both devices were locked

• Remove DO NOT MERGE only after explicit maintainer approval

This PR was built by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

High Risk
Adds a new native client with Clerk auth, DPoP, relay tokens, and managed-environment credentials—security-sensitive paths that must stay aligned with packages/contracts and server behavior.

Overview
Introduces a standalone native SwiftUI iOS app under apps/swift-ios that talks to T3 servers directly (separate from the React Native app in apps/mobile), with its own Xcode project, dev identity (T3 Swift Dev / t3code-swiftui-dev), and side-by-side install.

Adds T3 Connect cloud plumbing in Swift: Clerk session handling, device-bound DPoP signing, relay HTTP client, managed-environment token exchange, and runtime authorization wired into the native connection stack.

Contributor and agent docs now treat mobile as two clients—AGENTS.md, test-t3-mobile, test-t3-app, and ios-debugger-agent spell out when to build Metro/React Native vs native SwiftUI and warn against cross-client verification.

Adds CI via .github/workflows/swift-ios.yml: checks generated Swift wire fixtures (generate-swift-wire-fixtures.ts --check) and runs apps/swift-ios/Scripts/ci-test.sh on macOS when apps/swift-ios or contracts change.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add experimental native SwiftUI iOS client with widgets, share extension, and T3 Connect

• Introduces a full native SwiftUI iOS app under apps/swift-ios/ with core transport (WebSocket RPC, HTTP), pairing/T3 Connect DPoP auth, and a NativeFeatureClient composing all feature surfaces
• Adds SwiftUI screens for threads, composer, workspace, settings, connections, devices, usage, source control, reviews, files, and terminal (backed by GhosttyKit)\n- Ships WidgetKit extensions (recent-tasks widget + Live Activity) and a Share Services extension that stages shared text/images/files into a shared-inbox via the app group container
• Includes an extensive test suite covering wire contracts, transport reliability, pairing, usage, Markdown, voice input, attachments, and platform features
• Adds CI workflow (swift-ios.yml), wire-fixture generator (scripts/generate-swift-wire-fixtures.ts), and device install scripts
• Risk: this is a large new codebase with no backward-compatibility surface; the T3Code.xcodeproj embeds Widget and Share extensions whose app-group identifier depends on the T3CODE_APP_GROUP_IDENTIFIER build setting being correctly configured per environment

^{Macroscope summarized 459cc4e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 355f5cdf-7ba6-4194-ae4f-03b732623002

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a full SwiftUI iOS client with new transport, persistence, terminal, sharing, widget, notification, and T3 Connect authentication capabilities. Its broad runtime surface and changed product defaults, including access and notification behavior, require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Provider logo follow-up

Replaced the generic CPU and initial badges with the repository's official OpenAI, Claude, Cursor, Grok, and OpenCode SVG artwork. The same driver-keyed component now covers model rows, model configuration, settings/new-task controls, and the compact composer trigger. Unknown custom providers retain the initial fallback.

Before	After

OpenAI and OpenCode rendering:

Verification:

• Focused model-picker tests: 8 passed, 0 failed
• Simulator build and visual inspection passed
• Signed build installed and launched on DevPhone15

Commit: 8792d15f5

[t3dotgg]

Mobile interaction polish

This pass replaces the generic home-row sparkle with the resolved harness mark, keeps the latest transcript content visible when the software keyboard changes the viewport, makes keyboard dismissal immediate, constrains long thread headers, and reduces mobile prompt controls to model + reasoning in the composer and Automatic / Full access in the thread menu.

Previous home	Harness-aware home

Previous thread	Keyboard-pinned composer

Verification:

• 23 focused simulator tests passed, 0 failed
• Simulator build, software-keyboard transition, menu contents, title constraints, and composer layout inspected
• Signed 04ccb7a9c build installed and launched on DevPhone15

Commits: 5ab663449 through 04ccb7a9c

[cursor]

Stub models block image attachments

Medium Severity

ThreadComposerProviderCatalog injects a saved model as FeatureModel(id:name:) with default supportsImages of false. DailyUXModelOptions.supportsImages then treats that stub as authoritative whenever any discovered sibling model advertises images, so the thread composer disables attachments and blocks send for custom or temporarily undiscovered models. Previously a missing catalog entry fell through to the permissive unknown-model path.

^{Reviewed by Cursor Bugbot for commit 9d3d8d5. Configure here.}

[cursor]

DPoP proofs encode null ath

High Severity

Token-exchange DPoP proofs leave ath nil, and the synthesized Encodable payload writes "ath": null. The shared verifier treats ath as an omitted string key, so those proofs fail as malformed. Relay and environment token exchange both mint proofs without an access token, so T3 Connect cannot complete authorization against the real server.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectManagedAuthorization.swift#L99-L100
• apps/swift-ios/App/Cloud/T3ConnectRelayClient.swift#L307-L308

^{Reviewed by Cursor Bugbot for commit 1a59936. Configure here.}

[cursor]

Sign-out loses in-flight token refresh

High Severity

refreshCredential only registers credential(forEnvironmentID:) as an in-flight authorization operation. After that returns, descriptor fetch and DPoP token exchange keep running outside waitForAuthorizationOperations(). Sign-out can finish, revoke managed state, then the refresh completes and a later persist can reinstall a usable managed credential.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectCapability.swift#L233-L270
• apps/swift-ios/App/NativeFeatureClient.swift#L328-L341

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Onboarding succeeds while environment is down

Medium Severity

pair fails when the installed snapshot is disconnected, but setEnvironmentEnabled and T3 Connect handleConnect do not. Enabling a saved environment or completing a managed connect still reports success after a failed shell load, so onboarding can advance for an unreachable computer.

Additional Locations (2)

• apps/swift-ios/Features/Connection/ConnectionOnboardingView.swift#L622-L636
• apps/swift-ios/Features/Connection/T3ConnectView.swift#L354-L366

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Retry skips a fresh thread snapshot

Medium Severity

loadThread always calls retainActiveThread before the warm-resume gate, so Retry on an already-open thread writes a fresh threadResumeStates entry and then takes that path. The failed snapshot is not refetched until ensureDetailCatchUpFallback waits another catchUpDelay.

Additional Locations (2)

• apps/swift-ios/App/NativeFeatureClient.swift#L3617-L3629
• apps/swift-ios/Features/Chat/ThreadDetailView.swift#L541-L545

^{Reviewed by Cursor Bugbot for commit 7f6e659. Configure here.}

[cursor]

Workspace refresh omits provider instance

High Severity

refreshProviders sends cwd without instanceId. The server only loads a workspace snapshot when both are present, so this call runs a full provider refresh and never stores skills or slash commands for the current workspace. Thread and new-task composers therefore keep the machine catalog, or an empty one after another workspace snapshot exists.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2024-L2031

^{Reviewed by Cursor Bugbot for commit e706cdc. Configure here.}

[cursor]

Provider setup UI stays stale

Medium Severity

Sign-in, sign-out, install, and remove only store the returned event. The account and runtime controls still read provider.authStatus and provider.isInstalled, which stay stale until a manual catalog refresh. A finished sign-in can show Sign in again, and Sign in can stay disabled after a successful install.

Additional Locations (1)

• apps/swift-ios/Features/Settings/ProviderSetupView.swift#L111-L132

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

HTML file preview never runs

Low Severity

The new html/htm media-preview check sits inside the image, PDF, video, and document branch. FeatureFilePreviewKind.infer classifies those extensions as .source, so that branch never runs and HTML files still load as text instead of a media preview.

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

There are 50 total unresolved issues (including 47 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Preference saves can wipe catalogs

High Severity

updateServerPreferences fetches a full serverConfig for the capability check, then saveServerPreferences ignores it and rebuilds the cached snapshot from serverConfigsByEnvironmentID. A missing cache entry stores empty providers and publishes that snapshot, so changing an icon or shared preference can clear the model catalog until another refresh.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2142-L2150

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Mismatches miss uncached settings

Medium Severity

serverPreferences returns settings from the network without storing them, while sharedPreferenceMismatches only reads serverConfigsByEnvironmentID. After a cache miss the Preferences screen shows the loaded values but an empty difference list, so “Use this environment’s preferences” never appears until something else writes the cache.

Additional Locations (1)

• apps/swift-ios/Features/Settings/EnvironmentPreferencesView.swift#L76-L81

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Work-log icons drop later

Low Severity

Each work-log activity assigns toolPresentation from the current payload or that tool’s stored presentation, and a miss writes nil. A later generic tool therefore erases an earlier browser or computer icon, so the grouped work-log header loses its mark after ordinary file or command updates.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[t3dotgg]

T3 Code's shipped mobile client is React Native. This experiment adds a standalone native SwiftUI client so the team can try its feel, performance, and connection workflows without replacing any existing surface.

The app lives entirely in apps/swift-ios, speaks the existing server contracts directly, and installs side by side as T3 Code (SwiftUI) with bundle ID com.t3tools.t3code.swiftui.

Try it

1. Open apps/swift-ios/T3Code.xcodeproj in Xcode.
2. Select the T3Code scheme and an iOS 17+ simulator or device.
3. Build and pair with an existing T3 Code server using its URL and code, pairing link, or QR code.

See apps/swift-ios/README.md for architecture, included functionality, and known gaps.

What to test

• Pairing, onboarding, and multiple environments
• Web V2 home behavior with large thread collections
• Message-first thread creation and model selection
• Long Markdown transcripts, composer states, approvals, and input requests
• Image attachments, reconnect behavior, project tools, and terminal sessions

Preview

Home	Thread

Verification

• 245 native simulator tests passed, 0 failed, 1 skipped

• Repeated A to B to C to A long-thread navigation verified against an isolated real-data snapshot

• Latest build compiled, installed, and launched on an iPhone 17 Pro simulator

• Signed latest build installed on Big O and DevPhone15; automatic launch deferred because both devices were locked

• Remove DO NOT MERGE only after explicit maintainer approval

This PR was built by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

High Risk
Adds a new native client with Clerk auth, DPoP, relay tokens, and managed-environment credentials—security-sensitive paths that must stay aligned with packages/contracts and server behavior.

Overview
Introduces a standalone native SwiftUI iOS app under apps/swift-ios that talks to T3 servers directly (separate from the React Native app in apps/mobile), with its own Xcode project, dev identity (T3 Swift Dev / t3code-swiftui-dev), and side-by-side install.

Adds T3 Connect cloud plumbing in Swift: Clerk session handling, device-bound DPoP signing, relay HTTP client, managed-environment token exchange, and runtime authorization wired into the native connection stack.

Contributor and agent docs now treat mobile as two clients—AGENTS.md, test-t3-mobile, test-t3-app, and ios-debugger-agent spell out when to build Metro/React Native vs native SwiftUI and warn against cross-client verification.

Adds CI via .github/workflows/swift-ios.yml: checks generated Swift wire fixtures (generate-swift-wire-fixtures.ts --check) and runs apps/swift-ios/Scripts/ci-test.sh on macOS when apps/swift-ios or contracts change.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add experimental native SwiftUI iOS client with widgets, share extension, and T3 Connect

• Introduces a full native SwiftUI iOS app under apps/swift-ios/ with core transport (WebSocket RPC, HTTP), pairing/T3 Connect DPoP auth, and a NativeFeatureClient composing all feature surfaces
• Adds SwiftUI screens for threads, composer, workspace, settings, connections, devices, usage, source control, reviews, files, and terminal (backed by GhosttyKit)\n- Ships WidgetKit extensions (recent-tasks widget + Live Activity) and a Share Services extension that stages shared text/images/files into a shared-inbox via the app group container
• Includes an extensive test suite covering wire contracts, transport reliability, pairing, usage, Markdown, voice input, attachments, and platform features
• Adds CI workflow (swift-ios.yml), wire-fixture generator (scripts/generate-swift-wire-fixtures.ts), and device install scripts
• Risk: this is a large new codebase with no backward-compatibility surface; the T3Code.xcodeproj embeds Widget and Share extensions whose app-group identifier depends on the T3CODE_APP_GROUP_IDENTIFIER build setting being correctly configured per environment

^{Macroscope summarized 459cc4e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 355f5cdf-7ba6-4194-ae4f-03b732623002

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a full SwiftUI iOS client with new transport, persistence, terminal, sharing, widget, notification, and T3 Connect authentication capabilities. Its broad runtime surface and changed product defaults, including access and notification behavior, require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Provider logo follow-up

Replaced the generic CPU and initial badges with the repository's official OpenAI, Claude, Cursor, Grok, and OpenCode SVG artwork. The same driver-keyed component now covers model rows, model configuration, settings/new-task controls, and the compact composer trigger. Unknown custom providers retain the initial fallback.

Before	After

OpenAI and OpenCode rendering:

Verification:

• Focused model-picker tests: 8 passed, 0 failed
• Simulator build and visual inspection passed
• Signed build installed and launched on DevPhone15

Commit: 8792d15f5

[t3dotgg]

Mobile interaction polish

This pass replaces the generic home-row sparkle with the resolved harness mark, keeps the latest transcript content visible when the software keyboard changes the viewport, makes keyboard dismissal immediate, constrains long thread headers, and reduces mobile prompt controls to model + reasoning in the composer and Automatic / Full access in the thread menu.

Previous home	Harness-aware home

Previous thread	Keyboard-pinned composer

Verification:

• 23 focused simulator tests passed, 0 failed
• Simulator build, software-keyboard transition, menu contents, title constraints, and composer layout inspected
• Signed 04ccb7a9c build installed and launched on DevPhone15

Commits: 5ab663449 through 04ccb7a9c

[cursor]

Stub models block image attachments

Medium Severity

ThreadComposerProviderCatalog injects a saved model as FeatureModel(id:name:) with default supportsImages of false. DailyUXModelOptions.supportsImages then treats that stub as authoritative whenever any discovered sibling model advertises images, so the thread composer disables attachments and blocks send for custom or temporarily undiscovered models. Previously a missing catalog entry fell through to the permissive unknown-model path.

^{Reviewed by Cursor Bugbot for commit 9d3d8d5. Configure here.}

[cursor]

DPoP proofs encode null ath

High Severity

Token-exchange DPoP proofs leave ath nil, and the synthesized Encodable payload writes "ath": null. The shared verifier treats ath as an omitted string key, so those proofs fail as malformed. Relay and environment token exchange both mint proofs without an access token, so T3 Connect cannot complete authorization against the real server.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectManagedAuthorization.swift#L99-L100
• apps/swift-ios/App/Cloud/T3ConnectRelayClient.swift#L307-L308

^{Reviewed by Cursor Bugbot for commit 1a59936. Configure here.}

[cursor]

Sign-out loses in-flight token refresh

High Severity

refreshCredential only registers credential(forEnvironmentID:) as an in-flight authorization operation. After that returns, descriptor fetch and DPoP token exchange keep running outside waitForAuthorizationOperations(). Sign-out can finish, revoke managed state, then the refresh completes and a later persist can reinstall a usable managed credential.

Additional Locations (2)

• apps/swift-ios/App/Cloud/T3ConnectCapability.swift#L233-L270
• apps/swift-ios/App/NativeFeatureClient.swift#L328-L341

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Onboarding succeeds while environment is down

Medium Severity

pair fails when the installed snapshot is disconnected, but setEnvironmentEnabled and T3 Connect handleConnect do not. Enabling a saved environment or completing a managed connect still reports success after a failed shell load, so onboarding can advance for an unreachable computer.

Additional Locations (2)

• apps/swift-ios/Features/Connection/ConnectionOnboardingView.swift#L622-L636
• apps/swift-ios/Features/Connection/T3ConnectView.swift#L354-L366

^{Reviewed by Cursor Bugbot for commit 9a3aef3. Configure here.}

[cursor]

Retry skips a fresh thread snapshot

Medium Severity

loadThread always calls retainActiveThread before the warm-resume gate, so Retry on an already-open thread writes a fresh threadResumeStates entry and then takes that path. The failed snapshot is not refetched until ensureDetailCatchUpFallback waits another catchUpDelay.

Additional Locations (2)

• apps/swift-ios/App/NativeFeatureClient.swift#L3617-L3629
• apps/swift-ios/Features/Chat/ThreadDetailView.swift#L541-L545

^{Reviewed by Cursor Bugbot for commit 7f6e659. Configure here.}

[cursor]

Workspace refresh omits provider instance

High Severity

refreshProviders sends cwd without instanceId. The server only loads a workspace snapshot when both are present, so this call runs a full provider refresh and never stores skills or slash commands for the current workspace. Thread and new-task composers therefore keep the machine catalog, or an empty one after another workspace snapshot exists.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2024-L2031

^{Reviewed by Cursor Bugbot for commit e706cdc. Configure here.}

[cursor]

Provider setup UI stays stale

Medium Severity

Sign-in, sign-out, install, and remove only store the returned event. The account and runtime controls still read provider.authStatus and provider.isInstalled, which stay stale until a manual catalog refresh. A finished sign-in can show Sign in again, and Sign in can stay disabled after a successful install.

Additional Locations (1)

• apps/swift-ios/Features/Settings/ProviderSetupView.swift#L111-L132

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

HTML file preview never runs

Low Severity

The new html/htm media-preview check sits inside the image, PDF, video, and document branch. FeatureFilePreviewKind.infer classifies those extensions as .source, so that branch never runs and HTML files still load as text instead of a media preview.

^{Reviewed by Cursor Bugbot for commit 00be9a1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

There are 50 total unresolved issues (including 47 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Preference saves can wipe catalogs

High Severity

updateServerPreferences fetches a full serverConfig for the capability check, then saveServerPreferences ignores it and rebuilds the cached snapshot from serverConfigsByEnvironmentID. A missing cache entry stores empty providers and publishes that snapshot, so changing an icon or shared preference can clear the model catalog until another refresh.

Additional Locations (1)

• apps/swift-ios/App/NativeFeatureClient.swift#L2142-L2150

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Mismatches miss uncached settings

Medium Severity

serverPreferences returns settings from the network without storing them, while sharedPreferenceMismatches only reads serverConfigsByEnvironmentID. After a cache miss the Preferences screen shows the loaded values but an empty difference list, so “Use this environment’s preferences” never appears until something else writes the cache.

Additional Locations (1)

• apps/swift-ios/Features/Settings/EnvironmentPreferencesView.swift#L76-L81

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}

[cursor]

Work-log icons drop later

Low Severity

Each work-log activity assigns toolPresentation from the current payload or that tool’s stored presentation, and a miss writes nil. A later generic tool therefore erases an earlier browser or computer icon, so the grouped work-log header loses its mark after ordinary file or command updates.

^{Reviewed by Cursor Bugbot for commit 459cc4e. Configure here.}