Release 0.0.22: mobile gateways and product fixes (#31)

* Release 0.0.22: mobile gateways and product fixes

* Test the packaged mobile gateway shell

---------

Co-authored-by: Joseph Yaksich <gitcommit90@users.noreply.github.com>

Author: gitcommit90

CHANGELOG.md

@@ -7,6 +7,64 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.22] - 2026-07-28
+
+### Added
+
+- Presentations now define a visible, locked printable boundary on every
+  slide, defaulting to 1500 × 1000 with configurable dimensions. The
+  Excalidraw menu exports the whole bounded deck as one real multi-page PDF and
+  excludes material outside each printable page.
+- Android and iOS now package only a minimal HTTPS instance connection and
+  recovery shell. After selection they load the chosen instance's live
+  frontend directly, preserve native secure sessions, notifications, links,
+  attachments, microphone, keyboard, and safe-area behavior, and confine the
+  native bridge to an exact scheme/host/effective-port match.
+
+### Changed
+
+- Fresh browser profiles start in light mode, while retaining the existing
+  user-controlled dark-mode switch.
+- The Cowork section tabs are centered at normal widths.
+- Routes now presents a spacious bottom-to-top request flow through **1Helm
+  Router** into a stable arc of ChatGPT, Claude, Antigravity, xAI, OpenRouter,
+  NVIDIA, Cloudflare, and GLM. Dotted live paths and the request ledger keep
+  requested model policy separate from the routed provider or fallback.
+- Structured question choices now show an accessible pressed state with a
+  strong ring, fill, inset accent, and checked indicator in both themes.
+
+### Fixed
+
+- **Log Out** is now available in the profile menu. Native profiles also retain
+  their separate **Disconnect** action for erasing the selected instance and
+  secure session.
+- Every composer now displays and submits the authoritative effective model
+  policy using thread → channel → personal → workspace → agent precedence.
+  Personal overrides are labeled and can be cleared with **Use workspace
+  default**; stale submissions are rejected before admission, and queued turns
+  retain the model and provider snapshot they were admitted with.
+- Silent thread audits use their own `system-*` routing identity and the
+  Captain-scoped provider fabric, so concurrent user requests cannot be
+  mislabeled as maintenance. Router fallback remains a provider outcome rather
+  than appearing to change the requested model mid-turn.
+- HTTP browser instances now use `ws:` while HTTPS and native instances use
+  `wss:`. Fast Cowork collaboration sync, detached Files test rows, and legacy
+  presentation element ordering are also handled deterministically.
+
+### Tests
+
+- Native integration coverage proves visible personal-policy execution,
+  immediate restoration of the workspace default, stale-policy rejection,
+  durable admission metadata, and queued-model immutability across a later
+  preference change.
+- Browser coverage verifies profile Log Out, first-profile light mode, centered
+  Cowork tabs, selected answers in both themes, the literal eight-provider
+  Routes geometry, the locked presentation boundary, configurable page size,
+  and a parsed two-page 1600 × 900 PDF export.
+- Mobile contracts prove only gateway assets are packaged, HTTPS origins are
+  normalized, native sessions stay secure, and Android/iOS navigation cannot
+  broaden bridge access through an origin-prefix attack.
+
 ## [0.0.21] - 2026-07-27
 
 ### Fixed
@@ -642,7 +700,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   notarization, stapled tickets, Gatekeeper verification, persistent
   Application Support, and isolated Apple container machines.
 
-[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.21...HEAD
+[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.22...HEAD
+[0.0.22]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.22
 [0.0.21]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.21
 [0.0.20]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.20
 [0.0.19]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.19

README.md

@@ -143,10 +143,11 @@ acceptance from the same source commit.
 
 The mobile apps are thin, native gateways to a 1Helm you already run. Install
 and finish setup on a supported Mac, Windows, or Linux host first, give that
-host an HTTPS address, then enter the address, username, and password in the
-mobile app. The password is used only for sign-in and is never retained; the
-resulting session is stored in the iOS Keychain or encrypted with a key held by
-Android Keystore.
+host an HTTPS address, then select that address in the app. The app loads the
+selected instance's live frontend directly, so browsers, iPhone, iPad, and
+Android always use the same current interface. Sign-in happens on that live
+frontend; the password is never retained and the resulting session is stored
+in the iOS Keychain or encrypted with a key held by Android Keystore.
 
 - iPhone and iPad use the App Store build under the stable bundle identifier
   `com.gitcommit90.onehelm.mobile`.
@@ -155,9 +156,11 @@ Android Keystore.
   you used to open the file. Verify the release SHA-256 and install it; future
   releases signed by the same permanent 1Helm certificate install in place.
 - The native clients require HTTPS, do not contain or initialize the 1Helm
-  server, and do not retain host data or provider credentials beyond the
-  selected server address and secure session token. Use **Disconnect** in the
-  profile menu to erase both from the device.
+  server or a frozen copy of its product frontend, and do not retain host data
+  or provider credentials beyond the selected server address and secure
+  session token. Native bridge access is restricted to that exact scheme,
+  host, and port. Use **Disconnect** in the profile menu to erase both from the
+  device.
 - iPhone notifications are opt-in under **Settings → Notifications**. Device
   registration belongs to the signed-in account, per-channel mute still wins,
   and tapping an update opens its channel or thread. iOS camera and photo
@@ -252,6 +255,9 @@ and an audit trail. A prompt saying “use this service” is not a connector.
   `/workspace/presentations`, with one consistent file rail, live collaborative
   text editors, embedded whiteboard and slide canvases, and an optional
   channel-agent panel that starts an ordinary thread with the open file path.
+- Presentations define a visible, locked printable area (1500 × 1000 by
+  default), allow custom page dimensions, and export the complete bounded slide
+  deck as one multi-page PDF while excluding work outside each page.
 - Quick Note in the top bar for capturing a Markdown note into
   `/workspace/notes` without leaving or repositioning the current channel view.
 - Durable files, threads, curated memory, Mnemosyne long-term recall,
@@ -301,7 +307,7 @@ A fresh data directory opens first-run setup. The source runtime defaults to
 | `PORT` | `8123` | HTTP/WebSocket control-plane port. |
 | `CTRL_DATA_DIR` | `./data` | Databases, routing state, uploads, and narrow workspace mirrors. |
 | `HELM_CHANNEL_COMPUTER_BACKEND` | `apple` on macOS, `lxc` on Linux, `wsl` on Windows | Host isolation backend; `native` and `mock` are explicit development/test overrides. |
-| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.21` | Versioned channel-machine image contract. |
+| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.22` | Versioned channel-machine image contract. |
 
 ### Agent-first JSON CLI
 

android/app/src/main/java/com/gitcommit90/onehelm/mobile/InstanceGatewayPlugin.java

@@ -0,0 +1,71 @@
+package com.gitcommit90.onehelm.mobile;
+
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+import com.getcapacitor.JSObject;
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+
+@CapacitorPlugin(name = "InstanceGateway")
+public class InstanceGatewayPlugin extends Plugin {
+    static final String PREFS = "onehelm_instance_gateway";
+    static final String SERVER = "selected_https_origin";
+
+    static String validOrigin(String raw) {
+        if (raw == null) return null;
+        Uri uri = Uri.parse(raw.trim());
+        if (!"https".equalsIgnoreCase(uri.getScheme()) || uri.getHost() == null || uri.getUserInfo() != null || uri.getQuery() != null || uri.getFragment() != null) return null;
+        String path = uri.getPath();
+        if (path != null && !path.isEmpty() && !"/".equals(path)) return null;
+        return new Uri.Builder().scheme("https").encodedAuthority(uri.getEncodedAuthority()).build().toString();
+    }
+
+    private static int effectivePort(Uri uri) {
+        if (uri.getPort() >= 0) return uri.getPort();
+        return "https".equalsIgnoreCase(uri.getScheme()) ? 443 : "http".equalsIgnoreCase(uri.getScheme()) ? 80 : -1;
+    }
+
+    private static boolean sameOrigin(Uri left, Uri right) {
+        return left != null && right != null && left.getScheme() != null && right.getScheme() != null
+            && left.getHost() != null && right.getHost() != null
+            && left.getScheme().equalsIgnoreCase(right.getScheme())
+            && left.getHost().equalsIgnoreCase(right.getHost())
+            && effectivePort(left) == effectivePort(right);
+    }
+
+    @Override
+    public Boolean shouldOverrideLoad(Uri url) {
+        String scheme = url == null ? "" : String.valueOf(url.getScheme()).toLowerCase();
+        if ("data".equals(scheme) || "blob".equals(scheme)) return false;
+        if (!"http".equals(scheme) && !"https".equals(scheme)) return null;
+        String selected = validOrigin(getContext().getSharedPreferences(PREFS, Context.MODE_PRIVATE).getString(SERVER, null));
+        // The bundled connection/error shell and the exact selected origin are
+        // the only HTTP(S) documents allowed inside this bridge. External
+        // links are opened by the shared frontend before navigation begins.
+        return !(sameOrigin(url, Uri.parse("https://localhost")) || (selected != null && sameOrigin(url, Uri.parse(selected))));
+    }
+
+    @PluginMethod
+    public void getServer(PluginCall call) {
+        String origin = validOrigin(getContext().getSharedPreferences(PREFS, Context.MODE_PRIVATE).getString(SERVER, null));
+        JSObject result = new JSObject(); result.put("origin", origin == null ? "" : origin); call.resolve(result);
+    }
+
+    @PluginMethod
+    public void selectServer(PluginCall call) {
+        String origin = validOrigin(call.getString("origin"));
+        if (origin == null) { call.reject("Choose a valid HTTPS root address."); return; }
+        getContext().getSharedPreferences(PREFS, Context.MODE_PRIVATE).edit().putString(SERVER, origin).apply();
+        JSObject result = new JSObject(); result.put("origin", origin); call.resolve(result);
+        getActivity().runOnUiThread(() -> { Intent intent = getActivity().getIntent(); getActivity().finish(); getActivity().startActivity(intent); });
+    }
+
+    @PluginMethod
+    public void clearServer(PluginCall call) {
+        getContext().getSharedPreferences(PREFS, Context.MODE_PRIVATE).edit().remove(SERVER).apply(); call.resolve();
+        getActivity().runOnUiThread(() -> { Intent intent = getActivity().getIntent(); getActivity().finish(); getActivity().startActivity(intent); });
+    }
+}

android/app/src/main/java/com/gitcommit90/onehelm/mobile/MainActivity.java

@@ -1,5 +1,28 @@
 package com.gitcommit90.onehelm.mobile;
 
+import android.content.Context;
+import android.os.Bundle;
 import com.getcapacitor.BridgeActivity;
+import com.getcapacitor.CapConfig;
 
-public class MainActivity extends BridgeActivity {}
+public class MainActivity extends BridgeActivity {
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        registerPlugin(InstanceGatewayPlugin.class);
+        String selected = InstanceGatewayPlugin.validOrigin(getSharedPreferences(InstanceGatewayPlugin.PREFS, Context.MODE_PRIVATE).getString(InstanceGatewayPlugin.SERVER, null));
+        if (selected != null) {
+            config = new CapConfig.Builder(this)
+                .setServerUrl(selected)
+                .setErrorPath("error.html")
+                .setAndroidScheme("https")
+                .setAppendedUserAgentString("1HelmMobile")
+                .setBackgroundColor("#111318")
+                .setAllowMixedContent(false)
+                .setWebContentsDebuggingEnabled(false)
+                .setUseLegacyBridge(false)
+                .setZoomableWebView(false)
+                .create();
+        }
+        super.onCreate(savedInstanceState);
+    }
+}

capacitor.config.json

@@ -1,7 +1,7 @@
 {
   "appId": "com.gitcommit90.onehelm.mobile",
   "appName": "1Helm",
-  "webDir": "public",
+  "webDir": "mobile-gateway",
   "loggingBehavior": "none",
   "backgroundColor": "#111318",
   "zoomEnabled": false,
@@ -10,7 +10,8 @@
     "hostname": "localhost",
     "iosScheme": "capacitor",
     "androidScheme": "https",
-    "cleartext": false
+    "cleartext": false,
+    "errorPath": "error.html"
   },
   "ios": {
     "contentInset": "never",

ios/App/App.xcodeproj/project.pbxproj

@@ -11,6 +11,7 @@
 		4D22ABE92AF431CB00220026 /* CapApp-SPM in Frameworks */ = {isa = PBXBuildFile; productRef = 4D22ABE82AF431CB00220026 /* CapApp-SPM */; };
 		50379B232058CBB4000EE86E /* capacitor.config.json in Resources */ = {isa = PBXBuildFile; fileRef = 50379B222058CBB4000EE86E /* capacitor.config.json */; };
 		504EC3081FED79650016851F /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 504EC3071FED79650016851F /* AppDelegate.swift */; };
+		A1E100022026072800000001 /* GatewayViewController.swift in Sources */ = {isa = PBXBuildFile; fileRef = A1E100022026072800000002 /* GatewayViewController.swift */; };
 		504EC30D1FED79650016851F /* Main.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 504EC30B1FED79650016851F /* Main.storyboard */; };
 		504EC30F1FED79650016851F /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 504EC30E1FED79650016851F /* Assets.xcassets */; };
 		504EC3121FED79650016851F /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 504EC3101FED79650016851F /* LaunchScreen.storyboard */; };
@@ -23,6 +24,7 @@
 		50379B222058CBB4000EE86E /* capacitor.config.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.json; path = capacitor.config.json; sourceTree = "<group>"; };
 		504EC3041FED79650016851F /* App.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = App.app; sourceTree = BUILT_PRODUCTS_DIR; };
 		504EC3071FED79650016851F /* AppDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
+		A1E100022026072800000002 /* GatewayViewController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = GatewayViewController.swift; sourceTree = "<group>"; };
 		504EC30C1FED79650016851F /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/Main.storyboard; sourceTree = "<group>"; };
 		504EC30E1FED79650016851F /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
 		504EC3111FED79650016851F /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; name = Base; path = Base.lproj/LaunchScreen.storyboard; sourceTree = "<group>"; };
@@ -66,6 +68,7 @@
 			children = (
 				50379B222058CBB4000EE86E /* capacitor.config.json */,
 				504EC3071FED79650016851F /* AppDelegate.swift */,
+				A1E100022026072800000002 /* GatewayViewController.swift */,
 				504EC30B1FED79650016851F /* Main.storyboard */,
 				504EC30E1FED79650016851F /* Assets.xcassets */,
 				504EC3101FED79650016851F /* LaunchScreen.storyboard */,
@@ -160,6 +163,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				504EC3081FED79650016851F /* AppDelegate.swift in Sources */,
+				A1E100022026072800000001 /* GatewayViewController.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -302,14 +306,14 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 19;
+				CURRENT_PROJECT_VERSION = 22;
 				INFOPLIST_FILE = App/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 0.0.19;
+				MARKETING_VERSION = 0.0.22;
 				OTHER_SWIFT_FLAGS = "$(inherited) \"-D\" \"COCOAPODS\" \"-DDEBUG\"";
 				PRODUCT_BUNDLE_IDENTIFIER = com.gitcommit90.onehelm.mobile;
 				PRODUCT_NAME = 1Helm;
@@ -326,14 +330,14 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 19;
+				CURRENT_PROJECT_VERSION = 22;
 				INFOPLIST_FILE = App/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 0.0.19;
+				MARKETING_VERSION = 0.0.22;
 				PRODUCT_BUNDLE_IDENTIFIER = com.gitcommit90.onehelm.mobile;
 				PRODUCT_NAME = 1Helm;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "";

ios/App/App/Base.lproj/Main.storyboard

@@ -11,7 +11,7 @@
         <!--Bridge View Controller-->
         <scene sceneID="tne-QT-ifu">
             <objects>
-                <viewController id="BYZ-38-t0r" customClass="CAPBridgeViewController" customModule="Capacitor" sceneMemberID="viewController"/>
+                <viewController id="BYZ-38-t0r" customClass="GatewayViewController" customModule="App" customModuleProvider="target" sceneMemberID="viewController"/>
                 <placeholder placeholderIdentifier="IBFirstResponder" id="dkx-z0-nzr" sceneMemberID="firstResponder"/>
             </objects>
         </scene>