[fizzy-publish]

heronin: sign in from the phone app

Part of fizzyedit/work#1198

In plain words

Sign in from the phone app using your browser, then return to Heronin with your account connected.
The app remembers your sign-in privately so you can keep using it after restarting.

What changes

• Sign in opens the browser and waits for you to finish.
• The app remembers the account session in private credential storage.
• Signing out or an expired session removes the remembered credential.

            .done => {
                app_session.cookie.value, session_changed = .{ claim.session, true };
                check(account.transport.?, account.base);
            },

What you will notice

The Agent tab shows your account after sign-in. If sign-in does not finish within five minutes,
you can try again.

How we know it works

New in-process tests cover the browser handoff, polling, cookie forwarding, session expiry,
and sign-out without opening sockets. All six required gates pass; the test gate reports
73/73 tests passed. The real-phone browser-and-return check remains unverified.

How this serves fizzy

Platform:
phone users can sign in through their browser and return to the app with their account connected.

For agents: technical summary

Goal

Complete native account sign-in without changing the server, Drive, native import, or web OAuth.

What changed and why

A transport wrapper adds the native session cookie. A claim hashes a random verifier for the
browser URL and polls every two seconds, stopping after 150 answered attempts without a session.
The app restores and saves only 64-hex session values through Host secrets under heronin.session.
A surface timer keeps polling active; logout and token-check 401 responses clear the credential.

Budget: 129 added non-test lines and 317 added plus deleted lines including tests.
Counts use git diff --numstat HEAD plus wc -l for the two new scoped source files; PR/report
delivery artifacts are excluded. No statements are packed, and added lines fit 100 columns.

How it was verified

• zig fmt --check build.zig tools tests/check_public model app server
• zig build: 67/67 steps succeeded
• zig build server: 3/3 steps succeeded
• zig build test: 67/67 steps succeeded; 73/73 tests passed
• zig build web: 55/55 steps succeeded
• zig build check-public: 3/3 steps succeeded

The new app_session_tests.zig is registered in app_tests.zig. The native sign-in test replaces
openURL because it requires a dvui window, verifies the claim still starts when opening returns
false, and checks cookie installation, token requests, logout, and expiry. All transports are
in-process fakes.

Read in the dependency code: NativeTransport copies URL, headers, and body at request time.
Host exposes getSecret/setSecret. Android's sdl_main.zig sets an unset XDG_CONFIG_HOME from
SDL_GetAndroidInternalStoragePath, placing configuration and secrets in app-private storage.

Not done / follow-ups

UNVERIFIED: SDL_OpenURL opens the phone browser and the claim completes after returning to the app.
Ops' A7 smoke after merge: install, Sign in, return to the app, confirm the Agent tab shows the
account. No phone run or screenshots were taken.

Part of fizzyedit/work#1198