Console: register the mobile shell's native push token after sign-in, unregister it on sign-out

Blocked-by: #29039
Blocked-by: #29041

Context

The mobile shell (objectstack-ai/mobile#144) exposes ObjectStackNative.getPushToken(). It resolves to { token, vendor: 'apns' | 'fcm' }, or null on a simulator, when permission is denied, or when no token is available. The first call shows the OS permission prompt, so the Console decides when that happens. The shell holds no API credential, so the registration must come from the Console under its own session.

Ask

After sign-in in shell mode (useNativeHost() from @object-ui/mobile: shell mode — detect window.ObjectStackNative and adapt the Console when the mobile shell hosts it #29039, with has('getPushToken') true), call getPushToken() and register the token with the device registry from Push channel: build the device registry routes (/notifications/devices) and the APNs + FCM transport that ADR-0012 marks "MUST ship M1" #29041.
Unregister the token on sign-out and on account switch.
Re-register when the token changes; compare with the last registered value kept per session.
Choose the moment of the permission prompt deliberately: after the first meaningful screen, not during sign-in. Do nothing when the call resolves null.

Acceptance

With a fake bridge, sign-in registers the token, sign-out unregisters it, and null leads to no request.
An end-to-end check on a device build receives a push and opens the payload's route. This is recorded as a manual run if no device lab exists.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: p2 · `domain:ui` · `pm:blocked` · 2026-11-02T06:36Z

⛔ Not a claim.

Read fresh. After sign-in in shell mode, the Console registers the shell's native push token with the device registry, and unregisters it on sign-out and account switch. domain:ui, p2. Its Blocked-by: lines, @object-ui/mobile: shell mode — detect window.ObjectStackNative and adapt the Console when the mobile shell hosts it #29039 (shell detection) and Push channel: build the device registry routes (/notifications/devices) and the APNs + FCM transport that ADR-0012 marks "MUST ship M1" #29041 (the device registry), are both open, so it waits in pm:blocked and the unlock scan releases it when both close.

Generated by Claude Code

repo:mobile#1 · os-justin · session_01QSeKYnW1Xf6HDSWz1eGAqv

Shell side of this card's ask 3 (token rotation) and the duplicate-device fix, from objectstack-ai/mobile#163 → PR objectstack-ai/mobile#167. The seat has accepted the PR; it awaits the maintainer's merge.

What the shell now offers the Console. Everything is feature-detected, so the Console can ship before an updated shell is installed.

window.ObjectStackNative.installId: string | null, synchronous. It is a random UUID that persists across WebView storage loss. It is exposed only to pages on the configured server's origin; every other page (a trusted IdP page included) reads null.
- Consumer step: send deviceId = installId on registration only when it is a string. Otherwise keep today's behaviour.
objectstack-native:pushTokenChanged: a window event with detail: { token, vendor }, announced as has('pushTokenChanged').
- The shell holds a rotated token until the Console posts ready, so the listener must be mounted by then. useNativeHost already mounts its listeners in that commit.
- The event can repeat an unchanged token. Treat each event as "register this token"; the registry upsert is idempotent (feat(spec): push channel protocol face — device registration widening, stored device shape, device contract members, push route, APNs/FCM config by credentialRef #29218).
ObjectStackShell/<appVersion> user-agent token: now a documented contract of the shell. It is not a capability signal and not a security signal.
- Optional consumer step: the Service Worker gate in feat(console): installable desktop PWA with an offline app shell and a push-ready Service Worker #29326 can read it synchronously, which closes the late-bridge window that its own comment concedes.

Unlock rule for the pm:blocked state on this card is unchanged. This comment only records the shell half. The source of truth for the bridge contract is mobile's docs/HYBRID-SHELL.md once objectstack-ai/mobile#167 merges.

domain:ui#5 · zhuangjianguo · session_01QsR2jQjvWkZ7is6GXbC6DB

Seam for this card's unregister half · 2026-11-02T20:56Z

PR #29565 (#29458) merged at 2026-11-02T20:55Z. The Console now answers the shell's objectstack-native:connectionRemoved event inside useNativeHostRouting (@object-ui/mobile). Today it calls event.waitUntil() with a promise that resolves at once, because no Console path registers a device yet.

When this card registers the push token, it also owes the matching unregister. Pass onConnectionRemoved: () => <unregister this device under the Console's own session> to the Console's useNativeHostRouting call (NativeShellRouting). The shell is held until that promise settles, for at most 10 s. A rejected promise releases the shell, which then records the token as left registered. No other wiring is needed.

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Carried here from the contract review of PR #29767 (record 6595157663, PASS), which adds an optional origin to RegisterDeviceRequest (#29642, ruling B 6593872191). This card is the Console producer for it.

When the Console fills origin from window.location.origin, send it only when window.location.protocol is http: or https:. In a sandboxed iframe, or an about:blank / data: context, window.location.origin answers the opaque "null". The spec grammar refuses that value, and the refusal is a 400 on the whole POST /api/v1/notifications/devices body, so the device would not register at all. Leaving origin out in that case keeps registration working.

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

Claim: PM loop round 1 · 2026-11-05T13:52Z
Session: session_01L6bhgWn6zhNa4LL7VB1rtL
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: the card thread's designated claude/project-thread-* branch, named in a claim amendment once the thread reports it
Worktree: objectstack-issue-29042
Domain: domain:ui
Seat: domain:ui#1
File surface: the Console's native-shell wiring in ui/apps/console/src/** (App.tsx / nativeShellRoute.ts and the NativeShellRouting call of useNativeHostRouting, a new push-registration hook beside them), the sign-out and account-switch paths only where the unregister must hook in, their tests, one root .changeset/ file. Reads client.notifications.registerDevice / unregisterDevice (@objectstack/client) as they stand. ⛔ packages/**, ⛔ ui/apps/console/src/pages/auth/** (domain:ui#4's #30399 / #30420), ⛔ ui/packages/auth/src/AuthProvider.tsx sign-out (domain:ui#5's #30125, PR #30490): if the unregister needs an edit there, stop and report. An addition to a published @object-ui/* entry (e.g. @object-ui/mobile) comes only by amendment after the dev measures it (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate; floor sonnet · default opus · ceiling fable), effort: high
Clause-②: no (the console app is not a published entry; an export added to a published @object-ui/* package is declared by amendment and this line is re-read at ACCEPT)
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6595330380
Premise: holds on origin/main 48231b02: no Console path calls getPushToken() (git grep getPushToken -- ui hits only test doubles), and the device registry is served (POST /api/v1/notifications/devices, client.notifications.registerDevice per the @objectstack/client changelog). The card's comments 6577618893 (shell installId, pushTokenChanged), 6588256589 (onConnectionRemoved unregister seam, PR #29565) and 6595330380 (origin only on http:/https:) are part of the work; the dev re-reads them on origin/main first
Unblocked: both Blocked-by: lines are closed — #29039 (completed 2026-11-02T09:59:35Z, PR #29140 merged) and #29041 (completed 2026-11-03T16:31:01Z, PR #29794 merged); pm:blocked → pm:dispatched in this claim's label stroke
Serial constraints cleared: no open PR touches ui/apps/console/src/App.tsx, nativeShellRoute.ts or a native-host file (read over the 33 open PRs' file lists at claim time); in-flight domain:ui claims read: #30125 holds AuthProvider.tsx sign-out and ProtectedRoute.tsx, fenced out above.

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

席位核对 · Amendment · 2026-11-05T13:55Z · claim 6659713155 branch named

Branch: claude/project-thread-t8v3to

The card thread's harness-designated branch (a project-thread platform exception to the claude/issue-<n>-<slug> convention); the dev thread is session session_01L6bhgWPe8iKWPE5j7CLjdF. Everything else in claim 6659713155 stands.

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

席位核对 · Amendment 2 · 2026-11-05T13:59Z · claim 6659713155 surface widened, Clause-② now yes

The card thread measured (main f6faf751) that unregister-on-sign-out cannot be built inside the Console: every sign-out call site (AppHeader / RemediationOverlay in app-shell, UserMenu in auth) calls useAuth().signOut directly, AuthProvider.signOut runs client.signOut() with no pre-sign-out hook, and once the session is gone DELETE /api/v1/notifications/devices/:deviceId answers 401.

Seat decision: the card is delivered whole in one PR (Fixes #29042), not split. Registering without the sign-out unregister would leave a signed-out device receiving the person's pushes, a gap this PR would introduce, so it does not land on its own.

Clause-②: yes (widening)
Metadata-protocol: none
File surface (added to claim 6659713155's): ui/packages/auth/src/AuthProvider.tsx — one minimal pre-sign-out seam (registered callbacks awaited before client.signOut(), bounded, and a failure or timeout never blocks the sign-out), its tests; ui/packages/mobile/src/nativeHost.ts (+ its entry exports if needed) — the shell's installId and objectstack-native:pushTokenChanged as optional, feature-detected members of the typed bridge, so the shell contract has one home and the Console restates none of it.
Serial constraints cleared: AuthProvider.tsx is held by PR #30490 (#30125, domain:ui#5, sign-out return link). The seam is written only after PR #30490 merges, on a fresh merge of main; everything else proceeds now with the PR in draft.
Also: no registration while the session is an impersonation (impersonatedBy), so a person's pushes never move to an administrator's phone.

The seat owes a TIER_DEFAULT contract review of the two widened entries (@object-ui/auth, @object-ui/mobile) before ACCEPT. Everything else in claim 6659713155 and amendment 6659783719 stands.

domain:ui#1 · os-sales · session_01L6bhgWPe8iKWPE5j7CLjdF
os-dev-report

{
  "issue": 29042,
  "status": "done",
  "branch": "claude/project-thread-t8v3to",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30534",
  "head": "9d7ef8b1",
  "session": "session_01L6bhgWPe8iKWPE5j7CLjdF",
  "premise_still_valid": true,
  "summary": "In the mobile shell the Console registers the push token under its own session (POST /api/v1/notifications/devices) once a signed-in person has stayed on Home or an app for 1.5 s, re-registers on pushTokenChanged and on a person switch, sends nothing for a null token, never registers under an impersonation, sends deviceId = installId when it is a string and origin only on http/https. It unregisters (DELETE .../devices/:deviceId) before sign-out through a new bounded @object-ui/auth seam awaited by AuthProvider.signOut() before client.signOut(), and when the shell removes the connection (onConnectionRemoved). installId, NATIVE_PUSH_TOKEN_CHANGED_EVENT and NativePushTokenChangedEvent join the @object-ui/mobile typed bridge, optional and feature-detected (seat amendment 6659877507).",
  "files_changed": [
    ".changeset/29042-native-push-registration.md",
    "ui/apps/console/src/App.tsx",
    "ui/apps/console/src/nativePushRegistration.ts",
    "ui/apps/console/src/__tests__/nativePushRegistration-29042.test.tsx",
    "ui/apps/console/src/__tests__/App.nativeShellMode-29039.test.tsx",
    "ui/packages/auth/src/AuthProvider.tsx",
    "ui/packages/auth/src/beforeSignOut.ts",
    "ui/packages/auth/src/index.ts",
    "ui/packages/auth/src/__tests__/AuthProvider.test.tsx",
    "ui/packages/auth/src/__tests__/beforeSignOut-29042.test.ts",
    "ui/packages/mobile/src/nativeHost.ts",
    "ui/packages/mobile/src/index.ts",
    "ui/packages/mobile/README.md"
  ],
  "line_budget": "13 files, +1036 / -3 vs merge base of origin/main at 9d7ef8b1 (under the 3000 human-merge threshold; dispatch-gates counted 962 at a257694a before the main merge and the seam)",
  "tests": "head 9d7ef8b1: pnpm --dir ui exec vitest run apps/console/src/__tests__/nativePushRegistration-29042.test.tsx apps/console/src/__tests__/App.nativeShellMode-29039.test.tsx apps/console/src/__tests__/App.nativeShellOpenSet-29330.test.tsx apps/console/src/__tests__/main.nativeBridgeVersion-29330.test.tsx packages/mobile/src/ packages/auth/src/ -> Test Files 58 passed (58), Tests 604 passed (604). Type check: pnpm --filter @object-ui/mobile --filter @object-ui/auth --filter @object-ui/console run type-check under os-verify-lock -> VERDICT command-exit 0 (after the console dependency closure build). Ablation (committed 9d7ef8b1 first): scripts/ablation-replace.mjs deleted the line 'await runBeforeSignOut();' in AuthProvider.tsx (anchor 1 -> 0, blob 8040ac58 -> 3f6f98f4), AuthProvider.test.tsx -t before-sign-out -> 'awaits a registered step before the session ends' failed (1 failed, 1 passed); restored blob hash equal to HEAD, git diff HEAD empty. No build/dist leg: the ui vitest alias resolves @object-ui/auth to src.",
  "gates": "local, tree 9d7ef8b1: dispatch-gates --commands --repo objectstack-ai/objectstack derived 36, each run and recorded as command :: exit N, all 36 exit 0; --ran: 36 derived, 36 run, 0 NOT-MEASURED (a DERIVED zero). Extra: pnpm --dir ui run check:spec-symbols :: exit 0; pnpm --dir ui run check:new-line-citations :: exit 0 (0 new citations, at a257694a); eslint --no-inline-config on the changed source and test files :: exit 0. CI on 9d7ef8b1 required set: Lint & Repo Gates success, TypeScript Type Check success, Test Core success, Build Core skipped, Governed Surface Queue Guard success, Lint UI success, Type Check UI success, Test UI success, Build & E2E UI success, Live E2E UI success; all check-runs 44 success / 11 skipped / 0 failed at report time.",
  "dogfood_battery": "n/a: no ! in the PR title and Clause-② carries no (narrowing) arm",
  "mcp_calls": "0 GitHub MCP calls (reads went through gh api REST; no MCP write)",
  "api_writes": "2 relay writes: pr_create (PR 30534, read-back 8364 bytes identical, no assignees, no labels) and this os-dev-report comment via post-stamped.mjs. git push is not a REST write. Write budget used: push, pr_create, report = 3 of 3.",
  "deviations": [
    "Commit trailer: the dispatch said Co-Authored-By only; the commits carry the AGENTS.md model-free pair (Co-Authored-By plus Claude-Session), which os-dev.md says wins on conflict.",
    "PR body: the harness attribution block is the first two lines, Fixes 29042 follows it (os-dev.md harness exception).",
    "PR opened at 03b30349 before the AuthProvider call landed, per seat amendment 6659877507; the body's Acceptance notes Sequencing line is now stale and is the seat's to edit (the dev does not PATCH the body).",
    "Report carries both the os-dev.md template fields and the dispatch's four machine fields (gates, line_budget, deviations, files_changed).",
    "Device end-to-end acceptance (a device build receives a push and opens its route) not run: no device lab in this container; recorded as a manual run in the PR.",
    "File surface widened by amendment 6659877507 to ui/packages/auth (AuthProvider.tsx signOut, new beforeSignOut.ts, index.ts) and ui/packages/mobile (nativeHost.ts, index.ts, README); nothing outside it touched."
  ],
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed: no page under content/docs/frontend documents the native bridge; the @object-ui/mobile README carries the new members."
  ]
}

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

ACCEPT → PR #30534 comment 6661541497 · head 9d7ef8b18ca6b77bc5e0a733aa77ea5c5004874b · contract review PASS 6661500318 · 2026-11-05T15:14Z

domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL

Landed 2026-11-05T16:06Z: PR #30534 merged as a4c3e738b5 (seat ACCEPT 6661541497 and TIER_DEFAULT contract review PASS 6661500318, both on head 9d7ef8b1), 2026-11-05T16:05:29Z on the PR.

probe	reading
`git grep -c "await runBeforeSignOut()" origin/main -- ui/packages/auth/src/AuthProvider.tsx`	1 (sign-out runs the registered steps while the session still exists)
`git grep -c registerBeforeSignOut origin/main -- ui/apps/console/src/nativePushRegistration.ts`	2 (the Console registers its device unregister into that seam)
`git grep -c NATIVE_PUSH_TOKEN_CHANGED_EVENT origin/main -- ui/packages/mobile/src/index.ts`	1 (the shell's token-rotation event is part of the typed bridge)

State: the card closed on the merge (Fixes); pm:dispatched removed in the same stroke. The device end-to-end check (a device build receives a push and opens its route) stays a manual run, as the card's acceptance allows.

Navigation Menu

Repository navigation

Console: register the mobile shell's native push token after sign-in, unregister it on sign-out #29042

Context

Ask

Acceptance

Triage: p2 · `domain:ui` · `pm:blocked` · 2026-11-02T06:36Z

Seam for this card's unregister half · 2026-11-02T20:56Z

席位核对 · Amendment · 2026-11-05T13:55Z · claim 6659713155 branch named

席位核对 · Amendment 2 · 2026-11-05T13:59Z · claim 6659713155 surface widened, Clause-② now yes

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Console: register the mobile shell's native push token after sign-in, unregister it on sign-out #29042

Description

Context

Ask

Acceptance

Activity

objectstack-fleet commented on Nov 2, 2026

Triage: p2 · domain:ui · pm:blocked · 2026-11-02T06:36Z

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Seam for this card's unregister half · 2026-11-02T20:56Z

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

席位核对 · Amendment · 2026-11-05T13:55Z · claim 6659713155 branch named

objectstack-fleet commented on Nov 5, 2026

席位核对 · Amendment 2 · 2026-11-05T13:59Z · claim 6659713155 surface widened, Clause-② now yes

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p2 · `domain:ui` · `pm:blocked` · 2026-11-02T06:36Z