feat(swift-ios): share into durable composer drafts

[saphid]

Summary

Adds a Share-to-T3-Code extension flow with project/recent-thread destinations and durable shared composer drafts. Includes idempotent import, explicit discard, stale-destination recovery, app-group configuration, bounded media handling, and cleanup of incomplete staging.

Visual evidence

Destination picker	Durable handoff	Composer draft

Watch the 37-second Safari → share extension → selected-thread composer proof.

Verification

• apps/swift-ios/Scripts/ci-test.sh — 224 tests passed
• Fresh independent Claude Opus 5 high review completed; all actionable findings were addressed and the final repair review found no blockers.
• Signed PR-head build installed on an iPhone 17 Pro simulator (iOS 26.5); Safari URL → native share sheet → recent-thread selector → durable handoff → populated composer verified.
• Physical-iPhone verification is blocked by the current development profiles lacking the App Group entitlement; the simulator flow above proves the code path and simulator signing.

Scope

Targets the active native SwiftUI owner branch (#5178).

Note

Add durable composer drafts for iOS share extension with video and destination selection

• The share extension now lets users pick a destination (new thread or existing recent thread) before saving, with the selection persisted into a versioned share envelope alongside video attachments.
• Shared videos (up to 1, max 250 MB) are converted to a JPEG contact sheet via PlatformSharedVideoProcessor and attached to the draft; combined media is capped at 8 attachments.
• Share envelopes are now "durable": they survive process boundaries as staged drafts keyed by share ID, routed into the correct thread or new-thread composer when the main app opens, and acknowledged/removed only after successful routing.
• NewThreadView gains full incoming-share draft lifecycle support: pre-load, auto-open project picker, debounced persistence under a share key, discard confirmation, and dismissal blocking while a share is pending.
• ThreadDetailView merges incoming share drafts into the live composer after initial restore, deduplicates by share ID, reports attachment overflow, and persists the merged result atomically.
• Cross-process shared stores (T3SharedRecentThreadStore, T3SharedAppearanceStore) are introduced so the share extension can display recent threads and respect the app's appearance setting.
• Risk: schema version bump from 1 to 2 for share envelopes; legacy v1 envelopes without destination or videos are decoded with defaults, so old envelopes on device will still load correctly.

^{Macroscope summarized 8e7e474. (Automatic summaries will resume when PR exits draft mode or review begins).}

---

Note

Medium Risk
Large cross-cutting share/import/routing surface with durable drafts and idempotency; video processing and app-group configuration add failure modes, though behavior is heavily tested.

Overview
Share extension now stages content with an optional destination (new thread or a recent thread from app-group storage) instead of only “save and open app.” The UI is a searchable destination list; appearance syncs from the main app. Movies are accepted (bounded size/count) and videos are converted to a JPEG contact-sheet attachment for the composer.

Inbox model bumps to schema v2 with videos, destination, and legacy v1 decoding; App Group ID can be set via plist. Shared recent threads and appearance live in the app group for the extension.

Import pipeline supports project import, thread import, and staging under incoming-share: keys without removing the inbox until routing completes. Idempotent share-ID ledger prevents duplicate merges if inbox cleanup fails.

Host app auto-routes envelopes that already have a destination (stage → new-task sheet, or import → thread composer); manual project picker remains when destination is unset. NewThreadView routes staged shares on project pick with discard/ack flows; ThreadDetailView merges late share imports and warns on attachment overflow.

^{Reviewed by Cursor Bugbot for commit 8e7e474. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 29c33b02-eab6-4b95-8bd1-6fc5b249fcd8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[saphid]

Simulator evidence from the integrated approved Debug build:

Verified on iOS 26.5 against an active disposable backend: the shared draft survived app relaunch/project switching and remained editable. Share-payload parsing, queueing, orphan cleanup, and draft handoff are covered by the exact-head focused tests and passing native CI.

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a significant new feature: share-into-destination selection with video support, durable draft staging, and cross-component navigation. The scope includes new user-facing workflows, schema changes, and processing pipelines that warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[saphid]

Additional iOS 26.5 simulator proof: Safari’s system share sheet exposes the installed T3 Swift Dev extension, and the host app separately restored the saved New Task composer draft after app relaunch and project switching.

The extension-to-host payload handoff, persistence/cancellation races, and cleanup are covered by the exact-head 225-test pass and green native CI.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8c7dd8e. Configure here.}

[saphid]

Dependency-safe final integration is preserved at saphid/swiftui-share-drafts-final-stack (f5e9c4093) over dependency ref saphid/share-drafts-integration-deps (656d5235c). I have deliberately not replaced this Theo-targeted PR head: the tested result depends on #5973 deep links, live #5610 final editor, and the preserved reasoning/keyboard stack. Updating now would duplicate all dependency diffs.

The unique share commit keeps the final UITextView/paste/attachments/reasoning/unlimited composer and latest .sharedThread route. It fixes two real integration races: one observable FIFO root owner prevents deep links/shares overwriting one another; item-driven New Task presentation carries an immutable exact project/share context so SwiftUI cannot capture a stale nil share. Stale dismissals cannot clear the active replacement. The broader later modal/dismissal coordinator is intentionally not imported.

Verification: focused 105/105; full native 105 XCTest + 273 Swift Testing, one expected skip, zero failures; cold share → final editor → Alpha; warm deep link wins exact thread; second warm share → final editor → Zulu; git diff --check clean. Tailnet-only proof: https://alexs-macbook-pro-1.tail4e5636.ts.net:10013/share-drafts-integration-f5e9c4093.mp4

Landing order: #5973 → #5610 → #5985 reasoning (plus tests-only keyboard acceptance) → rebase only f5e9c4093 and update this PR. Opus review unavailable at confirmed 429 quota boundary; no verdict claimed.

[saphid]

Final dependent New Task lifecycle hardening is now preserved separately at saphid/swiftui-new-task-presentation-hardening (7a8248d65), exactly one commit on the final share integration f5e9c4093. It does not expand this PR or add another root queue.

Scope is only WorkspaceView.swift + lifecycle contract tests: latest-wins/fresh identity, modal deferral, exact-ID dismissal start/completion, fallback, displaced share release once, stale/idempotent callbacks, route cancellation/no ghost, and backgrounding cannot masquerade as dismissal. Root FIFO, item-driven immutable share context, and .sharedThread remain owned by #5976.

Verification: focused 12/12; full native 273 tests/28 suites; integrated real background/foreground share handoff, replacement share, project deep-link cancellation/no ghost, Settings deferral, final cancel/home; git diff --check clean. Tailnet-only proof: https://alexs-macbook-pro-1.tail4e5636.ts.net:10013/new-task-presentation-hardening-final.mp4

Landing order: #5976 unique f5e9c4093 first, then hardening 7a8248d65. Opus review unavailable at confirmed 429; no verdict claimed.

[saphid]

Current-base repair: rebased the full Share Drafts stack onto the latest SwiftUI owner branch and updated existing-thread routing to enable the destination environment under the current multi-environment model. Focused ComposerDraftStoreTests plus PlatformIncomingShareTests pass: 30/30. The physical-phone blocker is unchanged: the development signing profiles still lack the App Group entitlement. Any provider-catalog fixture failure is the base issue fixed by #6130.