sync: ambient directories, receiving rules, and the gates that were red

.dependency-cruiser.js

@@ -64,6 +64,12 @@ module.exports = {
           '(^|/)index\\.(ts|tsx)$', // barrel/entry files
           '^src/types/', // type barrels are legitimately import-only
           '^src/(bootstrap|shims|config)/', // wiring/shim/config shells reached outside the graph
+          // Core utilities whose only importers are in the private pro/ submodule. The cruiser scans src
+          // alone, so a module used exclusively by pro reads as an orphan even though deleting it would
+          // break the build - coalesce is imported by pro/sync/fileTransferService and
+          // pro/sync/ambientShareService. Same reasoning as the @offgrid/pro exception below: not real
+          // debt, so excluded rather than baselined. Confirm with grep in pro/ before adding to this list.
+          '^src/utils/coalesce\\.ts$',
         ],
       },
       to: {},
@@ -106,6 +112,10 @@ module.exports = {
     },
   ],
   options: {
+    // Keep file-linked workspace packages under node_modules so dependency-cruiser can
+    // classify them from this package.json instead of treating their real paths as
+    // undeclared source files outside the mobile project.
+    preserveSymlinks: true,
     doNotFollow: { path: 'node_modules' },
     tsPreCompilationDeps: true,
     tsConfig: { fileName: 'tsconfig.json' },

.eslintrc.js

@@ -71,9 +71,22 @@ module.exports = {
     'sonarjs/no-duplicated-branches': 'warn',
   },
   overrides: [
+    {
+      files: ['scripts/physical-sync/**/*.mjs'],
+      parserOptions: {
+        ecmaVersion: 2022,
+        sourceType: 'module',
+      },
+    },
     {
       // Relax structural rules in test files — large test suites and helpers are acceptable
-      files: ['__tests__/**/*', '*.test.ts', '*.test.tsx', 'jest.setup.ts'],
+      files: [
+        '__tests__/**/*',
+        'scripts/physical-sync/__tests__/**/*.mjs',
+        '*.test.ts',
+        '*.test.tsx',
+        'jest.setup.ts',
+      ],
       rules: {
         'max-lines': 'off',
         'max-lines-per-function': 'off',

.github/workflows/ci.yml

@@ -28,6 +28,45 @@
           distribution: 'temurin'
           java-version: '17'
 
+      # @offgrid/sync and @offgrid/rag are file: dependencies on the SIBLING shared monorepo
+      # ("file:../shared/packages/sync"). They arrived with the sync work and nothing in CI ever provisioned
+      # them, so every job failed on the same missing module wearing different hats: TS2307 in typecheck, 26
+      # no-phantom-deps errors in the architecture gate, and 260 jest suites unable to resolve
+      # <workspace>/../shared/packages/sync/src/index.ts.
+      #
+      # actions/checkout refuses a path outside the workspace, so it lands inside and is moved up one level -
+      # which is exactly where the file: specifier and jest's moduleNameMapper both point.
+      #
+      # Matching branch first, main as the fallback: a PR that changes the app and the shared package together
+      # has to be tested against the package it expects, not against main's copy.
+      - name: Check out the shared monorepo
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        id: shared_branch
+        continue-on-error: true
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: _shared
+          ref: ${{ github.head_ref || github.ref_name }}
+          persist-credentials: false
+      - name: Fall back to shared main
+        if: ${{ env.PRO_SUBMODULE_PAT != '' && steps.shared_branch.outcome != 'success' }}
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: _shared
+          persist-credentials: false
+      - name: Put shared beside this checkout
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        run: |
+          rm -rf ../shared
+          mv _shared ../shared
+          # Its own deps and build, because npm resolves the file: dep to dist/ and jest to src/.
+          npm --prefix ../shared/packages/sync ci || npm --prefix ../shared/packages/sync install
+          npm --prefix ../shared/packages/sync run build
+
       - name: Install dependencies
         run: npm ci
 
@@ -64,6 +103,45 @@
           node-version: '22'
           cache: 'npm'
 
+      # @offgrid/sync and @offgrid/rag are file: dependencies on the SIBLING shared monorepo
+      # ("file:../shared/packages/sync"). They arrived with the sync work and nothing in CI ever provisioned
+      # them, so every job failed on the same missing module wearing different hats: TS2307 in typecheck, 26
+      # no-phantom-deps errors in the architecture gate, and 260 jest suites unable to resolve
+      # <workspace>/../shared/packages/sync/src/index.ts.
+      #
+      # actions/checkout refuses a path outside the workspace, so it lands inside and is moved up one level -
+      # which is exactly where the file: specifier and jest's moduleNameMapper both point.
+      #
+      # Matching branch first, main as the fallback: a PR that changes the app and the shared package together
+      # has to be tested against the package it expects, not against main's copy.
+      - name: Check out the shared monorepo
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        id: shared_branch
+        continue-on-error: true
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: _shared
+          ref: ${{ github.head_ref || github.ref_name }}
+          persist-credentials: false
+      - name: Fall back to shared main
+        if: ${{ env.PRO_SUBMODULE_PAT != '' && steps.shared_branch.outcome != 'success' }}
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: _shared
+          persist-credentials: false
+      - name: Put shared beside this checkout
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        run: |
+          rm -rf ../shared
+          mv _shared ../shared
+          # Its own deps and build, because npm resolves the file: dep to dist/ and jest to src/.
+          npm --prefix ../shared/packages/sync ci || npm --prefix ../shared/packages/sync install
+          npm --prefix ../shared/packages/sync run build
+
       - name: Install dependencies
         run: npm ci
 
@@ -98,6 +176,45 @@
           node-version: '22'
           cache: 'npm'
 
+      # @offgrid/sync and @offgrid/rag are file: dependencies on the SIBLING shared monorepo
+      # ("file:../shared/packages/sync"). They arrived with the sync work and nothing in CI ever provisioned
+      # them, so every job failed on the same missing module wearing different hats: TS2307 in typecheck, 26
+      # no-phantom-deps errors in the architecture gate, and 260 jest suites unable to resolve
+      # <workspace>/../shared/packages/sync/src/index.ts.
+      #
+      # actions/checkout refuses a path outside the workspace, so it lands inside and is moved up one level -
+      # which is exactly where the file: specifier and jest's moduleNameMapper both point.
+      #
+      # Matching branch first, main as the fallback: a PR that changes the app and the shared package together
+      # has to be tested against the package it expects, not against main's copy.
+      - name: Check out the shared monorepo
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        id: shared_branch
+        continue-on-error: true
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: _shared
+          ref: ${{ github.head_ref || github.ref_name }}
+          persist-credentials: false
+      - name: Fall back to shared main
+        if: ${{ env.PRO_SUBMODULE_PAT != '' && steps.shared_branch.outcome != 'success' }}
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: _shared
+          persist-credentials: false
+      - name: Put shared beside this checkout
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        run: |
+          rm -rf ../shared
+          mv _shared ../shared
+          # Its own deps and build, because npm resolves the file: dep to dist/ and jest to src/.
+          npm --prefix ../shared/packages/sync ci || npm --prefix ../shared/packages/sync install
+          npm --prefix ../shared/packages/sync run build
+
       - name: Install dependencies
         run: npm ci
 
@@ -151,6 +268,45 @@
           distribution: 'temurin'
           java-version: '17'
 
+      # @offgrid/sync and @offgrid/rag are file: dependencies on the SIBLING shared monorepo
+      # ("file:../shared/packages/sync"). They arrived with the sync work and nothing in CI ever provisioned
+      # them, so every job failed on the same missing module wearing different hats: TS2307 in typecheck, 26
+      # no-phantom-deps errors in the architecture gate, and 260 jest suites unable to resolve
+      # <workspace>/../shared/packages/sync/src/index.ts.
+      #
+      # actions/checkout refuses a path outside the workspace, so it lands inside and is moved up one level -
+      # which is exactly where the file: specifier and jest's moduleNameMapper both point.
+      #
+      # Matching branch first, main as the fallback: a PR that changes the app and the shared package together
+      # has to be tested against the package it expects, not against main's copy.
+      - name: Check out the shared monorepo
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        id: shared_branch
+        continue-on-error: true
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: _shared
+          ref: ${{ github.head_ref || github.ref_name }}
+          persist-credentials: false
+      - name: Fall back to shared main
+        if: ${{ env.PRO_SUBMODULE_PAT != '' && steps.shared_branch.outcome != 'success' }}
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ env.PRO_SUBMODULE_PAT }}
+          path: _shared
+          persist-credentials: false
+      - name: Put shared beside this checkout
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        run: |
+          rm -rf ../shared
+          mv _shared ../shared
+          # Its own deps and build, because npm resolves the file: dep to dist/ and jest to src/.
+          npm --prefix ../shared/packages/sync ci || npm --prefix ../shared/packages/sync install
+          npm --prefix ../shared/packages/sync run build
+
       - name: Install JS dependencies
         run: npm ci
 

App.tsx

@@ -18,7 +18,6 @@
 import { useDebugLogsStore } from './src/stores/debugLogsStore';
 import { initDebugLogFile, appendDebugLine } from './src/utils/debugLogFile';
 import { loadProFeatures } from './src/bootstrap/loadProFeatures';
-import { checkProStatus } from './src/services/proLicenseService';
 import { hydrateDownloadStore } from './src/services/downloadHydration';
 import { initActiveDownloadPersistence } from './src/services/activeDownloadPersistence';
 import { restoreQueuedDownloads } from './src/services/restoreQueuedDownloads';
@@ -200,7 +199,7 @@
     })().catch((error) => {
       logger.error('[App] Download-state recovery failed:', error);
     });
   }, [setDownloadedModels, setDownloadedImageModels]);
 
   const initializeApp = useCallback(async () => {
     try {
@@ -261,32 +260,12 @@
       // Initialize RAG database tables
       ragService.ensureReady().catch((err) => logger.error('Failed to initialize RAG service on startup', err));
 
-      // Read the cached Pro entitlement before Pro features load. checkProStatus
-      // returns the Keychain cache immediately and fires a background Keygen
-      // revalidation so the next launch stays fresh.
-      //
-      // Pro is optional: a failure here (keychain locked, no network) must never
-      // abort app init or hang the splash screen, so it is isolated and only logs.
-      let isPro = false;
       try {
-        isPro = await checkProStatus();
-      } catch (proError) {
-        logger.error('[App] Pro check failed, continuing without entitlement:', proError);
-      }
-
-      try {
-        // Load pro features — only activates if the keychain entitlement is set
-        // (or in dev, where loadProFeatures force-unlocks).
-        await loadProFeatures(isPro);
-
-        // Reconcile the persisted Pro flag with the actual entitlement on every
-        // boot. Setting it to the resolved value (not only ever true) means a
-        // cleared/expired license also flips it back to false — previously it
-        // only ever went true, so a stale persisted true stuck forever.
-        // DEV builds force-unlock for local testing, unless the Settings
-        // "Turn off Pro (DEV)" toggle is set. Never force-unlocks in release.
-        const devUnlock = __DEV__ && !useAppStore.getState().devProDisabled;
-        useAppStore.getState().setHasRegisteredPro(isPro || devUnlock);
+        // Register the private Pro entitlement provider before the first status
+        // read, then activate only the capabilities that entitlement permits.
+        // loadProFeatures separately projects cached credential access from a
+        // Debug developer unlock; Sync reconciliation owns device admission.
+        await loadProFeatures();
       } catch (proError) {
         logger.error('[App] Pro feature load failed, continuing without Pro:', proError);
       }

__tests__/hardening/batch2-chatslist.test.tsx

@@ -17,6 +17,11 @@
  * services barrel, and vector icons — none of which is the logic under test.
  */
 
+import {
+  formatClockTime,
+  formatShortDate,
+  formatWeekday,
+} from '../../src/utils/localTime';
 import React from 'react';
 import { render, fireEvent, within } from '@testing-library/react-native';
 import { useAppStore } from '../../src/stores/appStore';
@@ -84,6 +89,8 @@ jest.mock('../../src/components/CustomAlert', () => ({
 jest.mock('../../src/services', () => ({
   onnxImageGeneratorService: { deleteGeneratedImage: jest.fn(() => Promise.resolve()) },
   activeModelService: {
+    // The model-selection seam, from the one place it is defined.
+    ...require('../utils/activeModelServiceStub').activeModelSelectionStub(),
     loadTextModel: jest.fn(() => Promise.resolve()),
     loadImageModel: jest.fn(() => Promise.resolve()),
     unloadTextModel: jest.fn(() => Promise.resolve()),
@@ -121,13 +128,19 @@ describe('batch2 ChatsListScreen — sort, timestamp format, delete, empty', ()
   });
 
   // Case 26: today's conversation shows a clock time, NOT a date.
-  it('case26: shows a clock time (HH:MM) for a conversation from today', () => {
+  // These used to build their expected string with toLocaleTimeString / toLocaleDateString. The app
+  // deliberately stopped using those: Hermes ships without ICU data in most React Native builds, so they
+  // silently answered in UTC - a message written at 10:12 in Delhi read "4:42 AM" on the phone while the
+  // Mac beside it said 10:12. src/utils/localTime.ts replaced them with methods that are always the
+  // device's own zone, so asserting through those same functions is the only way this test agrees with
+  // the app on a machine in any timezone - and it fails if the formatting is changed in one place only.
+  it('case26: shows a clock time for a conversation from today', () => {
     const now = new Date();
     const conv = createConversation({ title: 'Today Chat', updatedAt: now.toISOString() });
     useChatStore.setState({ conversations: [conv] });
 
     const { getByText } = render(<ChatsListScreen />);
-    const expectedClock = now.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
+    const expectedClock = formatClockTime(now);
     expect(getByText(expectedClock)).toBeTruthy();
     // it is NOT a weekday or month/day string
     expect(expectedClock).toMatch(/\d/);
@@ -141,7 +154,7 @@ describe('batch2 ChatsListScreen — sort, timestamp format, delete, empty', ()
     useChatStore.setState({ conversations: [conv] });
 
     const { getByText } = render(<ChatsListScreen />);
-    const expectedWeekday = threeDaysAgo.toLocaleDateString([], { weekday: 'short' });
+    const expectedWeekday = formatWeekday(threeDaysAgo);
     expect(getByText(expectedWeekday)).toBeTruthy();
     // guard: a weekday short name is not a HH:MM clock
     expect(expectedWeekday).not.toMatch(/^\d{1,2}:\d{2}/);
@@ -155,7 +168,7 @@ describe('batch2 ChatsListScreen — sort, timestamp format, delete, empty', ()
     useChatStore.setState({ conversations: [conv] });
 
     const { getByText } = render(<ChatsListScreen />);
-    const expectedMonthDay = twoWeeksAgo.toLocaleDateString([], { month: 'short', day: 'numeric' });
+    const expectedMonthDay = formatShortDate(twoWeeksAgo);
     expect(getByText(expectedMonthDay)).toBeTruthy();
   });
 

__tests__/hardening/batch4-image-provider-remove.test.ts

@@ -19,7 +19,9 @@ jest.mock('../../src/services/modelManager', () => ({
   modelManager: { deleteImageModel: jest.fn(async () => {}) },
 }));
 jest.mock('../../src/services/activeModelService', () => ({
-  activeModelService: { unloadImageModel: jest.fn(async () => {}) },
+  activeModelService: {
+    // The model-selection seam, from the one place it is defined.
+    ...require('../utils/activeModelServiceStub').activeModelSelectionStub(), unloadImageModel: jest.fn(async () => {}) },
 }));
 jest.mock('../../src/services/backgroundDownloadService', () => ({
   backgroundDownloadService: {

__tests__/hardening/batch4-phase-state-machine.test.ts

@@ -104,6 +104,11 @@ describe('image-gen phase state machine — ordered transitions (cases 17, 18, 2
       activeModelId: 'text-1',
       settings: { ...useAppStore.getState().settings, enhanceImagePrompts: true } as any,
     });
+    // WHICH text model to enhance with is asked of activeModelService, which is the one owner of that
+    // question so image generation cannot pick a different model than chat does. This suite mocks that
+    // service, so setting activeModelId in the store is no longer enough on its own - the mock has to
+    // answer, or the service finds no text model and skips enhancement entirely.
+    mockActive.selectedTextModelId.mockReturnValue('text-1');
     // Text model loads on demand then reports loaded.
     mockLlm.isModelLoaded.mockReturnValueOnce(false).mockReturnValue(true);
     mockLlm.generateResponse.mockResolvedValue('an enhanced red apple, studio lighting');