feat(mobile): pick, share, and receive files in threads

[t3dotgg]

The web file attachment foundation is now merged in #8236. This PR now contains only the mobile client work. Mobile can attach photos today, but it cannot pick documents or keep files shared from other apps.

The composer offers Photos and Files when the connected server supports file uploads. The native share sheet accepts files, audio, and video, then routes them into a project draft. The thread feed renders file attachments as rows that open with the original filename. Unknown attachment types render as inert rows.

The shared upload flow verifies, transfers, and releases pending uploads. One outbox removal path releases local files. Revision checks prevent stale outbox writes from replacing newer edits. Share cleanup deletes only files under app-owned directories, so an iOS open-in-place share cannot delete the sender's document.

The Android share fix now patches expo-sharing@57.0.16 for Expo SDK 57. It keeps the source filename, treats shared text streams as files, and keeps accompanying text.

Native release requirement: the share registration and native module patch need new iOS and Android builds. Ship those builds before a compatible OTA relies on file share registration. Device verification is still required for native sharing, the Android patch, file picking, and download naming.

Release warning: clients with the old image-only attachment contract cannot decode threads that contain file attachments. The tolerant contract in #8235 and the feed support in this PR must ship before the web client exposes file uploads.

Original work by Theo Browne with Claude Fable 5 in the Claude Code harness. Modernized by GPT-5.6 Sol in the Codex harness.

---

Note

Medium Risk
Touches native share intents, local file lifecycle, and server upload/delete paths; mistakes could leak storage or mishandle user-owned URIs, though ownership checks and extensive tests mitigate this. Requires new native builds for broad share MIME registration and the patched expo-sharing module.

Overview
Extends the mobile composer beyond images to generic file attachments end-to-end: pick/copy into app-owned storage, show file chips in the attachment strip, upload pending server bytes before startTurn, and render downloadable file rows in the thread feed (with inert rows for unknown types).

Share sheet and system share targets now accept documents (iOS supportsFileWithMaxCount, Android */*). Incoming shares persist PDFs and similar without base64, enforce size limits, filter by destination server capabilities, and only delete files under owned sandbox/App Group paths so open-in-place shares cannot wipe the sender’s document. The share inbox rolls back persisted copies if the durable draft write fails.

Composer UX adds Photos vs Files when the server advertises fileAttachments, gates share import until server config is known for file shares, and sweeps unused local files after import/cancel/send. Outbox/editor reliability moves removal helpers to thread-outbox-removal, chains pending-task editor flushes with revision CAS, and reuses pending uploads across retry attempts via prepareTurnAttachments.

^{Reviewed by Cursor Bugbot for commit ae9086c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add file picking, sharing, and receiving to mobile threads

• Broadens the attachment model from images to generic DraftComposerAttachment across the composer, outbox, and incoming share flows
• Adds pickComposerFiles and persistComposerAttachmentFile in composerImages.ts to copy picked files to app storage while enforcing per-message count and size limits
• Reworks thread-outbox-manager.ts to track per-message monotonic revisions and enforce compare-and-set (CAS) semantics on update, remove, and clearEnvironment to handle concurrent edits safely
• Introduces reference-counting cleanup sweeps for unreferenced attachment files in use-composer-drafts.ts and thread-outbox-removal.ts
• Patches expo-sharing in expo-sharing@57.0.16.patch to extract originalName via the Android content resolver and handle mixed text/file payloads
• Risk: Outbox update and remove now conditionally require expectedRevision; removal and environment clear logic moved to thread-outbox-removal.ts and callers bypassing it will miss automatic attachment cleanup

^{Macroscope summarized ae9086c.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 915eadc9-de1b-4496-8422-38c1b6e9d2bb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−7 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−13 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	11	11	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+81 B (+0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+85 B (+1.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	+88 B (+0.2%)	66.4 KiB	✅
Claude	Live turn messages	9	11	+2 (+22.2%)	21	✅

Baseline: d22709f · PR result: ae9086c · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds an end-to-end mobile file attachment and sharing capability across native registration, local storage, uploads, thread rendering, and outbox recovery. It also changes share-target defaults and introduces significant lifecycle and native-runtime side effects, warranting human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 470c8d5. Configure here.}

[t3dotgg]

@juliusmarminge you down to push this one over the finish line?