[yordis]

• Merge applied without textual conflicts except the agent context budget file: took upstream's values, then re-recorded the measured MCP tool list size (48359) so the budget test passes and stays below main's recorded value.
• Upstream added Blacksmith-only mobile workflows and unpinned action tags: pinned every tag to a full commit SHA (reusing existing pins) so the org policy does not cause startup failures.
• useblacksmith/stickydisk is not on the org allowlist: removed the cache mount steps and disabled the Android and iOS build jobs (dev client, preview, production), since this fork does not ship mobile builds.
• No fork ledger entry was made redundant by the new upstream commits; migrations are untouched and identical to upstream.

---

Note

Medium Risk
Touches OAuth CSRF binding, preview tab selection for agents, and a large mobile layout refactor; mobile build jobs are disabled here but merged workflow/scripts still expand CI surface.

Overview
Brings in Blacksmith-backed mobile automation: a new Mobile Dev Client workflow and split Android/iOS EAS preview pipelines (local Android builds, shared PR comment script with tests, CI wiring). Docs and agent skills now describe dispatching that workflow when mobile:install misses cache. This fork keeps the workflow files but disables Android/iOS build jobs, drops sticky-disk mounts, and pins workflow action SHAs per org policy.

Mobile app splits adaptive workspace context into stable actions vs pane state (useWorkspacePaneState) to cut re-renders on sidebar toggles, and removes the Android composer-keyboard sidebar slide/overhang behavior. Thread lists and the composer show ACP registry instance names when icons don’t distinguish them; Android drops compact single-line headers; the thread feed stops Android focus-scroll jumps and drops unused initial content inset helpers.

Server: MCP OAuth CSRF binds to DPoP thumbprint when the hosted app renews credentials on the same browser key; preview tab visibility and default tab pick follow the desktop-shown tab, not only stream viewers; Antigravity usage gets richer model resolution/pricing and strips inherited Crashpad pipe env; preview tool copy tightens write vs display guidance. Web: image preview uses Ctrl/pinch to zoom and normal wheel to pan.

^{Reviewed by Cursor Bugbot for commit b0782c9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b0782c9. Configure here.}

[cursor]

Fork Android preview build still enabled

Medium Severity

The fork Android preview android-build job still runs when needs.preview.outputs.build is true. The other native build jobs (mobile-dev-client, same-repo preview android-build, production store builds) are gated with if: false because this fork does not ship mobile builds, but this pull_request_target job was left enabled. A labeled fork PR with no existing client still starts a 32-vCPU Blacksmith eas build --local using the reviewed SHA and EXPO_PREVIEW_TOKEN.

 

^{Reviewed by Cursor Bugbot for commit b0782c9. Configure here.}

[cursor]

Preview comment waits for disabled build

Medium Severity

The same-repo Android preview job still comments that a Blacksmith client is building and will receive an install link when that finishes. android-build is now if: false, so when no cached client exists the comment stays on “Building on Blacksmith” with a run link that never posts the APK. Testers cannot tell the native build was intentionally skipped.

Additional Locations (1)

• .github/scripts/mobile-preview-comment.cjs#L56-L57

 

^{Reviewed by Cursor Bugbot for commit b0782c9. Configure here.}