feat: P2 — tool approvals, streaming markdown, and tool-call diffs

[saucam]

What

P2 for codeoid-mobile: the provider-agnostic approve/deny bar, a markdown streaming transcript, and Edit/Write tool diffs. Mobile-only — no daemon or protocol changes; builds on the already-published @codeoid/{protocol,core}@0.1.0.

This is the "approvals + streaming first" slice. Push notifications are a separate follow-up (they need protocol + daemon + a relay).

Highlights

• ApprovalBar — binary approve/deny via session.approve. Detection reuses the shared @codeoid/core findPendingApproval kernel (usePendingApproval = throttled transcript + live session status), so it stays consistent with the web bar. Provider-agnostic by construction: claude / codex / pi / acp all normalize to the one waiting_confirmation + approvalId wire contract in the daemon, so the bar never branches on provider. The in-flight machine stays disabled until the tool-state delta lands and is keyed by approvalId so each approval starts clean.
• Streaming transcript — FlashList v2 (chat-style stick-to-bottom via maintainVisibleContentPosition), MessageRow role dispatch, MarkdownText (react-native-marked, memoized by text). rAF-coalesced store subscriptions + a per-row useMessageVersion so a 20-40/s token stream repaints once per frame and streamed content never freezes behind memoization (the store mutates messages in place, so ref identity can't drive per-row updates).
• ToolCard — tool-call state machine (phase badge + per-phase body) with a persistent Edit/Write diff across phases, reconstructed from tool.input with jsdiff and collapsed to ±2 context lines (src/lib/diff.ts).

Library choice

Deliberately react-native-marked (pure-JS; only native peer is react-native-svg, bundled in Expo Go SDK 57), not the design doc's react-native-streamdown — streamdown's native peers (react-native-enriched-markdown, react-native-worklets) aren't in Expo Go and would force a custom dev build. Keeping this slice Expo-Go-runnable is the whole point of shipping it first (usable over Tailscale today). FlashList 2.0.2 + react-native-svg 15.15.4 are pinned to the versions Expo Go SDK 57 bundles.

Scope notes

• v1 approvals are binary — updatedInput (edit-then-approve) is deferred: the daemon doesn't broadcast a tool's patchableKeys to clients, and codex ignores updatedInput.
• gemini/openai backends expose no gateable mutating tools, so the bar simply never appears for them (correct behavior).
• Rich parts[] rendering (code/table/tree/image beyond plain text) is a follow-up; assistant text renders from the authoritative content string, matching the web UI.

Verification

• tsc --noEmit + eslint . clean.
• expo export --platform web bundles 952 modules.
• src/lib/diff.ts unit-tested — 14 assertions incl. context collapse + line numbering.
• Read-only protocol probe against a live daemon (auth → list → attach) observed 525 real messages across all roles; every shape matches the renderers.
• Pending: a live approval click-through (a session must be actively blocked on a tool) + on-device render — needs an interactive session, not exercisable headlessly.

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	diff@​9.0.0
	react-native-svg@​15.15.4
	react-native-marked@​8.1.1
	@​shopify/​flash-list@​2.0.2

View full report