Skip to content

trunk-merge/pr-3836/14186d57-3c8c-43a2-94db-e6393cbad3ac - #3842

Closed
trunk-io[bot] wants to merge 4 commits into
mainfrom
trunk-merge/pr-3836/14186d57-3c8c-43a2-94db-e6393cbad3ac
Closed

trunk-merge/pr-3836/14186d57-3c8c-43a2-94db-e6393cbad3ac#3842
trunk-io[bot] wants to merge 4 commits into
mainfrom
trunk-merge/pr-3836/14186d57-3c8c-43a2-94db-e6393cbad3ac

Conversation

@trunk-io

@trunk-io trunk-io Bot commented Jul 27, 2026

Copy link
Copy Markdown
Trunk Merge Pull Request Banner

This pull request was created and is being managed by Trunk Merge.

This pull request is based on the main branch at SHA bb3f037ba3ff04ade6224bcef4b7031d273ee272.

See more details about each PR in the batch here:

When CI completes, this pull request will be closed automatically.

Pull Requests Being Tested

This pull request is testing a batch with the changes from pull requests 3836 and 3787 - batching documentation.

Gilbert09 and others added 4 commits July 24, 2026 11:51
Previously the mobile task composer cleared the typed text and attachments on
submit and fire-and-forgot the send. A failed send (network/API error) only
logged and showed an alert — the user's message and any picked attachments were
lost.

The send path now reports success/failure back to the composer across every
branch of handleSendPrompt (queued-message edit, terminal-session resend, queue
mode, steer/interrupt, and normal send). The composer still clears immediately
and stays responsive; on failure it restores the submitted text and attachments,
but only when the composer is still empty (the user hasn't started a new draft)
and the failed submission is still the latest one (guarded by a monotonic
submission id). The decision logic lives in a small pure helper module with
Vitest coverage.

Ports desktop PRs #3766 and #3785 to the mobile app.

Generated-By: PostHog Code
Task-Id: d27aba44-dcf9-4ed7-b588-128490732718
Ports the CSP enforcement from desktop PR #3803 to the mobile app.

Mobile already had the sandbox hardening from #3803 (dropped allow-same-origin,
srcdoc instead of document.write, bridgeClosed guard) but never built or
injected a CSP meta tag, so MCP app HTML ran in the WebView with no CSP.

Adds a local mcpAppCsp.ts mirroring desktop's mcp-app-csp.ts (same directives,
same restrictive default policy, doctype-aware injection) and applies it at the
single seam where HTML is handed to the sandboxed frame in useMobileAppBridge.

Generated-By: PostHog Code
Task-Id: a853a2a7-56b2-4faa-a41d-d04505fb2761
@github-actions

Copy link
Copy Markdown

React Doctor found no issues in the changed files. 🎉

Reviewed by React Doctor for commit c466fc8.

@trunk-io trunk-io Bot closed this Jul 27, 2026
@trunk-io
trunk-io Bot deleted the trunk-merge/pr-3836/14186d57-3c8c-43a2-94db-e6393cbad3ac branch July 27, 2026 14:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant