feat(app): mobile UI improvements — content spacing, UI zoom, spacing scale

.agents/skills/release-beta/SKILL.md

@@ -1,13 +1,9 @@
 ---
 name: release-beta
-description: Cut a beta release of Paseo. Use when the user says "release beta", "cut a beta", "ship a beta", "beta release", or "/release-beta". Betas are release candidates on the beta channel — they carry an in-place changelog entry, don't move the website download target, and publish npm only on the beta dist-tag.
+description: Cut a beta release of Paseo. Use when the user says "release beta", "cut a beta", "ship a beta", "beta release", or "/release-beta".
 user-invocable: true
 ---
 
 # Release beta
 
-Read `docs/release.md` in the Paseo repo and follow the **Beta flow** section end-to-end. Run the **Beta release** completion checklist at the bottom of that doc.
-
-During preparation, classify the previous-stable-to-`HEAD` diff as patch or minor and show the target version and rationale to the user. Agents never select a major version autonomously.
-
-Each beta updates an in-place `CHANGELOG.md` entry (`## X.Y.Z-beta.N`) that gets overwritten at promotion, and npm publishes only on the explicit `beta` dist-tag.
+Follow the **Beta flow** and **Beta release** completion checklist in `docs/release.md` end-to-end.

.agents/skills/release-stable/SKILL.md

@@ -6,8 +6,4 @@ user-invocable: true
 
 # Release stable
 
-Read `docs/release.md` in the Paseo repo and follow the **Standard release (stable)** flow if cutting fresh, or the **Beta flow** promotion step if promoting an existing beta. Run the **Stable release (or promotion)** completion checklist at the bottom of that doc.
-
-For a fresh release, classify the previous-stable-to-`HEAD` diff as patch or minor and show the target version and rationale to the user. Agents never select a major version autonomously.
-
-The doc covers the changelog, pre-release sanity check, and post-release babysit pattern. Don't skip steps.
+Follow the applicable flow and the **Stable release (or promotion)** completion checklist in `docs/release.md` end-to-end.

.easignore

@@ -0,0 +1,21 @@
+# Exclude non-app packages and docs from EAS upload
+packages/cli/
+packages/desktop/
+packages/relay/
+packages/website/
+packages/protocol/
+packages/plugin/
+packages/highlight/
+packages/expo-two-way-audio/
+scripts/
+docs/
+.github/
+.dev/
+*.md
+.gitignore
+.easignore
+
+# EAS cloud runner has bun 1.2 which can't read lockfileVersion 2 (bun 1.4+).
+# Exclude bun.lock so EAS falls back to npm with package-lock.json.
+bun.lock
+bun.lockb

.github/PULL_REQUEST_TEMPLATE.md

@@ -18,7 +18,7 @@ Closes #
 
 ### Reasoning
 
-<!-- A short description of the reasoning of this change in your own words. What was wrong, and how do you hope this PR fixes it. If you can't explain this briefly, the PR is probably too big. This description must be grounded in real user flows and framed as value provider to Paseo users. -->
+<!-- A short description of the reasoning of this change in your own words. What was wrong, and how do you hope this PR fixes it. If you can't explain this briefly, the PR is probably too big. This description must be grounded in real user flows and framed as value provided to Paseo users. -->
 
 ### Goals
 

.github/workflows/android-apk-release.yml

@@ -20,16 +20,14 @@ env:
   SOURCE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
 
 jobs:
-  publish-android-apk:
+  ensure-release:
     permissions:
       contents: write
-      packages: read
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          sparse-checkout: scripts
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
 
       - name: Resolve release tag
@@ -43,7 +41,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          if gh release view "$RELEASE_TAG" --repo "${{ github.repository }}" >/dev/null 2>&1; then
+          if node scripts/github-release.mjs --repo "${{ github.repository }}" --tag "$RELEASE_TAG" >/dev/null 2>&1; then
             exit 0
           fi
 
@@ -52,6 +50,7 @@ jobs:
             --repo "${{ github.repository }}"
             --title "Paseo $RELEASE_TAG"
             --notes ""
+            --draft
           )
 
           if [[ "$IS_PRERELEASE" == "true" ]]; then
@@ -60,8 +59,26 @@ jobs:
 
           if ! gh "${release_args[@]}"; then
             echo "Release creation raced with another workflow; continuing."
+            node scripts/github-release.mjs --repo "${{ github.repository }}" --tag "$RELEASE_TAG" >/dev/null
           fi
 
+  publish-android-apk:
+    needs: [ensure-release]
+    permissions:
+      contents: write
+      packages: read
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
+
+      - name: Resolve release tag
+        shell: bash
+        run: node scripts/emit-release-env.mjs --source-tag "$SOURCE_TAG" >> "$GITHUB_ENV"
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
@@ -84,11 +101,37 @@ jobs:
       - name: Build Android APK on EAS
         id: eas_build
         shell: bash
+        env:
+          EAS_ANDROID_KEYSTORE_BASE64: ${{ secrets.EAS_ANDROID_KEYSTORE_BASE64 }}
+          EAS_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.EAS_ANDROID_KEYSTORE_PASSWORD }}
+          EAS_ANDROID_KEY_ALIAS: ${{ secrets.EAS_ANDROID_KEY_ALIAS }}
+          EAS_ANDROID_KEY_PASSWORD: ${{ secrets.EAS_ANDROID_KEY_PASSWORD }}
         run: |
           set -euo pipefail
+
+          # Strip bun.lock from the repo so EAS doesn't try bun install.
+          # EAS detects bun workspace from bun.lock before .easignore applies.
+          rm -f bun.lock bun.lockb
+
           cd packages/app
 
+          # Write keystore INSIDE the project so EAS uploads it to cloud
+          echo "$EAS_ANDROID_KEYSTORE_BASE64" | base64 -d > .release.keystore
+          cat > credentials.json <<CREDS
+          {
+            "android": {
+              "keystore": {
+                "keystorePath": ".release.keystore",
+                "keystorePassword": "$EAS_ANDROID_KEYSTORE_PASSWORD",
+                "keyAlias": "$EAS_ANDROID_KEY_ALIAS",
+                "keyPassword": "$EAS_ANDROID_KEY_PASSWORD"
+              }
+            }
+          }
+          CREDS
+
           build_json="$(npx eas build --platform android --profile production-apk --non-interactive --wait --json)"
+          rm -f credentials.json .release.keystore
           echo "$build_json" > "$RUNNER_TEMP/eas-build.json"
 
           build_id="$(jq -r 'if type == "array" then .[0].id // empty else .id // empty end' "$RUNNER_TEMP/eas-build.json")"
@@ -117,7 +160,7 @@ jobs:
             exit 1
           fi
 
-          asset_name="paseo-${RELEASE_TAG}-android.apk"
+          asset_name="hydra-paseo-${RELEASE_TAG}-android.apk"
           asset_path="$RUNNER_TEMP/$asset_name"
 
           curl --fail --location --output "$asset_path" "$artifact_url"
@@ -129,4 +172,5 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release upload "$RELEASE_TAG" "${{ steps.artifact.outputs.asset_path }}" --clobber --repo "${{ github.repository }}"
+          release_lookup="$(node scripts/github-release.mjs --repo "${{ github.repository }}" --tag "$RELEASE_TAG")"
+          gh release upload "$release_lookup" "${{ steps.artifact.outputs.asset_path }}" --clobber --repo "${{ github.repository }}"

.github/workflows/ci.yml

@@ -52,7 +52,7 @@ jobs:
           filters: .github/ci-paths.yml
 
       - name: Validate CI contracts
-        run: node --test scripts/ci-workflow.test.mjs scripts/daemon-launch-contract.test.mjs
+        run: node --test scripts/ci-workflow.test.mjs scripts/daemon-launch-contract.test.mjs scripts/sync-fdroid-changelogs.test.mjs
 
   format:
     name: format
@@ -348,12 +348,12 @@ jobs:
         timeout-minutes: 10
         run: npx playwright install chromium
 
-      - name: Build app dependencies
-        run: npm run build:app-deps
-
       - name: Build server stack
         run: npm run build:server
 
+      - name: Build native app dependency
+        run: npm run build --workspace=@getpaseo/expo-two-way-audio
+
       - name: Install agent CLIs for provider tests
         run: node scripts/npm-retry.mjs install -g @anthropic-ai/claude-code @openai/codex@0.105.0 opencode-ai
 

.github/workflows/desktop-release.yml

@@ -75,7 +75,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          if gh release view "$RELEASE_TAG" --repo "${{ github.repository }}" > /dev/null 2>&1; then
+          if node scripts/github-release.mjs --repo "${{ github.repository }}" --tag "$RELEASE_TAG" > /dev/null 2>&1; then
             echo "Release $RELEASE_TAG already exists, skipping creation"
           else
             prerelease_flag=""
@@ -86,8 +86,10 @@ jobs:
               --repo "${{ github.repository }}" \
               --title "Paseo $RELEASE_TAG" \
               --notes "" \
+              --draft \
               $prerelease_flag || {
                 echo "Release creation raced with another workflow; continuing."
+                node scripts/github-release.mjs --repo "${{ github.repository }}" --tag "$RELEASE_TAG" > /dev/null
               }
           fi
 
@@ -191,7 +193,8 @@ jobs:
             echo "::error::No release artifacts found in $release_dir"
             exit 1
           fi
-          gh release upload "$RELEASE_TAG" "${files[@]}" --clobber --repo "${{ github.repository }}"
+          release_lookup="$(node scripts/github-release.mjs --repo "${{ github.repository }}" --tag "$RELEASE_TAG")"
+          gh release upload "$release_lookup" "${files[@]}" --clobber --repo "${{ github.repository }}"
 
       - name: Upload desktop artifacts to workflow
         if: env.SHOULD_PUBLISH != 'true'
@@ -299,7 +302,8 @@ jobs:
             echo "::error::No release artifacts found in $release_dir"
             exit 1
           fi
-          gh release upload "$RELEASE_TAG" "${files[@]}" --clobber --repo "${{ github.repository }}"
+          release_lookup="$(node scripts/github-release.mjs --repo "${{ github.repository }}" --tag "$RELEASE_TAG")"
+          gh release upload "$release_lookup" "${files[@]}" --clobber --repo "${{ github.repository }}"
 
       - name: Upload desktop artifacts to workflow
         if: env.SHOULD_PUBLISH != 'true'
@@ -404,7 +408,8 @@ jobs:
             echo "::error::No release artifacts found in $release_dir"
             exit 1
           fi
-          gh release upload "$RELEASE_TAG" "${files[@]}" --clobber --repo "${{ github.repository }}"
+          release_lookup="$(node scripts/github-release.mjs --repo "${{ github.repository }}" --tag "$RELEASE_TAG")"
+          gh release upload "$release_lookup" "${files[@]}" --clobber --repo "${{ github.repository }}"
 
       - name: Upload desktop artifacts to workflow
         if: env.SHOULD_PUBLISH != 'true'
@@ -424,7 +429,7 @@ jobs:
 
   finalize-rollout:
     needs: [publish-macos, publish-linux, publish-windows]
-    if: ${{ always() && (needs.publish-macos.result == 'success' || needs.publish-macos.result == 'skipped') && (needs.publish-linux.result == 'success' || needs.publish-linux.result == 'skipped') && (needs.publish-windows.result == 'success' || needs.publish-windows.result == 'skipped') && (github.event_name != 'workflow_dispatch' || github.event.inputs.publish != 'false') }}
+    if: ${{ always() && (github.event_name != 'workflow_dispatch' || github.event.inputs.publish != 'false') }}
     permissions:
       contents: write
     runs-on: ubuntu-latest
@@ -480,7 +485,7 @@ jobs:
           name: windows-manifest
           path: release-manifests/windows-manifest
 
-      - name: Assemble and upload stamped manifests
+      - name: Assemble manifests and publish release
         if: env.IS_SMOKE_TAG != 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -491,6 +496,33 @@ jobs:
           manifests_dir="$PWD/final"
           mkdir -p "$manifests_dir"
 
+          expected_manifests=(
+            "${RELEASE_CHANNEL}-mac.yml"
+            "${RELEASE_CHANNEL}-linux.yml"
+            "${RELEASE_CHANNEL}.yml"
+          )
+          release_lookup="$(node ../scripts/github-release.mjs --repo "${{ github.repository }}" --tag "$RELEASE_TAG" --cleanup-duplicates)"
+          existing_assets="$(gh release view "$release_lookup" --repo "${{ github.repository }}" --json assets --jq '.assets[].name')"
+          for manifest_name in "${expected_manifests[@]}"; do
+            if grep -Fxq "$manifest_name" <<< "$existing_assets"; then
+              case "$manifest_name" in
+                "${RELEASE_CHANNEL}-mac.yml") platform_result="${{ needs.publish-macos.result }}" ;;
+                "${RELEASE_CHANNEL}-linux.yml") platform_result="${{ needs.publish-linux.result }}" ;;
+                "${RELEASE_CHANNEL}.yml") platform_result="${{ needs.publish-windows.result }}" ;;
+              esac
+              if [[ "$platform_result" =~ ^(success|skipped)$ ]]; then
+                gh release download "$release_lookup" \
+                  --repo "${{ github.repository }}" \
+                  --pattern "$manifest_name" \
+                  --dir "$manifests_dir"
+              else
+                gh release delete-asset "$release_lookup" "$manifest_name" \
+                  --repo "${{ github.repository }}" \
+                  --yes
+              fi
+            fi
+          done
+
           if [[ "${{ needs.publish-macos.result }}" == "success" ]]; then
             manifest_name="${RELEASE_CHANNEL}-mac.yml"
             node ../scripts/merge-mac-manifest.mjs \
@@ -515,6 +547,7 @@ jobs:
           fi
           timestamp="$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")"
           node ../scripts/stamp-rollout.mjs --release-date "$timestamp" --rollout-hours "$ROLLOUT_HOURS" "${files[@]}"
+          # shellcheck disable=SC2016
           ROLLOUT_HOURS_EXPECTED="$ROLLOUT_HOURS" RELEASE_DATE_EXPECTED="$timestamp" node -e '
             const yaml = require("js-yaml");
             const fs = require("fs");
@@ -536,4 +569,28 @@ jobs:
               }
             }
           ' "${files[@]}"
-          gh release upload "$RELEASE_TAG" "${files[@]}" --clobber --repo "${{ github.repository }}"
+          gh release upload "$release_lookup" "${files[@]}" --clobber --repo "${{ github.repository }}"
+
+          failed_builds=()
+          [[ "${{ needs.publish-macos.result }}" =~ ^(success|skipped)$ ]] || failed_builds+=(macOS)
+          [[ "${{ needs.publish-linux.result }}" =~ ^(success|skipped)$ ]] || failed_builds+=(Linux)
+          [[ "${{ needs.publish-windows.result }}" =~ ^(success|skipped)$ ]] || failed_builds+=(Windows)
+          if (( ${#failed_builds[@]} > 0 )); then
+            echo "::error::Desktop builds did not complete for ${failed_builds[*]}; the release remains a draft"
+            exit 1
+          fi
+
+          missing_manifests=()
+          for manifest_name in "${expected_manifests[@]}"; do
+            [[ -f "$manifests_dir/$manifest_name" ]] || missing_manifests+=("$manifest_name")
+          done
+          if (( ${#missing_manifests[@]} > 0 )); then
+            echo "::error::Missing updater manifests: ${missing_manifests[*]}; the release remains a draft"
+            exit 1
+          fi
+
+          publish_args=(release edit "$release_lookup" --tag "$RELEASE_TAG" --draft=false --repo "${{ github.repository }}")
+          if [[ "$IS_PRERELEASE" == "true" ]]; then
+            publish_args+=(--prerelease)
+          fi
+          gh "${publish_args[@]}"

.github/workflows/docker.yml

@@ -18,6 +18,7 @@ on:
       - "packages/client/**"
       - "packages/expo-two-way-audio/**"
       - "packages/highlight/**"
+      - "packages/plugin/**"
       - "packages/protocol/**"
       - "packages/relay/**"
       - "packages/server/**"

.github/workflows/nix-update-hash.yml

@@ -10,6 +10,7 @@ on:
       - "package.json"
       - "package-lock.json"
       - "packages/highlight/**"
+      - "packages/plugin/**"
       - "packages/server/**"
       - "packages/relay/**"
       - "packages/cli/**"

.github/workflows/nix.yml

@@ -12,6 +12,7 @@ on:
       - "packages/app/**"
       - "packages/expo-two-way-audio/**"
       - "packages/highlight/**"
+      - "packages/plugin/**"
       - "packages/protocol/**"
       - "packages/client/**"
       - "packages/server/**"