Make the Rust client the sole app

app/src/android/app_log.rs

@@ -0,0 +1,101 @@
+//! The platform half of this app's logging: what
+//! `crate::client::log_ring` needs that only Android can supply, which is
+//! `android_logger` as the logger to forward to and nothing else.
+
+use crate::client::log_ring::{self, LogRing};
+use std::{
+    fs, panic,
+    path::{Path, PathBuf},
+    sync::OnceLock,
+};
+
+/// Installs the in-process ring in front of Android's logger.
+pub fn install(max_level: log::LevelFilter) {
+    let inner = android_logger::AndroidLogger::new(
+        android_logger::Config::default()
+            .with_max_level(max_level)
+            .with_tag("iris-android-app"),
+    );
+    if log_ring::install_process_logger(
+        Box::new(inner),
+        max_level,
+        iris::diagnostics::trace_enabled,
+    )
+    .is_err()
+    {
+        log::warn!("iris app log: a logger was already installed, so there is no ring");
+    }
+    install_panic_hook();
+}
+
+pub fn ring() -> &'static LogRing {
+    log_ring::process_ring()
+}
+
+#[cfg(feature = "bench")]
+pub fn diagnostics_line() -> String {
+    let where_to_read = match crate::android::devlog::authority() {
+        Some(authority) => format!("devlog provider: content://{authority}"),
+        None => "devlog provider: declared, not created yet".to_string(),
+    };
+    format!("{}\n{where_to_read}", ring().summary())
+}
+
+/// Where the panic hook leaves its report, under the app's private
+/// directory. Read back and dropped by [`set_crash_dir`] on the next
+/// start.
+const CRASH_FILE: &str = "last-panic.txt";
+
+/// Enough preceding log lines to explain a crash without evicting the next run.
+const CRASH_CONTEXT_LINES: usize = 80;
+
+const PREVIOUS_RUN_TARGET: &str = "previous_run";
+
+static CRASH_PATH: OnceLock<PathBuf> = OnceLock::new();
+
+/// Copies aborting panics into the device-readable log ring.
+fn install_panic_hook() {
+    let previous = panic::take_hook();
+    panic::set_hook(Box::new(move |info| {
+        let where_at = match info.location() {
+            Some(at) => format!("{}:{}:{}", at.file(), at.line(), at.column()),
+            None => "an unknown location".to_string(),
+        };
+        let message = info.payload_as_str().unwrap_or("Box<dyn Any>");
+        let line = format!("iris panic at {where_at}: {message}");
+        log::error!("{line}");
+        if let Some(path) = CRASH_PATH.get() {
+            let context = ring()
+                .try_tail_text(CRASH_CONTEXT_LINES)
+                .unwrap_or_else(|| {
+                    "(the log ring was locked as this run died; no context)".to_string()
+                });
+            let _ = fs::write(path, format!("{line}\n{context}"));
+        }
+        previous(info);
+    }));
+}
+
+/// Configures crash persistence and replays a report left by the previous run.
+pub fn set_crash_dir(dir: &Path) {
+    let path = dir.join(CRASH_FILE);
+    if let Ok(previous) = fs::read_to_string(&path) {
+        // Delete first so a panic during replay cannot create a replay loop.
+        let _ = fs::remove_file(&path);
+        replay_crash(&previous);
+    }
+    let _ = CRASH_PATH.set(path);
+}
+
+/// Puts a previous run's report back in the ring: its context lines in
+/// the order they happened, then the panic itself.
+fn replay_crash(report: &str) {
+    let (panic_line, context) = report.split_once('\n').unwrap_or((report, ""));
+    for line in context.lines().filter(|line| !line.is_empty()) {
+        ring().push(log::Level::Info, PREVIOUS_RUN_TARGET, line.to_string());
+    }
+    log::error!(
+        "iris app log: the previous run died -- {}",
+        panic_line.trim()
+    );
+}

app/src/android/bench_client.rs

@@ -0,0 +1,888 @@
+use crate::android::bench_jni::PlatformHandle;
+use crate::client::transcript_fold::{TranscriptItem, fold_event};
+use crate::ui::{self, TranscriptScreen};
+use android_view::jni::{JavaVM, objects::GlobalRef};
+use event_model::SeqEvent;
+use iris::android::{AndroidAppState, AndroidRsc, AndroidUiState, HasAndroidUiState};
+use iris::prelude::*;
+use std::{
+    fs, mem,
+    sync::{
+        Arc, Mutex,
+        atomic::{AtomicBool, Ordering},
+        mpsc,
+    },
+    time::{Duration, Instant},
+};
+
+const STREAM_EVENTS_PER_SEC: u64 = 20;
+const STREAM_SECONDS: u64 = 20;
+
+const LEGACY_CYCLES: usize = 6;
+
+const FLING_VELOCITY_PX_S: f32 = 12_000.0;
+const FLING_COUNT: usize = 8;
+const FLING_SETTLE_CAP_MS: u64 = 3_000;
+const FLING_PAUSE_MS: u64 = 300;
+
+const TYPE_TEXT: &str = "Benchmarking this transcript screen requires unusually long, \
+multisyllabic words so wrapping and reflow are properly exercised: internationalization, \
+counterproductiveness, disproportionately, incomprehensibility, deinstitutionalization, \
+uncharacteristically, overenthusiastically, misunderstanding, straightforwardness, \
+telecommunications, and interdisciplinary collaboration all push a narrow composer field to \
+wrap across several lines while the transcript above is pushed upward by the growing \
+keyboard-adjacent box, which is exactly what a real reader typing a long message sees \
+happening now!!!";
+const TYPE_CHAR_MS: u64 = 50;
+
+const KEYBOARD_CYCLES: usize = 5;
+const KEYBOARD_WAIT_MS: u64 = 1_000;
+
+const POLL_MS: u64 = 16;
+
+const REPORT_MAX_HEIGHT_DP: f32 = 260.0;
+
+pub struct BenchClient {
+    ui_state: AndroidUiState,
+    content: WeakWidget<WidgetPtr>,
+    report_display: WeakWidget<TextEdit>,
+    top_bar: WeakWidget<WidgetPtr>,
+    screen: Option<TranscriptScreen>,
+    items: Vec<TranscriptItem>,
+    stream_tail: Vec<SeqEvent>,
+    platform: Option<Arc<PlatformHandle>>,
+    last_report: Option<String>,
+    running: bool,
+    ime_state: Arc<Mutex<ImeState>>,
+    keyboard_was_visible: bool,
+    last_top_pad: f32,
+}
+
+#[derive(Default)]
+struct ImeState {
+    visible: bool,
+    shown_events: u32,
+    hidden_events: u32,
+}
+
+impl HasAndroidUiState for BenchClient {
+    fn android_state(&self) -> &AndroidUiState {
+        &self.ui_state
+    }
+    fn android_state_mut(&mut self) -> &mut AndroidUiState {
+        &mut self.ui_state
+    }
+}
+
+fn placeholder<Rsc: HasEvents>(rsc: &mut Rsc, message: &str) -> StrongWidget {
+    wtext(message.to_string())
+        .color(PaintId::WHITE)
+        .wrap(true)
+        .pad(16)
+        .add_strong(rsc)
+        .any()
+}
+
+fn process_cpu_ms() -> Option<u64> {
+    // SAFETY: `rusage` is a plain-old-data struct `getrusage` fully
+    // initialises on success; on failure it is never read.
+    unsafe {
+        let mut usage: libc::rusage = mem::zeroed();
+        if libc::getrusage(libc::RUSAGE_SELF, &mut usage) != 0 {
+            return None;
+        }
+        let user_ms = usage.ru_utime.tv_sec as u64 * 1000 + usage.ru_utime.tv_usec as u64 / 1000;
+        let sys_ms = usage.ru_stime.tv_sec as u64 * 1000 + usage.ru_stime.tv_usec as u64 / 1000;
+        Some(user_ms + sys_ms)
+    }
+}
+
+fn peak_rss_kb() -> Option<u64> {
+    fs::read_to_string("/proc/self/status")
+        .ok()?
+        .lines()
+        .find_map(|line| line.strip_prefix("VmHWM:"))
+        .and_then(|rest| rest.trim().strip_suffix("kB"))
+        .and_then(|n| n.trim().parse().ok())
+}
+
+fn battery_line(samples: &[i32]) -> String {
+    if samples.is_empty() {
+        return "  battery current: unavailable on this device".to_string();
+    }
+    let mean = samples.iter().map(|&v| v as i64).sum::<i64>() / samples.len() as i64;
+    let (Some(min), Some(max)) = (samples.iter().min(), samples.iter().max()) else {
+        unreachable!("samples is non-empty, checked above");
+    };
+    format!(
+        "  battery current: mean {mean}\u{b5}A over {} samples (min {min}, max {max})",
+        samples.len()
+    )
+}
+
+impl AndroidAppState for BenchClient {
+    fn new(mut ui_state: AndroidUiState, rsc: &mut AndroidRsc<Self>) -> Self {
+        let content = WidgetPtr::new().add(rsc);
+        let loading = placeholder(rsc, "Loading fixture...");
+        content(rsc).set(loading);
+
+        let report_display = wtext("")
+            .editable(EditMode::MultiLine)
+            .text_align(Align::LEFT)
+            .wrap(true)
+            .size(14)
+            .color(PaintId::WHITE)
+            .attr::<Selectable>(())
+            .label("Benchmark report")
+            .add(rsc);
+
+        let top_bar = WidgetPtr::new().add(rsc);
+        let controls = bench_controls(rsc, 0.0);
+        top_bar(rsc).set(controls);
+        let tree = (
+            top_bar,
+            report_display
+                .pad(dp(8))
+                .max_height(dp(REPORT_MAX_HEIGHT_DP)),
+            content.height(rest(1)),
+        )
+            .span(Dir::DOWN)
+            .add_strong(rsc)
+            .any();
+        ui_state.set_root(rsc, tree);
+
+        let font = rsc.ui.text.font_diagnostics();
+        log::info!(
+            "iris fonts: {} families found, default={:?} mono={:?}, resolved regular={:?} \
+             bold={:?} italic={:?} mono={:?}, icons={:?}",
+            font.families_found,
+            font.default_family,
+            font.default_mono_family,
+            font.regular_resolved,
+            font.bold_resolved,
+            font.italic_resolved,
+            font.mono_resolved,
+            font.icon_family,
+        );
+
+        let mut client = Self {
+            ui_state,
+            content,
+            report_display,
+            top_bar,
+            screen: None,
+            items: Vec::new(),
+            stream_tail: Vec::new(),
+            platform: None,
+            last_report: None,
+            running: false,
+            ime_state: Arc::new(Mutex::new(ImeState::default())),
+            keyboard_was_visible: false,
+            last_top_pad: 0.0,
+        };
+
+        match ui::fixture::build_screen(rsc) {
+            Ok((opened, tree)) => {
+                client.items = opened.items;
+                client.stream_tail = opened.stream_tail;
+                (client.content)(rsc).set(tree);
+                client.screen = Some(opened.screen);
+            }
+            Err(message) => {
+                client.show_message(rsc, &format!("Couldn't fold the bench fixture: {message}"))
+            }
+        }
+        client
+    }
+
+    fn platform_ready(&mut self, _rsc: &mut AndroidRsc<Self>, vm: JavaVM, view: GlobalRef) {
+        self.platform = Some(Arc::new(PlatformHandle::new(vm, view)));
+    }
+
+    fn back_pressed(&mut self, _rsc: &mut AndroidRsc<Self>) -> bool {
+        false
+    }
+
+    fn on_insets_changed(
+        &mut self,
+        rsc: &mut AndroidRsc<Self>,
+        insets: iris::android::WindowInsets,
+    ) {
+        if insets.top != self.last_top_pad {
+            self.last_top_pad = insets.top;
+            let controls = bench_controls(rsc, insets.top);
+            (self.top_bar)(rsc).set(controls);
+        }
+
+        if let Some(screen) = &self.screen {
+            screen
+                .composer
+                .set_bottom_inset(rsc, insets.bottom.max(insets.ime_bottom));
+        }
+
+        // The platform's own answer, not `ime_bottom > 0.0` -- see
+        // `iris::android::WindowInsets::ime_bottom`. The height is still
+        // climbing while the keyboard slides in, so a frame or two of a
+        // real opening reads as "closed" when the boolean is inferred from
+        // it, and `shown_events`/`hidden_events` below count transitions.
+        let ime_visible = insets.ime_visible;
+
+        let mut ime = self.ime_state.lock().unwrap();
+        if ime_visible && !ime.visible {
+            ime.shown_events += 1;
+        }
+        if !ime_visible && ime.visible {
+            ime.hidden_events += 1;
+        }
+        ime.visible = ime_visible;
+        drop(ime);
+
+        if ime_visible && !self.keyboard_was_visible {
+            self.keyboard_was_visible = true;
+            let redraw = rsc.tasks.redraw_handle();
+            rsc.spawn_task(async move |mut ctx| {
+                tokio::time::sleep(Duration::from_millis(KEYBOARD_DIAGNOSTICS_DELAY_MS)).await;
+                ctx.update(|state: &mut BenchClient, rsc| {
+                    state.capture_keyboard_diagnostics(rsc);
+                });
+                redraw.request_redraw();
+            });
+        } else if !ime_visible {
+            self.keyboard_was_visible = false;
+        }
+    }
+}
+
+const KEYBOARD_DIAGNOSTICS_DELAY_MS: u64 = 500;
+
+type Rsc = AndroidRsc<BenchClient>;
+
+/// What a report says about the `iris::input`/`iris::frame` trace, from
+/// the flag read at the start of what is being reported and again at the
+/// end.
+///
+/// Three answers rather than two. Those lines are default-off and the
+/// switch that turns them on is on screen while a benchmark runs, so
+/// "somebody moved it half way through" is a state that actually happens
+/// -- and reported as either "on" or "off" it is a confident sentence
+/// about a log that only covers part of the run. The "on" wording also
+/// says what it costs, because a traced run fills the ring in seconds and
+/// a reader looking at a log with nothing else in it should know why.
+fn trace_line(at_start: bool, at_end: bool) -> String {
+    match (at_start, at_end) {
+        (true, true) => "input/frame trace: on (iris::input and iris::frame lines are in \
+                         the app log, and a traced run fills the ring in seconds)"
+            .to_string(),
+        (false, false) => "input/frame trace: off".to_string(),
+        _ => "input/frame trace: switched during this run, so those lines cover only part \
+              of it"
+            .to_string(),
+    }
+}
+
+/// The header row's own backdrop -- see `bench_controls`'s doc comment on
+/// why it needs one at all. A dark neutral rather than pure black
+/// (`android::render::CLEAR_COLOR`) so the row reads as a distinct panel
+/// instead of a hole in the background the buttons happen to float in.
+const HEADER_SURFACE: Srgba8 = Srgba8::new(28, 28, 34, 255);
+
+/// `top_pad` is the status-bar inset in physical pixels (0.0 until
+/// `on_insets_changed` has run once) -- folded in here, rather than
+/// exposing the unadded builder for a caller to `.pad()` itself, because
+/// naming that builder's type at each call site is more machinery than a
+/// top-of-screen padding number is worth.
+const HEADER_TEXT: f32 = 18.0;
+
+const HEADER_ROW_HEIGHT_DP: f32 = 56.0;
+
+fn bench_controls(rsc: &mut Rsc, top_pad: f32) -> StrongWidget {
+    let run_rect = rect(Srgba8::rgb(40, 70, 40))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+                ctx.state.start_benchmark(rsc);
+            },
+        )
+        .label("Run benchmark");
+    let run = (
+        run_rect,
+        wtext("Run benchmark")
+            .size(HEADER_TEXT)
+            .text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    let copy_rect = rect(Srgba8::rgb(50, 50, 60))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+                ctx.state.copy_report(rsc);
+            },
+        )
+        .label("Copy report");
+    let copy = (
+        copy_rect,
+        wtext("Copy report")
+            .size(HEADER_TEXT)
+            .text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    let diag_rect = rect(Srgba8::rgb(60, 45, 70))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+                ctx.state.show_diagnostics(rsc);
+            },
+        )
+        .label("Diagnostics");
+    let diagnostics = (
+        diag_rect,
+        wtext("Diagnostics")
+            .size(HEADER_TEXT)
+            .text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    // A switch rather than a button, so its own appearance says which
+    // state it is in: the two `iris::input`/`iris::frame` targets are
+    // default-off (`iris::diagnostics`'s module doc) because a 120Hz
+    // session fills the 2000-line ring in seconds, so "is it on right
+    // now" is the question somebody has while looking at a log that is
+    // either full of trace or has none.
+    let tracing = iris::diagnostics::trace_enabled();
+    let trace_rect = rect(if tracing {
+        Srgba8::rgb(90, 70, 30)
+    } else {
+        Srgba8::rgb(50, 50, 60)
+    })
+    .on(
+        CursorSense::click(),
+        |ctx: EventIdCtx<'_, Rsc, _, _>, rsc: &mut Rsc| {
+            ctx.state.toggle_trace(rsc);
+        },
+    )
+    .label("Trace input and frames");
+    let trace = (
+        trace_rect,
+        wtext(if tracing { "Trace on" } else { "Trace off" })
+            .size(HEADER_TEXT)
+            .text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(dp(8))
+        .add(rsc);
+
+    let row1 = (run, copy).span(Dir::RIGHT).add(rsc);
+    let row2 = (diagnostics, trace).span(Dir::RIGHT).add(rsc);
+    let buttons = (row1, row2).span(Dir::DOWN).add(rsc);
+
+    (rect(HEADER_SURFACE), buttons)
+        .stack()
+        .height(dp(2.0 * HEADER_ROW_HEIGHT_DP))
+        .pad(Padding::top(top_pad))
+        .add_strong(rsc)
+        .any()
+}
+
+impl BenchClient {
+    fn show_message(&mut self, rsc: &mut Rsc, message: &str) {
+        let widget = placeholder(rsc, message);
+        (self.content)(rsc).set(widget);
+        self.screen = None;
+    }
+
+    fn rebuild_transcript(&mut self, rsc: &mut Rsc) {
+        let (screen, tree) = ui::build_tree(rsc, ui::fixture::rows(&self.items));
+        (self.content)(rsc).set(tree);
+        self.screen = Some(screen);
+    }
+
+    fn show_diagnostics(&mut self, rsc: &mut Rsc) {
+        let report = self.diagnostics_text(rsc);
+        self.report_display.edit(rsc).set(&report);
+        self.last_report = Some(report);
+    }
+
+    /// Turns the `iris::input`/`iris::frame` trace on or off, redraws the
+    /// switch that says so, and shows the pane that now reports it.
+    fn toggle_trace(&mut self, rsc: &mut Rsc) {
+        let on = !iris::diagnostics::trace_enabled();
+        iris::diagnostics::set_trace(on);
+        log::info!(
+            "iris diagnostics: input/frame trace {}",
+            if on { "on" } else { "off" }
+        );
+        let controls = bench_controls(rsc, self.last_top_pad);
+        (self.top_bar)(rsc).set(controls);
+        self.show_diagnostics(rsc);
+    }
+
+    /// The diagnostics report as text, with no side effect on what is on
+    /// screen -- shared by the `Diagnostics` button (which shows it) and
+    /// the keyboard-open capture (which only logs it), so the two can
+    /// never drift into reporting different things.
+    fn diagnostics_text(&self, rsc: &mut Rsc) -> String {
+        let font = rsc.ui.text.font_diagnostics();
+        let frame_report = match self.android_state().frame_report.report() {
+            Some(stats) => format!("{stats}"),
+            None => "no frames recorded yet".to_string(),
+        };
+        let renderer = match &self.android_state().renderer {
+            Some(renderer) => renderer.diagnostics_report(&font, &frame_report),
+            None => "iris diagnostics: no renderer yet (no surface)".to_string(),
+        };
+        // Insets must be visible without adb so a missing callback can be
+        // distinguished from a callback reporting zero IME height.
+        format!(
+            "{renderer}\n{}\n{}\n{}\n{}",
+            trace_line(
+                iris::diagnostics::trace_enabled(),
+                iris::diagnostics::trace_enabled()
+            ),
+            self.android_state().insets_report(),
+            // Which server this build talks to, and what to do when the
+            // answer is "none" -- the bench itself opens a checked-in
+            // fixture and needs no server, so this pane is the only place
+            // an enrolment can be seen to have taken.
+            crate::android::enrollment::status_line(),
+            crate::android::app_log::diagnostics_line()
+        )
+    }
+
+    fn capture_keyboard_diagnostics(&mut self, rsc: &mut Rsc) {
+        let report = self.diagnostics_text(rsc);
+        log::info!("iris keyboard diagnostics:\n{report}");
+    }
+
+    fn copy_report(&mut self, rsc: &mut Rsc) {
+        let Some(platform) = &self.platform else {
+            log::info!("iris bench report: no platform handle, can't reach the clipboard");
+            return;
+        };
+        let report = match self.last_report.clone() {
+            Some(report) => report,
+            None => format!(
+                "no benchmark has run yet -- these are the diagnostics instead:\n\n{}",
+                self.diagnostics_text(rsc)
+            ),
+        };
+        if platform.copy_to_clipboard("iris bench report", &report) {
+            log::info!("iris bench report: copied to clipboard");
+        } else {
+            log::info!("iris bench report: clipboard copy failed");
+        }
+    }
+
+    fn start_benchmark(&mut self, rsc: &mut Rsc) {
+        if self.running {
+            log::info!("iris bench report: already running");
+            return;
+        }
+        self.running = true;
+        self.android_state_mut().frame_report.reset();
+        self.report_display.edit(rsc).set("Running benchmark...");
+
+        let redraw = rsc.tasks.redraw_handle();
+        let platform = self.platform.clone();
+        let stream_tail = self.stream_tail.clone();
+        let ime_state = self.ime_state.clone();
+        let platform_hz = platform.as_ref().and_then(|p| p.refresh_rate_hz());
+        let cpu_start = process_cpu_ms();
+        // Read at the start as well as the end, because the switch is on
+        // screen while a run is going: a report that only asked afterwards
+        // would say "on" about a run whose first half has no trace in it
+        // -- the inferred answer presented as the measured one.
+        let trace_at_start = iris::diagnostics::trace_enabled();
+        let run_started_at = Instant::now();
+
+        rsc.spawn_task(async move |mut ctx| {
+            // The battery sampler runs for the whole run, once a second,
+            // the benchmark's established battery-sampling cadence
+            // -- via its own JNI-attached thread, not `ctx.update`, since
+            // a sample needs no widget-tree access.
+            let sampler_done = Arc::new(AtomicBool::new(false));
+            let samples = Arc::new(Mutex::new(Vec::<i32>::new()));
+            let sampler = platform.clone().map(|platform| {
+                let done = sampler_done.clone();
+                let samples = samples.clone();
+                tokio::spawn(async move {
+                    while !done.load(Ordering::Relaxed) {
+                        if let Some(value) = platform.battery_current_ua() {
+                            samples.lock().unwrap().push(value);
+                        }
+                        tokio::time::sleep(Duration::from_secs(1)).await;
+                    }
+                })
+            });
+
+            let travel = run_fling_phase(&mut ctx, &redraw).await;
+            let (sent, total) = run_stream_phase(&mut ctx, &redraw, stream_tail).await;
+            run_type_phase(&mut ctx, &redraw, &platform).await;
+            let keyboard = run_keyboard_phase(&mut ctx, &platform, &ime_state).await;
+
+            sampler_done.store(true, Ordering::Relaxed);
+            if let Some(sampler) = sampler {
+                let _ = sampler.await;
+            }
+            let battery = battery_line(&samples.lock().unwrap());
+            let cpu_line = match (cpu_start, process_cpu_ms()) {
+                (Some(start), Some(end)) => {
+                    format!(
+                        "  process CPU time over this run: {}ms",
+                        end.saturating_sub(start)
+                    )
+                }
+                _ => "  process CPU time over this run: unavailable".to_string(),
+            };
+            let rss_line = match peak_rss_kb() {
+                Some(kb) => format!("  peak RSS: {kb}kB"),
+                None => "  peak RSS: unavailable (/proc/self/status unreadable)".to_string(),
+            };
+            let total_seconds = run_started_at.elapsed().as_secs_f64();
+
+            ctx.update(move |state: &mut BenchClient, rsc| {
+                state.running = false;
+                let now = Instant::now();
+                let drawn_hz = state.android_state().frame_report.sustained_frame_hz();
+                let refresh_hz = match (drawn_hz, platform_hz) {
+                    (Some(d), Some(p)) => d.max(p),
+                    (Some(d), None) => d,
+                    (None, Some(p)) => p,
+                    (None, None) => 60.0,
+                };
+                let hz_line = match (drawn_hz, platform_hz) {
+                    (Some(d), Some(p)) if d > p + 5.0 => format!(
+                        " (sustained {d:.0}fps, so at least that; the display reported {p:.0}Hz)"
+                    ),
+                    (Some(d), Some(_)) => format!(" (as the display reports it; drew {d:.0}fps)"),
+                    (Some(d), None) => {
+                        format!(" (sustained {d:.0}fps; the display would not say)")
+                    }
+                    (None, Some(_)) => {
+                        " (as the display reports it; too few frames to measure)".to_string()
+                    }
+                    (None, None) => " (assumed -- neither measured nor reported)".to_string(),
+                };
+                let phase_lines: String = state
+                    .android_state()
+                    .frame_report
+                    .phase_stats(now, refresh_hz)
+                    .iter()
+                    .map(|p| format!("{p}\n"))
+                    .collect();
+                let per_phase = if phase_lines.is_empty() {
+                    String::new()
+                } else {
+                    format!("per phase:\n{phase_lines}\n")
+                };
+                let frames_block = match state.android_state().frame_report.report() {
+                    Some(stats) => {
+                        let (late, late_pct) =
+                            state.android_state().frame_report.late_at_hz(refresh_hz);
+                        format!(
+                            "frames:\n  {} frames over {:.1}s at {:.0}Hz{hz_line} ({:.1}ms \
+                             budget)\n  \
+                             late: {late} ({late_pct:.1}%)\n  total  p50 {:.1}ms  p90 {:.1}ms  \
+                             p99 {:.1}ms\n  worst {:.1}ms\n  build_p50 {:.1}ms  acquire_p50 \
+                             {:.1}ms  submit_p50 {:.1}ms",
+                            stats.total_frames,
+                            total_seconds,
+                            refresh_hz,
+                            1000.0 / refresh_hz as f64,
+                            stats.p50.as_secs_f64() * 1000.0,
+                            stats.p90.as_secs_f64() * 1000.0,
+                            stats.p99.as_secs_f64() * 1000.0,
+                            stats.worst.as_secs_f64() * 1000.0,
+                            stats.cpu_p50.as_secs_f64() * 1000.0,
+                            stats.acquire_p50.as_secs_f64() * 1000.0,
+                            stats.gpu_wait_p50.as_secs_f64() * 1000.0,
+                        )
+                    }
+                    None => "frames:\n  no frames recorded".to_string(),
+                };
+                let scroll_line = format!(
+                    "  scroll: {LEGACY_CYCLES} cycles ({} swipes, legacy tween), streamed \
+                     {sent}/{total} fixture events",
+                    LEGACY_CYCLES * 4
+                );
+                let fling_line = format!(
+                    "  fling: {FLING_COUNT} flings out + {FLING_COUNT} back at \
+                     {FLING_VELOCITY_PX_S}px/s, travel {travel}"
+                );
+                let type_line = format!(
+                    "  type: {} characters inserted then deleted, one per {TYPE_CHAR_MS}ms",
+                    TYPE_TEXT.chars().count()
+                );
+                let traced = trace_line(trace_at_start, iris::diagnostics::trace_enabled());
+                let report = format!(
+                    "iris bench report\n{traced}\n{per_phase}{frames_block}\n\nbench:\n\
+                     {fling_line}\n{scroll_line}\n{type_line}\n{keyboard}\n{cpu_line}\n\
+                     {rss_line}\n{battery}"
+                );
+                log::info!("iris bench report: {report}");
+                state.report_display.edit(rsc).set(&report);
+                state.last_report = Some(report);
+            });
+            redraw.request_redraw();
+        });
+    }
+}
+
+/// Runs `f` against the real `BenchClient`/`Rsc` on the main thread (the
+/// same `ctx.update` every other mutation here goes through) and returns
+/// its result to the caller's async task -- `ctx.update` alone has no way
+/// to hand a value back, since the closure only actually runs once the
+/// next frame callback drains `IrisViewPeer`'s task channel
+/// (`drain_tasks`). **Must call `redraw.request_redraw()` itself, right
+/// after enqueueing** -- `ctx.update` only ever pushes onto a channel;
+/// nothing drains it until something schedules the frame callback that
+/// calls `drain_tasks`, and a caller relying on some *earlier*,
+/// already-in-flight `request_redraw()` to cover a *later* `ctx.update`
+/// deadlocks the moment that earlier callback has already fired and
+/// drained everything queued before this call existed. Cost a real hang
+/// in this file's first version of the fling phase: every loop iteration
+/// after the first sat forever with nothing scheduled to drain it.
+/// Polls rather than assuming one `POLL_MS` sleep is enough, since a
+/// slow device's frame callback can lag further than that.
+async fn read_from_state<T, F>(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    redraw: &Arc<dyn RequestRedraw>,
+    f: F,
+) -> T
+where
+    T: Send + 'static,
+    F: FnOnce(&mut BenchClient, &mut Rsc) -> T + Send + 'static,
+{
+    let (tx, rx) = mpsc::channel();
+    ctx.update(move |state: &mut BenchClient, rsc| {
+        let _ = tx.send(f(state, rsc));
+    });
+    redraw.request_redraw();
+    loop {
+        if let Ok(value) = rx.try_recv() {
+            return value;
+        }
+        tokio::time::sleep(Duration::from_millis(POLL_MS)).await;
+    }
+}
+
+async fn run_fling_phase(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    redraw: &Arc<dyn RequestRedraw>,
+) -> String {
+    ctx.update(|state: &mut BenchClient, _rsc| {
+        state.android_state_mut().frame_report.mark_phase("fling");
+    });
+    ctx.update(|state: &mut BenchClient, rsc| {
+        if let Some(screen) = &state.screen {
+            (screen.list)(rsc).jump_to_end();
+        }
+    });
+    redraw.request_redraw();
+    // Lets the next frame's `repair_anchor` resolve `jump_to_end`'s
+    // `anchor = None` into a real slot before `start` is read.
+    tokio::time::sleep(Duration::from_millis(POLL_MS * 2)).await;
+    let start = read_anchor_position(ctx, redraw).await;
+
+    for _ in 0..FLING_COUNT {
+        ctx.update(|state: &mut BenchClient, rsc| {
+            if let Some(screen) = &state.screen {
+                (screen.list)(rsc).fling(FLING_VELOCITY_PX_S);
+                animate_scroll(screen.list, rsc);
+            }
+        });
+        redraw.request_redraw();
+        wait_for_fling_settle(ctx, redraw).await;
+        tokio::time::sleep(Duration::from_millis(FLING_PAUSE_MS)).await;
+    }
+    let outward = read_anchor_position(ctx, redraw).await;
+
+    for _ in 0..FLING_COUNT {
+        ctx.update(|state: &mut BenchClient, rsc| {
+            if let Some(screen) = &state.screen {
+                (screen.list)(rsc).fling(-FLING_VELOCITY_PX_S);
+                animate_scroll(screen.list, rsc);
+            }
+        });
+        redraw.request_redraw();
+        wait_for_fling_settle(ctx, redraw).await;
+        tokio::time::sleep(Duration::from_millis(FLING_PAUSE_MS)).await;
+    }
+    let end = read_anchor_position(ctx, redraw).await;
+
+    format!("start={start} outward={outward} end={end} ticked=frame-loop")
+}
+
+async fn read_anchor_position(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    redraw: &Arc<dyn RequestRedraw>,
+) -> String {
+    read_from_state(ctx, redraw, |state, rsc| match &state.screen {
+        Some(screen) => (screen.list)(rsc).anchor_position_display(),
+        None => "idx=none".to_string(),
+    })
+    .await
+}
+
+fn animate_scroll(scroll: iris::prelude::WeakWidget<iris::prelude::LazySpan>, rsc: &mut Rsc) {
+    let id = scroll.id();
+    rsc.ui_mut().animate(id);
+}
+
+async fn wait_for_fling_settle(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    redraw: &Arc<dyn RequestRedraw>,
+) {
+    let cap = Duration::from_millis(FLING_SETTLE_CAP_MS);
+    let started = Instant::now();
+    while started.elapsed() < cap {
+        let still_scrolling = read_from_state(ctx, redraw, |state, rsc| match &state.screen {
+            Some(screen) => (screen.list)(rsc).is_scrolling(),
+            None => false,
+        })
+        .await;
+        if !still_scrolling {
+            return;
+        }
+        tokio::time::sleep(Duration::from_millis(POLL_MS)).await;
+    }
+}
+
+async fn run_stream_phase(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    redraw: &Arc<dyn RequestRedraw>,
+    stream_tail: Vec<SeqEvent>,
+) -> (usize, usize) {
+    ctx.update(|state: &mut BenchClient, _rsc| {
+        state.android_state_mut().frame_report.mark_phase("stream");
+    });
+    ctx.update(|state: &mut BenchClient, rsc| {
+        if let Some(screen) = &state.screen {
+            (screen.list)(rsc).jump_to_end();
+        }
+    });
+    redraw.request_redraw();
+
+    let total = (STREAM_EVENTS_PER_SEC * STREAM_SECONDS) as usize;
+    let mut sent = 0usize;
+    for event in stream_tail.into_iter().take(total) {
+        ctx.update(move |state: &mut BenchClient, rsc| {
+            let old_items = state.items.clone();
+            state.items = fold_event(&state.items, &event);
+            match state.screen.as_mut() {
+                Some(screen) => screen.apply(rsc, &old_items, &state.items),
+                None => state.rebuild_transcript(rsc),
+            }
+        });
+        redraw.request_redraw();
+        sent += 1;
+        tokio::time::sleep(Duration::from_millis(1000 / STREAM_EVENTS_PER_SEC)).await;
+    }
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    (sent, total)
+}
+
+async fn run_type_phase(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    redraw: &Arc<dyn RequestRedraw>,
+    platform: &Option<Arc<PlatformHandle>>,
+) {
+    ctx.update(|state: &mut BenchClient, _rsc| {
+        state.android_state_mut().frame_report.mark_phase("type");
+    });
+    ctx.update(|state: &mut BenchClient, rsc| {
+        if let Some(screen) = &state.screen {
+            (screen.list)(rsc).jump_to_end();
+            state.set_focus(Some(screen.composer.field));
+        }
+    });
+    redraw.request_redraw();
+    if let Some(p) = platform {
+        p.show_ime();
+    }
+    tokio::time::sleep(Duration::from_millis(300)).await;
+
+    let mut typed = String::new();
+    for ch in TYPE_TEXT.chars() {
+        typed.push(ch);
+        let text = typed.clone();
+        ctx.update(move |state: &mut BenchClient, rsc| {
+            if let Some(screen) = &state.screen {
+                screen.composer.field.edit(rsc).set(&text);
+            }
+        });
+        redraw.request_redraw();
+        tokio::time::sleep(Duration::from_millis(TYPE_CHAR_MS)).await;
+    }
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    while !typed.is_empty() {
+        typed.pop();
+        let text = typed.clone();
+        ctx.update(move |state: &mut BenchClient, rsc| {
+            if let Some(screen) = &state.screen {
+                screen.composer.field.edit(rsc).set(&text);
+            }
+        });
+        redraw.request_redraw();
+        tokio::time::sleep(Duration::from_millis(TYPE_CHAR_MS)).await;
+    }
+}
+
+async fn run_keyboard_phase(
+    ctx: &mut iris::task::TaskCtx<Rsc>,
+    platform: &Option<Arc<PlatformHandle>>,
+    ime_state: &Arc<Mutex<ImeState>>,
+) -> String {
+    ctx.update(|state: &mut BenchClient, _rsc| {
+        state
+            .android_state_mut()
+            .frame_report
+            .mark_phase("keyboard");
+    });
+    let mut shown = 0;
+    let mut hidden = 0;
+    for _ in 0..KEYBOARD_CYCLES {
+        let before_shown = ime_state.lock().unwrap().shown_events;
+        if let Some(p) = platform {
+            p.show_ime();
+        }
+        tokio::time::sleep(Duration::from_millis(KEYBOARD_WAIT_MS)).await;
+        if ime_state.lock().unwrap().shown_events > before_shown {
+            shown += 1;
+        }
+
+        let before_hidden = ime_state.lock().unwrap().hidden_events;
+        if let Some(p) = platform {
+            p.hide_ime();
+        }
+        tokio::time::sleep(Duration::from_millis(KEYBOARD_WAIT_MS)).await;
+        if ime_state.lock().unwrap().hidden_events > before_hidden {
+            hidden += 1;
+        }
+    }
+    if shown == 0 {
+        format!("  keyboard: could not be shown ({KEYBOARD_CYCLES} attempts, 0 confirmed visible)")
+    } else {
+        format!(
+            "  keyboard: shown {shown}/{KEYBOARD_CYCLES}, hidden {hidden}/{KEYBOARD_CYCLES} \
+             (confirmed via on_insets_changed)"
+        )
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::TYPE_TEXT;
+
+    #[test]
+    fn type_text_is_exactly_600_characters() {
+        assert_eq!(TYPE_TEXT.chars().count(), 600);
+    }
+}

app/src/android/bench_jni.rs

@@ -0,0 +1,179 @@
+use android_view::jni::{
+    JNIEnv, JavaVM,
+    objects::{GlobalRef, JObject, JValue},
+};
+
+/// `android.os.BatteryManager.BATTERY_PROPERTY_CURRENT_NOW` -- not exposed
+/// as a constant anywhere reachable without the Android SDK jar, so named
+/// here with its source rather than left as a bare `2`.
+const BATTERY_PROPERTY_CURRENT_NOW: i32 = 2;
+
+pub struct PlatformHandle {
+    vm: JavaVM,
+    view: GlobalRef,
+}
+
+impl PlatformHandle {
+    pub fn new(vm: JavaVM, view: GlobalRef) -> Self {
+        Self { vm, view }
+    }
+
+    fn context<'e>(&self, env: &mut JNIEnv<'e>) -> Option<JObject<'e>> {
+        env.call_method(
+            self.view.as_obj(),
+            "getContext",
+            "()Landroid/content/Context;",
+            &[],
+        )
+        .ok()?
+        .l()
+        .ok()
+    }
+
+    fn system_service<'e>(
+        &self,
+        env: &mut JNIEnv<'e>,
+        context: &JObject<'e>,
+        name: &str,
+    ) -> Option<JObject<'e>> {
+        let jname = env.new_string(name).ok()?;
+        env.call_method(
+            context,
+            "getSystemService",
+            "(Ljava/lang/String;)Ljava/lang/Object;",
+            &[JValue::Object(jname.as_ref())],
+        )
+        .ok()?
+        .l()
+        .ok()
+    }
+
+    pub fn battery_current_ua(&self) -> Option<i32> {
+        let mut guard = self.vm.attach_current_thread().ok()?;
+        let env: &mut JNIEnv = &mut guard;
+        let context = self.context(env)?;
+        let battery_manager = self.system_service(env, &context, "batterymanager")?;
+        let value = env
+            .call_method(
+                &battery_manager,
+                "getIntProperty",
+                "(I)I",
+                &[JValue::Int(BATTERY_PROPERTY_CURRENT_NOW)],
+            )
+            .ok()?
+            .i()
+            .ok()?;
+        if value == 0 || value == i32::MIN {
+            None
+        } else {
+            Some(value)
+        }
+    }
+
+    /// Puts `text` on the system clipboard through `ClipboardManager` --
+    /// `true` only if the whole JNI chain (service lookup, `ClipData`,
+    /// `setPrimaryClip`) succeeded.
+    pub fn copy_to_clipboard(&self, label: &str, text: &str) -> bool {
+        self.try_copy_to_clipboard(label, text).is_some()
+    }
+
+    fn try_copy_to_clipboard(&self, label: &str, text: &str) -> Option<()> {
+        let mut guard = self.vm.attach_current_thread().ok()?;
+        let env: &mut JNIEnv = &mut guard;
+        let context = self.context(env)?;
+        let clipboard = self.system_service(env, &context, "clipboard")?;
+        let jlabel = env.new_string(label).ok()?;
+        let jtext = env.new_string(text).ok()?;
+        let clip = env
+            .call_static_method(
+                "android/content/ClipData",
+                "newPlainText",
+                "(Ljava/lang/CharSequence;Ljava/lang/CharSequence;)Landroid/content/ClipData;",
+                &[
+                    JValue::Object(jlabel.as_ref()),
+                    JValue::Object(jtext.as_ref()),
+                ],
+            )
+            .ok()?
+            .l()
+            .ok()?;
+        env.call_method(
+            &clipboard,
+            "setPrimaryClip",
+            "(Landroid/content/ClipData;)V",
+            &[JValue::Object(&clip)],
+        )
+        .ok()?;
+        Some(())
+    }
+
+    pub fn refresh_rate_hz(&self) -> Option<f32> {
+        let mut guard = self.vm.attach_current_thread().ok()?;
+        let env: &mut JNIEnv = &mut guard;
+        let display = env
+            .call_method(
+                self.view.as_obj(),
+                "getDisplay",
+                "()Landroid/view/Display;",
+                &[],
+            )
+            .ok()?
+            .l()
+            .ok()?;
+        if display.is_null() {
+            return None;
+        }
+        let rate = env
+            .call_method(&display, "getRefreshRate", "()F", &[])
+            .ok()?
+            .f()
+            .ok()?;
+        if rate > 0.0 { Some(rate) } else { None }
+    }
+
+    pub fn show_ime(&self) -> bool {
+        self.try_toggle_ime(true).unwrap_or(false)
+    }
+
+    pub fn hide_ime(&self) -> bool {
+        self.try_toggle_ime(false).unwrap_or(false)
+    }
+
+    fn try_toggle_ime(&self, show: bool) -> Option<bool> {
+        let mut guard = self.vm.attach_current_thread().ok()?;
+        let env: &mut JNIEnv = &mut guard;
+        let context = self.context(env)?;
+        let imm = self.system_service(env, &context, "input_method")?;
+        if show {
+            env.call_method(
+                &imm,
+                "showSoftInput",
+                "(Landroid/view/View;I)Z",
+                &[JValue::Object(self.view.as_obj()), JValue::Int(0)],
+            )
+            .ok()?
+            .z()
+            .ok()
+        } else {
+            let token = env
+                .call_method(
+                    self.view.as_obj(),
+                    "getWindowToken",
+                    "()Landroid/os/IBinder;",
+                    &[],
+                )
+                .ok()?
+                .l()
+                .ok()?;
+            env.call_method(
+                &imm,
+                "hideSoftInputFromWindow",
+                "(Landroid/os/IBinder;I)Z",
+                &[JValue::Object(&token), JValue::Int(0)],
+            )
+            .ok()?
+            .z()
+            .ok()
+        }
+    }
+}

app/src/android/devlog.rs

@@ -0,0 +1,160 @@
+//! The JNI half of `DevLogProvider`: reading this process's own log ring
+//! for a `ContentProvider` that Dev Updater queries.
+
+use android_view::jni::JNIEnv;
+use android_view::jni::objects::{JClass, JObject, JString};
+use android_view::jni::sys::{jlong, jobjectArray};
+use std::{path::Path, ptr, sync::OnceLock};
+
+/// Gated with its one reader: the tabs demo links no `client-core` and so
+/// has no ring to lay out, and an ungated constant is a warning in that
+/// build (`iris-android-app` without `transcript-screen`).
+#[cfg(feature = "transcript-screen")]
+const FIELDS_PER_LINE: usize = 5;
+
+/// The authority the provider registered itself under, once it has been
+/// created. `None` until then, which is a state worth being able to say:
+/// a provider Android never instantiated and one that is answering look
+/// the same from inside this process otherwise.
+static AUTHORITY: OnceLock<String> = OnceLock::new();
+
+#[cfg(feature = "bench")]
+pub fn authority() -> Option<&'static str> {
+    AUTHORITY.get().map(String::as_str)
+}
+
+/// The directory is taken here as well as in
+/// `MainActivity.nativeSetFilesDir` because **the provider is often the
+/// only thing running**: once the app has died, Dev Updater's query
+/// starts the process for the provider alone, so no activity ever runs
+/// and the panic hook's file would never be replayed into the ring. That
+/// is precisely the run whose log is being asked for. Whichever of the
+/// two arrives first does the replay; `set_crash_dir` deletes the file,
+/// so the second finds nothing and says nothing.
+///
+/// # Safety
+/// Called by the JVM with the arguments its `native` declaration names.
+#[unsafe(no_mangle)]
+pub extern "system" fn Java_dev_iris_android_demo_DevLogProvider_nativeReady(
+    mut env: JNIEnv,
+    _class: JClass,
+    authority: JString,
+    files_dir: JString,
+) {
+    #[cfg(feature = "transcript-screen")]
+    if let Some(dir) = string_arg(&mut env, &files_dir) {
+        crate::android::app_log::set_crash_dir(Path::new(&dir));
+    }
+    #[cfg(not(feature = "transcript-screen"))]
+    let _ = &files_dir;
+    let Some(authority) = string_arg(&mut env, &authority) else {
+        return;
+    };
+    log::info!("iris devlog: serving this app's log at content://{authority}");
+    let _ = AUTHORITY.set(authority);
+}
+
+fn string_arg(env: &mut JNIEnv, value: &JString) -> Option<String> {
+    if value.is_null() {
+        return None;
+    }
+    env.get_string(value).ok().map(Into::into)
+}
+
+/// `newest_seq` is `-1` for a ring nothing has been written to, which is
+/// what tells a reader holding a cursor that this process **restarted**:
+/// the ring is in memory, so a new process starts again at zero and a
+/// stale cursor would otherwise skip everything silently.
+///
+/// # Safety
+/// Called by the JVM with the arguments its `native` declaration names.
+#[unsafe(no_mangle)]
+pub extern "system" fn Java_dev_iris_android_demo_DevLogProvider_nativeStatus(
+    mut env: JNIEnv,
+    _class: JClass,
+) -> jobjectArray {
+    string_array(&mut env, &status_fields())
+}
+
+/// Inclusive of `since` because [`crate::client::log_ring::LogRing::since`]
+/// is, and one definition of the cursor is what keeps the app's own
+/// uploaded report and this provider describing the same lines.
+///
+/// # Safety
+/// Called by the JVM with the arguments its `native` declaration names.
+#[unsafe(no_mangle)]
+pub extern "system" fn Java_dev_iris_android_demo_DevLogProvider_nativeLinesSince(
+    mut env: JNIEnv,
+    _class: JClass,
+    since: jlong,
+) -> jobjectArray {
+    // A negative cursor is a caller asking for everything, not an error to
+    // take the app down over: the provider is a diagnostic.
+    string_array(&mut env, &line_fields(since.max(0) as u64))
+}
+
+#[cfg(feature = "transcript-screen")]
+fn status_fields() -> Vec<String> {
+    let ring = crate::client::log_ring::process_ring();
+    vec![
+        ring.len().to_string(),
+        ring.dropped().to_string(),
+        ring.newest_seq().map_or(-1, |seq| seq as i64).to_string(),
+    ]
+}
+
+/// The tabs demo links no `client-core` and keeps no ring, so it holds
+/// nothing and has never dropped anything -- which is the truth, not a
+/// stand-in. The natives are still exported there, because a `native`
+/// method Java declares and the library does not is an
+/// `UnsatisfiedLinkError` the moment the class loads.
+#[cfg(not(feature = "transcript-screen"))]
+fn status_fields() -> Vec<String> {
+    vec!["0".to_string(), "0".to_string(), "-1".to_string()]
+}
+
+#[cfg(feature = "transcript-screen")]
+fn line_fields(since: u64) -> Vec<String> {
+    let (lines, _next) = crate::client::log_ring::process_ring().since(since);
+    let mut fields = Vec::with_capacity(lines.len() * FIELDS_PER_LINE);
+    for line in lines {
+        fields.push(line.seq.to_string());
+        fields.push(line.at_ms.to_string());
+        fields.push(line.level.to_string());
+        fields.push(line.target);
+        fields.push(line.message);
+    }
+    fields
+}
+
+#[cfg(not(feature = "transcript-screen"))]
+fn line_fields(_since: u64) -> Vec<String> {
+    Vec::new()
+}
+
+/// Null rather than a panic across the JNI boundary: `DevLogProvider`
+/// reads it as "the provider could not answer" and returns no cursor,
+/// which Dev Updater already draws as a distinct state. Taking the app
+/// down to report that its diagnostic is unavailable would be worse than
+/// the diagnostic being unavailable.
+fn string_array(env: &mut JNIEnv, fields: &[String]) -> jobjectArray {
+    let null = ptr::null_mut();
+    let Ok(class) = env.find_class("java/lang/String") else {
+        return null;
+    };
+    let Ok(array) = env.new_object_array(fields.len() as i32, class, JObject::null()) else {
+        return null;
+    };
+    for (index, field) in fields.iter().enumerate() {
+        let Ok(value) = env.new_string(field) else {
+            return null;
+        };
+        if env
+            .set_object_array_element(&array, index as i32, value)
+            .is_err()
+        {
+            return null;
+        }
+    }
+    array.into_raw()
+}

app/src/android/enrollment.rs

@@ -0,0 +1,87 @@
+#[cfg(not(feature = "bench"))]
+use crate::client::api::UreqTransport;
+use crate::client::config::{EnrolledServer, EnrollmentStore};
+use std::path::PathBuf;
+use std::sync::OnceLock;
+
+static FILES_DIR: OnceLock<PathBuf> = OnceLock::new();
+
+pub fn set_files_dir(dir: PathBuf) {
+    if let Err(existing) = FILES_DIR.set(dir.clone()) {
+        assert_eq!(
+            existing, dir,
+            "the app's files directory was set twice with different paths"
+        );
+    }
+}
+
+fn store() -> Option<EnrollmentStore> {
+    FILES_DIR.get().map(EnrollmentStore::new)
+}
+
+pub enum Status {
+    Enrolled(EnrolledServer),
+    NotEnrolled,
+    /// The question could not be answered -- the activity never handed a
+    /// files directory over, or the file is there and unreadable. Kept
+    /// apart from `NotEnrolled` because the two want different actions
+    /// from whoever is looking.
+    Unknown(String),
+}
+
+pub fn status() -> Status {
+    let Some(store) = store() else {
+        return Status::Unknown("the activity never handed over a files directory".to_string());
+    };
+    match store.load() {
+        Ok(Some(server)) => Status::Enrolled(server),
+        Ok(None) => Status::NotEnrolled,
+        Err(error) => Status::Unknown(error.to_string()),
+    }
+}
+
+/// One line for the diagnostics pane. The three states read differently on
+/// purpose: "not enrolled" says what to do about it, and "couldn't tell"
+/// must not be mistaken for it.
+#[cfg(feature = "bench")]
+pub fn status_line() -> String {
+    match status() {
+        Status::Enrolled(server) => format!("enrolled: {}:{}", server.host, server.port),
+        Status::NotEnrolled => "not enrolled -- open the enrol link from Dev Updater".to_string(),
+        Status::Unknown(why) => format!("enrolment unreadable: {why}"),
+    }
+}
+
+pub fn apply_link(uri: &str) -> Result<EnrolledServer, String> {
+    let server = EnrolledServer::parse_link(uri)?;
+    let store = store().ok_or("the app has no files directory to save an enrollment in")?;
+    store
+        .save(&server)
+        .map_err(|error| format!("couldn't save the enrollment: {error}"))?;
+    Ok(server)
+}
+
+/// Gated to the same builds as `transcript_client`, its only caller: the
+/// bench build opens a checked-in fixture and reaches no server, so
+/// compiling this into it would be a warning about dead code that is
+/// dead on purpose.
+///
+/// Every failure here is a sentence a screen can show, because there is
+/// nowhere else for it to go: this app has no `logcat` on the phone it is
+/// built for.
+#[cfg(not(feature = "bench"))]
+pub fn transport() -> Result<UreqTransport, String> {
+    let server = match status() {
+        Status::Enrolled(server) => server,
+        Status::NotEnrolled => {
+            return Err("Not enrolled yet -- open the enrol link from Dev Updater.".to_string());
+        }
+        Status::Unknown(why) => return Err(format!("Couldn't read the enrollment: {why}")),
+    };
+    let ca_pem = server.ca_pem.as_ref().ok_or(
+        "The enrollment link carried no CA, so there is nothing to pin. \
+         Enrol again with a link minted by this server.",
+    )?;
+    UreqTransport::new(server.base_url(), &server.token, ca_pem.as_bytes())
+        .map_err(|error| error.message)
+}

app/src/android/mod.rs

@@ -0,0 +1,169 @@
+use android_view::{
+    Context, View,
+    jni::{
+        JNIEnv, JavaVM,
+        objects::{JClass, JString},
+        sys::{JNI_VERSION_1_6, JavaVM as RawJavaVM, jint, jlong},
+    },
+    register_view_class,
+};
+#[cfg(not(feature = "transcript-screen"))]
+use iris::android::{AndroidAppState, AndroidRsc, AndroidUiState, HasAndroidUiState};
+use log::LevelFilter;
+use std::{
+    ffi::c_void,
+    path::{Path, PathBuf},
+};
+
+/// The app's own log ring and its upload -- only where `client-core` is
+/// linked, which is every build that has a server to send to. The plain
+/// tabs demo keeps `android_logger` alone, as it always had.
+#[cfg(feature = "transcript-screen")]
+mod app_log;
+#[cfg(feature = "bench")]
+mod bench_client;
+#[cfg(feature = "bench")]
+mod bench_jni;
+mod devlog;
+#[cfg(feature = "transcript-screen")]
+mod enrollment;
+#[cfg(all(feature = "transcript-screen", not(feature = "bench")))]
+mod transcript_client;
+
+/// The app's `View` subclass, matching the Java side's package --
+/// `app/src/main/java/dev/iris/android/demo/IrisView.java`.
+const VIEW_CLASS: &str = "dev/iris/android/demo/IrisView";
+
+#[cfg(not(feature = "transcript-screen"))]
+pub struct Client {
+    ui_state: AndroidUiState,
+}
+
+#[cfg(not(feature = "transcript-screen"))]
+impl HasAndroidUiState for Client {
+    fn android_state(&self) -> &AndroidUiState {
+        &self.ui_state
+    }
+    fn android_state_mut(&mut self) -> &mut AndroidUiState {
+        &mut self.ui_state
+    }
+}
+
+#[cfg(not(feature = "transcript-screen"))]
+impl AndroidAppState for Client {
+    fn new(mut ui_state: AndroidUiState, rsc: &mut AndroidRsc<Self>) -> Self {
+        // `widgets.info` is the winit example's frame-debug readout, kept
+        // current from `DesktopAppState::window_event` -- android-view has
+        // no per-frame hook to drive the equivalent from here yet, so it
+        // is left at its built "" text rather than wired to nothing.
+        let _ = tabs_ui::build(rsc, &mut ui_state);
+        Self { ui_state }
+    }
+
+    fn back_pressed(&mut self, _rsc: &mut AndroidRsc<Self>) -> bool {
+        false
+    }
+}
+
+#[cfg(not(feature = "transcript-screen"))]
+type ActiveClient = Client;
+#[cfg(all(feature = "transcript-screen", not(feature = "bench")))]
+type ActiveClient = transcript_client::TranscriptClient;
+#[cfg(feature = "bench")]
+type ActiveClient = bench_client::BenchClient;
+
+extern "system" fn new_view_peer<'local>(
+    env: JNIEnv<'local>,
+    view: View<'local>,
+    context: Context<'local>,
+) -> jlong {
+    iris::android::new_peer::<ActiveClient>(env, view, context)
+}
+
+/// # Safety
+/// Interacting with JNI at load time is always unsafe at some level --
+/// mirrors android-view's own demo, which carries the same comment.
+#[unsafe(no_mangle)]
+pub unsafe extern "system" fn JNI_OnLoad(vm: *mut RawJavaVM, _: *mut c_void) -> jint {
+    // The ring in front of `android_logger` where there is one (see
+    // `app_log`), and `android_logger` alone otherwise. Both install the
+    // same tag and level, so `logcat` cannot tell the two builds apart --
+    // the ring only adds a second reader.
+    #[cfg(feature = "transcript-screen")]
+    app_log::install(LevelFilter::Debug);
+    #[cfg(not(feature = "transcript-screen"))]
+    android_logger::init_once(
+        android_logger::Config::default()
+            .with_max_level(LevelFilter::Debug)
+            .with_tag("iris-android-app"),
+    );
+    let vm = unsafe { JavaVM::from_raw(vm) }.unwrap();
+    let mut env = vm.get_env().unwrap();
+    register_view_class(&mut env, VIEW_CLASS, new_view_peer);
+    iris::android::register_native_methods(&mut env, VIEW_CLASS);
+    JNI_VERSION_1_6
+}
+
+/// `MainActivity.nativeSetFilesDir` -- the app's private directory, handed
+/// over before the view exists because that is where the enrollment is
+/// read from and written to (`enrollment`'s module doc).
+///
+/// Exported by name rather than registered through `RegisterNatives`: the
+/// view's methods are registered because `android-view` owns that class
+/// and hands out one function pointer, whereas these two are this app's
+/// own activity and the mangled name is the whole of what is needed.
+///
+/// # Safety
+/// Called by the JVM with the arguments its `native` declaration names.
+#[unsafe(no_mangle)]
+pub extern "system" fn Java_dev_iris_android_demo_MainActivity_nativeSetFilesDir(
+    mut env: JNIEnv,
+    _class: JClass,
+    dir: JString,
+) {
+    let Some(dir) = jstring(&mut env, dir) else {
+        return;
+    };
+    #[cfg(feature = "transcript-screen")]
+    {
+        app_log::set_crash_dir(Path::new(&dir));
+        enrollment::set_files_dir(PathBuf::from(&dir));
+    }
+    log::debug!("iris app: files directory is {dir}");
+}
+
+/// # Safety
+/// Called by the JVM with the arguments its `native` declaration names.
+#[unsafe(no_mangle)]
+pub extern "system" fn Java_dev_iris_android_demo_MainActivity_nativeEnroll(
+    mut env: JNIEnv,
+    _class: JClass,
+    uri: JString,
+) {
+    let Some(uri) = jstring(&mut env, uri) else {
+        return;
+    };
+    #[cfg(feature = "transcript-screen")]
+    match enrollment::apply_link(&uri) {
+        // Never the token: `wg-app-link`'s enroll module forbids logging
+        // it, and this line would otherwise be the one place it leaked.
+        Ok(server) => log::info!("iris app: enrolled with {}:{}", server.host, server.port),
+        Err(error) => log::warn!("iris app: that enrolment link was refused -- {error}"),
+    }
+    #[cfg(not(feature = "transcript-screen"))]
+    log::warn!("iris app: {uri} arrived, but this build has no server to enrol with");
+}
+
+fn jstring(env: &mut JNIEnv, value: JString) -> Option<String> {
+    if value.is_null() {
+        log::warn!("iris app: the activity passed a null string across JNI");
+        return None;
+    }
+    match env.get_string(&value) {
+        Ok(value) => Some(value.into()),
+        Err(error) => {
+            log::warn!("iris app: couldn't read a string from the activity -- {error}");
+            None
+        }
+    }
+}

app/src/android/transcript_client.rs

@@ -0,0 +1,299 @@
+use crate::client::api::{ApiClient, UreqTransport};
+use crate::client::event_stream::{StreamItem, follow_session_events};
+use crate::client::transcript_fold::{
+    TranscriptItem, fold_event, fold_page, group_tool_runs, raw_seq,
+};
+use crate::ui::{self, TranscriptScreen};
+use event_model::SeqEvent;
+use iris::android::{AndroidAppState, AndroidRsc, AndroidUiState, HasAndroidUiState};
+use iris::prelude::*;
+use std::{
+    sync::{
+        Arc,
+        atomic::{AtomicU64, Ordering},
+    },
+    thread,
+};
+
+pub struct TranscriptClient {
+    ui_state: AndroidUiState,
+    /// The screen's own content -- everything under the fixed
+    /// [`frame_report_controls`] bar, which is built once (`new`, below)
+    /// and never touched by `show_message`/`rebuild_transcript`'s own
+    /// `set` calls the way `desktop-app`'s `transcript_ptr` isn't touched
+    /// by rebuilding the session list beside it.
+    content: WeakWidget<WidgetPtr>,
+    screen: Option<TranscriptScreen>,
+    items: Vec<TranscriptItem>,
+    session_id: Option<String>,
+    generation: Arc<AtomicU64>,
+}
+
+impl HasAndroidUiState for TranscriptClient {
+    fn android_state(&self) -> &AndroidUiState {
+        &self.ui_state
+    }
+    fn android_state_mut(&mut self) -> &mut AndroidUiState {
+        &mut self.ui_state
+    }
+}
+
+fn build_transport() -> Result<UreqTransport, String> {
+    crate::android::enrollment::transport()
+}
+
+fn placeholder<Rsc: HasEvents>(rsc: &mut Rsc, message: &str) -> StrongWidget {
+    wtext(message.to_string())
+        .color(PaintId::WHITE)
+        .wrap(true)
+        .pad(16)
+        .add_strong(rsc)
+        .any()
+}
+
+fn frame_report_controls(rsc: &mut AndroidRsc<TranscriptClient>) -> WeakWidget {
+    type Rsc = AndroidRsc<TranscriptClient>;
+    let report_rect = rect(Srgba8::rgb(50, 50, 60))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, _rsc: &mut Rsc| match ctx
+                .state
+                .android_state()
+                .frame_report
+                .report()
+            {
+                Some(stats) => log::info!("iris frame report: {stats}"),
+                None => log::info!(
+                    "iris frame report: no frames recorded -- scroll first, then press this"
+                ),
+            },
+        )
+        .label("Frame report");
+    let report = (
+        report_rect,
+        wtext("Frame report").size(18).text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(8)
+        .add(rsc);
+
+    let reset_rect = rect(Srgba8::rgb(70, 40, 40))
+        .on(
+            CursorSense::click(),
+            |ctx: EventIdCtx<'_, Rsc, _, _>, _rsc: &mut Rsc| {
+                ctx.state.android_state_mut().frame_report.reset();
+                log::info!("iris frame report: reset");
+            },
+        )
+        .label("Reset frame report");
+    let reset = (
+        reset_rect,
+        wtext("Reset").size(18).text_align(Align::CENTER),
+    )
+        .stack()
+        .pad(8)
+        .add(rsc);
+
+    (report, reset).span(Dir::RIGHT).height(56).add(rsc)
+}
+
+impl AndroidAppState for TranscriptClient {
+    fn new(mut ui_state: AndroidUiState, rsc: &mut AndroidRsc<Self>) -> Self {
+        let content = WidgetPtr::new().add(rsc);
+        let loading = placeholder(rsc, "Loading sessions...");
+        content(rsc).set(loading);
+
+        let tree = (frame_report_controls(rsc), content.height(rest(1)))
+            .span(Dir::DOWN)
+            .add_strong(rsc)
+            .any();
+        ui_state.set_root(rsc, tree);
+
+        let mut client = Self {
+            ui_state,
+            content,
+            screen: None,
+            items: Vec::new(),
+            session_id: None,
+            generation: Arc::new(AtomicU64::new(0)),
+        };
+        client.spawn_fetch_sessions(rsc);
+        client
+    }
+
+    fn back_pressed(&mut self, _rsc: &mut AndroidRsc<Self>) -> bool {
+        // No screen stack of its own -- same "let the activity finish"
+        // answer `iris-android-app`'s tabs `Client` already gives.
+        false
+    }
+}
+
+impl TranscriptClient {
+    fn show_message(&mut self, rsc: &mut AndroidRsc<Self>, message: &str) {
+        let widget = placeholder(rsc, message);
+        (self.content)(rsc).set(widget);
+        self.screen = None;
+    }
+
+    fn spawn_fetch_sessions(&mut self, rsc: &mut AndroidRsc<Self>) {
+        let redraw = rsc.tasks.redraw_handle();
+        let my_generation = self.generation.load(Ordering::SeqCst);
+        let generation = self.generation.clone();
+        rsc.spawn_task(async move |mut ctx| {
+            let outcome = match build_transport() {
+                Ok(transport) => ApiClient::new(transport)
+                    .fetch_sessions()
+                    .map_err(|e| e.to_string()),
+                Err(e) => Err(format!("couldn't set up TLS: {e}")),
+            };
+            ctx.update(move |state: &mut TranscriptClient, rsc| {
+                if generation.load(Ordering::SeqCst) != my_generation {
+                    return;
+                }
+                match outcome {
+                    Ok(sessions) => match sessions.into_iter().next() {
+                        Some(session) => state.select_session(rsc, session.id),
+                        None => state.show_message(rsc, "No sessions on the sandbox server."),
+                    },
+                    Err(message) => {
+                        state.show_message(rsc, &format!("Couldn't list sessions: {message}"))
+                    }
+                }
+            });
+            redraw.request_redraw();
+        });
+    }
+
+    fn select_session(&mut self, rsc: &mut AndroidRsc<Self>, session_id: String) {
+        let my_generation = self.generation.fetch_add(1, Ordering::SeqCst) + 1;
+        self.items.clear();
+        self.session_id = Some(session_id.clone());
+        self.show_message(rsc, "Loading transcript...");
+
+        let redraw = rsc.tasks.redraw_handle();
+        let live_generation = self.generation.clone();
+        rsc.spawn_task(async move |mut ctx| {
+            let transports =
+                build_transport().and_then(|rest| build_transport().map(|stream| (rest, stream)));
+            let (rest, stream_transport) = match transports {
+                Ok(pair) => pair,
+                Err(e) => {
+                    let message = format!("couldn't set up TLS: {e}");
+                    ctx.update(move |state: &mut TranscriptClient, rsc| {
+                        if live_generation.load(Ordering::SeqCst) == my_generation {
+                            state.show_message(rsc, &message);
+                        }
+                    });
+                    redraw.request_redraw();
+                    return;
+                }
+            };
+            let api = ApiClient::new(rest);
+
+            let page: Result<Vec<serde_json::Value>, String> = api
+                .fetch_transcript_page(&session_id, None, 200, true)
+                .map_err(|e| e.to_string());
+            let after = page
+                .as_ref()
+                .ok()
+                .and_then(|values| values.last())
+                .and_then(raw_seq)
+                .unwrap_or(0);
+            let result = page.and_then(|values| fold_page(&values));
+
+            {
+                let live_generation = live_generation.clone();
+                ctx.update(move |state: &mut TranscriptClient, rsc| {
+                    if live_generation.load(Ordering::SeqCst) != my_generation {
+                        return;
+                    }
+                    match result {
+                        Ok(items) => {
+                            state.items = items;
+                            state.rebuild_transcript(rsc);
+                        }
+                        Err(message) => {
+                            state.show_message(rsc, &format!("Couldn't load transcript: {message}"))
+                        }
+                    }
+                });
+            }
+            redraw.request_redraw();
+
+            if live_generation.load(Ordering::SeqCst) != my_generation {
+                return;
+            }
+            let _ =
+                follow_session_events(
+                    &stream_transport,
+                    &session_id,
+                    after,
+                    move |item| match item {
+                        StreamItem::Open | StreamItem::Reset => {
+                            live_generation.load(Ordering::SeqCst) == my_generation
+                        }
+                        StreamItem::Event { event, .. } => {
+                            if live_generation.load(Ordering::SeqCst) != my_generation {
+                                return false;
+                            }
+                            let live_generation = live_generation.clone();
+                            ctx.update(move |state: &mut TranscriptClient, rsc| {
+                                if live_generation.load(Ordering::SeqCst) != my_generation {
+                                    return;
+                                }
+                                state.apply_event(rsc, &event);
+                            });
+                            redraw.request_redraw();
+                            true
+                        }
+                    },
+                );
+        });
+    }
+
+    fn rebuild_transcript(&mut self, rsc: &mut AndroidRsc<Self>) {
+        let in_progress = self
+            .screen
+            .as_ref()
+            .map(|screen| screen.composer.field.edit(rsc).text.text().to_string())
+            .filter(|t| !t.is_empty());
+
+        let rows = group_tool_runs(&self.items);
+        let (screen, tree) = ui::build_tree(rsc, rows);
+
+        if let Some(text) = in_progress {
+            screen.composer.field.edit(rsc).set(&text);
+        }
+        if let Some(session_id) = self.session_id.clone() {
+            let field = screen.composer.field;
+            rsc.register_event(field, Submit, move |ctx, rsc| {
+                let text = field.edit(rsc).take();
+                let text = text.trim().to_string();
+                if !text.is_empty() {
+                    ctx.state.send_message(session_id.clone(), text);
+                }
+            });
+        }
+
+        (self.content)(rsc).set(tree);
+        self.screen = Some(screen);
+    }
+
+    fn apply_event(&mut self, rsc: &mut AndroidRsc<Self>, event: &SeqEvent) {
+        let old_items = self.items.clone();
+        self.items = fold_event(&self.items, event);
+        match self.screen.as_mut() {
+            Some(screen) => screen.apply(rsc, &old_items, &self.items),
+            None => self.rebuild_transcript(rsc),
+        }
+    }
+
+    fn send_message(&mut self, session_id: String, text: String) {
+        thread::spawn(move || {
+            if let Ok(transport) = build_transport() {
+                let api = ApiClient::new(transport);
+                let _ = api.send_message(&session_id, &text, &[]);
+            }
+        });
+    }
+}

app/src/bin_desktop.rs

@@ -0,0 +1,9 @@
+use ai_app::desktop::{app, startup};
+
+fn main() {
+    if let Err(e) = startup::load_startup_config() {
+        eprintln!("desktop-app: {e}");
+        std::process::exit(2);
+    }
+    app::run();
+}

app/src/client/ansi.rs

@@ -0,0 +1,455 @@
+use std::ops::Range;
+
+/// An RGB colour, the same shape wherever this crate names one -- no alpha,
+/// because the one place that needs partial transparency (dimming) says so
+/// with a separate flag rather than baking it into the colour.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Rgb {
+    pub r: u8,
+    pub g: u8,
+    pub b: u8,
+}
+
+impl Rgb {
+    pub const fn new(r: u8, g: u8, b: u8) -> Self {
+        Self { r, g, b }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct AnsiPalette {
+    pub colours: [Rgb; 16],
+    pub foreground: Rgb,
+    pub background: Rgb,
+}
+
+/// One span's worth of styling. `None` means unspecified.
+#[derive(Debug, Clone, Copy, PartialEq, Default)]
+pub struct Style {
+    pub color: Option<Rgb>,
+    /// How much of `color`'s alpha survives, 0.0-1.0; `None` is opaque.
+    pub alpha: Option<f32>,
+    pub background: Option<Rgb>,
+    pub bold: bool,
+    pub italic: bool,
+    pub underline: bool,
+    pub strikethrough: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Default)]
+pub struct StyledText {
+    pub text: String,
+    pub spans: Vec<(Range<usize>, Style)>,
+}
+
+impl StyledText {
+    fn plain(text: String) -> Self {
+        Self {
+            text,
+            spans: Vec::new(),
+        }
+    }
+}
+
+const ESC: char = '\u{1B}';
+const BELL: char = '\u{7}';
+
+pub fn ansi_styled(text: &str, palette: &AnsiPalette) -> StyledText {
+    if !text.contains(ESC) && !text.contains('\r') {
+        return StyledText::plain(text.to_string());
+    }
+
+    let chars: Vec<char> = text.chars().collect();
+    let mut runs: Vec<(String, Option<Style>)> = Vec::new();
+    let mut sgr = Sgr::PLAIN;
+    let mut at = 0usize;
+    let mut plain = String::new();
+
+    let flush = |plain: &mut String, sgr: Sgr, runs: &mut Vec<(String, Option<Style>)>| {
+        if !plain.is_empty() {
+            runs.push((std::mem::take(plain), sgr.span(palette)));
+        }
+    };
+
+    while at < chars.len() {
+        let c = chars[at];
+        if c == ESC {
+            flush(&mut plain, sgr, &mut runs);
+            at = skip_escape(&chars, at, |params, final_byte| {
+                if final_byte == 'm' {
+                    sgr = sgr.apply(params, palette);
+                }
+            });
+        } else if c == '\r' && chars.get(at + 1) != Some(&'\n') {
+            flush(&mut plain, sgr, &mut runs);
+            drop_line(&mut runs);
+            at += 1;
+        } else if c == '\r' {
+            at += 1;
+        } else if c >= ' ' || c == '\n' || c == '\t' {
+            plain.push(c);
+            at += 1;
+        } else {
+            at += 1;
+        }
+    }
+    flush(&mut plain, sgr, &mut runs);
+
+    let mut out = String::new();
+    let mut spans = Vec::new();
+    for (run_text, style) in runs {
+        let start = out.len();
+        out.push_str(&run_text);
+        if let Some(style) = style {
+            spans.push((start..out.len(), style));
+        }
+    }
+    StyledText { text: out, spans }
+}
+
+fn drop_line(runs: &mut Vec<(String, Option<Style>)>) {
+    while let Some((text, style)) = runs.pop() {
+        if let Some(break_at) = text.rfind('\n') {
+            runs.push((text[..=break_at].to_string(), style));
+            return;
+        }
+    }
+}
+
+fn is_csi_final(c: char) -> bool {
+    ('@'..='~').contains(&c)
+}
+
+/// Steps over the escape sequence starting at `at`, reporting a CSI's
+/// parameters and final byte. One reader for every kind, because the point
+/// is to *leave* them all behind: a sequence this did not recognise would
+/// otherwise have its body printed as ordinary text. Three shapes -- the CSI
+/// (`ESC [ ... letter`), the string escapes which run to a terminator, and
+/// the two-character ones.
+fn skip_escape(chars: &[char], at: usize, mut on_csi: impl FnMut(&str, char)) -> usize {
+    let Some(&next) = chars.get(at + 1) else {
+        return at + 1;
+    };
+    match next {
+        '[' => {
+            let mut end = at + 2;
+            while end < chars.len() && !is_csi_final(chars[end]) {
+                end += 1;
+            }
+            if end >= chars.len() {
+                chars.len()
+            } else {
+                let params: String = chars[at + 2..end].iter().collect();
+                on_csi(&params, chars[end]);
+                end + 1
+            }
+        }
+        ']' | 'P' | 'X' | '^' | '_' => {
+            let mut end = at + 2;
+            while end < chars.len() {
+                if chars[end] == BELL {
+                    return end + 1;
+                }
+                if chars[end] == ESC && chars.get(end + 1) == Some(&'\\') {
+                    return end + 2;
+                }
+                end += 1;
+            }
+            chars.len()
+        }
+        _ => at + 2,
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+struct Sgr {
+    fg: Option<Rgb>,
+    bg: Option<Rgb>,
+    bold: bool,
+    dim: bool,
+    italic: bool,
+    underline: bool,
+    strike: bool,
+    reverse: bool,
+}
+
+const DIM_ALPHA: f32 = 0.65;
+
+impl Sgr {
+    const PLAIN: Sgr = Sgr {
+        fg: None,
+        bg: None,
+        bold: false,
+        dim: false,
+        italic: false,
+        underline: false,
+        strike: false,
+        reverse: false,
+    };
+
+    fn span(&self, palette: &AnsiPalette) -> Option<Style> {
+        if *self == Sgr::PLAIN {
+            return None;
+        }
+        let front = if self.reverse {
+            Some(self.bg.unwrap_or(palette.background))
+        } else {
+            self.fg
+        };
+        let back = if self.reverse {
+            Some(self.fg.unwrap_or(palette.foreground))
+        } else {
+            self.bg
+        };
+        // Dim has to have a colour to dim, so where none was named it dims
+        // the ordinary one.
+        let stated = front.or(if self.dim {
+            Some(palette.foreground)
+        } else {
+            None
+        });
+        Some(Style {
+            color: stated,
+            alpha: if self.dim { Some(DIM_ALPHA) } else { None },
+            background: back,
+            bold: self.bold,
+            italic: self.italic,
+            underline: self.underline,
+            strikethrough: self.strike,
+        })
+    }
+
+    fn apply(&self, params: &str, palette: &AnsiPalette) -> Sgr {
+        let codes: Vec<i64> = params
+            .split(';')
+            .map(|p| p.trim().parse::<i64>().unwrap_or(0))
+            .collect();
+        let mut state = *self;
+        let mut at = 0usize;
+        while at < codes.len() {
+            let code = codes[at];
+            state = match code {
+                0 => Sgr::PLAIN,
+                1 => Sgr {
+                    bold: true,
+                    ..state
+                },
+                2 => Sgr { dim: true, ..state },
+                3 => Sgr {
+                    italic: true,
+                    ..state
+                },
+                4 => Sgr {
+                    underline: true,
+                    ..state
+                },
+                7 => Sgr {
+                    reverse: true,
+                    ..state
+                },
+                9 => Sgr {
+                    strike: true,
+                    ..state
+                },
+                21 | 22 => Sgr {
+                    bold: false,
+                    dim: false,
+                    ..state
+                },
+                23 => Sgr {
+                    italic: false,
+                    ..state
+                },
+                24 => Sgr {
+                    underline: false,
+                    ..state
+                },
+                27 => Sgr {
+                    reverse: false,
+                    ..state
+                },
+                29 => Sgr {
+                    strike: false,
+                    ..state
+                },
+                30..=37 => Sgr {
+                    fg: Some(palette.colours[(code - 30) as usize]),
+                    ..state
+                },
+                90..=97 => Sgr {
+                    fg: Some(palette.colours[(code - 90 + 8) as usize]),
+                    ..state
+                },
+                40..=47 => Sgr {
+                    bg: Some(palette.colours[(code - 40) as usize]),
+                    ..state
+                },
+                100..=107 => Sgr {
+                    bg: Some(palette.colours[(code - 100 + 8) as usize]),
+                    ..state
+                },
+                39 => Sgr { fg: None, ..state },
+                49 => Sgr { bg: None, ..state },
+                38 | 48 => {
+                    let (colour, last) = extended_colour(&codes, at, palette);
+                    at = last;
+                    if code == 38 {
+                        Sgr {
+                            fg: colour,
+                            ..state
+                        }
+                    } else {
+                        Sgr {
+                            bg: colour,
+                            ..state
+                        }
+                    }
+                }
+                _ => state,
+            };
+            at += 1;
+        }
+        state
+    }
+}
+
+fn extended_colour(codes: &[i64], at: usize, palette: &AnsiPalette) -> (Option<Rgb>, usize) {
+    match codes.get(at + 1) {
+        Some(&5) => match codes.get(at + 2) {
+            None => (None, at + 1),
+            Some(&n) => (Some(indexed_colour(n, palette)), at + 2),
+        },
+        Some(&2) => {
+            let r = codes.get(at + 2);
+            let g = codes.get(at + 3);
+            let b = codes.get(at + 4);
+            match (r, g, b) {
+                (Some(&r), Some(&g), Some(&b)) => (
+                    Some(Rgb::new(
+                        r.clamp(0, 255) as u8,
+                        g.clamp(0, 255) as u8,
+                        b.clamp(0, 255) as u8,
+                    )),
+                    at + 4,
+                ),
+                _ => (None, at + 1),
+            }
+        }
+        _ => (None, at + 1),
+    }
+}
+
+const CUBE: [u8; 6] = [0, 95, 135, 175, 215, 255];
+
+fn indexed_colour(n: i64, palette: &AnsiPalette) -> Rgb {
+    if n < 0 {
+        palette.foreground
+    } else if n < 16 {
+        palette.colours[n as usize]
+    } else if n < 232 {
+        let i = (n - 16) as usize;
+        Rgb::new(CUBE[i / 36], CUBE[i / 6 % 6], CUBE[i % 6])
+    } else if n < 256 {
+        let grey = (8 + (n - 232) * 10) as u8;
+        Rgb::new(grey, grey, grey)
+    } else {
+        palette.foreground
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn palette() -> AnsiPalette {
+        let mut colours = [Rgb::new(0, 0, 0); 16];
+        for (i, c) in colours.iter_mut().enumerate() {
+            *c = Rgb::new(i as u8, 0, 0);
+        }
+        AnsiPalette {
+            colours,
+            foreground: Rgb::new(255, 255, 255),
+            background: Rgb::new(0, 0, 0),
+        }
+    }
+
+    fn styled(text: &str) -> StyledText {
+        ansi_styled(text, &palette())
+    }
+
+    fn style_over(text: &str, word: &str) -> Option<Style> {
+        let out = styled(text);
+        let at = out
+            .text
+            .find(word)
+            .unwrap_or_else(|| panic!("no {word:?} in {}", out.text));
+        out.spans
+            .iter()
+            .find(|(range, _)| range.contains(&at))
+            .map(|(_, style)| *style)
+    }
+
+    #[test]
+    fn a_colour_becomes_a_span_and_the_sequence_itself_disappears() {
+        let text = format!("plain {ESC}[31mred{ESC}[0m plain");
+        assert_eq!(styled(&text).text, "plain red plain");
+        assert_eq!(
+            style_over(&text, "red").unwrap().color,
+            Some(Rgb::new(1, 0, 0))
+        );
+        assert!(style_over(&text, "plain").is_none());
+    }
+
+    #[test]
+    fn bright_background_and_256_colour_forms_all_reach_the_same_table() {
+        assert_eq!(
+            style_over(&format!("{ESC}[91mx"), "x").unwrap().color,
+            Some(Rgb::new(9, 0, 0))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[44mx"), "x").unwrap().background,
+            Some(Rgb::new(4, 0, 0))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[38;5;1mx"), "x").unwrap().color,
+            Some(Rgb::new(1, 0, 0))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[38;5;16mx"), "x").unwrap().color,
+            Some(Rgb::new(0, 0, 0))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[38;5;231mx"), "x").unwrap().color,
+            Some(Rgb::new(255, 255, 255))
+        );
+        assert_eq!(
+            style_over(&format!("{ESC}[38;2;10;20;30mx"), "x")
+                .unwrap()
+                .color,
+            Some(Rgb::new(10, 20, 30))
+        );
+    }
+
+    #[test]
+    fn everything_that_is_not_styling_is_dropped_rather_than_printed() {
+        let text = format!("a{ESC}[2Jb{ESC}[Kc{ESC}]0;a title{BELL}d{ESC}=e");
+        assert_eq!(styled(&text).text, "abcde");
+    }
+
+    #[test]
+    fn a_carriage_return_rewrites_its_line_as_it_does_on_a_terminal() {
+        assert_eq!(styled("10%\r50%\rdone\n").text, "done\n");
+        assert_eq!(styled("kept\r\nfirst\rlast").text, "kept\nlast");
+    }
+
+    #[test]
+    fn a_sequence_cut_off_mid_stream_takes_no_text_with_it() {
+        assert_eq!(styled(&format!("text {ESC}[3")).text, "text ");
+    }
+
+    #[test]
+    fn unstyled_text_costs_no_spans_at_all() {
+        assert_eq!(styled("nothing to do here").spans.len(), 0);
+        assert_eq!(styled(&format!("a{ESC}[2Jb")).spans.len(), 0);
+    }
+}

app/src/client/api.rs

@@ -0,0 +1,546 @@
+use std::io::Read;
+
+use event_model::SeqEvent;
+use serde::Deserialize;
+use serde_json::Value;
+
+/// `status` is the HTTP status where there was a response at all, and
+/// `None` where the server was never reached -- mirroring `ApiException` in
+/// `Api.kt`.
+#[derive(Debug, Clone)]
+pub struct ApiError {
+    pub message: String,
+    pub status: Option<u16>,
+}
+
+impl std::fmt::Display for ApiError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.message)
+    }
+}
+impl std::error::Error for ApiError {}
+
+pub enum Body {
+    Json(Value),
+    Bytes {
+        content_type: String,
+        bytes: Vec<u8>,
+    },
+}
+
+/// What a transport hands back for a REST call: the status and the body
+/// read whole. A streamed body ([`Transport::stream`]) is a different
+/// method because its whole point is not reading it whole.
+pub struct RawResponse {
+    pub status: u16,
+    pub body: Vec<u8>,
+}
+
+pub trait Transport: Send + Sync {
+    fn request(
+        &self,
+        method: &str,
+        path: &str,
+        body: Option<Body>,
+    ) -> Result<RawResponse, ApiError>;
+
+    fn stream(&self, path: &str) -> Result<Box<dyn Read + Send>, ApiError>;
+}
+
+/// One session as `GET /sessions` and `GET /sessions/{id}` report it.
+/// Mirrors `Api.kt`'s `SessionSummary`; see that type's doc for what each
+/// field means and why `setup` is never shown.
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSummary {
+    pub id: String,
+    pub setup: String,
+    #[serde(default)]
+    pub keeps_own_transcript: bool,
+    pub setup_name: String,
+    pub provider: String,
+    pub title: String,
+    #[serde(default)]
+    pub model: Option<String>,
+    #[serde(default)]
+    pub permission_mode: Option<String>,
+    #[serde(default)]
+    pub imported: bool,
+    #[serde(default = "default_true")]
+    pub notify: bool,
+    #[serde(default)]
+    pub cwd: Option<String>,
+    #[serde(default)]
+    pub context_tokens: Option<u64>,
+    #[serde(default)]
+    pub max_image_edge: Option<u32>,
+    pub status: String,
+    pub last_activity: f64,
+}
+
+fn default_true() -> bool {
+    true
+}
+
+pub struct ApiClient<T: Transport> {
+    transport: T,
+}
+
+impl<T: Transport> ApiClient<T> {
+    pub fn new(transport: T) -> Self {
+        Self { transport }
+    }
+
+    /// The transport underneath, for a caller that needs the raw SSE
+    /// stream (`event_stream::follow_session_events`) rather than one of
+    /// this client's typed REST calls -- `transcript_source::TranscriptSource`
+    /// is the one that does.
+    pub fn transport(&self) -> &T {
+        &self.transport
+    }
+
+    fn json_request<R: for<'de> Deserialize<'de>>(
+        &self,
+        method: &str,
+        path: &str,
+        body: Option<Value>,
+    ) -> Result<R, ApiError> {
+        let raw = self.transport.request(method, path, body.map(Body::Json))?;
+        serde_json::from_slice(&raw.body).map_err(|e| ApiError {
+            message: format!("Reached the server but couldn't read its response ({e})"),
+            status: Some(raw.status),
+        })
+    }
+
+    fn empty_request(&self, method: &str, path: &str, body: Option<Value>) -> Result<(), ApiError> {
+        self.transport.request(method, path, body.map(Body::Json))?;
+        Ok(())
+    }
+
+    pub fn fetch_sessions(&self) -> Result<Vec<SessionSummary>, ApiError> {
+        self.json_request("GET", "/sessions", None)
+    }
+
+    pub fn fetch_session(&self, session_id: &str) -> Result<SessionSummary, ApiError> {
+        self.json_request("GET", &format!("/sessions/{session_id}"), None)
+    }
+
+    pub fn send_message(
+        &self,
+        session_id: &str,
+        text: &str,
+        attachment_ids: &[String],
+    ) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/message"),
+            Some(serde_json::json!({ "text": text, "attachmentIds": attachment_ids })),
+        )
+    }
+
+    pub fn unqueue_message(&self, session_id: &str, message_id: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/unqueue"),
+            Some(serde_json::json!({ "messageId": message_id })),
+        )
+    }
+
+    pub fn answer_question(
+        &self,
+        session_id: &str,
+        question_id: &str,
+        answers: &[String],
+    ) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/answer"),
+            Some(serde_json::json!({ "questionId": question_id, "answers": answers })),
+        )
+    }
+
+    pub fn interrupt_session(&self, session_id: &str) -> Result<(), ApiError> {
+        self.empty_request("POST", &format!("/sessions/{session_id}/interrupt"), None)
+    }
+
+    pub fn stop_session(&self, session_id: &str) -> Result<(), ApiError> {
+        self.empty_request("POST", &format!("/sessions/{session_id}/stop"), None)
+    }
+
+    pub fn start_session(&self, session_id: &str) -> Result<(), ApiError> {
+        self.empty_request("POST", &format!("/sessions/{session_id}/start"), None)
+    }
+
+    pub fn rename_session(&self, session_id: &str, title: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/title"),
+            Some(serde_json::json!({ "title": title })),
+        )
+    }
+
+    pub fn set_session_cwd(&self, session_id: &str, cwd: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/cwd"),
+            Some(serde_json::json!({ "cwd": cwd })),
+        )
+    }
+
+    pub fn set_session_model(&self, session_id: &str, model: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/model"),
+            Some(serde_json::json!({ "model": model })),
+        )
+    }
+
+    pub fn set_session_permission_mode(
+        &self,
+        session_id: &str,
+        mode: &str,
+    ) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/permission-mode"),
+            Some(serde_json::json!({ "permissionMode": mode })),
+        )
+    }
+
+    pub fn set_session_notify(&self, session_id: &str, notify: bool) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/notify"),
+            Some(serde_json::json!({ "notify": notify })),
+        )
+    }
+
+    pub fn run_command(&self, session_id: &str, text: &str) -> Result<(), ApiError> {
+        self.empty_request(
+            "POST",
+            &format!("/sessions/{session_id}/command"),
+            Some(serde_json::json!({ "text": text })),
+        )
+    }
+
+    pub fn compact_session(&self, session_id: &str) -> Result<(), ApiError> {
+        self.empty_request("POST", &format!("/sessions/{session_id}/compact"), None)
+    }
+
+    pub fn delete_session(&self, session_id: &str, delete_foreign: bool) -> Result<(), ApiError> {
+        let path = if delete_foreign {
+            format!("/sessions/{session_id}?deleteForeign=true")
+        } else {
+            format!("/sessions/{session_id}")
+        };
+        self.empty_request("DELETE", &path, None)
+    }
+
+    /// A page of transcript history. `before` is the newest-first cursor
+    /// (server default is "the newest page" when absent, which a caller
+    /// gets by passing `None`); the events themselves are handed back as
+    /// [`event_model::SeqEvent`] via `crate::client::event_stream`'s parsing, kept
+    /// out of this method's signature so a caller that only wants the raw
+    /// lines (for the transcript cache) is not forced to parse them.
+    pub fn fetch_transcript_page(
+        &self,
+        session_id: &str,
+        before: Option<u64>,
+        limit: u32,
+        coalesce: bool,
+    ) -> Result<Vec<Value>, ApiError> {
+        self.json_request(
+            "GET",
+            &transcript_path(session_id, before, limit, coalesce, None),
+            None,
+        )
+    }
+
+    pub fn fetch_transcript_lines(
+        &self,
+        session_id: &str,
+        before: Option<u64>,
+        limit: u32,
+        coalesce: bool,
+        after: Option<u64>,
+    ) -> Result<Vec<(String, SeqEvent)>, ApiError> {
+        let path = transcript_path(session_id, before, limit, coalesce, after);
+        let raw: Vec<Box<serde_json::value::RawValue>> = self.json_request("GET", &path, None)?;
+        raw.into_iter()
+            .map(|value| {
+                let line = value.get().to_string();
+                let event: SeqEvent = serde_json::from_str(&line).map_err(|e| ApiError {
+                    message: format!(
+                        "the server sent a transcript line this build couldn't parse: {e}"
+                    ),
+                    status: None,
+                })?;
+                Ok((line, event))
+            })
+            .collect()
+    }
+}
+
+fn transcript_path(
+    session_id: &str,
+    before: Option<u64>,
+    limit: u32,
+    coalesce: bool,
+    after: Option<u64>,
+) -> String {
+    let mut path = format!("/sessions/{session_id}/transcript?limit={limit}");
+    if let Some(before) = before {
+        path.push_str(&format!("&before={before}"));
+    }
+    if coalesce {
+        path.push_str("&coalesce=true");
+    }
+    if let Some(after) = after {
+        path.push_str(&format!("&after={after}"));
+    }
+    path
+}
+
+pub struct UreqTransport {
+    agent: ureq::Agent,
+    base_url: String,
+    token: String,
+}
+
+impl UreqTransport {
+    pub fn new(
+        base_url: impl Into<String>,
+        token: impl Into<String>,
+        ca_pem: &[u8],
+    ) -> Result<Self, ApiError> {
+        let cert = ureq::tls::Certificate::from_pem(ca_pem).map_err(|e| ApiError {
+            message: format!("The pinned CA certificate could not be read: {e}"),
+            status: None,
+        })?;
+        let tls_config = ureq::tls::TlsConfig::builder()
+            .root_certs(ureq::tls::RootCerts::new_with_certs(&[cert]))
+            .build();
+        let agent: ureq::Agent = ureq::Agent::config_builder()
+            .tls_config(tls_config)
+            .http_status_as_error(false)
+            .timeout_connect(Some(std::time::Duration::from_secs(5)))
+            .build()
+            .into();
+        Ok(Self {
+            agent,
+            base_url: base_url.into(),
+            token: token.into(),
+        })
+    }
+
+    fn url(&self, path: &str) -> String {
+        format!("{}{}", self.base_url, path)
+    }
+}
+
+impl Transport for UreqTransport {
+    fn request(
+        &self,
+        method: &str,
+        path: &str,
+        body: Option<Body>,
+    ) -> Result<RawResponse, ApiError> {
+        let url = self.url(path);
+        let auth = format!("Bearer {}", self.token);
+        let mut builder = ureq::http::Request::builder()
+            .method(method)
+            .uri(&url)
+            .header("Authorization", &auth);
+        let response = match body {
+            None => builder
+                .body(())
+                .map_err(ureq::Error::from)
+                .and_then(|req| self.agent.run(req)),
+            Some(Body::Json(value)) => {
+                builder = builder.header("Content-Type", "application/json");
+                builder
+                    .body(serde_json::to_vec(&value).unwrap_or_default())
+                    .map_err(ureq::Error::from)
+                    .and_then(|req| self.agent.run(req))
+            }
+            Some(Body::Bytes {
+                content_type,
+                bytes,
+            }) => {
+                builder = builder.header("Content-Type", content_type);
+                builder
+                    .body(bytes)
+                    .map_err(ureq::Error::from)
+                    .and_then(|req| self.agent.run(req))
+            }
+        };
+        let mut response = response.map_err(|e| transport_error(&self.base_url, path, e))?;
+        let status = response.status().as_u16();
+        let mut body = Vec::new();
+        response
+            .body_mut()
+            .as_reader()
+            .read_to_end(&mut body)
+            .map_err(|e| ApiError {
+                message: format!("Reached {url} but couldn't read its response ({e})"),
+                status: Some(status),
+            })?;
+        if !(200..300).contains(&status) {
+            return Err(response_error(status, &body, path));
+        }
+        Ok(RawResponse { status, body })
+    }
+
+    fn stream(&self, path: &str) -> Result<Box<dyn Read + Send>, ApiError> {
+        let url = self.url(path);
+        let auth = format!("Bearer {}", self.token);
+        let response = self
+            .agent
+            .get(&url)
+            .header("Authorization", &auth)
+            .header("Accept", "text/event-stream")
+            .config()
+            .timeout_recv_response(None)
+            .build()
+            .call();
+        let mut response = response.map_err(|e| transport_error(&self.base_url, path, e))?;
+        let status = response.status().as_u16();
+        if status != 200 {
+            let mut body = Vec::new();
+            let _ = response.body_mut().as_reader().read_to_end(&mut body);
+            return Err(response_error(status, &body, path));
+        }
+        Ok(Box::new(response.into_body().into_reader()))
+    }
+}
+
+fn transport_error(base_url: &str, path: &str, e: ureq::Error) -> ApiError {
+    ApiError {
+        message: format!(
+            "Couldn't reach the server at {base_url} ({e}) -- is ai-server running, and is this \
+             device able to reach that address (WireGuard up)? [{path}]"
+        ),
+        status: None,
+    }
+}
+
+fn response_error(status: u16, body: &[u8], path: &str) -> ApiError {
+    let detail = String::from_utf8_lossy(body).trim().to_string();
+    let message = if status == 401 {
+        "The server rejected this device's token. Re-enroll by scanning the server's QR (or \
+         rotate with --rotate-token and scan the new one)."
+            .to_string()
+    } else if detail.is_empty() {
+        format!("Server returned HTTP {status} for {path}")
+    } else {
+        detail
+    };
+    ApiError {
+        message,
+        status: Some(status),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Cursor;
+    use std::sync::Mutex;
+
+    #[derive(Default)]
+    struct FakeTransport {
+        responses: Mutex<Vec<(String, String, RawResponse)>>,
+    }
+
+    impl FakeTransport {
+        fn respond(&self, method: &str, path: &str, status: u16, body: &str) {
+            self.responses.lock().unwrap().push((
+                method.to_string(),
+                path.to_string(),
+                RawResponse {
+                    status,
+                    body: body.as_bytes().to_vec(),
+                },
+            ));
+        }
+    }
+
+    impl Transport for FakeTransport {
+        fn request(
+            &self,
+            method: &str,
+            path: &str,
+            _body: Option<Body>,
+        ) -> Result<RawResponse, ApiError> {
+            let mut responses = self.responses.lock().unwrap();
+            let index = responses
+                .iter()
+                .position(|(m, p, _)| m == method && p == path)
+                .ok_or_else(|| ApiError {
+                    message: format!("no fake response for {method} {path}"),
+                    status: None,
+                })?;
+            let (_, _, response) = responses.remove(index);
+            if !(200..300).contains(&response.status) {
+                return Err(response_error(response.status, &response.body, path));
+            }
+            Ok(response)
+        }
+
+        fn stream(&self, _path: &str) -> Result<Box<dyn Read + Send>, ApiError> {
+            Ok(Box::new(Cursor::new(Vec::new())))
+        }
+    }
+
+    #[test]
+    fn fetch_sessions_parses_the_list() {
+        let transport = FakeTransport::default();
+        transport.respond(
+            "GET",
+            "/sessions",
+            200,
+            r#"[{"id":"s1","setup":"m1","setupName":"desktop","provider":"claude_cli",
+               "title":"hi","status":"idle","lastActivity":1.0}]"#,
+        );
+        let client = ApiClient::new(transport);
+        let sessions = client.fetch_sessions().unwrap();
+        assert_eq!(sessions.len(), 1);
+        assert_eq!(sessions[0].id, "s1");
+        assert_eq!(sessions[0].setup_name, "desktop");
+        assert!(sessions[0].notify);
+        assert_eq!(sessions[0].model, None);
+    }
+
+    #[test]
+    fn a_401_gets_the_enrollment_message_regardless_of_the_bare_body() {
+        let transport = FakeTransport::default();
+        transport.respond("POST", "/sessions/s1/interrupt", 401, "unauthorized");
+        let client = ApiClient::new(transport);
+        let err = client.interrupt_session("s1").unwrap_err();
+        assert!(err.message.contains("Re-enroll"));
+        assert_eq!(err.status, Some(401));
+    }
+
+    #[test]
+    fn a_bare_error_status_with_no_body_falls_back_to_a_generic_message() {
+        let transport = FakeTransport::default();
+        transport.respond("POST", "/sessions/s1/stop", 500, "");
+        let client = ApiClient::new(transport);
+        let err = client.stop_session("s1").unwrap_err();
+        assert!(err.message.contains("500"));
+    }
+
+    #[test]
+    fn a_server_explanation_in_the_body_is_surfaced_verbatim() {
+        let transport = FakeTransport::default();
+        transport.respond(
+            "POST",
+            "/sessions/s1/cwd",
+            409,
+            "that path does not exist on this machine",
+        );
+        let client = ApiClient::new(transport);
+        let err = client.set_session_cwd("s1", "/nope").unwrap_err();
+        assert_eq!(err.message, "that path does not exist on this machine");
+    }
+}

app/src/client/config.rs

@@ -0,0 +1,316 @@
+use base64::Engine;
+use serde::{Deserialize, Serialize};
+use std::io;
+use std::path::{Path, PathBuf};
+
+/// `ca_pem` is the trust anchor to pin, when the link carried one (the
+/// `ca` parameter, `wg_app_link::enroll::ca_param`). It is optional
+/// for compatibility with older links. Current clients require it before
+/// opening a transport. It is a public certificate, not a secret.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct EnrolledServer {
+    pub host: String,
+    pub port: u16,
+    pub token: String,
+    #[serde(default)]
+    pub ca_pem: Option<String>,
+}
+
+impl EnrolledServer {
+    /// `ca` is base64url of the certificate's DER and is rebuilt into PEM
+    /// here, because that is what every consumer of it wants
+    /// (`UreqTransport::new`, and the file a person points `curl --cacert`
+    /// at). A `ca` that does not decode fails the whole link rather than
+    /// enrolling a server with no trust anchor: the link said which
+    /// certificate to pin, and quietly not pinning it is the one outcome
+    /// nothing downstream could notice.
+    pub fn parse_link(link: &str) -> Result<Self, String> {
+        let query = link.split_once('?').map(|(_, q)| q).ok_or_else(|| {
+            format!(
+                "'{link}' has no query string (expected \
+                 aiapp://enroll?host=...&port=...&token=...)"
+            )
+        })?;
+
+        let mut host = None;
+        let mut port = None;
+        let mut token = None;
+        let mut ca = None;
+        for pair in query.split('&') {
+            let Some((key, value)) = pair.split_once('=') else {
+                continue;
+            };
+            let value = percent_decode(value);
+            match key {
+                "host" => host = Some(value),
+                "port" => port = Some(value),
+                "token" => token = Some(value),
+                "ca" => ca = Some(value),
+                _ => {}
+            }
+        }
+
+        let host = host.ok_or_else(|| format!("'{link}' is missing 'host'"))?;
+        let port_str = port.ok_or_else(|| format!("'{link}' is missing 'port'"))?;
+        let port: u16 = port_str
+            .parse()
+            .map_err(|e| format!("'{link}''s port ('{port_str}') is not a number: {e}"))?;
+        let token = token.ok_or_else(|| format!("'{link}' is missing 'token'"))?;
+        let ca_pem = ca.map(|ca| pem_from_link_param(&ca)).transpose()?;
+
+        Ok(Self {
+            host,
+            port,
+            token,
+            ca_pem,
+        })
+    }
+
+    pub fn base_url(&self) -> String {
+        format!("https://{}:{}", self.host, self.port)
+    }
+}
+
+fn pem_from_link_param(ca: &str) -> Result<String, String> {
+    let der = base64::engine::general_purpose::URL_SAFE_NO_PAD
+        .decode(ca.as_bytes())
+        .map_err(|e| format!("the link's 'ca' is not base64url ({e})"))?;
+    let body = base64::engine::general_purpose::STANDARD.encode(&der);
+    let mut pem = String::from("-----BEGIN CERTIFICATE-----\n");
+    for line in body.as_bytes().chunks(64) {
+        pem.push_str(std::str::from_utf8(line).expect("base64 is ASCII"));
+        pem.push('\n');
+    }
+    pem.push_str("-----END CERTIFICATE-----\n");
+    Ok(pem)
+}
+
+/// Where one client keeps the enrollment it should not have to be told
+/// about a second time. `dir` is the caller's, because that is the only
+/// part that differs by platform -- see this module's doc.
+pub struct EnrollmentStore {
+    dir: PathBuf,
+}
+
+impl EnrollmentStore {
+    pub fn new(dir: impl Into<PathBuf>) -> Self {
+        Self { dir: dir.into() }
+    }
+
+    pub fn dir(&self) -> &Path {
+        &self.dir
+    }
+
+    fn file(&self) -> PathBuf {
+        self.dir.join("enrollment.json")
+    }
+
+    pub fn save(&self, server: &EnrolledServer) -> io::Result<()> {
+        std::fs::create_dir_all(&self.dir)?;
+        let path = self.file();
+        let json = serde_json::to_vec_pretty(server)
+            .expect("EnrolledServer holds nothing that fails to serialise");
+        std::fs::write(&path, json)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))?;
+        }
+        Ok(())
+    }
+
+    pub fn load(&self) -> io::Result<Option<EnrolledServer>> {
+        let path = self.file();
+        match std::fs::read(&path) {
+            Ok(bytes) => {
+                let server = serde_json::from_slice(&bytes).map_err(|e| {
+                    io::Error::new(
+                        io::ErrorKind::InvalidData,
+                        format!("{} is not a valid enrollment ({e})", path.display()),
+                    )
+                })?;
+                Ok(Some(server))
+            }
+            Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(None),
+            Err(e) => Err(e),
+        }
+    }
+}
+
+fn percent_decode(s: &str) -> String {
+    let bytes = s.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == b'%'
+            && i + 2 < bytes.len()
+            && let Ok(byte) =
+                u8::from_str_radix(std::str::from_utf8(&bytes[i + 1..i + 3]).unwrap_or(""), 16)
+        {
+            out.push(byte);
+            i += 3;
+            continue;
+        }
+        out.push(bytes[i]);
+        i += 1;
+    }
+    String::from_utf8_lossy(&out).into_owned()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_host_port_and_token() {
+        let server =
+            EnrolledServer::parse_link("aiapp://enroll?host=127.0.0.1&port=8547&token=abcDEF123")
+                .unwrap();
+        assert_eq!(
+            server,
+            EnrolledServer {
+                host: "127.0.0.1".to_string(),
+                port: 8547,
+                token: "abcDEF123".to_string(),
+                ca_pem: None,
+            }
+        );
+        assert_eq!(server.base_url(), "https://127.0.0.1:8547");
+    }
+
+    #[test]
+    fn field_order_does_not_matter() {
+        let server =
+            EnrolledServer::parse_link("aiapp://enroll?token=tok&port=443&host=example.com")
+                .unwrap();
+        assert_eq!(server.host, "example.com");
+        assert_eq!(server.port, 443);
+        assert_eq!(server.token, "tok");
+    }
+
+    #[test]
+    fn a_percent_encoded_token_is_decoded() {
+        let server =
+            EnrolledServer::parse_link("aiapp://enroll?host=h&port=1&token=a%2Bb%2Fc").unwrap();
+        assert_eq!(server.token, "a+b/c");
+    }
+
+    #[test]
+    fn a_missing_field_is_named_in_the_error() {
+        let err = EnrolledServer::parse_link("aiapp://enroll?host=h&port=1").unwrap_err();
+        assert!(
+            err.contains("token"),
+            "error should name the missing field: {err}"
+        );
+    }
+
+    #[test]
+    fn a_ca_in_the_link_comes_back_as_pem() {
+        let der = [0x30u8, 0x82, 0x01, 0xfb, 0x3e, 0x7f];
+        let param = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(der);
+        let server =
+            EnrolledServer::parse_link(&format!("aiapp://enroll?host=h&port=1&token=t&ca={param}"))
+                .unwrap();
+        let pem = server.ca_pem.expect("the link carried a CA");
+        assert!(pem.starts_with("-----BEGIN CERTIFICATE-----\n"), "{pem}");
+        assert!(
+            pem.trim_end().ends_with("-----END CERTIFICATE-----"),
+            "{pem}"
+        );
+        assert_eq!(
+            base64::engine::general_purpose::STANDARD
+                .decode(
+                    pem.lines()
+                        .filter(|l| !l.starts_with("-----"))
+                        .collect::<String>()
+                )
+                .unwrap(),
+            der
+        );
+    }
+
+    #[test]
+    fn no_ca_parameter_is_none_not_an_error() {
+        let server = EnrolledServer::parse_link("aiapp://enroll?host=h&port=1&token=t").unwrap();
+        assert_eq!(server.ca_pem, None);
+    }
+
+    #[test]
+    fn a_ca_that_does_not_decode_fails_the_link() {
+        let err =
+            EnrolledServer::parse_link("aiapp://enroll?host=h&port=1&token=t&ca=not!base64url")
+                .unwrap_err();
+        assert!(err.contains("ca"), "{err}");
+    }
+
+    #[test]
+    fn a_saved_enrollment_reads_back_the_same() {
+        let dir = tempfile::tempdir().unwrap();
+        let store = EnrollmentStore::new(dir.path());
+        let server = EnrolledServer {
+            host: "127.0.0.1".to_string(),
+            port: 8547,
+            token: "tok".to_string(),
+            ca_pem: Some("-----BEGIN CERTIFICATE-----\nQUJD\n-----END CERTIFICATE-----\n".into()),
+        };
+        store.save(&server).unwrap();
+        assert_eq!(store.load().unwrap(), Some(server));
+    }
+
+    #[test]
+    fn nothing_saved_yet_is_none_not_an_error() {
+        let dir = tempfile::tempdir().unwrap();
+        assert_eq!(EnrollmentStore::new(dir.path()).load().unwrap(), None);
+    }
+
+    #[test]
+    fn an_enrollment_without_a_ca_still_loads() {
+        let dir = tempfile::tempdir().unwrap();
+        let store = EnrollmentStore::new(dir.path());
+        std::fs::create_dir_all(dir.path()).unwrap();
+        std::fs::write(
+            dir.path().join("enrollment.json"),
+            br#"{"host":"h","port":1,"token":"t"}"#,
+        )
+        .unwrap();
+        assert_eq!(store.load().unwrap().unwrap().ca_pem, None);
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn the_saved_file_is_owner_only() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = tempfile::tempdir().unwrap();
+        let store = EnrollmentStore::new(dir.path());
+        store
+            .save(&EnrolledServer {
+                host: "h".to_string(),
+                port: 1,
+                token: "t".to_string(),
+                ca_pem: None,
+            })
+            .unwrap();
+        let mode = std::fs::metadata(dir.path().join("enrollment.json"))
+            .unwrap()
+            .permissions()
+            .mode();
+        assert_eq!(mode & 0o777, 0o600);
+    }
+
+    #[test]
+    fn a_corrupt_file_is_named_in_the_error() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("enrollment.json"), b"not json").unwrap();
+        let err = EnrollmentStore::new(dir.path()).load().unwrap_err();
+        assert!(err.to_string().contains("enrollment.json"));
+    }
+
+    #[test]
+    fn a_non_numeric_port_is_named_in_the_error() {
+        let err = EnrolledServer::parse_link("aiapp://enroll?host=h&port=x&token=t").unwrap_err();
+        assert!(
+            err.contains("port"),
+            "error should name the offending field: {err}"
+        );
+    }
+}

app/src/client/durations.rs

@@ -0,0 +1,74 @@
+/// A tool's timeout arrives as `480000`, which nobody reads as eight
+/// minutes. The rule has two halves, because a short span and a long one
+/// are read for different things. Under a minute the question is "roughly
+/// how long", so only the largest unit is shown and a fraction carries the
+/// rest -- `2.5s`. At a minute or more the question is "how long exactly",
+/// so every unit with something in it is written out -- `5d 12h 4m`. Empty
+/// units are left out rather than written as zero.
+pub fn format_millis(ms: i64) -> String {
+    if ms < 0 {
+        return format!("-{}", format_millis(-ms));
+    }
+    if ms < 1000 {
+        return format!("{ms}ms");
+    }
+    if ms < 60_000 {
+        let tenths = (ms + 50) / 100;
+        let (whole, rest) = (tenths / 10, tenths % 10);
+        return if rest == 0 {
+            format!("{whole}s")
+        } else {
+            format!("{whole}.{rest}s")
+        };
+    }
+    let seconds = ms / 1000;
+    [
+        ("d", seconds / 86_400),
+        ("h", seconds / 3600 % 24),
+        ("m", seconds / 60 % 60),
+        ("s", seconds % 60),
+    ]
+    .iter()
+    .filter(|(_, n)| *n > 0)
+    .map(|(unit, n)| format!("{n}{unit}"))
+    .collect::<Vec<_>>()
+    .join(" ")
+}
+
+pub fn format_millis_text(text: &str) -> String {
+    match text.trim().parse::<i64>() {
+        Ok(ms) => format_millis(ms),
+        Err(_) => text.to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn under_a_minute_is_the_largest_unit_alone() {
+        assert_eq!(format_millis(30), "30ms");
+        assert_eq!(format_millis(999), "999ms");
+        assert_eq!(format_millis(1000), "1s");
+        assert_eq!(format_millis(2500), "2.5s");
+        assert_eq!(format_millis(2460), "2.5s");
+        assert_eq!(format_millis(59_900), "59.9s");
+    }
+
+    #[test]
+    fn a_minute_or_more_is_every_unit_that_has_something_in_it() {
+        assert_eq!(format_millis(480_000), "8m");
+        assert_eq!(format_millis(60_000), "1m");
+        assert_eq!(format_millis(90_000), "1m 30s");
+        assert_eq!(format_millis(475_440_000), "5d 12h 4m");
+        assert_eq!(format_millis(432_240_000), "5d 4m");
+    }
+
+    #[test]
+    fn only_a_whole_number_of_milliseconds_is_rewritten() {
+        assert_eq!(format_millis_text(" 480000 "), "8m");
+        assert_eq!(format_millis_text("2 minutes"), "2 minutes");
+        assert_eq!(format_millis_text(""), "");
+    }
+}

app/src/client/event_stream.rs

@@ -0,0 +1,125 @@
+use std::io::{BufRead, BufReader};
+
+use event_model::SeqEvent;
+
+use crate::client::api::{ApiError, Transport};
+use crate::client::sse::SseReader;
+
+/// The frame name the server uses to say a cursor was too far behind to
+/// continue from. Must match `send_backlog` in `server/src/routes.rs`.
+const RESET_EVENT: &str = "reset";
+
+/// One frame of a session's event stream, folded from the wire shape the
+/// caller needs to act on -- mirroring what `EventStream.kt`'s three
+/// callbacks were for, as a single enum instead, since Rust has no
+/// equivalent of handing three closures to one blocking call.
+pub enum StreamItem {
+    Open,
+    Reset,
+    Event { raw: String, event: SeqEvent },
+}
+
+/// Follows `/sessions/{id}/events?after={after}`, calling `on_item` for
+/// each [`StreamItem`] until the connection drops or `on_item` asks to
+/// stop (by returning `false`). Reconnecting -- with the last seq seen as
+/// the new cursor -- is the caller's job.
+pub fn follow_session_events(
+    transport: &dyn Transport,
+    session_id: &str,
+    after: u64,
+    mut on_item: impl FnMut(StreamItem) -> bool,
+) -> Result<(), ApiError> {
+    let path = format!("/sessions/{session_id}/events?after={after}");
+    let body = transport.stream(&path)?;
+    if !on_item(StreamItem::Open) {
+        return Ok(());
+    }
+    let mut lines = BufReader::new(body).lines();
+    let mut reader = SseReader::new();
+    while let Some(line) = lines.next().transpose().map_err(|e| ApiError {
+        message: format!("Can't reach the server -- retrying. ({e})"),
+        status: None,
+    })? {
+        let Some(frame) = reader.feed_line(&line) else {
+            continue;
+        };
+        if frame.name.as_deref() == Some(RESET_EVENT) {
+            if !on_item(StreamItem::Reset) {
+                return Ok(());
+            }
+        } else if !frame.data.is_empty() {
+            let event: SeqEvent = serde_json::from_str(&frame.data).map_err(|e| ApiError {
+                message: format!("The server sent an event this build couldn't parse: {e}"),
+                status: None,
+            })?;
+            if !on_item(StreamItem::Event {
+                raw: frame.data,
+                event,
+            }) {
+                return Ok(());
+            }
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::client::api::{Body, RawResponse};
+    use std::io::Cursor;
+
+    struct FixtureTransport {
+        body: &'static str,
+    }
+
+    impl Transport for FixtureTransport {
+        fn request(
+            &self,
+            _method: &str,
+            _path: &str,
+            _body: Option<Body>,
+        ) -> Result<RawResponse, ApiError> {
+            unimplemented!("this fixture only serves a stream")
+        }
+
+        fn stream(&self, _path: &str) -> Result<Box<dyn std::io::Read + Send>, ApiError> {
+            Ok(Box::new(Cursor::new(self.body.as_bytes().to_vec())))
+        }
+    }
+
+    #[test]
+    fn events_and_a_reset_frame_are_told_apart() {
+        let transport = FixtureTransport {
+            body: "event:reset\n\ndata:{\"seq\":1,\"ts\":1.0,\"type\":\"status\",\"state\":\"idle\"}\n\n",
+        };
+        let mut items = Vec::new();
+        follow_session_events(&transport, "s1", 0, |item| {
+            items.push(match item {
+                StreamItem::Open => "open".to_string(),
+                StreamItem::Reset => "reset".to_string(),
+                StreamItem::Event { event, .. } => format!("event:{}", event.seq),
+            });
+            true
+        })
+        .unwrap();
+        assert_eq!(items, vec!["open", "reset", "event:1"]);
+    }
+
+    #[test]
+    fn the_caller_can_stop_early() {
+        let transport = FixtureTransport {
+            body: "data:{\"seq\":1,\"ts\":1.0,\"type\":\"status\",\"state\":\"idle\"}\n\n\
+                   data:{\"seq\":2,\"ts\":1.0,\"type\":\"status\",\"state\":\"idle\"}\n\n",
+        };
+        let mut count = 0;
+        follow_session_events(&transport, "s1", 0, |item| {
+            if matches!(item, StreamItem::Event { .. }) {
+                count += 1;
+            }
+            count < 1
+        })
+        .unwrap();
+        assert_eq!(count, 1);
+    }
+}

app/src/client/highlight/languages.rs

@@ -0,0 +1,536 @@
+use std::collections::HashSet;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Language {
+    C,
+    Coffeescript,
+    Cpp,
+    Csharp,
+    Dart,
+    Fish,
+    Go,
+    Java,
+    Javascript,
+    Json,
+    Kotlin,
+    Markdown,
+    Perl,
+    Php,
+    Python,
+    Ron,
+    Ruby,
+    Rust,
+    Shell,
+    Swift,
+    Toml,
+    Typescript,
+}
+
+impl Language {
+    pub const ALL: [Language; 22] = [
+        Language::C,
+        Language::Coffeescript,
+        Language::Cpp,
+        Language::Csharp,
+        Language::Dart,
+        Language::Fish,
+        Language::Go,
+        Language::Java,
+        Language::Javascript,
+        Language::Json,
+        Language::Kotlin,
+        Language::Markdown,
+        Language::Perl,
+        Language::Php,
+        Language::Python,
+        Language::Ron,
+        Language::Ruby,
+        Language::Rust,
+        Language::Shell,
+        Language::Swift,
+        Language::Toml,
+        Language::Typescript,
+    ];
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct Rules {
+    pub keywords: HashSet<&'static str>,
+    pub line_comments: Vec<&'static str>,
+    pub line_comments_at_word_start: bool,
+    pub block_comment: Option<BlockComment>,
+    pub quotes: Vec<Quote>,
+    pub attributes: Attributes,
+    pub raw_strings: bool,
+    /// Rust: `'` opens a character literal only when a backslash or one
+    /// character and a `'` follow. Otherwise it is a lifetime or a label.
+    pub lifetimes: bool,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct BlockComment {
+    pub open: &'static str,
+    pub close: &'static str,
+    pub nests: bool,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct Quote {
+    pub open: &'static str,
+    pub close: &'static str,
+    pub escapes: bool,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum Attributes {
+    #[default]
+    None,
+    AtWord,
+    HashBracket,
+    HashLine,
+    LineBracket,
+}
+
+const C_STYLE: BlockComment = BlockComment {
+    open: "/*",
+    close: "*/",
+    nests: false,
+};
+const NESTING: BlockComment = BlockComment {
+    open: "/*",
+    close: "*/",
+    nests: true,
+};
+
+const DOUBLE: Quote = Quote {
+    open: "\"",
+    close: "\"",
+    escapes: true,
+};
+const SINGLE: Quote = Quote {
+    open: "'",
+    close: "'",
+    escapes: true,
+};
+const TRIPLE_DOUBLE: Quote = Quote {
+    open: "\"\"\"",
+    close: "\"\"\"",
+    escapes: true,
+};
+const TRIPLE_SINGLE: Quote = Quote {
+    open: "'''",
+    close: "'''",
+    escapes: true,
+};
+
+fn words(list: &'static str) -> HashSet<&'static str> {
+    list.split_whitespace().collect()
+}
+
+pub fn rules_for(language: Language) -> Rules {
+    match language {
+        Language::C => Rules {
+            keywords: words(KEYWORDS_C),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::HashLine,
+            ..Default::default()
+        },
+        Language::Cpp => Rules {
+            keywords: words(KEYWORDS_CPP),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::HashLine,
+            ..Default::default()
+        },
+        Language::Csharp => Rules {
+            keywords: words(KEYWORDS_CSHARP),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        Language::Coffeescript => Rules {
+            keywords: words(KEYWORDS_COFFEESCRIPT),
+            line_comments: vec!["#"],
+            block_comment: Some(BlockComment {
+                open: "###",
+                close: "###",
+                nests: false,
+            }),
+            quotes: vec![TRIPLE_DOUBLE, TRIPLE_SINGLE, DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        Language::Dart => Rules {
+            keywords: words(KEYWORDS_DART),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            quotes: vec![TRIPLE_DOUBLE, TRIPLE_SINGLE, DOUBLE, SINGLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Fish => Rules {
+            keywords: words(KEYWORDS_FISH),
+            line_comments: vec!["#"],
+            line_comments_at_word_start: true,
+            quotes: vec![DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        Language::Go => Rules {
+            keywords: words(KEYWORDS_GO),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![
+                DOUBLE,
+                SINGLE,
+                Quote {
+                    open: "`",
+                    close: "`",
+                    escapes: false,
+                },
+            ],
+            ..Default::default()
+        },
+        Language::Java => Rules {
+            keywords: words(KEYWORDS_JAVA),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Javascript => Rules {
+            keywords: words(KEYWORDS_JAVASCRIPT),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![
+                DOUBLE,
+                SINGLE,
+                Quote {
+                    open: "`",
+                    close: "`",
+                    escapes: true,
+                },
+            ],
+            ..Default::default()
+        },
+        Language::Json => Rules {
+            keywords: words(KEYWORDS_JSON),
+            quotes: vec![DOUBLE],
+            ..Default::default()
+        },
+        Language::Kotlin => Rules {
+            keywords: words(KEYWORDS_KOTLIN),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            quotes: vec![
+                Quote {
+                    open: "\"\"\"",
+                    close: "\"\"\"",
+                    escapes: false,
+                },
+                DOUBLE,
+                SINGLE,
+            ],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Perl => Rules {
+            keywords: words(KEYWORDS_PERL),
+            line_comments: vec!["#"],
+            quotes: vec![DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        Language::Php => Rules {
+            keywords: words(KEYWORDS_PHP),
+            line_comments: vec!["//", "#"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Python => Rules {
+            keywords: words(KEYWORDS_PYTHON),
+            line_comments: vec!["#"],
+            quotes: vec![TRIPLE_DOUBLE, TRIPLE_SINGLE, DOUBLE, SINGLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Ron => Rules {
+            keywords: words(KEYWORDS_RON),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            quotes: vec![DOUBLE, SINGLE],
+            attributes: Attributes::HashBracket,
+            raw_strings: true,
+            ..Default::default()
+        },
+        Language::Ruby => Rules {
+            keywords: words(KEYWORDS_RUBY),
+            line_comments: vec!["#"],
+            quotes: vec![DOUBLE, SINGLE],
+            ..Default::default()
+        },
+        Language::Rust => Rules {
+            keywords: words(KEYWORDS_RUST),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            // No `'` here: `lifetimes` decides when one opens a character literal.
+            quotes: vec![DOUBLE],
+            attributes: Attributes::HashBracket,
+            raw_strings: true,
+            lifetimes: true,
+            ..Default::default()
+        },
+        Language::Shell => Rules {
+            keywords: words(KEYWORDS_SHELL),
+            line_comments: vec!["#"],
+            line_comments_at_word_start: true,
+            quotes: vec![
+                DOUBLE,
+                Quote {
+                    open: "'",
+                    close: "'",
+                    escapes: false,
+                },
+            ],
+            ..Default::default()
+        },
+        Language::Swift => Rules {
+            keywords: words(KEYWORDS_SWIFT),
+            line_comments: vec!["//"],
+            block_comment: Some(NESTING),
+            quotes: vec![TRIPLE_DOUBLE, DOUBLE],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Toml => Rules {
+            keywords: words(KEYWORDS_TOML),
+            line_comments: vec!["#"],
+            quotes: vec![
+                TRIPLE_DOUBLE,
+                Quote {
+                    open: "'''",
+                    close: "'''",
+                    escapes: false,
+                },
+                DOUBLE,
+                Quote {
+                    open: "'",
+                    close: "'",
+                    escapes: false,
+                },
+            ],
+            attributes: Attributes::LineBracket,
+            ..Default::default()
+        },
+        Language::Typescript => Rules {
+            keywords: words(KEYWORDS_TYPESCRIPT),
+            line_comments: vec!["//"],
+            block_comment: Some(C_STYLE),
+            quotes: vec![
+                DOUBLE,
+                SINGLE,
+                Quote {
+                    open: "`",
+                    close: "`",
+                    escapes: true,
+                },
+            ],
+            attributes: Attributes::AtWord,
+            ..Default::default()
+        },
+        Language::Markdown => Rules::default(),
+    }
+}
+
+const KEYWORDS_C: &str =
+    "auto break case char const continue default do double else enum extern float for goto if
+    int long register return short signed sizeof static struct switch typedef union unsigned
+    void volatile while";
+
+const KEYWORDS_CPP: &str =
+    "asm auto bool break case catch char class const const_cast continue default delete do
+    double dynamic_cast else enum explicit export extern false float for friend goto if inline
+    int long mutable namespace new operator private protected public register reinterpret_cast
+    return short signed sizeof static static_cast struct switch template this throw true try
+    typedef typeid typename union unsigned using virtual void volatile wchar_t while";
+
+const KEYWORDS_CSHARP: &str =
+    "abstract as base bool break byte case catch char checked class const continue decimal
+    default delegate do double else enum event explicit extern false finally fixed float for
+    foreach goto if implicit in int interface internal is lock long namespace new null object
+    operator out override params private protected public readonly ref return sbyte sealed short
+    sizeof stackalloc static string struct switch this throw true try typeof uint ulong unchecked
+    unsafe ushort using virtual void volatile while";
+
+const KEYWORDS_COFFEESCRIPT: &str =
+    "Infinity NaN and arguments await break by case catch class continue debugger delete defer
+    default do else export extends false finally for function if import in instanceof is isnt
+    let loop new no not null of on or package return super switch this throw true try typeof
+    unless undefined var wait when with yield";
+
+const KEYWORDS_DART: &str =
+    "abstract as assert async await base break case catch class const continue covariant
+    default deferred do dynamic else enum export extends external factory false final finally
+    for get if implements import in interface is late library mixin new null on operator part
+    required rethrow return sealed set show static super switch this throw true try var void
+    when with while yield";
+
+const KEYWORDS_FISH: &str =
+    "and begin break builtin case command continue else end exec for function if in not or
+    return switch while set echo test string math read source";
+
+const KEYWORDS_GO: &str =
+    "break case chan const continue default defer else fallthrough false for func go goto if
+    import interface map package range return select struct switch true type var";
+
+const KEYWORDS_JAVA: &str =
+    "abstract assert boolean break byte case catch char class const continue default do double
+    else enum extends final finally float for goto if implements import instanceof int interface
+    long native new null package private protected public return short static strictfp super
+    switch synchronized this throw throws transient try void volatile while";
+
+const KEYWORDS_JAVASCRIPT: &str =
+    "async await boolean break case catch class const continue debugger default delete do else
+    enum export extends false finally for function if implements import in instanceof interface
+    let new null package private protected public return super switch this throw true try typeof
+    var void while with yield";
+
+const KEYWORDS_JSON: &str = "true false null";
+
+const KEYWORDS_KOTLIN: &str =
+    "actual abstract annotation as break by catch class companion const constructor continue
+    coroutine crossinline data delegate dynamic do else enum expect external false final finally
+    for fun get if import in infix inline interface internal is lazy lateinit native null object
+    open operator out override package private protected public reified return sealed set super
+    suspend tailrec this throw true try typealias typeof val var vararg when while yield";
+
+const KEYWORDS_PERL: &str =
+    "__DATA__ __END__ __FILE__ __LINE__ __PACKAGE__ and cmp continue do else elsif eq eval for
+    foreach goto gt if last le lt my ne next no not or package redo ref return sub unless until
+    use while xor";
+
+const KEYWORDS_PHP: &str =
+    "__halt_compiler abstract and array as break callable case catch class clone const continue
+    declare default die do echo else elseif empty enddeclare endfor endforeach endif endswitch
+    endwhile eval exit extends final finally fn for foreach function global goto if implements
+    include include_once instanceof insteadof interface isset list match new or print private
+    protected public require require_once return static switch throw trait try unset use var
+    while xor yield";
+
+const KEYWORDS_PYTHON: &str =
+    "False True and as assert async await break class continue def del elif else except finally
+    for from global if import in is lambda nonlocal not or pass raise return try while with
+    yield";
+
+const KEYWORDS_RON: &str = "true false Some None inf NaN";
+
+const KEYWORDS_RUBY: &str =
+    "__ENCODING__ __END__ __FILE__ __LINE__ BEGIN END alias and begin break case class def do
+    else elsif end ensure false for if in module next nil not or redo rescue retry return self
+    super then true undef unless until when while yield";
+
+const KEYWORDS_RUST: &str =
+    "as async await break const continue crate dyn else enum extern false fn for if impl in
+    let loop match mod move mut pub ref return Self self static struct super trait true type
+    union unsafe use where while abstract become box do final macro override priv try typeof
+    unsized virtual yield";
+
+const KEYWORDS_SHELL: &str =
+    "alias bg bind break builtin caller cd command compgen complete compopt continue declare
+    dirs disown echo enable eval exec exit export fc fg getopts hash help history jobs kill let
+    local logout popd printf pushd pwd read readonly return set shift shopt source suspend
+    test";
+
+const KEYWORDS_SWIFT: &str =
+    "_ associatedtype class deinit enum extension fileprivate func import init inout internal
+    let open operator private precedencegroup protocol public rethrows static struct subscript
+    typealias var break case catch continue default defer do else fallthrough for guard if in
+    repeat return throw switch where while Any as await false is nil self Self super throws true
+    try associativity convenience didSet dynamic final get indirect infix lazy left mutating none
+    nonmutating optional override postfix precedence prefix Protocol required right set some Type
+    unowned weak willSet";
+
+const KEYWORDS_TOML: &str = "true false inf nan";
+
+const KEYWORDS_TYPESCRIPT: &str =
+    "abstract as asserts await break case catch class const constructor continue debugger
+    default delete do else enum export extends false finally for from function get if implements
+    import in infer instanceof interface is keyof let module namespace new null number object
+    package private protected public readonly require global return set static string super
+    switch this throw true try type typeof undefined unique unknown var void while with yield";
+
+/// The highlighter's language for a fence's info word, or `None` for one it
+/// has no rules for. Also what `super::file_language` reads for a file's
+/// extension -- one table, so a language added for fences is a language
+/// added for files.
+pub fn fence_language(name: Option<&str>) -> Option<Language> {
+    let name = name?.trim().to_lowercase();
+    FENCE_LANGUAGES
+        .iter()
+        .find(|(alias, _)| *alias == name)
+        .map(|(_, language)| *language)
+}
+
+/// The extension is the part after the *last* dot, which is what makes
+/// `build.gradle.kts` Kotlin. A leading dot is not one: `.bashrc` has no
+/// extension, it has a name that starts with a dot. A name with no dot at
+/// all -- `Makefile` -- is likewise `None`.
+pub fn file_language(name: &str) -> Option<Language> {
+    let dot = name.rfind('.')?;
+    if dot < 1 {
+        return None;
+    }
+    fence_language(Some(&name[dot + 1..]))
+}
+
+const FENCE_LANGUAGES: &[(&str, Language)] = &[
+    ("kotlin", Language::Kotlin),
+    ("kt", Language::Kotlin),
+    ("kts", Language::Kotlin),
+    ("rust", Language::Rust),
+    ("rs", Language::Rust),
+    ("sh", Language::Shell),
+    ("bash", Language::Shell),
+    ("shell", Language::Shell),
+    ("zsh", Language::Shell),
+    ("console", Language::Shell),
+    ("python", Language::Python),
+    ("py", Language::Python),
+    ("javascript", Language::Javascript),
+    ("js", Language::Javascript),
+    ("jsx", Language::Javascript),
+    ("typescript", Language::Typescript),
+    ("ts", Language::Typescript),
+    ("tsx", Language::Typescript),
+    ("java", Language::Java),
+    ("c", Language::C),
+    ("h", Language::C),
+    ("cpp", Language::Cpp),
+    ("c++", Language::Cpp),
+    ("cc", Language::Cpp),
+    ("hpp", Language::Cpp),
+    ("csharp", Language::Csharp),
+    ("cs", Language::Csharp),
+    ("c#", Language::Csharp),
+    ("go", Language::Go),
+    ("golang", Language::Go),
+    ("swift", Language::Swift),
+    ("dart", Language::Dart),
+    ("ruby", Language::Ruby),
+    ("rb", Language::Ruby),
+    ("php", Language::Php),
+    ("perl", Language::Perl),
+    ("pl", Language::Perl),
+    ("coffeescript", Language::Coffeescript),
+    ("coffee", Language::Coffeescript),
+    ("ron", Language::Ron),
+    ("toml", Language::Toml),
+    ("fish", Language::Fish),
+    ("json", Language::Json),
+    ("markdown", Language::Markdown),
+    ("md", Language::Markdown),
+];

app/src/client/highlight/markdown.rs

@@ -0,0 +1,618 @@
+use super::{Kind, Span};
+
+const BULLETS: &str = "-*+";
+const RULE_MARKERS: &str = "-*_=";
+const EMPHASIS: &str = "*_~";
+const URL_STOPS: &str = "<>\"'`|";
+const URL_TRAILING: &str = ".,:;!?";
+
+pub fn scan_markdown(code: &str) -> Vec<Span> {
+    MarkdownScanner::new(code).run()
+}
+
+struct MarkdownScanner {
+    code: Vec<char>,
+    spans: Vec<Span>,
+}
+
+impl MarkdownScanner {
+    fn new(code: &str) -> Self {
+        Self {
+            code: code.chars().collect(),
+            spans: Vec::new(),
+        }
+    }
+
+    fn run(mut self) -> Vec<Span> {
+        let mut at = 0usize;
+        // The delimiter run that opened the fenced block we are inside, or
+        // None between them.
+        let mut fence: Option<Vec<char>> = None;
+        let mut table = false;
+        loop {
+            let end = self.line_end(at);
+            if let Some(open) = fence.clone() {
+                self.emit(at, end, Kind::String);
+                if self.closes_fence(at, end, &open) {
+                    fence = None;
+                }
+            } else {
+                let opened = self.opens_fence(at, end);
+                if opened.is_some() {
+                    table = false;
+                    fence = opened;
+                } else {
+                    table = self.row(at, end, table);
+                }
+            }
+            if end == self.code.len() {
+                break;
+            }
+            at = end + 1;
+        }
+        self.spans
+    }
+
+    fn line_end(&self, at: usize) -> usize {
+        self.code[at..]
+            .iter()
+            .position(|&c| c == '\n')
+            .map(|p| at + p)
+            .unwrap_or(self.code.len())
+    }
+
+    fn row(&mut self, start: usize, end: usize, table: bool) -> bool {
+        if self.table_delimiter(start, end) {
+            let indented = self.indented(start, end);
+            self.emit(indented, end, Kind::Mark);
+            return true;
+        }
+        let header = end < self.code.len() && self.table_delimiter(end + 1, self.line_end(end + 1));
+        if (table || header) && self.has_pipe(start, end) {
+            self.table_row(start, end);
+            return true;
+        }
+        self.structure(start, end);
+        false
+    }
+
+    fn table_delimiter(&self, start: usize, end: usize) -> bool {
+        let mut dashes = false;
+        let mut pipes = false;
+        for c in &self.code[self.indented(start, end)..end] {
+            match c {
+                '-' => dashes = true,
+                '|' => pipes = true,
+                ':' | ' ' | '\t' => {}
+                _ => return false,
+            }
+        }
+        dashes && pipes
+    }
+
+    fn has_pipe(&self, start: usize, end: usize) -> bool {
+        let mut at = start;
+        while at < end {
+            if self.code[at] == '\\' {
+                at += 2;
+            } else if self.code[at] == '|' {
+                return true;
+            } else {
+                at += 1;
+            }
+        }
+        false
+    }
+
+    fn table_row(&mut self, start: usize, end: usize) {
+        let mut at = self.indented(start, end);
+        let mut cell = at;
+        while at < end {
+            match self.code[at] {
+                '\\' => at += 2,
+                '|' => {
+                    self.inline(cell, at);
+                    self.emit(at, at + 1, Kind::Mark);
+                    at += 1;
+                    cell = at;
+                }
+                _ => at += 1,
+            }
+        }
+        self.inline(cell, end);
+    }
+
+    fn emit(&mut self, start: usize, end: usize, kind: Kind) {
+        if end <= start {
+            return;
+        }
+        if let Some(last) = self.spans.last_mut()
+            && last.kind == kind
+            && last.end == start
+        {
+            last.end = end;
+            return;
+        }
+        self.spans.push(Span { start, end, kind });
+    }
+
+    fn indented(&self, start: usize, end: usize) -> usize {
+        let mut at = start;
+        while at < end && (self.code[at] == ' ' || self.code[at] == '\t') {
+            at += 1;
+        }
+        at
+    }
+
+    fn fence_run(&self, start: usize, end: usize) -> Option<(usize, usize)> {
+        let at = self.indented(start, end);
+        if at == end {
+            return None;
+        }
+        let marker = self.code[at];
+        if marker != '`' && marker != '~' {
+            return None;
+        }
+        let mut run = at;
+        while run < end && self.code[run] == marker {
+            run += 1;
+        }
+        if run - at >= 3 { Some((at, run)) } else { None }
+    }
+
+    fn opens_fence(&mut self, start: usize, end: usize) -> Option<Vec<char>> {
+        let (run_start, run_end) = self.fence_run(start, end)?;
+        self.emit(run_start, run_end, Kind::String);
+        let indented = self.indented(run_end, end);
+        self.emit(indented, end, Kind::Metadata);
+        Some(self.code[run_start..run_end].to_vec())
+    }
+
+    fn closes_fence(&self, start: usize, end: usize, open: &[char]) -> bool {
+        let Some((run_start, run_end)) = self.fence_run(start, end) else {
+            return false;
+        };
+        if self.code[run_start] != open[0] || run_end - run_start < open.len() {
+            return false;
+        }
+        self.indented(run_end, end) == end
+    }
+
+    fn structure(&mut self, start: usize, end: usize) {
+        let mut at = start;
+        while at < end && self.code[at] == '>' {
+            at += 1;
+            self.emit(at - 1, at, Kind::Mark);
+            at = self.indented(at, end);
+        }
+        if at == end {
+            return;
+        }
+        if self.heading(at, end) || self.thematic_break(at, end) {
+            return;
+        }
+        let text_start = self.bullet(at, end);
+        self.inline(text_start, end);
+    }
+
+    fn heading(&mut self, start: usize, end: usize) -> bool {
+        let mut at = start;
+        while at < end && self.code[at] == '#' {
+            at += 1;
+        }
+        let depth = at - start;
+        if !(1..=6).contains(&depth) {
+            return false;
+        }
+        if at < end && self.code[at] != ' ' && self.code[at] != '\t' {
+            return false;
+        }
+        self.emit(start, end, Kind::Keyword);
+        true
+    }
+
+    fn thematic_break(&mut self, start: usize, end: usize) -> bool {
+        let marker = self.code[start];
+        if !RULE_MARKERS.contains(marker) {
+            return false;
+        }
+        let mut seen = 0usize;
+        for &c in &self.code[start..end] {
+            if c == marker {
+                seen += 1;
+            } else if !c.is_whitespace() {
+                return false;
+            }
+        }
+        if seen < if marker == '=' { 1 } else { 3 } {
+            return false;
+        }
+        self.emit(start, end, Kind::Mark);
+        true
+    }
+
+    fn bullet(&mut self, start: usize, end: usize) -> usize {
+        let marker = self.code[start];
+        if BULLETS.contains(marker) && self.space_or_end(start + 1, end) {
+            self.emit(start, start + 1, Kind::Mark);
+            return self.indented(start + 1, end);
+        }
+        let mut digits = start;
+        while digits < end && self.code[digits].is_ascii_digit() {
+            digits += 1;
+        }
+        let delimiter = self.code.get(digits).copied();
+        if digits > start
+            && (delimiter == Some('.') || delimiter == Some(')'))
+            && self.space_or_end(digits + 1, end)
+        {
+            self.emit(start, digits + 1, Kind::Mark);
+            return self.indented(digits + 1, end);
+        }
+        start
+    }
+
+    fn space_or_end(&self, at: usize, end: usize) -> bool {
+        at >= end || self.code[at] == ' ' || self.code[at] == '\t'
+    }
+
+    fn inline(&mut self, start: usize, end: usize) {
+        let mut at = start;
+        while at < end {
+            let c = self.code[at];
+            at = if c == '\\' {
+                at + 2
+            } else if c == '`' {
+                self.code_span(at, end)
+            } else if c == '[' {
+                self.link(at, at, end)
+            } else if c == '!' && self.code.get(at + 1) == Some(&'[') {
+                self.link(at, at + 1, end)
+            } else if c == '<' {
+                self.autolink(at, end)
+            } else if EMPHASIS.contains(c) {
+                self.emphasis(at, end)
+            } else {
+                self.url(at, end).unwrap_or(at + 1)
+            };
+        }
+    }
+
+    fn code_span(&mut self, start: usize, end: usize) -> usize {
+        let mut open = start;
+        while open < end && self.code[open] == '`' {
+            open += 1;
+        }
+        let ticks = open - start;
+        let mut at = open;
+        while at < end {
+            if self.code[at] != '`' {
+                at += 1;
+                continue;
+            }
+            let mut close = at;
+            while close < end && self.code[close] == '`' {
+                close += 1;
+            }
+            if close - at == ticks {
+                self.emit(start, close, Kind::String);
+                return close;
+            }
+            at = close;
+        }
+        open
+    }
+
+    fn link(&mut self, start: usize, bracket: usize, end: usize) -> usize {
+        let mut depth = 0i32;
+        let mut close = bracket;
+        while close < end {
+            match self.code[close] {
+                '\\' => close += 1,
+                '[' => depth += 1,
+                ']' => {
+                    depth -= 1;
+                    if depth == 0 {
+                        break;
+                    }
+                }
+                _ => {}
+            }
+            close += 1;
+        }
+        if close >= end {
+            return start + 1;
+        }
+        let destination = close + 1;
+        if self.code.get(destination) != Some(&'(') {
+            return start + 1;
+        }
+        let Some(paren_rel) = self.code[destination..].iter().position(|&c| c == ')') else {
+            return start + 1;
+        };
+        let paren = destination + paren_rel;
+        if paren >= end {
+            return start + 1;
+        }
+        self.emit(start, bracket + 1, Kind::Mark);
+        self.inline(bracket + 1, close);
+        self.emit(close, destination, Kind::Mark);
+        self.emit(destination, paren + 1, Kind::Metadata);
+        paren + 1
+    }
+
+    fn autolink(&mut self, start: usize, end: usize) -> usize {
+        let mut at = start + 1;
+        let mut addressed = false;
+        while at < end {
+            let c = self.code[at];
+            if c.is_whitespace() || c == '<' {
+                return start + 1;
+            }
+            if c == '>' {
+                if !addressed {
+                    return start + 1;
+                }
+                self.emit(start, at + 1, Kind::Metadata);
+                return at + 1;
+            }
+            if c == ':' || c == '@' {
+                addressed = true;
+            }
+            at += 1;
+        }
+        start + 1
+    }
+
+    fn url(&mut self, start: usize, end: usize) -> Option<usize> {
+        if start > 0 && is_word(self.code[start - 1]) {
+            return None;
+        }
+        let mut scheme = start;
+        while scheme < end && self.code[scheme].is_alphabetic() {
+            scheme += 1;
+        }
+        if scheme == start || !starts_with(&self.code, scheme, "://") {
+            return None;
+        }
+        let body = scheme + 3;
+        let mut at = body;
+        let mut openers = 0i32;
+        let mut closers = 0i32;
+        while at < end && !self.code[at].is_whitespace() && !URL_STOPS.contains(self.code[at]) {
+            if self.code[at] == '(' {
+                openers += 1;
+            } else if self.code[at] == ')' {
+                closers += 1;
+            }
+            at += 1;
+        }
+        while at > body {
+            let last = self.code[at - 1];
+            if URL_TRAILING.contains(last) {
+                at -= 1;
+            } else if last == ')' && closers > openers {
+                closers -= 1;
+                at -= 1;
+            } else {
+                break;
+            }
+        }
+        if at == body {
+            return None;
+        }
+        self.emit(start, at, Kind::Metadata);
+        Some(at)
+    }
+
+    fn emphasis(&mut self, start: usize, end: usize) -> usize {
+        let marker = self.code[start];
+        let mut open = start;
+        while open < end && self.code[open] == marker {
+            open += 1;
+        }
+        let length = open - start;
+        if marker == '~' && length != 2 {
+            return open;
+        }
+        if length > 3 {
+            return open;
+        }
+        if open == end || self.code[open].is_whitespace() {
+            return open;
+        }
+        if marker == '_' && start > 0 && is_word(self.code[start - 1]) {
+            return open;
+        }
+        let mut at = open;
+        while at < end {
+            if self.code[at] == '\\' {
+                at += 2;
+                continue;
+            }
+            if self.code[at] != marker {
+                at += 1;
+                continue;
+            }
+            let mut close = at;
+            while close < end && self.code[close] == marker {
+                close += 1;
+            }
+            let finish = at + length;
+            if close - at >= length
+                && !self.code[at - 1].is_whitespace()
+                && !(marker == '_' && finish < end && is_word(self.code[finish]))
+            {
+                self.emit(start, finish, Kind::Literal);
+                return finish;
+            }
+            at = close;
+        }
+        open
+    }
+}
+
+fn is_word(c: char) -> bool {
+    c.is_alphanumeric() || c == '_'
+}
+
+fn starts_with(code: &[char], at: usize, token: &str) -> bool {
+    let token: Vec<char> = token.chars().collect();
+    if at + token.len() > code.len() {
+        return false;
+    }
+    code[at..at + token.len()] == token[..]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{Kind, Language, span_text, spans_of};
+
+    fn spans(code: &str, kind: Kind) -> Vec<String> {
+        let chars: Vec<char> = code.chars().collect();
+        spans_of(code, Language::Markdown)
+            .into_iter()
+            .filter(|s| s.kind == kind)
+            .map(|s| span_text(&chars, &s))
+            .collect()
+    }
+
+    fn assert_spans(code: &str, kind: Kind, expected: &[&str]) {
+        assert_eq!(spans(code, kind), expected.to_vec(), "{kind:?} in: {code}");
+    }
+
+    #[test]
+    fn a_heading_is_coloured_whole_and_a_hash_inside_a_word_is_not_one() {
+        let code = "## Layout\nissue #12 is fixed\n#hashtag";
+        assert_spans(code, Kind::Keyword, &["## Layout"]);
+    }
+
+    #[test]
+    fn seven_hashes_are_not_a_heading() {
+        assert_spans("####### deep", Kind::Keyword, &[]);
+    }
+
+    #[test]
+    fn a_fence_carries_its_language_as_metadata_and_its_body_as_one_string() {
+        let code = "text\n```kotlin\nval x = 1\n```\nmore";
+        assert_spans(code, Kind::Metadata, &["kotlin"]);
+        assert_spans(code, Kind::String, &["```", "val x = 1", "```"]);
+    }
+
+    #[test]
+    fn a_longer_fence_is_not_closed_by_a_shorter_one_and_a_heading_inside_it_is_not_a_heading() {
+        let code = "````\n```\n# not a heading\n````\nafter";
+        assert_spans(code, Kind::Keyword, &[]);
+        assert_spans(
+            code,
+            Kind::String,
+            &["````", "```", "# not a heading", "````"],
+        );
+    }
+
+    #[test]
+    fn an_unclosed_fence_runs_to_the_end_rather_than_panicking() {
+        assert_spans("```\nstill going", Kind::String, &["```", "still going"]);
+    }
+
+    #[test]
+    fn list_markers_and_quote_markers_colour_without_their_text() {
+        let code = "- one\n2. two\n> quoted";
+        assert_spans(code, Kind::Mark, &["-", "2.", ">"]);
+    }
+
+    #[test]
+    fn a_rule_and_a_setext_underline_are_the_same_mark() {
+        assert_spans("Title\n=====\n\n---", Kind::Mark, &["=====", "---"]);
+    }
+
+    #[test]
+    fn emphasis_needs_something_on_both_sides_of_it() {
+        assert_spans(
+            "**bold** and *thin*",
+            Kind::Literal,
+            &["**bold**", "*thin*"],
+        );
+        assert_spans("a * b * c and *p = *q", Kind::Literal, &[]);
+    }
+
+    #[test]
+    fn an_underscore_inside_a_word_emphasises_nothing() {
+        assert_spans("snake_case_name and _real_", Kind::Literal, &["_real_"]);
+    }
+
+    #[test]
+    fn a_code_span_holds_a_backtick_when_opened_with_two() {
+        assert_spans("``a ` b`` and `c`", Kind::String, &["``a ` b``", "`c`"]);
+    }
+
+    #[test]
+    fn an_unclosed_code_span_is_ordinary_text() {
+        assert_spans("a ` b", Kind::String, &[]);
+    }
+
+    #[test]
+    fn a_link_marks_its_brackets_and_colours_its_destination() {
+        let code = "see [the plan](PLAN.md) now";
+        assert_spans(code, Kind::Mark, &["[", "]"]);
+        assert_spans(code, Kind::Metadata, &["(PLAN.md)"]);
+    }
+
+    #[test]
+    fn a_table_is_found_by_its_delimiter_row_and_pipes_elsewhere_are_plain() {
+        let code = "| a | b |\n|---|---|\n| 1 | 2 |\n\nrun a | b in a paragraph";
+        assert_spans(
+            code,
+            Kind::Mark,
+            &["|", "|", "|", "|---|---|", "|", "|", "|"],
+        );
+    }
+
+    #[test]
+    fn a_table_without_outer_pipes_still_colours_and_the_table_ends_with_the_rows() {
+        let code = "a | b\n--- | ---\nnot a row";
+        assert_spans(code, Kind::Mark, &["|", "--- | ---"]);
+    }
+
+    #[test]
+    fn an_autolink_colours_and_an_html_tag_does_not() {
+        let code = "<https://example.com> and <a@b.com> and <div> and <img src=\"http://x\">";
+        assert_spans(
+            code,
+            Kind::Metadata,
+            &["<https://example.com>", "<a@b.com>", "http://x"],
+        );
+    }
+
+    #[test]
+    fn a_bare_url_gives_back_the_sentences_punctuation() {
+        assert_spans(
+            "see https://example.com/a., and ssh://host/x)",
+            Kind::Metadata,
+            &["https://example.com/a", "ssh://host/x"],
+        );
+    }
+
+    #[test]
+    fn a_bracket_a_url_opened_itself_stays_in_it() {
+        assert_spans(
+            "https://en.wikipedia.org/wiki/A_(b) here",
+            Kind::Metadata,
+            &["https://en.wikipedia.org/wiki/A_(b)"],
+        );
+    }
+
+    #[test]
+    fn a_url_inside_a_link_destination_is_not_coloured_twice() {
+        assert_spans(
+            "[x](https://example.com)",
+            Kind::Metadata,
+            &["(https://example.com)"],
+        );
+    }
+
+    #[test]
+    fn a_bracket_with_no_destination_after_it_is_left_plain() {
+        assert_spans("an [aside] here", Kind::Mark, &[]);
+    }
+}

app/src/client/highlight/mod.rs

@@ -0,0 +1,651 @@
+pub mod languages;
+pub mod markdown;
+
+pub use languages::{
+    Attributes, BlockComment, Language, Quote, Rules, fence_language, file_language, rules_for,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Kind {
+    Keyword,
+    String,
+    Literal,
+    Comment,
+    Metadata,
+    Punctuation,
+    Mark,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Span {
+    pub start: usize,
+    pub end: usize,
+    pub kind: Kind,
+}
+
+/// The text a [`Span`] covers, for a caller working in char indices (every
+/// test in this module, and any UI that also holds `code` as `Vec<char>`).
+pub fn span_text(code: &[char], span: &Span) -> String {
+    code[span.start..span.end].iter().collect()
+}
+
+/// The spans `language` colours in `code` -- the one way to ask, whatever
+/// the language turns out to be made of. `None` draws plain.
+pub fn spans_of(code: &str, language: Language) -> Vec<Span> {
+    if language == Language::Markdown {
+        markdown::scan_markdown(code)
+    } else {
+        scan(code, &rules_for(language))
+    }
+}
+
+/// Read `code` into the spans described by `rules`.
+fn scan(code: &str, rules: &Rules) -> Vec<Span> {
+    Scanner::new(code, rules).run()
+}
+
+const PUNCTUATION: &str = ",.:;";
+const MARKS: &str = "()={}<>-+[]|&";
+
+struct Scanner<'a> {
+    code: Vec<char>,
+    rules: &'a Rules,
+    spans: Vec<Span>,
+    at: usize,
+}
+
+impl<'a> Scanner<'a> {
+    fn new(code: &str, rules: &'a Rules) -> Self {
+        Self {
+            code: code.chars().collect(),
+            rules,
+            spans: Vec::new(),
+            at: 0,
+        }
+    }
+
+    fn run(mut self) -> Vec<Span> {
+        while self.at < self.code.len() {
+            let consumed = self.block_comment()
+                || self.line_comment()
+                || self.raw_string()
+                || self.character_or_lifetime()
+                || self.string()
+                || self.attribute()
+                || self.number()
+                || self.word()
+                || self.single_character();
+            if !consumed {
+                self.at += 1;
+            }
+        }
+        self.spans
+    }
+
+    fn emit(&mut self, start: usize, kind: Kind) {
+        if self.at > start {
+            self.spans.push(Span {
+                start,
+                end: self.at,
+                kind,
+            });
+        }
+    }
+
+    fn starts(&self, token: &str) -> bool {
+        starts_with_at(&self.code, self.at, token)
+    }
+
+    fn at_word_start(&self) -> bool {
+        self.at == 0
+            || self.code[self.at - 1].is_whitespace()
+            || ";|&(".contains(self.code[self.at - 1])
+    }
+
+    fn at_line_start(&self) -> bool {
+        let mut back = self.at as isize - 1;
+        while back >= 0 && self.code[back as usize] != '\n' {
+            if !self.code[back as usize].is_whitespace() {
+                return false;
+            }
+            back -= 1;
+        }
+        true
+    }
+
+    fn advance_to_end_of_line(&mut self) {
+        while self.at < self.code.len() && self.code[self.at] != '\n' {
+            self.at += 1;
+        }
+    }
+
+    fn advance_to_matching_bracket(&mut self) {
+        let mut depth = 0i32;
+        while self.at < self.code.len() {
+            match self.code[self.at] {
+                '[' => depth += 1,
+                ']' => depth -= 1,
+                _ => {}
+            }
+            self.at += 1;
+            if depth == 0 {
+                return;
+            }
+        }
+    }
+
+    fn block_comment(&mut self) -> bool {
+        let Some(comment) = self.rules.block_comment else {
+            return false;
+        };
+        if !self.starts(comment.open) {
+            return false;
+        }
+        let start = self.at;
+        self.at += comment.open.chars().count();
+        let mut depth = 1i32;
+        while self.at < self.code.len() && depth > 0 {
+            if self.starts(comment.close) {
+                depth -= 1;
+                self.at += comment.close.chars().count();
+            } else if comment.nests && self.starts(comment.open) {
+                depth += 1;
+                self.at += comment.open.chars().count();
+            } else {
+                self.at += 1;
+            }
+        }
+        self.emit(start, Kind::Comment);
+        true
+    }
+
+    fn line_comment(&mut self) -> bool {
+        if !self.rules.line_comments.iter().any(|c| self.starts(c)) {
+            return false;
+        }
+        if self.rules.line_comments_at_word_start && !self.at_word_start() {
+            return false;
+        }
+        let start = self.at;
+        self.advance_to_end_of_line();
+        self.emit(start, Kind::Comment);
+        true
+    }
+
+    fn raw_string(&mut self) -> bool {
+        if !self.rules.raw_strings {
+            return false;
+        }
+        let mut ahead = self.at;
+        if self.code.get(ahead) == Some(&'b') {
+            ahead += 1;
+        }
+        if self.code.get(ahead) != Some(&'r') {
+            return false;
+        }
+        ahead += 1;
+        let mut hashes = 0usize;
+        while self.code.get(ahead) == Some(&'#') {
+            ahead += 1;
+            hashes += 1;
+        }
+        if self.code.get(ahead) != Some(&'"') {
+            return false;
+        }
+        let start = self.at;
+        let closer: String = std::iter::once('"')
+            .chain(std::iter::repeat_n('#', hashes))
+            .collect();
+        let closer_chars: Vec<char> = closer.chars().collect();
+        let closed = find_from(&self.code, ahead + 1, &closer_chars);
+        self.at = match closed {
+            Some(index) => index + closer_chars.len(),
+            None => self.code.len(),
+        };
+        self.emit(start, Kind::String);
+        true
+    }
+
+    /// See [`Rules::lifetimes`]: an apostrophe that is not a character
+    /// literal opens nothing.
+    fn character_or_lifetime(&mut self) -> bool {
+        if !self.rules.lifetimes || self.code[self.at] != '\'' {
+            return false;
+        }
+        let Some(&next) = self.code.get(self.at + 1) else {
+            return false;
+        };
+        if next == '\\' || self.code.get(self.at + 2) == Some(&'\'') {
+            self.quoted(Quote {
+                open: "'",
+                close: "'",
+                escapes: true,
+            });
+        } else {
+            self.at += 1;
+        }
+        true
+    }
+
+    fn string(&mut self) -> bool {
+        let mut quote: Option<Quote> = None;
+        for candidate in &self.rules.quotes {
+            let current_len = quote.map(|q| q.open.chars().count()).unwrap_or(0);
+            if self.starts(candidate.open) && candidate.open.chars().count() > current_len {
+                quote = Some(*candidate);
+            }
+        }
+        let Some(quote) = quote else {
+            return false;
+        };
+        self.quoted(quote);
+        true
+    }
+
+    fn quoted(&mut self, quote: Quote) {
+        let start = self.at;
+        self.at += quote.open.chars().count();
+        while self.at < self.code.len() {
+            if quote.escapes && self.code[self.at] == '\\' && self.at + 1 < self.code.len() {
+                self.at += 2;
+                continue;
+            }
+            if self.starts(quote.close) {
+                self.at += quote.close.chars().count();
+                break;
+            }
+            self.at += 1;
+        }
+        self.at = self.at.min(self.code.len());
+        self.emit(start, Kind::String);
+    }
+
+    fn attribute(&mut self) -> bool {
+        let start = self.at;
+        match self.rules.attributes {
+            Attributes::None => return false,
+            Attributes::AtWord => {
+                if self.code[self.at] != '@' || !is_word_start(self.code.get(self.at + 1).copied())
+                {
+                    return false;
+                }
+                self.at += 1;
+                while self.at < self.code.len() && is_word_part(self.code[self.at]) {
+                    self.at += 1;
+                }
+            }
+            Attributes::HashBracket => {
+                if self.code[self.at] != '#' {
+                    return false;
+                }
+                let mut ahead = self.at + 1;
+                if self.code.get(ahead) == Some(&'!') {
+                    ahead += 1;
+                }
+                if self.code.get(ahead) != Some(&'[') {
+                    return false;
+                }
+                self.at = ahead;
+                self.advance_to_matching_bracket();
+            }
+            Attributes::HashLine => {
+                if self.code[self.at] != '#' || !self.at_line_start() {
+                    return false;
+                }
+                self.advance_to_end_of_line();
+            }
+            Attributes::LineBracket => {
+                if self.code[self.at] != '[' || !self.at_line_start() {
+                    return false;
+                }
+                self.advance_to_matching_bracket();
+            }
+        }
+        self.emit(start, Kind::Metadata);
+        true
+    }
+
+    fn number(&mut self) -> bool {
+        if !self.code[self.at].is_ascii_digit() {
+            return false;
+        }
+        let start = self.at;
+        while self.at < self.code.len() {
+            let c = self.code[self.at];
+            if c.is_alphanumeric() || c == '_' || c == '.' {
+                self.at += 1;
+            } else {
+                break;
+            }
+        }
+        self.emit(start, Kind::Literal);
+        true
+    }
+
+    fn word(&mut self) -> bool {
+        if !is_word_start(Some(self.code[self.at])) {
+            return false;
+        }
+        let start = self.at;
+        while self.at < self.code.len() && is_word_part(self.code[self.at]) {
+            self.at += 1;
+        }
+        let word: String = self.code[start..self.at].iter().collect();
+        if self.rules.keywords.contains(word.as_str()) {
+            self.emit(start, Kind::Keyword);
+        }
+        true
+    }
+
+    fn single_character(&mut self) -> bool {
+        let kind = if PUNCTUATION.contains(self.code[self.at]) {
+            Kind::Punctuation
+        } else if MARKS.contains(self.code[self.at]) {
+            Kind::Mark
+        } else {
+            return false;
+        };
+        self.at += 1;
+        self.emit(self.at - 1, kind);
+        true
+    }
+}
+
+fn is_word_start(c: Option<char>) -> bool {
+    matches!(c, Some(c) if c.is_alphabetic() || c == '_')
+}
+
+fn is_word_part(c: char) -> bool {
+    c.is_alphanumeric() || c == '_'
+}
+
+fn starts_with_at(code: &[char], at: usize, token: &str) -> bool {
+    let token: Vec<char> = token.chars().collect();
+    if at + token.len() > code.len() {
+        return false;
+    }
+    code[at..at + token.len()] == token[..]
+}
+
+fn find_from(code: &[char], from: usize, needle: &[char]) -> Option<usize> {
+    if needle.is_empty() || from > code.len() {
+        return None;
+    }
+    (from..=code.len().saturating_sub(needle.len())).find(|&i| code[i..i + needle.len()] == *needle)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn spans(code: &str, language: Language, kind: Kind) -> Vec<String> {
+        let chars: Vec<char> = code.chars().collect();
+        spans_of(code, language)
+            .into_iter()
+            .filter(|s| s.kind == kind)
+            .map(|s| span_text(&chars, &s))
+            .collect()
+    }
+
+    fn assert_spans(code: &str, language: Language, kind: Kind, expected: &[&str]) {
+        assert_eq!(
+            spans(code, language, kind),
+            expected.to_vec(),
+            "{kind:?} in: {code}"
+        );
+    }
+
+    #[test]
+    fn a_quoted_glob_is_one_string_not_a_comment() {
+        assert_spans("x '*/a/*'", Language::Shell, Kind::String, &["'*/a/*'"]);
+        assert_spans("x '*/a/*'", Language::Shell, Kind::Comment, &[]);
+    }
+
+    #[test]
+    fn a_find_with_globs_has_no_comment_in_it() {
+        let code = "find . -path '*/.git/*' -prune -o -name '*.kt' -print";
+        assert_spans(
+            code,
+            Language::Shell,
+            Kind::String,
+            &["'*/.git/*'", "'*.kt'"],
+        );
+        assert_spans(code, Language::Shell, Kind::Comment, &[]);
+    }
+
+    #[test]
+    fn a_url_does_not_comment_out_the_rest_of_a_shell_line() {
+        let code = "curl https://example.com/x && echo done";
+        assert_spans(code, Language::Shell, Kind::Comment, &[]);
+        assert_spans(code, Language::Shell, Kind::Keyword, &["echo"]);
+    }
+
+    #[test]
+    fn a_url_inside_a_kotlin_string_stays_a_string() {
+        let code = "val url = \"https://example.com\"\nfun f() = 1";
+        assert_spans(code, Language::Kotlin, Kind::Comment, &[]);
+        assert_spans(
+            code,
+            Language::Kotlin,
+            Kind::String,
+            &["\"https://example.com\""],
+        );
+        assert_spans(code, Language::Kotlin, Kind::Keyword, &["val", "fun"]);
+    }
+
+    #[test]
+    fn a_rust_attribute_is_metadata_and_the_struct_after_it_still_colours() {
+        let code = "#[derive(Debug)]\nstruct A { b: u8 }";
+        assert_spans(code, Language::Rust, Kind::Metadata, &["#[derive(Debug)]"]);
+        assert_spans(code, Language::Rust, Kind::Comment, &[]);
+        assert_spans(code, Language::Rust, Kind::Keyword, &["struct"]);
+    }
+
+    #[test]
+    fn an_inner_rust_attribute_closes_at_its_own_bracket() {
+        let code = "#![allow(dead_code)]\nfn f() {}";
+        assert_spans(
+            code,
+            Language::Rust,
+            Kind::Metadata,
+            &["#![allow(dead_code)]"],
+        );
+        assert_spans(code, Language::Rust, Kind::Keyword, &["fn"]);
+    }
+
+    #[test]
+    fn a_c_preprocessor_line_is_metadata_rather_than_a_comment() {
+        let code = "#include <stdio.h>\nint main() { return 0; }";
+        assert_spans(code, Language::C, Kind::Metadata, &["#include <stdio.h>"]);
+        assert_spans(code, Language::C, Kind::Comment, &[]);
+        assert_spans(code, Language::C, Kind::Keyword, &["int", "return"]);
+    }
+
+    #[test]
+    fn a_kotlin_annotation_is_metadata() {
+        assert_spans(
+            "@Composable fun f() {}",
+            Language::Kotlin,
+            Kind::Metadata,
+            &["@Composable"],
+        );
+    }
+
+    #[test]
+    fn a_hash_inside_a_kotlin_string_is_not_a_comment() {
+        let code = "val c = \"#FF0000\"\nval d = 1";
+        assert_spans(code, Language::Kotlin, Kind::Comment, &[]);
+        assert_spans(code, Language::Kotlin, Kind::String, &["\"#FF0000\""]);
+    }
+
+    #[test]
+    fn an_apostrophe_inside_a_kotlin_string_does_not_open_one() {
+        let code = "val a = \"don't\"\nval b = \"x\"";
+        assert_spans(
+            code,
+            Language::Kotlin,
+            Kind::String,
+            &["\"don't\"", "\"x\""],
+        );
+    }
+
+    #[test]
+    fn a_rust_lifetime_does_not_open_a_string_but_a_character_literal_does() {
+        let code = "fn f<'a>(x: &'a str) { let c = 'x'; }";
+        assert_spans(code, Language::Rust, Kind::String, &["'x'"]);
+    }
+
+    #[test]
+    fn an_escaped_quote_is_inside_the_rust_character_literal() {
+        assert_spans("let c = '\\'';", Language::Rust, Kind::String, &["'\\''"]);
+    }
+
+    #[test]
+    fn a_rust_raw_string_keeps_its_inner_quotes() {
+        let code = "let s = r#\"a \"quoted\" b\"#;";
+        assert_spans(
+            code,
+            Language::Rust,
+            Kind::String,
+            &["r#\"a \"quoted\" b\"#"],
+        );
+    }
+
+    #[test]
+    fn a_kotlin_triple_quoted_string_is_one_string() {
+        assert_spans(
+            "val s = \"\"\"a \"b\" c\"\"\"",
+            Language::Kotlin,
+            Kind::String,
+            &["\"\"\"a \"b\" c\"\"\""],
+        );
+    }
+
+    #[test]
+    fn a_shell_single_quoted_string_takes_no_escapes() {
+        assert_spans("echo 'a\\' b", Language::Shell, Kind::String, &["'a\\'"]);
+    }
+
+    #[test]
+    fn rust_and_kotlin_nest_block_comments() {
+        let code = "/* a /* b */ c */ x";
+        assert_spans(code, Language::Rust, Kind::Comment, &["/* a /* b */ c */"]);
+        assert_spans(
+            code,
+            Language::Kotlin,
+            Kind::Comment,
+            &["/* a /* b */ c */"],
+        );
+    }
+
+    #[test]
+    fn c_ends_a_block_comment_at_the_first_close() {
+        assert_spans(
+            "/* a /* b */ c */ x",
+            Language::C,
+            Kind::Comment,
+            &["/* a /* b */"],
+        );
+    }
+
+    #[test]
+    fn a_shell_comment_starts_only_at_a_word_boundary() {
+        let code = "${#x} $# a#b # real";
+        assert_spans(code, Language::Shell, Kind::Comment, &["# real"]);
+    }
+
+    #[test]
+    fn a_hash_anywhere_is_a_python_comment() {
+        assert_spans("x = 1 # note", Language::Python, Kind::Comment, &["# note"]);
+    }
+
+    #[test]
+    fn a_toml_table_header_is_metadata_and_a_hash_in_a_value_is_not_a_comment() {
+        let code = "[server]\ncolour = \"#FF0000\"\nport = 8080 # the real one";
+        assert_spans(code, Language::Toml, Kind::Metadata, &["[server]"]);
+        assert_spans(code, Language::Toml, Kind::String, &["\"#FF0000\""]);
+        assert_spans(code, Language::Toml, Kind::Comment, &["# the real one"]);
+        assert_spans(code, Language::Toml, Kind::Literal, &["8080"]);
+    }
+
+    #[test]
+    fn a_ron_attribute_and_its_values_colour() {
+        let code = "#![enable(implicit_some)]\n(count: 3, on: true)";
+        assert_spans(
+            code,
+            Language::Ron,
+            Kind::Metadata,
+            &["#![enable(implicit_some)]"],
+        );
+        assert_spans(code, Language::Ron, Kind::Keyword, &["true"]);
+        assert_spans(code, Language::Ron, Kind::Literal, &["3"]);
+    }
+
+    #[test]
+    fn an_unknown_fence_language_is_none() {
+        assert_eq!(fence_language(Some("brainfuck")), None);
+    }
+
+    #[test]
+    fn every_language_the_fence_table_knows_has_a_scanner() {
+        for language in Language::ALL {
+            spans_of("x", language);
+        }
+    }
+
+    #[test]
+    fn spans_stay_inside_the_code_for_every_language_and_every_nasty_input() {
+        let nasty = [
+            "",
+            "'",
+            "\"",
+            "\"unterminated",
+            "/* unterminated",
+            "###",
+            "#",
+            "#![",
+            "[",
+            "r#\"",
+            "\\",
+            "'''",
+            "\"\"\"",
+            "0x",
+            "1.2.3",
+            "a#b//c/*d*/'e\"f",
+            "```",
+            "*",
+            "**",
+            "~~",
+            "> ",
+            "- ",
+            "1.",
+            "[x](",
+            "#######",
+            "|",
+            "|---|",
+            "<",
+            "<>",
+            "http://",
+            "a://",
+            "\n\n   \n",
+        ];
+        for language in Language::ALL {
+            for code in nasty {
+                let chars: Vec<char> = code.chars().collect();
+                let spans = spans_of(code, language);
+                for s in &spans {
+                    assert!(
+                        s.start <= s.end && s.end <= chars.len(),
+                        "{language:?} answered {s:?} for {code:?}"
+                    );
+                }
+                let mut sorted = spans.clone();
+                sorted.sort_by_key(|s| s.start);
+                assert_eq!(
+                    spans, sorted,
+                    "{language:?} answered spans out of order for {code:?}"
+                );
+            }
+        }
+    }
+}

app/src/client/log_ring.rs

@@ -0,0 +1,637 @@
+use std::collections::VecDeque;
+use std::sync::{Arc, Mutex, OnceLock};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Both bounds apply -- whichever bites first -- because the two failure
+/// modes are different: a flood of short lines exhausts the count, and one
+/// pathological line (a stack trace, a pretty-printed JSON body) exhausts
+/// the bytes. A ring bounded only by lines can hold megabytes; one bounded
+/// only by bytes can be emptied by a single line.
+pub const DEFAULT_MAX_LINES: usize = 2000;
+pub const DEFAULT_MAX_BYTES: usize = 256 * 1024;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LogLine {
+    pub seq: u64,
+    /// Milliseconds since the unix epoch, from the app's own clock. The
+    /// app's rather than the receiver's: a line is timestamped when it
+    /// happened, and an upload can be minutes later or never.
+    pub at_ms: u64,
+    pub level: log::Level,
+    pub target: String,
+    pub message: String,
+}
+
+impl LogLine {
+    fn weight(&self) -> usize {
+        self.target.len() + self.message.len() + 32
+    }
+
+    /// `12:34:56.789 INFO  iris::android: the message`, the shape a
+    /// person skims. Time of day only -- the date is in the report's own
+    /// header, and a ring never spans one.
+    pub fn format(&self) -> String {
+        format!(
+            "{} {:<5} {}: {}",
+            clock_time(self.at_ms),
+            self.level,
+            self.target,
+            self.message
+        )
+    }
+}
+
+fn clock_time(at_ms: u64) -> String {
+    let ms = at_ms % 1000;
+    let secs_of_day = (at_ms / 1000) % 86_400;
+    format!(
+        "{:02}:{:02}:{:02}.{:03}",
+        secs_of_day / 3600,
+        (secs_of_day % 3600) / 60,
+        secs_of_day % 60,
+        ms
+    )
+}
+
+/// Now, in unix milliseconds. Saturating rather than panicking on a clock
+/// before the epoch: a wrong timestamp in a diagnostic is not worth taking
+/// the app down for.
+pub fn now_ms() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_millis() as u64)
+        .unwrap_or(0)
+}
+
+#[derive(Debug)]
+struct Inner {
+    lines: VecDeque<LogLine>,
+    bytes: usize,
+    max_lines: usize,
+    max_bytes: usize,
+    next_seq: u64,
+    dropped: u64,
+}
+
+#[derive(Debug, Clone)]
+pub struct LogRing(Arc<Mutex<Inner>>);
+
+impl LogRing {
+    pub fn new(max_lines: usize, max_bytes: usize) -> Self {
+        assert!(
+            max_lines > 0 && max_bytes > 0,
+            "a ring with no room holds nothing"
+        );
+        Self(Arc::new(Mutex::new(Inner {
+            lines: VecDeque::new(),
+            bytes: 0,
+            max_lines,
+            max_bytes,
+            next_seq: 0,
+            dropped: 0,
+        })))
+    }
+
+    pub fn with_defaults() -> Self {
+        Self::new(DEFAULT_MAX_LINES, DEFAULT_MAX_BYTES)
+    }
+
+    /// A poisoned lock is a bug in a panicking logger, not a reason to
+    /// take the app down a second time -- the ring is a diagnostic, and
+    /// losing it must not be worse than the fault it was recording.
+    fn with<R>(&self, f: impl FnOnce(&mut Inner) -> R) -> R {
+        let mut guard = match self.0.lock() {
+            Ok(guard) => guard,
+            Err(poisoned) => poisoned.into_inner(),
+        };
+        f(&mut guard)
+    }
+
+    pub fn push(&self, level: log::Level, target: &str, message: String) {
+        self.with(|inner| {
+            let line = LogLine {
+                seq: inner.next_seq,
+                at_ms: now_ms(),
+                level,
+                target: target.to_string(),
+                message,
+            };
+            inner.next_seq += 1;
+            inner.bytes += line.weight();
+            inner.lines.push_back(line);
+            // `!is_empty()` rather than `len() > 1`: one line larger than
+            // the whole byte bound is kept, because dropping it would
+            // leave the ring silently empty while lines were arriving.
+            while inner.lines.len() > inner.max_lines
+                || (inner.bytes > inner.max_bytes && inner.lines.len() > 1)
+            {
+                if let Some(evicted) = inner.lines.pop_front() {
+                    inner.bytes -= evicted.weight();
+                    inner.dropped += 1;
+                }
+            }
+        })
+    }
+
+    pub fn snapshot(&self) -> Vec<LogLine> {
+        self.with(|inner| inner.lines.iter().cloned().collect())
+    }
+
+    pub fn since(&self, seq: u64) -> (Vec<LogLine>, u64) {
+        self.with(|inner| {
+            let lines: Vec<LogLine> = inner
+                .lines
+                .iter()
+                .filter(|line| line.seq >= seq)
+                .cloned()
+                .collect();
+            let next = lines.last().map(|line| line.seq + 1).unwrap_or(seq);
+            (lines, next)
+        })
+    }
+
+    pub fn len(&self) -> usize {
+        self.with(|inner| inner.lines.len())
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    pub fn dropped(&self) -> u64 {
+        self.with(|inner| inner.dropped)
+    }
+
+    /// The sequence number of the newest line held, or `None` for a ring
+    /// nothing has been written to.
+    ///
+    /// What a reader needs to notice that this process **restarted**: the
+    /// ring is in memory, so a new process starts again at zero, and a
+    /// reader holding a cursor from the previous one would otherwise ask
+    /// for lines after a number nothing will reach for hours and see
+    /// nothing at all -- silently, which is worse than seeing the log
+    /// begin again. Answering `None` rather than 0 for an empty ring is
+    /// the same distinction [`Self::summary`] draws: "nothing has been
+    /// logged" is not a sequence number.
+    pub fn newest_seq(&self) -> Option<u64> {
+        self.with(|inner| inner.lines.back().map(|line| line.seq))
+    }
+
+    /// When the newest line was written, in unix milliseconds, or `None`
+    /// for a ring nothing has been written to.
+    pub fn last_at_ms(&self) -> Option<u64> {
+        self.with(|inner| inner.lines.back().map(|line| line.at_ms))
+    }
+
+    pub fn to_text(&self) -> String {
+        self.snapshot()
+            .iter()
+            .map(LogLine::format)
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+
+    /// The newest `max_lines` lines, formatted, or `None` if the ring is
+    /// locked at this instant.
+    ///
+    /// For the one caller that must not block: **the panic hook**. A panic
+    /// raised while this ring's own lock was held -- an allocation failing
+    /// inside [`Self::push`], an assertion in a `log::Log` on the way here
+    /// -- would deadlock the hook against the thread that is panicking,
+    /// and the process would hang instead of aborting, with nothing
+    /// written anywhere. Losing the context lines is the right trade
+    /// against that, and `None` says which happened rather than looking
+    /// like an empty log.
+    pub fn try_tail_text(&self, max_lines: usize) -> Option<String> {
+        let guard = match self.0.try_lock() {
+            Ok(guard) => guard,
+            Err(std::sync::TryLockError::Poisoned(poisoned)) => poisoned.into_inner(),
+            Err(std::sync::TryLockError::WouldBlock) => return None,
+        };
+        let lines = &guard.lines;
+        let from = lines.len().saturating_sub(max_lines);
+        Some(
+            lines
+                .iter()
+                .skip(from)
+                .map(LogLine::format)
+                .collect::<Vec<_>>()
+                .join("\n"),
+        )
+    }
+
+    /// One line for a diagnostics pane: how much is held, how much was
+    /// dropped, and when the last line arrived. "no lines yet" is its own
+    /// wording rather than a count of zero with a made-up time, because
+    /// "nothing has been logged" and "logging is not running" would
+    /// otherwise look the same.
+    pub fn summary(&self) -> String {
+        let (len, dropped, last) = self.with(|inner| {
+            (
+                inner.lines.len(),
+                inner.dropped,
+                inner.lines.back().map(|line| line.at_ms),
+            )
+        });
+        match last {
+            None => "app log: no lines yet".to_string(),
+            Some(at) => {
+                let dropped = if dropped > 0 {
+                    format!(", {dropped} dropped")
+                } else {
+                    String::new()
+                };
+                format!(
+                    "app log: {len} lines held{dropped}, last {}",
+                    clock_time(at)
+                )
+            }
+        }
+    }
+}
+
+/// Whether a target belongs to this app or to `iris` rather than to a
+/// dependency -- `starts_with` guarded by an
+/// exact match or a `::` so an unrelated crate that merely begins with the
+/// same letters (there is no such crate today, but the check should not
+/// rely on that) is never mistaken for one of ours.
+fn is_own_target(target: &str) -> bool {
+    target == "iris"
+        || target.starts_with("iris::")
+        || target == "ai_app"
+        || target.starts_with("ai_app::")
+}
+
+/// This is the one filter docs/IRIS_TODO.md's "logs way too big" entry
+/// asked for, applied once here rather than at each `debug!` call site:
+/// Info and above always ring, from anything, because a real warning or
+/// error from a dependency is worth keeping. Debug and Trace ring only
+/// from this app's own targets, and only while tracing is switched on --
+/// otherwise `naga::front`/`wgpu_core`/`jni` log at Debug unconditionally
+/// (the process logger's own level, set once at install and unrelated to
+/// tracing), which is what filled the ring with 1339 lines of it and
+/// dropped 4050 more before this existed. `iris`'s own Debug lines already
+/// self-gate on `iris::diagnostics::trace_enabled` at their call sites
+/// (commit 992c472); this is the backstop for lines this crate does not
+/// control.
+fn ring_accepts(level: log::Level, target: &str, trace_enabled: bool) -> bool {
+    level <= log::Level::Info || (trace_enabled && is_own_target(target))
+}
+
+pub struct RingLogger {
+    ring: LogRing,
+    inner: Box<dyn log::Log>,
+    trace_enabled: fn() -> bool,
+}
+
+impl RingLogger {
+    pub fn new(ring: LogRing, inner: Box<dyn log::Log>, trace_enabled: fn() -> bool) -> Self {
+        Self {
+            ring,
+            inner,
+            trace_enabled,
+        }
+    }
+}
+
+impl log::Log for RingLogger {
+    fn enabled(&self, _metadata: &log::Metadata) -> bool {
+        true
+    }
+
+    fn log(&self, record: &log::Record) {
+        if ring_accepts(record.level(), record.target(), (self.trace_enabled)()) {
+            self.ring
+                .push(record.level(), record.target(), record.args().to_string());
+        }
+        if self.inner.enabled(record.metadata()) {
+            self.inner.log(record);
+        }
+    }
+
+    fn flush(&self) {
+        self.inner.flush();
+    }
+}
+
+/// Fails only if a logger is already installed, which is a programmer
+/// error (two initialisation paths) rather than a recoverable condition --
+/// the caller is named in the error so it is findable.
+pub fn install(
+    ring: LogRing,
+    inner: Box<dyn log::Log>,
+    max_level: log::LevelFilter,
+    trace_enabled: fn() -> bool,
+) -> Result<(), log::SetLoggerError> {
+    log::set_boxed_logger(Box::new(RingLogger::new(ring, inner, trace_enabled)))?;
+    log::set_max_level(max_level);
+    Ok(())
+}
+
+/// **A deliberate process-global, where this project's rules otherwise say
+/// pass context explicitly.** What is being modelled is already one: `log`
+/// has exactly one backend per process, set once, and every `log::info!`
+/// anywhere in the binary goes to it. A ring handed around as a parameter
+/// would be a *second* answer to "which lines exist" -- the report would
+/// show one ring while the logger filled another, and which one a caller
+/// got would depend on how far down the call tree it was. The tests above
+/// all use their own [`LogRing`], so nothing here needs this to be
+/// testable.
+static PROCESS_RING: OnceLock<LogRing> = OnceLock::new();
+
+pub fn process_ring() -> &'static LogRing {
+    PROCESS_RING.get_or_init(LogRing::with_defaults)
+}
+
+pub fn install_process_logger(
+    inner: Box<dyn log::Log>,
+    max_level: log::LevelFilter,
+    trace_enabled: fn() -> bool,
+) -> Result<(), log::SetLoggerError> {
+    install(process_ring().clone(), inner, max_level, trace_enabled)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use log::Level;
+
+    fn fill(ring: &LogRing, count: usize) {
+        for n in 0..count {
+            ring.push(Level::Info, "test", format!("line {n}"));
+        }
+    }
+
+    #[test]
+    fn lines_come_back_oldest_first() {
+        let ring = LogRing::new(10, 1 << 20);
+        fill(&ring, 3);
+        let text: Vec<String> = ring.snapshot().into_iter().map(|l| l.message).collect();
+        assert_eq!(text, ["line 0", "line 1", "line 2"]);
+    }
+
+    #[test]
+    fn the_line_bound_drops_the_oldest_and_says_how_many() {
+        let ring = LogRing::new(3, 1 << 20);
+        fill(&ring, 5);
+        let text: Vec<String> = ring.snapshot().into_iter().map(|l| l.message).collect();
+        assert_eq!(text, ["line 2", "line 3", "line 4"], "the newest survive");
+        assert_eq!(ring.len(), 3);
+        assert_eq!(ring.dropped(), 2, "and the loss is reported, not silent");
+    }
+
+    #[test]
+    fn the_byte_bound_bites_before_the_line_bound_when_lines_are_large() {
+        let ring = LogRing::new(1000, 300);
+        for n in 0..10 {
+            ring.push(Level::Info, "t", format!("{n}{}", "x".repeat(100)));
+        }
+        assert!(
+            ring.len() < 10,
+            "the byte bound evicted: {} held",
+            ring.len()
+        );
+        assert!(ring.dropped() > 0);
+        assert!(
+            ring.snapshot().last().unwrap().message.starts_with('9'),
+            "and it evicted from the old end"
+        );
+    }
+
+    #[test]
+    fn one_oversized_line_is_kept_rather_than_leaving_the_ring_empty() {
+        let ring = LogRing::new(100, 64);
+        ring.push(Level::Error, "t", "y".repeat(5000));
+        assert_eq!(ring.len(), 1);
+        assert_eq!(ring.dropped(), 0);
+    }
+
+    #[test]
+    fn sequence_numbers_only_increase_and_survive_eviction() {
+        let ring = LogRing::new(2, 1 << 20);
+        fill(&ring, 5);
+        let seqs: Vec<u64> = ring.snapshot().into_iter().map(|l| l.seq).collect();
+        assert_eq!(seqs, [3, 4], "a gap is exactly what was dropped");
+    }
+
+    #[test]
+    fn since_returns_only_what_is_new_and_the_next_cursor() {
+        let ring = LogRing::new(100, 1 << 20);
+        fill(&ring, 3);
+        let (first, cursor) = ring.since(0);
+        assert_eq!(first.len(), 3);
+        assert_eq!(cursor, 3);
+
+        let (none, cursor) = ring.since(cursor);
+        assert!(none.is_empty(), "nothing new yet");
+        assert_eq!(cursor, 3, "and the cursor does not move");
+
+        ring.push(Level::Warn, "test", "later".into());
+        let (more, cursor) = ring.since(cursor);
+        assert_eq!(more.len(), 1);
+        assert_eq!(more[0].message, "later");
+        assert_eq!(cursor, 4);
+    }
+
+    #[test]
+    fn the_newest_sequence_says_where_the_ring_is_and_nothing_for_an_empty_one() {
+        let ring = LogRing::new(100, 1 << 20);
+        assert_eq!(ring.newest_seq(), None, "an empty ring has no newest line");
+        fill(&ring, 5);
+        assert_eq!(ring.newest_seq(), Some(4));
+
+        let restarted = LogRing::new(100, 1 << 20);
+        fill(&restarted, 1);
+        assert_eq!(
+            restarted.newest_seq(),
+            Some(0),
+            "a fresh ring starts again, which is exactly what a reader has to notice"
+        );
+    }
+
+    #[test]
+    fn reading_does_not_consume() {
+        let ring = LogRing::new(100, 1 << 20);
+        fill(&ring, 2);
+        let (sent, _) = ring.since(0);
+        assert_eq!(sent.len(), 2);
+        assert_eq!(ring.len(), 2, "the report still has them after an upload");
+        assert_eq!(ring.to_text().lines().count(), 2);
+    }
+
+    #[test]
+    fn try_tail_text_gives_the_newest_lines_with_no_header() {
+        let ring = LogRing::new(1000, 1 << 20);
+        fill(&ring, 200);
+        let tail = ring.try_tail_text(80).expect("nothing holds the lock");
+        let lines: Vec<&str> = tail.lines().collect();
+        assert_eq!(lines.len(), 80, "the cap, and no header: this is a file");
+        assert!(lines[0].ends_with("line 120"), "{}", lines[0]);
+        assert!(lines[79].ends_with("line 199"), "{}", lines[79]);
+    }
+
+    #[test]
+    fn try_tail_text_answers_none_rather_than_blocking_on_a_held_lock() {
+        let ring = LogRing::new(10, 1 << 20);
+        fill(&ring, 3);
+        let held = ring.0.lock().expect("fresh ring");
+        assert_eq!(ring.try_tail_text(80), None);
+        drop(held);
+        assert!(ring.try_tail_text(80).is_some());
+    }
+
+    #[test]
+    fn an_empty_ring_says_so_rather_than_reporting_a_time() {
+        let ring = LogRing::with_defaults();
+        assert_eq!(ring.summary(), "app log: no lines yet");
+        assert_eq!(ring.last_at_ms(), None);
+        assert!(ring.is_empty());
+    }
+
+    #[test]
+    fn the_summary_names_dropped_lines_only_when_there_are_some() {
+        let ring = LogRing::new(2, 1 << 20);
+        fill(&ring, 2);
+        assert!(!ring.summary().contains("dropped"), "{}", ring.summary());
+        fill(&ring, 2);
+        assert!(ring.summary().contains("2 dropped"), "{}", ring.summary());
+    }
+
+    #[test]
+    fn a_line_formats_as_time_level_target_message() {
+        let line = LogLine {
+            seq: 0,
+            at_ms: (12 * 3600 + 34 * 60 + 56) * 1000 + 789,
+            level: Level::Info,
+            target: "iris::android".into(),
+            message: "surface created".into(),
+        }
+        .format();
+        assert_eq!(line, "12:34:56.789 INFO  iris::android: surface created");
+    }
+
+    #[test]
+    fn the_ring_logger_forwards_to_the_inner_logger() {
+        use log::Log;
+        struct Collect(Arc<Mutex<Vec<String>>>, log::Level);
+        impl Log for Collect {
+            fn enabled(&self, metadata: &log::Metadata) -> bool {
+                metadata.level() <= self.1
+            }
+            fn log(&self, record: &log::Record) {
+                self.0.lock().unwrap().push(record.args().to_string());
+            }
+            fn flush(&self) {}
+        }
+
+        let seen = Arc::new(Mutex::new(Vec::new()));
+        let ring = LogRing::with_defaults();
+        let logger = RingLogger::new(
+            ring.clone(),
+            Box::new(Collect(seen.clone(), Level::Info)),
+            || true,
+        );
+        logger.log(
+            &log::Record::builder()
+                .args(format_args!("kept"))
+                .level(Level::Info)
+                .target("iris::test")
+                .build(),
+        );
+        logger.log(
+            &log::Record::builder()
+                .args(format_args!("filtered"))
+                .level(Level::Debug)
+                .target("iris::test")
+                .build(),
+        );
+
+        assert_eq!(
+            *seen.lock().unwrap(),
+            ["kept"],
+            "the inner logger's own filter still applies"
+        );
+        let held: Vec<String> = ring.snapshot().into_iter().map(|l| l.message).collect();
+        assert_eq!(
+            held,
+            ["kept", "filtered"],
+            "own-target debug still rings while tracing is on"
+        );
+    }
+
+    #[test]
+    fn a_foreign_targets_debug_line_never_rings_even_while_tracing_is_on() {
+        use log::Log;
+        struct Discard;
+        impl Log for Discard {
+            fn enabled(&self, _: &log::Metadata) -> bool {
+                true
+            }
+            fn log(&self, _: &log::Record) {}
+            fn flush(&self) {}
+        }
+
+        let ring = LogRing::with_defaults();
+        let logger = RingLogger::new(ring.clone(), Box::new(Discard), || true);
+        logger.log(
+            &log::Record::builder()
+                .args(format_args!("naga debug spam"))
+                .level(Level::Debug)
+                .target("naga::front")
+                .build(),
+        );
+        logger.log(
+            &log::Record::builder()
+                .args(format_args!("naga warning"))
+                .level(Level::Warn)
+                .target("wgpu_core::device")
+                .build(),
+        );
+
+        let held: Vec<String> = ring.snapshot().into_iter().map(|l| l.message).collect();
+        assert_eq!(
+            held,
+            ["naga warning"],
+            "Info-and-above always rings; foreign Debug never does"
+        );
+    }
+
+    #[test]
+    fn ring_accepts_is_own_target_debug_only_while_tracing() {
+        assert!(
+            ring_accepts(Level::Info, "wgpu_core::device", false),
+            "Info+ from anything, tracing off"
+        );
+        assert!(
+            ring_accepts(Level::Warn, "jni", true),
+            "Info+ from anything, tracing on"
+        );
+        assert!(
+            !ring_accepts(Level::Debug, "jni", true),
+            "foreign Debug, tracing on: still excluded"
+        );
+        assert!(
+            !ring_accepts(Level::Debug, "iris::sense", false),
+            "own Debug, tracing off: excluded"
+        );
+        assert!(
+            ring_accepts(Level::Debug, "iris::sense", true),
+            "own Debug, tracing on: included"
+        );
+        assert!(
+            ring_accepts(Level::Trace, "ai_app::api", true),
+            "own Trace, tracing on: included"
+        );
+    }
+
+    #[test]
+    fn is_own_target_matches_the_crate_or_its_modules_only() {
+        assert!(is_own_target("iris"));
+        assert!(is_own_target("iris::sense"));
+        assert!(is_own_target("ai_app"));
+        assert!(is_own_target("ai_app::log_ring"));
+        assert!(!is_own_target("iris_something_else"));
+        assert!(!is_own_target("naga::front"));
+        assert!(!is_own_target("jni"));
+    }
+}

app/src/client/markdown_blocks.rs

@@ -0,0 +1,241 @@
+use pulldown_cmark::{Event, Options, Parser, Tag};
+
+/// What a block is, for a renderer that wants to style or space blocks
+/// differently. `Other` is deliberately present rather than a panic or a
+/// silent fallback to `Paragraph`: markdown has more block kinds than this
+/// list and more get added, and a renderer treating an unknown one as
+/// prose is right, but it should be able to *tell* that is what it is
+/// doing.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BlockKind {
+    Paragraph,
+    Heading,
+    Code,
+    List,
+    Table,
+    Quote,
+    Other,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Block {
+    pub kind: BlockKind,
+    pub source: String,
+}
+
+fn kind_of(tag: &Tag) -> BlockKind {
+    match tag {
+        Tag::Paragraph => BlockKind::Paragraph,
+        Tag::Heading { .. } => BlockKind::Heading,
+        Tag::CodeBlock(_) => BlockKind::Code,
+        Tag::List(_) => BlockKind::List,
+        Tag::Table(_) => BlockKind::Table,
+        Tag::BlockQuote(_) => BlockKind::Quote,
+        _ => BlockKind::Other,
+    }
+}
+
+fn options() -> Options {
+    Options::ENABLE_STRIKETHROUGH | Options::ENABLE_TABLES | Options::ENABLE_TASKLISTS
+}
+
+pub fn split_blocks(src: &str) -> Vec<Block> {
+    let mut out: Vec<Block> = Vec::new();
+    let mut depth = 0usize;
+    let mut kind = BlockKind::Other;
+    for (event, range) in Parser::new_ext(src, options()).into_offset_iter() {
+        match event {
+            Event::Start(tag) => {
+                if depth == 0 {
+                    kind = kind_of(&tag);
+                }
+                depth += 1;
+            }
+            Event::End(_) => {
+                depth -= 1;
+                if depth == 0 {
+                    push(&mut out, kind, &src[range]);
+                }
+            }
+            _ => {
+                if depth == 0 {
+                    push(&mut out, BlockKind::Other, &src[range]);
+                }
+            }
+        }
+    }
+    out
+}
+
+fn push(out: &mut Vec<Block>, kind: BlockKind, source: &str) {
+    let source = source.trim_end();
+    if source.is_empty() {
+        return;
+    }
+    out.push(Block {
+        kind,
+        source: source.to_string(),
+    });
+}
+
+/// How many leading blocks of `old` and `new` are identical -- what a
+/// caller may keep the laid-out widgets for. See the module doc for why
+/// this is a comparison rather than an assumption.
+pub fn common_prefix(old: &[Block], new: &[Block]) -> usize {
+    old.iter().zip(new).take_while(|(a, b)| a == b).count()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn kinds(src: &str) -> Vec<BlockKind> {
+        split_blocks(src).into_iter().map(|b| b.kind).collect()
+    }
+
+    #[test]
+    fn a_message_splits_into_its_top_level_blocks() {
+        let src = "# Title\n\nFirst para.\n\n```rust\nfn main() {}\n```\n\n- a\n- b\n";
+        assert_eq!(
+            kinds(src),
+            vec![
+                BlockKind::Heading,
+                BlockKind::Paragraph,
+                BlockKind::Code,
+                BlockKind::List
+            ]
+        );
+        let blocks = split_blocks(src);
+        assert_eq!(blocks[1].source, "First para.");
+        assert_eq!(blocks[2].source, "```rust\nfn main() {}\n```");
+    }
+
+    #[test]
+    fn blank_input_has_no_blocks() {
+        assert!(split_blocks("").is_empty());
+        assert!(split_blocks("   \n\n  ").is_empty());
+    }
+
+    #[test]
+    fn a_delta_into_the_last_paragraph_leaves_earlier_blocks_untouched() {
+        let before = split_blocks("# Title\n\nFirst para.\n\nSecond par");
+        let after = split_blocks("# Title\n\nFirst para.\n\nSecond paragraph now.");
+        assert_eq!(common_prefix(&before, &after), 2);
+        assert_eq!(before.len(), 3);
+        assert_eq!(after.len(), 3);
+        assert_ne!(before[2], after[2]);
+    }
+
+    #[test]
+    fn a_delta_that_starts_a_new_block_keeps_every_old_one() {
+        let before = split_blocks("First para.\n\nSecond para.");
+        let after = split_blocks("First para.\n\nSecond para.\n\nThird");
+        assert_eq!(common_prefix(&before, &after), 2);
+        assert_eq!(after.len(), 3);
+    }
+
+    #[test]
+    fn an_unterminated_fence_is_one_block_while_it_streams() {
+        for src in [
+            "Here:\n\n```rust\n",
+            "Here:\n\n```rust\nfn main() {\n",
+            "Here:\n\n```rust\nfn main() {\n    println!(\"hi\");\n",
+        ] {
+            assert_eq!(
+                kinds(src),
+                vec![BlockKind::Paragraph, BlockKind::Code],
+                "{src:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn appending_can_rewrite_an_earlier_block_and_the_prefix_says_so() {
+        let before = split_blocks("Not a heading\n\nsecond");
+        let after = split_blocks("Not a heading\n\nsecond\n---");
+        assert_eq!(before[1].kind, BlockKind::Paragraph);
+        assert_eq!(after[1].kind, BlockKind::Heading);
+        assert_eq!(
+            common_prefix(&before, &after),
+            1,
+            "the rewritten block must not be reported as keepable"
+        );
+    }
+
+    #[test]
+    fn a_thematic_break_is_its_own_block() {
+        assert_eq!(
+            kinds("one\n\n---\n\ntwo"),
+            vec![BlockKind::Paragraph, BlockKind::Other, BlockKind::Paragraph]
+        );
+    }
+
+    #[test]
+    fn the_transcripts_own_block_shapes_survive_a_split() {
+        let fence_with_blanks = "Intro.\n\n```rust\nfn a() {}\n\nfn b() {}\n```\n\nAfter.";
+        assert_eq!(
+            kinds(fence_with_blanks),
+            vec![BlockKind::Paragraph, BlockKind::Code, BlockKind::Paragraph],
+            "a blank line inside a fence is not a block boundary"
+        );
+        assert_eq!(
+            kinds("```\n---\n```"),
+            vec![BlockKind::Code],
+            "a thematic break inside a fence is code, not a break"
+        );
+        assert_eq!(
+            kinds("- a\n  - a1\n  - a2\n- b"),
+            vec![BlockKind::List],
+            "a nested list is one top-level block"
+        );
+        assert_eq!(
+            kinds("## Heading\n```sh\nls\n```"),
+            vec![BlockKind::Heading, BlockKind::Code],
+            "a fence directly under a heading, with no blank line"
+        );
+        assert_eq!(
+            kinds("| a | b |\n|---|---|\n| 1 | 2 |"),
+            vec![BlockKind::Table]
+        );
+        assert_eq!(
+            kinds("> quoted\n> more\n\nplain"),
+            vec![BlockKind::Quote, BlockKind::Paragraph]
+        );
+    }
+
+    #[test]
+    fn every_prefix_of_a_streamed_message_keeps_all_but_its_last_block() {
+        let full = "# Report\n\nFirst finding, at some length.\n\n```rust\nfn main() {\n\n                        println!(\"hi\");\n}\n```\n\n- one\n  - nested\n- two\n\n| a | b |\n                    |---|---|\n| 1 | 2 |\n\n> and a closing quote.";
+        let mut prev = Vec::new();
+        for end in full.char_indices().map(|(i, _)| i).chain([full.len()]) {
+            let now = split_blocks(&full[..end]);
+            let common = common_prefix(&prev, &now);
+            assert!(
+                prev.is_empty() || common + 1 >= prev.len(),
+                "at {end} bytes the split rewrote block {common} of {}, not just the last one:\n                 before={prev:#?}\nafter={now:#?}",
+                prev.len()
+            );
+            prev = now;
+        }
+    }
+
+    #[test]
+    fn a_stream_that_ends_inside_a_fence_still_ends_with_one_code_block() {
+        let src = "Here is the patch:\n\n```diff\n- old line\n+ new line";
+        let blocks = split_blocks(src);
+        assert_eq!(
+            blocks.iter().map(|b| b.kind).collect::<Vec<_>>(),
+            vec![BlockKind::Paragraph, BlockKind::Code]
+        );
+        assert_eq!(blocks[1].source, "```diff\n- old line\n+ new line");
+    }
+
+    #[test]
+    fn the_delta_that_closes_a_fence_changes_only_the_last_block() {
+        let before = split_blocks("Text.\n\n```\ncode\n");
+        let after = split_blocks("Text.\n\n```\ncode\n```");
+        assert_eq!(before.len(), after.len());
+        assert_eq!(common_prefix(&before, &after), 1);
+        assert_ne!(before[1], after[1]);
+    }
+}

app/src/client/mod.rs

@@ -0,0 +1,17 @@
+pub mod ansi;
+pub mod api;
+pub mod config;
+pub mod durations;
+pub mod event_stream;
+pub mod highlight;
+pub mod log_ring;
+pub mod markdown_blocks;
+pub mod notifications;
+pub mod sse;
+pub mod text_cap;
+pub mod tool_summary;
+pub mod transcript_cache;
+pub mod transcript_fold;
+pub mod transcript_source;
+
+pub use event_model::*;

app/src/client/notifications.rs

@@ -0,0 +1,149 @@
+//! `GET /notifications`, the attention stream PLAN.md's "Notifications: two
+//! places, never both" describes. Ported from the parsing half of
+//! `app/.../Notifications.kt`'s `NotificationService` -- the framing
+//! ([`crate::client::sse`]) and the wire shape ([`SessionNotification`],
+//! [`NotificationKind`], mirroring `server/src/session/mod.rs`'s
+//! `Notification`/`NotificationKind`).
+
+use std::io::{BufRead, BufReader};
+
+use serde::Deserialize;
+
+use crate::client::api::{ApiError, Transport};
+use crate::client::sse::SseReader;
+
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionNotification {
+    pub session_id: String,
+    pub title: String,
+    pub kind: NotificationKind,
+    /// Epoch seconds, so a phone that was asleep can say how long ago.
+    pub at: f64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum NotificationKind {
+    AwaitingInput,
+    Finished,
+}
+
+impl NotificationKind {
+    /// What a notification asks of the reader, in the words they see --
+    /// ported verbatim from `Notifications.kt`'s `attentionLine`. One
+    /// function because the same fact is shown in two places (the
+    /// platform's drawer and the app's own banner) and two mappings of one
+    /// word drift.
+    pub fn attention_line(self) -> &'static str {
+        match self {
+            NotificationKind::AwaitingInput => "Waiting for you",
+            NotificationKind::Finished => "Finished",
+        }
+    }
+}
+
+/// Follows `/notifications`, calling `on_notification` for each frame until
+/// the connection drops or the callback asks to stop (by returning
+/// `false`). Reconnecting is the caller's job -- mirroring
+/// `NotificationService.follow`'s retry loop, which is a platform policy
+/// (how long to wait, whether to give up) rather than parsing logic.
+pub fn follow_notifications(
+    transport: &dyn Transport,
+    mut on_notification: impl FnMut(SessionNotification) -> bool,
+) -> Result<(), ApiError> {
+    let body = transport.stream("/notifications")?;
+    let mut lines = BufReader::new(body).lines();
+    let mut reader = SseReader::new();
+    while let Some(line) = lines.next().transpose().map_err(|e| ApiError {
+        message: format!("Can't reach the server -- retrying. ({e})"),
+        status: None,
+    })? {
+        let Some(frame) = reader.feed_line(&line) else {
+            continue;
+        };
+        if frame.data.is_empty() {
+            continue;
+        }
+        let notification: SessionNotification =
+            serde_json::from_str(&frame.data).map_err(|e| ApiError {
+                message: format!("The server sent a notification this build couldn't parse: {e}"),
+                status: None,
+            })?;
+        if !on_notification(notification) {
+            return Ok(());
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::client::api::{Body, RawResponse};
+    use std::io::Cursor;
+
+    struct FixtureTransport {
+        body: &'static str,
+    }
+
+    impl Transport for FixtureTransport {
+        fn request(
+            &self,
+            _method: &str,
+            _path: &str,
+            _body: Option<Body>,
+        ) -> Result<RawResponse, ApiError> {
+            unimplemented!("this fixture only serves a stream")
+        }
+
+        fn stream(&self, _path: &str) -> Result<Box<dyn std::io::Read + Send>, ApiError> {
+            Ok(Box::new(Cursor::new(self.body.as_bytes().to_vec())))
+        }
+    }
+
+    #[test]
+    fn a_notification_frame_parses_both_kinds() {
+        let transport = FixtureTransport {
+            body: "data:{\"sessionId\":\"s1\",\"title\":\"fix the bug\",\"kind\":\"awaitingInput\",\"at\":1.0}\n\n\
+                   data:{\"sessionId\":\"s2\",\"title\":\"add tests\",\"kind\":\"finished\",\"at\":2.0}\n\n",
+        };
+        let mut seen = Vec::new();
+        follow_notifications(&transport, |n| {
+            seen.push((n.session_id, n.kind));
+            true
+        })
+        .unwrap();
+        assert_eq!(
+            seen,
+            vec![
+                ("s1".to_string(), NotificationKind::AwaitingInput),
+                ("s2".to_string(), NotificationKind::Finished),
+            ]
+        );
+    }
+
+    #[test]
+    fn the_caller_can_stop_early() {
+        let transport = FixtureTransport {
+            body: "data:{\"sessionId\":\"s1\",\"title\":\"a\",\"kind\":\"finished\",\"at\":1.0}\n\n\
+                   data:{\"sessionId\":\"s2\",\"title\":\"b\",\"kind\":\"finished\",\"at\":2.0}\n\n",
+        };
+        let mut count = 0;
+        follow_notifications(&transport, |_| {
+            count += 1;
+            count < 1
+        })
+        .unwrap();
+        assert_eq!(count, 1);
+    }
+
+    #[test]
+    fn attention_line_matches_the_kotlin_original() {
+        assert_eq!(
+            NotificationKind::AwaitingInput.attention_line(),
+            "Waiting for you"
+        );
+        assert_eq!(NotificationKind::Finished.attention_line(), "Finished");
+    }
+}

app/src/client/sse.rs

@@ -0,0 +1,102 @@
+/// One SSE frame: its name (`None` for an ordinary data frame) and its payload.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Frame {
+    pub name: Option<String>,
+    pub data: String,
+}
+
+#[derive(Debug, Default)]
+pub struct SseReader {
+    data: String,
+    name: Option<String>,
+}
+
+impl SseReader {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn feed_line(&mut self, line: &str) -> Option<Frame> {
+        if line.is_empty() {
+            if self.name.is_some() || !self.data.is_empty() {
+                let frame = Frame {
+                    name: self.name.take(),
+                    data: std::mem::take(&mut self.data),
+                };
+                return Some(frame);
+            }
+            return None;
+        }
+        if let Some(rest) = line.strip_prefix("data:") {
+            self.data.push_str(rest.trim());
+        } else if let Some(rest) = line.strip_prefix("event:") {
+            self.name = Some(rest.trim().to_string());
+        }
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn frames(lines: &[&str]) -> Vec<Frame> {
+        let mut reader = SseReader::new();
+        lines.iter().filter_map(|l| reader.feed_line(l)).collect()
+    }
+
+    #[test]
+    fn a_data_only_frame_has_no_name() {
+        assert_eq!(
+            frames(&["data:hello", ""]),
+            vec![Frame {
+                name: None,
+                data: "hello".to_string()
+            }]
+        );
+    }
+
+    #[test]
+    fn a_named_frame_with_no_payload_still_completes() {
+        assert_eq!(
+            frames(&["event:reset", ""]),
+            vec![Frame {
+                name: Some("reset".to_string()),
+                data: String::new()
+            }]
+        );
+    }
+
+    #[test]
+    fn a_blank_line_with_nothing_pending_yields_no_frame() {
+        assert_eq!(frames(&[""]), vec![]);
+    }
+
+    #[test]
+    fn a_comment_and_an_id_line_are_ignored() {
+        assert_eq!(
+            frames(&[":keepalive", "id:5", "data:hi", ""]),
+            vec![Frame {
+                name: None,
+                data: "hi".to_string()
+            }]
+        );
+    }
+
+    #[test]
+    fn two_frames_in_a_row_are_both_reported() {
+        assert_eq!(
+            frames(&["data:one", "", "data:two", ""]),
+            vec![
+                Frame {
+                    name: None,
+                    data: "one".to_string()
+                },
+                Frame {
+                    name: None,
+                    data: "two".to_string()
+                },
+            ]
+        );
+    }
+}

app/src/client/text_cap.rs

@@ -0,0 +1,93 @@
+/// The default bound on a verbatim block -- a tool call's input or its
+/// output. Short, because this text is a machine's and the reader is
+/// looking for one line of it.
+pub const VERBATIM_LINES: usize = 80;
+pub const VERBATIM_BYTES: usize = 4096;
+
+pub const MESSAGE_LINES: usize = 200;
+pub const MESSAGE_BYTES: usize = 16 * 1024;
+
+const _: () = assert!(VERBATIM_LINES > 0 && VERBATIM_BYTES > 0);
+const _: () = assert!(MESSAGE_LINES > 0 && MESSAGE_BYTES > 0);
+
+/// `text` cut to `max_lines` lines and `max_bytes` bytes, with the line
+/// count it was cut *from*; `None` when the whole of it fits.
+pub fn cut(text: &str, max_lines: usize, max_bytes: usize) -> Option<(&str, usize)> {
+    debug_assert!(
+        max_lines > 0 && max_bytes > 0,
+        "a cap of nothing shows an empty block and a 'Show all' for every value there is",
+    );
+    let by_lines = text
+        .char_indices()
+        .filter(|(_, c)| *c == '\n')
+        .nth(max_lines - 1)
+        .map(|(i, _)| i);
+    let by_bytes = (text.len() > max_bytes).then(|| {
+        let mut end = max_bytes;
+        // Back up to a character boundary: a cut inside a multi-byte
+        // character panics on the slice below, and a transcript is full of
+        // them.
+        while !text.is_char_boundary(end) {
+            end -= 1;
+        }
+        end
+    });
+    let cut = match (by_lines, by_bytes) {
+        (Some(a), Some(b)) => a.min(b),
+        (a, b) => a.or(b)?,
+    };
+    Some((&text[..cut], text.lines().count()))
+}
+
+pub fn show_all_label(lines: usize) -> String {
+    format!("Show all {lines} lines")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn text_under_both_bounds_is_not_cut() {
+        assert_eq!(cut("one\ntwo\nthree", 80, 4096), None);
+    }
+
+    #[test]
+    fn the_line_bound_cuts_at_a_line_boundary() {
+        let text = "a\nb\nc\nd\n";
+        let (shown, lines) = cut(text, 2, 4096).expect("four lines is over a bound of two");
+        assert_eq!(shown, "a\nb");
+        assert_eq!(
+            lines, 4,
+            "the count is the whole text's, not the shown part's"
+        );
+    }
+
+    #[test]
+    fn the_byte_bound_cuts_one_long_line() {
+        let text = "x".repeat(5000);
+        let (shown, lines) = cut(&text, 80, 4096).expect("5000 bytes is over a bound of 4096");
+        assert_eq!(shown.len(), 4096);
+        assert_eq!(lines, 1);
+    }
+
+    #[test]
+    fn the_tighter_of_the_two_bounds_wins() {
+        let text = "aaaa\n".repeat(100);
+        let (shown, _) = cut(&text, 80, 100).expect("over both");
+        assert_eq!(shown.len(), 100, "the byte bound is the tighter one here");
+        let (shown, _) = cut(&text, 4, 4096).expect("over the line bound");
+        assert_eq!(shown, "aaaa\naaaa\naaaa\naaaa");
+    }
+
+    #[test]
+    fn a_cut_inside_a_multibyte_character_backs_up_to_the_boundary() {
+        let text = "é".repeat(100);
+        let (shown, _) = cut(&text, 80, 11).expect("200 bytes is over a bound of 11");
+        assert_eq!(
+            shown,
+            "é".repeat(5),
+            "11 bytes lands mid-character; 10 is the cut"
+        );
+    }
+}

app/src/client/tool_summary.rs

@@ -0,0 +1,186 @@
+use crate::client::durations::format_millis_text;
+use crate::client::highlight::Language;
+use serde_json::{Map, Value};
+
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct ToolInput {
+    pub subject: Option<String>,
+    pub language: Option<Language>,
+    pub description: Option<String>,
+    /// How long the call may take, in the largest units it fits. Shown
+    /// apart because it is a limit on the call rather than part of what
+    /// the call does.
+    pub timeout: Option<String>,
+    /// Everything else, as `name: value` lines. Never dropped.
+    pub rest: Vec<String>,
+}
+
+impl ToolInput {
+    pub fn title(&self) -> Option<&str> {
+        self.description
+            .as_deref()
+            .or(self.subject.as_deref())
+            .filter(|t| !t.trim().is_empty())
+    }
+}
+
+const SUBJECTS: &[(&str, &str, Option<Language>)] = &[
+    ("Bash", "command", Some(Language::Shell)),
+    ("Read", "file_path", None),
+    ("Write", "file_path", None),
+    ("Edit", "file_path", None),
+    ("Glob", "pattern", None),
+    ("Grep", "pattern", None),
+    ("WebFetch", "url", None),
+];
+
+const DESCRIPTIONS: &[&str] = &["description", "prompt"];
+
+/// One function rather than two, because the same coercion decides both
+/// what a subject reads as and what a leftover field's value reads as, and
+/// two copies would eventually disagree about a number.
+fn as_text(value: &Value) -> String {
+    match value {
+        Value::String(s) => s.clone(),
+        other => other.to_string(),
+    }
+}
+
+fn non_blank(value: Option<&Value>) -> Option<String> {
+    let text = as_text(value?);
+    (!text.trim().is_empty()).then_some(text)
+}
+
+pub fn parse_tool_input(tool: &str, input: &str) -> ToolInput {
+    let Ok(Value::Object(json)) = serde_json::from_str::<Value>(input) else {
+        return ToolInput {
+            rest: match input.trim().is_empty() {
+                true => Vec::new(),
+                false => vec![input.to_string()],
+            },
+            ..ToolInput::default()
+        };
+    };
+    parse_object(tool, &json)
+}
+
+fn parse_object(tool: &str, json: &Map<String, Value>) -> ToolInput {
+    let (subject_key, language) = SUBJECTS
+        .iter()
+        .find(|(name, ..)| *name == tool)
+        .map(|(_, key, language)| (Some(*key), *language))
+        .unwrap_or((None, None));
+    let subject = subject_key.and_then(|key| non_blank(json.get(key)));
+    let description = DESCRIPTIONS
+        .iter()
+        .find_map(|key| non_blank(json.get(*key)));
+    let timeout = non_blank(json.get("timeout")).map(|t| format_millis_text(&t));
+
+    let mut keys: Vec<&String> = json
+        .keys()
+        .filter(|k| Some(k.as_str()) != subject_key || subject.is_none())
+        .filter(|k| !DESCRIPTIONS.contains(&k.as_str()) || description.is_none())
+        .filter(|k| k.as_str() != "timeout" || timeout.is_none())
+        .collect();
+    keys.sort();
+    let rest = keys
+        .into_iter()
+        .map(|key| format!("{key}: {}", as_text(&json[key])))
+        .collect();
+
+    ToolInput {
+        subject,
+        language,
+        description,
+        timeout,
+        rest,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn each_tool_in_the_table_has_its_own_subject() {
+        let cases = [
+            ("Bash", r#"{"command":"ls -la"}"#, "ls -la"),
+            ("Read", r#"{"file_path":"/tmp/x.rs"}"#, "/tmp/x.rs"),
+            ("Write", r#"{"file_path":"/tmp/y.rs"}"#, "/tmp/y.rs"),
+            ("Edit", r#"{"file_path":"/tmp/z.rs"}"#, "/tmp/z.rs"),
+            ("Glob", r#"{"pattern":"**/*.rs"}"#, "**/*.rs"),
+            ("Grep", r#"{"pattern":"fn main"}"#, "fn main"),
+            ("WebFetch", r#"{"url":"https://x/y"}"#, "https://x/y"),
+        ];
+        for (tool, input, expected) in cases {
+            let parsed = parse_tool_input(tool, input);
+            assert_eq!(parsed.subject.as_deref(), Some(expected), "{tool}");
+            assert_eq!(parsed.title(), Some(expected), "{tool}");
+            assert!(parsed.rest.is_empty(), "{tool}: {:?}", parsed.rest);
+        }
+        assert_eq!(
+            parse_tool_input("Bash", r#"{"command":"ls"}"#).language,
+            Some(Language::Shell),
+            "a Bash command is shell, and is the one row that names a language"
+        );
+    }
+
+    #[test]
+    fn a_tools_own_description_is_what_the_one_line_says() {
+        let parsed = parse_tool_input(
+            "Bash",
+            r#"{"command":"cargo test -p iris","description":"Run the iris tests"}"#,
+        );
+        assert_eq!(parsed.title(), Some("Run the iris tests"));
+        assert_eq!(parsed.subject.as_deref(), Some("cargo test -p iris"));
+        assert!(parsed.rest.is_empty(), "{:?}", parsed.rest);
+    }
+
+    #[test]
+    fn a_timeout_is_read_as_a_span_and_kept_apart_from_the_rest() {
+        let parsed = parse_tool_input("Bash", r#"{"command":"sleep 500","timeout":480000}"#);
+        assert_eq!(parsed.timeout.as_deref(), Some("8m"));
+        assert!(parsed.rest.is_empty(), "{:?}", parsed.rest);
+    }
+
+    #[test]
+    fn every_field_not_drawn_elsewhere_is_still_shown() {
+        let parsed = parse_tool_input(
+            "Edit",
+            r#"{"file_path":"/a.rs","old_string":"x","new_string":"y","replace_all":true}"#,
+        );
+        assert_eq!(
+            parsed.rest,
+            vec![
+                "new_string: y".to_string(),
+                "old_string: x".to_string(),
+                "replace_all: true".to_string(),
+            ],
+            "sorted, and a non-string value written as JSON"
+        );
+        let unknown = parse_tool_input("SomeNewTool", r#"{"b":2,"a":"one"}"#);
+        assert_eq!(unknown.subject, None);
+        assert_eq!(unknown.rest, vec!["a: one".to_string(), "b: 2".to_string()]);
+    }
+
+    #[test]
+    fn input_that_is_not_an_object_is_still_the_input() {
+        assert_eq!(
+            parse_tool_input("Bash", "just a string").rest,
+            vec!["just a string".to_string()]
+        );
+        assert_eq!(parse_tool_input("Bash", "   ").rest, Vec::<String>::new());
+        assert_eq!(parse_tool_input("Bash", "").title(), None);
+    }
+
+    #[test]
+    fn a_blank_subject_is_no_subject_rather_than_an_empty_summary_line() {
+        let parsed = parse_tool_input("Bash", r#"{"command":"   ","other":1}"#);
+        assert_eq!(parsed.subject, None);
+        assert_eq!(parsed.title(), None);
+        assert_eq!(
+            parsed.rest,
+            vec!["command:    ".to_string(), "other: 1".to_string()]
+        );
+    }
+}

app/src/client/transcript_source.rs

@@ -0,0 +1,475 @@
+use event_model::SeqEvent;
+
+use crate::client::api::{ApiClient, ApiError, Transport};
+use crate::client::event_stream::{self, StreamItem};
+use crate::client::transcript_cache::SessionCache;
+
+/// The server's own default page size, named here because the cached
+/// opening has to be the same size as the fetched one -- a reader must not
+/// get a shorter first screen for having been here before.
+pub const OPENING_WINDOW: u32 = 80;
+
+/// A transcript-line parse failure, told apart from [`ApiError`] so a
+/// caller can tell "the server is unreachable" from "the server (or this
+/// phone's own disk) sent something this build cannot read" -- the two
+/// mean different things to a reader (retry, versus a build that is
+/// behind).
+#[derive(Debug, Clone)]
+pub struct ParseError(pub String);
+
+impl std::fmt::Display for ParseError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+impl std::error::Error for ParseError {}
+
+#[derive(Debug, Clone)]
+pub enum PageError {
+    Api(ApiError),
+    Parse(ParseError),
+}
+
+impl From<ApiError> for PageError {
+    fn from(e: ApiError) -> Self {
+        Self::Api(e)
+    }
+}
+
+impl From<ParseError> for PageError {
+    fn from(e: ParseError) -> Self {
+        Self::Parse(e)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum OlderPage {
+    Events(Vec<SeqEvent>),
+    NothingLoaded,
+}
+
+fn parse_line(line: &str) -> Result<SeqEvent, ParseError> {
+    serde_json::from_str(line).map_err(|e| ParseError(format!("{e}")))
+}
+
+pub struct TranscriptSource<T: Transport> {
+    api: ApiClient<T>,
+    session_id: String,
+    pub cache: SessionCache,
+}
+
+impl<T: Transport> TranscriptSource<T> {
+    pub fn new(api: ApiClient<T>, session_id: impl Into<String>, cache: SessionCache) -> Self {
+        Self {
+            api,
+            session_id: session_id.into(),
+            cache,
+        }
+    }
+
+    /// The cached opening window, or `None` when there is nothing usable
+    /// to draw.
+    pub fn cached_opening(&self, limit: usize) -> Option<Vec<SeqEvent>> {
+        self.cache.tail()?;
+        let lines = self.cache.newest(limit);
+        if lines.is_empty() {
+            return None;
+        }
+        match lines.iter().map(|l| parse_line(l)).collect() {
+            Ok(events) => Some(events),
+            Err(ParseError(_)) => {
+                self.cache.purge();
+                None
+            }
+        }
+    }
+
+    /// A caller must not resume a live stream from a cached seq unless it
+    /// is the same conversation: a transcript is append-only in ordinary
+    /// use, but the file backing it can be replaced or truncated (a
+    /// sandbox re-seeded with the same ids, a backup restored, a session
+    /// re-imported), and the server's catch-up on such a file would hand
+    /// this phone a continuation of a *different* conversation, spliced
+    /// onto the cached one with no seam. Caught with one request of a few
+    /// hundred bytes.
+    ///
+    /// `Ok(false)` purges the cache and means "open cold". `Err` is the
+    /// server not being askable, which is neither: the cached rows stay
+    /// on screen and the caller tries again on its own reconnect schedule.
+    pub fn probe(&self) -> Result<bool, ApiError> {
+        let Some(tail) = self.cache.tail() else {
+            return Ok(false);
+        };
+        let page = self.api.fetch_transcript_lines(
+            &self.session_id,
+            Some(tail.seq + 1),
+            1,
+            false,
+            None,
+        )?;
+        let matches = page.len() == 1
+            && parse_line(&tail.line)
+                .map(|cached| cached == page[0].1)
+                .unwrap_or(false);
+        if !matches {
+            self.cache.purge();
+        }
+        Ok(matches)
+    }
+
+    pub fn fetch_opening(&self) -> Result<Vec<SeqEvent>, ApiError> {
+        let page =
+            self.api
+                .fetch_transcript_lines(&self.session_id, None, OPENING_WINDOW, false, None)?;
+        for (line, event) in &page {
+            self.cache.append(line, event.seq);
+        }
+        self.cache.flush();
+        Ok(page.into_iter().map(|(_, event)| event).collect())
+    }
+
+    /// The page before `before`: from the cache when it holds it,
+    /// otherwise from the server bounded by what the cache already has.
+    pub fn page(&self, before: u64, limit: u32, coalesce: bool) -> Result<OlderPage, PageError> {
+        if before == 0 {
+            return Ok(OlderPage::NothingLoaded);
+        }
+        if let Some(lines) = self.cache.page(before, limit as usize, coalesce) {
+            let events: Vec<SeqEvent> = lines
+                .iter()
+                .map(|l| parse_line(l).map_err(PageError::from))
+                .collect::<Result<_, _>>()?;
+            return Ok(OlderPage::Events(events));
+        }
+        let after = self.cache.covered_up_to(before).map(|v| v - 1);
+        let page = self.api.fetch_transcript_lines(
+            &self.session_id,
+            Some(before),
+            limit,
+            coalesce,
+            after,
+        )?;
+        if let Some((_, first_event)) = page.first() {
+            let lines: Vec<String> = page.iter().map(|(line, _)| line.clone()).collect();
+            self.cache
+                .store_page(&lines, first_event.seq, before, coalesce);
+        }
+        Ok(OlderPage::Events(
+            page.into_iter().map(|(_, event)| event).collect(),
+        ))
+    }
+
+    /// Before, so that an event held back for a reader who is scrolled
+    /// away is already on disk -- what the cache holds is what the server
+    /// sent, not what a screen has got round to drawing. Flushed on each
+    /// status change, which is a turn's boundary and the granularity a
+    /// crash may as well lose, and once more when the stream ends.
+    pub fn follow(
+        &self,
+        after: u64,
+        mut on_item: impl FnMut(StreamItem) -> bool,
+    ) -> Result<(), ApiError> {
+        let cache = &self.cache;
+        let result = event_stream::follow_session_events(
+            self.api.transport(),
+            &self.session_id,
+            after,
+            |item| {
+                if let StreamItem::Event { raw, event } = &item {
+                    cache.append(raw, event.seq);
+                    if matches!(event.event, event_model::Event::Status { .. }) {
+                        cache.flush();
+                    }
+                }
+                on_item(item)
+            },
+        );
+        cache.flush();
+        result
+    }
+
+    /// Flushes everything this source has given the cache.
+    pub fn close(&self) {
+        self.cache.flush();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::client::api::{Body, RawResponse};
+    use std::collections::VecDeque;
+    use std::io::Read;
+    use std::sync::Mutex;
+
+    #[derive(Default)]
+    struct ScriptedTransport {
+        responses: Mutex<VecDeque<(u16, String)>>,
+        calls: Mutex<Vec<String>>,
+    }
+
+    impl ScriptedTransport {
+        fn respond(&self, status: u16, body: impl Into<String>) {
+            self.responses
+                .lock()
+                .unwrap()
+                .push_back((status, body.into()));
+        }
+
+        fn call_count(&self) -> usize {
+            self.calls.lock().unwrap().len()
+        }
+    }
+
+    impl Transport for ScriptedTransport {
+        fn request(
+            &self,
+            _method: &str,
+            path: &str,
+            _body: Option<Body>,
+        ) -> Result<RawResponse, ApiError> {
+            self.calls.lock().unwrap().push(path.to_string());
+            let (status, body) = self
+                .responses
+                .lock()
+                .unwrap()
+                .pop_front()
+                .unwrap_or_else(|| panic!("ScriptedTransport got an unscripted request: {path}"));
+            Ok(RawResponse {
+                status,
+                body: body.into_bytes(),
+            })
+        }
+
+        fn stream(&self, path: &str) -> Result<Box<dyn Read + Send>, ApiError> {
+            self.calls.lock().unwrap().push(path.to_string());
+            let (_, body) = self
+                .responses
+                .lock()
+                .unwrap()
+                .pop_front()
+                .unwrap_or_else(|| {
+                    panic!("ScriptedTransport got an unscripted stream request: {path}")
+                });
+            Ok(Box::new(std::io::Cursor::new(body.into_bytes())))
+        }
+    }
+
+    fn source(
+        transport: ScriptedTransport,
+        cache_root: &std::path::Path,
+    ) -> TranscriptSource<ScriptedTransport> {
+        let api = ApiClient::new(transport);
+        let cache = crate::client::transcript_cache::TranscriptCache::new(cache_root).session("s1");
+        TranscriptSource::new(api, "s1", cache)
+    }
+
+    fn status_line(seq: u64) -> String {
+        format!(r#"{{"seq":{seq},"ts":1.0,"type":"status","state":"idle"}}"#)
+    }
+
+    #[test]
+    fn a_cold_cache_has_no_opening_and_fetches_from_the_server() {
+        let dir = tempfile::tempdir().unwrap();
+        let transport = ScriptedTransport::default();
+        transport.respond(200, format!("[{}]", status_line(1)));
+        let source = source(transport, dir.path());
+
+        assert_eq!(source.cached_opening(80), None);
+        let opening = source.fetch_opening().unwrap();
+        assert_eq!(opening.len(), 1);
+        assert_eq!(opening[0].seq, 1);
+        assert!(source.cache.tail().is_some());
+    }
+
+    #[test]
+    fn probe_matching_the_cached_tail_leaves_the_cache_alone() {
+        let dir = tempfile::tempdir().unwrap();
+        let transport = ScriptedTransport::default();
+        transport.respond(200, format!("[{}]", status_line(1)));
+        let source = source(transport, dir.path());
+        source.fetch_opening().unwrap();
+
+        let transport2 = ScriptedTransport::default();
+        transport2.respond(200, format!("[{}]", status_line(1)));
+        let cache = crate::client::transcript_cache::TranscriptCache::new(dir.path()).session("s1");
+        let source2 = TranscriptSource::new(ApiClient::new(transport2), "s1", cache);
+        assert!(source2.probe().unwrap());
+        assert!(source2.cache.tail().is_some());
+    }
+
+    #[test]
+    fn probe_mismatching_the_cached_tail_purges_the_cache() {
+        let dir = tempfile::tempdir().unwrap();
+        let transport = ScriptedTransport::default();
+        transport.respond(200, format!("[{}]", status_line(1)));
+        let source = source(transport, dir.path());
+        source.fetch_opening().unwrap();
+
+        let transport2 = ScriptedTransport::default();
+        let different = r#"{"seq":1,"ts":1.0,"type":"status","state":"running"}"#.to_string();
+        transport2.respond(200, format!("[{different}]"));
+        let cache = crate::client::transcript_cache::TranscriptCache::new(dir.path()).session("s1");
+        let source2 = TranscriptSource::new(ApiClient::new(transport2), "s1", cache);
+        assert!(!source2.probe().unwrap());
+        assert!(source2.cache.tail().is_none());
+    }
+
+    #[test]
+    fn probe_finding_no_server_leaves_the_cache_untouched() {
+        let dir = tempfile::tempdir().unwrap();
+        let transport = ScriptedTransport::default();
+        transport.respond(200, format!("[{}]", status_line(1)));
+        let source = source(transport, dir.path());
+        source.fetch_opening().unwrap();
+
+        let transport2 = ScriptedTransport::default();
+        transport2.respond(500, "server on fire");
+        let cache = crate::client::transcript_cache::TranscriptCache::new(dir.path()).session("s1");
+        let source2 = TranscriptSource::new(ApiClient::new(transport2), "s1", cache);
+        assert!(source2.probe().is_err());
+        assert!(
+            source2.cache.tail().is_some(),
+            "an unreachable server must not be treated as a mismatch"
+        );
+    }
+
+    #[test]
+    fn paging_before_the_first_event_makes_no_request_at_all() {
+        let dir = tempfile::tempdir().unwrap();
+        let transport = ScriptedTransport::default();
+        let source = source(transport, dir.path());
+        assert_eq!(source.page(0, 80, true).unwrap(), OlderPage::NothingLoaded);
+        assert_eq!(source.api.transport().call_count(), 0);
+    }
+
+    #[test]
+    fn a_page_already_covered_by_the_cache_never_reaches_the_server() {
+        let dir = tempfile::tempdir().unwrap();
+        let transport = ScriptedTransport::default();
+        transport.respond(200, format!("[{},{}]", status_line(1), status_line(2)));
+        let source = source(transport, dir.path());
+        source.fetch_opening().unwrap();
+
+        let calls_before = source.api.transport().call_count();
+        let OlderPage::Events(page) = source.page(2, 10, true).unwrap() else {
+            panic!("a cursor of 2 is a real question about the conversation");
+        };
+        assert_eq!(page.len(), 1);
+        assert_eq!(page[0].seq, 1);
+        assert_eq!(
+            source.api.transport().call_count(),
+            calls_before,
+            "a cache hit must not touch the network"
+        );
+    }
+
+    #[test]
+    fn a_server_page_with_nothing_older_cached_carries_no_bound() {
+        let dir = tempfile::tempdir().unwrap();
+        let transport = ScriptedTransport::default();
+        transport.respond(200, format!("[{}]", status_line(5)));
+        let source = source(transport, dir.path());
+        source.fetch_opening().unwrap();
+
+        let transport2 = ScriptedTransport::default();
+        transport2.respond(200, format!("[{}]", status_line(3)));
+        let cache = crate::client::transcript_cache::TranscriptCache::new(dir.path()).session("s1");
+        let source2 = TranscriptSource::new(ApiClient::new(transport2), "s1", cache);
+        source2.page(5, 10, true).unwrap();
+        assert_eq!(
+            source2.api.transport().calls.lock().unwrap()[0],
+            "/sessions/s1/transcript?limit=10&before=5&coalesce=true"
+        );
+    }
+
+    #[test]
+    fn a_server_page_is_floored_at_the_end_of_the_cached_run() {
+        let dir = tempfile::tempdir().unwrap();
+        let cache = crate::client::transcript_cache::TranscriptCache::new(dir.path()).session("s1");
+        let lines: Vec<String> = (3..6).map(status_line).collect();
+        assert!(cache.store_page(&lines, 3, 6, true));
+        cache.append(&status_line(6), 6);
+        cache.append(&status_line(7), 7);
+        cache.flush();
+
+        let transport = ScriptedTransport::default();
+        transport.respond(200, format!("[{}]", status_line(9)));
+        let source = TranscriptSource::new(ApiClient::new(transport), "s1", cache);
+        source.page(10, 10, true).unwrap();
+        assert_eq!(
+            source.api.transport().calls.lock().unwrap()[0],
+            "/sessions/s1/transcript?limit=10&before=10&coalesce=true&after=7",
+            "the fetch must stop one seq below where this phone's copy ends"
+        );
+    }
+
+    #[test]
+    fn a_failing_server_page_is_an_error_rather_than_an_empty_one() {
+        let dir = tempfile::tempdir().unwrap();
+        let transport = ScriptedTransport::default();
+        transport.respond(500, "server on fire");
+        let source = source(transport, dir.path());
+        assert!(matches!(source.page(9, 10, true), Err(PageError::Api(_)),));
+    }
+
+    #[test]
+    fn an_unreadable_cached_page_is_a_parse_error_rather_than_an_empty_one() {
+        let dir = tempfile::tempdir().unwrap();
+        let cache = crate::client::transcript_cache::TranscriptCache::new(dir.path()).session("s1");
+        cache.store_page(
+            &[r#"{"seq":3,"but":"not an event"}"#.to_string()],
+            3,
+            4,
+            true,
+        );
+        cache.append(&status_line(4), 4);
+        cache.flush();
+        let transport = ScriptedTransport::default();
+        let source = TranscriptSource::new(ApiClient::new(transport), "s1", cache);
+        assert!(matches!(source.page(4, 10, true), Err(PageError::Parse(_)),));
+        assert_eq!(
+            source.api.transport().call_count(),
+            0,
+            "a cache hit that cannot be read must not fall through to the server unnoticed"
+        );
+    }
+
+    #[test]
+    fn a_bad_cached_opening_line_purges_rather_than_panicking() {
+        let dir = tempfile::tempdir().unwrap();
+        let cache = crate::client::transcript_cache::TranscriptCache::new(dir.path()).session("s1");
+        cache.append("not json at all", 1);
+        cache.flush();
+        let transport = ScriptedTransport::default();
+        let source = TranscriptSource::new(ApiClient::new(transport), "s1", cache);
+        assert_eq!(source.cached_opening(80), None);
+        assert!(
+            source.cache.tail().is_none(),
+            "a damaged line purges the cache"
+        );
+    }
+
+    #[test]
+    fn follow_writes_events_to_the_cache_before_the_caller_sees_them() {
+        let dir = tempfile::tempdir().unwrap();
+        let transport = ScriptedTransport::default();
+        transport.respond(200, format!("{}\n\n", sse_frame(&status_line(1))));
+        let source = source(transport, dir.path());
+        let mut seen = Vec::new();
+        source
+            .follow(0, |item| {
+                if let StreamItem::Event { event, .. } = item {
+                    seen.push(event.seq);
+                }
+                true
+            })
+            .unwrap();
+        assert_eq!(seen, vec![1]);
+        assert_eq!(source.cache.tail().unwrap().seq, 1);
+    }
+
+    fn sse_frame(data: &str) -> String {
+        format!("data:{data}")
+    }
+}

app/src/desktop/app.rs

@@ -0,0 +1,337 @@
+use crate::client::api::{ApiClient, SessionSummary, UreqTransport};
+use crate::client::event_stream::{StreamItem, follow_session_events};
+use crate::client::transcript_fold::{
+    TranscriptItem, fold_event, fold_page, group_tool_runs, raw_seq,
+};
+use event_model::SeqEvent;
+use iris::prelude::*;
+use std::{
+    process,
+    sync::{
+        Arc,
+        atomic::{AtomicU64, Ordering},
+    },
+    thread,
+};
+
+const LIST_WIDTH: f32 = 260.0;
+
+enum AppEvent {
+    Sessions(Result<Vec<SessionSummary>, String>),
+    TranscriptLoaded {
+        session_id: String,
+        generation: u64,
+        result: Result<Vec<TranscriptItem>, String>,
+    },
+    StreamEvent {
+        session_id: String,
+        generation: u64,
+        event: SeqEvent,
+    },
+    StreamEnded {
+        session_id: String,
+        generation: u64,
+        message: Option<String>,
+    },
+    SendFailed(String),
+}
+
+pub fn run() {
+    DesktopApp::<Client>::run();
+}
+
+#[derive(DesktopUiState)]
+struct Client {
+    ui_state: DesktopUiState,
+    api: Arc<ApiClient<UreqTransport>>,
+    stream_transport: Arc<UreqTransport>,
+    proxy: Proxy<AppEvent>,
+    sessions: Vec<SessionSummary>,
+    selected: Option<String>,
+    items: Vec<TranscriptItem>,
+    list_ptr: WeakWidget<WidgetPtr>,
+    transcript_ptr: WeakWidget<WidgetPtr>,
+    screen: Option<crate::ui::TranscriptScreen>,
+    generation: Arc<AtomicU64>,
+}
+
+impl DesktopAppState for Client {
+    type Event = AppEvent;
+
+    fn new(
+        mut ui_state: DesktopUiState,
+        rsc: &mut DesktopRsc<Self>,
+        proxy: Proxy<AppEvent>,
+    ) -> Self {
+        let (server, ca_pem) = super::startup::load_startup_config().unwrap_or_else(|e| {
+            eprintln!("desktop-app: {e}");
+            process::exit(2);
+        });
+        let build_transport =
+            || UreqTransport::new(server.base_url(), server.token.clone(), &ca_pem);
+        let (rest_transport, stream_transport) = build_transport()
+            .and_then(|rest| build_transport().map(|stream| (rest, stream)))
+            .unwrap_or_else(|e| {
+                eprintln!(
+                    "desktop-app: couldn't set up TLS to {}: {e}",
+                    server.base_url()
+                );
+                process::exit(1);
+            });
+        let api = Arc::new(ApiClient::new(rest_transport));
+        let stream_transport = Arc::new(stream_transport);
+
+        let list_ptr = WidgetPtr::new().add(rsc);
+        let transcript_ptr = WidgetPtr::new().add(rsc);
+        let loading = placeholder(rsc, "Loading sessions...");
+        transcript_ptr(rsc).set(loading);
+
+        (list_ptr.width(LIST_WIDTH), transcript_ptr.width(rest(1)))
+            .span(Dir::RIGHT)
+            .set_root(rsc, &mut ui_state);
+
+        let client = Self {
+            ui_state,
+            api,
+            stream_transport,
+            proxy,
+            sessions: Vec::new(),
+            selected: None,
+            items: Vec::new(),
+            list_ptr,
+            transcript_ptr,
+            screen: None,
+            generation: Arc::new(AtomicU64::new(0)),
+        };
+        client.spawn_fetch_sessions();
+        client
+    }
+
+    fn event(&mut self, event: AppEvent, rsc: &mut DesktopRsc<Self>) {
+        match event {
+            AppEvent::Sessions(Ok(sessions)) => {
+                self.sessions = sessions;
+                self.rebuild_list(rsc);
+                if self.selected.is_none() {
+                    self.show_message(rsc, "Select a session.");
+                }
+            }
+            AppEvent::Sessions(Err(message)) => {
+                self.show_message(rsc, &format!("Couldn't list sessions: {message}"));
+            }
+            AppEvent::TranscriptLoaded {
+                session_id,
+                generation,
+                result,
+            } => {
+                if self.current(&session_id, generation) {
+                    match result {
+                        Ok(items) => {
+                            self.items = items;
+                            self.rebuild_transcript(rsc);
+                        }
+                        Err(message) => {
+                            self.show_message(
+                                rsc,
+                                &format!("Couldn't load {session_id}: {message}"),
+                            );
+                        }
+                    }
+                }
+            }
+            AppEvent::StreamEvent {
+                session_id,
+                generation,
+                event,
+            } => {
+                if self.current(&session_id, generation) {
+                    let old_items = self.items.clone();
+                    self.items = fold_event(&self.items, &event);
+                    match self.screen.as_mut() {
+                        Some(screen) => screen.apply(rsc, &old_items, &self.items),
+                        None => self.rebuild_transcript(rsc),
+                    }
+                }
+            }
+            AppEvent::StreamEnded {
+                session_id,
+                generation,
+                message: Some(message),
+            } => {
+                if self.current(&session_id, generation) {
+                    eprintln!("desktop-app: {session_id}'s live connection ended: {message}");
+                }
+            }
+            AppEvent::StreamEnded { .. } => {}
+            AppEvent::SendFailed(message) => {
+                eprintln!("desktop-app: couldn't send: {message}");
+            }
+        }
+        self.ui_state.window.request_redraw();
+    }
+}
+
+impl Client {
+    fn current(&self, session_id: &str, generation: u64) -> bool {
+        self.selected.as_deref() == Some(session_id)
+            && self.generation.load(Ordering::SeqCst) == generation
+    }
+
+    fn show_message(&mut self, rsc: &mut DesktopRsc<Self>, message: &str) {
+        let widget = placeholder(rsc, message);
+        (self.transcript_ptr)(rsc).set(widget);
+    }
+
+    fn spawn_fetch_sessions(&self) {
+        let api = self.api.clone();
+        let proxy = self.proxy.clone();
+        thread::spawn(move || {
+            let result = api.fetch_sessions().map_err(|e| e.to_string());
+            let _ = proxy.send_event(AppEvent::Sessions(result));
+        });
+    }
+
+    fn rebuild_list(&mut self, rsc: &mut DesktopRsc<Self>) {
+        let list = Span::empty(Dir::DOWN).gap(2).add(rsc);
+        for session in &self.sessions {
+            let selected = self.selected.as_deref() == Some(session.id.as_str());
+            let row = session_row(rsc, session, selected);
+            list(rsc).push(row);
+        }
+        let tree = list
+            .background(rect(Srgba8::rgb(24, 24, 28)))
+            .add_strong(rsc)
+            .any();
+        (self.list_ptr)(rsc).set(tree);
+    }
+
+    fn select_session(&mut self, rsc: &mut DesktopRsc<Self>, session_id: String) {
+        let generation = self.generation.fetch_add(1, Ordering::SeqCst) + 1;
+        self.selected = Some(session_id.clone());
+        self.items.clear();
+        self.screen = None;
+        self.rebuild_list(rsc);
+        self.show_message(rsc, "Loading transcript...");
+
+        let api = self.api.clone();
+        let stream_transport = self.stream_transport.clone();
+        let proxy = self.proxy.clone();
+        let live_generation = self.generation.clone();
+        thread::spawn(move || {
+            let page: Result<Vec<serde_json::Value>, String> = api
+                .fetch_transcript_page(&session_id, None, 200, true)
+                .map_err(|e| e.to_string());
+            let after = page
+                .as_ref()
+                .ok()
+                .and_then(|values| raw_seq(values.last()?))
+                .unwrap_or(0);
+            let result = page.and_then(|values| fold_page(&values));
+            let _ = proxy.send_event(AppEvent::TranscriptLoaded {
+                session_id: session_id.clone(),
+                generation,
+                result,
+            });
+
+            let stop = || live_generation.load(Ordering::SeqCst) != generation;
+            if stop() {
+                return;
+            }
+            let outcome =
+                follow_session_events(&*stream_transport, &session_id, after, |item| match item {
+                    StreamItem::Open | StreamItem::Reset => !stop(),
+                    StreamItem::Event { event, .. } => {
+                        if stop() {
+                            return false;
+                        }
+                        let _ = proxy.send_event(AppEvent::StreamEvent {
+                            session_id: session_id.clone(),
+                            generation,
+                            event,
+                        });
+                        true
+                    }
+                });
+            let _ = proxy.send_event(AppEvent::StreamEnded {
+                session_id,
+                generation,
+                message: outcome.err().map(|e| e.to_string()),
+            });
+        });
+    }
+
+    fn send_message(&mut self, session_id: String, text: String) {
+        let api = self.api.clone();
+        let proxy = self.proxy.clone();
+        thread::spawn(move || {
+            if let Err(e) = api.send_message(&session_id, &text, &[]) {
+                let _ = proxy.send_event(AppEvent::SendFailed(e.to_string()));
+            }
+        });
+    }
+
+    fn rebuild_transcript(&mut self, rsc: &mut DesktopRsc<Self>) {
+        let in_progress = self
+            .screen
+            .as_ref()
+            .map(|screen| screen.composer.field.edit(rsc).text.text().to_string())
+            .filter(|t| !t.is_empty());
+
+        let rows = group_tool_runs(&self.items);
+        let (screen, tree) = crate::ui::build_tree(rsc, rows);
+
+        if let Some(text) = in_progress {
+            screen.composer.field.edit(rsc).set(&text);
+        }
+        if let Some(session_id) = self.selected.clone() {
+            let field = screen.composer.field;
+            rsc.register_event(field, Submit, move |ctx, rsc| {
+                let text = field.edit(rsc).take();
+                let text = text.trim().to_string();
+                if !text.is_empty() {
+                    ctx.state.send_message(session_id.clone(), text);
+                }
+            });
+        }
+
+        (self.transcript_ptr)(rsc).set(tree);
+        self.screen = Some(screen);
+    }
+}
+
+fn session_row(
+    rsc: &mut DesktopRsc<Client>,
+    session: &SessionSummary,
+    selected: bool,
+) -> StrongWidget {
+    let bg = if selected {
+        Srgba8::rgb(58, 90, 138)
+    } else {
+        Srgba8::rgb(38, 38, 44)
+    };
+    let id = session.id.clone();
+    let label = format!("{}\n{}", session.title, session.status);
+    wtext(label)
+        .color(PaintId::WHITE)
+        .wrap(true)
+        .pad(10)
+        .width(rest(1))
+        .background(rect(bg))
+        .on(
+            CursorSense::click(),
+            move |ctx, rsc: &mut DesktopRsc<Client>| {
+                ctx.state.select_session(rsc, id.clone());
+            },
+        )
+        .add_strong(rsc)
+        .any()
+}
+
+fn placeholder(rsc: &mut DesktopRsc<Client>, message: &str) -> StrongWidget {
+    wtext(message.to_string())
+        .color(PaintId::WHITE)
+        .wrap(true)
+        .pad(16)
+        .add_strong(rsc)
+        .any()
+}

app/src/desktop/config.rs

@@ -0,0 +1,16 @@
+use crate::client::config::EnrollmentStore;
+use std::path::PathBuf;
+
+pub fn config_dir() -> PathBuf {
+    let base = std::env::var_os("XDG_CONFIG_HOME")
+        .map(PathBuf::from)
+        .unwrap_or_else(|| {
+            let home = std::env::var_os("HOME").expect("HOME must be set");
+            PathBuf::from(home).join(".config")
+        });
+    base.join("ai-app-desktop")
+}
+
+pub fn store() -> EnrollmentStore {
+    EnrollmentStore::new(config_dir())
+}

app/src/desktop/mod.rs

@@ -0,0 +1,3 @@
+pub mod app;
+pub mod config;
+pub mod startup;

app/src/desktop/startup.rs

@@ -0,0 +1,67 @@
+//! The desktop binary's command line and the enrolment it resolves --
+//! `--link`/`--ca`, parsed once at startup and again from `app.rs`'s
+//! `Client::new`. Here rather than in `src/bin_desktop.rs` because both
+//! callers are in the library; the binary is only `fn main`.
+
+use crate::client::config::EnrolledServer;
+use std::{env, fs, path::PathBuf};
+
+use super::config;
+
+struct Args {
+    ca_path: Option<PathBuf>,
+    link: Option<String>,
+}
+
+fn parse_args() -> Result<Args, String> {
+    let mut ca_path = None;
+    let mut link = None;
+    let mut args = env::args().skip(1);
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--ca" => ca_path = Some(PathBuf::from(args.next().ok_or("--ca needs a path")?)),
+            "--link" => link = Some(args.next().ok_or("--link needs a value")?),
+            other => return Err(format!("unrecognised argument '{other}'")),
+        }
+    }
+    Ok(Args { ca_path, link })
+}
+
+pub fn load_startup_config() -> Result<(EnrolledServer, Vec<u8>), String> {
+    let args = parse_args()?;
+    let store = config::store();
+    let server = match args.link {
+        Some(link) => {
+            let server = EnrolledServer::parse_link(&link)?;
+            store
+                .save(&server)
+                .map_err(|e| format!("couldn't save the enrollment: {e}"))?;
+            server
+        }
+        None => store
+            .load()
+            .map_err(|e| format!("couldn't read the saved enrollment: {e}"))?
+            .ok_or_else(|| {
+                format!(
+                    "no server enrolled yet under {} -- pass --link 'aiapp://enroll?...' \
+                     once (app/ui-sandbox.sh's start banner prints one)",
+                    config::config_dir().display()
+                )
+            })?,
+    };
+    // `--ca` wins where it was given, so a caller can point a link's
+    // server at a certificate it did not carry -- and so the flag still
+    // means what it did before the link could carry one.
+    let ca_pem = match (&args.ca_path, &server.ca_pem) {
+        (Some(path), _) => fs::read(path)
+            .map_err(|e| format!("couldn't read the CA at {}: {e}", path.display()))?,
+        (None, Some(pem)) => pem.clone().into_bytes(),
+        (None, None) => {
+            return Err("this enrollment carries no CA -- pass --ca PATH (e.g. \
+                 ~/.config/ai-app/certs/ca.pem), or enrol again with a link \
+                 minted by a server that includes one"
+                .to_string());
+        }
+    };
+    Ok((server, ca_pem))
+}

app/src/lib.rs

@@ -0,0 +1,10 @@
+pub mod client;
+
+#[cfg(feature = "screens")]
+pub mod ui;
+
+#[cfg(all(feature = "screens", not(target_os = "android")))]
+pub mod desktop;
+
+#[cfg(all(feature = "screens", target_os = "android"))]
+pub mod android;

app/src/ui/composer.rs

@@ -0,0 +1,82 @@
+use crate::ui::theme::Theme;
+use iris::prelude::*;
+
+const MAX_LINES: f32 = 6.0;
+const APPROX_LINE_HEIGHT_DP: f32 = 24.0;
+const FIELD_PAD_DP: f32 = 12.0;
+
+/// `field` is exposed so the caller can read its content on submit
+/// (`field.edit(rsc).text()`) and clear it afterward
+/// (`field.edit(rsc).set("")`).
+pub struct Composer {
+    pub field: WeakWidget<TextEdit>,
+    /// The bar's own outer padding -- only `bottom` is ever changed, by
+    /// [`Self::set_bottom_inset`]. A `Pad` around the whole bar rather than
+    /// a rebuilt tree, because `field` lives inside it and cannot be
+    /// re-added to a new wrapper once it is strongly owned here.
+    outer_pad: WeakWidget<Pad>,
+}
+
+pub struct BuiltComposer {
+    pub composer: Composer,
+    pub widget: WeakWidget,
+}
+
+impl Composer {
+    /// Called by the platform shell (Android's `on_insets_changed`, e.g.)
+    /// whenever the space below the bar changes: the IME's own inset while
+    /// it is open, the navigation-bar inset otherwise. Takes a plain
+    /// `f32` in the caller's own physical-pixel units rather than an
+    /// Android-specific insets type, so this crate stays usable from the
+    /// winit backend too, which has no navigation bar to report.
+    /// Rewrites the existing `Pad` in place (marking it dirty through the
+    /// ordinary `Widgets::get_mut` path) instead of swapping in a new one,
+    /// so the field's focus, selection and in-progress text are untouched.
+    pub fn set_bottom_inset(&self, rsc: &mut impl UiRsc, inset: f32) {
+        if let Some(pad) = rsc.ui_mut().widgets.get_mut(&self.outer_pad) {
+            pad.padding.bottom = Len::abs(inset);
+            pad.exact_region = true;
+        }
+    }
+}
+
+/// Returns the composer plus its own bar as a **weak** id -- the caller
+/// (`lib.rs::build`) embeds it in the screen's own top-level tuple, whose
+/// `set_root` performs the one real strong registration. Calling
+/// `.add_strong`/`.upgrade` a second time on an id already strong-owned
+/// panics ("was already added", `core/src/widget/like.rs:12`) -- the same
+/// mistake this box's `row.rs` first made with its sender-label header, see
+/// that file's comment for the fuller account.
+pub fn build_composer<Rsc: HasEvents>(rsc: &mut Rsc, theme: &Theme) -> BuiltComposer
+where
+    Rsc::State: FocusHost,
+{
+    let field = wtext("")
+        .editable(EditMode::MultiLine)
+        .text_align(Align::LEFT)
+        .wrap(true)
+        .size(18)
+        .color(theme.text.clone())
+        .attr::<Selectable>(())
+        .label("Message")
+        .add(rsc);
+
+    // Without any mask at all the overflow paints *above* the bar, over
+    // the transcript: measured at 58px of stray text for a 475px message
+    // in a 417px box.
+    let content = field
+        .width(rest(1))
+        .scrollable(Axis::Y, Pin::End)
+        .pad(dp(FIELD_PAD_DP))
+        .max_height(dp(APPROX_LINE_HEIGHT_DP * MAX_LINES + FIELD_PAD_DP * 2.0))
+        .width(rest(1))
+        .masked_by(rect(theme.composer_surface.clone()))
+        .add(rsc);
+
+    let outer_pad: WeakWidget<Pad> = content.pad(Padding::ZERO).add(rsc);
+
+    BuiltComposer {
+        composer: Composer { field, outer_pad },
+        widget: outer_pad,
+    }
+}

app/src/ui/fixture.rs

@@ -0,0 +1,129 @@
+use crate::client::transcript_fold::{TranscriptItem, TranscriptRow, fold_page, group_tool_runs};
+use event_model::SeqEvent;
+use iris::prelude::*;
+
+pub const BACKLOG_COUNT: usize = 3202;
+
+const FIXTURE_JSONL: &str = include_str!("../../bench-fixture/assets/transcript.jsonl");
+
+pub const PHONE_WIDTH: f32 = 1080.0;
+pub const PHONE_HEIGHT: f32 = 2424.0;
+pub const PHONE_SCALE: f32 = 2.55;
+pub const PHONE_FRAME_MS: u64 = 8;
+
+pub fn phone_size() -> Vec2 {
+    Vec2::new(PHONE_WIDTH, PHONE_HEIGHT)
+}
+
+pub struct Fixture {
+    pub backlog: Vec<serde_json::Value>,
+    pub stream_tail: Vec<SeqEvent>,
+}
+
+impl Fixture {
+    /// Parses the whole fixture. Panics on malformed input: this is a
+    /// generated file compiled into the binary, so a parse failure is a
+    /// broken build rather than a condition a caller could recover from
+    /// (CODE_RULES: separate recoverable conditions from programmer
+    /// error).
+    pub fn parse() -> Self {
+        let mut backlog = Vec::with_capacity(BACKLOG_COUNT);
+        let mut stream_tail = Vec::new();
+        for (i, line) in FIXTURE_JSONL
+            .lines()
+            .filter(|line| !line.trim().is_empty())
+            .enumerate()
+        {
+            let value: serde_json::Value =
+                serde_json::from_str(line).expect("bench fixture is generated JSON, always valid");
+            if i < BACKLOG_COUNT {
+                backlog.push(value);
+            } else {
+                stream_tail.push(
+                    serde_json::from_value(value)
+                        .expect("bench fixture event matches event-model's SeqEvent"),
+                );
+            }
+        }
+        Self {
+            backlog,
+            stream_tail,
+        }
+    }
+
+    /// The opening page folded into transcript items -- the same
+    /// `fold_page` a real first load runs. `Err` carries the fold's own
+    /// message, which a caller shows on screen rather than panicking, so
+    /// a fixture that stops folding is visible in the app instead of
+    /// being a crash on launch.
+    pub fn backlog_items(&self) -> Result<Vec<TranscriptItem>, String> {
+        fold_page(&self.backlog)
+    }
+}
+
+pub fn rows(items: &[TranscriptItem]) -> Vec<TranscriptRow> {
+    group_tool_runs(items)
+}
+
+/// Everything a caller needs to run the fixture as an app screen would:
+/// the screen, the folded items behind it, and the events not yet
+/// streamed. The tree itself comes back separately from
+/// [`build_screen`], since whoever takes it owns it.
+pub struct Opened {
+    pub screen: crate::ui::TranscriptScreen,
+    pub items: Vec<TranscriptItem>,
+    /// The tail, for a caller that goes on replaying it one event at a
+    /// time through `fold_event`/`TranscriptScreen::apply` -- the
+    /// streaming phase of either app's benchmark.
+    pub stream_tail: Vec<SeqEvent>,
+}
+
+/// Build the transcript screen over the fixture's opening page, without
+/// claiming the window's root -- `crate::ui::build_tree`'s own split,
+/// for a caller (the Android bench) that puts the screen inside a shell
+/// of its own.
+pub fn build_screen<Rsc: HasEvents>(rsc: &mut Rsc) -> Result<(Opened, StrongWidget), String>
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let fixture = Fixture::parse();
+    let items = fixture.backlog_items()?;
+    let (screen, tree) = crate::ui::build_tree(rsc, rows(&items));
+    Ok((
+        Opened {
+            screen,
+            items,
+            stream_tail: fixture.stream_tail,
+        },
+        tree,
+    ))
+}
+
+pub fn open<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    ui_state: &mut impl HasRoot<Rsc>,
+) -> Result<Opened, String>
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let (opened, tree) = build_screen(rsc)?;
+    ui_state.set_root(rsc, tree);
+    Ok(opened)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_fixture_has_a_backlog_and_a_streaming_tail() {
+        let fixture = Fixture::parse();
+        assert_eq!(fixture.backlog.len(), BACKLOG_COUNT);
+        assert!(
+            fixture.stream_tail.len() >= 400,
+            "the stream phase replays 400 events; the fixture has {}",
+            fixture.stream_tail.len()
+        );
+        assert!(!fixture.backlog_items().expect("the page folds").is_empty());
+    }
+}

app/src/ui/markdown.rs

@@ -0,0 +1,644 @@
+use crate::client::highlight::{self, Kind, Language};
+use crate::client::markdown_blocks::{Block, BlockKind};
+use crate::ui::theme::Theme;
+use iris::prelude::*;
+use pulldown_cmark::{CodeBlockKind, Event, HeadingLevel, Options, Parser, Tag, TagEnd};
+use std::ops::Range;
+
+fn syntax_color(kind: Kind, theme: &Theme) -> PaintId {
+    match kind {
+        Kind::Keyword => theme.syntax_keyword.clone(),
+        Kind::String => theme.syntax_string.clone(),
+        Kind::Literal => theme.syntax_literal.clone(),
+        Kind::Comment => theme.syntax_comment.clone(),
+        Kind::Metadata => theme.syntax_metadata.clone(),
+        Kind::Punctuation => theme.syntax_punctuation.clone(),
+        Kind::Mark => theme.syntax_mark.clone(),
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum BlockFrame {
+    Plain,
+    Verbatim { fill: PaintId },
+    Quote,
+}
+
+pub fn frame_of(kind: BlockKind, theme: &Theme) -> BlockFrame {
+    match kind {
+        BlockKind::Code => BlockFrame::Verbatim {
+            fill: theme.verbatim_surface.clone(),
+        },
+        BlockKind::Table => BlockFrame::Verbatim {
+            fill: theme.table_surface.clone(),
+        },
+        BlockKind::Quote => BlockFrame::Quote,
+        BlockKind::Paragraph | BlockKind::Heading | BlockKind::List | BlockKind::Other => {
+            BlockFrame::Plain
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Link {
+    pub range: Range<usize>,
+    pub url: String,
+}
+
+#[derive(Clone, Default)]
+pub struct Rendered {
+    pub text: String,
+    pub spans: Vec<SpanStyle>,
+    pub links: Vec<Link>,
+}
+
+impl Rendered {
+    pub fn link_at(&self, byte: usize) -> Option<&Link> {
+        self.links.iter().find(|l| l.range.contains(&byte))
+    }
+}
+
+/// The heading ladder, in points at a 16pt body: it starts near the body
+/// text and descends, because these are headings inside a chat message
+/// rather than the top of a document. The numbers are Material's
+/// `headlineSmall`/`titleLarge`/`titleMedium`/`titleSmall`/`labelMedium`/
+/// `labelSmall`, which is what `Markdown.kt`'s `markdownTypography` picks
+/// -- kept as literals rather than derived from `base_size` so the two
+/// apps agree exactly.
+fn heading_size(level: HeadingLevel) -> f32 {
+    match level {
+        HeadingLevel::H1 => 24.0,
+        HeadingLevel::H2 => 22.0,
+        HeadingLevel::H3 => 16.0,
+        HeadingLevel::H4 => 14.0,
+        HeadingLevel::H5 => 12.0,
+        HeadingLevel::H6 => 11.0,
+    }
+}
+
+const BULLETS: [&str; 3] = ["\u{2022} ", "\u{25e6} ", "\u{25aa} "];
+
+/// A block-level separator inside one block's own text (a list item's
+/// paragraphs, a quote's): two never run into each other with no gap, but
+/// an empty `out` gets no leading blank.
+fn ensure_blank_line(out: &mut String) {
+    if !out.is_empty() && !out.ends_with("\n\n") {
+        while out.ends_with('\n') {
+            out.pop();
+        }
+        out.push_str("\n\n");
+    }
+}
+
+fn ensure_line(out: &mut String) {
+    if !out.is_empty() && !out.ends_with('\n') {
+        out.push('\n');
+    }
+}
+
+pub fn render_block(block: &Block, base_size: f32, theme: &Theme) -> Rendered {
+    match block.kind {
+        BlockKind::Table => table_text(&block.source, theme),
+        _ => render_markdown(&block.source, base_size, theme),
+    }
+}
+
+/// One markdown source string rendered into plain text plus the spans that
+/// style it. `base_size` is the row's ordinary paragraph font size, needed
+/// only so a heading's override is relative to it rather than a hardcoded
+/// absolute the caller cannot retune.
+pub fn render_markdown(src: &str, base_size: f32, theme: &Theme) -> Rendered {
+    let _ = base_size; // headings use the fixed Material ladder; see `heading_size`
+    let mut out = String::new();
+    let mut spans = Vec::new();
+    let mut links = Vec::new();
+    // Stack of start byte offsets for whatever inline/block styling is
+    // currently open -- pulldown-cmark's `Start`/`End` events are always
+    // balanced and each `End` already names its own kind (`TagEnd`), so a
+    // plain offset stack (rather than a tree, or repeating the kind here
+    // too) is enough. A link's destination rides along beside its offset,
+    // since `TagEnd::Link` does not carry it.
+    let mut open: Vec<(usize, Option<String>)> = Vec::new();
+    // One entry per open list: `Some(next number)` for an ordered list,
+    // `None` for a bulleted one. Depth is this vector's length, which is
+    // what picks the bullet glyph.
+    let mut lists: Vec<Option<u64>> = Vec::new();
+    let mut fence_language: Option<Language> = None;
+
+    let parser = Parser::new_ext(src, options());
+    for event in parser {
+        match event {
+            Event::Start(tag) => match tag {
+                Tag::Heading { .. }
+                | Tag::Emphasis
+                | Tag::Strong
+                | Tag::Strikethrough
+                | Tag::Image { .. } => open.push((out.len(), None)),
+                Tag::Link { dest_url, .. } => open.push((out.len(), Some(dest_url.to_string()))),
+                Tag::CodeBlock(kind) => {
+                    fence_language = match &kind {
+                        CodeBlockKind::Fenced(info) => {
+                            highlight::fence_language(info.split_whitespace().next())
+                        }
+                        CodeBlockKind::Indented => None,
+                    };
+                    ensure_blank_line(&mut out);
+                    open.push((out.len(), None));
+                }
+                Tag::Item => {
+                    ensure_line(&mut out);
+                    let depth = lists.len().max(1);
+                    out.push_str(&"    ".repeat(depth - 1));
+                    let start = out.len();
+                    match lists.last_mut() {
+                        Some(Some(n)) => {
+                            out.push_str(&format!("{n}. "));
+                            *n += 1;
+                        }
+                        _ => out.push_str(BULLETS[(depth - 1) % BULLETS.len()]),
+                    }
+                    spans.push(SpanStyle::new(start..out.len()).color(theme.marker.clone()));
+                }
+                Tag::List(first) => lists.push(first),
+                Tag::Paragraph | Tag::BlockQuote(_) => ensure_blank_line(&mut out),
+                _ => {}
+            },
+            Event::End(
+                tag_end @ (TagEnd::Heading(_)
+                | TagEnd::Emphasis
+                | TagEnd::Strong
+                | TagEnd::Strikethrough
+                | TagEnd::Link
+                | TagEnd::Image
+                | TagEnd::CodeBlock),
+            ) => {
+                let Some((start, dest)) = open.pop() else {
+                    continue;
+                };
+                if matches!(tag_end, TagEnd::CodeBlock) {
+                    while out.ends_with('\n') {
+                        out.pop();
+                    }
+                }
+                let range = start..out.len();
+                if range.is_empty() {
+                    continue;
+                }
+                match tag_end {
+                    TagEnd::Heading(level) => {
+                        spans.push(SpanStyle::new(range).font_size(heading_size(level)).bold());
+                    }
+                    TagEnd::Emphasis => spans.push(SpanStyle::new(range).italic()),
+                    TagEnd::Strong => spans.push(SpanStyle::new(range).bold()),
+                    TagEnd::Strikethrough => {
+                        spans.push(SpanStyle::new(range).color(theme.strikethrough.clone()));
+                    }
+                    // An image draws as its alt text until the port has a
+                    // transcript image widget (IRIS_TODO's "scaled
+                    // thumbnail"); marked as a link so it is at least
+                    // followable rather than silently inert.
+                    TagEnd::Link | TagEnd::Image => {
+                        spans.push(
+                            SpanStyle::new(range.clone())
+                                .color(theme.link.clone())
+                                .underline(),
+                        );
+                        if let Some(url) = dest {
+                            links.push(Link { range, url });
+                        }
+                    }
+                    TagEnd::CodeBlock => {
+                        spans.push(
+                            SpanStyle::new(range.clone())
+                                .family(Family::Monospace)
+                                .color(theme.code.clone()),
+                        );
+                        if let Some(language) = fence_language.take() {
+                            highlight_into(&mut spans, &out, range, language, theme);
+                        }
+                    }
+                    _ => unreachable!("filtered by the outer match arm"),
+                }
+            }
+            Event::Text(text) => out.push_str(&text),
+            Event::Code(text) => {
+                let start = out.len();
+                out.push_str(&text);
+                spans.push(
+                    SpanStyle::new(start..out.len())
+                        .family(Family::Monospace)
+                        .color(theme.code.clone()),
+                );
+            }
+            Event::SoftBreak => out.push(' '),
+            Event::HardBreak => out.push('\n'),
+            Event::Rule => {
+                ensure_line(&mut out);
+                out.push_str("\u{2500}\u{2500}\u{2500}\n");
+            }
+            Event::TaskListMarker(done) => {
+                let start = out.len();
+                out.push_str(if done { "[x] " } else { "[ ] " });
+                spans.push(SpanStyle::new(start..out.len()).color(theme.marker.clone()));
+            }
+            Event::End(TagEnd::List(_)) => {
+                lists.pop();
+            }
+            _ => {}
+        }
+    }
+    while out.ends_with('\n') {
+        out.pop();
+    }
+    spans.retain(|s| s.range.end <= out.len());
+    links.retain(|l| l.range.end <= out.len());
+    Rendered {
+        text: out,
+        spans,
+        links,
+    }
+}
+
+fn options() -> Options {
+    Options::ENABLE_STRIKETHROUGH | Options::ENABLE_TABLES | Options::ENABLE_TASKLISTS
+}
+
+pub(crate) fn highlight_into(
+    spans: &mut Vec<SpanStyle>,
+    text: &str,
+    range: Range<usize>,
+    language: Language,
+    theme: &Theme,
+) {
+    let code = &text[range.clone()];
+    // char index -> byte offset within `code`, plus the end, so a span's
+    // `end` is always in range.
+    let bytes: Vec<usize> = code
+        .char_indices()
+        .map(|(i, _)| i)
+        .chain(std::iter::once(code.len()))
+        .collect();
+    for span in highlight::spans_of(code, language) {
+        let (Some(&start), Some(&end)) = (bytes.get(span.start), bytes.get(span.end)) else {
+            debug_assert!(
+                false,
+                "highlight span {}..{} outside {} chars of code",
+                span.start,
+                span.end,
+                bytes.len() - 1
+            );
+            continue;
+        };
+        spans.push(
+            SpanStyle::new(range.start + start..range.start + end)
+                .family(Family::Monospace)
+                .color(syntax_color(span.kind, theme)),
+        );
+    }
+}
+
+const TABLE_MAX_COL: usize = 28;
+
+pub fn table_text(src: &str, theme: &Theme) -> Rendered {
+    let rows = table_cells(src);
+    if rows.is_empty() {
+        return Rendered::default();
+    }
+    let columns = rows.iter().map(Vec::len).max().unwrap_or(0);
+    let wrapped: Vec<Vec<Vec<String>>> = rows
+        .iter()
+        .map(|row| row.iter().map(|c| wrap_cell(c, TABLE_MAX_COL)).collect())
+        .collect();
+    let widths: Vec<usize> = (0..columns)
+        .map(|c| {
+            wrapped
+                .iter()
+                .filter_map(|row| row.get(c))
+                .flat_map(|lines| lines.iter())
+                .map(|l| l.chars().count())
+                .max()
+                .unwrap_or(0)
+        })
+        .collect();
+
+    let mut out = String::new();
+    let mut spans = Vec::new();
+    for (r, row) in wrapped.iter().enumerate() {
+        let height = row.iter().map(Vec::len).max().unwrap_or(1);
+        let start = out.len();
+        for line in 0..height {
+            if !out.is_empty() {
+                out.push('\n');
+            }
+            for (c, width) in widths.iter().enumerate() {
+                if c > 0 {
+                    out.push_str("  ");
+                }
+                let text = row.get(c).and_then(|l| l.get(line)).map(String::as_str);
+                let text = text.unwrap_or("");
+                out.push_str(text);
+                if c + 1 < widths.len() {
+                    for _ in text.chars().count()..*width {
+                        out.push(' ');
+                    }
+                }
+            }
+        }
+        if r == 0 {
+            spans.push(SpanStyle::new(start..out.len()).bold());
+            out.push('\n');
+            let rule: usize = widths.iter().sum::<usize>() + 2 * widths.len().saturating_sub(1);
+            let rule_start = out.len();
+            out.extend(std::iter::repeat_n('\u{2500}', rule));
+            spans.push(SpanStyle::new(rule_start..out.len()).color(theme.quote_bar.clone()));
+        }
+    }
+    Rendered {
+        text: out,
+        spans,
+        links: Vec::new(),
+    }
+}
+
+fn table_cells(src: &str) -> Vec<Vec<String>> {
+    let mut rows: Vec<Vec<String>> = Vec::new();
+    let mut cell = String::new();
+    let mut in_cell = false;
+    for event in Parser::new_ext(src, options()) {
+        match event {
+            Event::Start(Tag::TableHead) | Event::Start(Tag::TableRow) => rows.push(Vec::new()),
+            Event::Start(Tag::TableCell) => {
+                cell.clear();
+                in_cell = true;
+            }
+            Event::End(TagEnd::TableCell) => {
+                in_cell = false;
+                if let Some(row) = rows.last_mut() {
+                    row.push(cell.trim().to_string());
+                }
+            }
+            Event::Text(text) | Event::Code(text) if in_cell => cell.push_str(&text),
+            Event::SoftBreak | Event::HardBreak if in_cell => cell.push(' '),
+            _ => {}
+        }
+    }
+    rows.retain(|r| !r.is_empty());
+    rows
+}
+
+fn wrap_cell(text: &str, width: usize) -> Vec<String> {
+    let mut lines = Vec::new();
+    let mut line = String::new();
+    for word in text.split_whitespace() {
+        let extra = if line.is_empty() { 0 } else { 1 };
+        if !line.is_empty() && line.chars().count() + extra + word.chars().count() > width {
+            lines.push(std::mem::take(&mut line));
+        }
+        if !line.is_empty() {
+            line.push(' ');
+        }
+        line.push_str(word);
+    }
+    lines.push(line);
+    lines
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::client::markdown_blocks::split_blocks;
+
+    fn with_theme<T>(f: impl FnOnce(&Theme) -> T) -> T {
+        let mut paints = Paints::new();
+        let theme = Theme::new(&mut paints);
+        f(&theme)
+    }
+
+    fn render_markdown(src: &str, base_size: f32) -> Rendered {
+        with_theme(|theme| super::render_markdown(src, base_size, theme))
+    }
+
+    fn render_block(block: &Block, base_size: f32) -> Rendered {
+        with_theme(|theme| super::render_block(block, base_size, theme))
+    }
+
+    fn frame_of(kind: BlockKind) -> BlockFrame {
+        with_theme(|theme| super::frame_of(kind, theme))
+    }
+
+    fn syntax_color(kind: Kind) -> PaintId {
+        with_theme(|theme| super::syntax_color(kind, theme))
+    }
+
+    fn code_color() -> PaintId {
+        with_theme(|theme| theme.code.clone())
+    }
+
+    fn marker_color() -> PaintId {
+        with_theme(|theme| theme.marker.clone())
+    }
+
+    fn block(src: &str) -> Rendered {
+        let blocks = split_blocks(src);
+        assert_eq!(blocks.len(), 1, "test wants exactly one block: {blocks:?}");
+        render_block(&blocks[0], 16.0)
+    }
+
+    #[test]
+    fn plain_paragraph_has_no_spans() {
+        let r = render_markdown("just some words", 16.0);
+        assert_eq!(r.text, "just some words");
+        assert!(r.spans.is_empty());
+    }
+
+    #[test]
+    fn bold_and_italic_produce_spans_over_the_right_range() {
+        let r = render_markdown("a **bold** and *italic* word", 16.0);
+        assert_eq!(r.text, "a bold and italic word");
+        let bold = r.spans.iter().find(|s| s.bold && !s.italic).unwrap();
+        assert_eq!(&r.text[bold.range.clone()], "bold");
+        let italic = r.spans.iter().find(|s| s.italic).unwrap();
+        assert_eq!(&r.text[italic.range.clone()], "italic");
+    }
+
+    #[test]
+    fn heading_gets_a_bigger_font_size_span() {
+        let r = render_markdown("# A Title", 16.0);
+        assert!(r.text.starts_with("A Title"));
+        let heading = r.spans.iter().find(|s| s.font_size.is_some()).unwrap();
+        assert_eq!(&r.text[heading.range.clone()], "A Title");
+        assert_eq!(heading.font_size, Some(24.0));
+    }
+
+    #[test]
+    fn every_heading_level_is_a_different_size() {
+        let mut sizes = Vec::new();
+        for level in 1..=6 {
+            let src = format!("{} h", "#".repeat(level));
+            let r = render_markdown(&src, 16.0);
+            sizes.push(r.spans.iter().find_map(|s| s.font_size).unwrap());
+        }
+        let mut sorted = sizes.clone();
+        sorted.sort_by(|a, b| b.partial_cmp(a).unwrap());
+        sorted.dedup();
+        assert_eq!(sizes, sorted, "the ladder must descend with no repeats");
+    }
+
+    #[test]
+    fn a_link_keeps_its_text_and_its_url_and_can_be_hit() {
+        let r = render_markdown("see [the docs](https://example.com) for more", 16.0);
+        assert!(r.text.contains("the docs"));
+        assert!(
+            !r.text.contains("example.com"),
+            "the URL should not leak into the visible text"
+        );
+        let link = r.spans.iter().find(|s| s.underline).unwrap();
+        assert_eq!(&r.text[link.range.clone()], "the docs");
+        let at = r.text.find("docs").unwrap();
+        assert_eq!(r.link_at(at).unwrap().url, "https://example.com");
+        assert!(r.link_at(0).is_none(), "the word 'see' is not the link");
+        let past = r.text.find("for").unwrap();
+        assert!(r.link_at(past).is_none());
+    }
+
+    #[test]
+    fn fenced_code_block_is_monospaced_and_highlighted_by_its_language() {
+        let r = block("```rust\nlet x = 1; // note\n```");
+        assert_eq!(r.text, "let x = 1; // note");
+        let keyword = r
+            .spans
+            .iter()
+            .find(|s| s.color == Some(syntax_color(Kind::Keyword)))
+            .expect("a rust fence colours its keywords");
+        assert_eq!(&r.text[keyword.range.clone()], "let");
+        let comment = r
+            .spans
+            .iter()
+            .find(|s| s.color == Some(syntax_color(Kind::Comment)))
+            .unwrap();
+        assert_eq!(&r.text[comment.range.clone()], "// note");
+        assert!(r.spans.iter().all(|s| s.range.end <= r.text.len()));
+    }
+
+    #[test]
+    fn a_fence_in_an_unknown_language_is_monospace_and_uncoloured() {
+        let r = block("```brainfuck\nlet x = 1;\n```");
+        assert_eq!(r.text, "let x = 1;");
+        assert_eq!(r.spans.len(), 1);
+        assert!(r.spans[0].family == Some(Family::Monospace));
+        assert_eq!(r.spans[0].color, Some(code_color()));
+    }
+
+    #[test]
+    fn highlight_spans_are_byte_offsets_even_with_multibyte_code() {
+        let r = block("```rust\nlet s = \"café ☕\"; // é\n```");
+        for span in &r.spans {
+            assert!(
+                r.text.is_char_boundary(span.range.start)
+                    && r.text.is_char_boundary(span.range.end),
+                "span {:?} is not on a char boundary of {:?}",
+                span.range,
+                r.text
+            );
+        }
+        let string = r
+            .spans
+            .iter()
+            .find(|s| s.color == Some(syntax_color(Kind::String)))
+            .unwrap();
+        assert_eq!(&r.text[string.range.clone()], "\"café ☕\"");
+    }
+
+    #[test]
+    fn an_unterminated_fence_still_renders_what_arrived() {
+        let r = block("```rust\nlet x = 1;");
+        assert_eq!(r.text, "let x = 1;");
+        assert!(
+            r.spans
+                .iter()
+                .any(|s| s.color == Some(syntax_color(Kind::Keyword)))
+        );
+    }
+
+    #[test]
+    fn a_bulleted_list_gets_a_marker_per_item_and_indents_nesting() {
+        let r = block("- one\n- two\n    - deep");
+        assert_eq!(r.text, "\u{2022} one\n\u{2022} two\n    \u{25e6} deep");
+        let markers: Vec<_> = r
+            .spans
+            .iter()
+            .filter(|s| s.color == Some(marker_color()))
+            .map(|s| r.text[s.range.clone()].to_string())
+            .collect();
+        assert_eq!(markers, ["\u{2022} ", "\u{2022} ", "\u{25e6} "]);
+    }
+
+    #[test]
+    fn a_numbered_list_counts_from_the_number_it_was_written_with() {
+        let r = block("3. three\n4. four");
+        assert_eq!(r.text, "3. three\n4. four");
+        let markers: Vec<_> = r
+            .spans
+            .iter()
+            .filter(|s| s.color == Some(marker_color()))
+            .map(|s| r.text[s.range.clone()].to_string())
+            .collect();
+        assert_eq!(markers, ["3. ", "4. "]);
+    }
+
+    #[test]
+    fn a_quote_is_its_text_and_takes_the_quote_frame() {
+        let blocks = split_blocks("> quoted words\n> still quoted");
+        assert_eq!(frame_of(blocks[0].kind), BlockFrame::Quote);
+        let r = render_block(&blocks[0], 16.0);
+        assert_eq!(r.text, "quoted words still quoted");
+    }
+
+    #[test]
+    fn each_block_kind_maps_to_the_frame_it_is_drawn_in() {
+        use BlockKind::*;
+        assert_eq!(frame_of(Paragraph), BlockFrame::Plain);
+        assert_eq!(frame_of(Heading), BlockFrame::Plain);
+        assert_eq!(frame_of(List), BlockFrame::Plain);
+        assert_eq!(frame_of(Other), BlockFrame::Plain);
+        assert_eq!(frame_of(Quote), BlockFrame::Quote);
+        assert!(matches!(frame_of(Code), BlockFrame::Verbatim { .. }));
+        assert!(matches!(frame_of(Table), BlockFrame::Verbatim { .. }));
+        assert_ne!(
+            frame_of(Code),
+            frame_of(Table),
+            "a fence and a table sit on different fills"
+        );
+    }
+
+    #[test]
+    fn a_table_pads_its_columns_to_the_widest_cell() {
+        let r = block("| a | bb |\n|---|---|\n| cccc | d |");
+        let lines: Vec<&str> = r.text.lines().collect();
+        assert_eq!(lines[0], "a     bb");
+        assert_eq!(lines[1], "\u{2500}".repeat(8));
+        assert_eq!(lines[2], "cccc  d");
+        let bold = r.spans.iter().find(|s| s.bold).unwrap();
+        assert_eq!(&r.text[bold.range.clone()], "a     bb");
+    }
+
+    #[test]
+    fn a_long_table_cell_wraps_inside_its_column() {
+        let long = "one two three four five six seven eight nine ten eleven twelve";
+        let r = block(&format!("| k | v |\n|---|---|\n| a | {long} |"));
+        for line in r.text.lines() {
+            assert!(
+                line.chars().count() <= TABLE_MAX_COL + 1 + 2 + 1,
+                "line too wide: {line:?}"
+            );
+        }
+        assert!(r.text.contains("twelve"));
+    }
+
+    #[test]
+    fn a_task_list_marks_its_boxes() {
+        let r = block("- [x] done\n- [ ] not");
+        assert!(r.text.contains("[x] done"));
+        assert!(r.text.contains("[ ] not"));
+    }
+}

app/src/ui/mod.rs

@@ -0,0 +1,789 @@
+pub mod composer;
+// Keep the 1.9 MB fixture out of ordinary APKs.
+#[cfg(feature = "fixture")]
+pub mod fixture;
+pub mod markdown;
+pub mod row;
+pub(crate) mod tap;
+pub mod theme;
+pub mod tool;
+
+use crate::client::transcript_fold::{TranscriptItem, TranscriptRow as FoldedRow, group_tool_runs};
+use iris::prelude::*;
+use std::{mem, rc::Rc};
+use theme::Theme;
+
+pub struct TranscriptScreen {
+    /// The transcript's own `LazySpan` -- the layout *and* the scroll
+    /// position, since a lazy span owns a `ScrollController` of its own
+    /// rather than being wrapped in a `ScrollArea` (`docs/SCROLL.md`).
+    /// Exposed so a caller can read `.extent()`, drive it through
+    /// `Scrollable` (`.scroll()`, `.fling()`, `.amt()`) or call
+    /// `.jump_to_end()` directly.
+    pub list: WeakWidget<LazySpan>,
+    pub composer: composer::Composer,
+    rebuilds: usize,
+    tail: Option<(RowKey, row::TailRow)>,
+    session_working: bool,
+    theme: Rc<Theme>,
+}
+
+impl TranscriptScreen {
+    /// Append one more folded row at the live end of the transcript --
+    /// what a caller's SSE loop or a sent message calls as new events
+    /// arrive. `LazySpan::push_back` is O(1) and keeps the view pinned to the
+    /// newest content when it already was (I3).
+    pub fn push_row<Rsc: HasEvents>(&mut self, rsc: &mut Rsc, row: &FoldedRow)
+    where
+        Rsc::State: FocusHost + OpenUrl,
+    {
+        // Capped like any other row (`row::build_row`'s `cap`). A reply
+        // that goes on to *grow* past the cap is never capped, because it
+        // grows through `RowBlocks::apply_delta`, which appends to what is
+        // already drawn -- so the cap only ever catches a row that arrived
+        // long, which is the one nobody is watching arrive.
+        let row::BuiltRow { key, widget, tail } = row::build_row(
+            rsc,
+            self.list,
+            row,
+            self.session_working,
+            true,
+            self.theme.clone(),
+        );
+        (self.list)(rsc).push_back(LazyItem::new(key, widget));
+        self.tail = tail.map(|t| (key, t));
+    }
+
+    pub fn set_session_working<Rsc: HasEvents>(&mut self, rsc: &mut Rsc, working: bool)
+    where
+        Rsc::State: FocusHost + OpenUrl,
+    {
+        if self.session_working == working {
+            return;
+        }
+        self.session_working = working;
+        if let Some((_, row::TailRow::Tools(tools))) = self.tail.as_mut() {
+            let calls = tools.calls();
+            tools.apply_calls(rsc, &calls, working);
+        }
+    }
+
+    #[cfg(test)]
+    fn tail_card_count(&self) -> usize {
+        match self.tail.as_ref() {
+            Some((_, row::TailRow::Tools(tools))) => tools.card_count(),
+            _ => 0,
+        }
+    }
+
+    /// Open or close the newest row's tool run, when it is one -- what a
+    /// caller with no finger needs (`run-headless.sh`'s screenshot on this
+    /// displayless machine, and the tests below). Answers whether there
+    /// was such a row to act on, so a caller that expected one can say so
+    /// rather than silently producing the collapsed picture.
+    pub fn expand_tail_tools<Rsc: HasEvents>(&mut self, rsc: &mut Rsc, expanded: bool) -> bool
+    where
+        Rsc::State: FocusHost + OpenUrl,
+    {
+        let Some((_, row::TailRow::Tools(tools))) = self.tail.as_ref() else {
+            return false;
+        };
+        tools.set_group_expanded(rsc, expanded);
+        true
+    }
+
+    /// The `ReplaceLast` fast path: update the tail row in place if this
+    /// really is a change to the same row, and say whether that worked.
+    /// `false` for anything the caller must rebuild instead.
+    fn apply_tail_delta<Rsc: HasEvents>(
+        &mut self,
+        rsc: &mut Rsc,
+        key: RowKey,
+        row: &FoldedRow,
+    ) -> bool
+    where
+        Rsc::State: FocusHost + OpenUrl,
+    {
+        let Some((tail_key, kept)) = self.tail.as_mut() else {
+            return false;
+        };
+        if *tail_key != key {
+            return false;
+        }
+        match (kept, row) {
+            (row::TailRow::Blocks(blocks), FoldedRow::Single(item)) => {
+                let (sender, markdown_src) = row::item_content(item);
+                // A tool call is drawn as a card, never as markdown, so a
+                // row that kept blocks and now holds one is a different
+                // row -- rebuild it.
+                if matches!(item, TranscriptItem::ToolRun { .. }) {
+                    return false;
+                }
+                blocks.apply_delta(rsc, sender, &markdown_src)
+            }
+            (row::TailRow::Tools(tools), FoldedRow::Tools(calls)) => {
+                tools.apply_calls(rsc, calls, self.session_working)
+            }
+            (row::TailRow::Tools(tools), FoldedRow::Single(item)) => {
+                tools.apply_calls(rsc, std::slice::from_ref(item), self.session_working)
+            }
+            (row::TailRow::Blocks(_), FoldedRow::Tools(_)) => false,
+        }
+    }
+
+    /// Anything else -- a row *before* the tail changed, which only
+    /// happens when `group_tool_runs` regroups already-seen items (a tool
+    /// run's calls that used to be separate rows join once the run closes)
+    /// -- falls back to a full rebuild: every row is dropped
+    /// (`LazySpan::clear`) and rebuilt from `new`. Counted in
+    /// [`Self::take_rebuilds`] so a caller (a report, a test) can see how
+    /// often the fallback actually fires rather than assuming it never
+    /// does.
+    pub fn apply<Rsc: HasEvents>(
+        &mut self,
+        rsc: &mut Rsc,
+        old: &[TranscriptItem],
+        new: &[TranscriptItem],
+    ) where
+        Rsc::State: FocusHost + OpenUrl,
+    {
+        let old_rows = group_tool_runs(old);
+        let new_rows = group_tool_runs(new);
+
+        match diff_rows(&old_rows, &new_rows) {
+            RowDiff::Unchanged => {}
+            RowDiff::Appended { common } => {
+                for row in &new_rows[common..] {
+                    self.push_row(rsc, row);
+                }
+            }
+            RowDiff::ReplaceLast { common } => {
+                let old_key = row::row_key(&old_rows[common].key());
+                let new_key = row::row_key(&new_rows[common].key());
+                if new_key == old_key && self.apply_tail_delta(rsc, new_key, &new_rows[common]) {
+                    for row in &new_rows[common + 1..] {
+                        self.push_row(rsc, row);
+                    }
+                    return;
+                }
+
+                let row::BuiltRow {
+                    key: new_key,
+                    widget,
+                    tail: kept,
+                } = row::build_row(
+                    rsc,
+                    self.list,
+                    &new_rows[common],
+                    self.session_working,
+                    false,
+                    self.theme.clone(),
+                );
+                let evicted = (self.list)(rsc).replace_back(LazyItem::new(new_key, widget));
+                drop(evicted); // frees the old row's widget, same as a pop would
+                self.tail = kept.map(|t| (new_key, t));
+                for row in &new_rows[common + 1..] {
+                    self.push_row(rsc, row);
+                }
+            }
+            RowDiff::Rebuild => {
+                self.rebuilds += 1;
+                (self.list)(rsc).clear();
+                self.tail = None;
+                for row in &new_rows {
+                    self.push_row(rsc, row);
+                }
+            }
+        }
+    }
+
+    pub fn take_rebuilds(&mut self) -> usize {
+        mem::take(&mut self.rebuilds)
+    }
+
+    /// The semantic paint IDs used by this screen. A caller can replace
+    /// their entries through `rsc.ui_mut().paints.set(...)`; retained text
+    /// and rect primitives keep the IDs and need no widget rebuild.
+    pub fn theme(&self) -> &Theme {
+        &self.theme
+    }
+
+    /// The concatenated text of whatever is currently selected across one
+    /// or more rows, `None` if nothing is -- what a copy command reads.
+    pub fn selected_text<Rsc: HasEvents>(&self, rsc: &mut Rsc) -> Option<String> {
+        let id = rsc
+            .events()
+            .controllers
+            .id::<SelectionController>(self.list.id())?;
+        rsc.with_controller::<SelectionController, _>(id, |selection, rsc| {
+            selection.selected_text(rsc)
+        })?
+    }
+}
+
+pub fn build<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    ui_state: &mut impl HasRoot<Rsc>,
+    rows: Vec<FoldedRow>,
+) -> TranscriptScreen
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let (screen, tree) = build_tree(rsc, rows);
+    ui_state.set_root(rsc, tree);
+    screen
+}
+
+pub fn build_tree<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    rows: Vec<FoldedRow>,
+) -> (TranscriptScreen, StrongWidget)
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let theme = Rc::new(Theme::new(&mut rsc.ui_mut().paints));
+    let list = LazySpan::new(Dir::DOWN, Pin::End).add(rsc);
+    list.controller(
+        SelectionController::new()
+            .with_scroll(list)
+            .separator("\n\n"),
+    )
+    .add(rsc);
+
+    // The last row's block widgets are kept for the same reason
+    // `push_row` keeps them: a reply that is *already* streaming when the
+    // screen is built takes its next delta through `apply`, and a `None`
+    // here would send that delta down the rebuild path instead -- the
+    // whole message re-shaped, which is exactly what the per-block column
+    // exists to avoid, and nothing on screen or in `take_rebuilds` would
+    // say so.
+    let mut tail = None;
+    for (i, row) in rows.iter().enumerate() {
+        // `false`: a row built here is history until the caller says the
+        // session is working (`TranscriptScreen::set_session_working`),
+        // and claiming a call is running because the screen happens to be
+        // opening is exactly the inferred-as-measured mistake.
+        // `cap`: every row but the last. The last is the tail, which may
+        // be a reply already streaming when this screen opened, and a
+        // capped row cannot take a delta (`RowBlocks::capped`).
+        let cap = i + 1 < rows.len();
+        let row::BuiltRow {
+            key,
+            widget,
+            tail: kept,
+        } = row::build_row(rsc, list, row, false, cap, theme.clone());
+        list(rsc).push_back(LazyItem::new(key, widget));
+        tail = kept.map(|t| (key, t));
+    }
+
+    // The controller host covers gaps as well as text, so a tap anywhere in
+    // the transcript can dismiss a selection. Text and link listeners may
+    // see the same physical sample; `SelectionController` deduplicates it by
+    // the sample's own timestamp while still returning the same tap decision
+    // to whichever leaf owns the link action.
+    {
+        list.on(CursorSense::drag_senses(), move |ctx, rsc: &mut Rsc| {
+            let input = &ctx.data;
+            rsc.with_nearest_controller::<SelectionController, _>(list, |id, selection, rsc| {
+                selection.drag(id, rsc, input)
+            });
+        })
+        .add(rsc);
+    }
+
+    list.on(CursorSense::Scroll(Axis::Y), |ctx, rsc| {
+        let delta = ctx.data.scroll_delta.y * 50.0;
+        ctx.widget(rsc).scroll(delta);
+    })
+    .add(rsc);
+
+    let composer::BuiltComposer {
+        composer,
+        widget: composer_bar,
+    } = composer::build_composer(rsc, &theme);
+
+    let tree = (list.width(rest(1)).height(rest(1)).masked(), composer_bar)
+        .span(Dir::DOWN)
+        .add_strong(rsc)
+        .any();
+
+    (
+        TranscriptScreen {
+            tail,
+            session_working: false,
+            list,
+            composer,
+            rebuilds: 0,
+            theme,
+        },
+        tree,
+    )
+}
+
+/// What changed at the tail between two folded row lists -- the decision
+/// [`TranscriptScreen::apply`] acts on. Kept as its own pure function, no
+/// widget and no `Rsc`, so the three cases can be tested directly against
+/// synthetic `Vec<FoldedRow>`s (below) rather than needing a full widget
+/// harness to exercise logic that never touches one.
+#[derive(Debug, PartialEq, Eq)]
+enum RowDiff {
+    Unchanged,
+    Appended { common: usize },
+    ReplaceLast { common: usize },
+    Rebuild,
+}
+
+fn diff_rows(old: &[FoldedRow], new: &[FoldedRow]) -> RowDiff {
+    let common = old
+        .iter()
+        .zip(new.iter())
+        .take_while(|(a, b)| a == b)
+        .count();
+
+    if common == old.len() && common == new.len() {
+        RowDiff::Unchanged
+    } else if common == old.len() {
+        RowDiff::Appended { common }
+    } else if !old.is_empty() && common == old.len() - 1 && common < new.len() {
+        RowDiff::ReplaceLast { common }
+    } else {
+        RowDiff::Rebuild
+    }
+}
+
+#[cfg(test)]
+mod diff_tests {
+    use super::*;
+
+    fn user(seq: u64, text: &str) -> FoldedRow {
+        FoldedRow::Single(TranscriptItem::UserMsg {
+            seq,
+            text: text.to_string(),
+            attachments: Vec::new(),
+        })
+    }
+
+    fn assistant(seq: u64, text: &str, settled: bool) -> FoldedRow {
+        FoldedRow::Single(TranscriptItem::AssistantMsg {
+            seq,
+            text: text.to_string(),
+            settled,
+        })
+    }
+
+    fn tool(seq: u64, run_id: &str) -> TranscriptItem {
+        TranscriptItem::ToolRun {
+            seq,
+            id: format!("id{seq}"),
+            run_id: run_id.to_string(),
+            tool: "grep".to_string(),
+            input: "x".to_string(),
+            output: String::new(),
+            done: false,
+            failed: false,
+            asks: Vec::new(),
+            images: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn identical_lists_are_unchanged() {
+        let rows = vec![user(1, "hi"), assistant(2, "hello", true)];
+        assert_eq!(diff_rows(&rows, &rows.clone()), RowDiff::Unchanged);
+    }
+
+    #[test]
+    fn an_empty_list_growing_by_one_is_an_append_from_zero() {
+        let old: Vec<FoldedRow> = Vec::new();
+        let new = vec![user(1, "hi")];
+        assert_eq!(diff_rows(&old, &new), RowDiff::Appended { common: 0 });
+    }
+
+    #[test]
+    fn a_new_message_after_a_settled_reply_is_a_pure_append() {
+        let old = vec![user(1, "hi"), assistant(2, "hello", true)];
+        let new = vec![user(1, "hi"), assistant(2, "hello", true), user(3, "and?")];
+        assert_eq!(diff_rows(&old, &new), RowDiff::Appended { common: 2 });
+    }
+
+    #[test]
+    fn a_delta_into_the_open_reply_is_a_last_row_replace() {
+        let old = vec![user(1, "hi"), assistant(2, "hel", false)];
+        let new = vec![user(1, "hi"), assistant(2, "hello", false)];
+        assert_eq!(diff_rows(&old, &new), RowDiff::ReplaceLast { common: 1 });
+    }
+
+    #[test]
+    fn a_delta_that_both_settles_the_reply_and_starts_the_next_row_is_still_a_replace() {
+        let old = vec![user(1, "hi"), assistant(2, "hel", false)];
+        let new = vec![user(1, "hi"), assistant(2, "hello", true), user(3, "and?")];
+        assert_eq!(diff_rows(&old, &new), RowDiff::ReplaceLast { common: 1 });
+    }
+
+    #[test]
+    fn a_tool_run_closing_and_joining_an_earlier_call_is_a_regroup_fallback() {
+        let old = vec![FoldedRow::Single(tool(1, "run-a")), user(2, "meanwhile")];
+        let new = vec![FoldedRow::Tools(vec![tool(1, "run-a"), tool(3, "run-a")])];
+        assert_eq!(diff_rows(&old, &new), RowDiff::Rebuild);
+    }
+
+    #[test]
+    fn shrinking_the_list_is_a_rebuild() {
+        let old = vec![user(1, "hi"), assistant(2, "hello", true)];
+        let new = vec![user(1, "hi")];
+        assert_eq!(diff_rows(&old, &new), RowDiff::Rebuild);
+    }
+}
+
+#[cfg(test)]
+mod apply_tests {
+    use super::*;
+    use crate::client::text_cap::MESSAGE_LINES;
+    use std::iter;
+
+    struct TestFocus {
+        focus: Option<WeakWidget<TextEdit>>,
+    }
+    impl OpenUrl for TestFocus {
+        fn open_url(&mut self, _url: &str) {}
+    }
+
+    impl FocusHost for TestFocus {
+        fn recent_click(&mut self) -> bool {
+            false
+        }
+        fn set_focus(&mut self, id: Option<WeakWidget<TextEdit>>) {
+            self.focus = id;
+        }
+        fn focus_gained(&mut self, _region: Option<PixelRegion>) {}
+        fn is_focused(&self, id: WeakWidget<TextEdit>) -> bool {
+            self.focus == Some(id)
+        }
+    }
+
+    struct TestRsc {
+        ui: Ui,
+        events: EventManager<TestRsc>,
+    }
+    impl UiRsc for TestRsc {
+        fn ui(&self) -> &Ui {
+            &self.ui
+        }
+        fn ui_mut(&mut self) -> &mut Ui {
+            &mut self.ui
+        }
+        fn on_draw(&mut self, active: &ActiveData) {
+            self.events.draw(active);
+        }
+        fn on_undraw(&mut self, active: &ActiveData) {
+            self.events.undraw(active);
+        }
+        fn on_remove(&mut self, id: WidgetId) {
+            self.events.remove(id);
+        }
+    }
+    impl HasState for TestRsc {
+        type State = TestFocus;
+    }
+    impl HasEvents for TestRsc {
+        fn events(&self) -> &EventManager<Self> {
+            &self.events
+        }
+        fn events_mut(&mut self) -> &mut EventManager<Self> {
+            &mut self.events
+        }
+    }
+
+    fn user(seq: u64, text: &str) -> TranscriptItem {
+        TranscriptItem::UserMsg {
+            seq,
+            text: text.to_string(),
+            attachments: Vec::new(),
+        }
+    }
+
+    fn assistant(seq: u64, text: &str) -> TranscriptItem {
+        TranscriptItem::AssistantMsg {
+            seq,
+            text: text.to_string(),
+            settled: false,
+        }
+    }
+
+    fn reply(paragraphs: usize, tail: &str) -> String {
+        let mut out = String::new();
+        for i in 0..paragraphs {
+            out.push_str(&format!("Paragraph number {i} of a streamed reply.\n\n"));
+        }
+        out.push_str(tail);
+        out
+    }
+
+    fn cost_of_one_delta(paragraphs: usize) -> (u64, u64) {
+        let mut rsc = TestRsc {
+            ui: Ui::default(),
+            events: EventManager::default(),
+        };
+        let old_items = vec![assistant(1, &reply(paragraphs, "and the last one is st"))];
+        let new_items = vec![assistant(
+            1,
+            &reply(paragraphs, "and the last one is still going."),
+        )];
+        let (mut screen, tree) = build_tree(&mut rsc, group_tool_runs(&old_items));
+        let mut render = UiRenderState::new();
+        render.resize((1080.0, 20000.0));
+        render.update(&tree, &mut rsc);
+        render.take_counters();
+
+        screen.apply(&mut rsc, &old_items, &new_items);
+        render.update(&tree, &mut rsc);
+        assert_eq!(screen.take_rebuilds(), 0, "the delta path must be taken");
+        let RenderCounters { draws, shapes, .. } = render.take_counters();
+        (draws, shapes)
+    }
+
+    #[test]
+    fn a_delta_into_a_long_reply_redraws_the_same_widgets_as_a_short_one() {
+        assert!(
+            reply(100, "").len() > 3_000,
+            "the long case must actually be a long message"
+        );
+        let (short_draws, short_shapes) = cost_of_one_delta(1);
+        let (long_draws, long_shapes) = cost_of_one_delta(100);
+        assert_eq!(
+            short_draws, long_draws,
+            "a delta into a 100-paragraph reply redrew {long_draws} widgets against \
+             {short_draws} for a one-paragraph reply -- the earlier blocks are not being kept"
+        );
+        assert_eq!(
+            (short_shapes, long_shapes),
+            (1, 1),
+            "a delta shaped {long_shapes} text layouts in a 100-paragraph reply and \
+             {short_shapes} in a one-paragraph one; it must be the last block and nothing else"
+        );
+    }
+
+    fn call(id: &str, output: &str, done: bool) -> TranscriptItem {
+        TranscriptItem::ToolRun {
+            seq: 1,
+            id: id.to_string(),
+            run_id: "run".to_string(),
+            tool: "Bash".to_string(),
+            input: format!(r#"{{"command":"grep -rn {id} ."}}"#),
+            output: output.to_string(),
+            done,
+            failed: false,
+            asks: Vec::new(),
+            images: Vec::new(),
+        }
+    }
+
+    fn run_of(count: usize, output: &str, done: bool) -> Vec<TranscriptItem> {
+        (0..count)
+            .map(|i| call(&format!("t{i}"), output, done))
+            .collect()
+    }
+
+    fn open_run(
+        rsc: &mut TestRsc,
+        items: &[TranscriptItem],
+    ) -> (TranscriptScreen, StrongWidget, UiRenderState) {
+        let (mut screen, tree) = build_tree(rsc, group_tool_runs(items));
+        let mut render = UiRenderState::new();
+        render.resize((1080.0, 20000.0));
+        render.update(&tree, rsc);
+        assert!(
+            screen.expand_tail_tools(rsc, true),
+            "the fixture's only row must be the tool run"
+        );
+        render.update(&tree, rsc);
+        render.take_counters();
+        (screen, tree, render)
+    }
+
+    fn shapes_to_open(output: &str) -> u64 {
+        let mut rsc = TestRsc {
+            ui: Ui::default(),
+            events: EventManager::default(),
+        };
+        let items = run_of(3, output, true);
+        let (mut screen, tree) = build_tree(&mut rsc, group_tool_runs(&items));
+        let mut render = UiRenderState::new();
+        render.resize((1080.0, 20000.0));
+        render.update(&tree, &mut rsc);
+        render.take_counters();
+
+        assert!(
+            screen.expand_tail_tools(&mut rsc, true),
+            "the fixture's only row must be the tool run"
+        );
+        render.update(&tree, &mut rsc);
+        render.take_counters().shapes
+    }
+
+    #[test]
+    fn collapsed_cards_shape_only_their_summary_lines() {
+        let long: String = iter::repeat_n("a line of tool output\n", 4_000).collect();
+        assert!(long.len() > 80_000, "the long case must actually be long");
+
+        let short_shapes = shapes_to_open("ok\n");
+        let long_shapes = shapes_to_open(&long);
+        assert!(
+            short_shapes > 0,
+            "opening a group must shape something, or this compares two zeroes"
+        );
+        assert_eq!(
+            short_shapes, long_shapes,
+            "three collapsed cards shaped {long_shapes} text layouts over 80 kB of output \
+             against {short_shapes} over three bytes -- a collapsed card is laying out \
+             something it does not draw"
+        );
+    }
+
+    fn shapes_for_message(text: &str) -> u64 {
+        let mut rsc = TestRsc {
+            ui: Ui::default(),
+            events: EventManager::default(),
+        };
+        let items = vec![
+            TranscriptItem::AssistantMsg {
+                seq: 1,
+                text: text.to_string(),
+                settled: true,
+            },
+            TranscriptItem::AssistantMsg {
+                seq: 2,
+                text: "ok".to_string(),
+                settled: true,
+            },
+        ];
+        let (_screen, tree) = build_tree(&mut rsc, group_tool_runs(&items));
+        let mut render = UiRenderState::new();
+        render.resize((1080.0, 20000.0));
+        render.update(&tree, &mut rsc);
+        render.take_counters().shapes
+    }
+
+    #[test]
+    fn a_long_message_is_drawn_only_as_far_as_the_cap() {
+        let paragraphs = |n: usize| "a paragraph of a reply\n\n".repeat(n);
+        let capped = shapes_for_message(&paragraphs(MESSAGE_LINES * 4));
+        let bigger = shapes_for_message(&paragraphs(MESSAGE_LINES * 40));
+        assert!(
+            capped > 0,
+            "the screen shaped nothing, so this compares zeroes"
+        );
+        assert_eq!(
+            capped, bigger,
+            "a message ten times longer cost {bigger} text layouts against {capped} -- the cap \
+             is not bounding what gets laid out",
+        );
+    }
+
+    fn cost_of_one_result(count: usize) -> u64 {
+        let mut rsc = TestRsc {
+            ui: Ui::default(),
+            events: EventManager::default(),
+        };
+        let before = run_of(count, "", false);
+        let mut after = before.clone();
+        after[0] = call("t0", "the result", true);
+
+        let (mut screen, tree, mut render) = open_run(&mut rsc, &before);
+        screen.apply(&mut rsc, &before, &after);
+        render.update(&tree, &mut rsc);
+        assert_eq!(
+            screen.take_rebuilds(),
+            0,
+            "a result arriving must not rebuild the whole screen"
+        );
+        render.take_counters().draws
+    }
+
+    #[test]
+    fn a_result_arriving_redraws_one_card_whatever_the_run_holds() {
+        let small = cost_of_one_result(3);
+        let large = cost_of_one_result(12);
+        assert!(
+            small > 0,
+            "a result must redraw *something*, or this compares two zeroes"
+        );
+        assert_eq!(
+            small, large,
+            "one result redrew {large} widgets in a twelve-call run against {small} in a \
+             three-call one -- the other cards are being rebuilt with it"
+        );
+    }
+
+    #[test]
+    fn a_group_opens_and_closes_and_keeps_its_state_across_a_result() {
+        let mut rsc = TestRsc {
+            ui: Ui::default(),
+            events: EventManager::default(),
+        };
+        let before = run_of(3, "", false);
+        let mut after = before.clone();
+        after[1] = call("t1", "done", true);
+
+        let (mut screen, tree) = build_tree(&mut rsc, group_tool_runs(&before));
+        let mut render = UiRenderState::new();
+        render.resize((1080.0, 20000.0));
+        render.update(&tree, &mut rsc);
+
+        assert_eq!(screen.tail_card_count(), 0);
+        assert!(screen.expand_tail_tools(&mut rsc, true));
+        assert_eq!(screen.tail_card_count(), 3);
+
+        screen.apply(&mut rsc, &before, &after);
+        render.update(&tree, &mut rsc);
+        assert_eq!(screen.take_rebuilds(), 0);
+        assert_eq!(
+            screen.tail_card_count(),
+            3,
+            "the group closed under a result"
+        );
+
+        assert!(screen.expand_tail_tools(&mut rsc, false));
+        assert_eq!(screen.tail_card_count(), 0);
+    }
+
+    #[test]
+    fn a_call_joining_an_open_run_appends_one_card() {
+        let mut rsc = TestRsc {
+            ui: Ui::default(),
+            events: EventManager::default(),
+        };
+        let before = run_of(2, "ok", true);
+        let mut after = before.clone();
+        after.push(call("t2", "", false));
+
+        let (mut screen, tree, mut render) = open_run(&mut rsc, &before);
+        assert_eq!(screen.tail_card_count(), 2);
+        screen.apply(&mut rsc, &before, &after);
+        render.update(&tree, &mut rsc);
+        assert_eq!(
+            screen.take_rebuilds(),
+            0,
+            "an appended call is not a rebuild"
+        );
+        assert_eq!(screen.tail_card_count(), 3);
+    }
+
+    #[test]
+    fn a_tail_that_stops_being_tool_calls_falls_back_to_a_rebuild() {
+        let mut rsc = TestRsc {
+            ui: Ui::default(),
+            events: EventManager::default(),
+        };
+        let before = vec![user(1, "stable"), call("t0", "", false)];
+        let after = vec![user(1, "stable"), user(2, "not a tool call at all")];
+        let (mut screen, _tree) = build_tree(&mut rsc, group_tool_runs(&before));
+        screen.apply(&mut rsc, &before, &after);
+        assert_eq!(
+            screen.take_rebuilds(),
+            0,
+            "this is a ReplaceLast, not a whole-screen rebuild"
+        );
+        assert_eq!(screen.tail_card_count(), 0);
+    }
+}

app/src/ui/row.rs

@@ -0,0 +1,570 @@
+use crate::client::markdown_blocks::{Block, BlockKind, common_prefix, split_blocks};
+use crate::client::text_cap::{MESSAGE_BYTES, MESSAGE_LINES, cut, show_all_label};
+use crate::client::transcript_fold::{
+    ItemKey, QuestionCard, TranscriptItem, TranscriptRow as FoldedRow,
+};
+use crate::ui::markdown::{BlockFrame, Link, frame_of, render_block};
+use crate::ui::tap::{hold_edge, on_tap};
+use crate::ui::theme::Theme;
+use crate::ui::tool::{BuiltToolRow, ToolRow, build_tool_row};
+use iris::prelude::*;
+use std::{
+    cell::RefCell,
+    collections::hash_map::DefaultHasher,
+    hash::{Hash, Hasher},
+    rc::Rc,
+    slice,
+};
+
+const BLOCK_GAP_DP: f32 = 8.0;
+
+pub const BASE_SIZE: f32 = 16.0;
+
+/// Maps string run IDs above the sequence-number range used by transcripts.
+pub fn row_key(key: &ItemKey) -> RowKey {
+    match key {
+        ItemKey::Seq(seq) => *seq,
+        ItemKey::RunId(id) => {
+            let mut h = DefaultHasher::new();
+            id.hash(&mut h);
+            h.finish() | (1 << 63)
+        }
+    }
+}
+
+/// The sender label shown above a row's text, and the markdown source to
+/// render below it. `None` for a system-style note that has no sender.
+pub(crate) fn item_content(item: &TranscriptItem) -> (Option<&str>, String) {
+    match item {
+        TranscriptItem::UserMsg { text, .. } => (Some("You"), text.clone()),
+        TranscriptItem::AssistantMsg { text, .. } => (Some("Claude"), text.clone()),
+        TranscriptItem::ErrorMsg { message, .. } => (Some("Error"), message.clone()),
+        TranscriptItem::CommandRow { text, .. } => (Some("Command"), format!("`/{text}`")),
+        TranscriptItem::PeerNote { from, text, .. } => (Some(from.as_str()), text.clone()),
+        TranscriptItem::Note { text, .. } => (None, text.clone()),
+        TranscriptItem::ClearedNote { .. } => (None, "_Context cleared._".to_string()),
+        // Epoch seconds as-is until the port has a relative-time formatter
+        // (P1); the eventual limit control draws it as a countdown.
+        TranscriptItem::LimitNote { resets_at, .. } => (
+            None,
+            match resets_at {
+                Some(at) => format!("_Usage limit reached; resets at {at:.0} (epoch seconds)._"),
+                None => "_Usage limit reached._".to_string(),
+            },
+        ),
+        TranscriptItem::CompactedNote {
+            pre_tokens,
+            post_tokens,
+            ..
+        } => (
+            None,
+            match (pre_tokens, post_tokens) {
+                (Some(pre), Some(post)) => format!("_Compacted: {pre} -> {post} tokens._"),
+                _ => "_Compacted._".to_string(),
+            },
+        ),
+        TranscriptItem::ImageItem { r#ref, .. } => (None, format!("_[image: {ref}]_")),
+        TranscriptItem::QuestionCard(card) => (Some("Question"), question_markdown(card)),
+        TranscriptItem::ToolRun {
+            tool,
+            input,
+            output,
+            ..
+        } => (Some(tool.as_str()), tool_call_markdown(tool, input, output)),
+    }
+}
+
+fn question_markdown(card: &QuestionCard) -> String {
+    let mut out = card.prompt.clone();
+    for opt in &card.options {
+        out.push_str(&format!("\n- {}", opt.label));
+    }
+    out
+}
+
+fn tool_call_markdown(tool: &str, input: &str, output: &str) -> String {
+    let mut out = format!("**{tool}**\n\n```\n{input}\n```");
+    if !output.is_empty() {
+        out.push_str(&format!("\n\n```\n{output}\n```"));
+    }
+    out
+}
+
+pub struct RowBlocks {
+    blocks: Vec<Block>,
+    fields: Vec<WeakWidget<Text>>,
+    links: Vec<LinkTargets>,
+    column: WeakWidget<Span>,
+    sender: Option<String>,
+    /// A capped row must be rebuilt before accepting a delta.
+    capped: bool,
+    theme: Rc<Theme>,
+}
+
+/// Split for display: never empty, so a row with nothing in it yet is
+/// still one (empty) text widget rather than no widget at all -- an empty
+/// column reports a zero size and the row would vanish from the list.
+fn display_blocks(markdown_src: &str) -> Vec<Block> {
+    let blocks = split_blocks(markdown_src);
+    if blocks.is_empty() {
+        vec![Block {
+            kind: BlockKind::Paragraph,
+            source: markdown_src.to_string(),
+        }]
+    } else {
+        blocks
+    }
+}
+
+/// Caps at a block boundary when possible, or within the first oversized block.
+fn cap_message(blocks: Vec<Block>, cap: bool) -> (Vec<Block>, Option<usize>) {
+    let total = || blocks.iter().map(|b| b.source.lines().count()).sum();
+    if !cap {
+        return (blocks, None);
+    }
+    let mut kept = Vec::with_capacity(blocks.len());
+    let (mut lines_left, mut bytes_left) = (MESSAGE_LINES, MESSAGE_BYTES);
+    for block in &blocks {
+        if lines_left == 0 || bytes_left == 0 {
+            return (kept, Some(total()));
+        }
+        match cut(&block.source, lines_left, bytes_left) {
+            Some((head, _)) if kept.is_empty() => {
+                kept.push(Block {
+                    kind: block.kind,
+                    source: head.to_string(),
+                });
+                return (kept, Some(total()));
+            }
+            Some(_) => return (kept, Some(total())),
+            None => {
+                lines_left -= block.source.lines().count().min(lines_left);
+                bytes_left -= block.source.len().min(bytes_left);
+                kept.push(block.clone());
+            }
+        }
+    }
+    (kept, None)
+}
+
+/// Shared with the "Show all" callback to avoid copying a long message.
+struct RowSource {
+    sender: Option<String>,
+    markdown: String,
+}
+
+#[derive(Clone)]
+// Rebuilt markdown replaces link ranges while the retained tap callback keeps
+// the same handle. Iris callbacks are single-threaded, so Rc/RefCell is enough.
+struct LinkTargets(Rc<RefCell<Vec<Link>>>);
+
+impl LinkTargets {
+    fn new(links: Vec<Link>) -> Self {
+        Self(Rc::new(RefCell::new(links)))
+    }
+
+    fn replace(&self, links: Vec<Link>) {
+        *self.0.borrow_mut() = links;
+    }
+
+    fn url_at(&self, byte: usize) -> Option<String> {
+        self.0
+            .borrow()
+            .iter()
+            .find(|link| link.range.contains(&byte))
+            .map(|link| link.url.clone())
+    }
+}
+
+struct BuiltBlock {
+    field: WeakWidget<Text>,
+    widget: StrongWidget,
+    links: LinkTargets,
+}
+
+const FRAME_PAD_DP: f32 = 10.0;
+const QUOTE_BAR_DP: f32 = 3.0;
+const FRAME_RADIUS_DP: f32 = 8.0;
+
+fn build_block<Rsc: HasEvents>(rsc: &mut Rsc, block: &Block, theme: &Theme) -> BuiltBlock
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let frame = frame_of(block.kind, theme);
+    let rendered = render_block(block, BASE_SIZE, theme);
+    let links = LinkTargets::new(rendered.links);
+    let verbatim = matches!(frame, BlockFrame::Verbatim { .. });
+    let field = wtext(rendered.text)
+        .spans(rendered.spans)
+        .text_align(Align::LEFT)
+        .wrap(!verbatim)
+        .family(if verbatim {
+            Family::Monospace
+        } else {
+            Family::SansSerif
+        })
+        .size(BASE_SIZE)
+        .color(match frame {
+            BlockFrame::Quote => theme.quote_text.clone(),
+            _ => theme.text.clone(),
+        })
+        .add(rsc);
+
+    let tap_links = links.clone();
+    field
+        .on(CursorSense::drag_senses(), move |ctx, rsc: &mut Rsc| {
+            let (pos, size) = (ctx.data.pos, ctx.data.size);
+            let input = &ctx.data;
+            let outcome = rsc
+                .with_nearest_controller::<SelectionController, _>(field, |id, selection, rsc| {
+                    selection.drag(id, rsc, input)
+                })
+                .unwrap_or(SelectionInput::Tapped);
+            // Panning or selecting across a link must not open it.
+            if outcome == SelectionInput::Tapped {
+                let byte = field.selection(rsc).byte_at(pos, size);
+                let url = tap_links.url_at(byte);
+                if let Some(url) = url {
+                    log::info!("iris link: opening {url}");
+                    <Rsc::State as OpenUrl>::open_url(ctx.state, &url);
+                }
+            }
+        })
+        .add(rsc);
+
+    let framed = match frame {
+        BlockFrame::Plain => field.width(rest(1)).add_strong(rsc).any(),
+        BlockFrame::Verbatim { fill } => field
+            .scrollable(Axis::X, Pin::Start)
+            .pad(dp(FRAME_PAD_DP))
+            .masked_by(rect(fill).radius(dp(FRAME_RADIUS_DP)))
+            .width(rest(1))
+            .add_strong(rsc)
+            .any(),
+        BlockFrame::Quote => field
+            .width(rest(1))
+            .pad(Padding {
+                left: dp(QUOTE_BAR_DP + FRAME_PAD_DP),
+                ..Padding::ZERO
+            })
+            .background(rect(theme.quote_bar.clone()).width(dp(QUOTE_BAR_DP)))
+            .width(rest(1))
+            .add_strong(rsc)
+            .any(),
+    };
+    BuiltBlock {
+        field,
+        widget: framed,
+        links,
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+fn build_text_row<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    list: WeakWidget<LazySpan>,
+    key: RowKey,
+    sender: Option<&str>,
+    markdown_src: &str,
+    cap: bool,
+    theme: Rc<Theme>,
+) -> (StrongWidget, RowBlocks)
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let source = Rc::new(RowSource {
+        sender: sender.map(str::to_string),
+        markdown: markdown_src.to_string(),
+    });
+    let strong = WidgetPtr::new().add_strong(rsc);
+    let ptr = strong.weak();
+    let (content, blocks) = row_content(rsc, list, key, source, ptr, cap, theme);
+    ptr(rsc).set(content);
+    (strong.any(), blocks)
+}
+
+/// Separate from [`build_text_row`] because the tap calls it a second
+/// time, with `cap` false, and writes the result back into the same
+/// `WidgetPtr`.
+#[allow(clippy::too_many_arguments)]
+fn row_content<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    list: WeakWidget<LazySpan>,
+    key: RowKey,
+    source: Rc<RowSource>,
+    ptr: WeakWidget<WidgetPtr>,
+    cap: bool,
+    theme: Rc<Theme>,
+) -> (StrongWidget, RowBlocks)
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let (blocks, hidden) = cap_message(display_blocks(&source.markdown), cap);
+    let mut column = Span::empty(Dir::DOWN).gap(dp(BLOCK_GAP_DP));
+    let mut fields = Vec::with_capacity(blocks.len());
+    let mut links = Vec::with_capacity(blocks.len());
+    for block in &blocks {
+        let built = build_block(rsc, block, &theme);
+        fields.push(built.field);
+        links.push(built.links);
+        column.push(built.widget);
+    }
+    if let Some(lines) = hidden {
+        column.push(show_all(
+            rsc,
+            list,
+            key,
+            source.clone(),
+            ptr,
+            lines,
+            theme.clone(),
+        ));
+    }
+    let column = column.add(rsc);
+
+    // The parent composition performs the header's single strong registration.
+    let header: WeakWidget = match &source.sender {
+        Some(name) => wtext(name.clone())
+            .size(13.0)
+            .color(theme.secondary_text.clone())
+            .add(rsc),
+        None => Span::empty(Dir::DOWN).add(rsc),
+    };
+
+    let widget = (header, column.width(rest(1)))
+        .span(Dir::DOWN)
+        .gap(dp(4))
+        .pad(dp(10))
+        .add_strong(rsc)
+        .any();
+    (
+        widget,
+        RowBlocks {
+            blocks,
+            fields,
+            links,
+            column,
+            sender: source.sender.clone(),
+            capped: hidden.is_some(),
+            theme,
+        },
+    )
+}
+
+/// Rebuilds a capped row uncapped; its incremental state is intentionally discarded.
+#[allow(clippy::too_many_arguments)]
+fn show_all<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    list: WeakWidget<LazySpan>,
+    key: RowKey,
+    source: Rc<RowSource>,
+    ptr: WeakWidget<WidgetPtr>,
+    lines: usize,
+    theme: Rc<Theme>,
+) -> StrongWidget
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let label = show_all_label(lines);
+    let more_strong = WidgetPtr::new().add_strong(rsc);
+    let more = more_strong.weak();
+    let words = wtext(label.clone())
+        .size(13.0)
+        .color(theme.secondary_text.clone())
+        .text_align(Align::LEFT)
+        .label(label)
+        .add_strong(rsc);
+    more(rsc).set(words);
+    on_tap(rsc, more, list, move |rsc| {
+        hold_edge(rsc, list, key);
+        let (content, _blocks) =
+            row_content(rsc, list, key, source.clone(), ptr, false, theme.clone());
+        let _old = ptr(rsc).replace(content);
+    });
+    more_strong.any()
+}
+
+impl RowBlocks {
+    /// Updates only the changed tail blocks, or returns `false` when a rebuild is required.
+    pub fn apply_delta<Rsc: HasEvents>(
+        &mut self,
+        rsc: &mut Rsc,
+        sender: Option<&str>,
+        markdown_src: &str,
+    ) -> bool
+    where
+        Rsc::State: FocusHost + OpenUrl,
+    {
+        if self.sender.as_deref() != sender {
+            return false;
+        }
+        if self.capped {
+            return false;
+        }
+        let new_blocks = display_blocks(markdown_src);
+        let common = common_prefix(&self.blocks, &new_blocks);
+        // A delta may append or rewrite only the current final block.
+        if new_blocks.len() < self.blocks.len() || common + 1 < self.blocks.len() {
+            return false;
+        }
+        if new_blocks.len() == self.blocks.len()
+            && common < self.blocks.len()
+            && new_blocks[common].kind != self.blocks[common].kind
+        {
+            return false;
+        }
+        debug_assert!(
+            self.fields.len() == self.blocks.len() && self.links.len() == self.blocks.len(),
+            "one field and one link list per block: {} fields, {} links, {} blocks",
+            self.fields.len(),
+            self.links.len(),
+            self.blocks.len()
+        );
+
+        for (i, block) in new_blocks.iter().enumerate().skip(common) {
+            match (self.fields.get(i), self.links.get(i)) {
+                (Some(field), Some(links)) => {
+                    let rendered = render_block(block, BASE_SIZE, &self.theme);
+                    field(rsc).set_with_spans(rendered.text, rendered.spans);
+                    links.replace(rendered.links);
+                }
+                _ => {
+                    let built = build_block(rsc, block, &self.theme);
+                    self.fields.push(built.field);
+                    self.links.push(built.links);
+                    if let Some(column) = rsc.ui_mut().widgets.get_mut(&self.column) {
+                        column.push(built.widget);
+                    }
+                }
+            }
+        }
+        self.blocks = new_blocks;
+        true
+    }
+}
+
+fn build_single<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    list: WeakWidget<LazySpan>,
+    key: RowKey,
+    item: &TranscriptItem,
+    cap: bool,
+    theme: Rc<Theme>,
+) -> (StrongWidget, RowBlocks)
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let (sender, markdown_src) = item_content(item);
+    build_text_row(rsc, list, key, sender, &markdown_src, cap, theme)
+}
+
+/// Incremental state retained for whichever kind of row is currently last.
+pub enum TailRow {
+    Blocks(RowBlocks),
+    Tools(ToolRow),
+}
+
+pub struct BuiltRow {
+    pub key: RowKey,
+    pub widget: StrongWidget,
+    pub tail: Option<TailRow>,
+}
+
+/// `cap` limits historical rows; a live tail must remain uncapped.
+pub fn build_row<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    list: WeakWidget<LazySpan>,
+    row: &FoldedRow,
+    working: bool,
+    cap: bool,
+    theme: Rc<Theme>,
+) -> BuiltRow
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    // A single tool call still draws as a card, without a redundant group wrapper.
+    let calls = match row {
+        FoldedRow::Single(item @ TranscriptItem::ToolRun { .. }) => Some(slice::from_ref(item)),
+        FoldedRow::Tools(calls) => Some(calls.as_slice()),
+        FoldedRow::Single(_) => None,
+    };
+    if let Some(calls) = calls {
+        let key = row_key(&calls[0].key());
+        let BuiltToolRow { widget, row: tools } =
+            build_tool_row(rsc, list, key, calls.to_vec(), working, theme);
+        return BuiltRow {
+            key,
+            widget,
+            tail: Some(TailRow::Tools(tools)),
+        };
+    }
+    let FoldedRow::Single(item) = row else {
+        unreachable!("every Tools row took the branch above");
+    };
+    let key = row_key(&item.key());
+    let (widget, blocks) = build_single(rsc, list, key, item, cap, theme);
+    BuiltRow {
+        key,
+        widget,
+        tail: Some(TailRow::Blocks(blocks)),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn blocks(src: &str) -> Vec<Block> {
+        display_blocks(src)
+    }
+
+    #[test]
+    fn a_message_inside_the_bounds_is_not_capped() {
+        let (kept, hidden) = cap_message(blocks("hello\n\nthere"), true);
+        assert_eq!(kept.len(), 2);
+        assert_eq!(hidden, None);
+    }
+
+    #[test]
+    fn cap_false_keeps_everything() {
+        let src = "a\n\n".repeat(MESSAGE_LINES * 2);
+        let (kept, hidden) = cap_message(blocks(&src), false);
+        assert_eq!(kept.len(), MESSAGE_LINES * 2);
+        assert_eq!(hidden, None);
+    }
+
+    #[test]
+    fn a_long_message_is_cut_on_a_block_boundary() {
+        let src = "a paragraph\n\n".repeat(MESSAGE_LINES * 2);
+        let all = blocks(&src);
+        let (kept, hidden) = cap_message(all.clone(), true);
+        assert!(kept.len() < all.len(), "nothing was left out");
+        assert!(
+            kept.iter().zip(&all).all(|(k, a)| k == a),
+            "a block was truncated where a boundary was available",
+        );
+        assert_eq!(
+            hidden,
+            Some(all.iter().map(|b| b.source.lines().count()).sum()),
+            "the offer says the whole message's line count, not the shown part's",
+        );
+    }
+
+    #[test]
+    fn one_block_over_the_bound_by_itself_is_truncated() {
+        let src = format!("```\n{}```", "x\n".repeat(MESSAGE_LINES * 2));
+        let all = blocks(&src);
+        assert_eq!(all.len(), 1, "the fixture must be a single block");
+        let (kept, hidden) = cap_message(all.clone(), true);
+        assert_eq!(kept.len(), 1);
+        assert_eq!(
+            kept[0].kind, all[0].kind,
+            "truncation changed the block's kind"
+        );
+        assert!(
+            kept[0].source.len() < all[0].source.len(),
+            "the one over-long block was drawn whole",
+        );
+        assert!(hidden.is_some());
+    }
+}

app/src/ui/tap.rs

@@ -0,0 +1,29 @@
+use iris::prelude::*;
+
+pub(crate) fn on_tap<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    ptr: WeakWidget<WidgetPtr>,
+    list: WeakWidget<LazySpan>,
+    f: impl Fn(&mut Rsc) + 'static,
+) where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    ptr.on(CursorSense::drag_senses(), move |ctx, rsc: &mut Rsc| {
+        let input = &ctx.data;
+        let outcome = rsc
+            .with_nearest_controller::<SelectionController, _>(list, |id, selection, rsc| {
+                selection.drag(id, rsc, input)
+            })
+            .unwrap_or(SelectionInput::Tapped);
+        if outcome == SelectionInput::Tapped {
+            f(rsc);
+        }
+    })
+    .add(rsc);
+}
+
+pub(crate) fn hold_edge(rsc: &mut impl UiRsc, list: WeakWidget<LazySpan>, key: RowKey) {
+    if let Some((top, _bottom)) = list(rsc).extent(key) {
+        list(rsc).note_tap(top);
+    }
+}

app/src/ui/theme.rs

@@ -0,0 +1,70 @@
+use iris::prelude::*;
+
+/// The shared phone/desktop paint handles. Replacing their paint-table
+/// entries changes the theme without rebuilding widgets or primitives.
+#[derive(Clone)]
+pub struct Theme {
+    pub text: PaintId,
+    pub code: PaintId,
+    pub link: PaintId,
+    pub marker: PaintId,
+    pub verbatim_surface: PaintId,
+    pub table_surface: PaintId,
+    pub quote_bar: PaintId,
+    pub quote_text: PaintId,
+    pub strikethrough: PaintId,
+    pub card_surface: PaintId,
+    pub group_surface: PaintId,
+    pub muted: PaintId,
+    pub awaiting: PaintId,
+    pub failed: PaintId,
+    pub unknown: PaintId,
+    pub composer_surface: PaintId,
+    pub secondary_text: PaintId,
+    pub syntax_keyword: PaintId,
+    pub syntax_string: PaintId,
+    pub syntax_literal: PaintId,
+    pub syntax_comment: PaintId,
+    pub syntax_metadata: PaintId,
+    pub syntax_punctuation: PaintId,
+    pub syntax_mark: PaintId,
+}
+
+impl Theme {
+    pub fn new(paints: &mut Paints) -> Self {
+        Self {
+            text: paints.add(srgb(0xCDD6F4)),
+            code: paints.add(srgb(0xCDD6F4)),
+            link: paints.add(srgb(0x89B4FA)),
+            marker: paints.add(srgb(0xB4BEFE)),
+            verbatim_surface: paints.add(srgb(0x11111B)),
+            table_surface: paints.add(srgb(0x313244)),
+            quote_bar: paints.add(srgb(0x585B70)),
+            quote_text: paints.add(srgb(0xA6ADC8)),
+            strikethrough: paints.add(srgb(0x6C7086)),
+            card_surface: paints.add(srgb(0x313244)),
+            group_surface: paints.add(srgb(0x181825)),
+            muted: paints.add(srgb(0xA6ADC8)),
+            awaiting: paints.add(srgb(0xFAB387)),
+            failed: paints.add(srgb(0xF38BA8)),
+            unknown: paints.add(srgb(0xF9E2AF)),
+            composer_surface: paints.add(Srgba8::rgb(40, 40, 46)),
+            secondary_text: paints.add(Srgba8::rgb(150, 150, 160)),
+            syntax_keyword: paints.add(srgb(0xCBA6F7)),
+            syntax_string: paints.add(srgb(0xA6E3A1)),
+            syntax_literal: paints.add(srgb(0xFAB387)),
+            syntax_comment: paints.add(srgb(0x6C7086)),
+            syntax_metadata: paints.add(srgb(0xF9E2AF)),
+            syntax_punctuation: paints.add(srgb(0xA6ADC8)),
+            syntax_mark: paints.add(srgb(0x89DCEB)),
+        }
+    }
+}
+
+const fn srgb(hex: u32) -> Srgba8 {
+    Srgba8::rgb(
+        ((hex >> 16) & 0xff) as u8,
+        ((hex >> 8) & 0xff) as u8,
+        (hex & 0xff) as u8,
+    )
+}

app/src/ui/tool.rs

@@ -0,0 +1,657 @@
+use crate::client::text_cap::{VERBATIM_BYTES, VERBATIM_LINES, cut, show_all_label};
+use crate::client::tool_summary::{ToolInput, parse_tool_input};
+use crate::client::transcript_fold::{ToolState, TranscriptItem};
+use crate::ui::markdown::highlight_into;
+use crate::ui::tap::{hold_edge, on_tap};
+use crate::ui::theme::Theme;
+use iris::prelude::*;
+use std::{
+    cell::{Cell, RefCell},
+    collections::{HashMap, HashSet},
+    rc::Rc,
+};
+
+const NAME_SIZE: f32 = 14.0;
+const BODY_SIZE: f32 = 12.0;
+const LABEL_SIZE: f32 = 11.0;
+
+const CARD_PAD_DP: f32 = 12.0;
+const CARD_RADIUS_DP: f32 = 12.0;
+const GAP_DP: f32 = 8.0;
+const RAW_RADIUS_DP: f32 = 4.0;
+const RAW_PAD_DP: f32 = 8.0;
+const GROUP_INSET_DP: f32 = 4.0;
+
+const MARK_DP: f32 = 9.0;
+
+#[derive(Default)]
+struct ToolRowState {
+    group_expanded: bool,
+    open: HashMap<String, bool>,
+    whole: HashMap<(String, Part), bool>,
+}
+
+struct ToolRowData {
+    calls: Vec<TranscriptItem>,
+    view: ToolRowState,
+    working: bool,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
+enum Part {
+    Input,
+    Output,
+}
+
+struct ToolRowShared {
+    // The row owner and `'static` tap callbacks share this model. Callbacks
+    // are single-threaded but cannot borrow from `ToolRow`, hence Rc/RefCell.
+    data: RefCell<ToolRowData>,
+    /// One `WidgetPtr` per call, in order -- what makes a result cost one
+    /// card. Empty while the group is collapsed, because a collapsed group
+    /// draws no cards at all. Its path out is [`build_content`], which
+    /// clears it before building whatever replaces them.
+    cards: RefCell<Vec<WeakWidget<WidgetPtr>>>,
+    content: Cell<Option<WeakWidget<WidgetPtr>>>,
+    list: WeakWidget<LazySpan>,
+    key: RowKey,
+    theme: Rc<Theme>,
+}
+
+/// One transcript row's worth of tool calls, kept by the caller for the
+/// row a result can still land in -- the tool-call counterpart of
+/// [`crate::ui::row::RowBlocks`], and the reason a `ToolEnd` costs one card
+/// rather than a row.
+pub struct ToolRow {
+    shared: Rc<ToolRowShared>,
+}
+
+pub struct BuiltToolRow {
+    pub widget: StrongWidget,
+    pub row: ToolRow,
+}
+
+fn text<Rsc>(content: impl Into<String>, size: f32, color: PaintId) -> TextBuilder<Rsc> {
+    wtext(content)
+        .size(size)
+        .color(color)
+        .text_align(Align::LEFT)
+}
+
+fn disclosure<Rsc>(glyph: &'static str, theme: &Theme) -> TextBuilder<Rsc> {
+    text(glyph, MARK_DP, theme.muted.clone()).family(Family::Icons)
+}
+
+fn raw_block<Rsc: HasEvents>(rsc: &mut Rsc, body: TextBuilder<Rsc>, theme: &Theme) -> StrongWidget
+where
+    Rsc::State: FocusHost,
+{
+    let field = body
+        .family(Family::Monospace)
+        .size(BODY_SIZE)
+        .wrap(false)
+        .add(rsc);
+    field
+        .scrollable(Axis::X, Pin::Start)
+        .pad(dp(RAW_PAD_DP))
+        .masked_by(rect(theme.verbatim_surface.clone()).radius(dp(RAW_RADIUS_DP)))
+        .width(rest(1))
+        .add_strong(rsc)
+        .any()
+}
+
+fn state_word(state: ToolState) -> Option<&'static str> {
+    match state {
+        ToolState::Deciding => Some("your turn"),
+        ToolState::Running => Some("running"),
+        ToolState::Failed => Some("failed"),
+        ToolState::NoResult => Some("no result"),
+        ToolState::Succeeded => None,
+    }
+}
+
+fn state_mark(state: ToolState, theme: &Theme) -> Option<(&'static str, PaintId)> {
+    let color = match state {
+        ToolState::Deciding => theme.awaiting.clone(),
+        ToolState::Running => theme.muted.clone(),
+        ToolState::Failed => theme.failed.clone(),
+        ToolState::NoResult => theme.unknown.clone(),
+        ToolState::Succeeded => return None,
+    };
+    Some((
+        state_word(state).expect("non-success state has a label"),
+        color,
+    ))
+}
+
+/// What a screen reader is given for one card, and what a `ui-trace`
+/// script taps by: the tool, what the call is for, and how it went when
+/// that is anything but "fine".
+fn card_label(tool: &str, parsed: &ToolInput, state: ToolState) -> String {
+    let mut name = tool.to_string();
+    if let Some(title) = parsed.title() {
+        name.push_str(": ");
+        name.push_str(title);
+    }
+    if let Some(word) = state_word(state) {
+        name.push_str(" (");
+        name.push_str(word);
+        name.push(')');
+    }
+    name
+}
+
+/// The heading a group carries, also used as its accessibility label.
+fn group_label(count: usize) -> String {
+    format!("Called {count} tools")
+}
+
+fn capped(body: &str, whole: bool) -> (&str, usize, bool) {
+    match cut(body, VERBATIM_LINES, VERBATIM_BYTES) {
+        Some((head, lines)) if !whole => (head, lines, true),
+        Some((_, lines)) => (body, lines, false),
+        None => (body, body.lines().count(), false),
+    }
+}
+
+fn wants_whole(shared: &ToolRowShared, id: &str, part: Part) -> bool {
+    shared
+        .data
+        .borrow()
+        .view
+        .whole
+        .get(&(id.to_string(), part))
+        .copied()
+        .unwrap_or(false)
+}
+
+/// A control rather than a note, and it says the count rather than "more",
+/// because the reader is deciding whether to ask for it: "Show all 4,000
+/// lines" and "Show all 12 lines" are different decisions and the word
+/// "more" tells them apart not at all.
+fn show_all<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    shared: &Rc<ToolRowShared>,
+    index: usize,
+    id: &str,
+    part: Part,
+    lines: usize,
+) -> StrongWidget
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let label = show_all_label(lines);
+    let more_strong = WidgetPtr::new().add_strong(rsc);
+    let more = more_strong.weak();
+    let words = text(label.clone(), LABEL_SIZE, shared.theme.muted.clone())
+        .label(label)
+        .add_strong(rsc);
+    more(rsc).set(words);
+    let shared_for_tap = shared.clone();
+    let key = (id.to_string(), part);
+    on_tap(rsc, more, shared.list, move |rsc| {
+        hold_edge(rsc, shared_for_tap.list, shared_for_tap.key);
+        shared_for_tap
+            .data
+            .borrow_mut()
+            .view
+            .whole
+            .insert(key.clone(), true);
+        redraw_card(rsc, &shared_for_tap, index);
+    });
+    more_strong.any()
+}
+
+fn output_block<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    shared: &Rc<ToolRowShared>,
+    index: usize,
+    id: &str,
+    output: &str,
+    call_state: ToolState,
+) -> StrongWidget
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    if output.is_empty() {
+        let (words, colour) = match call_state {
+            ToolState::Succeeded => ("No output", shared.theme.muted.clone()),
+            ToolState::Failed => ("Failed, with no output", shared.theme.failed.clone()),
+            ToolState::NoResult => ("No result ever arrived", shared.theme.unknown.clone()),
+            ToolState::Running | ToolState::Deciding => {
+                ("No output yet", shared.theme.muted.clone())
+            }
+        };
+        return text(words, LABEL_SIZE, colour).add_strong(rsc).any();
+    }
+
+    let (shown, lines, was_cut) = capped(output, wants_whole(shared, id, Part::Output));
+    let mut column = Span::empty(Dir::DOWN).gap(dp(2));
+    column.push(
+        text("Output", LABEL_SIZE, shared.theme.text.clone())
+            .add_strong(rsc)
+            .any(),
+    );
+    let body = text(shown.to_string(), BODY_SIZE, shared.theme.text.clone());
+    column.push(raw_block(rsc, body, &shared.theme));
+    if was_cut {
+        column.push(show_all(rsc, shared, index, id, Part::Output, lines));
+    }
+    column.width(rest(1)).add_strong(rsc).any()
+}
+
+fn build_card<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    shared: &Rc<ToolRowShared>,
+    index: usize,
+) -> StrongWidget
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let call = shared.data.borrow().calls[index].clone();
+    let TranscriptItem::ToolRun {
+        id,
+        tool,
+        input,
+        output,
+        ..
+    } = &call
+    else {
+        debug_assert!(false, "a tool row holds only tool calls, not {call:?}");
+        return Span::empty(Dir::DOWN).add_strong(rsc).any();
+    };
+    let parsed = parse_tool_input(tool, input);
+    let data = shared.data.borrow();
+    let call_state = ToolState::of(&call, data.working).expect("matched ToolRun above");
+    let open =
+        data.view.open.get(id).copied().unwrap_or(false) || call_state == ToolState::Deciding;
+    drop(data);
+
+    let mut header = Span::empty(Dir::RIGHT).gap(dp(GAP_DP));
+    header.push(
+        disclosure(if open { icon::OPEN } else { icon::CLOSED }, &shared.theme)
+            .add_strong(rsc)
+            .any(),
+    );
+    header.push(
+        text(tool.clone(), NAME_SIZE, shared.theme.text.clone())
+            .add_strong(rsc)
+            .any(),
+    );
+    match (open, parsed.title()) {
+        (true, _) | (false, None) => {
+            header.push(Span::empty(Dir::RIGHT).width(rest(1)).add_strong(rsc).any())
+        }
+        (false, Some(title)) => header.push(
+            text(title.to_string(), BODY_SIZE, shared.theme.muted.clone())
+                .wrap(false)
+                .masked()
+                .width(rest(1))
+                .add_strong(rsc)
+                .any(),
+        ),
+    }
+    if open && let Some(timeout) = &parsed.timeout {
+        header.push(
+            text(
+                format!("timeout {timeout}"),
+                LABEL_SIZE,
+                shared.theme.muted.clone(),
+            )
+            .add_strong(rsc)
+            .any(),
+        );
+    }
+    if let Some((word, colour)) = state_mark(call_state, &shared.theme) {
+        header.push(text(word, LABEL_SIZE, colour).add_strong(rsc).any());
+    }
+
+    let mut column = Span::empty(Dir::DOWN).gap(dp(GAP_DP / 2.0));
+    column.push(header.width(rest(1)).add_strong(rsc).any());
+    if open {
+        if let Some(description) = &parsed.description {
+            column.push(
+                text(description.clone(), BODY_SIZE, shared.theme.muted.clone())
+                    .width(rest(1))
+                    .add_strong(rsc)
+                    .any(),
+            );
+        }
+        let whole = wants_whole(shared, id, Part::Input);
+        let mut input_lines = 0usize;
+        let mut input_cut = false;
+        if let Some(subject) = &parsed.subject {
+            let (shown, lines, was_cut) = capped(subject, whole);
+            input_lines += lines;
+            input_cut |= was_cut;
+            let spans = match parsed.language {
+                Some(language) => {
+                    let mut spans = Vec::new();
+                    highlight_into(&mut spans, shown, 0..shown.len(), language, &shared.theme);
+                    spans
+                }
+                None => Vec::new(),
+            };
+            let body = text(shown.to_string(), BODY_SIZE, shared.theme.text.clone()).spans(spans);
+            column.push(raw_block(rsc, body, &shared.theme));
+        }
+        if !parsed.rest.is_empty() {
+            // Never dropped: a field left out would be claiming the tool
+            // had no other input when it might (`ToolInput.kt`). Capped is
+            // not dropped -- the field is still there, with its size said
+            // out loud.
+            let joined = parsed.rest.join("\n");
+            let (shown, lines, was_cut) = capped(&joined, whole);
+            input_lines += lines;
+            input_cut |= was_cut;
+            let body = text(shown.to_string(), BODY_SIZE, shared.theme.muted.clone());
+            column.push(raw_block(rsc, body, &shared.theme));
+        }
+        if input_cut {
+            column.push(show_all(rsc, shared, index, id, Part::Input, input_lines));
+        }
+        column.push(output_block(rsc, shared, index, id, output, call_state));
+    }
+
+    column
+        .width(rest(1))
+        .pad(dp(CARD_PAD_DP))
+        .background(rect(shared.theme.card_surface.clone()).radius(dp(CARD_RADIUS_DP)))
+        .width(rest(1))
+        .label(card_label(tool, &parsed, call_state))
+        .add_strong(rsc)
+        .any()
+}
+
+fn redraw_card<Rsc: HasEvents>(rsc: &mut Rsc, shared: &Rc<ToolRowShared>, index: usize)
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let Some(ptr) = shared.card_ptr(index) else {
+        debug_assert!(false, "card {index} has no widget to redraw");
+        return;
+    };
+    let content = build_card(rsc, shared, index);
+    let _old = ptr(rsc).replace(content);
+}
+
+fn build_card_ptr<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    shared: &Rc<ToolRowShared>,
+    index: usize,
+) -> (StrongWidget, WeakWidget<WidgetPtr>)
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let strong = WidgetPtr::new().add_strong(rsc);
+    let ptr = strong.weak();
+    shared.cards.borrow_mut().push(ptr);
+    debug_assert_eq!(
+        shared.cards.borrow().len(),
+        index + 1,
+        "a card's index is its position, and both are the call's"
+    );
+    let content = build_card(rsc, shared, index);
+    ptr(rsc).set(content);
+    let for_tap = shared.clone();
+    on_tap(rsc, ptr, shared.list, move |rsc| {
+        hold_edge(rsc, for_tap.list, for_tap.key);
+        let Some(id) = for_tap.call_id(index) else {
+            debug_assert!(false, "tapped card {index} is no longer in the row");
+            return;
+        };
+        let was = for_tap
+            .data
+            .borrow()
+            .view
+            .open
+            .get(&id)
+            .copied()
+            .unwrap_or(false);
+        for_tap.data.borrow_mut().view.open.insert(id, !was);
+        redraw_card(rsc, &for_tap, index);
+    });
+    (strong.any(), ptr)
+}
+
+fn collapse_bar<Rsc: HasEvents>(rsc: &mut Rsc, shared: &Rc<ToolRowShared>) -> StrongWidget
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let strong = WidgetPtr::new().add_strong(rsc);
+    let ptr = strong.weak();
+    let mark = disclosure(icon::COLLAPSE, &shared.theme)
+        .center_text()
+        .width(rest(1))
+        .pad(dp(CARD_PAD_DP))
+        // Anything shown only as a mark still needs a name: this is what
+        // a screen reader reads and what a `ui-trace` script taps.
+        .label("Collapse these tool calls")
+        .add_strong(rsc);
+    ptr(rsc).set(mark);
+    let for_tap = shared.clone();
+    on_tap(rsc, ptr, shared.list, move |rsc| {
+        toggle_group(rsc, &for_tap)
+    });
+    strong.any()
+}
+
+/// Rebuilt whole when the group opens or closes, because that is a change
+/// of what the row *is* rather than of one card in it. Everything a single
+/// card's tap does goes through [`redraw_card`] instead.
+fn build_content<Rsc: HasEvents>(rsc: &mut Rsc, shared: &Rc<ToolRowShared>) -> StrongWidget
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    shared.cards.borrow_mut().clear();
+    let count = shared.data.borrow().calls.len();
+    debug_assert!(count > 0, "a tool row with no calls has nothing to draw");
+
+    if count == 1 {
+        return build_card_ptr(rsc, shared, 0).0;
+    }
+
+    if !shared.data.borrow().view.group_expanded {
+        let heading = group_label(count);
+        return text(heading.clone(), NAME_SIZE, shared.theme.text.clone())
+            .pad(dp(CARD_PAD_DP))
+            .width(rest(1))
+            .background(rect(shared.theme.card_surface.clone()).radius(dp(CARD_RADIUS_DP)))
+            .width(rest(1))
+            .label(heading)
+            .add_strong(rsc)
+            .any();
+    }
+
+    let heading = group_label(count);
+    let mut group = Span::empty(Dir::DOWN);
+    group.push(
+        text(heading.clone(), NAME_SIZE, shared.theme.text.clone())
+            .pad(dp(CARD_PAD_DP))
+            .width(rest(1))
+            .label(heading)
+            .add_strong(rsc)
+            .any(),
+    );
+    {
+        let mut cards = Span::empty(Dir::DOWN);
+        for index in 0..count {
+            cards.push(build_card_ptr(rsc, shared, index).0);
+        }
+        group.push(cards.pad(dp(GROUP_INSET_DP)).add_strong(rsc).any());
+    }
+    group.push(collapse_bar(rsc, shared));
+    group
+        .width(rest(1))
+        .background(rect(shared.theme.group_surface.clone()).radius(dp(CARD_RADIUS_DP)))
+        .width(rest(1))
+        .add_strong(rsc)
+        .any()
+}
+
+fn toggle_group<Rsc: HasEvents>(rsc: &mut Rsc, shared: &Rc<ToolRowShared>)
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    hold_edge(rsc, shared.list, shared.key);
+    let mut data = shared.data.borrow_mut();
+    data.view.group_expanded = !data.view.group_expanded;
+    drop(data);
+    let content = build_content(rsc, shared);
+    shared.set_content(rsc, content);
+}
+
+impl ToolRowShared {
+    fn set_content(&self, rsc: &mut impl UiRsc, content: StrongWidget) {
+        let Some(ptr) = self.content.get() else {
+            debug_assert!(
+                false,
+                "the row's content pointer is set before anything can tap it"
+            );
+            return;
+        };
+        let _old = ptr(rsc).replace(content);
+    }
+
+    fn call_id(&self, index: usize) -> Option<String> {
+        match self.data.borrow().calls.get(index) {
+            Some(TranscriptItem::ToolRun { id, .. }) => Some(id.clone()),
+            _ => None,
+        }
+    }
+
+    fn card_ptr(&self, index: usize) -> Option<WeakWidget<WidgetPtr>> {
+        self.cards.borrow().get(index).copied()
+    }
+}
+
+/// `working` is the caller's `session_working` **for this row** -- true
+/// only for the newest row of a session that is still doing something.
+/// Every row behind it belongs to a turn that has ended, so a call in one
+/// with no result never came back rather than still running.
+pub fn build_tool_row<Rsc: HasEvents>(
+    rsc: &mut Rsc,
+    list: WeakWidget<LazySpan>,
+    key: RowKey,
+    calls: Vec<TranscriptItem>,
+    working: bool,
+    theme: Rc<Theme>,
+) -> BuiltToolRow
+where
+    Rsc::State: FocusHost + OpenUrl,
+{
+    let shared = Rc::new(ToolRowShared {
+        data: RefCell::new(ToolRowData {
+            calls,
+            view: ToolRowState::default(),
+            working,
+        }),
+        cards: RefCell::new(Vec::new()),
+        content: Cell::new(None),
+        list,
+        key,
+        theme,
+    });
+    let content_strong = WidgetPtr::new().add_strong(rsc);
+    let content = content_strong.weak();
+    shared.content.set(Some(content));
+    let inner = build_content(rsc, &shared);
+    content(rsc).set(inner);
+    BuiltToolRow {
+        widget: content_strong.any(),
+        row: ToolRow { shared },
+    }
+}
+
+impl ToolRow {
+    /// The calls this row is currently drawing -- what a caller passes
+    /// back to [`Self::apply_calls`] when something other than the calls
+    /// themselves changed (the session's status).
+    pub fn calls(&self) -> Vec<TranscriptItem> {
+        self.shared.data.borrow().calls.clone()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn card_count(&self) -> usize {
+        self.shared.cards.borrow().len()
+    }
+
+    /// Exists because the expanded appearance is otherwise unreachable
+    /// from anything that cannot press the screen -- a headless
+    /// screenshot on this displayless machine, and a test. Same path a tap
+    /// takes, including `LazySpan::note_tap`, so what it produces is what a
+    /// reader would have got.
+    pub fn set_group_expanded<Rsc: HasEvents>(&self, rsc: &mut Rsc, expanded: bool)
+    where
+        Rsc::State: FocusHost + OpenUrl,
+    {
+        if self.shared.data.borrow().view.group_expanded != expanded {
+            toggle_group(rsc, &self.shared);
+        }
+    }
+
+    /// Bring this row up to date with `calls` **without** rebuilding the
+    /// cards that did not change, and say whether that was possible.
+    /// `false` means the caller must rebuild the row the ordinary way.
+    pub fn apply_calls<Rsc: HasEvents>(
+        &mut self,
+        rsc: &mut Rsc,
+        calls: &[TranscriptItem],
+        working: bool,
+    ) -> bool
+    where
+        Rsc::State: FocusHost + OpenUrl,
+    {
+        if calls.is_empty()
+            || !calls
+                .iter()
+                .all(|c| matches!(c, TranscriptItem::ToolRun { .. }))
+        {
+            return false;
+        }
+        let old = self.shared.data.borrow().calls.clone();
+        if calls.len() < old.len() {
+            return false;
+        }
+        if (old.len() == 1) != (calls.len() == 1) {
+            return false;
+        }
+        let changed: Vec<usize> = (0..old.len()).filter(|&i| old[i] != calls[i]).collect();
+        let ids: HashSet<String> = calls
+            .iter()
+            .filter_map(|c| match c {
+                TranscriptItem::ToolRun { id, .. } => Some(id.clone()),
+                _ => None,
+            })
+            .collect();
+        {
+            let mut data = self.shared.data.borrow_mut();
+            data.working = working;
+            data.calls = calls.to_vec();
+            data.view.open.retain(|id, _| ids.contains(id));
+            data.view.whole.retain(|(id, _), _| ids.contains(id));
+        }
+
+        if self.shared.cards.borrow().is_empty() {
+            if calls.len() != old.len() {
+                let content = build_content(rsc, &self.shared);
+                self.shared.set_content(rsc, content);
+            }
+            return true;
+        }
+        debug_assert_eq!(
+            self.shared.cards.borrow().len(),
+            old.len(),
+            "an open row draws exactly one card per call"
+        );
+
+        for index in changed {
+            redraw_card(rsc, &self.shared, index);
+        }
+        if calls.len() > old.len() {
+            let content = build_content(rsc, &self.shared);
+            self.shared.set_content(rsc, content);
+        }
+        true
+    }
+}