fix(watch): trust Tailscale certs + shared Keychain

frontend/ios/App/App.xcodeproj/project.pbxproj

@@ -7,6 +7,8 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
+		1F97793D2FB86A7A00B87829 /* WatchAuthBridge.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1F97793C2FB86A7A00B87829 /* WatchAuthBridge.swift */; };
+		1F97793E2FB86A8000B87829 /* WatchRelayCoordinator.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1F97793B2FB86A5700B87829 /* WatchRelayCoordinator.swift */; };
 		2C807BBEF27900A4B4C713F3 /* VoiceService.swift in Sources */ = {isa = PBXBuildFile; fileRef = E438A1E5CA844963819792C4 /* VoiceService.swift */; };
 		2FAD9763203C412B000D30F8 /* config.xml in Resources */ = {isa = PBXBuildFile; fileRef = 2FAD9762203C412B000D30F8 /* config.xml */; };
 		30271F81931105049A8D0BCA /* MitzoShared in Frameworks */ = {isa = PBXBuildFile; productRef = 2994CBB574BE2544F671F9BF /* MitzoShared */; };
@@ -20,19 +22,20 @@
 		51C82AC7CC9D0CD9BB2B8A2D /* MitzoWatchApp.swift in Sources */ = {isa = PBXBuildFile; fileRef = 729F6EAA7E6281CC8E027E58 /* MitzoWatchApp.swift */; };
 		87D5F3E4B2B79830BDC6F3CA /* VoiceInputBar.swift in Sources */ = {isa = PBXBuildFile; fileRef = CF9D046593F17D7DF6E6056B /* VoiceInputBar.swift */; };
 		91D36789BA83D98F79CA5EA1 /* ChatViewModel.swift in Sources */ = {isa = PBXBuildFile; fileRef = CE85EF8992F04F5159962BE4 /* ChatViewModel.swift */; };
-
 		9A8EE45055EB9BF5AB711065 /* PermissionBanner.swift in Sources */ = {isa = PBXBuildFile; fileRef = AB84607485C9AAA4D695F477 /* PermissionBanner.swift */; };
 		B87D83BB43FD8D7A331D5C16 /* LoginView.swift in Sources */ = {isa = PBXBuildFile; fileRef = A60979EA195F633EE664E716 /* LoginView.swift */; };
 		BDF94F63DBEDEAABE3DBA4B8 /* ChatView.swift in Sources */ = {isa = PBXBuildFile; fileRef = FF6B3AF931A2A562E89BCCA0 /* ChatView.swift */; };
 		E7C8020332FACEAD32C32377 /* MitzoShared in Frameworks */ = {isa = PBXBuildFile; productRef = A997DA8238CC43203EE0AD73 /* MitzoShared */; };
 		EB52F01B4D4DE944429DFFB7 /* SessionListView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9A3543D568BAEA16F3464C2D /* SessionListView.swift */; };
 		EBDB8718D00B3CAC47EFD6EC /* AppState.swift in Sources */ = {isa = PBXBuildFile; fileRef = FB2544C9BF33F98A575F8F9F /* AppState.swift */; };
+		F1A2B3C4D5E6F70800000001 /* ComposeSheet.swift in Sources */ = {isa = PBXBuildFile; fileRef = F1A2B3C4D5E6F70800000002 /* ComposeSheet.swift */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXFileReference section */
+		1F97793B2FB86A5700B87829 /* WatchRelayCoordinator.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WatchRelayCoordinator.swift; sourceTree = "<group>"; };
+		1F97793C2FB86A7A00B87829 /* WatchAuthBridge.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WatchAuthBridge.swift; sourceTree = "<group>"; };
 		264FB5577C8B9098BE816A36 /* MitzoWatch.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = MitzoWatch.app; sourceTree = BUILT_PRODUCTS_DIR; };
 		2FAD9762203C412B000D30F8 /* config.xml */ = {isa = PBXFileReference; lastKnownFileType = text.xml; path = config.xml; sourceTree = "<group>"; };
-
 		50379B222058CBB4000EE86E /* capacitor.config.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.json; path = capacitor.config.json; sourceTree = "<group>"; };
 		504EC3041FED79650016851F /* App.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = App.app; sourceTree = BUILT_PRODUCTS_DIR; };
 		504EC3071FED79650016851F /* AppDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
@@ -50,6 +53,7 @@
 		AB84607485C9AAA4D695F477 /* PermissionBanner.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = PermissionBanner.swift; sourceTree = "<group>"; };
 		CE85EF8992F04F5159962BE4 /* ChatViewModel.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = ChatViewModel.swift; sourceTree = "<group>"; };
 		CF9D046593F17D7DF6E6056B /* VoiceInputBar.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = VoiceInputBar.swift; sourceTree = "<group>"; };
+		F1A2B3C4D5E6F70800000002 /* ComposeSheet.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = ComposeSheet.swift; sourceTree = "<group>"; };
 		E438A1E5CA844963819792C4 /* VoiceService.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = VoiceService.swift; sourceTree = "<group>"; };
 		FA1E96663E02190E82402696 /* MitzoWatch.entitlements */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.entitlements; path = MitzoWatch.entitlements; sourceTree = "<group>"; };
 		FB2544C9BF33F98A575F8F9F /* AppState.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = AppState.swift; sourceTree = "<group>"; };
@@ -77,7 +81,6 @@
 /* End PBXFrameworksBuildPhase section */
 
 /* Begin PBXGroup section */
-
 		504EC2FB1FED79650016851F = {
 			isa = PBXGroup;
 			children = (
@@ -104,6 +107,8 @@
 				A1B2C3D40000000000000001 /* App.entitlements */,
 				50379B222058CBB4000EE86E /* capacitor.config.json */,
 				504EC3071FED79650016851F /* AppDelegate.swift */,
+				1F97793B2FB86A5700B87829 /* WatchRelayCoordinator.swift */,
+				1F97793C2FB86A7A00B87829 /* WatchAuthBridge.swift */,
 				504EC30B1FED79650016851F /* Main.storyboard */,
 				504EC30E1FED79650016851F /* Assets.xcassets */,
 				504EC3101FED79650016851F /* LaunchScreen.storyboard */,
@@ -121,7 +126,6 @@
 				CE85EF8992F04F5159962BE4 /* ChatViewModel.swift */,
 				E438A1E5CA844963819792C4 /* VoiceService.swift */,
 			);
-			name = Services;
 			path = Services;
 			sourceTree = "<group>";
 		};
@@ -145,9 +149,9 @@
 				AB84607485C9AAA4D695F477 /* PermissionBanner.swift */,
 				CF9D046593F17D7DF6E6056B /* VoiceInputBar.swift */,
 				FF6B3AF931A2A562E89BCCA0 /* ChatView.swift */,
+				F1A2B3C4D5E6F70800000002 /* ComposeSheet.swift */,
 				9A3543D568BAEA16F3464C2D /* SessionListView.swift */,
 			);
-			name = Views;
 			path = Views;
 			sourceTree = "<group>";
 		};
@@ -233,7 +237,7 @@
 			mainGroup = 504EC2FB1FED79650016851F;
 			packageReferences = (
 				D4C12C0A2AAA248700AAC8A2 /* XCLocalSwiftPackageReference "CapApp-SPM" */,
-				F0C38DA10F17B4BECD2F4E09 /* XCLocalSwiftPackageReference "MitzoShared" */,
+				F0C38DA10F17B4BECD2F4E09 /* XCLocalSwiftPackageReference "../MitzoShared" */,
 			);
 			productRefGroup = 504EC3051FED79650016851F /* Products */;
 			projectDirPath = "";
@@ -273,6 +277,8 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				1F97793D2FB86A7A00B87829 /* WatchAuthBridge.swift in Sources */,
+				1F97793E2FB86A8000B87829 /* WatchRelayCoordinator.swift in Sources */,
 				504EC3081FED79650016851F /* AppDelegate.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -289,6 +295,7 @@
 				9A8EE45055EB9BF5AB711065 /* PermissionBanner.swift in Sources */,
 				87D5F3E4B2B79830BDC6F3CA /* VoiceInputBar.swift in Sources */,
 				BDF94F63DBEDEAABE3DBA4B8 /* ChatView.swift in Sources */,
+				F1A2B3C4D5E6F70800000001 /* ComposeSheet.swift in Sources */,
 				EB52F01B4D4DE944429DFFB7 /* SessionListView.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -565,7 +572,7 @@
 			isa = XCLocalSwiftPackageReference;
 			relativePath = "CapApp-SPM";
 		};
-		F0C38DA10F17B4BECD2F4E09 /* XCLocalSwiftPackageReference "MitzoShared" */ = {
+		F0C38DA10F17B4BECD2F4E09 /* XCLocalSwiftPackageReference "../MitzoShared" */ = {
 			isa = XCLocalSwiftPackageReference;
 			relativePath = ../MitzoShared;
 		};
@@ -574,7 +581,7 @@
 /* Begin XCSwiftPackageProductDependency section */
 		2994CBB574BE2544F671F9BF /* MitzoShared */ = {
 			isa = XCSwiftPackageProductDependency;
-			package = F0C38DA10F17B4BECD2F4E09 /* XCLocalSwiftPackageReference "MitzoShared" */;
+			package = F0C38DA10F17B4BECD2F4E09 /* XCLocalSwiftPackageReference "../MitzoShared" */;
 			productName = MitzoShared;
 		};
 		4D22ABE82AF431CB00220026 /* CapApp-SPM */ = {
@@ -584,7 +591,7 @@
 		};
 		A997DA8238CC43203EE0AD73 /* MitzoShared */ = {
 			isa = XCSwiftPackageProductDependency;
-			package = F0C38DA10F17B4BECD2F4E09 /* XCLocalSwiftPackageReference "MitzoShared" */;
+			package = F0C38DA10F17B4BECD2F4E09 /* XCLocalSwiftPackageReference "../MitzoShared" */;
 			productName = MitzoShared;
 		};
 /* End XCSwiftPackageProductDependency section */

frontend/ios/App/App/App.entitlements

@@ -4,5 +4,9 @@
 <dict>
 	<key>aps-environment</key>
 	<string>development</string>
+	<key>keychain-access-groups</key>
+	<array>
+		<string>$(AppIdentifierPrefix)com.mitzo.app</string>
+	</array>
 </dict>
 </plist>

frontend/ios/App/App/AppDelegate.swift

@@ -5,9 +5,10 @@ import Capacitor
 class AppDelegate: UIResponder, UIApplicationDelegate {
 
     var window: UIWindow?
+    private let watchRelay = WatchRelayCoordinator()
 
     func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
-        // Override point for customization after application launch.
+        watchRelay.start()
         return true
     }
 
@@ -17,12 +18,11 @@ class AppDelegate: UIResponder, UIApplicationDelegate {
     }
 
     func applicationDidEnterBackground(_ application: UIApplication) {
-        // Use this method to release shared resources, save user data, invalidate timers, and store enough application state information to restore your application to its current state in case it is terminated later.
-        // If your application supports background execution, this method is called instead of applicationWillTerminate: when the user quits.
+        watchRelay.suspend()
     }
 
     func applicationWillEnterForeground(_ application: UIApplication) {
-        // Called as part of the transition from the background to the active state; here you can undo many of the changes made on entering the background.
+        watchRelay.reconnect()
     }
 
     func applicationDidBecomeActive(_ application: UIApplication) {
@@ -46,4 +46,12 @@ class AppDelegate: UIResponder, UIApplicationDelegate {
         return ApplicationDelegateProxy.shared.application(application, continue: userActivity, restorationHandler: restorationHandler)
     }
 
+    func application(_ application: UIApplication, didRegisterForRemoteNotificationsWithDeviceToken deviceToken: Data) {
+        NotificationCenter.default.post(name: .capacitorDidRegisterForRemoteNotifications, object: deviceToken)
+    }
+
+    func application(_ application: UIApplication, didFailToRegisterForRemoteNotificationsWithError error: Error) {
+        NotificationCenter.default.post(name: .capacitorDidFailToRegisterForRemoteNotifications, object: error)
+    }
+
 }

frontend/ios/App/App/Info.plist

@@ -2,7 +2,9 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-    <key>CAPACITOR_DEBUG</key>
+    <key>AppIdentifierPrefix</key>
+	<string>$(AppIdentifierPrefix)</string>
+	<key>CAPACITOR_DEBUG</key>
 	<string>$(CAPACITOR_DEBUG)</string>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>en</string>

frontend/ios/App/App/WatchAuthBridge.swift

@@ -0,0 +1,45 @@
+// Capacitor plugin that bridges web auth tokens into the native shared Keychain.
+// When the web app logs in, it calls WatchAuthBridge.saveToken() so the
+// watch can read the JWT from the shared Keychain access group.
+
+import Capacitor
+import MitzoShared
+
+@objc(WatchAuthBridge)
+public class WatchAuthBridge: CAPPlugin, CAPBridgedPlugin {
+    public let identifier = "WatchAuthBridge"
+    public let jsName = "WatchAuthBridge"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "saveToken", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "clearToken", returnType: CAPPluginReturnPromise),
+    ]
+
+    private let authManager = AuthManager()
+
+    @objc func saveToken(_ call: CAPPluginCall) {
+        guard let token = call.getString("token") else {
+            call.reject("Missing token")
+            return
+        }
+
+        Task {
+            do {
+                try await authManager.saveToken(token)
+                call.resolve()
+            } catch {
+                call.reject("Failed to save token: \(error.localizedDescription)")
+            }
+        }
+    }
+
+    @objc func clearToken(_ call: CAPPluginCall) {
+        Task {
+            do {
+                try await authManager.clearToken()
+                call.resolve()
+            } catch {
+                call.reject("Failed to clear token: \(error.localizedDescription)")
+            }
+        }
+    }
+}

frontend/ios/App/App/WatchRelayCoordinator.swift

@@ -0,0 +1,69 @@
+// Coordinates native WS connection + WatchRelay for Apple Watch communication.
+// The Capacitor web layer has its own WS; this is a second native connection
+// used exclusively by WatchRelayHost to bridge watch ↔ server messages.
+
+import UIKit
+import MitzoShared
+
+final class WatchRelayCoordinator: @unchecked Sendable {
+    private let authManager = AuthManager()
+    private let watchRelay: WatchRelayHost
+    private var wsClient: MitzoWSClient?
+    private let lock = NSLock()
+
+    private var serverURL: URL {
+        let stored = UserDefaults.standard.string(forKey: "mitzo_server_url")
+        return URL(string: stored ?? "https://dimakis-mac.tail:3100")!
+    }
+
+    init() {
+        watchRelay = WatchRelayHost(authManager: authManager)
+        // Activate WCSession immediately so watch can reach us even before login
+        watchRelay.activate(wsClient: nil, apiClient: nil)
+    }
+
+    func start() {
+        Task { await connect() }
+    }
+
+    func reconnect() {
+        Task { await connect() }
+    }
+
+    func suspend() {
+        Task {
+            let client: MitzoWSClient? = lock.withLock { wsClient }
+            if let client {
+                let sessions = await client.getSuspendSessions()
+                if !sessions.isEmpty {
+                    try? await client.suspend(sessions: sessions)
+                }
+            }
+        }
+    }
+
+    private func connect() async {
+        guard let token = try? await authManager.getToken() else { return }
+
+        var components = URLComponents(url: serverURL, resolvingAgainstBaseURL: false)!
+        components.scheme = components.scheme == "https" ? "wss" : "ws"
+        components.path = "/ws/chat"
+        components.queryItems = [URLQueryItem(name: "token", value: token)]
+
+        guard let wsURL = components.url else { return }
+
+        let client = MitzoWSClient(url: wsURL)
+        lock.withLock { wsClient = client }
+
+        let api = MitzoAPIClient(baseURL: serverURL, authManager: authManager)
+        // Update relay with authenticated clients (WCSession already activated in init)
+        watchRelay.activate(wsClient: client, apiClient: api)
+
+        let relay = watchRelay
+        await client.connect { event in
+            if case .message(let msg) = event {
+                relay.forwardToWatch(msg)
+            }
+        }
+    }
+}

frontend/ios/App/WatchRelayCoordinator.swift

@@ -0,0 +1,74 @@
+// Coordinates native WS connection + WatchRelay for Apple Watch communication.
+// The Capacitor web layer has its own WS; this is a second native connection
+// used exclusively by WatchRelayHost to bridge watch ↔ server messages.
+
+import UIKit
+import MitzoShared
+
+final class WatchRelayCoordinator: @unchecked Sendable {
+    private let authManager = AuthManager()
+    private let watchRelay: WatchRelayHost
+    private var wsClient: MitzoWSClient?
+    private let lock = NSLock()
+
+    private var serverURL: URL {
+        let stored = UserDefaults.standard.string(forKey: "mitzo_server_url")
+        return URL(string: stored ?? "https://dimakis-mac.tail:3100")!
+    }
+
+    init() {
+        watchRelay = WatchRelayHost(authManager: authManager)
+    }
+
+    func start() {
+        // Activate WCSession unconditionally so the watch relay works
+        // even before auth. This lets the auth_token relay bootstrap
+        // the token, and list_sessions/get_messages return proper errors
+        // instead of silently hanging with no delegate.
+        let apiClient = MitzoAPIClient(baseURL: serverURL, authManager: authManager)
+        watchRelay.activate(wsClient: nil, apiClient: apiClient)
+
+        Task { await connectWS() }
+    }
+
+    func reconnect() {
+        Task { await connectWS() }
+    }
+
+    func suspend() {
+        Task {
+            let client: MitzoWSClient? = lock.withLock { wsClient }
+            if let client {
+                let sessions = await client.getSuspendSessions()
+                if !sessions.isEmpty {
+                    try? await client.suspend(sessions: sessions)
+                }
+            }
+        }
+    }
+
+    /// Connect the native WS (for forwarding server events to watch).
+    /// WCSession is already active from start() — this only adds WS.
+    private func connectWS() async {
+        guard let token = try? await authManager.getToken() else { return }
+
+        var components = URLComponents(url: serverURL, resolvingAgainstBaseURL: false)!
+        components.scheme = components.scheme == "https" ? "wss" : "ws"
+        components.path = "/ws/chat"
+        components.queryItems = [URLQueryItem(name: "token", value: token)]
+
+        guard let wsURL = components.url else { return }
+
+        let client = MitzoWSClient(url: wsURL)
+        let apiClient = MitzoAPIClient(baseURL: serverURL, authManager: authManager)
+        lock.withLock { wsClient = client }
+        watchRelay.activate(wsClient: client, apiClient: apiClient)
+
+        let relay = watchRelay
+        await client.connect { event in
+            if case .message(let msg) = event {
+                relay.forwardToWatch(msg)
+            }
+        }
+    }
+}