ruby_everywhere 0.6.0 → 0.8.0

data/lib/everywhere/console.rb

@@ -36,7 +36,8 @@ module Everywhere
       desktop: ["desktop", :magenta],
       ios: ["ios", :blue],
       android: ["android", :green],
-      logs: ["logs", :gray]
+      logs: ["logs", :gray],
+      tunnel: ["tunnel", :yellow]
     }.freeze
 
     TAG_WIDTH = TAGS.values.map { |label, _| label.length }.max

data/lib/everywhere/desktop_dev_app.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "shellwords"
+require_relative "desktop_assets"
+require_relative "host"
+require_relative "icon"
+require_relative "paths"
+require_relative "plist"
+require_relative "ui"
+
+module Everywhere
+  # What `every dev` stages under ~/.rubyeverywhere so a live `cargo run` shell
+  # looks like the app being built: the flat assets folder, the Dock icon, and
+  # on macOS a throwaway .app around the dev binary — plus the command that
+  # links the two together and launches it.
+  #
+  # None of this is packaging. `every build` writes the real, complete bundle;
+  # this is the subset a dev session needs, restaged on every launch so
+  # editing an asset and pressing `d` is enough to see it.
+  class DesktopDevApp
+    def initialize(config:)
+      @config = config
+    end
+
+    # native/desktop/assets/** → the staged flat folder the running shell
+    # reads. Runs the same compiler `every build` does, so an asset that
+    # resolves in dev resolves in the packaged app too. Returns
+    # [dir, errors]; the dir is returned even when the app ships no assets,
+    # because the shell only has to cope with it not existing.
+    def stage_desktop_assets
+      dest = Everywhere::Paths.desktop_assets_dir(@config.bundle_id)
+      source = File.join(@config.root, "native", "desktop", "assets")
+      _names, errors = Everywhere::DesktopAssets.write!(source, dest)
+      [dest, errors]
+    end
+
+    # A minimal .app around the dev binary, so macOS has a CFBundleName to
+    # read. Without it every menu that names the app says "example-shell" —
+    # the crate name — because an unbundled process has nothing else to go on.
+    # (Setting NSProcessInfo's processName at runtime does NOT fix this: the
+    # menu bar and the predefined About/Hide/Quit items are built from the
+    # bundle, and macOS has already decided by the time any Rust runs.)
+    #
+    # Only the plist matters here. No icon is stamped: the shell sets the Dock
+    # icon at runtime from NATIVE_ICON_PATH, because Tauri applies its own
+    # compiled-in icon after launch and would win over a bundle icns anyway.
+    # `every build` writes the real, complete plist — this is the dev subset.
+    def stage_dev_bundle
+      app = File.join(Everywhere::Paths.desktop_dev_app_dir(@config.bundle_id),
+                      "#{dev_bundle_name}.app")
+      macos = File.join(app, "Contents", "MacOS")
+      FileUtils.mkdir_p(macos)
+      File.write(File.join(app, "Contents", "Info.plist"), dev_info_plist)
+      [app, File.join(macos, dev_exe_name)]
+    end
+
+    # Display names are free-form (spaces, punctuation, emoji all fine), but
+    # this one becomes a directory name — so the separators, and a leading dot
+    # that would hide or escape the bundle, are the only things taken out.
+    def dev_bundle_name
+      cleaned = @config.name.to_s.gsub(%r{[/\\]}, "-").sub(/\A\.+/, "").strip
+      cleaned.empty? ? "App" : cleaned
+    end
+
+    # Spaces are legal in CFBundleExecutable but a nuisance in every shell
+    # command that names it, so the executable follows the packaged app's
+    # convention and drops them.
+    def dev_exe_name = dev_bundle_name.gsub(/\s+/, "")
+
+    def dev_info_plist
+      name = Everywhere::Plist.escape(@config.name)
+      <<~PLIST
+        <?xml version="1.0" encoding="UTF-8"?>
+        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+        <plist version="1.0">
+        <dict>
+          <key>CFBundleName</key><string>#{name}</string>
+          <key>CFBundleDisplayName</key><string>#{name}</string>
+          <key>CFBundleExecutable</key><string>#{Everywhere::Plist.escape(dev_exe_name)}</string>
+          <key>CFBundleIdentifier</key><string>#{Everywhere::Plist.escape(@config.bundle_id)}</string>
+          <key>CFBundlePackageType</key><string>APPL</string>
+          <key>CFBundleShortVersionString</key><string>#{Everywhere::Plist.escape(@config.version)}</string>
+          <key>NSHighResolutionCapable</key><true/>
+        </dict>
+        </plist>
+      PLIST
+    end
+
+    # The Dock icon for the running shell. `cargo run` produces a bare binary
+    # with no .app around it, so macOS has nothing to read an icon from and
+    # Tauri's compiled-in placeholder wins — which is how you end up staring
+    # at the gem's icon while testing your own app.
+    #
+    # Shaped with the same Big Sur inset + squircle the packaged .icns gets
+    # (Icon.macos_master), so the Dock looks identical in dev and in a release
+    # build rather than subtly rounder in one of them. Returns "" when the app
+    # has no icon — the shell reads that as "leave it alone".
+    def stage_desktop_icon
+      source = @config.icon
+      return "" unless source && File.exist?(source)
+
+      dest = File.join(Everywhere::Paths.desktop_icon_dir(@config.bundle_id), "icon.png")
+      FileUtils.mkdir_p(File.dirname(dest))
+      FileUtils.cp(source, dest) unless Everywhere::Icon.macos_master(source, dest)
+      dest
+    rescue StandardError => e
+      # A Dock icon is never worth failing a dev session over.
+      UI.warn("couldn't prepare the Dock icon (#{e.class}) — using the default")
+      ""
+    end
+
+    # macOS runs the shell from inside a throwaway .app so it has a name;
+    # everywhere else `cargo run` is still the whole story.
+    #
+    # Three steps in one command rather than three Ruby calls, because the
+    # link has to happen between the compile and the launch and we want ONE
+    # supervised child: cargo's progress relays into the dock, and exec then
+    # replaces it with the app, so the pid we're tracking is the window.
+    #
+    # A hard link, not a copy: same volume (both under ~/.rubyeverywhere), so
+    # it's free and instant, where copying a debug Tauri binary is ~100MB on
+    # every launch. cargo replaces the file on rebuild rather than writing
+    # through it, so the link is remade each time — hence `ln -f`.
+    def desktop_command(prepared)
+      return "cargo run" unless Host.darwin?
+
+      _app, exe = stage_dev_bundle
+      built = File.join(prepared.target_dir, "debug", "example-shell")
+      [
+        "cargo build",
+        "{ ln -f #{built.shellescape} #{exe.shellescape} 2>/dev/null || " \
+          "cp -f #{built.shellescape} #{exe.shellescape}; }",
+        "exec #{exe.shellescape}"
+      ].join(" && ")
+    end
+  end
+end

data/lib/everywhere/dock/state.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../clock"
+
 module Everywhere
   class Dock
     # What the dock knows about each thing `every dev` is running. Pure data
@@ -22,7 +24,7 @@ module Everywhere
         def busy? = BUSY.include?(state)
       end
 
-      def initialize(keys, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
+      def initialize(keys, clock: -> { Clock.monotonic })
         @clock = clock
         @lock = Mutex.new
         ordered = ORDER & keys

data/lib/everywhere/engine.rb

@@ -51,6 +51,14 @@ module Everywhere
       app.middleware.insert_before 0, Everywhere::AuthHandoff, root: app.root.to_s
     end
 
+    # `every preview` fronts the dev server with a tunnel whose hostname is
+    # only known at spawn time, so it arrives by env var; without this, Rails'
+    # host authorization greets every phone with a blocked-host page.
+    initializer "everywhere.preview_host" do |app|
+      host = ENV["EVERYWHERE_PREVIEW_HOST"].to_s
+      app.config.hosts << host if app.config.respond_to?(:hosts) && !host.empty?
+    end
+
     # /everywhere/ios_v1.json — the mobile shells' remote path configuration
     # (rules + settings.tabs), generated from config/everywhere.yml at request
     # time so tab changes ship with a normal deploy. A real controller (not
@@ -64,6 +72,22 @@ module Everywhere
         require_relative "mobile_configs_controller"
         get "/everywhere/reset", to: Everywhere::MobileConfigsController.action(:reset),
                                  as: :everywhere_reset
+        # Jump preview endpoints — dead (404) outside `every preview` runs.
+        # OPTIONS routes are the CORS preflights: the connect page calling
+        # these lives on the Jump site, another origin by definition.
+        get "/everywhere/jump_v1", to: Everywhere::MobileConfigsController.action(:jump_manifest),
+                                   defaults: { format: "json" },
+                                   as: :everywhere_jump_manifest
+        match "/everywhere/jump_v1", to: Everywhere::MobileConfigsController.action(:jump_manifest),
+                                     via: :options
+        post "/everywhere/jump/session", to: Everywhere::MobileConfigsController.action(:jump_session),
+                                         as: :everywhere_jump_session
+        match "/everywhere/jump/session", to: Everywhere::MobileConfigsController.action(:jump_session),
+                                          via: :options
+        # The way back out of a preview — served on EVERY app with this gem,
+        # because after instance.set the previewed app is all Jump can reach.
+        get "/everywhere/jump/leave", to: Everywhere::MobileConfigsController.action(:jump_leave),
+                                      as: :everywhere_jump_leave
         get "/everywhere/:platform_v1", to: Everywhere::MobileConfigsController.action(:show),
                                         constraints: { platform_v1: /(?:ios|android)_v1/ },
                                         defaults: { format: "json" },

data/lib/everywhere/entrypoint.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require_relative "cli"
+require_relative "ui"
+
+module Everywhere
+  # The body of both executables — `every` and `rbe` are the same CLI under two
+  # names, so exe/* stay one-liners that call in here.
+  module Entrypoint
+    module_function
+
+    def run(argv = ARGV)
+      Dry::CLI.new(Everywhere::CLI).call(arguments: argv)
+    rescue Interrupt
+      # ^C is an answer, not a crash: no backtrace, and the shell's own convention
+      # for "killed by SIGINT".
+      exit 130
+    rescue Everywhere::Error => e
+      # Everywhere::Fatal is a SystemExit, not an Error, so a die! that already
+      # printed its own line passes straight through here.
+      Everywhere::UI.die!(e.message)
+    end
+  end
+end

data/lib/everywhere/error.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # Required on its own by every file that raises it, so each stays loadable
+  # standalone (the packaged runtime requires them piecemeal, without going
+  # through everywhere.rb).
+  class Error < StandardError; end
+end

data/lib/everywhere/framework.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "error"
+
 module Everywhere
   # Framework adapters keep both the CLI (dev/build) and the packaged runtime
   # (boot) framework-agnostic. Each adapter owns two sides of one framework:
@@ -32,9 +34,24 @@ module Everywhere
       File.exist?(File.join(root, "config.ru")) && gemfile_mentions?(root, "sinatra")
     end
 
+    # Bundler reads either name, and `gem "rails"` / `gem("rails")` are the same
+    # line to it. Anchored at the start of the line so a commented-out gem — the
+    # usual reason a Gemfile still mentions one — doesn't count as detection.
+    GEMFILE_NAMES = %w[Gemfile gems.rb].freeze
+
     def self.gemfile_mentions?(root, gem_name)
-      gemfile = File.join(root, "Gemfile")
-      File.exist?(gemfile) && File.read(gemfile).match?(/gem ["']#{Regexp.escape(gem_name)}/)
+      pattern = /^\s*gem[\s(]+["']#{Regexp.escape(gem_name)}/
+      GEMFILE_NAMES.any? do |name|
+        path = File.join(root, name)
+        File.exist?(path) && read_source(path).match?(pattern)
+      end
+    end
+
+    # Gemfiles are UTF-8, but the process may be running under LANG=C, where
+    # File.read tags the bytes as US-ASCII and any accented comment makes the
+    # match raise instead of answering.
+    def self.read_source(path)
+      File.read(path, encoding: "UTF-8").scrub
     end
 
     attr_reader :root
@@ -120,8 +137,10 @@ module Everywhere
       def name = "rails"
 
       # CLI
+      # executable?, not exist?: a repo downloaded as a zip loses the exec bit,
+      # and running bin/dev then dies with a bare "Permission denied".
       def dev_command
-        File.exist?(File.join(root, "bin", "dev")) ? "bin/dev" : "bundle exec rails server"
+        File.executable?(File.join(root, "bin", "dev")) ? "bin/dev" : "bundle exec rails server"
       end
 
       def precompile_env
@@ -187,7 +206,7 @@ module Everywhere
       def name = "sinatra"
 
       def dev_command
-        File.exist?(File.join(root, "bin", "dev")) ? "bin/dev" : "bundle exec rackup --host 127.0.0.1"
+        File.executable?(File.join(root, "bin", "dev")) ? "bin/dev" : "bundle exec rackup --host 127.0.0.1"
       end
 
       # No asset pipeline by default; nothing to precompile.
@@ -206,6 +225,4 @@ module Everywhere
       def env_exports = { "HANAMI_ENV" => "production", "RACK_ENV" => "production" }
     end
   end
-
-  class Error < StandardError; end
 end

data/lib/everywhere/host.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # The machine the CLI is running on — never the machine it's building for
+  # (that's the --target, see Config.os_of and the receipt).
+  module Host
+    module_function
+
+    def darwin? = RUBY_PLATFORM.include?("darwin")
+  end
+end

data/lib/everywhere/ignore.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 module Everywhere
-  # Shared source-exclusion rules, read from `.everywhereignore` (dockerignore
-  # style) when present, else a sensible default. ONE source of truth so the
+  # Shared source-exclusion rules: the built-in DEFAULTS, plus `.everywhereignore`
+  # (dockerignore style) appended when the app has one. ONE source of truth so the
   # build receipt's source checksum (Receipt) and the Platform snapshot
   # (`every platform build`, later) describe exactly the same set of files — a
   # checksum that didn't match what actually ships would be worse than none.
@@ -15,7 +15,8 @@ module Everywhere
   #
   # Rules are evaluated top to bottom and the LAST one that matches a path wins
   # (dockerignore semantics), so ordering matters: put `!` re-includes after the
-  # broad exclude they carve out of.
+  # broad exclude they carve out of — and the app's file, coming last, can
+  # re-include anything DEFAULTS excluded.
   class Ignore
     FILE = ".everywhereignore"
     FLAGS = File::FNM_PATHNAME | File::FNM_DOTMATCH
@@ -29,10 +30,17 @@ module Everywhere
       *.key *.pem *.crt *.p12 *.mobileprovision
     ].freeze
 
+    # The app's file is layered ON TOP of DEFAULTS rather than replacing them:
+    # a project that adds one line to skip a fixture dir must not thereby start
+    # shipping .env and *.p12. Last match wins, so a user who really wants a
+    # defaulted-out file back can still `!` it in.
     def self.for(root)
       path = File.join(root, FILE)
-      source = File.exist?(path) ? File.read(path) : DEFAULTS.join("\n")
-      new(parse(source))
+      return new(parse(DEFAULTS.join("\n"))) unless File.exist?(path)
+
+      # UTF-8 explicitly (and scrubbed): under LANG=C the bytes come back
+      # US-ASCII and a non-ASCII path pattern makes the matching raise.
+      new(parse(DEFAULTS.join("\n")) + parse(File.read(path, encoding: "UTF-8").scrub))
     end
 
     # → [{ negated:, pattern: }, ...] in file order. Blank lines and whole-line

data/lib/everywhere/jump.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "securerandom"
+
+module Everywhere
+  # Jump: the companion app that previews RubyEverywhere apps on a real
+  # device (spec: platform/docs/jump.md). The server side is two endpoints,
+  # live only while `every preview` runs (EVERYWHERE_JUMP_TOKEN set):
+  #
+  #   POST /everywhere/jump/session   {token, device_name} -> {bearer}
+  #   GET  /everywhere/jump_v1.json   Authorization: Bearer ... -> manifest
+  #
+  # The pairing token is per-run and multi-use (a forwarded link must work
+  # for a second coworker's device); each device exchanges it once for a
+  # bearer. Bearers are stateless HMACs keyed on the token — no session
+  # store, and every bearer dies with the run because the token does.
+  module Jump
+    PROTOCOL = 1
+    SESSION_PATH = "/everywhere/jump/session"
+    MANIFEST_PATH = "/everywhere/jump_v1.json"
+
+    module_function
+
+    def token = ENV["EVERYWHERE_JUMP_TOKEN"]
+    def enabled? = !token.to_s.empty?
+
+    def manifest_hash(config)
+      {
+        "version" => 1,
+        "jump_protocol" => PROTOCOL,
+        "app" => { "name" => config.name, "identifier" => config.bundle_id },
+        "appearance" => {
+          "tint_color" => config.tint_color,
+          "background_color" => config.background_color
+        }.compact,
+        "entry_path" => config.entry_path,
+        "remote_instances" => (true if config.remote_instances?),
+        "path_configuration" => {
+          "ios" => "/everywhere/ios_v1.json",
+          "android" => "/everywhere/android_v1.json"
+        },
+        "native_extensions" => [
+          ("ios" if config.native_ios?),
+          ("android" if config.native_android?)
+        ].compact
+      }.compact
+    end
+
+    # nil on a bad token; the session hash otherwise. Logs to stderr so the
+    # connect shows up in the terminal `every preview` is pumping.
+    def exchange(candidate, device_name)
+      return nil unless valid_token?(candidate)
+
+      warn connect_log_line(device_name)
+      { "bearer" => mint_bearer, "jump_protocol" => PROTOCOL }
+    end
+
+    def mint_bearer(tok = token)
+      nonce = SecureRandom.hex(12)
+      "v1.#{nonce}.#{signature(tok, nonce)}"
+    end
+
+    def valid_bearer?(bearer, tok = token)
+      version, nonce, mac = bearer.to_s.split(".", 3)
+      return false unless version == "v1" && nonce && mac && !tok.to_s.empty?
+
+      expected = signature(tok, nonce)
+      mac.bytesize == expected.bytesize && OpenSSL.fixed_length_secure_compare(mac, expected)
+    end
+
+    def valid_token?(candidate, tok = token)
+      candidate = candidate.to_s
+      return false if tok.to_s.empty? || candidate.empty?
+
+      candidate.bytesize == tok.bytesize && OpenSSL.fixed_length_secure_compare(candidate, tok)
+    end
+
+    def signature(tok, nonce)
+      OpenSSL::HMAC.hexdigest("SHA256", tok, "jump-session-v1:#{nonce}")
+    end
+
+    LEAVE_PATH = "/everywhere/jump/leave"
+
+    # The connect page lives on the Jump site; the endpoints live on the
+    # previewed app — always cross-origin. `*` is safe here: nothing is
+    # cookie-authenticated, the token/bearer IS the credential.
+    CORS_HEADERS = {
+      "access-control-allow-origin" => "*",
+      "access-control-allow-methods" => "GET, POST, OPTIONS",
+      "access-control-allow-headers" => "authorization, content-type",
+      "access-control-max-age" => "600"
+    }.freeze
+
+    # Appended to the previewed app's resolved tabs while preview runs: after
+    # instance.set the previewed app's path configuration is the ONLY chrome
+    # Jump has, so without this tab there is no way back to the launcher. A
+    # tabless app gets a pair — its own content as tab one, the exit as tab
+    # two — because a lone exit tab would replace the app's content outright.
+    def exit_tabs(config, os, tabs)
+      return tabs + [exit_tab(os)] unless tabs.empty?
+
+      app_tab = { "title" => config.name,
+                  "path" => config.entry_path || "/",
+                  "icon" => os.to_s == "android" ? "apps" : "app" }
+      [app_tab, exit_tab(os)]
+    end
+
+    def exit_tab(os)
+      { "title" => "Jump",
+        "path" => LEAVE_PATH,
+        "icon" => os.to_s == "android" ? "u_turn_left" : "arrow.uturn.backward.circle" }
+    end
+
+    def connect_log_line(device_name)
+      name = device_name.to_s.gsub(/[[:cntrl:]]/, "").strip[0, 64]
+      name = "A device" if name.empty?
+      "[everywhere] Jump connected: #{name}"
+    end
+  end
+end

data/lib/everywhere/line_pump.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "clock"
+
 module Everywhere
   # Turns the raw byte stream off a pty master into whole lines.
   #
@@ -25,7 +27,7 @@ module Everywhere
     # "Overwrite? [Yn]" — would be invisible for as long as it mattered.
     IDLE_FLUSH = 0.2
 
-    def initialize(idle_flush: IDLE_FLUSH, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
+    def initialize(idle_flush: IDLE_FLUSH, clock: -> { Clock.monotonic })
       # Bytes in, text out. A pty hands over BINARY, and a chunk boundary can
       # land in the middle of a multi-byte character, so buffering and splitting
       # happen on bytes — UTF-8 is self-synchronizing, so a newline is never

data/lib/everywhere/minisign.rb

@@ -4,6 +4,7 @@ require "openssl"
 require "base64"
 require "securerandom"
 require_relative "blake2b"
+require_relative "error"
 
 module Everywhere
   # Minisign-compatible Ed25519 signing, stdlib-only (OpenSSL + our Blake2b).

data/lib/everywhere/mobile_config_endpoint.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "config"
+require_relative "jump"
 
 module Everywhere
   # Rack middleware serving the mobile shells' remote path configuration:
@@ -32,6 +33,26 @@ module Everywhere
     end
 
     def call(env)
+      # Jump endpoints exist only while `every preview` runs (pass through
+      # otherwise, so nothing is reachable on a normal deploy). The leave page
+      # is the exception — it's how Jump escapes a previewed app, so it must
+      # answer whenever this gem is present.
+      if Jump.enabled?
+        if env["REQUEST_METHOD"] == "OPTIONS" &&
+           [Jump::SESSION_PATH, Jump::MANIFEST_PATH].include?(env["PATH_INFO"])
+          return [204, Jump::CORS_HEADERS.dup, []]
+        end
+        if env["REQUEST_METHOD"] == "POST" && env["PATH_INFO"] == Jump::SESSION_PATH
+          return jump_session(env)
+        end
+        if env["REQUEST_METHOD"] == "GET" && env["PATH_INFO"] == Jump::MANIFEST_PATH
+          return jump_manifest(env)
+        end
+      end
+      if env["REQUEST_METHOD"] == "GET" && env["PATH_INFO"] == Jump::LEAVE_PATH
+        return html(Everywhere.mobile_jump_leave_html)
+      end
+
       return @app.call(env) unless env["REQUEST_METHOD"] == "GET"
 
       if env["PATH_INFO"] == RESET
@@ -56,11 +77,37 @@ module Everywhere
       os = match[1]
       config = Config.load(@root)
       tabs = Everywhere.resolve_tabs(config.tabs_for(os), request_for(env))
+      tabs = Jump.exit_tabs(config, os, tabs) if Jump.enabled?
       json(config.path_configuration_json(os, tabs: tabs))
     end
 
     private
 
+    def jump_session(env)
+      require "json"
+      body = JSON.parse(env["rack.input"].read.to_s) rescue {}
+      result = Jump.exchange(body["token"], body["device_name"])
+      return forbidden unless result
+
+      [201, jump_json_headers, [JSON.generate(result)]]
+    end
+
+    def jump_manifest(env)
+      require "json"
+      bearer = env["HTTP_AUTHORIZATION"].to_s.delete_prefix("Bearer ").strip
+      return forbidden unless Jump.valid_bearer?(bearer)
+
+      [200, jump_json_headers, [JSON.generate(Jump.manifest_hash(Config.load(@root)))]]
+    end
+
+    def forbidden
+      [403, jump_json_headers, ['{"error":"invalid or expired preview token"}']]
+    end
+
+    def jump_json_headers
+      { "content-type" => "application/json", "cache-control" => "no-store" }.merge(Jump::CORS_HEADERS)
+    end
+
     def json(body)
       [200, { "content-type" => "application/json", "cache-control" => cache_control }, [body]]
     end

data/lib/everywhere/mobile_configs_controller.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "config"
+require_relative "jump"
 
 module Everywhere
   # Serves the mobile shells' remote path configuration in Rails apps:
@@ -31,6 +32,7 @@ module Everywhere
 
       os = params[:platform_v1].delete_suffix("_v1")
       tabs = Everywhere.resolve_tabs(config.tabs_for(os), request)
+      tabs = Jump.exit_tabs(config, os, tabs) if Jump.enabled?
       render json: config.path_configuration_hash(os, tabs: tabs)
     end
 
@@ -52,6 +54,43 @@ module Everywhere
       render json: json
     end
 
+    # Jump preview endpoints (spec: platform/docs/jump.md §3). 404 unless
+    # `every preview` is running (EVERYWHERE_JUMP_TOKEN set), so nothing is
+    # reachable on a normal deploy. Always cross-origin (the connect page
+    # lives on the Jump site), hence the CORS headers + preflight.
+    def jump_session
+      return head(:not_found) unless Jump.enabled?
+
+      apply_jump_headers
+      return head(:no_content) if request.method == "OPTIONS"
+
+      result = Jump.exchange(params[:token], params[:device_name])
+      return head(:forbidden) unless result
+
+      render json: result, status: :created
+    end
+
+    def jump_manifest
+      return head(:not_found) unless Jump.enabled?
+
+      apply_jump_headers
+      return head(:no_content) if request.method == "OPTIONS"
+
+      bearer = request.headers["Authorization"].to_s.delete_prefix("Bearer ").strip
+      return head(:forbidden) unless Jump.valid_bearer?(bearer)
+
+      render json: Jump.manifest_hash(Config.load(::Rails.root.to_s))
+    end
+
+    # GET /everywhere/jump/leave — the way back OUT of a Jump preview. Served
+    # unconditionally (unlike the endpoints above): once Jump re-roots onto a
+    # previewed app, this page is its only path home, preview session or not.
+    def jump_leave
+      response.headers["cache-control"] = "no-store"
+      render html: Everywhere.mobile_jump_leave_html.html_safe,
+             layout: false, content_type: "text/html"
+    end
+
     # GET /everywhere/reset?to=/path — the native "reset the app" page. Auth
     # flows redirect the shell here so it rebuilds cleanly before landing on
     # `to`. Never cached (it must run every time).
@@ -60,5 +99,12 @@ module Everywhere
       render html: Everywhere.mobile_reset_html(params[:to]).html_safe,
              layout: false, content_type: "text/html"
     end
+
+    private
+
+    def apply_jump_headers
+      response.headers["cache-control"] = "no-store"
+      Jump::CORS_HEADERS.each { |key, value| response.headers[key] = value }
+    end
   end
 end