ruby_everywhere 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1644d6c9be14fdb8ef738eaee6f33225e5916ea401945f7c6c494e8963a2c16
-  data.tar.gz: 03621b7846f16b5621a352e7d4fc42ac38c8859095fc1be1098eef48b081fb0f
+  metadata.gz: 97a5e572306841f37118d70c1b5702efc0fc1d48d9377e8ad325e551b7b720b2
+  data.tar.gz: 9ffbcd6323f81374f94b1237cdf06a13c50dc2c3466479c8fbb0cfdedfa6ddbd
 SHA512:
-  metadata.gz: 4de42927fa8a53c136e0f9a3015ee1f930199642a26504d198673d0fe3e8cc24e32e9db219d34a170023809db8a9fb20715a6577e13cc6bb030fc9e3a8600b45
-  data.tar.gz: 58da2af357a422bd9dd87badf31175ba71767a5c3364d52f875690fd217a0be15cf1b12296bb195332ebec015ede65b7f486e3c1bf65ff66d5d0cb6831a20e3f
+  metadata.gz: 66071e14c65bec691891622e1133253e77437cf5ce1d1c43d6785e3b70568ad12c9bcd7155d932a2bf27b313779b562082bdf9fb9f38a1c7468ccff1006c04e2
+  data.tar.gz: '068d02e32db302d5b48e1325e9f789e460ede9e18a15e30b20fee7d2ac22a100858577f7ba2fd138d0a2655eaa5e50532058527921b8a29abd3dc727aeb02339'

data/lib/everywhere/builders/android.rb

@@ -287,10 +287,49 @@ module Everywhere
         write_drawables(work)
         write_icon_font(work)
         write_manifest(work)
+        write_network_security(work)
         write_extensions(work)
         write_native_packages(work)
       end
 
+      # The template's baseline forbids cleartext everywhere (debug overlays
+      # loopback + .local only — see the two res/xml/network_security_config.xml
+      # files and their comments). An instance app (`remote.instances: true`)
+      # exists to load OTHER apps, and `every preview --lan` serves those as
+      # plain http on whatever LAN address the laptop has that day — an address
+      # no config written at build time can enumerate, and Android's
+      # network-security-config has no CIDR syntax to scope a private-range
+      # exception the way iOS's NSAllowsLocalNetworking does. So instance apps
+      # get cleartext permitted wholesale, in both build types (the debug
+      # overlay REPLACES main's resource, so leaving it standing would make
+      # debug builds stricter than release). The shell's own traffic to
+      # remote.url stays https; the alternative is a picker that cannot open
+      # what it picked.
+      #
+      # Written only when instances is on: stage() re-copies the template over
+      # the work dir every build, so switching it off restores the strict
+      # default without a writer for that side of the toggle.
+      def write_network_security(work)
+        return unless @config.remote_instances?
+
+        UI.step("allowing cleartext http #{UI.dim("(remote.instances: previewed apps live on LAN addresses)")}")
+        xml = <<~XML
+          <?xml version="1.0" encoding="utf-8"?>
+          <!-- Written by `every build` because config/everywhere.yml sets
+               remote.instances: true — previewed apps arrive as plain http on
+               LAN addresses that cannot be enumerated at build time. Do not
+               edit; the template's strict default returns if instances is
+               turned off. -->
+          <network-security-config>
+              <base-config cleartextTrafficPermitted="true" />
+          </network-security-config>
+        XML
+        [File.join(work, "app", "src", "main", "res", "xml", "network_security_config.xml"),
+         File.join(work, "app", "src", "debug", "res", "xml", "network_security_config.xml")].each do |path|
+          File.write(path, xml)
+        end
+      end
+
       # --- identity -------------------------------------------------------------
 
       # app/build.gradle.kts reads these four values, so identity is stamped

data/lib/everywhere/config/mobile.rb

@@ -182,12 +182,24 @@ module Everywhere
       # `uri` pointing at a Fragment this build doesn't contain resolves to
       # nothing and the visit dead-ends. An explicit `uri:` always wins — that's
       # the escape hatch for a screen whose annotation says something else.
+      #
+      # `fallback_uri` rides along for the shell that ISN'T this app's own
+      # build: a Jump-style instance shell fetches this same document live, and
+      # the derived uri names a Fragment compiled into the app's build, not the
+      # picker's. Hotwire falls back per rule when the primary uri resolves to
+      # no registered destination, and every gem-built shell registers the
+      # missing-screen placeholder at this address — so the previewing shell
+      # says "this screen is native" instead of spinning forever, while the
+      # app's own build never consults the fallback at all.
+      MISSING_SCREEN_URI = "hotwire://fragment/everywhere-missing"
+
       def android_screen_properties(properties)
         id = properties["view_controller"]
         return properties if id.nil? || properties.key?("uri")
         return properties unless native_android_screens.key?(id.to_s)
 
-        properties.merge("uri" => "hotwire://fragment/#{id}")
+        fallback = properties.key?("fallback_uri") ? {} : { "fallback_uri" => MISSING_SCREEN_URI }
+        properties.merge("uri" => "hotwire://fragment/#{id}", **fallback)
       end
 
       # The full path-configuration document for one mobile platform — rules plus

data/lib/everywhere/version.rb

@@ -3,7 +3,7 @@
 require "json"
 
 module Everywhere
-  VERSION = "0.8.0"
+  VERSION = "0.9.0"
 
   # Version of the @rubyeverywhere/bridge JS this gem ships. bridge/ in the
   # gem IS the npm package (served to Rails apps by Everywhere::Engine,

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/EverywhereApplication.kt

@@ -2,6 +2,8 @@ package com.rubyeverywhere.shell
 
 import android.app.Application
 import android.webkit.CookieManager
+import android.webkit.WebSettings
+import android.widget.Toast
 import androidx.core.net.toUri
 import com.rubyeverywhere.shell.bridge.BiometricsComponent
 import com.rubyeverywhere.shell.bridge.HapticsComponent
@@ -20,6 +22,7 @@ import dev.hotwire.core.turbo.visit.VisitProposal
 import dev.hotwire.core.turbo.webview.HotwireWebView
 import dev.hotwire.navigation.activities.HotwireActivity
 import dev.hotwire.navigation.config.defaultFragmentDestination
+import dev.hotwire.navigation.destinations.HotwireDestinationDeepLink
 import dev.hotwire.navigation.config.registerBridgeComponents
 import dev.hotwire.navigation.config.registerFragmentDestinations
 import dev.hotwire.navigation.config.registerRouteDecisionHandlers
@@ -55,12 +58,22 @@ class EverywhereApplication : Application() {
 
         Hotwire.defaultFragmentDestination = WebFragment::class
 
-        Hotwire.registerFragmentDestinations(
+        val fragmentDestinations = listOf(
             WebFragment::class,
             WebBottomSheetFragment::class,
-            // App-provided native screens (everywhere.yml native.android.screens).
-            *EverywhereExtensions.fragmentDestinations.toTypedArray()
-        )
+            // Where a rule's fallback_uri lands when its primary uri names a
+            // Fragment this build doesn't contain (previewing another app).
+            MissingExtensionFragment::class
+        ) + EverywhereExtensions.fragmentDestinations // everywhere.yml native.android.screens
+        Hotwire.registerFragmentDestinations(*fragmentDestinations.toTypedArray())
+
+        // Every uri those destinations answer to, read from the same
+        // annotation Hotwire itself matches against — handed to the
+        // missing-screen guard below so it can tell a resolvable rule from
+        // one that would go nowhere.
+        val registeredUris = fragmentDestinations
+            .mapNotNull { it.java.getAnnotation(HotwireDestinationDeepLink::class.java)?.uri }
+            .toSet()
 
         Hotwire.registerBridgeComponents(
             BridgeComponentFactory("everywhere--notification", ::NotificationComponent),
@@ -78,6 +91,7 @@ class EverywhereApplication : Application() {
         Hotwire.registerRouteDecisionHandlers(
             ResetRouteDecisionHandler(),
             AuthFlowRouteDecisionHandler(),
+            MissingScreenRouteDecisionHandler(registeredUris),
             AppNavigationRouteDecisionHandler(),
             BrowserTabRouteDecisionHandler(),
             SystemNavigationRouteDecisionHandler()
@@ -99,6 +113,16 @@ class EverywhereApplication : Application() {
         Hotwire.config.makeCustomWebView = { context ->
             HotwireWebView(context, null).also { webView ->
                 WebControlChannel.install(webView, config.webConfigJson)
+                // Instance apps pair with LAN-hosted previews: the picker page
+                // is https but the app it probes is plain http, which WebView
+                // blocks as mixed content — and then the picker reports a live
+                // preview as "not answering". Scoped to remote.instances so
+                // ordinary apps keep the strict default. The main-frame http
+                // load itself is governed by network_security_config.xml,
+                // which `every build` opens up under the same flag.
+                if (config.remoteInstances) {
+                    webView.settings.mixedContentMode = WebSettings.MIXED_CONTENT_ALWAYS_ALLOW
+                }
             }
         }
     }
@@ -154,6 +178,43 @@ private class ResetRouteDecisionHandler : Router.RouteDecisionHandler {
     }
 }
 
+/**
+ * The last line of defence for a native-screen rule this build can't serve.
+ *
+ * A previewed app on a current gem serves `fallback_uri` pointing at
+ * [MissingExtensionFragment], and the visit lands there — this handler never
+ * matches. An app on an older gem serves only `uri: hotwire://fragment/<id>`,
+ * and Hotwire's answer to a uri no registered destination claims is to do
+ * nothing at all — which reads as a spinner that never ends. Refuse the visit
+ * loudly instead: a toast naming the screen, and the user stays on the page
+ * they tapped from.
+ */
+private class MissingScreenRouteDecisionHandler(
+    private val registeredUris: Set<String>
+) : Router.RouteDecisionHandler {
+    override val name = "everywhere-missing-screen"
+
+    override fun matches(proposal: VisitProposal, configuration: NavigatorConfiguration): Boolean {
+        val uri = proposal.properties["uri"]?.toString() ?: return false
+        val fallback = proposal.properties["fallback_uri"]?.toString()
+        return uri !in registeredUris && (fallback == null || fallback !in registeredUris)
+    }
+
+    override fun handle(
+        proposal: VisitProposal,
+        configuration: NavigatorConfiguration,
+        activity: HotwireActivity
+    ): Router.Decision {
+        val identifier = proposal.properties["view_controller"]?.toString() ?: "native"
+        Toast.makeText(
+            activity,
+            activity.getString(R.string.everywhere_missing_screen_toast, identifier),
+            Toast.LENGTH_LONG
+        ).show()
+        return Router.Decision.CANCEL
+    }
+}
+
 /**
  * A provider sign-in: hand it to a Custom Tab instead of loading it in the web
  * view. Cancelling leaves the user on the page they tapped from, which is where

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/EverywhereConfig.kt

@@ -189,6 +189,27 @@ class EverywhereConfig private constructor(
             return if (path.isNullOrEmpty() || path == "/") rootUrl else url(forPath = path)
         }
 
+    /**
+     * Every origin the shell's own pages can be served from: the stamped
+     * root, the dev override, and a picked instance. The control channel is
+     * offered to all of them, not just the current [rootUrl] — while rooted
+     * on an instance, the picker's pages still come from the stamped origin,
+     * and without the channel there they could switch in but never switch
+     * again (`Everywhere.instance.*` would fall back to a plain navigation).
+     */
+    val trustedRootOrigins: Set<String>
+        get() = listOfNotNull(stampedRemoteUrl, devUrl, instanceUrl)
+            .mapNotNull(::originOf)
+            .toSet()
+
+    private fun originOf(url: String): String? {
+        val uri = url.toUri()
+        val scheme = uri.scheme ?: return null
+        val host = uri.host ?: return null
+        val port = if (uri.port > 0) ":${uri.port}" else ""
+        return "$scheme://$host$port"
+    }
+
     /**
      * The server half of the path configuration (rules + settings.tabs),
      * generated from everywhere.yml by the gem's MobileConfigEndpoint — so tab

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/MainActivity.kt

@@ -140,7 +140,16 @@ class MainActivity : HotwireActivity() {
         // Swap to the real theme before the content view inflates.
         setTheme(R.style.Theme_Everywhere)
         enableEdgeToEdge()
-        super.onCreate(savedInstanceState)
+
+        // A rebuild ([rebuildAndRoute]: reset, sign-in/out, instance switch)
+        // arrives with EXTRA_ROUTE on the Intent and must start from scratch:
+        // handing the saved state to super restores every navigator's back
+        // stack, climbing the page the user just left back on top of the new
+        // root. Dropped here, the recreate behaves like a fresh launch — while
+        // a real config change or process death (no EXTRA_ROUTE) restores
+        // normally.
+        val state = if (intent.hasExtra(EXTRA_ROUTE)) null else savedInstanceState
+        super.onCreate(state)
 
         setContentView(R.layout.activity_main)
         findViewById<View>(R.id.root).applyDefaultImeWindowInsets()
@@ -148,7 +157,7 @@ class MainActivity : HotwireActivity() {
         splash = findViewById(R.id.splash)
         showSplash()
 
-        initializeTabs(savedInstanceState?.getInt(STATE_SELECTED_TAB) ?: 0)
+        initializeTabs(state?.getInt(STATE_SELECTED_TAB) ?: 0)
 
         observeEvents()
         observePathConfiguration()
@@ -220,7 +229,14 @@ class MainActivity : HotwireActivity() {
 
         pendingRoute = null
         pendingRouteHostId = null
-        navigator.route(route)
+        // Post, don't call: this callback fires from onAttachFragment while
+        // the host's start fragment is still mid-transaction — no view, no
+        // web delegate — and routing into it synchronously crashes Hotwire
+        // ("lateinit property webDelegate has not been initialized"). One
+        // trip through the main queue lets the transaction finish first.
+        window.decorView.post {
+            if (!isFinishing && !isDestroyed) navigator.route(route)
+        }
     }
 
     // ------------------------------------------------------------------------
@@ -380,19 +396,32 @@ class MainActivity : HotwireActivity() {
      * handling selection would make More a one-shot.
      */
     private fun installTabListeners(arrangement: MainTabs.Arrangement) {
-        if (!arrangement.hasMore) return
+        val hasLeaveSlot = arrangement.slots.any { isLeaveTab(it.entry?.path) }
+        if (!arrangement.hasMore && !hasLeaveSlot) return
 
         bottomNav.setOnItemSelectedListener { item ->
             val index = item.itemId
-            // selectingMoreForRoute is the one case where selecting More IS the
-            // intent: something routed to an overflow path and the host has to
-            // come forward to receive it.
-            if (arrangement.isMoreIndex(index) && !selectingMoreForRoute) {
-                showMoreSheet(arrangement)
-                false
-            } else {
-                switchToSlot(index)
-                true
+            when {
+                // The Jump leave tab is a native action, exactly as on iOS
+                // (EverywhereTabBarController): the page behind it is a
+                // gem-served Turbo-less fallback, so selecting its host could
+                // only end at the error view. The tap clears the picked
+                // instance directly and never becomes a selection.
+                isLeaveTab(arrangement.entryAt(index)?.path) -> {
+                    leaveInstance()
+                    false
+                }
+                // selectingMoreForRoute is the one case where selecting More IS
+                // the intent: something routed to an overflow path and the host
+                // has to come forward to receive it.
+                arrangement.isMoreIndex(index) && !selectingMoreForRoute -> {
+                    showMoreSheet(arrangement)
+                    false
+                }
+                else -> {
+                    switchToSlot(index)
+                    true
+                }
             }
         }
 
@@ -408,6 +437,19 @@ class MainActivity : HotwireActivity() {
         }
     }
 
+    /**
+     * The injected "leave preview" tab (a Jump instance's way home), matched
+     * by its gem-reserved path. Only meaningful for instance apps — for
+     * everyone else no such tab is ever injected, and the guard keeps an
+     * unlucky app path from being swallowed.
+     */
+    private fun isLeaveTab(path: String?): Boolean =
+        config.remoteInstances && path == JUMP_LEAVE_PATH
+
+    private fun leaveInstance() {
+        EverywhereEvents.emit(EverywhereEvents.Event.ClearInstance(null))
+    }
+
     /**
      * Bring a slot's host forward — upstream `HotwireBottomNavigationController`'s
      * private `switchTab`, which taking over the item-selected listener costs us.
@@ -466,7 +508,11 @@ class MainActivity : HotwireActivity() {
 
             row.setOnClickListener {
                 dialog.dismiss()
-                route(config.url(forPath = entry.path))
+                // The leave row is the same native action as a leave SLOT —
+                // see installTabListeners; routing it would load the
+                // Turbo-less fallback page and end at the error view.
+                if (isLeaveTab(entry.path)) leaveInstance()
+                else route(config.url(forPath = entry.path))
             }
             list.addView(row)
         }
@@ -777,9 +823,17 @@ class MainActivity : HotwireActivity() {
     }
 
     /**
-     * `recreate()` loses every field, so the landing page rides along on the
-     * Intent — which `recreate()` does preserve — and is picked up by the next
-     * `onCreate`.
+     * `recreate()` for an in-place rebuild — a CLEAR_TASK relaunch tears the
+     * task down first, which plays as the app closing and cold-starting on
+     * every reset (sign-in, sign-out, instance switch). recreate() keeps the
+     * window; the landing page rides along on the Intent, which recreate()
+     * preserves while fields are lost.
+     *
+     * The saved instance state, however, must NOT come back: it carries every
+     * navigator's back stack, and restoring it climbs the page the user just
+     * left (Jump's connect screen, a pre-sign-in page) right back on top of
+     * the new root. `onCreate` treats the presence of [EXTRA_ROUTE] as the
+     * fresh-start flag and drops the state — see the top of [onCreate].
      */
     private fun rebuildAndRoute(target: String) {
         AuthFlow.cancel()
@@ -956,6 +1010,10 @@ class MainActivity : HotwireActivity() {
         const val EXTRA_ROUTE = "everywhere.route"
         const val EXTRA_LAST_REBUILD = "everywhere.lastRebuild"
 
+        /** The injected leave tab's path — same constant iOS keeps on
+         *  EverywhereTabBarController.jumpLeavePath. */
+        const val JUMP_LEAVE_PATH = "/everywhere/jump/leave"
+
         /**
          * How close two path-change rebuilds have to be before the second is
          * treated as a loop rather than a legitimate config change. Generous

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/MissingExtensionFragment.kt

@@ -0,0 +1,105 @@
+package com.rubyeverywhere.shell
+
+import android.graphics.drawable.Drawable
+import android.os.Bundle
+import android.util.TypedValue
+import android.view.Gravity
+import android.view.LayoutInflater
+import android.view.View
+import android.view.ViewGroup
+import android.widget.FrameLayout
+import android.widget.ImageView
+import android.widget.LinearLayout
+import android.widget.TextView
+import androidx.appcompat.widget.Toolbar
+import androidx.core.graphics.drawable.DrawableCompat
+import com.google.android.material.appbar.AppBarLayout
+import dev.hotwire.navigation.destinations.HotwireDestinationDeepLink
+import dev.hotwire.navigation.fragments.HotwireFragment
+
+/**
+ * The per-rule fallback destination for native screens this build doesn't
+ * contain — the Android half of iOS's `MissingExtensionScreen`.
+ *
+ * The gem writes `fallback_uri: hotwire://fragment/everywhere-missing` next to
+ * every derived screen `uri` (see the gem's Config::Mobile), so when a
+ * Jump-style shell previews an app whose rules name Fragments compiled into
+ * THAT app's build, the visit lands here and says so — instead of Hotwire
+ * finding no destination and leaving the user on a spinner forever. An app's
+ * own build resolves the primary uri and never consults the fallback.
+ */
+@HotwireDestinationDeepLink(uri = "hotwire://fragment/everywhere-missing")
+class MissingExtensionFragment : HotwireFragment() {
+    private lateinit var toolbar: Toolbar
+
+    override fun onCreateView(
+        inflater: LayoutInflater,
+        container: ViewGroup?,
+        savedInstanceState: Bundle?
+    ): View {
+        val context = requireContext()
+        // The rule that routed here still carries the screen's identifier.
+        val identifier = pathProperties["view_controller"]?.toString() ?: "native"
+
+        toolbar = Toolbar(context).apply {
+            title = getString(R.string.everywhere_missing_screen_nav_title)
+        }
+        val appBar = AppBarLayout(context).apply {
+            fitsSystemWindows = true
+            addView(toolbar, ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT)
+        }
+
+        val secondary = TypedValue().let {
+            context.theme.resolveAttribute(android.R.attr.textColorSecondary, it, true)
+            requireNotNull(context.getColorStateList(it.resourceId)).defaultColor
+        }
+
+        val icon = ImageView(context).apply {
+            setImageDrawable(tinted(IconFont.drawable(context, "extension", dp(44)), secondary))
+        }
+        val title = TextView(context).apply {
+            text = getString(R.string.everywhere_missing_screen_title)
+            textSize = 20f
+            setTypeface(typeface, android.graphics.Typeface.BOLD)
+            gravity = Gravity.CENTER
+        }
+        val body = TextView(context).apply {
+            text = getString(R.string.everywhere_missing_screen_body, identifier)
+            textSize = 15f
+            setTextColor(secondary)
+            gravity = Gravity.CENTER
+        }
+
+        val column = LinearLayout(context).apply {
+            orientation = LinearLayout.VERTICAL
+            gravity = Gravity.CENTER_HORIZONTAL
+            setPadding(dp(32), 0, dp(32), 0)
+            addView(icon)
+            addView(title, spaced(dp(14)))
+            addView(body, spaced(dp(14)))
+        }
+        val content = FrameLayout(context).apply {
+            addView(column, FrameLayout.LayoutParams(
+                ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT,
+                Gravity.CENTER
+            ))
+        }
+
+        return LinearLayout(context).apply {
+            orientation = LinearLayout.VERTICAL
+            addView(appBar, ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT)
+            addView(content, LinearLayout.LayoutParams(ViewGroup.LayoutParams.MATCH_PARENT, 0, 1f))
+        }
+    }
+
+    override fun toolbarForNavigation(): Toolbar = toolbar
+
+    private fun tinted(drawable: Drawable, color: Int): Drawable =
+        DrawableCompat.wrap(drawable).mutate().also { DrawableCompat.setTint(it, color) }
+
+    private fun spaced(marginTop: Int) = LinearLayout.LayoutParams(
+        ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT
+    ).apply { topMargin = marginTop }
+
+    private fun dp(value: Int): Int = (value * resources.displayMetrics.density).toInt()
+}

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/WebFragment.kt

@@ -1,5 +1,8 @@
 package com.rubyeverywhere.shell
 
+import android.view.View
+import android.widget.TextView
+import androidx.core.view.isVisible
 import dev.hotwire.core.turbo.errors.VisitError
 import dev.hotwire.navigation.destinations.HotwireDestinationDeepLink
 import dev.hotwire.navigation.fragments.HotwireWebFragment
@@ -8,10 +11,11 @@ import dev.hotwire.navigation.fragments.HotwireWebFragment
  * The default destination for every web visit.
  *
  * Deliberately thin — the framework's own fragment already does the work. Its
- * one job is telling [MainActivity] when there is content on screen, which is
- * how the splash comes down. Android has no `NavigatorDelegate.requestDidFinish`
- * the way iOS does; the visit callbacks on the fragment are where that
- * information surfaces.
+ * jobs are telling [MainActivity] when there is content on screen (how the
+ * splash comes down — Android has no `NavigatorDelegate.requestDidFinish` the
+ * way iOS does; the visit callbacks on the fragment are where that information
+ * surfaces) and swapping the library's button-less error view for one the user
+ * can act on.
  */
 @HotwireDestinationDeepLink(uri = "hotwire://fragment/web")
 open class WebFragment : HotwireWebFragment() {
@@ -30,6 +34,29 @@ open class WebFragment : HotwireWebFragment() {
         settled()
     }
 
+    /**
+     * The library's error view is a message with no controls — its only retry
+     * is pull-to-refresh, invisible exactly when the user is staring at a dead
+     * page. Ours adds an explicit retry, and — inside a picked instance, where
+     * retrying can only knock on the same dead host — the way home: clear the
+     * instance and re-root onto the app's own start page, exactly what the
+     * page's own `Everywhere.instance.clear()` would do if it could load.
+     */
+    override fun createErrorView(error: VisitError): View {
+        val view = layoutInflater.inflate(R.layout.everywhere_error, null)
+        view.findViewById<TextView>(R.id.everywhere_error_description).text = error.description()
+        view.findViewById<View>(R.id.everywhere_error_retry).setOnClickListener {
+            refresh(displayProgress = true)
+        }
+        view.findViewById<View>(R.id.everywhere_error_leave).apply {
+            isVisible = EverywhereConfig.shared.instanceUrl != null
+            setOnClickListener {
+                EverywhereEvents.emit(EverywhereEvents.Event.ClearInstance(null))
+            }
+        }
+        return view
+    }
+
     private fun settled() {
         (activity as? MainActivity)?.onWebContentSettled()
     }

data/support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/WebControlChannel.kt

@@ -189,16 +189,12 @@ class WebControlChannel : WebViewCompat.WebMessageListener {
         }
 
         /**
-         * The app's own origin, derived from the *effective* root — so a dev
-         * build against 127.0.0.1 and a picked instance both work without a
-         * second list to keep in sync.
+         * Every origin the shell's own pages come from — stamped root, dev
+         * override, picked instance (EverywhereConfig.trustedRootOrigins).
+         * All of them, not just the effective root: while the shell is rooted
+         * on an instance, the picker's own pages are still served from the
+         * stamped origin, and they need the channel to switch or leave.
          */
-        private fun originRules(): Set<String> {
-            val uri = EverywhereConfig.shared.rootUrl.toUri()
-            val scheme = uri.scheme ?: return emptySet()
-            val host = uri.host ?: return emptySet()
-            val port = if (uri.port > 0) ":${uri.port}" else ""
-            return setOf("$scheme://$host$port")
-        }
+        private fun originRules(): Set<String> = EverywhereConfig.shared.trustedRootOrigins
     }
 }

data/support/mobile/android/app/src/main/res/layout/everywhere_error.xml

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  FROZEN. The failed-visit screen WebFragment.createErrorView inflates in
+  place of the library's hotwire_error.xml, which has no controls at all —
+  its only retry is pull-to-refresh, invisible exactly when the user is
+  staring at a dead page. Same typography as the library's version, plus an
+  explicit retry button and an escape hatch for picked instances (shown by
+  WebFragment only when an instance override is active).
+-->
+<FrameLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:background="?android:colorBackground">
+
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:layout_gravity="center"
+        android:orientation="vertical"
+        android:gravity="center_horizontal"
+        android:paddingStart="24dp"
+        android:paddingEnd="24dp">
+
+        <com.google.android.material.textview.MaterialTextView
+            style="@style/TextAppearance.MaterialComponents.Headline6"
+            android:id="@+id/everywhere_error_title"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:gravity="center_horizontal"
+            android:text="@string/everywhere_error_title" />
+
+        <com.google.android.material.textview.MaterialTextView
+            style="@style/TextAppearance.MaterialComponents.Caption"
+            android:id="@+id/everywhere_error_description"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="8dp"
+            android:gravity="center_horizontal"
+            android:textSize="14sp" />
+
+        <com.google.android.material.button.MaterialButton
+            android:id="@+id/everywhere_error_retry"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="24dp"
+            android:text="@string/everywhere_error_retry" />
+
+        <com.google.android.material.button.MaterialButton
+            style="@style/Widget.MaterialComponents.Button.TextButton"
+            android:id="@+id/everywhere_error_leave"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="8dp"
+            android:text="@string/everywhere_error_leave"
+            android:visibility="gone" />
+
+    </LinearLayout>
+
+</FrameLayout>

data/support/mobile/android/app/src/main/res/values/strings.xml

@@ -15,4 +15,23 @@
       names its own overflow tab on iOS.
     -->
     <string name="everywhere_more_tab">More</string>
+    <!--
+      The failed-visit screen (WebFragment.createErrorView). "Back to start"
+      shows only inside a picked instance, where retrying the same dead host
+      is the only other move — it clears the instance and re-roots.
+    -->
+    <string name="everywhere_error_title">Error loading page</string>
+    <string name="everywhere_error_retry">Try again</string>
+    <string name="everywhere_error_leave">Back to start</string>
+    <!--
+      MissingExtensionFragment — the fallback destination when a previewed
+      app's rule names a native screen compiled into ITS build, not this
+      shell. Copy mirrors iOS's MissingExtensionScreen.
+    -->
+    <string name="everywhere_missing_screen_nav_title">Preview</string>
+    <string name="everywhere_missing_screen_title">This screen is native</string>
+    <string name="everywhere_missing_screen_body">In the full build, “%1$s” is a native screen compiled into the app. Jump can\'t run another app\'s native code — everything else in this preview works.</string>
+    <!-- Older previewed apps serve no fallback_uri; their native-screen visits
+         are refused with this toast instead of a spinner that never ends. -->
+    <string name="everywhere_missing_screen_toast">“%1$s” is a native screen in the full build — Jump can\'t run another app\'s native code.</string>
 </resources>

data/support/mobile/ios/App/ErrorViewController.swift

@@ -1,14 +1,19 @@
 import UIKit
 
 /// A full-screen error page with a retry button, presented when a visit fails
-/// (e.g. the server is unreachable).
+/// (e.g. the server is unreachable). When the failure happened inside a picked
+/// instance — where retrying can only knock on the same dead host — a second
+/// button offers the way home (SceneDelegate passes `leaveHandler` exactly
+/// then, and it clears the instance and re-roots).
 final class ErrorViewController: UIViewController {
     private let error: Error
     private let retryHandler: (() -> Void)?
+    private let leaveHandler: (() -> Void)?
 
-    init(error: Error, retryHandler: (() -> Void)?) {
+    init(error: Error, retryHandler: (() -> Void)?, leaveHandler: (() -> Void)? = nil) {
         self.error = error
         self.retryHandler = retryHandler
+        self.leaveHandler = leaveHandler
         super.init(nibName: nil, bundle: nil)
     }
 
@@ -41,7 +46,15 @@ final class ErrorViewController: UIViewController {
         })
         retryButton.isHidden = retryHandler == nil
 
-        let stackView = UIStackView(arrangedSubviews: [imageView, messageLabel, retryButton])
+        var leaveConfiguration = UIButton.Configuration.plain()
+        leaveConfiguration.title = "Back to start"
+        leaveConfiguration.buttonSize = .large
+        let leaveButton = UIButton(configuration: leaveConfiguration, primaryAction: UIAction { [weak self] _ in
+            self?.leave()
+        })
+        leaveButton.isHidden = leaveHandler == nil
+
+        let stackView = UIStackView(arrangedSubviews: [imageView, messageLabel, retryButton, leaveButton])
         stackView.axis = .vertical
         stackView.alignment = .center
         stackView.spacing = 16
@@ -61,4 +74,9 @@ final class ErrorViewController: UIViewController {
         retryHandler?()
         dismiss(animated: true)
     }
+
+    private func leave() {
+        dismiss(animated: true)
+        leaveHandler?()
+    }
 }

data/support/mobile/ios/App/SceneDelegate.swift

@@ -599,7 +599,18 @@ extension SceneDelegate: NavigatorDelegate {
     }
 
     private func presentError(_ error: HotwireNativeError, retryHandler: RetryBlock?) {
-        let errorViewController = ErrorViewController(error: error, retryHandler: retryHandler)
+        // Inside a picked instance whose server has gone away, Retry can only
+        // knock on the same dead host — offer the way home too: clear the
+        // instance and re-root, exactly what the leave tab does when it can load.
+        var leaveHandler: (() -> Void)?
+        if config.remoteInstances == true, EverywhereConfig.instanceURL != nil {
+            leaveHandler = { [weak self] in
+                guard let self else { return }
+                EverywhereConfig.setInstanceURL(nil)
+                self.resetApp(to: self.config.startURL)
+            }
+        }
+        let errorViewController = ErrorViewController(error: error, retryHandler: retryHandler, leaveHandler: leaveHandler)
         errorViewController.modalPresentationStyle = .fullScreen
         activeNavigator.activeNavigationController.present(errorViewController, animated: true)
     }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_everywhere
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Andrea Fomera
@@ -240,6 +240,7 @@ files:
 - support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/IconFont.kt
 - support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/MainActivity.kt
 - support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/MainTabs.kt
+- support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/MissingExtensionFragment.kt
 - support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/WebBottomSheetFragment.kt
 - support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/WebFragment.kt
 - support/mobile/android/app/src/main/java/com/rubyeverywhere/shell/bridge/BiometricsComponent.kt
@@ -257,6 +258,7 @@ files:
 - support/mobile/android/app/src/main/res/layout/activity_main.xml
 - support/mobile/android/app/src/main/res/layout/bridge_menu_sheet.xml
 - support/mobile/android/app/src/main/res/layout/bridge_menu_sheet_item.xml
+- support/mobile/android/app/src/main/res/layout/everywhere_error.xml
 - support/mobile/android/app/src/main/res/layout/tab_more_sheet.xml
 - support/mobile/android/app/src/main/res/layout/tab_more_sheet_item.xml
 - support/mobile/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml