@desklink/react-native 0.5.2 → 0.5.4

package/README.md

@@ -3,7 +3,7 @@
 <p align="center">
   <a href="https://www.npmjs.com/package/@desklink/react-native"><img alt="npm" src="https://img.shields.io/npm/v/@desklink/react-native?style=flat&label=npm" /></a>
   <a href="https://github.com/umeranjum17/desklink/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/umeranjum17/desklink/ci.yml?style=flat&branch=main" /></a>
-  <a href="LICENSE"><img alt="Apache 2.0" src="https://img.shields.io/badge/license-Apache--2.0-666?style=flat" /></a>
+  <a href="https://github.com/umeranjum17/desklink/blob/main/packages/desktop-client/LICENSE"><img alt="Apache 2.0" src="https://img.shields.io/badge/license-Apache--2.0-666?style=flat" /></a>
   <img alt="Android, iOS and web" src="https://img.shields.io/badge/Android%20%7C%20iOS%20%7C%20web-111?style=flat" />
 </p>
 
@@ -20,7 +20,7 @@ the application.
 ## Install
 
 The npm badge at the top of this page tracks the registry version, and npm
-verifies package integrity on install. See the [changelog](../../CHANGELOG.md)
+verifies package integrity on install. See the [changelog](https://github.com/umeranjum17/desklink/blob/main/CHANGELOG.md)
 for release changes. Supported platforms: Android, iOS and web.
 
 The package contains native code and is not an Expo Go package. Inside this
@@ -156,7 +156,8 @@ view.
   VP9. Neither platform links a second WebRTC stack.
 - **A sharp, zoomable picture.** In portrait the default is fit-width;
   in landscape it covers the screen below the status bar (as far as the 2.5
-  zoom limit allows). The picture stays undistorted. One finger pans cropped
+  zoom limit allows). The `cover` prop opts portrait into the same
+  coverage, cropping the overflowing sides instead of letterboxing. The picture stays undistorted. One finger pans cropped
   content; pinch to zoom before panning when the whole desktop already fits.
   Pass the screen's safe-area `insets` (for example from
   `react-native-safe-area-context`) so the default starts below the status bar
@@ -230,17 +231,22 @@ view.
   instead of sitting at 44 pt. An app may draw its own keys
   from `modifiers` instead.
 - **Readiness is a rendered frame.** Android marks the first draw; iOS marks
-  the first `RTCView` video-dimensions callback and ignores later ones, so a
-  resize or remount during a reconnect does not read as live. Neither marks
-  a track or ICE connection as live.
+  the first `RTCView` video-dimensions callback and ignores later ones; web
+  marks the first presented frame and ignores later repaints, so a resize,
+  remount, or renegotiation repaint during a reconnect does not read as live.
+  No platform marks a track or ICE connection as live.
 - **Connection states, as they happen.** The session status is `idle`,
   `opening`, `connecting`, `live`, `reconnecting`, `ended` or `failed`. The
   peer's ICE state and the engine's `session.state` both feed it: a
   `disconnected` path reads as `reconnecting` within about a second of the
   drop — never a frozen picture that still says live — and a recovered path
   reads as `live` again once the picture is advancing again (ICE `connected`
-  alone does not restore `live` while the picture is frozen). A path that reports
-  `failed` reopens the session with fresh authority instead of staying stuck.
+  alone does not restore `live` while the picture is frozen). The peer's own ICE
+  `failed` — a lost media path, not a verdict on the session — holds the session
+  and its handle for ~30 s (the engine keeps it for about 28 s after the path
+  dies), so a roam longer than the client's own ~15 s `failed` still returns to
+  the same session; an SDP or candidate failure, which means the negotiation
+  itself is broken, reopens with fresh authority instead of staying stuck.
   Every event carries its engine session id where the carrier preserves it,
   and the session ignores anything naming a session it no longer holds, so a
   previous generation's queued offer or revocation cannot corrupt or kill a
@@ -270,7 +276,28 @@ view.
   reopens back off across ~60 s too instead of spending one attempt while the
   network is still down. Renegotiation transients from a restart the session
   asked for itself are expected, not a new outage: they neither flip the
-  status nor trigger another restart for a short grace window.
+  status nor trigger another restart for a short grace window. A picture
+  that keeps moving holds off the heartbeat watchdog for up to ~20 s, since
+  the control channel lags the video after an outage.
+- **Roaming keeps the session.** The signalling carrier is not the session:
+  when it closes, or a restart request on it gets no reply within 1.5 s, the
+  session drops that carrier for good (calling its optional `close()`) and
+  keeps calling `authorize()` — one dial at a time, 250 ms after a failure,
+  5 s each, with no budget and no backoff. The lost carrier does not change the
+  status by itself: the status follows the picture and the peer's transport, so
+  it reads `reconnecting` only once the picture stops or the stall watchdog
+  fires. While the loop runs, a session that has shown a picture never reports
+  `failed` or a transport failure; one that never showed a picture reports the
+  first-frame transport failure after 20 s and the loop stops. A new carrier
+  picks up the same session after a 300 ms grace for the old ICE pair: if the
+  picture advanced during it, there is no restart (and a `reconnecting`
+  session returns to `live`); otherwise the session moves to `reconnecting`
+  and asks for an ICE restart. Failures caused
+  by the dead carrier wait for the next one rather than ending the session.
+  A carrier that comes back after the host's 30 s reattach window opens a new
+  session at once. A `session` or `generation` refusal (the desktop no longer
+  holds the session) also reopens at once. An `authorize()` refusal still ends
+  the session: a revoked pairing cannot roam back.
 - **Input starts disarmed.** This is a local arm against accidental touches,
   not a permission: the session already has input. `setInputEnabled(true)` arms
   pointer, keyboard and clipboard input; `setInputEnabled(false)` blocks new
@@ -297,7 +324,7 @@ view.
 The one thing the app must supply. It carries the engine's local protocol over
 whatever authenticated channel the app already has.
 
-See the [BYOKit integration guidance](../../README.md#why-desklink-exists)
+See the [BYOKit integration guidance](https://github.com/umeranjum17/desklink/blob/main/README.md#why-desklink-exists)
 for the application's pairing, identity and signaling transport.
 
 ```ts
@@ -312,6 +339,19 @@ interface Signaling {
 candidates, state and revocation. Pixels and input do **not** use this
 channel — they are the desktop's own WebRTC session.
 
+`authorize()` must wait for the authenticated carrier to open before returning
+its `Signaling`. It rejects with `code: 'transport'` for a network or carrier
+failure; any other rejection is a refusal that ends the session, so a roam only
+keeps the session when the adapter tags its outages. When that carrier is gone,
+reject pending and future requests with `code: 'transport'`; do not queue them
+indefinitely. An adapter may emit
+`{ kind: 'carrier-closed' }` once to notify subscribers of that loss, and may
+offer `close()`, which the package calls on a carrier it has given up on. This is
+not the native peer's `closed` event or an engine revocation. Preserve the
+engine's `session.revoked` code: `transport` indicates path loss; other codes
+(or no code) are final. The demo adapter bounds connection setup to five seconds
+and closes its socket and pending queue when disposed.
+
 ## Shipping on iOS
 
 What the consuming app — not this package — must get right before review.
@@ -323,7 +363,7 @@ What the consuming app — not this package — must get right before review.
   `NSBonjourServices` is only needed if the app adds its own Bonjour
   discovery — desklink discovers no hosts. Relay-only sessions never prompt.
   For app-supplied routes, see the
-  [BYOKit integration guidance](../../README.md#why-desklink-exists).
+  [BYOKit integration guidance](https://github.com/umeranjum17/desklink/blob/main/README.md#why-desklink-exists).
   See [TN3179](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy).
 - **Export compliance.** The viewer's DTLS-SRTP comes from libwebrtc bundled
   with `react-native-webrtc`, not from the OS, so the app must check the
@@ -384,7 +424,7 @@ the run builds or caches stays in `~/desklink-ios` there. The run creates a
 uniquely named simulator and deletes it during cleanup. Set
 `DESKLINK_IOS_DEVICE` to the name or udid of one of the Mac's own simulators to
 run on that instead and leave it in place. For host desktop isolation, see the
-[private-lab guidance](../../README.md#develop). When the selected
+[private-lab guidance](https://github.com/umeranjum17/desklink/blob/main/README.md#develop). When the selected
 Xcode has no simulator platform, point `DESKLINK_IOS_XCODE` at one that does;
 `DESKLINK_IOS_RUNTIME` picks the iOS version (for example `18.6`); the
 script's header lists the other settings. To capture the cursor tip proof, set

package/android/build.gradle

@@ -33,7 +33,6 @@ dependencies {
   implementation project(':expo-modules-core')
   implementation 'androidx.core:core-ktx:1.17.0'
   implementation "org.jetbrains.kotlin:kotlin-stdlib:${kotlinVersion}"
-  testImplementation 'junit:junit:4.13.2'
   // The app's existing WebRTC binding, so the org.webrtc classes and the single
   // native library are shared rather than a second copy being linked in. This
   // package never mutates that binding's global decoder factory.

package/android/src/main/java/expo/modules/desklink/DesklinkModule.kt

@@ -145,6 +145,10 @@ class DesklinkModule : Module() {
         view.setGestures(gestures ?: "desktop")
       }
 
+      Prop("cover") { view: DesktopView, cover: Boolean? ->
+        view.setCover(cover ?: false)
+      }
+
       OnViewDestroys { view: DesktopView -> view.release() }
 
       OnViewDidUpdateProps { view: DesktopView ->

package/android/src/main/java/expo/modules/desklink/DesktopSession.kt

@@ -111,7 +111,7 @@ class DesktopSession(
         emit("ready", emptyMap())
       } catch (error: Throwable) {
         Log.w(TAG, "Could not start the desktop session", error)
-        fail("transport", error.message ?: "the desktop session could not start")
+        fail("transport", error.message ?: "the desktop session could not start", "session")
       }
     }
   }
@@ -146,7 +146,7 @@ class DesktopSession(
       val connection = peer ?: return@execute
       val target = epoch
       if (type != "offer") {
-        fail("transport", "the engine must send an offer")
+        fail("transport", "the engine must send an offer", "sdp")
         return@execute
       }
       connection.setRemoteDescription(
@@ -171,23 +171,23 @@ class DesktopSession(
                         }
                       }
 
-                      override fun onCreateFailure(error: String?) = fail("transport", error)
-                      override fun onSetFailure(error: String?) = fail("transport", error)
+                      override fun onCreateFailure(error: String?) = fail("transport", error, "sdp")
+                      override fun onSetFailure(error: String?) = fail("transport", error, "sdp")
                     },
                     answer,
                   )
                 }
 
                 override fun onSetSuccess() = Unit
-                override fun onCreateFailure(error: String?) = fail("transport", error)
-                override fun onSetFailure(error: String?) = fail("transport", error)
+                override fun onCreateFailure(error: String?) = fail("transport", error, "sdp")
+                override fun onSetFailure(error: String?) = fail("transport", error, "sdp")
               },
               MediaConstraints(),
             )
           }
 
-          override fun onCreateFailure(error: String?) = fail("transport", error)
-          override fun onSetFailure(error: String?) = fail("transport", error)
+          override fun onCreateFailure(error: String?) = fail("transport", error, "sdp")
+          override fun onSetFailure(error: String?) = fail("transport", error, "sdp")
         },
         SessionDescription(SessionDescription.Type.OFFER, sdp),
       )
@@ -233,7 +233,7 @@ class DesktopSession(
       ByteBuffer.wrap(message.toString().toByteArray(StandardCharsets.UTF_8)), false,
     ))
     if (!sent) {
-      fail("transport", "the desktop control channel could not send")
+      fail("transport", "the desktop control channel could not send", "control")
       close()
     }
   }
@@ -425,7 +425,7 @@ class DesktopSession(
         ui.postDelayed(sample, 2000)
       }
       if (state == PeerConnection.IceConnectionState.FAILED) {
-        fail("transport", "the connection to the desktop was lost")
+        fail("transport", "the connection to the desktop was lost", "ice")
       }
     }
 
@@ -495,8 +495,16 @@ class DesktopSession(
     ui.post { onEvent(name, payload) }
   }
 
-  private fun fail(code: String, message: String?) {
-    ui.post { onEvent("failure", mapOf("code" to code, "message" to (message ?: "unknown"))) }
+  /**
+   * One native failure, with its `reason` so the hook can tell an ICE failure
+   * (the peer's path died, which the session can be held across) from an SDP,
+   * candidate or control failure (the session itself is broken, which stays
+   * terminal).
+   */
+  private fun fail(code: String, message: String?, reason: String? = null) {
+    val payload = mutableMapOf<String, Any?>("code" to code, "message" to (message ?: "unknown"))
+    if (reason != null) payload["reason"] = reason
+    ui.post { onEvent("failure", payload) }
   }
 
   companion object {

package/android/src/main/java/expo/modules/desklink/DesktopView.kt

@@ -114,6 +114,19 @@ class DesktopView(context: Context, appContext: AppContext) : ExpoView(context,
   private var fitted = true
   private var filling = true
   private var filledScale = 0f
+  /**
+   * Opt-in cover: the picture covers the view in every orientation, cropping
+   * the overflowing axis, instead of fitting the portrait width. Off by
+   * default; the default path below is untouched.
+   */
+  private var cover = false
+
+  fun setCover(value: Boolean) {
+    if (value == cover) return
+    cover = value
+    filledScale = 0f
+    layoutPicture()
+  }
 
   /** What the system covers at each edge (bars, cutout), in pixels: left, top, right, bottom. */
   private var insetLeft = 0f
@@ -459,9 +472,11 @@ class DesktopView(context: Context, appContext: AppContext) : ExpoView(context,
   }
 
   private fun fillScale(): Float {
-    val cover = if (width <= height) safeWidth() / surfaceWidth
-      else max(width.toFloat() / surfaceWidth, (height - insetTop) / surfaceHeight)
-    return max(fitScale(), min(cover, MAX_SCALE))
+    // Portrait fits the width unless the app opted into cover; landscape
+    // covers. Either way the fill never goes below the fit or above the zoom cap.
+    val wide = if (width <= height && !cover) safeWidth() else width.toFloat()
+    val fill = max(wide / surfaceWidth, (height - insetTop) / surfaceHeight)
+    return max(fitScale(), min(fill, MAX_SCALE))
   }
 
   /** Re-derive the placement from `filling`, `fitted`, the zoom limits and the edges. */

package/app.plugin.js

@@ -7,10 +7,233 @@
  * without it.
  *
  *   "plugins": ["@desklink/react-native"]
+ *
+ * The plugin also repairs `expo-modules-jsi` 57.x for Xcode 26 (Swift 6.2).
+ * Two defects, both fatal, both fixed upstream in expo-modules-jsi 58 (SDK 58
+ * is out of scope and the 57 line has no fixed patch release):
+ *
+ * 1. `RuntimeScheduler.h` annotates two C++ constructors with
+ *    `SWIFT_RETURNS_RETAINED`, which Swift 6.2 rejects as a hard error
+ *    ("not returning a SWIFT_SHARED_REFERENCE type"), so no 57-line app
+ *    compiles. Mirrored from 58: private constructors plus static `create`
+ *    factories carrying the annotation, with the Swift call sites moved over.
+ * 2. `JavaScriptRuntime.swift` captures raw JSI pointers through
+ *    `nonisolated(unsafe)` locals into `JavaScriptActor.assumeIsolated`
+ *    closures, which Swift 6.2 rejects ("sending ... risks causing data
+ *    races") now that `assumeIsolated` takes a `sending` closure. Mirrored
+ *    from 58: an `UncheckedSendable` box plus `.value` at the use sites.
+ *
+ * Applied to the installed package at prebuild time, before `pod install`
+ * compiles it. Scoped to the 57 line: other versions skip untouched.
+ */
+const fs = require('fs');
+const path = require('path');
+
+const JSI_HEADER = 'apple/Sources/ExpoModulesJSI-Cxx/include/RuntimeScheduler.h';
+const JSI_SWIFT = 'apple/Sources/ExpoModulesJSI/Runtime/JavaScriptRuntime.swift';
+const JSI_BOX = 'apple/Sources/ExpoModulesJSI/Utilities/UncheckedSendable.swift';
+
+// The exact 57.x constructor block: constructors carrying the annotation that
+// Swift 6.2 rejects. (\u2014 is the em dash in the original comment.)
+const BROKEN_CONSTRUCTORS = `public:
+  /**
+   Constructs a scheduler bound to a host-provided native RuntimeScheduler.
+   \`scheduleTask\` dispatches through \`fn\`, which the host implements against
+   the real react::RuntimeScheduler.
+   */
+  SWIFT_RETURNS_RETAINED RuntimeScheduler(void *scheduler, ScheduleFn fn) noexcept
+      : nativeScheduler(scheduler), scheduleFn(fn) {}
+
+  /**
+   Constructs a no-op scheduler. Scheduled tasks run synchronously on the
+   caller's thread \u2014 intended for standalone runtimes (e.g. tests) that have
+   no React scheduler.
+   */
+  SWIFT_RETURNS_RETAINED RuntimeScheduler() {}`;
+
+// The 58-shaped replacement: unannotated private constructors plus annotated
+// static factories, which every Swift version accepts.
+const FIXED_CONSTRUCTORS = `  RuntimeScheduler(void *scheduler, ScheduleFn fn) noexcept
+      : nativeScheduler(scheduler), scheduleFn(fn) {}
+
+  RuntimeScheduler() noexcept {}
+
+public:
+  // Swift creates instances through the static \`create\` functions below, not
+  // the constructors: \`SWIFT_RETURNS_RETAINED\` on a constructor is a hard
+  // error on Swift 6.2 (Xcode 26), while a static function returning the shared
+  // reference accepts the annotation on every Swift version. This mirrors the
+  // fix Expo ships in expo-modules-jsi 58; the 57 line has no such release.
+
+  /**
+   Creates a scheduler bound to a host-provided native RuntimeScheduler.
+   \`scheduleTask\` dispatches through \`fn\`, which the host implements against
+   the real react::RuntimeScheduler.
+   */
+  static RuntimeScheduler *create(void *scheduler, ScheduleFn fn) noexcept SWIFT_RETURNS_RETAINED {
+    return new RuntimeScheduler(scheduler, fn);
+  }
+
+  /**
+   Creates a no-op scheduler. Scheduled tasks run synchronously on the
+   caller's thread \u2014 intended for standalone runtimes (e.g. tests) that have
+   no React scheduler.
+   */
+  static RuntimeScheduler *create() noexcept SWIFT_RETURNS_RETAINED {
+    return new RuntimeScheduler();
+  }`;
+
+// Verbatim from expo-modules-jsi 58's Utilities/UncheckedSendable.swift: an
+// allocation-free `@unchecked Sendable` box. Swift 6.2 still reports
+// "sending ... risks causing data races" for `nonisolated(unsafe)` locals
+// captured by a `sending` closure, while a captured `Sendable` value passes.
+const UNCHECKED_SENDABLE = `/// Immutable wrapper that makes a non-Sendable value capturable by a \`@Sendable\` closure without compiler enforcement.
+/// Unlike \`NonisolatedUnsafeVar\`, it is a struct, so wrapping a value doesn't allocate.
+///
+/// Use it instead of a \`nonisolated(unsafe) let\` local captured by such a closure: Swift 6.2 still reports
+/// "sending '...' risks causing data races" for those, while a capture of a \`Sendable\` value passes on every version.
+/// The caller is responsible for making sure the value is never accessed concurrently.
+internal struct UncheckedSendable<Value>: @unchecked Sendable {
+  let value: Value
+
+  init(_ value: Value) {
+    self.value = value
+  }
+}
+`;
+
+function countOf(text, snippet) {
+    return text.split(snippet).length - 1;
+}
+
+function replaceOnceOrThrow(text, oldText, newText, what) {
+    if (countOf(text, oldText) !== 1) {
+        throw new Error('[desklink] expo-modules-jsi ' + what + ': expected one match, refusing to patch.');
+    }
+    return text.replace(oldText, newText);
+}
+
+/**
+ * Apply the 58-shaped Xcode 26 fixes to the installed expo-modules-jsi.
+ * Idempotent: a second prebuild (or an upstream-fixed copy) is a no-op.
+ * Scoped to the 57 line; anything else is left untouched. Throws on an
+ * unrecognised 57 layout rather than shipping a guess.
  */
-module.exports = function withDesklinkPointer(config) {
+function patchExpoModulesJsi(projectRoot) {
+    const root = path.join(projectRoot, 'node_modules/expo-modules-jsi');
+    const header = path.join(root, JSI_HEADER);
+    if (!fs.existsSync(header)) {
+        console.log('[desklink] expo-modules-jsi header not installed, skipping Xcode 26 fix');
+        return;
+    }
+    let version = '';
+    try {
+        version = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version ?? '';
+    } catch { /* unknown version: the layout checks below decide */ }
+    if (!version.startsWith('57.')) {
+        if (version === '') {
+            throw new Error('[desklink] expo-modules-jsi has no readable version; refusing to patch blind.');
+        }
+        console.log(`[desklink] expo-modules-jsi ${version} is not a 57 release, skipping Xcode 26 fix`);
+        return;
+    }
+    const before = fs.readFileSync(header, 'utf8');
+    if (!before.includes('static RuntimeScheduler *create(')) {
+        if (countOf(before, BROKEN_CONSTRUCTORS) !== 1) {
+            throw new Error(
+                '[desklink] expo-modules-jsi ' + version + ' RuntimeScheduler.h has an unrecognised layout; ' +
+                'refusing to patch. Update this plugin workaround for the installed version.'
+            );
+        }
+        fs.writeFileSync(header, before.replace(BROKEN_CONSTRUCTORS, FIXED_CONSTRUCTORS));
+    }
+
+    // The header's only constructor callers are the Swift file beside it:
+    // point them at the factories. Member accesses (`.Priority(`, `.ScheduleFn`)
+    // never match `RuntimeScheduler(`.
+    const swift = path.join(root, JSI_SWIFT);
+    if (!fs.existsSync(swift)) {
+        throw new Error('[desklink] expo-modules-jsi ' + version + ' ships no ' + JSI_SWIFT + '.');
+    }
+    let swiftText = fs.readFileSync(swift, 'utf8');
+    if (!swiftText.includes('expo.RuntimeScheduler.create(')) {
+        const migrated = swiftText.replace(/expo\.RuntimeScheduler\(/g, 'expo.RuntimeScheduler.create(');
+        if (migrated === swiftText || /expo\.RuntimeScheduler\(/.test(migrated)) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift call sites not fully migrated.');
+        }
+        swiftText = migrated;
+    }
+
+    // Capture the JSI pointers through UncheckedSendable instead of
+    // `nonisolated(unsafe)`, which Swift 6.2 rejects at `sending` closures.
+    if (!swiftText.includes('resultPtr.value')) {
+        if (countOf(swiftText, 'nonisolated(unsafe) let resultPtr = resultPtr') !== 3) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift pointer captures have an unrecognised layout.');
+        }
+        swiftText = replaceOnceOrThrow(swiftText,
+            'let propertyName = String(cString: propertyName)\n      nonisolated(unsafe) let resultPtr = resultPtr',
+            'let propertyName = String(cString: propertyName)\n      let resultPtr = UncheckedSendable(resultPtr)',
+            'getter capture');
+        swiftText = swiftText.split(
+            '    nonisolated(unsafe) let thisPtr = thisPtr\n' +
+            '    nonisolated(unsafe) let argumentsPtr = argumentsPtr\n' +
+            '    nonisolated(unsafe) let resultPtr = resultPtr').join(
+            '    let thisPtr = UncheckedSendable(thisPtr)\n' +
+            '    let argumentsPtr = UncheckedSendable(argumentsPtr)\n' +
+            '    let resultPtr = UncheckedSendable(resultPtr)');
+        if (countOf(swiftText, 'let thisPtr = UncheckedSendable(thisPtr)') !== 2) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift trampoline captures not fully migrated.');
+        }
+        const writes = countOf(swiftText, 'writeJSIValue(to: resultPtr)');
+        if (writes !== 3) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift result writes have an unrecognised layout.');
+        }
+        swiftText = swiftText.replace(/writeJSIValue\(to: resultPtr\)/g, 'writeJSIValue(to: resultPtr.value)');
+        swiftText = replaceOnceOrThrow(swiftText,
+            'UnsafeMutablePointer(mutating: thisPtr)', 'UnsafeMutablePointer(mutating: thisPtr.value)',
+            'owning-this use');
+        const starts = countOf(swiftText, 'start: argumentsPtr, count:');
+        if (starts !== 2) {
+            throw new Error('[desklink] expo-modules-jsi JavaScriptRuntime.swift buffer starts have an unrecognised layout.');
+        }
+        swiftText = swiftText.replace(/start: argumentsPtr, count:/g, 'start: argumentsPtr.value, count:');
+        swiftText = replaceOnceOrThrow(swiftText,
+            'JavaScriptUnownedValue(runtime.pointee, thisPtr)', 'JavaScriptUnownedValue(runtime.pointee, thisPtr.value)',
+            'unowned-this use');
+        swiftText = replaceOnceOrThrow(swiftText,
+            'so the `nonisolated(unsafe)` capture is sound.', 'so capturing them through `UncheckedSendable` is sound.',
+            'trampoline comment');
+        fs.writeFileSync(swift, swiftText);
+    }
+
+    const box = path.join(root, JSI_BOX);
+    if (!fs.existsSync(box)) {
+        fs.writeFileSync(box, UNCHECKED_SENDABLE);
+    }
+    console.log('[desklink] patched expo-modules-jsi ' + version + ' for Xcode 26');
+}
+
+function withDesklinkPointer(config) {
     return {
         ...config,
         ios: { ...config.ios, infoPlist: { ...config.ios?.infoPlist, UIApplicationSupportsIndirectInputEvents: true } },
     };
+}
+
+function withExpoJsiSwiftFix(config) {
+    let withDangerousMod;
+    try {
+        withDangerousMod = require('expo/config-plugins').withDangerousMod;
+    } catch {
+        throw new Error('[desklink] expo/config-plugins is required to apply the Xcode 26 patch.');
+    }
+    return withDangerousMod(config, ['ios', async (config) => {
+        patchExpoModulesJsi(config.modRequest.projectRoot);
+        return config;
+    }]);
+}
+
+module.exports = function withDesklink(config) {
+    return withExpoJsiSwiftFix(withDesklinkPointer(config));
 };
+module.exports.patchExpoModulesJsi = patchExpoModulesJsi;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@desklink/react-native",
-    "version": "0.5.2",
+    "version": "0.5.4",
     "license": "Apache-2.0",
     "description": "Render and drive a desktop session from a React Native app",
     "main": "index.ts",

package/src/DesktopView.ios.tsx

@@ -1,5 +1,5 @@
 import * as React from 'react';
-import { Image, Keyboard, StyleSheet, TextInput, View, type GestureResponderEvent, type LayoutChangeEvent, type ViewProps } from 'react-native';
+import { Image, Keyboard, StyleSheet, TextInput, View, useWindowDimensions, type GestureResponderEvent, type LayoutChangeEvent, type ViewProps } from 'react-native';
 import pointerArrow from './pointer.png';
 import { requireNativeViewManager, requireOptionalNativeModule } from 'expo-modules-core';
 import type { DesktopViewProps } from './DesktopView';
@@ -67,7 +67,7 @@ function loadRTCView(): React.ComponentType<Record<string, unknown>> | null {
 /** An offset that the edge clamp turns into the desktop's top-left corner. */
 const TOP_LEFT: Point = { x: Infinity, y: Infinity };
 
-export function DesktopView({ sessionId, style, placeholder, accessibilityLabel, keyboardClearance = 0, insets, gestures = 'desktop', onPictureFrame }: DesktopViewProps) {
+export function DesktopView({ sessionId, style, placeholder, accessibilityLabel, keyboardClearance = 0, insets, gestures = 'desktop', cover = false, onPictureFrame }: DesktopViewProps) {
     const [revision, refresh] = React.useReducer((n: number) => n + 1, 0);
     const [bounds, setBounds] = React.useState({ width: 0, height: 0 });
     const [size, setSize] = React.useState(() => getDesktopSize(sessionId) ?? { width: 0, height: 0 });
@@ -145,18 +145,27 @@ export function DesktopView({ sessionId, style, placeholder, accessibilityLabel,
     const visibleBottom = Math.min(top + safeHeight, bounds.height - (keyboardOverlap ? keyboardOverlap + keyboardClearance : 0));
     const visibleHeight = Math.max(1, visibleBottom - top);
     const fit = size.width && size.height ? Math.min(safeWidth / size.width, visibleHeight / size.height) : 1;
-    const defaultScale = bounds.width <= bounds.height
+    // Portrait fits the width unless the app opted into cover, when it covers
+    // like landscape does (as `DesktopView.kt` does); either way the fill never
+    // goes below the fit or above the zoom cap.
+    const defaultScale = bounds.width <= bounds.height && !cover
         ? safeWidth / size.width
         : Math.max(bounds.width / size.width, (bounds.height - top) / size.height);
     const fill = size.width && size.height ? Math.max(fit, Math.min(MAX_SCALE, defaultScale)) : 1;
     const scale = zoom === null ? fill : fit * zoom;
     /** The zoom over the whole-desktop fit the picture is at now. */
     const zoomed = fit > 0 ? scale / fit : 1;
-    // A new desktop size fills the view again, and a new fill (a rotation)
-    // starts again, at the desktop's top-left corner, where a page's first words are.
+    // A new desktop size fills the view again, and a rotation starts again at
+    // the desktop's top-left corner, where a page's first words are. Only an
+    // orientation change resets it: the application making room for the
+    // keyboard also changes the view, by taking height away, and that must
+    // move the picture (below) rather than snap it back to the corner and
+    // leave the field the tap just put the caret in hidden under the keyboard.
+    const window = useWindowDimensions();
+    const portrait = window.width <= window.height;
     React.useEffect(() => { setZoom(null); setOffset(TOP_LEFT); }, [size.width, size.height]);
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    React.useEffect(() => { if (zoom === null) setOffset(TOP_LEFT); }, [fill, bounds.width, bounds.height, top, left, insets?.right, insets?.bottom]);
+    React.useEffect(() => { if (zoom === null) setOffset(TOP_LEFT); }, [portrait]);
     const pictureWidth = size.width * scale;
     const pictureHeight = size.height * scale;
     const point = (x: number, y: number, clamp = false): Point | null => {

package/src/DesktopView.tsx

@@ -35,6 +35,11 @@ export interface DesktopViewProps {
      * (one finger scrolls), or a device screen (one finger presses and drags).
      */
     gestures?: GestureProfile;
+    /**
+     * Cover the view in every orientation, cropping the overflowing axis,
+     * instead of fitting the portrait width. Off by default.
+     */
+    cover?: boolean;
     /**
      * Where the picture ended, in the view's own points, whenever it moves.
      * A wide desktop on a tall screen leaves a band under the picture; this is
@@ -53,6 +58,7 @@ interface NativeSurfaceProps {
     /** `insets` as top, left, bottom, right. */
     insets?: number[];
     gestures?: GestureProfile;
+    cover?: boolean;
 }
 
 // The Expo view is resolved at module load; on a platform without it the
@@ -69,7 +75,7 @@ const NativeSurface: React.ComponentType<NativeSurfaceProps> | null = desktopAva
  * belong to the application, which mounts this wherever it wants the desktop
  * to appear.
  */
-export function DesktopView({ sessionId, style, placeholder, accessibilityLabel, keyboardClearance = 0, insets, gestures = 'desktop' }: DesktopViewProps) {
+export function DesktopView({ sessionId, style, placeholder, accessibilityLabel, keyboardClearance = 0, insets, gestures = 'desktop', cover = false }: DesktopViewProps) {
     if (NativeSurface == null || sessionId == null) {
         return (
             <View style={[styles.surface, style]}>
@@ -78,7 +84,7 @@ export function DesktopView({ sessionId, style, placeholder, accessibilityLabel,
         );
     }
     return <NativeSurface style={[styles.surface, style]} sessionId={sessionId} accessible={accessibilityLabel !== undefined} accessibilityLabel={accessibilityLabel} keyboardClearance={keyboardClearance}
-        insets={[insets?.top ?? 0, insets?.left ?? 0, insets?.bottom ?? 0, insets?.right ?? 0]} gestures={gestures} />;
+        insets={[insets?.top ?? 0, insets?.left ?? 0, insets?.bottom ?? 0, insets?.right ?? 0]} gestures={gestures} cover={cover} />;
 }
 
 const styles = StyleSheet.create({