@oxyhq/services 26.0.0 → 26.0.1

package/src/notifications/deviceNotifications.ts

@@ -8,25 +8,6 @@
  * already lives in `@oxyhq/core`; core may never import an `expo-*` module, and
  * this adapter is the Expo-side half that closes that gap.
  *
- * ## Reached through its OWN entry point, never the root barrel
- *
- * ```ts
- * import { getExpoPushToken } from '@oxyhq/services/notifications';
- * ```
- *
- * This is the only module in the package that depends on peers an app which
- * does not use push genuinely never installs, and a barrel export would put it
- * in EVERY consumer's import graph. `tsc` resolves the specifier of an
- * `import()` even when the call is lazy and inside a try/catch, so a barrel
- * export turned "optional peer" into a hard requirement: consumers with no
- * interest in push failed to type-check with TS2307. The subpath is what keeps
- * the optionality honest — see the note in `src/index.ts`.
- *
- * Metro is the resolver that behaves differently here, and in the useful
- * direction: an unresolvable DYNAMIC `import()` bundles fine (the `catch` below
- * takes over at runtime), where a static import fails the build outright. That
- * is why the runtime shape below must stay dynamic-and-guarded.
- *
  * ## Native-only by construction
  *
  * Every entry point resolves its null/no-op result from `Platform.OS` BEFORE the
@@ -316,69 +297,6 @@ export type ForegroundPresentation = 'show' | 'suppress';
  */
 let foregroundHandlerAttempted = false;
 
-/** How prominently Android surfaces a channel's notifications. */
-export type NotificationChannelImportance = 'default' | 'high';
-
-/** An Android notification channel this app delivers on. */
-export interface NotificationChannelSpec {
-  /**
-   * The channel id. It MUST match the id the sender attaches: Android 8+ drops
-   * a notification whose channel the app has not created, silently and with no
-   * error on either side, which is the hardest push symptom there is to
-   * diagnose. Ids that cross the wire belong in `@oxyhq/contracts`, not in a
-   * string typed on both sides.
-   */
-  id: string;
-  /** User-visible channel name — app copy, so the caller localizes it. */
-  name: string;
-  /** User-visible description shown in Android's notification settings. */
-  description?: string;
-  importance?: NotificationChannelImportance;
-}
-
-/**
- * Create (or update) an Android notification channel.
- *
- * A no-op everywhere but Android: iOS has no channels, and web never loads the
- * native module. Call it BEFORE registering a push token, so the very first
- * notification the server sends already has a channel to land on.
- *
- * Failure is non-fatal and logged: a missing channel costs visibility, and
- * refusing to register a token over it would cost the feature entirely.
- *
- * @returns Whether the channel was actually created (`false` off Android, or
- *   when the native module is unavailable, or when creation failed).
- */
-export async function ensureNotificationChannel(
-  spec: NotificationChannelSpec,
-): Promise<boolean> {
-  if (Platform.OS !== 'android') {
-    return false;
-  }
-  const notifications = await loadNotifications();
-  if (!notifications) {
-    return false;
-  }
-  try {
-    await notifications.setNotificationChannelAsync(spec.id, {
-      name: spec.name,
-      importance:
-        spec.importance === 'high'
-          ? notifications.AndroidImportance.HIGH
-          : notifications.AndroidImportance.DEFAULT,
-      ...(spec.description ? { description: spec.description } : {}),
-    });
-    return true;
-  } catch (error) {
-    log.warn(
-      'could not create the notification channel',
-      { method: 'ensureNotificationChannel', channelId: spec.id },
-      error,
-    );
-    return false;
-  }
-}
-
 /**
  * Install the ONE process-wide handler that decides whether an incoming
  * notification is shown while the app is in the FOREGROUND.

package/src/ui/boot/__tests__/coldBootWebAuthMode.test.ts

@@ -0,0 +1,281 @@
+/**
+ * `runProviderColdBoot` — the `webAuthMode` transport gate (#691 phase 7).
+ *
+ * `webAuthMode: 'popup'` must never let the boot navigate the RP's top-level
+ * window: no silent `prompt=none` restore, no authorize redirect, a signed-out
+ * domain simply resolves signed out. `'redirect'` — still the default and the
+ * compatibility path — must behave exactly as before.
+ *
+ * Unlike `__tests__/boot/runProviderColdBoot.test.ts` (deadline + connectivity
+ * wiring, with `crossOriginRestore` stubbed out), this suite keeps the restore
+ * lane REAL so the redirect-mode assertions reach the actual navigation
+ * primitive — the thing popup mode has to suppress.
+ */
+
+import type { AuthStateStore, PersistedAuthState, SessionClient } from '@oxyhq/core';
+
+// Only `runSessionColdBoot` and the origin-CLASSIFICATION predicates are faked.
+// jsdom's `location` is non-configurable, so origin eligibility has to be driven
+// through the predicates (their real behaviour is covered by core's own tests);
+// everything else in core (PKCE, authorize-URL builder, handshake store) stays
+// real so the redirect-mode lane is exercised end to end.
+jest.mock('@oxyhq/core', () => {
+  const actual = jest.requireActual('@oxyhq/core');
+  return {
+    __esModule: true,
+    ...actual,
+    runSessionColdBoot: jest.fn(),
+    isLoopbackOrigin: jest.fn(() => false),
+    isOfficialWebOrigin: jest.fn(() => true),
+    isIdpHubOrigin: jest.fn(() => false),
+  };
+});
+
+// The ONLY top-level-window navigation primitive either lane can reach.
+jest.mock('../../components/oauthNavigation', () => ({
+  redirectToAuthorize: jest.fn(),
+}));
+
+// Spied but REAL: redirect mode must still perform the actual restore.
+jest.mock('../../utils/crossOriginRestore', () => {
+  const actual = jest.requireActual('../../utils/crossOriginRestore');
+  return {
+    __esModule: true,
+    ...actual,
+    maybeStartSilentOAuthRestore: jest.fn(actual.maybeStartSilentOAuthRestore),
+    consumeSilentOAuthError: jest.fn(actual.consumeSilentOAuthError),
+  };
+});
+
+jest.mock('../../utils/oauthReturn', () => {
+  const actual = jest.requireActual('../../utils/oauthReturn');
+  return {
+    __esModule: true,
+    ...actual,
+    tryCompleteOAuthReturn: jest.fn(async () => false),
+    consumeHubSyncFailure: jest.fn(actual.consumeHubSyncFailure),
+  };
+});
+
+import { runSessionColdBoot } from '@oxyhq/core';
+import { redirectToAuthorize } from '../../components/oauthNavigation';
+import {
+  clearCrossOriginRestoreGuards,
+  consumeSilentOAuthError,
+  maybeStartSilentOAuthRestore,
+} from '../../utils/crossOriginRestore';
+import { consumeHubSyncFailure, tryCompleteOAuthReturn } from '../../utils/oauthReturn';
+import { runProviderColdBoot, type RunProviderColdBootOptions } from '../runProviderColdBoot';
+
+const mockRunSessionColdBoot = runSessionColdBoot as jest.Mock;
+const mockRedirectToAuthorize = redirectToAuthorize as jest.Mock;
+const mockSilentRestore = maybeStartSilentOAuthRestore as jest.Mock;
+const mockConsumeSilentOAuthError = consumeSilentOAuthError as jest.Mock;
+const mockConsumeHubSyncFailure = consumeHubSyncFailure as jest.Mock;
+const mockTryCompleteOAuthReturn = tryCompleteOAuthReturn as jest.Mock;
+
+const CLIENT_ID = 'oxy_dk_test';
+
+/** An auth store holding no device credential — the signed-out domain case. */
+function makeEmptyAuthStore(): AuthStateStore {
+  return {
+    load: jest.fn(async (): Promise<PersistedAuthState | null> => null),
+    save: jest.fn(async () => undefined),
+    clear: jest.fn(async () => undefined),
+  } as unknown as AuthStateStore;
+}
+
+interface Harness {
+  options: RunProviderColdBootOptions;
+  commitSession: jest.Mock;
+  markAuthResolved: jest.Mock;
+  setTokenReady: jest.Mock;
+  sessionClientStart: jest.Mock;
+}
+
+function makeHarness(overrides: Partial<RunProviderColdBootOptions> = {}): Harness {
+  const commitSession = jest.fn(async () => undefined);
+  const markAuthResolved = jest.fn();
+  const setTokenReady = jest.fn();
+  const sessionClientStart = jest.fn(async () => undefined);
+
+  const options: RunProviderColdBootOptions = {
+    oxyServices: {} as RunProviderColdBootOptions['oxyServices'],
+    authStore: makeEmptyAuthStore(),
+    clientId: CLIENT_ID,
+    sessionClient: { start: sessionClientStart } as unknown as SessionClient,
+    syncDeviceCredentialToHost: jest.fn(async () => undefined),
+    commitSession,
+    markAuthResolved,
+    setTokenReady,
+    ...overrides,
+  };
+
+  return { options, commitSession, markAuthResolved, setTokenReady, sessionClientStart };
+}
+
+/** `runSessionColdBoot` finding no session at all — the signed-out domain. */
+function stubSignedOutBoot(): void {
+  mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
+    await opts.onSignedOut?.('no_session');
+    return { kind: 'unauthenticated' } as const;
+  });
+}
+
+describe('runProviderColdBoot — webAuthMode transport gate (#691 phase 7)', () => {
+  beforeEach(() => {
+    mockRunSessionColdBoot.mockReset();
+    mockRedirectToAuthorize.mockClear();
+    mockSilentRestore.mockClear();
+    mockConsumeSilentOAuthError.mockClear();
+    mockConsumeHubSyncFailure.mockClear();
+    mockTryCompleteOAuthReturn.mockClear();
+    mockTryCompleteOAuthReturn.mockImplementation(async () => false);
+    globalThis.sessionStorage?.clear();
+    clearCrossOriginRestoreGuards();
+  });
+
+  describe("webAuthMode: 'popup'", () => {
+    it('never starts the silent restore and never navigates the top-level window', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness({ webAuthMode: 'popup' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockSilentRestore).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('resolves a domain with no local credential SIGNED OUT instead of bouncing', async () => {
+      stubSignedOutBoot();
+      const { options, markAuthResolved, commitSession, sessionClientStart } = makeHarness({
+        webAuthMode: 'popup',
+      });
+
+      await runProviderColdBoot(options);
+
+      // Auth resolution concluded (routing can settle), nothing was committed,
+      // and with no persisted credential the device socket is not started.
+      expect(markAuthResolved).toHaveBeenCalled();
+      expect(commitSession).not.toHaveBeenCalled();
+      expect(sessionClientStart).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('still completes an authorization code already on the URL (blocked-popup fallback)', async () => {
+      // A popup-mode app lands here whenever the browser blocked the popup and
+      // `startWebOAuthSignIn` fell back to a full-page redirect.
+      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      const { options, markAuthResolved, setTokenReady } = makeHarness({ webAuthMode: 'popup' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
+      expect(setTokenReady).toHaveBeenLastCalledWith(true);
+      expect(markAuthResolved).toHaveBeenCalled();
+      // The device mint is short-circuited by the completed return leg.
+      expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('commits the OAuth return WITHOUT hub sync', async () => {
+      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      const { options } = makeHarness({ webAuthMode: 'popup' });
+
+      await runProviderColdBoot(options);
+
+      const commit = mockTryCompleteOAuthReturn.mock.calls[0][0] as {
+        commitSession: (input: unknown) => Promise<void>;
+      };
+      await commit.commitSession({ sessionId: 's1', userId: 'u1' });
+      expect(options.commitSession).toHaveBeenCalledWith(
+        { sessionId: 's1', userId: 'u1' },
+        { activate: true, hubSync: false },
+      );
+    });
+  });
+
+  describe("webAuthMode: 'redirect' (unchanged compatibility path)", () => {
+    it('starts the silent restore and navigates to the IdP with prompt=none', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness({ webAuthMode: 'redirect' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
+      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
+      const url = new URL(mockRedirectToAuthorize.mock.calls[0][0] as string);
+      expect(url.origin + url.pathname).toBe('https://auth.oxy.so/authorize');
+      expect(url.searchParams.get('client_id')).toBe(CLIENT_ID);
+      expect(url.searchParams.get('prompt')).toBe('none');
+    });
+
+    it('is the DEFAULT when no webAuthMode is supplied', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness();
+
+      await runProviderColdBoot(options);
+
+      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
+      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
+    });
+
+    it('does NOT restore when the mint already resolved a session', async () => {
+      mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
+        const session = { sessionId: 's1', userId: 'u1', accessToken: 'at', via: 'device-secret-mint' };
+        await opts.onSession?.(session);
+        return { kind: 'session', via: session.via, session } as const;
+      });
+      const { options, commitSession } = makeHarness({ webAuthMode: 'redirect' });
+
+      await runProviderColdBoot(options);
+
+      expect(commitSession).toHaveBeenCalledWith(
+        { sessionId: 's1', accessToken: 'at', userId: 'u1' },
+        { activate: false },
+      );
+      expect(mockSilentRestore).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('URL-cleanup consumers run in BOTH modes', () => {
+    it.each(['popup', 'redirect'] as const)(
+      'consumes the silent-OAuth error and hub-sync failure params (%s)',
+      async (webAuthMode) => {
+        stubSignedOutBoot();
+        const { options } = makeHarness({ webAuthMode });
+
+        await runProviderColdBoot(options);
+
+        expect(mockConsumeSilentOAuthError).toHaveBeenCalledTimes(1);
+        expect(mockConsumeHubSyncFailure).toHaveBeenCalledTimes(1);
+      },
+    );
+
+    it.each(['popup', 'redirect'] as const)(
+      'consumes an authorization code left on the URL (%s)',
+      async (webAuthMode) => {
+        stubSignedOutBoot();
+        const { options } = makeHarness({ webAuthMode });
+
+        await runProviderColdBoot(options);
+
+        expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
+      },
+    );
+  });
+
+  describe('identity mode still skips both web OAuth lanes in either transport', () => {
+    it.each(['popup', 'redirect'] as const)('skips the return leg and the restore (%s)', async (webAuthMode) => {
+      stubSignedOutBoot();
+      const { options } = makeHarness({ webAuthMode, sessionMode: 'identity' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
+      expect(mockSilentRestore).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+  });
+});

package/src/ui/boot/runProviderColdBoot.ts

@@ -8,9 +8,15 @@ import {
 } from '@oxyhq/core';
 import type { SessionClient } from '@oxyhq/core';
 import { loadPersistedDeviceCredential } from '../utils/deviceCredential';
-import { tryCompleteOAuthReturn } from '../utils/oauthReturn';
+import {
+  consumeSilentOAuthError,
+  isSilentRestoreEligibleOrigin,
+  maybeStartSilentOAuthRestore,
+} from '../utils/crossOriginRestore';
+import { tryCompleteOAuthReturn, consumeHubSyncFailure } from '../utils/oauthReturn';
 import { isWebBrowser } from '../utils/isWebBrowser';
-import { isNetConnectivityExplicitlyOffline } from '../utils/netConnectivity';
+import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
+import type { WebAuthMode } from '../oauth/types';
 import type { CommitInput } from '../context/oxyContextTypes';
 
 /** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
@@ -61,8 +67,8 @@ async function detectOfflineHint(): Promise<boolean> {
       }),
     ]);
     // `null` ⇒ the probe timed out (unknown → assume online). Only an explicit
-    // disconnected / unreachable verdict disables the network steps.
-    return isNetConnectivityExplicitlyOffline(state);
+    // `isConnected === false` disables the network steps.
+    return state?.isConnected === false;
   } catch {
     // NetInfo missing / probe threw — never block sign-in on a probe failure.
     return false;
@@ -74,19 +80,39 @@ export interface RunProviderColdBootOptions {
   authStore: AuthStateStore;
   clientId?: string;
   authRedirectUri?: string;
+  /**
+   * Authorize endpoint override for silent cross-origin restore. Defaults to
+   * the production Oxy IdP when unset; a local/staging deployment sets it so the
+   * silent-restore redirect targets its own IdP, never production.
+   */
+  authorizeBaseUrl?: string;
   /**
    * Who owns the session this boot resolves. `'account'` (the default) is the
    * device's active account — every ordinary Oxy app. `'identity'` binds the
    * boot to the owner of this device's PRIMARY identity key and REQUIRES
-   * {@link identity}; it also disables the web OAuth return leg below, which
-   * commits whatever account the IdP hands back.
+   * {@link identity}; it also disables the two web OAuth lanes below, which
+   * commit whatever account the IdP hands back.
    */
   sessionMode?: SessionMode;
   /** The identity binding required by `sessionMode: 'identity'`. */
   identity?: IdentityBinding;
+  /**
+   * How this provider's WEB sign-in reaches the IdP
+   * (`OxyProviderProps.webAuthMode`).
+   *
+   * A first-class INPUT to the boot, not a UI-only concern: `'popup'` forbids
+   * the automatic full-page `prompt=none` restore in step 3, so a domain with no
+   * local credential resolves SIGNED OUT instead of bouncing the top-level
+   * window to `auth.oxy.so`. See `allowsAutomaticIdpRedirect`.
+   * @default 'redirect'
+   */
+  webAuthMode?: WebAuthMode;
   sessionClient: SessionClient;
   syncDeviceCredentialToHost: () => Promise<void>;
-  commitSession: (input: CommitInput, options: { activate: boolean }) => Promise<void>;
+  commitSession: (
+    input: CommitInput,
+    options: { activate: boolean; hubSync?: boolean },
+  ) => Promise<void>;
   markAuthResolved: () => void;
   setTokenReady: (ready: boolean) => void;
 }
@@ -95,19 +121,19 @@ export interface RunProviderColdBootOptions {
  * Device-first cold boot for `@oxyhq/services` providers.
  *
  * Ordered pipeline:
- * 1. Complete an OAuth authorization-code return already on the URL (web)
+ * 1. Complete OAuth authorization-code return (web)
  * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
  *    primary-identity-key lane in `sessionMode: 'identity'`)
+ * 3. Silent OAuth for all web apps when mint finds no session
  *
- * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
- * which for an identity-bound client is somebody else's account by construction.
- * In `'identity'` mode the boot is exactly step 2.
+ * Steps 1 and 3 are ACCOUNT-MODE ONLY: both commit whichever account the IdP
+ * resolves, which for an identity-bound client is somebody else's account by
+ * construction. In `'identity'` mode the boot is exactly step 2.
  *
- * The boot NEVER navigates the top-level window. There is no automatic
- * `prompt=none` bounce to the IdP: a web origin with no local device credential
- * resolves SIGNED OUT and waits for the user's next explicit "Continue with
- * Oxy", which opens a popup from a real gesture (#691 phase 7b). Step 1 is not a
- * navigation — it only consumes a code that is already in the address bar.
+ * Step 3 is additionally REDIRECT-MODE ONLY: it navigates the top-level window
+ * with no user gesture behind it, which `webAuthMode: 'popup'` exists to
+ * eliminate. In popup mode the boot is steps 1 and 2, and a domain with no local
+ * credential simply resolves signed out. See `allowsAutomaticIdpRedirect`.
  */
 export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Promise<void> {
   const {
@@ -115,8 +141,10 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
     authStore,
     clientId,
     authRedirectUri,
+    authorizeBaseUrl,
     sessionMode = 'account',
     identity,
+    webAuthMode = 'redirect',
     sessionClient,
     syncDeviceCredentialToHost,
     commitSession,
@@ -129,19 +157,28 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
   setTokenReady(false);
 
   try {
-    // The redirect transport's RETURN leg. An app reaches it whenever the browser
-    // BLOCKED the sign-in popup and `startWebOAuthSignIn` fell back to a
-    // full-page redirect (`popup-blocked` / `popup-navigation-failed`), so it is
-    // load-bearing even though nothing here ever starts a redirect. It consumes a
-    // code (or a stale OAuth `error`) already in the address bar and rewrites the
-    // URL via `history.replaceState`; it never begins a navigation.
+    // MODE-INDEPENDENT URL cleanup, deliberately so: both consume query params a
+    // PREVIOUS redirect-mode session left in the address bar (`?error=login_required`
+    // from a silent authorize, `?hub_sync=failed` from the hub) and restore the
+    // page the visit started on. Flipping an app to popup mode must not strand
+    // those params, so neither is gated on `webAuthMode`. Neither starts a
+    // navigation — they only rewrite the URL via `history.replaceState`.
+    consumeSilentOAuthError();
+    consumeHubSyncFailure();
+
+    // The redirect transport's RETURN leg — also NOT gated on `webAuthMode`. A
+    // popup-mode app legitimately lands here with `?code=` whenever the browser
+    // blocked the popup and `startWebOAuthSignIn` fell back to a full-page
+    // redirect (`popup-blocked` / `popup-navigation-failed`), and an app that
+    // switched modes mid-flight must not be stranded with a dead `?code=`
+    // either. It consumes a code already on the URL; it never starts one.
     const oauthCompleted = identityBound
       ? false
       : await tryCompleteOAuthReturn({
           oxyServices,
           clientId,
           authRedirectUri,
-          commitSession: (input) => commitSession(input, { activate: true }),
+          commitSession: (input) => commitSession(input, { activate: true, hubSync: false }),
         });
     if (oauthCompleted) {
       setTokenReady(true);
@@ -155,7 +192,7 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
     // resolves to "online" — the network steps still run.
     const offline = await detectOfflineHint();
 
-    await runSessionColdBoot({
+    const outcome = await runSessionColdBoot({
       oxy: oxyServices,
       store: authStore,
       platform: { isWeb: isWebBrowser(), isNative: !isWebBrowser() },
@@ -222,6 +259,46 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
         }
       },
     });
+
+    // Silent cross-origin OAuth restore (web cross-app SSO): a full-page
+    // `prompt=none` bounce to the IdP when the mint found no local session.
+    //
+    // TRANSPORT gate (`allowsAutomaticIdpRedirect`): `webAuthMode: 'popup'`
+    // FORBIDS this lane. It navigates the top-level window with no user gesture
+    // behind it, which is precisely what popup mode exists to eliminate — a
+    // popup-mode domain without a local credential resolves signed out right
+    // here and waits for the user's next explicit "Continue with Oxy" (issue
+    // #691, "Cold boot and cross-domain behavior"). `'redirect'` — still the
+    // default and the compatibility path — reaches this lane unchanged, and this
+    // whole block disappears with the transport in phase 7b.
+    //
+    // ORIGIN gate: same as the hub-sync WRITE side (`syncHubAfterSignIn`) —
+    // official web origins only, never the IdP hub itself, and — unlike the
+    // write side — never a loopback / local-dev origin (which must not be
+    // bounced to a hosted IdP on cold boot). The authorize endpoint is
+    // env-configurable so a local/staging app targets its own IdP instead of
+    // production.
+    const webOrigin = isWebBrowser()
+      ? (globalThis as { location?: Location }).location?.origin
+      : undefined;
+    if (
+      !identityBound &&
+      allowsAutomaticIdpRedirect(webAuthMode) &&
+      clientId &&
+      outcome.kind !== 'session' &&
+      webOrigin &&
+      isSilentRestoreEligibleOrigin(webOrigin)
+    ) {
+      const redirected = await maybeStartSilentOAuthRestore({
+        oxyServices,
+        clientId,
+        redirectUri: authRedirectUri,
+        authorizeBaseUrl,
+      });
+      if (redirected) {
+        return;
+      }
+    }
   } catch (error) {
     if (__DEV__) {
       loggerUtil.error(

package/src/ui/components/FollowButton.tsx

@@ -6,7 +6,7 @@ import type {
   StyleProp,
 } from 'react-native';
 import { useOxy } from '../context/OxyContext';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { Button } from '@oxyhq/bloom/button';
 import { Loading } from '@oxyhq/bloom/loading';
 import { useFollow, useFollowForButton } from '../hooks/useFollow';

package/src/ui/components/OxyAccountDialogScreen.tsx

@@ -75,19 +75,7 @@ const OxyAccountDialogScreen: React.FC<BaseScreenProps> = ({ canGoBack }) => {
   const { view } = snapshot;
   const showBack =
     view === 'qr' || view === 'signup' || (view === 'add' && snapshot.accounts.length > 0);
-  const goToAccounts = useCallback(() => {
-    if (!controller) return;
-    const { view: currentView, signIn } = controller.getSnapshot();
-    // Backing out of an active request must withdraw it — otherwise the
-    // authorizeCode stays approvable until expiry (issue #691 phase 5).
-    if (
-      (currentView === 'qr' || currentView === 'add') &&
-      (signIn.phase === 'starting' || signIn.phase === 'waiting')
-    ) {
-      controller.cancelSignIn();
-    }
-    controller.setView('accounts');
-  }, [controller]);
+  const goToAccounts = useCallback(() => controller?.setView('accounts'), [controller]);
   // An ENTRY view (accounts / signin — no in-dialog back of its own) that is
   // MORPHED into a host surface (ManageAccount → switcher) has a frame beneath it,
   // so its back CLOSES the dialog and reshapes back to the host — routed through

package/src/ui/components/OxyAuthChooser.tsx

@@ -36,7 +36,7 @@
 import type React from 'react';
 import { useCallback, useMemo, useState, useSyncExternalStore } from 'react';
 import { Linking, Platform } from 'react-native';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { useTheme } from '@oxyhq/bloom/theme';
 import type { AccountDialogSnapshot } from '@oxyhq/core';
 import { isOxyRpOrigin } from '@oxyhq/core';
@@ -72,13 +72,6 @@ const ACCOUNTS_APP_URL = 'https://accounts.oxy.so';
 export interface OxyAuthChooserProps {
   /** Called after a completed switch, sign-in, or sign-up. */
   onComplete?: () => void;
-  /**
-   * When false, the web sign-in entry does not auto-start a device-flow
-   * session on mount. Use for hosts (e.g. the cross-origin passkey hub) that
-   * already have a pending `authorizeCode` and must not spawn a second one.
-   * @default true
-   */
-  autoStartSignIn?: boolean;
 }
 
 /**
@@ -86,10 +79,7 @@ export interface OxyAuthChooserProps {
  * (wrapped in Bloom's `<Dialog>`) today; mountable bare by any future host that
  * supplies its own `onComplete`.
  */
-const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({
-  onComplete,
-  autoStartSignIn: autoStartSignInEnabled = true,
-}) => {
+const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({ onComplete }) => {
   const {
     accountDialogController: controller,
     showBottomSheet,
@@ -171,11 +161,11 @@ const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({
   // a no-op on native (button-driven). Reads the live snapshot at call time (an
   // event callback, not render), so it is stable across renders.
   const autoStartSignIn = useCallback(() => {
-    if (!autoStartSignInEnabled || !controller || !isWebBrowser()) return;
+    if (!controller || !isWebBrowser()) return;
     const { view: currentView, signIn } = controller.getSnapshot();
     if ((currentView !== 'signin' && currentView !== 'add') || signIn.phase !== 'idle') return;
     void controller.signInWithOxy();
-  }, [autoStartSignInEnabled, controller]);
+  }, [controller]);
 
   // Bind the headless controller. `getSnapshot` returns a stable reference
   // between changes, so it is `useSyncExternalStore`-safe. Guard the no-provider