Ship 2026-05-06: 5 GH closed + 12 features + Bug #1 (squashed eb-branch)

[ballinbigE]

What

Single-commit squash of every commit on eb-branch ahead of main, including 19 substantive commits from 2026-05-06's full-day session. Created as a fresh branch off current main so the diff applies cleanly without the hash-mismatch conflict that's been blocking PR #29.

Today's changes (2026-05-06)

Tier-2 GH burn-down (5 issues closed)

• [HIGH] Audit CloudflareTunnel.swift Process invocation for shell-injection #15 [HIGH] CloudflareTunnel Process invocation audit — no shell-injection vector; argv-array form documented + 7 regression tests in CloudflareTunnelArgsTests.swift
• [HIGH] Migrate PIN from UserDefaults to Keychain; raise entropy #14 [HIGH] PIN UserDefaults→Keychain + raise entropy to 8 digits — new PINStore, one-shot migration, 11 tests
• [MED] Add Mac→iOS app-level heartbeat (current keepalive is one-way) #19 [MED] Mac→iOS app-level heartbeat — new HeartbeatMessage/HeartbeatAckMessage, 15s server timer, iOS auto-acks
• [MED] Tighten message types: arrange_windows.layout → enum, optional defaults #20 [MED] arrange_windows.layout String→enum — Codable now rejects unknown rawValues, ErrorMessage broadcast
• [MED] WebSocket auth + Mac handler test coverage gaps #24 [MED] APNsMetadataStore + requireAuth lock test coverage — 8 + 3 tests including 10k concurrent-read TSan canary

Sim-QA fix (install-verified)

• Bug Handle maintaining connections while app is backgrounded better #1: disconnect() now also clears lastError + connectingStartedAt (was leaking watchdog "Stalled Ns" into UI)

Connection + PTT visibility

• Story G: BackendPickerSheet shows live per-backend reachability dot + caption (Connected / Connecting… / Unreachable / PIN required / Off)
• Story H: Single-line PTT health banner above the mic — surfaces Whisper offline / mid-press disconnect / warming up

Codex CLI integration (live-verified)

• Story I: Codex CLI image-paste path — new CLIKind enum on WindowState; TerminalStateDetector.classifyCLI sniffs process names; KeystrokeInjector.pasteImage writes NSImage to clipboard + Cmd+V into iTerm2

A11y + paste + scrollback + numbered prompts

• §B15 slot-row a11y sweep — traits + hints on every chip
• §35 Cross-app clipboard paste via keyboard long-press (32 KiB cap, multi-byte-safe trim)
• §38 iTerm scrollback nav — chevron buttons in panel header, Shift+PageUp/Down + Cmd+Home/End via System Events
• §18 Context-aware numbered-prompt chips — pure detector requires ❯ cursor marker to disambiguate from prose

Picker last-seen + top-bar enrichment + image upload recovery

• Story J: Picker shows "Last seen Xm/Xh/Xd ago" per backend (new lastConnectedAt field)
• Story K: Top-bar 4-state pill (unpaired / connected / connecting / authFailed / stalled)
• Story L: Image-upload categorized error chip + recovery action (Reset / Pick window / Try another / Retry)

Diagnostic capture

• §26 Shake-to-diagnose — ShakeDetector + DiagnosticsSheet with frozen iPhone snapshot, copy + Request Mac bundle buttons

Test coverage

Suite	Start	End	Δ
QuipMac	256	298	+42
QuipiOS	195	275	+80
Combined	451	573	+122

All green across 13 new test files.

Why a squash + new branch

PR #29 blocked by hash-mismatch conflict from a git filter-repo redaction of historical commit 71af40e (device name leak). Per branch memory feedback_no_filter_repo_main_conflict.md, force-pushing main is permanently off the menu. This branch is the path-B/C alternative — fresh branch off current main with a single squash commit of all 49 ahead-of-main commits.

Closes PR #29 (please close manually when this lands).

Test plan

• CI builds both schemes
• Mac suite green
• iOS suite green
• Hardware: rebuild + reinstall iPhone + Mac, run punch list in docs/superpowers/handoffs/2026-05-06-session-handoff.md

🤖 Generated with Claude Code