Expose OpenID tokens and homeserver credentials from the client proxy, and
add fork-only services for the HealthChat member directory backend
(api.healthchat.ch) plus a service that reads MSC4133 extended profile
fields directly from the homeserver. Groundwork for the members tab and
the profile screens.
Claude-Session: https://claude.ai/code/session_013qdTbAWsZj2quQzEkagXaS
The call package now says why a call ended. Only our own hang-up is an
end call action; a call the other side declined or left, that nobody
answered, or that failed is reported to CallKit with that reason, so the
call log no longer shows it as one we ended, and no end action comes back
to hang up a call that is already over.
Also adopts the package's other host changes: the voice call icon beside
"Calling…", and the call's large avatar rendered at the 140 pt it is
drawn at.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Store the notifications switch per account
Adds AccountSettings.enableNotifications and moves the app-wide value into the signed in accounts before they're restored: the first account takes it out of the app settings and the others get the same switch, so someone who turned notifications off keeps them off.
* Add a notification service to every user session
Each account's NotificationService sets its pusher when its notifications are on and deletes it when they're off (appending with multiple accounts), keeps the account's unread count and decides which of its delivered notifications to clear. It asks the NotificationManager, the only owner of the notification center, through actions: remove the notifications matching a rule, request authorization and the unread count. The UserSessionManager connects every live session's service to the manager, and flows and screens use the session's service instead of the manager, which leaves the flow parameters.
* Route notifications by account
Taps only open rooms of the active account for now, a tap made while restoring only opens once its account is the active one, replies are sent from the account they were made for, and signing out only clears that account's notifications unless it was the last one. The notification extension hides pushes for an account that signed out while other accounts are still signed in.
* Turn notifications on and off for each account
The notification settings switch is now saved per account, and each account's NotificationService sets or deletes its pusher when it changes, asking for permission when it's turned on.
* Apply review suggestions to multi-account notifications
Migration
- Move the notifications switch with a single per-account migration, like 26.10.1 and 26.10.2, and drop its dedicated test.
Notification manager and service
- Follow each account's badge count publisher directly, removing the badge count action and the stored counts.
- Only reset the badge and unregister from APNs when the last account signs out, as each account already clears its own notifications.
- Set up the service's subscriptions in a single setupSubscriptions().
- Rename switchChanged(to:) to enableNotificationsChanged(to:) and pusherConfiguration(identifiers:) to pusherConfiguration(for:).
- Build the service without hopping to the main actor, it already runs there.
Notification service extension
- Check the account's switch in NotificationHandler using the session's settings, and log an error when a push arrives for an account that's turned off.
- Always show pushes that match no signed-in account and log an error, so a broken setup stays visible.
Other
- Store a pending inline reply in a PendingInlineReplyDetails struct.
- Assign the chats tab badge with weakAssign.
- Make PusherConfiguration Equatable so the pusher test checks it in one expectation.
- Clarify the comment about notifications without a receiver.
* Print instead of logging before the app hooks run in the NSE
A push that matches no signed-in account goes back to printing, as MXLog shouldn't be used before the app hooks have run. The push is still shown so a broken setup stays visible.
* Add a UserHooks system with just the CreateRoomScreenHook for now.
* Move more hooks into UserHooks.
* Pass the ClientProxy to makeUserHooks instead of calling AppHooks.configure(with:).
* Update the Enterprise submodule.
* Keep every signed-in account live
With the multi-account flag on, the accounts other than the active one are now
restored at launch, one after the other once the active account's UI is up.
They run their migrations, sync while the app is active, get a pusher (appended
so accounts on the same homeserver keep each other's) and count towards the app
badge, and background refresh and search backfill cover them too. Only the
active account's remote settings are ever applied.
Calls stay with the active account until the call service handles every account,
and an auth error on another account is only logged until accounts can be signed
out one at a time. With the flag off only the active account is live, as before.
* Sum the app badge across every signed in account
Each live account now reports its own unread count, and the app badge
shows their sum. Delivered notifications are only cleared for the
account whose rooms were read, so a room shared by two accounts keeps
the other account's notifications.
The room list observer for the badge and the notifications moves from
the UserSessionFlowCoordinator to the AppCoordinator's per-account
wiring. The flow keeps updating the chats tab badge.
* Let the user session manager manage every session
- The AppCoordinator tells the manager to pause, resume, go offline or
run the search backfill, instead of looping over the sessions itself.
- The manager also restores the other accounts, preparing each with the
AppCoordinator's migrations and wiring, and resumes them while the
services are running. With a single account nothing changes.
- Wiring an account again (e.g. after clearing the cache) replaces its
observers rather than adding to them.
- Add addAccountFlowEnabled, a developer-only switch for the upcoming
add account flow. It isn't a user preference, so testers enabling
multi-account can't add a second account yet.
* Apply review suggestions to keeping every account live
- Move the notification changes (pushers for every account, the summed
app badge and per-account clearing) to their own PR, so notifications
follow the active account again for now.
- Revert loading only the active account's remote settings: they load in
the store again, as on develop, until the hooks are reworked.
- The user session manager reports the auth errors of every live session,
so the AppCoordinator subscribes once instead of keeping per-account
observers.
- Restoring a single account is private to the manager now.
- Rename otherSessionsRestoreTask to otherSessionsRestorationTask.
* Restore every signed in account through one path
The user session manager now restores every account in a single pass,
most recently selected first, instead of separate restores for the
active account and the others. The AppCoordinator shows the first
account that comes back and no longer reads the multi-account flag:
without it, the manager only ever makes one account live.
- Clearing the cache clears every live account, and the next pass
replaces their sessions.
- Each account is migrated once per launch, and an account that just
signed in is never migrated.
- A pass also runs after signing in, so the other accounts come live.
- Remove UserSessionManagerError, restoreActiveSession and
restoreOtherSessions.
* Only clear the cache of the active account
Clearing the cache goes back to clearing the account shown in the UI.
Its session stays live until the next restore pass replaces it, and when
that restore fails another live account becomes the active one.
* Apply review suggestions to restoring every account
- Remove the search backfill guard: with no sessions the manager starts
nothing and reports that nothing is running, so the task completes.
- Add a TODO to switch to the most recently used account when the
active one signs out while others are signed in (element-meta#3325).
- Disable SwiftLint's type_body_length on the AppCoordinator again, it's
just over the limit with develop's new migrations.
* Remove the now unused setting to disable in-app notifications.
* Move visible account settings into AccountSettings.
Have ignored enableNotifications for now as that will require reworking the NotificationManager.
* Allow different sounds to be selected for each account.
* Move defaultNotificationTone into AccountSettings.
Sign-in now creates and stores its session through the
UserSessionManagerProtocol rather than the UserSessionStore, so the
AppCoordinator no longer holds the store.
- The manager forwards clientSessionDelegate and
userSession(for:sessionDirectories:passphrase:) to its store. As with
restoring, the new session isn't registered until the AppCoordinator
adds it.
- AuthenticationService takes the manager, for both sign-in and soft
logout.
- The store mock's configuration moves to the manager mock.
The sync update action is sent from the room list service state listener,
which fires before the SDK has applied the new unread counts, leaving the
app badge one sync behind. Drive both the badge and the clearing of
delivered notifications for fully read rooms from the room list publisher
instead, moving the observer from the ChatsTabFlowCoordinator into the
UserSessionFlowCoordinator.
The NotificationManager now receives the badge count from the caller so the
same value can be reused elsewhere.
* Suggest recently visited rooms when forwarding messages
The Forward to screen now shows up to 5 recently visited rooms in a
Suggestions section, above a Chats section that lists every room. The
suggestions are never searched: while searching, only the Chats section
is shown and filtered. The source room, invites, spaces and upgraded
rooms are never suggested, and the section is hidden when there is
nothing to suggest.
The suggestions are resolved from the room summaries rather than room
proxies, so they show up without holding back the list, and they are
re-resolved as the room list loads after a cold start. ClientProxy now
exposes the recently visited room IDs for this.
The recently visited rooms filter is now async, so callers choose its
isolation instead of asserting it at runtime.
* Apply review suggestions to the forwarding suggestions
Rooms:
- Each room is listed once. Suggested rooms are left out of Chats unless
searching, where Chats lists every result. This also removes the
duplicated row whose selection changed without the tapped row's
animation.
- The Chats header is hidden when the section has no rooms.
Suggestions:
- Resolve them once when the screen opens instead of on every room list
update.
Remove some redundant injections when passed alongside a user session too.
# Conflicts:
# ElementX/Sources/Screens/PinnedEventsTimelineScreen/View/PinnedEventsTimelineScreen.swift
# ElementX/Sources/Screens/Timeline/TimelineViewModel.swift
Add the element-call-ios dependency and a developer option for native calls
The package carries the call UI and the matrix-rust-rtc media stack, pinned by
exact version the way the SDK is, with the local path kept commented out for
working against a checkout. Its media xcframework has no Intel simulator slice
and a package cannot say so for the projects that consume it, hence the
excluded architecture at the project level.
The developer option is off by default and nothing reads it yet. It is placed
next to the Element Call URL override, which only applies to the web view that
native calls replace.
* Add an AccountProvider type and use it within AppSettings.
* Use the AccountProvider type within the Authentication flow too.
* Fix unit test compilation with Swift 6.4
* Make sure defaultAccountProvider takes allowOtherAccountProviders into account.
* Document a caveat on using AuthenticationService.homeserver.value.accountProvider.
* remove the usage of the timeline kind override in favour of getting it properly from the timeline view model
* allow the previews to include gallery items filtered by the allowed types when started outside the gallery
sss
asa
* fix for actions not being forwarded to the timeline right
* pr suggestions
* Report user presence on app lifecycle transitions
Adds a PresenceReporter driven by the app lifecycle handlers and the sharePresence setting: online when foreground-active and sharing, unavailable when backgrounded and sharing, offline when not sharing. Sends are immediate, deduped, and serialized latest-wins. Background app refresh and the NSE seed the process presence to offline so their sync requests carry no presence side effect. Presence rides on the SDK's process-global state, so every sync path is covered without touching sync lifecycle.
Signed-off-by: Jared L <48422312+lhjt@users.noreply.github.com>
* Add presence reporter tests
Pins the presence reporter invariants: the never-online sweep with sharing off, an immediate online send on foreground-active, dedupe of repeated states, latest-wins ordering of serialized sends, and the NSE offline seed.
Signed-off-by: Jared L <48422312+lhjt@users.noreply.github.com>
* wip: address review comments
Signed-off-by: Jared L <48422312+lhjt@users.noreply.github.com>
* refactor: remove obsolete presence heartbeat
Remove the shared activity snapshot, heartbeat refresh, and notification-extension freshness policy while retaining the session-scoped presence service and its serialized lifecycle reporting. Restore the NSE's intermediate one-time offline seed so the cleanup remains buildable ahead of the final sync-presence correction.
Signed-off-by: Jared L <48422312+lhjt@users.noreply.github.com>
* fix: make notification extension presence-neutral
Configure the built NSE client with offline sync presence without sending an immediate presence update. Keep notification setup non-fatal when presence configuration fails and remove the temporary production test seam.
Signed-off-by: Jared L <48422312+lhjt@users.noreply.github.com>
* chore: restore application lifecycle logging
Restore the pre-existing foreground lifecycle diagnostics that were removed during the presence refactor. Keep presence reporting session-scoped and clarify that background refresh configures the client's sync presence without an immediate update.
Signed-off-by: Jared L <48422312+lhjt@users.noreply.github.com>
---------
Signed-off-by: Jared L <48422312+lhjt@users.noreply.github.com>
* Update the SDK and hook up the status from Room Heroes.
Also start requesting profiles via sss when the feature flag is enabled.
* Add support for subscribing to your own profile.
dds sending of multi-media "gallery" messages, gated behind the new galleryEnabled developer option (Developer Options → Room, off by default). Rendering of received galleries ships in a separate PR.
Wires sendGallery through TimelineProxy/TimelineController onto the SDK's Timeline.sendGallery.
MediaUploadPreviewScreen sends selected items as one gallery when the flag is on.
Co-authored with the original author of #5601.
NOTE: This PR allows to send gallery messages, but they won't be rendered without the gallery timeline item PR.
Adds the ability to send a gallery message (multiple attachments in one message)
via the media upload preview, wired through the timeline controller/proxy to the
SDK's sendGallery. Gated by a `galleryEnabled` developer flag (default off),
matching Element X Android — with the flag off, attachments are sent as
individual messages as before.
Extends the community PR #5601, rebased onto develop. Tracking:
element-hq/element-meta#3201
Co-authored-by: svetoslav.mitov <svetoslav.mitov@sportinno.com>
Adds the ability to send a gallery message (multiple attachments in one message)
via the media upload preview, wired through the timeline controller/proxy to the
SDK's sendGallery. Gated by a `galleryEnabled` developer flag (default off),
matching Element X Android — with the flag off, attachments are sent as
individual messages as before.
Extends the community PR #5601, rebased onto develop. Tracking:
element-hq/element-meta#3201
Co-authored-by: svetoslav.mitov <svetoslav.mitov@sportinno.com>
* Update the SDK and handle API breaks.
* Rename sdkUserThing to rustUserThing for consistency.
* Add user status ClientProxy methods.
* Rename UserStatus.UserSet to UserStatus.Raw.
Split global search into Rooms and Messages tabs. The Messages tab lists
matching events with the room's name and avatar, a sender-prefixed preview,
rich media (image/video/audio/file) previews, and a loading indicator, then
paginates as you scroll. Queries are debounced and the previous one is
superseded so late results can't clobber a newer search.
* implemented the content scanner service with caching and a way to use in the state store context
* fix swiftformat comment enforcing
* pr suggestions
homeserverReachabilityPublisher now reports unreachable while suspended so media loading parks instead of failing against a closed store. The reachability banner was keyed off the same publisher, so pausing the client would surface a spurious "Server unreachable" message.
Expose a separate homeserverConnectivityPublisher derived from the sync service state alone (it stays reachable while suspended) and key the banner off that, keeping the suspend-aware publisher for gating work that needs an open store.
* Add a developer flag for the search tab
Introduces a globalSearchEnabled user preference (off by default) with a toggle in Developer Options, used to gate the new search experience.
* Support search role tabs in the tab coordinator
Migrates the NavigationTabCoordinator to SwiftUI's value-based Tab API and adds an isSearch option so a tab can adopt the iOS 26 .search role, which detaches it into the trailing search button in the tab bar.
* Moves room search to a new screen
Adds a new screen that filters the alternate room summary provider as you type, shows an empty state, and lists matching rooms with their matrix identifier. Supports hardware keyboard selection (arrow keys to move through results, return to open) by reaching into the system search field.
* Present search in a dedicated tab
Adds the search tab to the chats flow on iOS 26 when the flag is enabled, rendered as the detached .search role button. The Cmd+K shortcut now selects this tab, and the home screen's inline search is hidden while the tab is available.
* Remove the old global search screen
The dedicated search tab replaces the Cmd+K floating window, so the GlobalSearchScreen, its window plumbing in the WindowManager, and its presentation in the chats flow are all removed.
* Enable Swift 6.2 with default main actor isolation for the app target
Turn on SWIFT_VERSION 6.2, SWIFT_APPROACHABLE_CONCURRENCY and SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor for the ElementX target, matching the NSE and Share Extension (which already use 6.2 without the main actor default).
# Conflicts:
# ElementX.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
* Update the code generation templates for Swift 6
Emit nonisolated/@unchecked Sendable mocks and nonisolated string enums, and mark async mock methods @concurrent so they keep suspending like the real implementations (otherwise intermediate states are unobservable in tests). Includes the regenerated mocks and strings.
# Conflicts:
# ElementX/Sources/Mocks/Generated/GeneratedMocks.swift
* Make the data layer and services nonisolated and Sendable
Annotate the value-type models, Rust SDK proxy wrappers, timeline item graph, settings, logging and NSE-shared types as nonisolated, and conform the service protocols to Sendable so their existentials can cross isolation boundaries. These types run off the main actor and no longer inherit the target's default main actor isolation.
* Adopt the new isolation across call sites, mocks and signatures
Update call sites, closure signatures and mock configuration helpers to match the nonisolated/Sendable data layer, including the main actor isolated mock inits and the @Sendable filter on recentlyVisitedRooms.
^ Conflicts:
^ ElementX/Sources/Services/SecureBackup/SecureBackupController.swift
* Remove redundant @MainActor annotations
With the app target defaulting to main actor isolation, the explicit @MainActor on view models, coordinators, views and their protocols is no longer required.
* Fix concurrency hotspots surfaced by the migration
Resolve the room summary main-thread deadlock by moving diff processing onto AsyncStreams, add the SDKListener.onMainActor FIFO bridge for SDK callbacks, hop KVO/timer/UIKit callbacks to the main actor via assumeIsolated, add isolated deinits, and apply the few justified nonisolated(unsafe) escapes for queue-confined Apple APIs.
* Fix the unit tests for Swift 6 concurrency
Hop the waitForConfirmation body onto the caller's actor (Swift Testing runs confirmation closures off-actor), and adjust the affected suites and async signatures.
* offload diffs on concurrent threads instead of main actor
* make room info protocols sendable
* use a task group for fetching data so that everything runs concurrently in the TextRoomTimelineView when getting the preview.
* use the generic onMainActor implementation, which already makes a stream and send the continuation on the main actor.
* small pr comments issues being addressed
* update enterprise
* Update StaticCode to 1.1.0 and specify the required Swift isolation.
* fix ElementCallServiceTests
* update enterprise
* re-generate mocks
* update enterprise
* enterprise new code conformed to swift 6
---------
Co-authored-by: Doug <douglase@element.io>
update generateRecoveryKey to take a passphrase option
Wire up AppHooks with recovery key hook
Update xcodeproj
Review fixups
Review fixups
Make the `SecureBackupRecoveryState.viewMode` extension private
Bump the enterprise submodule
`pauseServices` took a completion block only because it was historically
called from `deinit`, which can't await (the SE-0371 note). `deinit` now
stops the sync itself, so the sole remaining caller is the AppCoordinator,
which can await instead.
Make `pauseServices` async and update the AppCoordinator background-task
and lifecycle call sites to await it, calling the OS-facing completions
(endBackgroundTask / setTaskCompleted) afterwards. This also removes the
`MainActor.assumeIsolated` workaround — awaiting a @MainActor method hops
onto the main actor cleanly — and fixes a latent bug where a nil `self` in
the background app refresh expiration handler would skip setTaskCompleted.
joel.poyet
Valere
Mauro
Doug
Stefan Ceriu
Mauro Romito
Doug
Valere Fedronic
Jared L
svetoslav-sportinno
Michael