[ymote]

Apps can now ask for presentation full screen from the person's tap. This is for Quick Deck's Present and PDF Tools' Read mode, which until now could only fill their own window. It is built on #516's window full screen and adds what #516 doesn't have: an app-facing request, the host window's own full screen, Esc and a hint, and no edge reveal while an app presents.

Before: ⌘F and SetFullscreen in the desktop styles

Before #516, read from the code at c5e2eb3:

• ⌘F (WmAction::Fullscreen(FullscreenMode::Fullscreen)) only maximized the focused window, the same as ⌘⌥F. WmLayout::toggle_fullscreen_mode toggled DesktopWindow::maximized, so the window kept its title bar and stopped above the dock (Maximize and snaps end above a floating dock; honour a native window's requested size #487), and the bar and dock stayed. WmLayout::rects_of never read the workspace's fullscreen on a floating desk, and sync_bar_for_fullscreen read only the tiled state.
• WmRequest::SetFullscreen { fullscreen } focused the client, then compared fullscreen with the active workspace's tiled fullscreen_mode(), which is always None on a floating desk. So each true toggled the maximize (asking twice maximized, then restored), and false never applied.

#516 replaced both on a floating desk: a real full screen with edge reveal, and SetFullscreen checked against the window's own state. This PR doesn't touch either.

What this adds

window.fullscreen {on} is a host service in the shell (crates/shell/src/app_fullscreen.rs) for in-process card apps:

host.request("window.fullscreen", {on: true}, fn(r) {
    // r.is_ok: r.data is {applied, fullscreen, fills_screen}
})
fn on_app_fullscreen(on) { … }   // optional: called when full screen starts and when it ends

• The app's own window only. App::window_of finds the window whose Card runner runs the requesting isolate (Replier::isolate_key), for the requesting app. Anything else is refused not_a_window:: a glance card, a host sheet, another app's window.

• From a tap, by the app itself.

  • The window must have the focus, not be minimized, and be on the workspace in view. Otherwise the answer is foreground_required:.
  • A request without its surface's authority (ServiceCall::may_prompt false: an agent's tool call, or a callback of one) is refused agent_call:. No capability decides this; see "The prompt capability" below.
  • The person must have pressed the app's own content in that window in the last 5 s (gesture_required:). A press on a group tab, a stopped app's face, a host sheet over the app or a process tile doesn't count. A request that applies uses the press up, and so does any ending except the app's own {on: false}.
  • {on: false} needs none of these: an app can always give the screen back.

• On:

  • WmLayout::set_fullscreen puts that window in full screen. It is a new per-window setter: A window's full screen, as macOS's green button makes it #516's SUPER+F only toggles the focused window.
  • WmState::presentation keeps every edge from bringing out the bar, the title bar or the dock, as in a slideshow's play mode. That covers A window's full screen, as macOS's green button makes it #516's top and bottom reveals (App::desktop_pointer) and every style's dock or taskbar (desktop::dock_shows). The flag lives and ends with the presentation, and ⌘F full screen keeps A window's full screen, as macOS's green button makes it #516's edges.
  • The shell's window enters the host's full screen if it isn't there already. The OSD says "Press Esc to exit full screen" for 3 s, and the app's hook hears true.

• Off. These end it:

  • Esc, which the shell handles before the keymap and after its modal surfaces.
  • {on: false}.
  • ⌘F.
  • The window closing or losing the focus: another window, a workspace switch, or minimize.
  • The app's module failing (a panic). A presentation never carries over to another instance in the same window.
  • A switch to a phone style.
  • The person leaving the host's full screen.

  Everything goes back as it was. A window that was already full screen (⌘F) stays full screen. The host window leaves full screen only if this presentation entered it (HostFullscreen). If the host window is still entering when the presentation ends, its next report decides, up to 20 s later (PENDING_LEAVE_SECONDS): in, and it leaves; not in (a failed enter), and there is nothing to give back. After 20 s, whatever the window reports is the person's.

• Host full screen goes through maximize and restore. makepad's macOS backend ignores FullscreenWindow and NormalizeWindow, which is what Window::fullscreen and normal send. maximize and restore both send toggleFullScreen: there, so the shell asks the window to leave only while it reports full screen. A TODO marks where to switch once makepad makes fullscreen and normal real on macOS; that makepad fix is a follow-up. Elsewhere it is makepad's maximize, which is unverified.

• Hidden runs. With MAKEPAD_HIDE_WINDOWS set (launch_input::hidden_windows), the shell never asks the host window to go full screen: on macOS that could bring the hidden window onto the screen in a Space of its own.

• Phones (mobile styles) answer {applied: false, fullscreen: false, fills_screen: true} and change nothing. Every app already fills the screen, and the shell has no immersive mode.

The gesture finding

makepad's runtime cannot tell whether a host.request came from a person's tap:

• A SplashHostRequest carries only may_prompt, which says the surface is in the foreground and rules out agent tool calls, home tiles and their callbacks. A foreground app's own timer keeps may_prompt.
• Input provenance (trusted_user_input) covers only macOS HID pointers and Android touches. It holds during the native event's synchronous handler, but a Splash on_click runs later, from the widget-to-script queue (handle_script_tasks), outside it.

So, as agreed, the shell keeps a browser-like transient activation: a press on the app's own content in that window (MpRunViewAction::Pressed) within the last 5 s, plus focus and front, with Esc and the hint as the rest of the protection. Any press counts, remote and synthetic ones included, because a script app cannot create input. A makepad patch could make it exact by carrying trusted_user_input() from the native event into WidgetToScriptCallRequest and then SplashHostRequest. It would still be false on Windows and Linux.

The prompt capability

The review asked whether the API quietly needs the app's prompt capability. At App Hub 38635915 it doesn't, and now the shell no longer leans on a value that could:

• ServiceCall::may_prompt is the surface's authority, not the declaration. IsolateSettings::for_app gives every admitted app's window host_prompts: true, and the Card runner (cardapp.rs) lowers it only while the app is suspended (phones only) or one of its tool calls is pending: admitted_prompts && !app_suspended && !script_tools::pending_for(..). A callback keeps the authority of the request it answers. The declaration is AppPolicy::may_prompt, and nothing on a request's path reads it.
• Evidence: the hidden-shell probe app below declared only storage, and its requests applied. PDF Tools and Quick Deck don't declare prompt either.
• Admission no longer refuses on may_prompt. The shell's turn says which reason applies: foreground_required: for a window not in front, agent_call: for a request without its surface's authority, and neither for {on: false}.
• no_capability_decides_a_requests_authority resolves manifests with no capabilities, PDF Tools' and Quick Deck's, and prompt, and checks that each window gets the authority. An App Hub pin that tied it to a capability fails there first.

Not listed by runtime.list (App Hub follow-up)

api_methods() is empty: App Hub's HostApiMethod::validate requires a capability from KNOWN_CAPABILITIES, and none fits a window method. So runtime.list doesn't show window.fullscreen, and an app can't put it in host_api, but calling it needs no declaration. Making it discoverable needs a window capability in App Hub's contract, then a repin.

Review follow-ups (95214d9 and 18c1164)

The independent review of f1c98d5 found no critical or major issues. Its minor points and nits, fixed as a new commit:

1. An app could bounce back after Esc (minor). A presentation that ends any other way than the app's own {on: false} now drops the window's press (Presenter::finish). So a click that turned a slide, then Esc, then the app asking again from on_app_fullscreen(false) is refused gesture_required:. The app's own toggle keeps the press it was given, as a browser's exit does.
2. The prompt capability (minor). See "The prompt capability" above: the new refusal is agent_call:, and foreground_required: now says what "in front" means.
3. Only presses on the app's own content arm it (nit). MpModuleView sends the new MpRunViewAction::Pressed for a press on the module's live root with no host sheet up. It asks before the app sees the press, which may close the sheet. Group tabs, a stopped app's face and process tiles send only Clicked, which focuses.
4. A crashed app kept presenting (nit). The presentation now ends with Ending::Failed when the module fails. It records its instance (SplashVmId), so another instance in the window ends it too. A failed instance's window is no request's window.
5. A late macOS entry (nit). There is no fixed 3 s grace now. Once a presentation ends while the host window is entering, the window's next report decides: in, and it leaves; not in (macOS reports a failed enter), and there is nothing to give back. The re-check's nit (third commit, 18c1164): that pending leave could wait forever. A presentation that began while the window was still leaving the last full screen had its enter ignored by macOS, and the window's report of that leave came during the presentation. The leave then stayed pending until the person next entered full screen themselves, which the shell took out once. A pending leave now expires after 20 s (PENDING_LEAVE_SECONDS), and a new presentation after that asks to enter again (a_leave_waiting_for_an_enter_that_never_came_expires).
6. Nits. Requests that changed nothing, refusals among them, log one line per app every 10 s, with a count of the lines not written (QuietLog). host_window_reported ignores geometry changes of windows other than the shell's own.

Also, begin_presentation now ends another window's presentation that this event hasn't ended yet before it starts one.

Tests

From phone/, cargo test --locked --features mobile-apps -p octosense-shell, with OCTOSENSE_HOME, RINX_DATA_DIR and MAKEPAD_HIDE_WINDOWS=1:

• Linux build host, on this head (18c1164): 1302 passed, 0 failed, with MAKEPAD_SPLASH_BUDGET_MS=10000 as phone.yml sets it.
• On 95214d9: 1301 passed, 0 failed, the same way; python3 tools/setup.py --check --cargo passed.
• On the first commit (f1c98d5): 1297 passed, 0 failed, the same way. A run without that variable on the loaded host failed two module_resize_tests with script time budget exceeded, the known wall-clock flake; both pass when run alone.
• The pre-A window's full screen, as macOS's green button makes it #516 version of this work passed 1290/1290 on this Mac and 1293/1293 on Linux.

cargo check --locked -p octosense, Linux build host, 95214d9: passed. This Mac built -p octosense --no-default-features --features app-hub,craft-engines from 95214d9 plus the stacked PDF Tools commit, with no warnings from the shell.

New tests:

• app_fullscreen (19):
  • the request path: own window only, foreground, an agent's call, the press, on and off, the phone;
  • the activation window, and a_press_made_while_presenting_does_not_bring_it_back: the presses through a presentation as the shell wires them (Presenter). A press made while presenting, then each ending, then the app asking again is refused gesture_required; the app's own toggle keeps its press;
  • no_capability_decides_a_requests_authority (see "The prompt capability");
  • host bookkeeping: already full screen, entered then left, the person leaving, ended while still entering (in late, or a failed enter), a pending leave that expires, a new presentation while an enter is on its way, hidden windows;
  • the endings, including a closed window, another instance and a failed app;
  • the Esc path;
  • the quiet log: one line per app every 10 s, then the count.
• module_input_tests: every press assertion now also checks whose press counts (Asked::Press). A click or touch on the window in front never counts for the app behind it, and a stopped app's face counts for nothing. The new a_press_on_a_host_sheet_over_a_card_app_is_not_the_apps uses App Hub's real Card runner: a press on its host sheet raises the window and counts for nothing, and once the sheet is gone presses count again.
• layout: set_fullscreen_sets_a_named_window_and_a_closed_window_ends_it, clear_fullscreen_clears_both_desks.
• desktop: an_apps_presentation_keeps_the_dock_away.
• shell::osd: the_full_screen_hint_names_esc_and_goes_away.

Hidden-shell check on this Mac (13 Oct 2026, first commit)

These runs are on f1c98d5. The review follow-ups are covered by the tests above and haven't been re-run in a hidden shell yet.

What was run. Hidden desktop shells (MAKEPAD_HIDE_WINDOWS=1), started from a Terminal tab under the shared lock. Each used a scratch OCTOSENSE_HOME, OCTOS_APP_CORE_DIR, OCTOSENSE_APP_DATA, RINX_DATA_DIR and OCTOSENSE_LLM_VAULT=file, in the OctoSense style at 1400×899. They were driven over the remote and ended with /quit.

• The app was a scratch system app built in through OCTOSENSE_SYSTEM_APPS, never committed. It has Present, Leave and "Ask in 7 s" buttons, and asks once at startup with no tap.
• Rects come from /snap. The checks on bar, title bar and dock read pixels of /g grabs, which come from the app's drawable; no OS screenshots were taken.

Before, c5e2eb3 (6/6 checks):

• The app window is at [54,76,990,603].
• ⌘F maximized it to [12,76,1376,733] above the dock, keeping its title bar, the bar [0,0,1400,32] and the dock. ⌘F again restored [54,76,990,603].
• The app's request was answered no service answers "window" on this device.

This PR at f1c98d5, on main with #516 (25/25 checks):

• The startup request (no tap) was refused with gesture_required.
• ⌘F (A window's full screen, as macOS's green button makes it #516) covered the window [0,0,1400,899] with no bar, title bar or dock. The top edge brought the bar back, as the control for A window's full screen, as macOS's green button makes it #516's edges. ⌘F again restored [54,76,990,603] and the bar.
• A tap on Present answered {applied: true, fullscreen: true, fills_screen: true}, and the hook heard on_app_fullscreen(true).
  • The window covered [0,0,1400,899] with no bar, title bar or dock, and "Press Esc to exit full screen" showed in full.
  • With the pointer on the top edge, then the bottom edge, nothing came out.
  • The log says the host window was not asked to enter full screen, because the windows are hidden.
• Esc ended the presentation: the window went back to [54,76,990,603], the bar came back, and the hook heard false.
• Present then Leave ({on: false}) answered {applied: true, fullscreen: false} and restored the window.
• "Ask in 7 s" (a request 7 s after its tap) was refused with gesture_required.
• Present then ⌘F ended the presentation (Uncovered).
• Present then ⌘W ended it (Closed), and the bar came back.
• The shell log has no panic.

What a hidden run cannot show:

• macOS actually entering and leaving full screen. A hidden run never asks the host window, on purpose; only the bookkeeping was exercised, in unit tests.
• Windows and Linux. Whether makepad's maximize gives a presentation room on those systems is untested.
• A real tap's timing. The presses here came from the remote. Only the transient-activation rule was checked: a press counts, and one 7 s old doesn't.

Unverified

• Entering and leaving macOS's full screen on a real display: hidden runs never ask the host window, by design.
• Makepad's maximize on Windows and Linux.
• Apps using it: PDF Tools' Read mode is wired in PDF Tools: Read mode takes the screen (window.fullscreen) #522, stacked on this PR, with a passing Linux hidden-shell run. Quick Deck's Present comes after Quick Deck: play a deck's video and audio #518.

What App Flow's docs/SCRIPT-API.md needs (separate repo, not edited here)

• Under Host services, window.fullscreen {on}:
  • call it from a tap or click handler;
  • the answer is {applied, fullscreen, fills_screen};
  • refusals start with gesture_required:, foreground_required:, agent_call:, not_a_window: or invalid_arguments:;
  • after Esc (or any ending but the app's own {on: false}) asking again needs a new press;
  • Esc is the shell's, and no edge reveal happens while the app presents;
  • a phone changes nothing;
  • card-host answers no service answers "window" on this device;
  • runtime.describe reports it as not implemented until App Hub knows a window capability.
• A place for host-called hooks: on_app_fullscreen(on) beside on_app_resize(width, height), which SCRIPT-API doesn't list either.
• HOST-SERVICES: which shell serves window (the desktop shell; Home answers without changing anything).

🤖 Generated with Claude Code

[ymote]

macOS checks on this head (18c1164)

• Hidden shell, the review follow-ups' probe (rev): 28 of 28 checks pass.

  • ⌘F covers the desk and gives it back.
  • A tap's presentation covers the desk, and no screen edge brings out the bar, title bar or dock.
  • Esc, the app's own {on: false}, ⌘F and closing each end it and put the window back exactly.
  • A late request (press older than 5 s) is refused.
  • After Esc, the app asking again from its hook is refused, and the window stays back.

  A first run failed 5 exact-rect checks. Its baseline was measured during the window's opening animation on a loaded Mac, so it was 1 point short on every side. With the driver waiting for the window to settle, every rect matched.

• Visible window, 13 Oct, with the maintainer at the keys (the PDF Tools: Read mode takes the screen (window.fullscreen) #522 build on this head). PDF Tools' Read mode put the real macOS window into full screen twice. Each time the window reported full screen before the presentation ended (first by the app's own exit, then by Esc), and the shell then took the window back out.

• Crash in that session. It aborted about 20 minutes later, when Quick Deck was opened. That is shell: find the bar's strip as the body's own child, not by name (fixes Quick Deck crash after #516) #519's crash: since A window's full screen, as macOS's green button makes it #516, the bar lookup finds Quick Deck's bar. This branch doesn't touch it.

The gate comes in queue order after #519 and #513, with main merged in first.

[ymote]

Local CI passed on 3023c13 (tools/ci-local.sh --only all --linux-host --offload, 120m16s, Darwin arm64; the ubuntu jobs and the macOS jobs' portable steps (their macOS steps ran here) on the Linux build host, Linux x86_64).

GitHub would run for this PR: desktop.yml, phone.yml, apps.yml. Merged on this local pass (macOS runner queue); GitHub CI runs on the merge commit on main.

Job	Step	Result	Time
ci-local / drift	The local mapping fits the workflows	PASS	-
desktop.yml / desktop	Prepare the pinned framework sources	PASS	1s
desktop.yml / desktop (linux)	Prepare the pinned framework sources	PASS	1s
desktop.yml / desktop (linux)	One copy of every shell source	PASS	-
desktop.yml / desktop (linux)	In-app updater and installer handoff	PASS	1m42s
desktop.yml / desktop (linux)	One Makepad, App Hub, octos and Rinx in the locked graph	PASS	2s
desktop.yml / desktop (linux)	The native apps' generated places match native-apps.json	PASS	0s
desktop.yml / desktop	Compile the desktop with the shared runtime	PASS	20m18s
desktop.yml / desktop	Desktop tools and scripts	PASS	34s
desktop.yml / native-host-api	Prepare the pinned framework sources	PASS	1s
desktop.yml / native-host-api	Build the native acceptance host and pinned Hub CLI	PASS	83m46s
desktop.yml / native-host-api	Signed app tool calls a real OS permission API	PASS	7s
phone.yml / home (linux)	Prepare pinned sources and the reviewed runtime patch	PASS	0s
phone.yml / home (linux)	Verify the single runtime graph	PASS	2s
phone.yml / home (linux)	The native apps' generated places match native-apps.json	PASS	0s
phone.yml / home (linux)	The pinned octos revision	PASS	0s
phone.yml / home (linux)	Build octos (unless cached)	PASS	-
phone.yml / home (linux)	Build Home, App Hub admission and runtime policy tests	PASS	3m27s
phone.yml / home (linux)	Test Home, App Hub admission and runtime policy	PASS	42s
phone.yml / home (linux)	Two-lane scenario (real kernel, scripted model)	PASS	27s
phone.yml / home (linux)	Build opt-in AppCard tests	PASS	2m46s
phone.yml / home (linux)	Test opt-in AppCard	PASS	1s
phone.yml / home (linux)	Build craft-engine relay and system-chat tests	PASS	2m50s
phone.yml / home (linux)	Test craft-engine relay and system chat	PASS	13s
phone.yml / home (linux)	Build linked Terminal tests	PASS	2m26s
phone.yml / home (linux)	Test linked Terminal	PASS	1s
phone.yml / home (linux)	Build Wasm and runtime policy tests	PASS	1m15s
phone.yml / home (linux)	Test Wasm and runtime policy	PASS	11s
phone.yml / home	Prepare pinned sources and the reviewed runtime patch	PASS	2s
phone.yml / home	Validate launcher icons and Apple asset catalogs	PASS	12s
phone.yml / home	Compile Home and its bundled modules	PASS	15m12s
apps.yml / services (linux)	python3 tools/setup.py	PASS	0s
apps.yml / services (linux)	Shared system app interface	PASS	0s
apps.yml / services (linux)	Kernel service	PASS	18s
apps.yml / services (linux)	OctoSense release updater	PASS	6s
apps.yml / services (linux)	App peers	PASS	29s
apps.yml / services (linux)	AI providers config	PASS	5s
apps.yml / services (linux)	Connected provider protocols and Linux host adapter	PASS	46s
apps.yml / services (linux)	L0 in-card chat (sys.chat, host side)	PASS	10s
apps.yml / services (linux)	System toolbox (workflow templates)	PASS	1m29s
apps.yml / kernel-security (linux)	python3 tools/setup.py	PASS	0s
apps.yml / kernel-security (linux)	The pinned octos revision	PASS	0s
apps.yml / kernel-security (linux)	Build octos (unless cached)	PASS	-
apps.yml / kernel-security (linux)	Real-kernel tests	PASS	40s
apps.yml / apps (linux)	python3 tools/setup.py	PASS	0s
apps.yml / apps (linux)	Host services (Mail, AI providers, News)	PASS	2m04s
apps.yml / apps (linux)	Connected accounts and Rinx editor	PASS	1m32s
apps.yml / apps (linux)	Shell AI services (crates/ai-host)	PASS	2m55s
apps.yml / apps (linux)	AppCard runtime setup safeguards	PASS	0s
apps.yml / apps (linux)	AppCard clippy (own crates; shared runtime compiles)	PASS	27s
apps.yml / apps (linux)	AppCard transport and store	PASS	7s
apps.yml / apps (linux)	One Makepad, App Hub, octos and Rinx in the locked graph	PASS	2s
rom.yml / product (linux)	python3 -m unittest discover -s tests -v	SKIPPED (!)	-
rom.yml / product (linux)	Check generated Agent Binder client	SKIPPED (!)	-
rom.yml / product (linux)	bash -n scripts/stage-forks.sh scripts/publish-release.sh scripts/apply-to-tree.sh scripts/build-rom.sh	PASS	-
rom.yml / web-installer (linux)	npm ci --ignore-scripts --no-audit --no-fund	SKIPPED (!)	-
rom.yml / web-installer (linux)	npm test	SKIPPED (!)	-
rom.yml / web-installer (linux)	npx playwright install --with-deps chromium	SKIPPED (!)	-
rom.yml / web-installer (linux)	npm run test:browser	SKIPPED (!)	-
rom.yml / web-installer (linux)	python3 -m unittest discover -s tests -p test_installer_manifest.py -v	SKIPPED (!)	-
rom.yml / web-installer (linux)	bash -n scripts/release.sh	SKIPPED (!)	-
linux-host / sandbox (linux)	python3 tools/setup.py	PASS	0s
linux-host / sandbox (linux)	Process sandbox on Linux (Landlock, seccomp)	PASS	1m48s

Skipped (these did NOT pass; (!) marks a skip that blocks tools/ci-local-merge.sh):

• rom.yml / product (linux): python3 -m unittest discover -s tests -v: javac -version does not work here: install a JDK (17 or newer) and put its bin/ on PATH or set JAVA_HOME
• rom.yml / product (linux): Check generated Agent Binder client: needs build-tools/35.0.0/aidl, platforms/android-35/framework.aidl in the Android SDK (no Android SDK found): install the SDK packages 'build-tools;35.0.0' and 'platforms;android-35' (sdkmanager) and set ANDROID_HOME
• rom.yml / web-installer (linux): npm ci --ignore-scripts --no-audit --no-fund: no node, npm, npx on PATH (the workflow uses node 24); put node on PATH
• rom.yml / web-installer (linux): npm test: no node, npm, npx on PATH (the workflow uses node 24); put node on PATH
• rom.yml / web-installer (linux): npx playwright install --with-deps chromium: no node, npm, npx on PATH (the workflow uses node 24); put node on PATH
• rom.yml / web-installer (linux): npm run test:browser: no node, npm, npx on PATH (the workflow uses node 24); put node on PATH
• rom.yml / web-installer (linux): python3 -m unittest discover -s tests -p test_installer_manifest.py -v: no node, npm, npx on PATH (the workflow uses node 24); put node on PATH
• rom.yml / web-installer (linux): bash -n scripts/release.sh: no node, npm, npx on PATH (the workflow uses node 24); put node on PATH

Notes:

• GitHub runs Python 3.12; this run used Python 3.9.6
• GitHub runs Python 3.12; the Linux host used Python 3.14.4