Dead code (from the abandoned thumb-zone/Explore-sheet nav experiment):
- OasisMobile.css: removed ~90 lines of orphaned CSS (.oasis-bottombar-fork/.bb-fab-*,
.hive-sheet*/.fork-sheet*/.hsq-*, .omt-spacer, .hive-sheet-seg/.hs-seg, dead
.oasis-bottombar-fixed) — no element emits any of them.
- main_views.js: removed renderHiveSheet() (never called; sole emitter of that CSS).
- karvan_view.js: dropped dead export karvanShortId + unused karvanView param.
- Added a style for .karvan-msg-live (client emitted it with no rule).
Karvan security (from the review):
- GET /karvan/:id only adopts a mirror room on a real navigation (sec-fetch-dest
document / Accept text/html), not on <img>/subresources → fixes a CSRF that could
spam/evict the user's ephemeral rooms.
- Cap room.members at 50 (was unbounded; each poll echoed it back).
- Reject signal payloads >16KB (SDP/ICE are tiny) — anti memory-DoS.
- karvan.js: guard malformed {kind:desc} signals so one bad signal can't abort a poll batch.
Tests: 15/15 (added members-cap + oversized-payload). Verified: CSRF fix (nav=200,
subresource=302), pages unchanged after CSS removal, boot clean.
Reuses Oasis's own private-message invite pattern (like the industry module:
pmModel.sendMessage([feed], 'KARVAN_INVITE', '... -> /karvan/<id>')), so the invite
lands in the contact's inbox with a link — no new SSB code, no touching the SSB
startup. Joining a room by link adopts a local mirror (karvanModel.adoptRoom, the
id is the capability). Real-time cross-device signaling (media/text sync between
the two mirrors) is the remaining Fase 2 piece (muxrpc ephemeral), deferred.
Verified single-node: invite publishes to the inbox, validation, adopt, form; 13/13
model tests (added adoptRoom).
The hexagon hive was rendered in the header on EVERY page (~210px), pushing real
content far down on Peers/Market/Inbox/etc. Now a middleware flag
(__OASIS_SHOW_HIVE__ = path is /activity or /) gates renderHiveNav so the hive is
the home hub only; other pages get just the fixed topbar and their content up top.
Personal/Community and the bottombar still navigate everywhere.
Navigation fixes:
- The bottom "Explore" sheet no longer blocks the top bar: closed state is
visibility:hidden (out of hit-testing), so the top identity buttons and page
content always receive taps (fixes "top buttons don't work").
- Top bar is now identity only (logo, avatar). The Personal/Community filter
moved into the Explore sheet, next to the hive, as a segmented control.
New module "Karvan" (self-contained; inspired by karvan-protocol ephemeral rooms):
- Ephemeral/temporary chat rooms held only in RAM, self-destructing on idle
(30 min) / absolute (2 h) TTL — nothing is written to disk.
- Server relay chat (RAM + polling) as the reliable path, plus a WebRTC
data-channel layer (perfect negotiation, HTTP signaling mailbox) for instant
P2P delivery; degrades to the relay if WebRTC is unavailable. Data-channel
only (no camera/mic) so no wrapper permission changes are needed.
- Files: models/karvan_model.js, views/karvan_view.js, client/public/js/karvan.js;
routes /karvan* + karvanMod config + nav entry (network) + karvanTitle i18n (11 langs).
Additive and gated by OASIS_MOBILE / karvanMod; Linux and the UX_OASIS branch untouched.
- Topbar: single fixed line [logo][Personal][Community][avatar] in one dark
tone (#121212) with gold accents only; the hive hexagons scroll below it.
- Hive: Personal/Community filter the home hive from any page; opening a
category shows its modules as a 2x2 grid of square buttons (a lone odd
button is centered instead of left-aligned).
- Chats: per-message reply (?replyTo=), chat switcher strip and quote banner;
the message rate limit is lifted on mobile.
- Forums: optional subtopics (?topic=) with threaded rendering.
- Bottombar: fixed Inbox - PM - Write - Search - Graphos - Peers.
- Turn the header Personal/Community tabs into links to
/activity?hive=personal|community, so they work on every page (they take
you to the home and filter the hexagons), not only while already on
/activity — no more dead buttons off the home.
- Drop the "All" tab: entering shows all 10 categories; clicking a filter
that is already active toggles it off and shows all again.
- Filter the hive server-side (renderHiveNav reads the request filter set
by the middleware) instead of the CSS radio-hack, and drop the now-dead
half-filter CSS. Active tab is highlighted via the .active class.
renderMobileTopbar read global.__OASIS_SELF_AVATAR__, but nothing ever
set it, so the top-right circle always fell back to the default avatar
(noticeable in the start/welcome flow, where the profile card showed the
real picture but the topbar circle did not).
Populate the global in the throttled refresh middleware from
about.image(self): build /image/256/<blob> when a picture exists, else
leave it null so the topbar uses the default avatar.
Rebase onto upstream 0.9.0. Mobile topbar (logo->home, avatar->profile),
hexagon category nav (hive) and bottom bar; remove the six top-bar
buttons (inbox/pm/publish/search/graphos/peers) that cluttered the header.
Theme OasisMobileUX carries topbar/hexagon/bottombar styles.
- Selectable Oasis-Mobile-UX theme; mobile.css kept intact
- Hexagon category launcher on home (10 categories with expandable modules)
- Customizable bottom bar (up to 4 shortcuts, Peers/Invites fixed)
- Empty states and collapsible activity filters
