From c19c02f22fe4d434e823af93bb397e0bce91711c Mon Sep 17 00:00:00 2001 From: Simon Hamp Date: Mon, 19 Oct 2026 13:45:50 +0100 Subject: [PATCH 1/2] Explain trying the app with Jump, and bring the README up to date Adds a short list of what's in the app, and a Jump section up front: clone, composer setup, php artisan native:jump, scan the QR code. Without plugin credentials Jump needs DEVNULL_KEY_STORE=file, since a real phone won't make a key without Secure Storage. The API section said #130 wasn't merged. It is, so the app talks to dev-null.sh by default, and the section now lists the endpoints still in review upstream. Also documents DEVNULL_APPLE_SIGN_IN and stops naming an App ID that doesn't match .env.example. Co-Authored-By: Claude Opus 5.5 --- README.md | 72 +++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 57 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index 79bfe9a..1fa2b42 100644 --- a/README.md +++ b/README.md @@ -2,29 +2,50 @@ A native iOS and Android app for [devnull](https://dev-null.sh), the social network for developers drawn as a git log. It's built with [NativePHP Mobile](https://nativephp.com) v4, so the UI is fully native and the app logic is Laravel. -## How signing in works +## What's in it -There are no passwords or tokens. On first launch the app makes its own ed25519 SSH key and keeps the secret half in the Keychain. Every request to devnull is signed with it. +- The Following, Latest and Trending logs, drawn as a git graph with each author in their lane colour, and a pill for new commits. +- Commits with their threads, polls, quotes, link previews and images. +- Committing, replying and quoting from a sheet, with drafts kept the way the web's stash keeps them. +- Starring, saving, reporting, and pastéis mode. +- Notifications, grouped and filtered as on the web. +- Profiles with activity, streaks, achievements, pinned commits, and follower and following lists. +- Muting and blocking, your account settings, and your lane colour. +- Signing in with GitHub, or with an Apple ID you've linked. -Sign in with GitHub opens dev-null.sh in the system's sign-in browser, which shares Safari's cookies, so if you're already signed in there you only tap Approve. dev-null.sh approves this phone's key for your account and sends the browser back to `devnull://auth/callback` with a code. The app trades the code for your account with a signed request, using PKCE to prove it started the sign-in. +## Try it on your phone with Jump -On iOS you can also link an Apple ID from this device, under your profile. After that, Sign in with Apple on a new phone gets you into the same account. It never makes one: a devnull account is always a GitHub one, so an Apple ID nobody has linked gets a message saying to sign in with GitHub first. It comes from [codingwithrk/nativephp-social-auth](https://github.com/codingwithrk/nativephp-social-auth), which hashes the app's nonce for Apple, and the app asks Apple for no name or email. +The quickest way to run the app is [Jump](https://bifrost.nativephp.com/jump), NativePHP's free app for running a project on your phone without Xcode or Android Studio. -## The API +1. Install Jump on your iPhone or Android phone. +2. Clone this repo and set it up: + + ```sh + git clone https://github.com/NativePHP/dev-null-app.git + cd dev-null-app + composer setup + ``` + +3. Start Jump's server, then scan the QR code it shows with Jump. Your phone and your computer need to be on the same Wi-Fi. -The app talks to the signed `/api/v1` from [nunomaduro/dev-null.sh#130](https://github.com/nunomaduro/dev-null.sh/pull/130), which isn't merged yet. Until it is, point the app at a devnull instance running that branch. + ```sh + php artisan native:jump + ``` -To make that instance work with the app on your phone, create a tunnel (ngrok, Cloudflare etc) and set the `DEVNULL_URL` .env key to that URL before compiling the app. +`composer setup` needs NativePHP plugin credentials for the Secure Storage plugin. If you don't have them, run `composer setup:free` instead (see [Without plugin credentials](#without-plugin-credentials)) and add `DEVNULL_KEY_STORE=file` to `.env`. Otherwise the app won't make its key on a real phone. -## Setup +## Building it yourself Clone the repo and: ```sh cd dev-null-app composer setup +php artisan native:run ``` +If CocoaPods fails with "Unicode Normalization not appropriate for ASCII-8BIT", run it with `LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8`. + `nativephp/mobile-secure-storage` is a paid plugin from `plugins.nativephp.com`, so `composer install` needs your NativePHP plugin credentials. See below if you don't have access to the plugin. For now the app tracks unreleased branches, which Composer pulls straight from GitHub: @@ -55,21 +76,42 @@ COMPOSER=composer.free.json php artisan native:run ios Without the plugin, the app keeps its key in a file encrypted with `APP_KEY` instead of in the Keychain. That's fine for a simulator, but don't ship it. On a real phone the app works this out for itself and refuses to make a key. `DEVNULL_KEY_STORE` (`keychain` or `file`) overrides the choice, so `file` makes it use the file on a phone too. +### Configuration + These can be set in `.env`: -- `DEVNULL_URL` is the devnull instance to talk to. It defaults to production. +- `DEVNULL_URL` is the devnull instance to talk to. It defaults to production, https://dev-null.sh. - `NATIVEPHP_DEEPLINK_SCHEME` must be `devnull`, as in `.env.example`. NativePHP registers the scheme from it at build time, and its sign-in browser reads it from the bundled `.env` to know when dev-null.sh has sent the browser back. +- `DEVNULL_APPLE_SIGN_IN=false` hides Sign in with Apple, for a build whose App ID doesn't have the capability yet. - `GOOGLE_SERVER_CLIENT_ID`, `GOOGLE_IOS_CLIENT_ID` and `GOOGLE_IOS_REVERSED_CLIENT_ID` belong to the social-auth plugin's Google Sign-In, which the app doesn't use. NativePHP won't build without the first, so keep the placeholders from `.env.example`. -A production build for a real iPhone needs an explicit App ID (`com.nativephp.devnull`) with the Sign in with Apple capability, since the plugin adds its entitlement. A wildcard provisioning profile can't carry it. +A production build for a real iPhone needs an explicit App ID for `NATIVEPHP_APP_ID` with the Sign in with Apple capability, since the plugin adds its entitlement. A wildcard provisioning profile can't carry it. -## Running it +## How signing in works -```sh -php artisan native:run -``` +There are no passwords or tokens. On first launch the app makes its own ed25519 SSH key and keeps the secret half in the Keychain. Every request to devnull is signed with it. -If CocoaPods fails with "Unicode Normalization not appropriate for ASCII-8BIT", run it with `LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8`. +Sign in with GitHub opens dev-null.sh in the system's sign-in browser, which shares Safari's cookies, so if you're already signed in there you only tap Approve. dev-null.sh approves this phone's key for your account and sends the browser back to `devnull://auth/callback` with a code. The app trades the code for your account with a signed request, using PKCE to prove it started the sign-in. + +On iOS you can also link an Apple ID from this device, under your profile. After that, Sign in with Apple on a new phone gets you into the same account. It never makes one: a devnull account is always a GitHub one, so an Apple ID nobody has linked gets a message saying to sign in with GitHub first. It comes from [codingwithrk/nativephp-social-auth](https://github.com/codingwithrk/nativephp-social-auth), which hashes the app's nonce for Apple, and the app asks Apple for no name or email. + +## The API + +The app talks to devnull's signed `/api/v1`, which came in with [nunomaduro/dev-null.sh#130](https://github.com/nunomaduro/dev-null.sh/pull/130) and runs on dev-null.sh. + +Some features use endpoints that are still in review upstream, so against dev-null.sh they fail until those land: + +- starring and saving ([#550](https://github.com/nunomaduro/dev-null.sh/pull/550)), +- deleting your account ([#551](https://github.com/nunomaduro/dev-null.sh/pull/551)), +- reporting ([#552](https://github.com/nunomaduro/dev-null.sh/pull/552)), +- quoting ([#553](https://github.com/nunomaduro/dev-null.sh/pull/553)), +- syncing from GitHub and saving your colour ([#554](https://github.com/nunomaduro/dev-null.sh/pull/554)), +- muting and blocking ([#555](https://github.com/nunomaduro/dev-null.sh/pull/555)), +- follower and following lists ([#556](https://github.com/nunomaduro/dev-null.sh/pull/556)), +- pastéis mode ([#557](https://github.com/nunomaduro/dev-null.sh/pull/557)), +- Sign in with Apple ([#558](https://github.com/nunomaduro/dev-null.sh/pull/558)). + +To try them sooner, run devnull with those branches merged, put it behind a tunnel (ngrok, Cloudflare and so on), and set `DEVNULL_URL` to the tunnel's URL before building. ## Tests From f5a3a408c4e85c782e980c01ad5f2335a2de8aa7 Mon Sep 17 00:00:00 2001 From: Simon Hamp Date: Mon, 19 Oct 2026 13:59:15 +0100 Subject: [PATCH 2/2] Say what it takes to sign in from Jump, and that it can't yet Jump's sign-in browser only comes back for jump:// links, and dev-null.sh only redirects to devnull://. The Jump section now sits after building the app and lists what getting that far would take: devnull running locally behind a tunnel, jump:// allowed in its config/mobile.php, and the app sending a jump:// redirect_uri. Even then Jump doesn't pass the link on to the app it's running, so it says to build the app to sign in. Co-Authored-By: Claude Opus 5.5 --- README.md | 41 ++++++++++++++++++++--------------------- 1 file changed, 20 insertions(+), 21 deletions(-) diff --git a/README.md b/README.md index 1fa2b42..a0702e0 100644 --- a/README.md +++ b/README.md @@ -13,27 +13,6 @@ A native iOS and Android app for [devnull](https://dev-null.sh), the social netw - Muting and blocking, your account settings, and your lane colour. - Signing in with GitHub, or with an Apple ID you've linked. -## Try it on your phone with Jump - -The quickest way to run the app is [Jump](https://bifrost.nativephp.com/jump), NativePHP's free app for running a project on your phone without Xcode or Android Studio. - -1. Install Jump on your iPhone or Android phone. -2. Clone this repo and set it up: - - ```sh - git clone https://github.com/NativePHP/dev-null-app.git - cd dev-null-app - composer setup - ``` - -3. Start Jump's server, then scan the QR code it shows with Jump. Your phone and your computer need to be on the same Wi-Fi. - - ```sh - php artisan native:jump - ``` - -`composer setup` needs NativePHP plugin credentials for the Secure Storage plugin. If you don't have them, run `composer setup:free` instead (see [Without plugin credentials](#without-plugin-credentials)) and add `DEVNULL_KEY_STORE=file` to `.env`. Otherwise the app won't make its key on a real phone. - ## Building it yourself Clone the repo and: @@ -87,6 +66,26 @@ These can be set in `.env`: A production build for a real iPhone needs an explicit App ID for `NATIVEPHP_APP_ID` with the Sign in with Apple capability, since the plugin adds its entitlement. A wildcard provisioning profile can't carry it. +## Running it in Jump + +[Jump](https://bifrost.nativephp.com/jump) is NativePHP's free app for running a project on your phone without Xcode or Android Studio. It can run this app, but you can't sign in there yet, so you won't get past the welcome screen. + +To run it, install Jump on your phone, clone the repo and run `composer setup` as above, then start Jump's server and scan the QR code it shows with Jump. Your phone and your computer need to be on the same Wi-Fi. + +```sh +php artisan native:jump +``` + +Without plugin credentials, add `DEVNULL_KEY_STORE=file` to `.env` as well. Jump runs on a real phone, where the app won't make its key without the Secure Storage plugin. + +Signing in is what doesn't work. dev-null.sh sends the sign-in browser back to the app at `devnull://auth/callback`, but inside Jump the browser only comes back for Jump's own `jump://` links. Getting that far would take: + +1. devnull running locally, behind a tunnel (ngrok, Cloudflare and so on), with `DEVNULL_URL` set to the tunnel's URL, +2. `jump://` added to `redirect_uri_prefixes` in devnull's `config/mobile.php`, so the authorize page will redirect there, +3. the app sending `jump://auth/callback` as its `redirect_uri`, which it doesn't today. + +Even then, Jump doesn't pass a `jump://` link on to the app it's running, so the sign-in never reaches the app. Until it does, build the app yourself to sign in. + ## How signing in works There are no passwords or tokens. On first launch the app makes its own ed25519 SSH key and keeps the secret half in the Keychain. Every request to devnull is signed with it.