78:T110b,## Summary The environment connection model (about 1.9k lines that were already DOM-free) lived in `apps/web/src/lib`, where nothing outside the web app could import it. It now lives in `packages/environment-client/src/connection/` and is exported as `@openmanager/environment-client/connection`, so the React Native app can use the same code. ### What moved (with `git mv`, so history follows) `bootstrap`, `pairing`, `route-fallback`, `route-health`, `connection-state`, `environment-store` and their tests. The tests now live in `packages/environment-client/tests/connection/` (the package's test home) and run in a **node** environment, which also shows they need no DOM. The subpath is a source-only `exports` entry declared exactly like the package root (`types` + `default` pointing at `./src/connection/index.ts`). Web resolves it the same way it already resolves the root. ### Seams - **Registry storage.** `readEnvironmentRegistry`, `writeEnvironmentRegistry` and `clearEnvironmentRegistry` take a `RegistryStorage` (`getItem`, `setItem`, `removeItem`). They used to fall back to `window.localStorage` themselves. Web now passes `browserRegistryStorage` (`apps/web/src/lib/registry-storage.ts`), which looks up `window.localStorage` on each call. It does this because reading `window.localStorage` itself throws where storage is blocked, and that throw has to happen inside the registry functions, which already read it as an empty or unsaved registry. - **Loopback permission.** `fetchBootstrap`, `probeRouteHealth` and `searchRoutes` take a `loopbackAccessDenied` check. It is only asked when a fetch to this device's loopback address fails, so a refused browser permission shows as "blocked" rather than "nothing listening". The check is **required**, not defaulted. If it were optional, a caller that forgot it would quietly lose the "blocked" answer, and the types would not complain. A host with no such gate passes `noLoopbackGate` explicitly. `searchRoutes` only asks for the check when no custom `probe` is supplied. Web passes its existing `loopbackAccessDenied` at every call site. ### What stayed browser-only, and why - `pairingAppUrl` reads `window.location` and `import.meta.env.BASE_URL`, which only make sense for the web app. It is now in `apps/web/src/lib/pairing-app-url.ts`. - `loopbackAccessDenied` reads `navigator.permissions`. It stays in `apps/web/src/lib/local-access.ts` and is injected as described above. - `local-owner.ts`, `environment-cache.ts`, `browser-runtime.ts` and `providers/connection-provider.tsx` stay in `apps/web` unchanged, apart from import paths and passing the two seams. ### Keeping the folder host-neutral The root `eslint.config.mjs` adds `no-restricted-globals` for `window`, `document`, `localStorage`, `navigator`, `indexedDB` and `location` on `packages/environment-client/src/connection/**`. It also adds `no-restricted-properties` for the `globalThis.` / `self.` forms of the same names. I checked the rule by planting a file that uses each one: lint reported all six. ### Web behaviour unchanged - No protocol change. Error messages, timeouts, registry versioning and the legacy-key migration are the same. - The story-fixture checks that ran `deriveConnectionUi` over the web stories now sit next to those stories (`apps/web/src/stories/connection-states.test.ts`), so the package does not depend on web fixtures. - `environment-client-provider.test.tsx` still drives a real `loopback-network: denied` permission through `ConnectionProvider` to `local_access_blocked`. That covers the injected check end to end. - New tests cover the storage seam on web (`registry-storage.test.ts`, including a throwing `localStorage` getter) and the loopback seam in the package (the check is asked for loopback routes and never for remote ones, for `fetchBootstrap`, `probeRouteHealth` and `searchRoutes`). ## Verification - `pnpm --filter @openmanager/environment-client typecheck`, `lint`, `test`: 16 files, 374 tests pass - `pnpm --filter @openmanager/web typecheck`, `lint`: clean - Web vitest on Node 24.14.1: 25 files, 236 tests pass - Prettier is clean on every file I touched. Four files were already unformatted on main (the three docs and `connection-state.ts`, which moved unchanged), and I left those as they were. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 79:Tcff,

**[Medium impact]** The PR appears safe to merge; the documentation update matches the storage code.

Summary

Moves the shared connection code into `@openmanager/environment-client/connection`. - Web and phone clients share the environment connection flow.

Diagram

```mermaid %%{init: {'theme': 'neutral'}}%% flowchart LR Web[Web app] --> Shared[environment-client/connection] Phone[Phone app] -. Can reuse .-> Shared Web --> Storage[Browser storage adapter] Web --> Permission[Loopback permission check] Storage --> Shared Permission --> Shared ``` _{Reviews (2) · Last reviewed commit: ["Describe web's registry storage adapter ..."](https://github.com/calledforth/openmanager/commit/09761b0904c88f2e4a6fd365e4033fb4a91bac66) · [Reviewed by Greptile](https://www.greptile.com/?utm_source=greptile_review&utm_medium=github&utm_campaign=review_public&utm_content=calledforth/openmanager)} 7a:T5f2,## 🚀 Deploying Preview to Cloudflare 🚀 ### Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		09761b0	2026-10-20T17:19:38.195Z	View logs ↗
Build: Failed ❌ View logs ↗		1df8b59	2026-10-20T16:33:10.687Z	View logs ↗

7b:T61f,refactor(environment-client): host-neutral connection stack for web and phone Finish moving the web connection model into @openmanager/environment-client/connection (a source-only exports subpath, like the package root) and cut its last ties to the browser: - Registry storage is injected: read/write/clear take a RegistryStorage (getItem, setItem, removeItem). Web hands in browserRegistryStorage, which looks up window.localStorage per call so a blocked-storage throw still lands inside the registry functions and reads as an empty or unsaved registry. - The loopback permission check is injected and required on fetchBootstrap, probeRouteHealth and searchRoutes (unless a custom probe is given), so a host cannot lose the "browser blocked this device" answer by leaving it out. noLoopbackGate is the explicit choice for a host with no such gate. Web passes local-access's loopbackAccessDenied at every call site, including the route search, which the earlier wiring had missed. - pairingAppUrl (window.location) moves to apps/web/src/lib/pairing-app-url; loopbackAccessDenied stays in apps/web/src/lib/local-access. - ESLint rejects window, document, localStorage, navigator, indexedDB and location (bare and via globalThis/self) under src/connection. - Tests run from packages/environment-client/tests/connection in a node environment; the story-fixture checks stay next to the web stories. - README and docs point at the new home. Web behaviour is unchanged; no protocol change. Co-Authored-By: Claude Fable 5.1 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"calledforth","repo":"openmanager","pullNumber":224}],"data":{"repositoryId":"2045","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/df85a2a863690ececdfb4ceab2ebc19a?key=AYAb%2FP%2FITdOrIocJPPXAonOcVf4PkC6tWA%2FOIgQlcYyqnQQIaNnaIVD85WBzhMjz7crp9yDFQCczdUtjOlw7OfZ8AuzqFPX%2FcqsTEhdldE%2F6mDiLciX5tf9MbvCL9%2BLdJ9BZgwrkD3bRDnCxtIXBNT4aRcfWVjEqG3spdGCdDBtfTAXg8Qp%2FqZl%2FkQ%3D%3D","externalProvider":"github","login":"calledforth","type":"User","url":"https://github.com/calledforth"},"authorId":"65070429","baseRefName":"main","closedAt":null,"comments":2,"createdAt":"2026-10-20T16:29:52Z","headRefName":"feat/cal-299-connection-stack","id":"4936914","isDraft":false,"labels":[],"number":224,"repository":{"name":"openmanager","owner":"calledforth","provider":"forgejo"},"state":"open","title":"Move the web connection stack into environment-client so the phone can share it","updatedAt":"2026-10-21T07:49:16Z","url":"https://trylle.com/calledforth/openmanager/pulls/224","body":"$78","additions":4061,"deletions":3783,"changedFiles":53,"commits":3,"reviewComments":0,"headSha":"09761b0904c88f2e4a6fd365e4033fb4a91bac66","baseSha":"af2253b48332e161dcb0241660d41410c0832da2","headRepoOwner":"calledforth","headRepoName":"openmanager","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":false,"mergeableState":"dirty","conflictingFiles":["apps/web/src/providers/connection-provider.tsx"],"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:224"},"comments":[{"id":26888985,"graphqlId":"26888985","body":"$79","createdAt":"2026-10-20T16:33:30Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/d5fdefbe765e9f429d38a31328621291?key=Acl0%2BlhblDOxCrSlqfonNDhgrt1LwjH88FRgEld3W8TJMWD14w5hVMk945%2FUo6%2F4SXM8sWkkR1IS3%2FPkJicqQw3Nzkwzis1r900F6Ii81AW%2B6%2FgoEHT7u6ClQhGHk5zI5yHvly2ZTjc6HDW38z1iK%2FBzByCTQdN9niTDbBlKfNdTv6bYqay%2Boc9at4A%3D","externalProvider":"github","login":"greptile-apps[bot]","type":"Bot","url":"https://github.com/apps/greptile-apps"}},{"id":26888999,"graphqlId":"26888999","body":"$7a","createdAt":"2026-10-20T17:01:36Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/f7188bca2549640bc2bbeeddfbbaff53?key=AV4CoCtKF5YpmzMRJSZH%2F3ytHE7gwGgCUN0OAx7tpDnfCwy%2FBrVLEwk3sVggJf43QUmAP3fEyOcJe6bfm4nBG47IqomMUjZtT9z6Vs%2B1oij%2Fg0TjtZ%2FFgr7mJ7MgWYorqKEoI59z%2BHVnKIwe9hk4wNjj19aAt7oNzie1AcDKQ%2FQaOMvcInr4HiTxzA%3D%3D","externalProvider":"github","login":"cloudflare-workers-and-pages[bot]","type":"Bot","url":"https://github.com/apps/cloudflare-workers-and-pages"}}],"commits":[{"sha":"09761b0904c88f2e4a6fd365e4033fb4a91bac66","message":"Describe web's registry storage adapter accurately in the README\n\nWeb passes browserRegistryStorage, which looks up window.localStorage on\nevery call so a blocked-storage throw lands inside the registry functions,\nnot localStorage itself. A phone implementer copying the old line would\nhave lost that protection.\n\nCo-Authored-By: Claude Fable 5.1 \n","createdAt":"2026-10-20T22:47:47+05:30","author":{"id":128,"avatarUrl":"https://cdn.trylle.com/media/images/df85a2a863690ececdfb4ceab2ebc19a?key=ATVW84LPIaR4kyz6cU5x7tlwLlIdlIesqGFdvCQgv65nYLIFL5Vfl5wvIrU370FqK6f1eFsWpJN1PITP6Be4SMtzUKGZCD9JqUNSBeFv0QtIx1OtF1g2k7JxyI9C0gJqWbhK12vaE1OfuVrfcKUIKv5GrkTtzpj5svfyNTx9vNMy0dJTLI1cQMASIQ%3D%3D","login":"calledforth","name":"calledforth","type":"User","url":"https://trylle.com/calledforth"},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}},{"sha":"1df8b59c538268b06ba7ae6375e6583dbfa1eafc","message":"$7b","createdAt":"2026-10-20T21:59:15+05:30","author":{"id":128,"avatarUrl":"https://cdn.trylle.com/media/images/df85a2a863690ececdfb4ceab2ebc19a?key=ATVW84LPIaR4kyz6cU5x7tlwLlIdlIesqGFdvCQgv65nYLIFL5Vfl5wvIrU370FqK6f1eFsWpJN1PITP6Be4SMtzUKGZCD9JqUNSBeFv0QtIx1OtF1g2k7JxyI9C0gJqWbhK12vaE1OfuVrfcKUIKv5GrkTtzpj5svfyNTx9vNMy0dJTLI1cQMASIQ%3D%3D","login":"calledforth","name":"calledforth","type":"User","url":"https://trylle.com/calledforth"},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}},{"sha":"46b9e77e86a773ff60eb02d4115eeb0f7fe58499","message":"Move the web connection stack into environment-client\n\nPure move with git mv so the follow-up commits show the real edits:\nbootstrap, pairing, route-fallback, route-health, connection-state and\nenvironment-store go to packages/environment-client/src/connection, and\ntheir tests to packages/environment-client/tests/connection (the\npackage's test home). This commit does not build on its own; the next\ncommits fix the imports and seams.\n\nCo-Authored-By: Claude Fable 5.1 \n","createdAt":"2026-10-20T18:13:18+05:30","author":{"id":128,"avatarUrl":"https://cdn.trylle.com/media/images/df85a2a863690ececdfb4ceab2ebc19a?key=ATVW84LPIaR4kyz6cU5x7tlwLlIdlIesqGFdvCQgv65nYLIFL5Vfl5wvIrU370FqK6f1eFsWpJN1PITP6Be4SMtzUKGZCD9JqUNSBeFv0QtIx1OtF1g2k7JxyI9C0gJqWbhK12vaE1OfuVrfcKUIKv5GrkTtzpj5svfyNTx9vNMy0dJTLI1cQMASIQ%3D%3D","login":"calledforth","name":"calledforth","type":"User","url":"https://trylle.com/calledforth"},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}}],"events":[{"id":26888980,"event":"pull_push","createdAt":"2026-10-20T16:29:52Z","actor":{"id":128,"avatarUrl":"https://cdn.trylle.com/media/images/df85a2a863690ececdfb4ceab2ebc19a?key=ATVW84LPIaR4kyz6cU5x7tlwLlIdlIesqGFdvCQgv65nYLIFL5Vfl5wvIrU370FqK6f1eFsWpJN1PITP6Be4SMtzUKGZCD9JqUNSBeFv0QtIx1OtF1g2k7JxyI9C0gJqWbhK12vaE1OfuVrfcKUIKv5GrkTtzpj5svfyNTx9vNMy0dJTLI1cQMASIQ%3D%3D","login":"calledforth","name":"calledforth","type":"User","url":"https://trylle.com/calledforth","authorAssociation":"OWNER"},"body":"{\"is_force_push\":false,\"commit_ids\":[\"46b9e77e86a773ff60eb02d4115eeb0f7fe58499\",\"1df8b59c538268b06ba7ae6375e6583dbfa1eafc\"]}","commitIds":["46b9e77e86a773ff60eb02d4115eeb0f7fe58499","1df8b59c538268b06ba7ae6375e6583dbfa1eafc"]}],"reviews":[],"stackEvents":[],"commentPagination":{"totalCount":2,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793408512286}],"children":"$L7c"}] 64:null 6b:[["$","title","0",{"children":"Commits · Move the web connection stack into environment-client so the phone can share it · calledforth/openmanager | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on Move the web connection stack into environment-client so the phone can share it (#224) in calledforth/openmanager."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · Move the web connection stack into environment-client so the phone can share it · calledforth/openmanager, calledforth/openmanager, calledforth/openmanager repository, openmanager, TypeScript repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/calledforth/openmanager/pulls/224/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/calledforth/openmanager/pulls/224/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · Move the web connection stack into environment-client so the phone can share it · calledforth/openmanager | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on Move the web connection stack into environment-client so the phone can share it (#224) in calledforth/openmanager."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/calledforth/openmanager/pulls/224/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=calledforth&repo=openmanager"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=calledforth&repo=openmanager"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"calledforth/openmanager repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · Move the web connection stack into environment-client so the phone can share it · calledforth/openmanager | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on Move the web connection stack into environment-client so the phone can share it (#224) in calledforth/openmanager."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=calledforth&repo=openmanager"}],["$","meta","32",{"name":"twitter:image:alt","content":"calledforth/openmanager repository preview on Trylle"}],"$L7d","$L7e","$L7f","$L80"]

Commits on Tue, Oct 20, 2026