Cloud mode: sign in at cloud.objectos.ai, pick an organization, land in its environment #153

repo:mobile#1 · os-justin · session_01QSeKYnW1Xf6HDSWz1eGAqv

Blocked-by: #152
Blocked-by: objectstack-ai/cloud#3489

Context

Design screens 1 → 2 → 4. ObjectOS Cloud already does unified login:

• the control plane at cloud.objectos.ai is the OIDC provider, and every environment at <label>.objectos.ai is a relying party;
• the "open environment" path mints a one-time ticket (GET /api/v1/cloud/environments/:id/sso-open), which the environment exchanges for its own session (/api/v1/auth/sso-exchange);
• cookies stay per environment host.

Each organization has exactly one production environment (objectstack-ai/cloud#3487; every option there keeps that). Mobile lists organizations, not environments, and never shows development environments.

Ask

1. Welcome → Cloud. "使用 ObjectOS Cloud 登录" loads the Cloud console at <cloudUrl>/_console.
   • cloudUrl comes from build config, a new EXPO_PUBLIC_CLOUD_URL defaulting to https://cloud.objectos.ai.
   • The user signs in there with whatever the Cloud offers (password, social, SSO).
2. Navigation policy in Cloud mode.
   • Admit the Cloud host and *.<cloud root domain> in the top frame. Everything else keeps the existing policy.
   • The bridge answers only the page whose origin is the current connection; it never answers the Cloud control-plane page.
3. Adopting the environment.
   • When a top-frame navigation lands on https://<env>.<root>/_console… after the handoff, the shell saves or updates a cloud connection (with the store from the saved-connections card) labelled with the organization name, and makes it current.
   • Read the label from that environment's anonymous /api/v1/runtime/config branding, or from the picker page; say which in the PR.
4. Coming back. The next launch opens the current connection directly; "添加组织" from the switcher returns to the Cloud picker.
5. Organization picker (screen 2). The picker is the Cloud console's page, made phone-ready by the objectstack-ai/cloud card filed with this design. The shell adds no native picker.

Security boundary: this widens the navigation policy (a new admitted host pattern). Per the charter it stays on the human floor; the maintainer merges.

Acceptance

• Unit tests cover the Cloud-mode navigation decisions: admitted patterns, an off-root host refused, an unrelated subdomain-looking host refused (objectos.ai.evil.example), and the adopt-on-landing rule.
• Manual run on a development build: sign in, pick an organization, land, relaunch to the same organization.