feat: Add Cairn mobile companion app and desktop Device Sync

.github/workflows/release-mobile.yml

@@ -0,0 +1,72 @@
+name: Release Mobile (TestFlight)
+
+# Builds the Expo iOS app on EAS and submits it to TestFlight.
+#
+# Trigger: push a tag like `mobile-v2.4.0` (see scripts/releasemobile.sh), or
+# run manually from the Actions tab (workflow_dispatch).
+#
+# Required repo secret:
+#   EXPO_TOKEN  — an Expo access token (expo.dev → Account → Access tokens).
+#                 EAS uses it for both the build and the TestFlight submit;
+#                 Apple signing credentials + the App Store Connect key are
+#                 stored on EAS (managed credentials), not here.
+#
+# One-time setup (run locally in mobile/, see mobile/README):
+#   npm i -g eas-cli && eas login && eas init && eas credentials
+
+on:
+  push:
+    tags:
+      - "mobile-v*"
+  workflow_dispatch:
+    inputs:
+      submit:
+        description: "Submit the build to TestFlight after it finishes"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-ios:
+    name: EAS Build + Submit (iOS)
+    runs-on: ubuntu-latest
+    # The build itself runs on EAS's macOS workers; this runner only drives the
+    # eas-cli, so ubuntu is fine (and cheaper/faster to spin up).
+    defaults:
+      run:
+        working-directory: mobile
+
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: mobile/package-lock.json
+
+      # Sets up eas-cli and authenticates via EXPO_TOKEN.
+      # NOTE: pin to a commit SHA once you've vetted the version you want.
+      - uses: expo/expo-github-action@v8
+        with:
+          eas-version: latest
+          token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: Install dependencies
+        run: npm ci
+
+      # Build on EAS (managed credentials) and wait for the artifact.
+      - name: EAS Build (iOS, production)
+        run: eas build --platform ios --profile production --non-interactive --wait
+
+      # Submit the finished build to TestFlight. Skipped if a manual run
+      # unchecked "submit". Uses the latest successful iOS build for this commit.
+      - name: EAS Submit (TestFlight)
+        if: >-
+          github.event_name == 'push' ||
+          github.event.inputs.submit == 'true'
+        run: eas submit --platform ios --profile production --latest --non-interactive

.gitignore

@@ -36,6 +36,9 @@ yarn-error.log*
 
 # env files (can opt-in for committing if needed)
 .env*
+# ...but always track example/template env files (no secrets).
+!.env.example
+!**/.env.example
 
 # vercel
 .vercel
@@ -82,3 +85,4 @@ cairn.db-wal
 # test mock vaults
 /tests/fixtures/obsidian-vault/
 scripts/runtime-baselines/
+/mobile/node_modules

changelogs/v2.4.0.md

@@ -0,0 +1,19 @@
+## What's new
+
+This release introduces the **Cairn mobile companion app** and the desktop-side **Device Sync** that connects the two. The mobile app is an offline-first iOS/Android client (Expo) you build yourself today, with the App Store as a possible future path.
+
+### Features
+
+- **Cairn mobile companion app**: A new offline-first mobile client for your workspace — notes, tasks, a drag-and-drop board, folders, tags, and an AI chat/assistant. Markdown rendering has parity with the desktop (syntax highlighting, task-list checkboxes, callouts, KaTeX math, and Mermaid diagrams). Everything works offline; changes reconcile with the desktop when connected.
+- **Device Sync (desktop)**: New **Settings → Device Sync** panel to connect a shared cloud folder (iCloud Drive, Dropbox, or Syncthing) that your phone also points at. Sync is offline-first and file-safe — only append-only oplog files ever transit the folder, never your database. On first connect, your entire existing workspace is seeded to the folder; after that only changes are exchanged, in the background.
+- **Conflict-safe reconciliation**: Concurrent edits to the same note on two devices are resolved with last-writer-wins plus a preserved **"conflicted copy"** note, so an edit is never silently lost. Note edits arriving from the phone are re-projected to their `.md` files on disk, keeping the desktop's dual-write parity.
+- **Pluggable mobile AI backend**: Mobile chat runs through a provider abstraction — a built-in endpoint for first-party builds, or any **OpenAI-compatible** endpoint (OpenAI, Azure OpenAI, OpenRouter, Together, Groq, LM Studio, Ollama, …) that you configure in-app with a base URL, model (with a "fetch models" picker), and an API key stored in the device keychain.
+
+### Changes
+
+- **Shared "one brain" core**: Note formatting, markdown transforms, folder-tree building, the syntax palette, and the offline-first sync engine were hoisted into a shared, framework-agnostic package used by both desktop and mobile — so the two apps stay behaviourally identical from a single source of truth.
+- **Device Sync stays idle until enabled**: The desktop only builds and drains its sync oplog while a sync folder is connected. If you never enable Device Sync, no oplog is accumulated — there's zero overhead for desktop-only users.
+
+### Requirements & notes
+
+- **Device Sync requires the mobile app.** It exchanges changes with your phone, not with another desktop — the Settings panel now states this explicitly. The mobile app is currently a build-it-yourself companion (see the mobile README); there's nothing to sync with until it's installed on your device.