ci: put CI keychain first in codesign search list

codesign resolves signing identities through the user keychain search
list (first match wins) and ignores --keychain for the lookup. This
runner hosts another project whose keychain holds the same Apple
Distribution identity, so when that keychain is locked, codesign fails
with errSecInternalComponent no matter how correctly our own keychain
is set up. Prepend the fresh CI keychain to the search list for the
build and always delete it afterward, which restores the original list.

Also drop the runner-diagnostics step, the GitHub-hosted Ruby PATH
export, and the duplicate CODE_SIGN_IDENTITY param.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/testflight.yml

@@ -4,20 +4,15 @@ on:
   workflow_dispatch:
   push:
     tags:
-      - "release/v*"
+      - "release/ios/v*"
 
 jobs:
   testflight:
-    runs-on: xcode
-    defaults:
-      run:
-        shell: bash
+    runs-on: macos-arm64
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
@@ -27,35 +22,11 @@ jobs:
           working-directory: ios
 
       - name: Install XcodeGen
-        run: |
-          set -euo pipefail
-          if ! command -v xcodegen >/dev/null 2>&1; then
-            brew install xcodegen
-          fi
-
-      - name: Prepare Runner Keychain
-        env:
-          HOME: /var/lib/act_runner
-        run: |
-          set -euo pipefail
-          mkdir -p "${HOME}/Library/Keychains"
-
-          login_keychain="${HOME}/Library/Keychains/login.keychain"
-          if [ ! -f "${login_keychain}-db" ]; then
-            security create-keychain -p "" "${login_keychain}"
-          fi
-
-          security unlock-keychain -p "" "${login_keychain}" 2>/dev/null || \
-            security unlock-keychain -p "sybil-ci-keychain-password" "${login_keychain}" 2>/dev/null || true
-          security default-keychain -d user -s "${login_keychain}"
-          security list-keychains -d user -s "${login_keychain}-db"
-          security delete-keychain "${HOME}/Library/Keychains/sybil_ci_keychain" >/dev/null 2>&1 || true
-          rm -f "${HOME}/Library/Keychains/sybil_ci_keychain" "${HOME}/Library/Keychains/sybil_ci_keychain-db"
+        run: command -v xcodegen >/dev/null 2>&1 || brew install xcodegen
 
       - name: Upload to TestFlight
         working-directory: ios
         env:
-          HOME: /var/lib/act_runner
           APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
           APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}
@@ -65,7 +36,4 @@ jobs:
           SYBIL_BUILD_NUMBER: ${{ github.run_number }}
           FASTLANE_SKIP_UPDATE_CHECK: "1"
           FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120"
-        run: |
-          export PATH="/Users/runner/hostedtoolcache/Ruby/3.1.7/arm64/bin:${PATH}"
-          ruby --version
-          bundle exec fastlane ios beta
+        run: bundle exec fastlane ios beta

docs/api/rest.md

@@ -285,6 +285,7 @@ Behavior notes:
 - For `chatId` calls, server stores only *new* non-assistant messages from provided history to avoid duplicates.
 - `additionalSystemPrompt`, when present directly or loaded from stored chat settings, is prepended to the provider request as a `system` message and is not inserted into the persisted chat transcript by this endpoint.
 - `enabledTools` limits Sybil-managed tools for this request. When omitted for a saved chat, the stored chat setting is used; otherwise all available tools are enabled by default. An empty array disables Sybil-managed tools.
+- `maxTokens` is optional. For `anthropic`, when omitted the backend requests the selected model's maximum output token limit from Anthropic's Models API and uses that as `max_tokens`; if the model limit cannot be loaded, the fallback is 128000. For other providers, omitted `maxTokens` is not sent as an explicit cap.
 - Server persists final assistant output and call metadata (`LlmCall`) in DB.
 - Server updates chat-level model metadata on each call: `lastUsedProvider`/`lastUsedModel`; first successful/failed call also initializes `initiatedProvider`/`initiatedModel` if unset.
 - Attachments are optional and currently apply to `user` messages. Persisted chat history stores them under `message.metadata.attachments`.

docs/api/streaming-chat.md

@@ -64,6 +64,7 @@ Notes:
 - For persisted streams, backend stores only new non-assistant input history rows to avoid duplicates.
 - `additionalSystemPrompt`, when present directly or loaded from stored chat settings, is prepended to the provider request as a `system` message and is not inserted into the persisted chat transcript by this endpoint.
 - `enabledTools` limits Sybil-managed tools for this request. When omitted for a saved chat, the stored chat setting is used; otherwise all available tools are enabled by default. An empty array disables Sybil-managed tools.
+- `maxTokens` is optional. For `anthropic`, when omitted the backend requests the selected model's maximum output token limit from Anthropic's Models API and uses that as `max_tokens`; if the model limit cannot be loaded, the fallback is 128000. For other providers, omitted `maxTokens` is not sent as an explicit cap.
 - Attachments are optional and are persisted under `message.metadata.attachments` on stored user messages when `persist` is `true`.
 
 Persisted chat streams with a `chatId` are backend-owned active runs:

ios/AGENTS.md

@@ -21,6 +21,12 @@ Instructions for work under `/Users/buzzert/src/sybil-2/ios`.
 - To choose a screenshot path, run `just screenshot path=build/name.png`.
 - The underlying screenshot command is `xcrun simctl io booted screenshot <path>` and requires a booted simulator.
 
+## Release Workflow
+- iOS release tags use the annotated tag namespace `release/ios/vX.Y.Z`; increment from the latest existing `release/ios/v*` tag.
+- Tag message convention is `ios: X.Y.Z`, for example `git tag -a release/ios/v1.13.5 -m "ios: 1.13.5"`.
+- Push the release commit and tag together with `git push origin <branch> release/ios/vX.Y.Z`.
+- Fastlane derives the marketing version from the release tag and stamps `ios/Apps/Sybil/project.yml` during CI, so do not manually bump `MARKETING_VERSION` for normal tagged releases unless explicitly requested.
+
 ## App Structure
 - App target entry: `/Users/buzzert/src/sybil-2/ios/Apps/Sybil/Sources/SybilApp.swift`
 - Shared iOS app code lives in Swift package:

ios/Apps/Sybil/project.yml

@@ -24,7 +24,7 @@ targets:
         GENERATE_INFOPLIST_FILE: YES
         INFOPLIST_FILE: Apps/Sybil/Info.plist
         ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
-        MARKETING_VERSION: "1.10"
+        MARKETING_VERSION: "1.13.2"
         CURRENT_PROJECT_VERSION: 11
         INFOPLIST_KEY_CFBundleDisplayName: Sybil
         INFOPLIST_KEY_ITSAppUsesNonExemptEncryption: NO

ios/Packages/Sybil/Sources/Sybil/SybilChatTranscriptView.swift

@@ -58,7 +58,8 @@ struct SybilChatTranscriptView: View {
                         .frame(height: 18 + bottomContentInset)
                         .id(bottomAnchorID)
                 }
-                .frame(maxWidth: .infinity, alignment: .leading)
+                .frame(maxWidth: SybilLayout.webContentMaxWidth, alignment: .leading)
+                .frame(maxWidth: .infinity, alignment: .center)
                 .padding(.horizontal, 14)
                 .padding(.top, 18 + topContentInset)
             }

ios/Packages/Sybil/Sources/Sybil/SybilSearchResultsView.swift

@@ -98,7 +98,8 @@ struct SybilSearchResultsView: View {
                         .foregroundStyle(SybilTheme.danger)
                 }
             }
-            .frame(maxWidth: .infinity, alignment: .leading)
+            .frame(maxWidth: SybilLayout.webContentMaxWidth, alignment: .leading)
+            .frame(maxWidth: .infinity, alignment: .center)
             .padding(.horizontal, 14)
             .padding(.top, 20 + topContentInset)
             .padding(.bottom, 20 + bottomContentInset)

ios/Packages/Sybil/Sources/Sybil/SybilTheme.swift

@@ -64,6 +64,10 @@ extension Font {
     }
 }
 
+enum SybilLayout {
+    static let webContentMaxWidth: CGFloat = 896
+}
+
 enum SybilTheme {
     static let background = Color(red: 0.02, green: 0.02, blue: 0.05)
     static let surface = Color(red: 0.05, green: 0.04, blue: 0.10)

ios/fastlane/Fastfile

@@ -12,6 +12,7 @@ CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
+APP_PROJECT_SPEC = File.join(IOS_ROOT, "Apps/Sybil/project.yml")
 
 def present?(value)
   !value.to_s.strip.empty?
@@ -24,14 +25,15 @@ end
 def release_version
   tag = ENV["SYBIL_VERSION_TAG"]
   tag = ENV["GITHUB_REF_NAME"] if !present?(tag)
+  tag = ENV["GITHUB_REF"].to_s.sub(%r{\Arefs/tags/}, "") if !present?(tag)
   tag = sh("git describe --tags --abbrev=0").strip if !present?(tag)
-  version = tag.to_s.sub(%r{\Arelease/}, "").sub(/\Av/, "")
+  match = tag.to_s.match(%r{\Arelease/ios/v(\d+\.\d+\.\d+)\z})
 
-  unless version.match?(/\A\d+\.\d+\.\d+\z/)
-    UI.user_error!("Release tag must look like v1.2.3; got #{tag.inspect}")
+  unless match
+    UI.user_error!("Release tag must look like release/ios/v1.2.3; got #{tag.inspect}")
   end
 
-  version
+  match[1]
 end
 
 # App Store Connect requires CFBundleVersion to be unique and strictly
@@ -48,6 +50,17 @@ def build_number
   value.to_i
 end
 
+def stamp_marketing_version(version)
+  contents = File.read(APP_PROJECT_SPEC)
+  updated = contents.sub(/^(\s*MARKETING_VERSION:\s*).*/, "\\1\"#{version}\"")
+
+  if updated == contents
+    UI.user_error!("Could not find MARKETING_VERSION in #{APP_PROJECT_SPEC}")
+  end
+
+  File.write(APP_PROJECT_SPEC, updated)
+end
+
 platform :ios do
   private_lane :app_store_api_key do
     app_store_connect_api_key(
@@ -58,9 +71,13 @@ platform :ios do
     )
   end
 
-  # CI has no login keychain, so create a dedicated throwaway one for match to
-  # import the distribution cert into. The runner's launchd job sets
-  # SessionCreate, so add_to_search_list actually makes it visible to xcodebuild.
+  # CI signs headlessly, so match needs a fresh unlocked keychain to import
+  # into. codesign resolves identities through the user keychain *search list*
+  # (first match wins; the --keychain flag does not restrict the lookup), and
+  # other projects' keychains on this runner hold the same identity but are
+  # usually locked — so ours must come first. delete_keychain in the beta
+  # lane's ensure removes both the keychain and its search-list entry, which
+  # also keeps our (later locked) copy from shadowing those other projects.
   private_lane :prepare_ci_keychain do
     next unless ci?
 
@@ -70,9 +87,15 @@ platform :ios do
       password: CI_KEYCHAIN_PASSWORD,
       unlock: true,
       timeout: 3600,
-      add_to_search_list: true
+      add_to_search_list: false
     )
 
+    others = sh("security list-keychains -d user", log: false)
+      .scan(/"([^"]+)"/)
+      .flatten
+      .reject { |path| path.include?(CI_KEYCHAIN_NAME) }
+    sh("security list-keychains -d user -s #{([CI_KEYCHAIN_DB_PATH] + others).shelljoin}")
+
     ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
     ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
   end
@@ -103,9 +126,11 @@ platform :ios do
 
     api_key = app_store_api_key
 
+    version = release_version
+    stamp_marketing_version(version)
     sh("xcodegen", "--spec", PROJECT_SPEC)
 
-    increment_version_number(version_number: release_version, xcodeproj: PROJECT_FILE)
+    increment_version_number(version_number: version, xcodeproj: PROJECT_FILE)
     increment_build_number(build_number: build_number, xcodeproj: PROJECT_FILE)
 
     sync_signing(api_key: api_key, readonly: true)
@@ -114,7 +139,6 @@ platform :ios do
       project: PROJECT_FILE,
       scheme: SCHEME,
       export_method: "app-store",
-      codesigning_identity: "Apple Distribution",
       xcargs: [
         "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
         "CODE_SIGN_STYLE=Manual",
@@ -134,5 +158,7 @@ platform :ios do
       api_key: api_key,
       skip_waiting_for_build_processing: true
     )
+  ensure
+    delete_keychain(name: CI_KEYCHAIN_NAME) if ci? && File.file?(CI_KEYCHAIN_DB_PATH)
   end
 end

server/src/llm/protocols/messages-api.ts

@@ -28,6 +28,45 @@ import type { ChatMessage } from "../types.js";
 const INTERNAL_CORRECTION =
   "Internal correction: the previous assistant message claimed it would run a tool, but no tool call was made. If the task needs an available tool, call it now. Otherwise provide the final answer directly without saying you will run a tool.";
 
+const DEFAULT_ANTHROPIC_MAX_TOKENS = 128_000;
+const MODEL_MAX_TOKENS_CACHE_MS = 24 * 60 * 60 * 1000;
+
+const modelMaxTokensCache = new Map<string, { maxTokens: number; expiresAt: number }>();
+
+function readMaxTokens(value: unknown) {
+  return Number.isSafeInteger(value) && (value as number) > 0 ? (value as number) : undefined;
+}
+
+function getModelInfoMaxTokens(modelInfo: any) {
+  return readMaxTokens(modelInfo?.max_tokens) ?? readMaxTokens(modelInfo?.maxTokens);
+}
+
+async function getMessagesMaxTokens(params: ToolAwareCompletionParams) {
+  if (params.maxTokens) return params.maxTokens;
+
+  const cached = modelMaxTokensCache.get(params.model);
+  if (cached && cached.expiresAt > Date.now()) return cached.maxTokens;
+
+  try {
+    const retrieve = params.client?.models?.retrieve;
+    if (typeof retrieve === "function") {
+      const modelInfo = await retrieve.call(params.client.models, params.model);
+      const maxTokens = getModelInfoMaxTokens(modelInfo);
+      if (maxTokens) {
+        modelMaxTokensCache.set(params.model, {
+          maxTokens,
+          expiresAt: Date.now() + MODEL_MAX_TOKENS_CACHE_MS,
+        });
+        return maxTokens;
+      }
+    }
+  } catch {
+    // Fall back to the documented max for Claude Opus 4.8 and related high-output models.
+  }
+
+  return DEFAULT_ANTHROPIC_MAX_TOKENS;
+}
+
 function toTools(tools: any[]) {
   return tools
     .map((tool) => {
@@ -160,11 +199,12 @@ function mergeUsage(acc: Required<ToolAwareUsage>, usage: any) {
 
 export async function completeWithMessagesApi(params: ToolAwareCompletionParams): Promise<ToolAwareCompletionResult> {
   const enabledTools = getEnabledChatTools(params);
+  const maxTokens = await getMessagesMaxTokens(params);
   if (!enabledTools.length) {
     const response = await params.client.messages.create({
       model: params.model,
       system: buildTopLevelSystemPrompt(params.messages, params.userLocation),
-      max_tokens: params.maxTokens ?? 1024,
+      max_tokens: maxTokens,
       temperature: params.temperature,
       messages: buildBaseMessages(params),
     } as any);
@@ -192,7 +232,7 @@ export async function completeWithMessagesApi(params: ToolAwareCompletionParams)
     const response = await params.client.messages.create({
       model: params.model,
       system: buildTopLevelSystemPrompt(params.messages, params.userLocation, buildChatToolSystemPrompt(params)),
-      max_tokens: params.maxTokens ?? 1024,
+      max_tokens: maxTokens,
       temperature: params.temperature,
       messages: conversation,
       tools: toTools(enabledTools),
@@ -248,6 +288,7 @@ export async function completeWithMessagesApi(params: ToolAwareCompletionParams)
 
 export async function* streamWithMessagesApi(params: ToolAwareCompletionParams): AsyncGenerator<ToolAwareStreamingEvent> {
   const enabledTools = getEnabledChatTools(params);
+  const maxTokens = await getMessagesMaxTokens(params);
   if (!enabledTools.length) {
     const rawResponses: unknown[] = [];
     const usageAcc: Required<ToolAwareUsage> = { inputTokens: 0, outputTokens: 0, totalTokens: 0 };
@@ -259,7 +300,7 @@ export async function* streamWithMessagesApi(params: ToolAwareCompletionParams):
     const stream = await params.client.messages.create({
       model: params.model,
       system: buildTopLevelSystemPrompt(params.messages, params.userLocation),
-      max_tokens: params.maxTokens ?? 1024,
+      max_tokens: maxTokens,
       temperature: params.temperature,
       messages: buildBaseMessages(params),
       stream: true,
@@ -315,7 +356,7 @@ export async function* streamWithMessagesApi(params: ToolAwareCompletionParams):
     const stream = await params.client.messages.create({
       model: params.model,
       system: buildTopLevelSystemPrompt(params.messages, params.userLocation, buildChatToolSystemPrompt(params)),
-      max_tokens: params.maxTokens ?? 1024,
+      max_tokens: maxTokens,
       temperature: params.temperature,
       messages: conversation,
       tools: toTools(enabledTools),

server/tests/chat-tools-streaming.test.ts

@@ -140,6 +140,94 @@ test("plain Chat Completions stream does not send Sybil-managed tools", async ()
   assert.equal(events.at(-1)?.type === "done" ? events.at(-1)?.result.text : null, "Hi");
 });
 
+test("Messages API defaults max_tokens to the Anthropic model maximum", async () => {
+  let requestBody: any = null;
+  let retrievedModel: string | null = null;
+  const client = {
+    models: {
+      retrieve: async (model: string) => {
+        retrievedModel = model;
+        return { id: model, max_tokens: 128000 };
+      },
+    },
+    messages: {
+      create: async (body: any) => {
+        requestBody = body;
+        return {
+          content: [{ type: "text", text: "Done" }],
+          usage: { input_tokens: 1, output_tokens: 1 },
+        };
+      },
+    },
+  };
+
+  const result = await completeWithMessagesApi({
+    client: client as any,
+    model: "claude-max-default-test",
+    messages: [{ role: "user", content: "Say done" }],
+  });
+
+  assert.equal(retrievedModel, "claude-max-default-test");
+  assert.equal(requestBody?.max_tokens, 128000);
+  assert.equal(result.text, "Done");
+});
+
+test("Messages API preserves explicit maxTokens", async () => {
+  let requestBody: any = null;
+  let didRetrieveModel = false;
+  const client = {
+    models: {
+      retrieve: async () => {
+        didRetrieveModel = true;
+        return { max_tokens: 128000 };
+      },
+    },
+    messages: {
+      create: async (body: any) => {
+        requestBody = body;
+        return streamFrom([
+          {
+            type: "message_start",
+            message: {
+              usage: { input_tokens: 1, output_tokens: 0 },
+            },
+          },
+          {
+            type: "content_block_start",
+            index: 0,
+            content_block: { type: "text", text: "" },
+          },
+          {
+            type: "content_block_delta",
+            index: 0,
+            delta: { type: "text_delta", text: "Done" },
+          },
+          { type: "content_block_stop", index: 0 },
+          {
+            type: "message_delta",
+            delta: { stop_reason: "end_turn", stop_sequence: null },
+            usage: { output_tokens: 1 },
+          },
+          { type: "message_stop" },
+        ]);
+      },
+    },
+  };
+
+  const events = await collectEvents(
+    streamWithMessagesApi({
+      client: client as any,
+      model: "claude-explicit-max-test",
+      messages: [{ role: "user", content: "Say done" }],
+      maxTokens: 4096,
+    })
+  );
+
+  assert.equal(didRetrieveModel, false);
+  assert.equal(requestBody?.max_tokens, 4096);
+  assert.equal(events.at(-1)?.type === "done" ? events.at(-1)?.result.text : null, "Done");
+});
+
 test("fetch_url sends browser-like navigation headers", async () => {
   const originalFetch = globalThis.fetch;
   const fetchCalls: Array<{ input: RequestInfo | URL; init?: RequestInit }> = [];

web/src/index.css

@@ -286,6 +286,14 @@ textarea {
   word-break: break-word;
 }
 
+.md-content > :first-child {
+  margin-top: 0;
+}
+
+.md-content > :last-child {
+  margin-bottom: 0;
+}
+
 .md-table-scroll {
   max-width: 100%;
   margin: 0.35rem 0 1rem;
@@ -384,7 +392,8 @@ textarea {
 
 .md-content ul,
 .md-content ol {
-  margin-top: 0.65rem;
+  margin-top: 0.85rem;
+  margin-bottom: 0.85rem;
   margin-left: 0;
   padding-left: 0;
   list-style: none;
@@ -396,6 +405,26 @@ textarea {
   padding-left: 1.35rem;
 }
 
+.md-content ul > li {
+  position: relative;
+  padding-left: 1.1rem;
+}
+
+.md-content ul > li::before {
+  content: "";
+  position: absolute;
+  left: 0;
+  top: 0.76em;
+  width: 0.36rem;
+  height: 0.36rem;
+  border-radius: 9999px;
+  background: hsl(188 86% 62%);
+  box-shadow:
+    0 0 0 2px hsl(188 86% 62% / 0.12),
+    0 0 10px hsl(188 86% 62% / 0.42);
+  transform: translateY(-50%);
+}
+
 .md-content li + li {
   margin-top: 0.3rem;
 }