fix(mobile): link URLs with ports, single-label hosts and fuller paths

[rynfar]

Problem

On mobile, URLs like http://localhost:3000/path, http://devbox/x or https://example.com:8443/a?b=c:d in chat text were not tappable. The md4c parser bundled in react-native-nitro-markdown requires a dotted host for autolinks, stops at :, and accepts only a small set of path, query and fragment characters.

Fix

Add upstream's pnpm patch for react-native-nitro-markdown@0.5.8. Scheme URLs now link with a single host label, an optional numeric port, and the common path / query / fragment punctuation. A trailing run of sentence punctuation (?!.,:*) stays outside the link; a trailing _ or ~ stays inside it. www. and e-mail autolinks still require a dotted host.

Sources

Upstream source	Upstream PR	Disposition
fe6388f01d5ae9f9db43079c6f5b2c31869067ca	#13795	Adopted
81e0491d2bdec153bf1ee12d4e1deab3909b7428	#13807	Adopted (final patch content)

Which package Pylon actually builds

The earlier review note for these sources assumed Pylon builds from apps/mobile/deps/react-native-nitro-markdown-0.5.0.tgz. It does not:

• apps/mobile/package.json lists that tarball under a package-level overrides key, which pnpm ignores (only npm reads it; the workspace overrides in pnpm-workspace.yaml has no entry for this package).
• pnpm-lock.yaml resolves react-native-nitro-markdown ^0.5.0 to the registry 0.5.8, and apps/mobile/node_modules/react-native-nitro-markdown is that build. Its md4c.c differs from the tarball's (the tarball carries extra LaTeX delimiter code).
• Upstream has the same layout and patches 0.5.8 the same way.

So the upstream patch file applies unchanged and no tarball rebuild is needed. The tarball and the npm-only override are left untouched; whether to delete them is a separate cleanup.

Pylon adaptations

None to the patch. The lockfile change is limited to the five lines that carry the new patch hash. Pylon's native rendering and selection module (apps/mobile/modules/t3-markdown-text) is unchanged; it consumes the parser's link nodes.

Verification

• vp i --frozen-lockfile accepted the lockfile, and the installed cpp/md4c/md4c.c contains the patch.
• A scratch C harness (outside the repo) compiled the installed md4c.c with the flags the library uses and compared it with the unpatched file over 12 inputs. Newly linked: http://localhost:3000/path, http://devbox/x, https://example.com:8443/a?b=c:d#frag:1, http://127.0.0.1:5173/?token=a.b~c, https://example.com/a(b)c:d@e!f,g;h%20, https://example.com/foo_, https://example.com/x~. Unchanged: https://example.com/a... links as https://example.com/a, https://example.com. drops the full stop, www.localhost and me@localhost stay plain text, emphasis and strikethrough around a URL still resolve.
• vp test run apps/mobile/src/lib/nativeMarkdownText.test.ts: 63 tests passed.

Limits

• The repository has no place to run a native parser test (the parser is C compiled into the app, and the existing markdown tests work on already-parsed nodes), so no regression test was added; the harness above is the evidence.
• No rendered-client pass: no simulator or emulator run. The patch changes native code, so it needs a new native build, not an OTA update.

Refs #865.

Model: Claude Opus 5.5. Harness: Claude Code in Pylon. Workflow: review-t3-upstream skill.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	14.0 KiB	+2 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.3 KiB	7.3 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	+6 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	14.0 KiB	14.0 KiB	−3 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.3 KiB	7.3 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.8 KiB	−2 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.9 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: da77592 · PR result: 49768f0 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.