Announcing C+ 0.0.28

C+ already supports programs on macOS, Windows, Linux, iOS, Android, ESP32, and WebAssembly. Version 0.0.28 closes the larger gap that remained in the UI stack: Facet now has native AppKit, UIKit, Android, GTK, and Win32 backends.

The release also changes Facet's application model, introduces explicit capability grants for agent access, completes more of the Windows, Linux, Android, and iOS platform layers, and gives the compiler's query, MCP, and LSP front doors one completion implementation backed by warm project sessions. These additions do not introduce a VM or garbage collector. C+ still compiles to native code through LLVM, and its safety checks add no runtime cost.

One Facet application model, five native backends

Facet's shared tree now runs through native backends on macOS, iOS, Android, Linux, and Windows. Applications register named windows and routes, then start through App::run:

let app = runtime::App::new("example");
app.window("main", Home::boxed);
let _run = app.run("main");

Each window owns its routes and retained Back and Forward history. Windows are addressed by name and key, while screen instances receive their own arguments and navigation-state hooks. The same application structure is implemented by facet_appkit, facet_uikit, facet_android, facet_gtk, and facet_win32.

The runtime and optional agent integration now live in the facet_runtime and facet_agent packages. The previous app.screen, Screen::chrome, runtime::Window, and global content-navigation APIs have been removed. The release notes contain the complete migration list and a link to the detailed navigation table.

Native platform work

The new Facet backends are part of a broader platform pass:

• Windows has a complete host toolchain path, native Facet and agent surfaces, WinHTTP, filesystem watching, camera capture, secure storage, file picking, notifications, permissions, and haptics.
• Linux has the rebuilt GTK Facet and agent surfaces, plus native process and PTY support, terminal integration, HTTP, inotify, camera preview, location, secure storage, and file picking.
• Android has a native Facet runtime and agent surface, recycler-backed controls, native input and rendering, notifications, application links, secure storage, file picking, and Maven/AAR dependency resolution.
• iOS has a broader UIKit surface with multiwindow behavior, keyboard handling, context menus, agent access, notifications, application links, and camera and device integrations.

Capability packages cover notifications, application links, camera, location, sensors, biometrics, secure storage, permissions, file picking, haptics, sharing, HTTP, and filesystem watching. Each backend either implements the capability or reports that it is unsupported explicitly.

Agent access uses explicit grants

The agent surface no longer reduces authorization to one allow or reject decision. Every in-process or external caller receives a Grant containing the exact capabilities it may use: ordinary read and action, protected read and action, private read and action, and structural tree editing.

Open, Protected, Private, and Excluded sensitivity tiers are inherited through the UI tree. Exposure, sensitivity, whether a control is wired, and whether the caller has the required grant are checked separately before native input is sent. Text edits remain versioned so a stale agent write returns a conflict instead of replacing newer text.

AppKit, UIKit, Android, GTK, and Win32 all expose the same semantic surface. agent_mcp transports it over JSON-RPC/MCP, while agent_inapp provides the same operations without a socket.

Completion and warm project sessions

cpc query complete, MCP's complete_at, and LSP textDocument/completion now call the same compiler implementation. The compiler decides whether a caret is asking for scope names, module items, or members and returns one ranked answer.

The LSP and MCP servers keep a project graph warm instead of rebuilding it for every request. LSP project loading also resolves declared dependencies, so a real package graph no longer falls back to single-file behavior because its vendor imports appear missing.

Language, concurrency, and packages

Async entry points are compiler-driven in 0.0.28. Use async fn main and async #[test]; synchronous code can consume a future with .wait() or future::wait_or_cancel. The old executor::block_on and executor::run entry points have been removed. Future teardown, detached tasks, scoped threads, reactors, sockets, and Windows pipe waits also gained stronger cancellation behavior.

Project manifests now use entry for applications and [library] for C ABI libraries. [[bin]] and [lib] have been removed. Package resolution supports exact tagged dependencies, a per-user store, local vendor overrides, and Android Maven/AAR dependencies.

Other migration points include:

• guard let complements use else Pattern, without pipe delimiters.
• Raw SQLite bindings are imported as sqlite/raw.
• static-arena is now static_arena.
• terminal/appkit is now the platform-neutral terminal/backend.
• Multiple UI selections are represented as a set.

The compiler also fixes method-local This resolution, preserves public statics in package archives, and archives one object per module so consumers link only the package modules they reach.

Install and read

brew install netdur/cplus/cplus
cpc --version

Linux and Windows builds are available from the GitHub releases page. The C+ 0.0.28 manual documents the current project, and the complete release notes list every shipped change and migration item. Earlier manuals remain available under /docs/{version}.