3 Commits

Author	SHA1	Message	Date
Yaojia Wang	c1612d0145	build(android): make release buildable and instrumented testing possible ... Four gaps that made "ship it" and "test it on hardware" impossible. RELEASE SIGNING. assembleRelease was silently producing app-release-unsigned.apk because there was no signingConfigs block at all — the failure mode where you only notice at install time. Credentials now resolve from keystore.properties, then local.properties, then WEBTERM_RELEASE_* env; nothing is created or committed, and keystore.properties.example is the template. The degradation is ENFORCED, not documented. The signingConfig is only created when credentials actually resolve — an empty config is precisely what makes AGP emit an unsigned artifact quietly — and a guard on packageRelease throws with an actionable message, distinguishing "not configured" from "credentials found but the keystore file is missing: <path>". It hooks the PACKAGE task on purpose: R8 has already run and reported by then, so a developer without a keystore still gets the full shrink result rather than an early abort. Verified: minifyReleaseWithR8 completes, packageRelease fails loudly, and no unsigned APK is written. VERSIONING. Was still the scaffold 1 / "0.1.0". Now 1 / "0.1.0-alpha01", where the suffix is a factual claim about device verification rather than decoration: alpha means device QA is essentially unstarted, beta means the A34/A35 checklist blocks pass on hardware, and plain 0.1.0 means the whole checklist is ticked. versionCode stays 1 because no artifact has ever left the build machine. MINIFICATION. release had isMinifyEnabled = false and an empty rules file — so nothing had ever exercised R8 on this app, and the first release build would have been the experiment. Now minify + resource shrinking, with a deliberately short rules file: the actual artifacts were checked, and kotlinx.serialization, Tink, Hilt, FCM, OkHttp, Compose and CameraX all ship their own consumer rules, so none are re-declared. The termux packages are kept whole because the JitPack artifacts ship no rules and :terminal-view binds to non-API internals — it writes the public TerminalView.mEmulator field and calls TerminalRenderer.getFontWidth()/getFontLineSpacing(). Getting that wrong yields a build that crashes only in production. lintVitalRelease also passes now, the two pre-existing lint ERRORS having been fixed earlier this session. ANDROID TEST ENABLEMENT. :app had no androidTest source set and no instrumentation runner, which is the mechanical reason A34/A35 have no code at all. The runner (Hilt-aware) and dependencies are wired, and a :macrobenchmark module exists. The tests themselves are a separate change. Verified: ./gradlew test :app:assembleDebug :app:assembleDebugAndroidTest :app:assembleBenchmark :macrobenchmark:assembleBenchmark :app:lintVitalRelease koverVerify -> BUILD SUCCESSFUL; 901 JVM tests, 0 failures on a forced re-execution with test-results deleted and --no-build-cache.	2026-07-30 12:14:53 +02:00
Yaojia Wang	e254918b1c	feat(android): native Android client — full app parity build (A1–A36 + S1) ... Mirror the iOS P0+P1 client as a Gradle multi-module app. Pure-JVM (Kover ≥80% gated): :wire-protocol (frozen contract + HostEndpoint CSWSH origin + byte-exact codec), :session-core (SessionEngine + reconnect/ping/gate/digest reducers), :api-client, :client-tls (pure PKCS12/keymanager), :transport-okhttp (OkHttp WS+REST). Framework: :app (Compose M3 Adaptive, Hilt, FCM, 11 screens + NavGraph), :terminal-view (Termux terminal-emulator/-view via JitPack, Apache-2.0 — the renderer seam proven headless), :host-registry (DataStore), :client-tls-android (AndroidKeyStore + Tink). Highlights: single-key-home mTLS (non-exportable AndroidKeyStore key + re-reading X509KeyManager + connectionPool.evictAll on rotation, ping-pong single-commit so a failed rotation never clobbers the prior identity); FCM Allow/Deny trust split (Deny=BroadcastReceiver, Allow=trampoline Activity hosting BiometricPrompt); per-consumer-Channel EventBus (R10); config-surviving RetainedSessionHolder; byte-exact KeyByteMap; §5.4 pairing warning tiers. Verified: ~484 JVM tests + Kover ≥80% on the pure modules + :app assembles to an APK; all framework modules assemble. Device behaviors (rendering/IME/FCM/biometric/camera, E2E A34/A35, S2 real-handset FCM spike) deferred to android/DEVICE_QA_CHECKLIST.md per plan §7 (no emulator/Firebase here). Built via multi-agent orchestration (TDD builders → adversarial cross-review → fix → re-verify → independent gate); progress in android/PROGRESS_ANDROID.md.	2026-07-10 16:41:21 +02:00
Yaojia Wang	4ea8f7862a	feat(android): pure-Kotlin foundation — AW0 scaffold + AW1 modules (218 tests green) ... Implements the verifiable pure-Kotlin core of the Android client per docs/ANDROID_CLIENT_PLAN.md, mirroring the iOS SPM package set as Gradle modules. Built + reviewed via multi-agent workflow (explore→implement→verify→review), then review findings fixed with regression tests. Modules (all pure JVM, kotlin("jvm"); Android-framework modules scaffolded but gated off in settings — no Android SDK in this env): - :wire-protocol — frozen wire contract (sealed Client/ServerMessage, enums, HostEndpoint CSWSH origin derivation, transport interfaces), hand-rolled codec byte-identical to the server's JSON.stringify + tolerant kotlinx decode. - :session-core — ReconnectMachine (1→2→4→8→16→30 backoff), PingScheduler, GateTracker (two-line epoch guard), AwayDigest, UnreadLedger, TitleSanitizer, KeyByteMap (byte-matches public/keybar.ts). - :api-client — all REST routes, tolerant decode, Origin-iff-guarded, prefs unknown-key preservation, pairing probe + host-tier classifier. - :client-tls — pure half: PKCS#12 parse, X509KeyManager alias logic, CertificateSummary, provider-agnostic wrong-passphrase classification. - :test-support — FakeTransport / FakeHttpTransport / virtual-clock fakes. Verify: ./gradlew clean test → 218 tests, 0 failures (wire-protocol 47, session-core 60, api-client 69, client-tls 27, test-support 15). Review (3 lenses, 8/10 each) findings fixed: sessionId JSON-injection escape, CancellationException propagation in PingScheduler, PairingProbe close-on-cancel leak, HostEndpoint trim, HostClassifier hoisted to :wire-protocol (type unified), BouncyCastle-portable wrong-passphrase detection, lone-surrogate escaping. Known gap (documented, deferred): /push/fcm-token has no server route yet — plan task A33 (src/push/fcm.ts) delivers it.	2026-07-08 13:45:07 +02:00