6 Commits

Author	SHA1	Message	Date
Yaojia Wang	980dbaa928	feat(android): wire the dead code, render the git panel, make the token gate real ... Four agents' worth of :app wiring. Everything here existed as tested code with zero production call sites, or as a screen rendering a shape the server stopped sending months ago. Dead code that shipped as features. All three were fully implemented and unit-tested while being reachable from nothing: - Session-list preview thumbnails. SessionsHome called SessionListScreen without the `thumbnails` argument, so the `= null` default won and every row rendered a placeholder forever — on the home session chooser, whose entire purpose is seeing what each session is doing. - Quick-reply chips and their palette editor. - PointerContextMenu (large-screen secondary click). ThumbnailPipeline's formal cross-review had been explicitly skipped when it was written — PROGRESS_ANDROID.md said so in as many words, and it is concurrency code, so nothing had ever reviewed OR executed it. It has now been reviewed and kept: the LruCache key, the fair Semaphore(2), the Mutex-guarded in-flight dedup and the NonCancellable in-flight release are all sound, and a retained map entry would have poisoned a key forever. The v0.6 project-detail git panel. Android rendered the pre-w6 shape: one bare dirty dot, a bare hash+subject commit row, and a worktree heading that renamed itself to "Branch" at n=1 — the exact behaviour G5 removed. Now the sync band, unpushed marking with a single upstream boundary, and "Worktrees (n)". The rule that drives it is enforced, not documented: exactly one state may render green, and no-upstream is not that state. Remote approvals are no longer blind. status.preview reaches GateBanner and PlanGateSheet, so the user can see the command or diff they are approving instead of a tool name. Absent preview stays an ordinary gate, not an error. The WEBTERM_TOKEN gate is no longer inert. NetworkModule was calling OkHttpClientFactory.create(identityProvider) with no cookieJar, so the shared client ran on CookieJar.NO_COOKIES and none of the cookie plumbing did anything. It now installs the real AuthCookieJar — one client, so the cookie rides the WS upgrade too — backed by the Tink-sealed store, and binds InMemoryAuthCookieStore if a cipher cannot be constructed rather than ever persisting a shell credential in the clear. The persister runs on an IO scope because OkHttp calls a CookieJar synchronously and must never block on DataStore or Tink. And the user-facing half that made the gate unusable: a token-gated host answers the pairing probe's unauthenticated GET with 401, which the frozen taxonomy could only report as "this port is running something else" — so such a host was impossible to pair AND the copy was misleading. Pairing now routes to a token prompt and resumes through the same cert-gate choke point. The token is a parameter, never a field and never part of any UI state. Docs corrected rather than left aspirational: the plan asserted a cleartext allowlist "permitted only for private LAN/Tailscale CIDRs", which the platform cannot express at all — the network-security-config format has no netmask or prefix syntax. PROGRESS_ANDROID.md now opens with what "COMPLETE" actually meant, and PROGRESS_LOG.md records the whole pass including what is still undone: A34/A35 have no code, and device QA remains ~0%. Verified: ./gradlew test :app:assembleDebug :app:testDebugUnitTest koverVerify -> BUILD SUCCESSFUL, 893 JVM tests, 0 failures (baseline was 617). The :app run was re-measured with outputs deleted and --no-build-cache, and the APK re-packaged, so Hilt graph validity is an observation rather than an up-to-date claim.	2026-07-30 11:23:23 +02:00
Yaojia Wang	3e5cfdc1cf	fix(android): make the terminal actually usable on a device ... The client built to an APK and 617 JVM tests passed, but nothing had ever run on hardware, and three defects made it unusable the moment it did. All three were invisible to the JVM suite because none of those tests instantiate an Android View. 1. Every key press crashed. `RemoteTerminalView` bound the forked emulator but never installed a `TerminalViewClient`, and the stock Termux view dereferences `mClient` with no null guard on the first line of the paths a user actually hits (`onKeyDown` offset 82, `onCreateInputConnection` offset 0, `onKeyUp`, `onKeyPreIme`). Installing any client is not enough: returning false continues into `mTermSession.write()` at offset 150, and `mTermSession` is null forever because `TerminalSession` is final and forking a process is what this app must not do. So the client consumes the key itself and `KeyRouting` has no defer-to-stock branch at all — the crash is unrepresentable, not merely avoided. Termux's `KeyHandler` stays the authority for the key tables, so DECCKM still emits `ESC O A`. 2. The PTY never learned the real size. Nothing called `RemoteTerminalSession.updateSize`, and the stock fallback is dead (`TerminalView.updateSize` early-returns without a session), so every full-screen TUI rendered into 80x24. `TerminalResizeDriver` now drives it from real cell metrics — read through the public `getFontWidth()` / `getFontLineSpacing()` accessors rather than reflection, which would break silently under R8, or a re-measured Paint, which would drift from what the renderer actually draws (plan risk R5). 3. Bare-LAN connections were impossible. `network_security_config.xml` was a self-labelled STUB denying all cleartext while `HostEndpoint` accepts http and derives ws://. The format has no CIDR syntax, so the allowlist its own comment promised cannot be written; cleartext is permitted in base-config, the tunnel domain keeps a TLS block, trust anchors are pinned to system-only, and the guard moves to the §5.4 pairing tiers. Adversarial review then found three more, and one it got wrong: - Swipe-scrolling inside an alternate-screen TUI still crashed. The touch path bypasses `TerminalViewClient` entirely: `doScroll` turns a scroll into `handleKeyCode` whenever the alternate buffer is active, and that dereferences `mTermSession`. Claude Code is an alternate-screen TUI, so this was a crash during normal use on the app's main screen. `TerminalScrollGesture` claims the vertical drag first and reproduces all three `doScroll` branches, closing the fling runnable and `onGenericMotionEvent` with it. - `autofill()` dereferences `mTermSession` unguarded while the view advertises itself autofillable, so any password manager crashed it. The subtree is excluded from the autofill structure. - The review asked for stock text selection to be restored. It cannot be: the ActionMode's own Copy and Paste handlers dereference the absent session, so a reachable selection UI has an NPE on its Copy button. Long press stays consumed and copy-out is recorded as a feature gap. Also: the WEBTERM_TOKEN cookie is carried on REST and the WS upgrade and sealed with Tink AEAD under an AndroidKeyStore key (fail-closed — a seal failure persists nothing rather than falling back to plaintext), and `allowBackup=false` keeps a 30-day shell credential off Google Drive. Verified: ./gradlew test :app:assembleDebug -> 757 JVM tests, 0 failures. Nothing here is device-verified yet; that is the next step.	2026-07-30 08:59:01 +02:00
Yaojia Wang	0b35dc043f	feat(android): wire zero-touch device enrollment + fix renew/cache (B-track) ... - wire the enroll flow into the app UI (EnrollmentScreen + ViewModel + Hilt DI + host-menu "自动获取证书"), mirroring iOS — Android previously only had manual .p12 import; the enroll library was built but unreachable. - renew is now mTLS-only ({csr}-only body, no Authorization header) matching the /device/:id/renew contract (the enroll bearer is minutes-lived → silent rotation would have thrown weeks later). - enroll refreshes the identity-repository cache so a mid-session-enrolled cert is presented on the next mTLS handshake without a process restart. gradle :app:assembleDebug + api-client/client-tls-android unit tests + koverVerify green. On-device QA (keygen/enroll/present) is the operator's step.	2026-07-19 08:31:29 +02:00
Yaojia Wang	bc31de85dd	feat(android): Projects/Diff/Worktree/git-write parity with web+iOS (W5) ... Brings the native Android client to parity with the web/iOS Projects + git surface, consuming the existing server endpoints — ZERO server change. (The "SDK-gated modules" premise was stale; they were already online.) - :api-client (pure Kotlin/JVM): PrStatus/GitLog/GitWrite models (tolerant decoders, safe-error), ProjectInfo + ahead/behind/lastCommitMs; 8 new Endpoints builders (projectPr/projectLog read-only; createWorktree/removeWorktree/prune/gitStage/ gitCommit/gitPush guarded w/ Origin) + ApiClient methods (PR/log degrade in body; writes 200→Ok / 429→RateLimited / 4xx-5xx→Rejected(safe msg)). - :app presenters (JVM-tested): DiffViewModel base-compare + git stage/commit/push; new WorktreeViewModel (create/remove/prune + client branch validation + isMain block); ProjectDetailViewModel failure-isolated PR-chip + recent-commits. - Compose screens wired: ProjectDetail (PR chip tappable only for https, recent commits, worktree create/remove-with-force/prune, view-diff), Diff (base input, per-file stage/unstage, commit/push bar), Projects (ahead/behind sync chip). Nav closes the pre-existing "no inbound link to the diff screen" gap. Verified independently: `./gradlew :app:assembleDebug test :api-client:koverVerify` BUILD SUCCESSFUL; 348 unit tests pass (api-client 102 / app 246); coverage gate held; git status android-only. Compose rendering/interaction deferred to on-device QA (android/DEVICE_QA_CHECKLIST.md), as prior Android waves did.	2026-07-13 05:58:28 +02:00
Yaojia Wang	e254918b1c	feat(android): native Android client — full app parity build (A1–A36 + S1) ... Mirror the iOS P0+P1 client as a Gradle multi-module app. Pure-JVM (Kover ≥80% gated): :wire-protocol (frozen contract + HostEndpoint CSWSH origin + byte-exact codec), :session-core (SessionEngine + reconnect/ping/gate/digest reducers), :api-client, :client-tls (pure PKCS12/keymanager), :transport-okhttp (OkHttp WS+REST). Framework: :app (Compose M3 Adaptive, Hilt, FCM, 11 screens + NavGraph), :terminal-view (Termux terminal-emulator/-view via JitPack, Apache-2.0 — the renderer seam proven headless), :host-registry (DataStore), :client-tls-android (AndroidKeyStore + Tink). Highlights: single-key-home mTLS (non-exportable AndroidKeyStore key + re-reading X509KeyManager + connectionPool.evictAll on rotation, ping-pong single-commit so a failed rotation never clobbers the prior identity); FCM Allow/Deny trust split (Deny=BroadcastReceiver, Allow=trampoline Activity hosting BiometricPrompt); per-consumer-Channel EventBus (R10); config-surviving RetainedSessionHolder; byte-exact KeyByteMap; §5.4 pairing warning tiers. Verified: ~484 JVM tests + Kover ≥80% on the pure modules + :app assembles to an APK; all framework modules assemble. Device behaviors (rendering/IME/FCM/biometric/camera, E2E A34/A35, S2 real-handset FCM spike) deferred to android/DEVICE_QA_CHECKLIST.md per plan §7 (no emulator/Firebase here). Built via multi-agent orchestration (TDD builders → adversarial cross-review → fix → re-verify → independent gate); progress in android/PROGRESS_ANDROID.md.	2026-07-10 16:41:21 +02:00
Yaojia Wang	4ea8f7862a	feat(android): pure-Kotlin foundation — AW0 scaffold + AW1 modules (218 tests green) ... Implements the verifiable pure-Kotlin core of the Android client per docs/ANDROID_CLIENT_PLAN.md, mirroring the iOS SPM package set as Gradle modules. Built + reviewed via multi-agent workflow (explore→implement→verify→review), then review findings fixed with regression tests. Modules (all pure JVM, kotlin("jvm"); Android-framework modules scaffolded but gated off in settings — no Android SDK in this env): - :wire-protocol — frozen wire contract (sealed Client/ServerMessage, enums, HostEndpoint CSWSH origin derivation, transport interfaces), hand-rolled codec byte-identical to the server's JSON.stringify + tolerant kotlinx decode. - :session-core — ReconnectMachine (1→2→4→8→16→30 backoff), PingScheduler, GateTracker (two-line epoch guard), AwayDigest, UnreadLedger, TitleSanitizer, KeyByteMap (byte-matches public/keybar.ts). - :api-client — all REST routes, tolerant decode, Origin-iff-guarded, prefs unknown-key preservation, pairing probe + host-tier classifier. - :client-tls — pure half: PKCS#12 parse, X509KeyManager alias logic, CertificateSummary, provider-agnostic wrong-passphrase classification. - :test-support — FakeTransport / FakeHttpTransport / virtual-clock fakes. Verify: ./gradlew clean test → 218 tests, 0 failures (wire-protocol 47, session-core 60, api-client 69, client-tls 27, test-support 15). Review (3 lenses, 8/10 each) findings fixed: sessionId JSON-injection escape, CancellationException propagation in PingScheduler, PairingProbe close-on-cancel leak, HostEndpoint trim, HostClassifier hoisted to :wire-protocol (type unified), BouncyCastle-portable wrong-passphrase detection, lone-surrogate escaping. Known gap (documented, deferred): /push/fcm-token has no server route yet — plan task A33 (src/push/fcm.ts) delivers it.	2026-07-08 13:45:07 +02:00