Repository navigation
Termux:API bridge: restore the socket read, fix the review findings, clean build - #35
Merged
Merged
Conversation
…ile, and the user startup hook The Termux:API command surface runs entirely in-app: a per-ABI C helper spoke the abstract-UDS wire protocol with a listener in the app process, and the guest scripts reach Android features without a second SSH, camera or SMS stack. The manifest is trimmed to a defensible core so the app stops reading as a trojan profile to Play Protect, and the dispatch gate distinguishes a missing grant from an undeclared permission so affected commands answer honestly instead of dying in a pipe. /root/.startup.local is the user-managed, once-per-interactive-session startup hook (issue 32); it is in the shared tail of the generated startup for all twenty distros, and redterm-startup-local prints a safe starter body that is a no-op wherever run-parts or /etc/update-motd.d is absent. versionCode 8 / versionName 2.4.0.
…erence The gate is reading the w: lines of compileDebugKotlin, not the exit code, and 13 compiler warnings had slipped through being reported as a clean build. None is fixed by a suppression: - The five unchecked as? List<T> casts on reflective results (CellInfoApi, NetworkApis, SsidApi) become a star-projection cast plus per-element concrete casts, which the compiler can check. - The eight deprecated references stop being references: ScanResult.SSID is read by name (withdrawn on 33); setVisibleInDownloadsUi is invoked reflectively on the levels where it still has effect (<29, a documented no-op since); the no-arg MediaRecorder is reached by name with the Context constructor on 34+; the withdrawn CDMA/EHRPD/1xRTT constants stand as their stable documented values; the three-argument Locale constructor becomes Locale.forLanguageTag (non-deprecated on every level the app runs); and setWifiEnabled is reached by name on the declared type.
…unded reads, and close the review's gaps Guest paths are named on the distro side, but the bridge opens them in the app process. The launcher now exports REDTERM_ROOTFS_HOST, the guest helper attaches it to every request, and ApiPaths is the one place that projects a guest path to the host path it actually lives at (or refuses it). Share, storage-get, media-play and media-scan all go through it. Also, per the review: - ApiSocket reads run on a bounded pool with a deadline; LocalSocket has no read-timeout API, so a stuck peer is bounded by the pool cap and closed, not pinned. Response bodies over the uint16 field are refused, not sent. - A read/write size cap on saf readDocument; a counter-range guard; a bounded callback read; a non-cyclic media scan; a bound on concurrent requests. - A single JSON string encoder (ApiJson) so an SSID with control bytes is valid JSON; TtsApi keeps the exact language/region/variant; the wifi toggle checks its grant and a present boolean flag; NFC rejects a disabled radio, re-enables reader mode on resume, and posts a cancel on destroy. - installOne only replaces scripts it owns (the marker); ensureInstalled clears just the binary and stamp, keeping feature output. - the startup-hook sourcing test now runs the block the generator emits, not a hand copy. Helper binaries rebuilt for all four ABIs; GUEST_SCRIPT_VERSION is 7.
…host wire line con.peerCredentials can throw IOException; unguarded it skipped every writeResponse and the guest saw 'no response from the app'. The uid guard now catches the read and says which way it closed, instead of vanishing. Also pin the parser against the exact rootfs-host line the rebuilt helper puts on the wire, and finish the F-Droid metadata for v2.4.0.
A 'no response from the app' from the guest means the connection was accepted and then closed without an answer. Several paths did that silently: the uid guard (peerCredentials can throw), a peer that closed before sending, and nothing marked the listener coming up. Every outcome now logs, so the next on-device run says exactly which branch closed the connection instead of vanishing. Also pin the parser against the battery-status wire line with the rootfs-host extra the rebuilt helper emits.
… pool On device the pooled read stopped after 'connection accepted; reading request' and never reached any outcome, so the guest saw 'no response from the app'. The last release read inline on the request thread and worked. Revert that one change: a stuck peer blocks only its own request thread (capped by the semaphore), which LocalSocket cannot bound any other way, and is the approach that is proven on device. The safe uid guard and the per-outcome logging are kept.
|
Caution Review failedThe pull request is closed. Walkthrough
Merge Risk:
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the in-app termux:API bridge (guest helper over an abstract Unix socket, per-feature API actions), and closes the outstanding review findings.
This branch specifically:
Summary by CodeRabbit