From ac60b294edfff61208afc71f81f5b10fe06d9528 Mon Sep 17 00:00:00 2001
From: Vitor Pamplona <vitor@vitorpamplona.com>
Date: Wed, 15 Jul 2026 10:33:14 -0400
Subject: [PATCH] fix(strictmode): stop CleartextNetworkViolation noise from
 the Tor SOCKS proxy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

detectCleartextNetwork() is enforced by netd per-UID at the packet level: it
flags any socket whose first bytes aren't a TLS handshake, with no per-host
exemption. Every relay WebSocket tunneled over the embedded Arti Tor SOCKS
proxy on 127.0.0.1:17392 opens with a cleartext SOCKS5 greeting, so the
detector fired constantly on legitimate loopback traffic.

The Network-Security-Config localhost allowlist does NOT silence it — that flag
only governs the voluntary NetworkSecurityPolicy.isCleartextTrafficPermitted()
check that HTTP stacks consult, not netd's packet inspection. The old XML
comment claiming otherwise was wrong.

Drop the detector (the app already permits cleartext globally for ws:// relays,
so it produced little signal) and correct the misleading comment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../vitorpamplona/amethyst/service/logging/Logging.kt    | 9 ++++++++-
 amethyst/src/main/res/xml/network_security_config.xml    | 7 +++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt b/amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt
index ad9a307efc..6ba703477d 100644
--- a/amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt
+++ b/amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt
@@ -43,7 +43,14 @@ class Logging {
                     .detectLeakedClosableObjects()
                     .detectLeakedRegistrationObjects()
                     .detectFileUriExposure()
-                    .detectCleartextNetwork()
+                    // detectCleartextNetwork() is intentionally NOT enabled. netd enforces it
+                    // per-UID at the packet level (it flags a socket whose first bytes aren't a
+                    // TLS handshake) and there is no per-host exemption. Every relay WebSocket
+                    // tunneled over the embedded Arti Tor SOCKS proxy on 127.0.0.1:17392 opens
+                    // with a cleartext SOCKS5 greeting, so this detector fires constantly on
+                    // legitimate loopback traffic. The Network-Security-Config localhost
+                    // allowlist does NOT silence it — that flag only governs the voluntary
+                    // NetworkSecurityPolicy.isCleartextTrafficPermitted() check, not netd.
                     .detectContentUriWithoutPermission()
                     .apply {
                         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
diff --git a/amethyst/src/main/res/xml/network_security_config.xml b/amethyst/src/main/res/xml/network_security_config.xml
index 78948e9698..fdf4d8885a 100644
--- a/amethyst/src/main/res/xml/network_security_config.xml
+++ b/amethyst/src/main/res/xml/network_security_config.xml
@@ -1,8 +1,11 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
     Cleartext traffic is permitted globally so user-configured ws:// relays keep working.
-    The explicit localhost domain-config silences StrictMode CleartextNetworkViolation
-    for the Tor SOCKS proxy on 127.0.0.1.
+    The explicit localhost domain-config keeps NetworkSecurityPolicy.isCleartextTrafficPermitted()
+    happy for loopback services (the Tor SOCKS proxy on 127.0.0.1:17392, the local Blossom cache
+    on :24242). Note: this does NOT silence StrictMode's detectCleartextNetwork() — that detector
+    runs in netd at the packet level and ignores this allowlist, which is why we don't enable it
+    (see Logging.kt).
 -->
 <network-security-config>
     <base-config cleartextTrafficPermitted="true">