mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-09 08:04:45 +00:00
Claude
daae12b53d
Implements the Android side of the napplet/nsite trust boundary on top of the commons core. The applet runs in a separate OS process holding no keys; every dangerous operation is brokered to the main process and gated by user consent. :napplet process (no secrets): - NappletHostActivity: hardened WebView (no file/content access, no DOM storage, mixed-content blocked, SafeBrowsing on), applet served into an opaque-origin sandboxed iframe, manifest blobs served already-verified via shouldInterceptRequest with a default-deny CSP (connect-src 'none' = no direct network), and a window.napplet.* shim bridged over an origin-restricted WebMessageListener. Main process (holds the signer): - NappletBrokerService: bound Messenger service running the commons NappletBroker against the live account; exported=false + UID check. Builds the broker per request so account switches are honored; relay publish via the account's computed broadcast relays. - NappletConsentActivity + NappletConsentCoordinator: capability-consent dialog with a suspend bridge; fails closed on dismissal. - DataStoreNappletPermissionStore: persistent grant store. Shared edge: NappletProtocolJson (JSON codec), NappletIpc (Messenger contract), NappletLauncher (packs a verified manifest into the host Intent), shell.html. Adds androidx.webkit (Apache-2.0) for the origin-restricted message bridge — a plain @JavascriptInterface leaks into every frame and would break the boundary. Manifest declares the :napplet activity, the consent activity, and the broker service. :amethyst:compileFdroidDebugKotlin passes; on-device verification and a UI entry point are the remaining steps (see the plan doc). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016ncMHuBBVHEf7spAoSssde