Merge pull request 'feat(pwa): remove install prompt' (#76) from dev into main

Reviewed-on: #76

.cargo/config.toml

@@ -0,0 +1,2 @@
+[env]
+MTP_TYPE_MAPS = { value = "mtp-type-maps/type-maps.yaml", relative = true }

.envrc

@@ -0,0 +1 @@
+use flake

.fallowrc.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json",
+  "entry": [
+    "src/index.{ts,tsx,js,jsx}",
+    "src/main.{ts,tsx,js,jsx}",
+    "apps/pwa/src/serviceWorker.ts",
+    "apps/tauri/render-version.ts",
+    "packages/**/*.test.ts"
+  ],
+  "workspaces": {
+    "packages": ["packages/*", "apps/*"]
+  },
+  "duplicates": {
+    "minOccurrences": 3,
+    "ignore": ["**/scripts/**", "**.test.ts", "licenses/**"]
+  },
+  "rules": {}
+}

.forgejo/workflows/dependency-builds.yml

@@ -0,0 +1,60 @@
+name: Dependency builds
+
+on:
+  pull_request:
+
+env:
+  FORGEJO_TOKEN: ""
+  GITHUB_TOKEN: ""
+
+jobs:
+  web:
+    if: ${{ github.actor == 'rasensprenger' }}
+    name: Build web
+    runs-on: nixos
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: git submodule update --init --recursive
+      - run: nix develop .#electron --command pnpm install --frozen-lockfile
+      - run: nix develop .#electron --command pnpm run build:packages
+      - run: nix develop .#electron --command pnpm run build:web
+
+  desktop:
+    if: ${{ github.actor == 'rasensprenger' }}
+    name: Build desktop
+    runs-on: nixos
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: git submodule update --init --recursive
+      - run: nix develop .#electron --command pnpm install --frozen-lockfile
+      - run: nix develop .#electron --command pnpm run build:packages
+      - run: nix develop .#electron --command pnpm run build:desktop
+
+  native-mtp:
+    if: ${{ github.actor == 'rasensprenger' }}
+    name: Test native MTP
+    runs-on: nixos
+    steps:
+      - run: nix profile add nixpkgs#nodejs_24
+      - uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: git submodule update --init --recursive
+      - run: nix develop .#electron --command bash -lc 'cd apps/tauri/src-tauri && cargo test'
+
+  mobile:
+    if: ${{ github.actor == 'rasensprenger' }}
+    name: Build mobile
+    runs-on: nixos
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: git submodule update --init --recursive
+      - run: nix develop .#tauri --command pnpm install --frozen-lockfile
+      - run: nix develop .#tauri --command pnpm run build:packages
+      - run: nix develop .#tauri --command pnpm --dir apps/tauri run build:mobile:ci

.forgejo/workflows/deploy-dev.yml

@@ -1,4 +1,5 @@
 on:
+  workflow_dispatch:
   push:
     branches:
       - dev
@@ -7,72 +8,103 @@ on:
 
 jobs:
   build-web:
-    runs-on: docker
+    runs-on: nixos
     steps:
       - name: Check out repo
         uses: https://data.forgejo.org/actions/checkout@v4
 
-      - name: Install Packages
+      - name: Pull git submodules
-        run: apt-get update && apt-get install -y sudo curl jq fakeroot dpkg rpm
+        run: git submodule update --init --recursive
-
-      - name: Install Nix
-        uses: https://github.com/cachix/install-nix-action@v30
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: nix develop .#electron --command pnpm install --frozen-lockfile
 
       - name: Copy licenses
-        run: bun run copy-licenses
+        run: nix develop .#electron --command pnpm run copy-licenses
 
       - name: Build packages
-        run: bun run build:packages
+        run: nix develop .#electron --command pnpm run build:packages
 
       - name: Build web
-        run: bun run build:web
+        run: nix develop .#electron --command pnpm run build:web
-
-      - name: Install rsync
-        run: apt-get update && apt-get install -y rsync
 
       - name: Deploy
-        run: rsync -a --delete apps/web/dist/ /var/lib/www/tensamin-web-dev/
+        run: nix develop .#electron --command rsync -a --delete apps/web/dist/ /var/lib/www/tensamin-web-dev/
 
   build-mobile:
-    runs-on: docker
+    runs-on: nixos
     steps:
       - name: Check out repo
         uses: https://data.forgejo.org/actions/checkout@v4
 
-      - name: Install Packages
+      - name: Pull git submodules
-        run: apt-get update && apt-get install -y sudo curl jq fakeroot dpkg rpm
+        run: git submodule update --init --recursive
-
-      - name: Install Nix
-        uses: https://github.com/cachix/install-nix-action@v30
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: nix develop .#tauri --command pnpm install --frozen-lockfile
 
       - name: Copy licenses
-        run: bun run copy-licenses
+        run: nix develop .#tauri --command pnpm run copy-licenses
 
       - name: Build packages
-        run: bun run build:packages
+        run: nix develop .#tauri --command pnpm run build:packages
 
       - name: Setup Android Keystore
         env:
           KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
           KEYSTORE_PROPERTIES: ${{ secrets.ANDROID_KEYSTORE_PROPERTIES }}
         run: |
-          bun -e "require('fs').writeFileSync('keystore.jks', Buffer.from(process.env.KEYSTORE_BASE64.replace(/\s+/g, ''), 'base64'))"
+          set -euo pipefail
-          bun -e "const content = process.env.KEYSTORE_PROPERTIES.replace(/\\n/g, '\n').replace(/\r/g, '').split('\n').map(l => l.trim()).filter(l => l).join('\n'); require('fs').writeFileSync('keystore.properties', content)"
+
+          if [ -z "$KEYSTORE_BASE64" ]; then
+            echo "ANDROID_KEYSTORE_BASE64 secret is missing or empty"
+            exit 1
+          fi
+
+          if [ -z "$KEYSTORE_PROPERTIES" ]; then
+            echo "ANDROID_KEYSTORE_PROPERTIES secret is missing or empty"
+            exit 1
+          fi
+
+          printf '%s' "$KEYSTORE_BASE64" \
+            | tr -d '[:space:]' \
+            | base64 -d > keystore.jks
+
+          printf '%s' "$KEYSTORE_PROPERTIES" \
+            | sed 's/\\n/\n/g' \
+            | tr -d '\r' \
+            | sed 's|^[[:space:]]*storeFile[[:space:]]*=.*|storeFile=keystore.jks|' \
+            > keystore.properties
+
+          grep -q '^[[:space:]]*storeFile[[:space:]]*=' keystore.properties || printf '\nstoreFile=keystore.jks\n' >> keystore.properties
+
+          if [ ! -s keystore.jks ]; then
+            echo "Decoded keystore.jks is missing or empty"
+            exit 1
+          fi
+
+          if [ ! -s keystore.properties ]; then
+            echo "Generated keystore.properties is missing or empty"
+            exit 1
+          fi
+
+          if ! grep -q '^[[:space:]]*keyAlias[[:space:]]*=' keystore.properties; then
+            echo "keystore.properties is missing keyAlias"
+            exit 1
+          fi
+
+          if ! grep -Eq '^[[:space:]]*(keyPassword|password)[[:space:]]*=' keystore.properties; then
+            echo "keystore.properties is missing keyPassword or password"
+            exit 1
+          fi
+
+          if ! grep -Eq '^[[:space:]]*(storePassword|password)[[:space:]]*=' keystore.properties; then
+            echo "keystore.properties is missing storePassword or password"
+            exit 1
+          fi
 
       - name: Build mobile
-        run: bun run build:mobile
+        run: nix develop .#tauri --command pnpm run build:mobile
 
       - name: Upload mobile artifact
         uses: https://data.forgejo.org/actions/upload-artifact@v3
@@ -81,7 +113,7 @@ jobs:
           path: apps/tauri/src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release.apk
 
   build-desktop:
-    runs-on: docker
+    runs-on: nixos
     strategy:
       matrix:
         target: [linux]
@@ -89,23 +121,22 @@ jobs:
       - name: Check out repo
         uses: https://data.forgejo.org/actions/checkout@v4
 
-      - name: Install Packages
+      - name: Pull git submodules
-        run: apt-get update && apt-get install -y sudo curl jq fakeroot dpkg rpm xz-utils
+        run: git submodule update --init --recursive
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: nix develop .#electron --command pnpm install --frozen-lockfile
 
       - name: Copy licenses
-        run: bun run copy-licenses
+        run: nix develop .#electron --command pnpm run copy-licenses
 
       - name: Build packages
-        run: bun run build:packages
+        run: nix develop .#electron --command pnpm run build:packages
 
       - name: Set Electron dev version
         run: |
+          nix develop .#electron --command bash <<'EOF'
+          set -euo pipefail
           VERSION="$(node -p "require('./package.json').version")"
           SHORT_SHA="$(git rev-parse --short HEAD)"
           DEV_VERSION="$VERSION-dev-$SHORT_SHA"
@@ -117,9 +148,15 @@ jobs:
             pkg.version = process.env.DEV_VERSION;
             fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + "\n");
           '
+          EOF
 
       - name: Build Electron desktop
-        run: bun run build:desktop
+        run: |
+          nix develop .#electron --command bash <<'EOF'
+          set -euo pipefail
+          cd apps/electron
+          pnpm run package:raw
+          EOF
 
       - name: Upload desktop artifacts
         uses: https://data.forgejo.org/actions/upload-artifact@v3
@@ -128,7 +165,7 @@ jobs:
           path: apps/electron/release/
 
   release:
-    runs-on: docker
+    runs-on: nixos
     needs: [build-web, build-mobile, build-desktop]
     steps:
       - name: Check out repo
@@ -136,14 +173,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install Packages
+      - name: Pull git submodules
-        run: apt-get update && apt-get install -y sudo curl jq
+        run: git submodule update --init --recursive
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: nix develop .#electron --command pnpm install --frozen-lockfile
 
       - name: Download mobile artifact
         uses: https://data.forgejo.org/actions/download-artifact@v3
@@ -160,21 +194,27 @@ jobs:
       - name: Read version and hash
         id: version
         run: |
+          nix develop .#electron --command bash <<'EOF'
+          set -euo pipefail
           VERSION="$(node -p "require('./package.json').version")"
           SHORT_SHA="$(git rev-parse --short HEAD)"
           echo "version=$VERSION" >> "$FORGEJO_OUTPUT"
           echo "short_sha=$SHORT_SHA" >> "$FORGEJO_OUTPUT"
           echo "tag=${VERSION}-dev-${SHORT_SHA}" >> "$FORGEJO_OUTPUT"
           echo "title=${VERSION}-dev-${SHORT_SHA}" >> "$FORGEJO_OUTPUT"
+          EOF
 
       - name: Copy releases
         env:
           TENSAMIN_RELEASE_VERSION: ${{ steps.version.outputs.tag }}
           TENSAMIN_RELEASE_TAG: ${{ steps.version.outputs.tag }}
         run: |
+          nix develop .#electron --command bash <<'EOF'
+          set -euo pipefail
           ASSET_BASE_URL="${{ forgejo.api_url }}"
           ASSET_BASE_URL="${ASSET_BASE_URL%/api/v1}/${{ forgejo.repository }}/releases/download/${{ steps.version.outputs.tag }}"
-          FORGEJO_RELEASE_ASSET_BASE_URL="$ASSET_BASE_URL" bun --bun run copy-releases
+          FORGEJO_RELEASE_ASSET_BASE_URL="$ASSET_BASE_URL" pnpm run copy-releases
+          EOF
 
       - name: Create pre-release and upload files
         env:
@@ -185,6 +225,7 @@ jobs:
           TAG: ${{ steps.version.outputs.tag }}
           TITLE: ${{ steps.version.outputs.title }}
         run: |
+          nix develop .#electron --command bash <<'EOF'
           set -eu
 
           test -d releases
@@ -273,3 +314,4 @@ jobs:
               -H "Authorization: token $TOKEN" \
               -F "attachment=@$file"
           done
+          EOF

.forgejo/workflows/deploy-prod.yml

@@ -1,4 +1,5 @@
 on:
+  workflow_dispatch:
   push:
     branches:
       - main
@@ -7,72 +8,103 @@ on:
 
 jobs:
   build-web:
-    runs-on: docker
+    runs-on: nixos
     steps:
       - name: Check out repo
         uses: https://data.forgejo.org/actions/checkout@v4
 
-      - name: Install Packages
+      - name: Pull git submodules
-        run: apt-get update && apt-get install -y sudo curl jq fakeroot dpkg rpm
+        run: git submodule update --init --recursive
-
-      - name: Install Nix
-        uses: https://github.com/cachix/install-nix-action@v30
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: nix develop .#electron --command pnpm install --frozen-lockfile
 
       - name: Copy licenses
-        run: bun run copy-licenses
+        run: nix develop .#electron --command pnpm run copy-licenses
 
       - name: Build packages
-        run: bun run build:packages
+        run: nix develop .#electron --command pnpm run build:packages
 
       - name: Build web
-        run: bun run build:web
+        run: nix develop .#electron --command pnpm run build:web
-
-      - name: Install rsync
-        run: apt-get update && apt-get install -y rsync
 
       - name: Deploy
-        run: rsync -a --delete apps/web/dist/ /var/lib/www/tensamin-web-prod/
+        run: nix develop .#electron --command rsync -a --delete apps/web/dist/ /var/lib/www/tensamin-web-prod/
 
   build-mobile:
-    runs-on: docker
+    runs-on: nixos
     steps:
       - name: Check out repo
         uses: https://data.forgejo.org/actions/checkout@v4
 
-      - name: Install Packages
+      - name: Pull git submodules
-        run: apt-get update && apt-get install -y sudo curl jq fakeroot dpkg rpm
+        run: git submodule update --init --recursive
-
-      - name: Install Nix
-        uses: https://github.com/cachix/install-nix-action@v30
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: nix develop .#tauri --command pnpm install --frozen-lockfile
 
       - name: Copy licenses
-        run: bun run copy-licenses
+        run: nix develop .#tauri --command pnpm run copy-licenses
 
       - name: Build packages
-        run: bun run build:packages
+        run: nix develop .#tauri --command pnpm run build:packages
 
       - name: Setup Android Keystore
         env:
           KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
           KEYSTORE_PROPERTIES: ${{ secrets.ANDROID_KEYSTORE_PROPERTIES }}
         run: |
-          bun -e "require('fs').writeFileSync('keystore.jks', Buffer.from(process.env.KEYSTORE_BASE64.replace(/\s+/g, ''), 'base64'))"
+          set -euo pipefail
-          bun -e "const content = process.env.KEYSTORE_PROPERTIES.replace(/\\n/g, '\n').replace(/\r/g, '').split('\n').map(l => l.trim()).filter(l => l).join('\n'); require('fs').writeFileSync('keystore.properties', content)"
+
+          if [ -z "$KEYSTORE_BASE64" ]; then
+            echo "ANDROID_KEYSTORE_BASE64 secret is missing or empty"
+            exit 1
+          fi
+
+          if [ -z "$KEYSTORE_PROPERTIES" ]; then
+            echo "ANDROID_KEYSTORE_PROPERTIES secret is missing or empty"
+            exit 1
+          fi
+
+          printf '%s' "$KEYSTORE_BASE64" \
+            | tr -d '[:space:]' \
+            | base64 -d > keystore.jks
+
+          printf '%s' "$KEYSTORE_PROPERTIES" \
+            | sed 's/\\n/\n/g' \
+            | tr -d '\r' \
+            | sed 's|^[[:space:]]*storeFile[[:space:]]*=.*|storeFile=keystore.jks|' \
+            > keystore.properties
+
+          grep -q '^[[:space:]]*storeFile[[:space:]]*=' keystore.properties || printf '\nstoreFile=keystore.jks\n' >> keystore.properties
+
+          if [ ! -s keystore.jks ]; then
+            echo "Decoded keystore.jks is missing or empty"
+            exit 1
+          fi
+
+          if [ ! -s keystore.properties ]; then
+            echo "Generated keystore.properties is missing or empty"
+            exit 1
+          fi
+
+          if ! grep -q '^[[:space:]]*keyAlias[[:space:]]*=' keystore.properties; then
+            echo "keystore.properties is missing keyAlias"
+            exit 1
+          fi
+
+          if ! grep -Eq '^[[:space:]]*(keyPassword|password)[[:space:]]*=' keystore.properties; then
+            echo "keystore.properties is missing keyPassword or password"
+            exit 1
+          fi
+
+          if ! grep -Eq '^[[:space:]]*(storePassword|password)[[:space:]]*=' keystore.properties; then
+            echo "keystore.properties is missing storePassword or password"
+            exit 1
+          fi
 
       - name: Build mobile
-        run: bun run build:mobile
+        run: nix develop .#tauri --command pnpm run build:mobile
 
       - name: Upload mobile artifact
         uses: https://data.forgejo.org/actions/upload-artifact@v3
@@ -81,7 +113,7 @@ jobs:
           path: apps/tauri/src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release.apk
 
   build-desktop:
-    runs-on: docker
+    runs-on: nixos
     strategy:
       matrix:
         target: [linux]
@@ -89,23 +121,22 @@ jobs:
       - name: Check out repo
         uses: https://data.forgejo.org/actions/checkout@v4
 
-      - name: Install Packages
+      - name: Pull git submodules
-        run: apt-get update && apt-get install -y sudo curl jq fakeroot dpkg rpm xz-utils
+        run: git submodule update --init --recursive
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: nix develop .#electron --command pnpm install --frozen-lockfile
 
       - name: Copy licenses
-        run: bun run copy-licenses
+        run: nix develop .#electron --command pnpm run copy-licenses
 
       - name: Build packages
-        run: bun run build:packages
+        run: nix develop .#electron --command pnpm run build:packages
 
       - name: Set Electron prod version
         run: |
+          nix develop .#electron --command bash <<'EOF'
+          set -euo pipefail
           VERSION="$(node -p "require('./package.json').version")"
           export VERSION
           node -e '
@@ -115,9 +146,15 @@ jobs:
             pkg.version = process.env.VERSION;
             fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + "\n");
           '
+          EOF
 
       - name: Build Electron desktop
-        run: bun run build:desktop
+        run: |
+          nix develop .#electron --command bash <<'EOF'
+          set -euo pipefail
+          cd apps/electron
+          pnpm run package:raw
+          EOF
 
       - name: Upload desktop artifacts
         uses: https://data.forgejo.org/actions/upload-artifact@v3
@@ -126,20 +163,17 @@ jobs:
           path: apps/electron/release/
 
   release:
-    runs-on: docker
+    runs-on: nixos
     needs: [build-web, build-mobile, build-desktop]
     steps:
       - name: Check out repo
         uses: https://data.forgejo.org/actions/checkout@v4
 
-      - name: Install Packages
+      - name: Pull git submodules
-        run: apt-get update && apt-get install -y sudo curl jq
+        run: git submodule update --init --recursive
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: nix develop .#electron --command pnpm install --frozen-lockfile
 
       - name: Download mobile artifact
         uses: https://data.forgejo.org/actions/download-artifact@v3
@@ -156,18 +190,24 @@ jobs:
       - name: Read version
         id: version
         run: |
+          nix develop .#electron --command bash <<'EOF'
+          set -euo pipefail
           VERSION="$(node -p "require('./package.json').version")"
           echo "version=$VERSION" >> "$FORGEJO_OUTPUT"
           echo "tag=$VERSION" >> "$FORGEJO_OUTPUT"
+          EOF
 
       - name: Copy releases
         env:
           TENSAMIN_RELEASE_VERSION: ${{ steps.version.outputs.tag }}
           TENSAMIN_RELEASE_TAG: ${{ steps.version.outputs.tag }}
         run: |
+          nix develop .#electron --command bash <<'EOF'
+          set -euo pipefail
           ASSET_BASE_URL="${{ forgejo.api_url }}"
           ASSET_BASE_URL="${ASSET_BASE_URL%/api/v1}/${{ forgejo.repository }}/releases/download/${{ steps.version.outputs.tag }}"
-          FORGEJO_RELEASE_ASSET_BASE_URL="$ASSET_BASE_URL" bun --bun run copy-releases
+          FORGEJO_RELEASE_ASSET_BASE_URL="$ASSET_BASE_URL" pnpm run copy-releases
+          EOF
 
       - name: Create release and upload files
         env:
@@ -177,6 +217,7 @@ jobs:
           SHA: ${{ forgejo.sha }}
           TAG: ${{ steps.version.outputs.tag }}
         run: |
+          nix develop .#electron --command bash <<'EOF'
           set -eu
 
           test -d releases
@@ -230,34 +271,43 @@ jobs:
               -H "Authorization: token $TOKEN" \
               -F "attachment=@$file"
           done
+          EOF
 
-      - name: Update root flake release hash
+      - name: Delete dev releases
         env:
-          TAG: ${{ steps.version.outputs.tag }}
+          TOKEN: ${{ forgejo.token }}
+          API: ${{ forgejo.api_url }}
+          REPO: ${{ forgejo.repository }}
         run: |
+          nix develop .#electron --command bash <<'EOF'
           set -eu
 
-          APPIMAGE="$(find releases -maxdepth 1 -type f -name 'Tensamin-*-linux-x86_64.AppImage' -print -quit)"
+          PAGE=1
-          test -n "$APPIMAGE"
+          DELETE_RELEASES=delete-dev-releases.tsv
 
-          HASH="$(node -e 'const fs = require("fs"); const crypto = require("crypto"); const file = process.argv[1]; console.log("sha256-" + crypto.createHash("sha256").update(fs.readFileSync(file)).digest("base64"));' "$APPIMAGE")"
+          : > "$DELETE_RELEASES"
-          export HASH
 
-          node -e '
+          while :; do
-            const fs = require("fs");
+            curl -fsS \
-            const version = process.env.TAG;
+              -H "Authorization: token $TOKEN" \
-            const hash = process.env.HASH;
+              "$API/repos/$REPO/releases?page=$PAGE&limit=50&pre-release=true" \
-            let content = fs.readFileSync("flake.nix", "utf8");
+              -o releases.json
-            content = content.replace(/version = "[^"]+";/, `version = "${version}";`);
-            content = content.replace(/hash = "sha256-[^"]+";/, `hash = "${hash}";`);
-            fs.writeFileSync("flake.nix", content);
-          '
 
-          if git diff --quiet -- flake.nix; then
+            COUNT="$(jq 'length' releases.json)"
-            echo "flake.nix already has the current release hash."
+            test "$COUNT" -gt 0 || break
-            exit 0
-          fi
 
-          git add flake.nix
+            jq -r \
-          git -c user.name="forgejo-actions" -c user.email="forgejo-actions@localhost" commit -m "(qol): update release flake hash"
+              '.[] | select(.prerelease == true) | select(.tag_name | contains("-dev-")) | [.id, .tag_name] | @tsv' releases.json \
-          git push
+              >> "$DELETE_RELEASES"
+
+            PAGE="$((PAGE + 1))"
+          done
+
+          while IFS="$(printf '\t')" read -r release_id release_tag; do
+            test -n "$release_id" || continue
+            echo "Deleting dev release $release_tag"
+            curl -fsS -X DELETE \
+              -H "Authorization: token $TOKEN" \
+              "$API/repos/$REPO/releases/$release_id"
+          done < "$DELETE_RELEASES"
+          EOF

.gitignore

@@ -1,2 +1,6 @@
 node_modules
 releases
+.fallow
+.direnv
+keystore.jks
+keystore.properties

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "mtp-type-maps"]
+	path = mtp-type-maps
+	url = https://git.methanium.net/tensamin/mtp-type-maps

.prettierignore

@@ -5,4 +5,5 @@ coverage
 *.tsbuildinfo
 bun.lock
 apps/tauri/src-tauri
+apps/electron/release
 licenses

LICENSE

@@ -1,16 +1,15 @@
-Copyright (c) [2025] [Methanium]
+Copyright (c) 2025 Methanium
+
 All rights reserved.
 
-This software is protected by copyright. Copying, editing,
+No part of this software, source code, documentation, or
-distributing, publicly performing, or any other use of this software
+associated materials may be copied, reproduced, modified,
-or its components, in source or binary form, is strictly prohibited without the express
+distributed, published, sublicensed, sold, or used to create
-written permission of the copyright holder.
+derivative works without prior written permission from the
+copyright holder.
 
-FUTURE LICENSE ACCEPTANCE:
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY
-It is the copyright holder's intention to release this software in the future
+OF ANY KIND, EXPRESS OR IMPLIED. TO THE MAXIMUM
-under a license yet to be defined, which will, among other things,
+EXTENT PERMITTED BY LAW, THE COPYRIGHT HOLDER SHALL
-allow private, non-commercial use. This statement does not constitute
+NOT BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
-a current license grant and does not alter the above
+LIABILITY ARISING FROM THE SOFTWARE OR ITS USE.
-prohibition on use, copying, or modification. Until the formal
-publication of such a future license, all rights remain
-reserved.

README

@@ -0,0 +1,3 @@
+# Information
+
+All dev releases get deleted upon creation of the latest prod release.

TODO

@@ -0,0 +1,6 @@
+- Add a bunch of tests
+- Full accessability
+- Add settings saving & update onboarding to use it
+- Add onboarding page to load one profile during onboarding
+
+-> Most folders in packages/ have specific todos

apps/electron/.gitignore

@@ -1,2 +1,2 @@
 dist
-release
+release

apps/electron/flake.lock

@@ -1,61 +0,0 @@
-{
-  "nodes": {
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1779508470,
-        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "29916453413845e54a65b8a1cf996842300cd299",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

apps/electron/flake.nix

@@ -1,88 +0,0 @@
-{
-  description = "Electron Development Environment";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    flake-utils.url = "github:numtide/flake-utils";
-  };
-
-  outputs = {nixpkgs, flake-utils, ...}:
-    flake-utils.lib.eachDefaultSystem (system: let
-      pkgs = import nixpkgs {inherit system; config.allowUnfree = true;};
-      electronRuntimeLibs = with pkgs; [
-        alsa-lib
-        at-spi2-atk
-        at-spi2-core
-        atk
-        cairo
-        cups
-        dbus
-        expat
-        fontconfig
-        freetype
-        gdk-pixbuf
-        glib
-        gtk3
-        libdrm
-        libgbm
-        libglvnd
-        libnotify
-        libpulseaudio
-        libuuid
-        libxkbcommon
-        mesa
-        nspr
-        nss
-        pango
-        pipewire
-        systemd
-        wayland
-        # xorg
-        libX11
-        libXScrnSaver
-        libXcomposite
-        libXcursor
-        libXdamage
-        libXext
-        libXfixes
-        libXi
-        libXrandr
-        libXtst
-        libxcb
-      ];
-    in {
-      devShells.default = pkgs.mkShell {
-        packages = with pkgs; [
-          nodejs_22
-          corepack_22
-          bun
-          electron
-          pkg-config
-          python3
-          gcc
-          gnumake
-          git
-          jq
-          patchelf
-          dpkg
-          rpm
-          fpm
-        ] ++ electronRuntimeLibs;
-
-        shellHook = ''
-          export LD_LIBRARY_PATH="${pkgs.lib.makeLibraryPath electronRuntimeLibs}:$LD_LIBRARY_PATH"
-          export ELECTRON_ENABLE_LOGGING=1
-          export ELECTRON_OZONE_PLATFORM_HINT="''${ELECTRON_OZONE_PLATFORM_HINT:-auto}"
-          export NPM_CONFIG_TARGET_ARCH="''${NPM_CONFIG_TARGET_ARCH:-x64}"
-          export npm_config_build_from_source=true
-          export USE_SYSTEM_FPM=true
-
-          alias electron-install='cd ../.. && bun install'
-          alias electron-build-web='cd ../.. && bun run build:web'
-          alias electron-dev='bun run dev'
-          alias electron-package='bun run package:linux'
-          alias electron-validate='bun run validate'
-        '';
-      };
-    });
-}

apps/electron/package.json

@@ -5,44 +5,48 @@
   "description": "Tensamin desktop client",
   "author": "methanium",
   "homepage": "https://git.methanium.net/tensamin/client",
+  "desktopName": "Tensamin",
   "type": "module",
   "main": "dist/main/main.js",
   "scripts": {
     "clean": "rm -rf dist release",
-    "build:web": "cd ../.. && bun run build:web",
+    "lint": "eslint src",
+    "build:web": "cd ../.. && pnpm run build:web",
     "build": "tsc -p tsconfig.json && esbuild src/preload/preload.ts --bundle --platform=node --format=cjs --external:electron --outfile=dist/preload/preload.cjs",
-    "dev:raw": "cd ../.. && bun run build:web && cd apps/electron && bun run build && electron . --verbose",
+    "dev:raw": "cd ../.. && pnpm run build:web && cd apps/electron && pnpm run build && electron . --verbose",
-    "dev": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop --command bun run dev:raw; else bun run dev:raw; fi",
+    "dev": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop ../..#electron --command pnpm run dev:raw; else pnpm run dev:raw; fi",
-    "start:raw": "bun run build && electron .",
+    "start:raw": "pnpm run build && electron .",
-    "start": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop --command bun run start:raw; else bun run start:raw; fi",
+    "start": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop ../..#electron --command pnpm run start:raw; else pnpm run start:raw; fi",
-    "package:raw": "cd ../.. && bun run build:web && cd apps/electron && bun run build && electron-builder --publish never",
+    "package:raw": "cd ../.. && pnpm run build:web && cd apps/electron && pnpm run build && electron-builder --publish never",
-    "package": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop --command bun run package:raw; else bun run package:raw; fi",
+    "package": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop ../..#electron --command pnpm run package:raw; else pnpm run package:raw; fi",
-    "package:linux:raw": "cd ../.. && bun run build:web && cd apps/electron && bun run build && electron-builder --linux --publish never",
+    "package:linux:raw": "cd ../.. && pnpm run build:web && cd apps/electron && pnpm run build && electron-builder --linux --publish never",
-    "package:linux": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop --command bun run package:linux:raw; else bun run package:linux:raw; fi",
+    "package:linux": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop ../..#electron --command pnpm run package:linux:raw; else pnpm run package:linux:raw; fi",
-    "package:windows:raw": "cd ../.. && bun run build:web && cd apps/electron && bun run build && electron-builder --win --publish never",
+    "package:windows:raw": "cd ../.. && pnpm run build:web && cd apps/electron && pnpm run build && electron-builder --win --publish never",
-    "package:windows": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop --command bun run package:windows:raw; else bun run package:windows:raw; fi",
+    "package:windows": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop ../..#electron --command pnpm run package:windows:raw; else pnpm run package:windows:raw; fi",
-    "checksum": "bun scripts/generate-release-metadata.ts",
+    "checksum": "node scripts/generate-release-metadata.ts",
-    "generate-signing-key": "bun scripts/generate-signing-key.ts",
+    "generate-signing-key": "node scripts/generate-signing-key.ts",
-    "validate:raw": "bun run build && bun run package:linux:raw",
+    "validate:raw": "pnpm run build && pnpm run package:linux:raw",
-    "validate": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop --command bun run validate:raw; else bun run validate:raw; fi"
+    "validate": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop ../..#electron --command pnpm run validate:raw; else pnpm run validate:raw; fi"
-  },
-  "dependencies": {
-    "electron-updater": "^6.6.2"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "^26.1.2",
-    "electron": "^39.2.7",
+    "electron": "^43.3.0",
-    "electron-builder": "^26.0.12",
+    "electron-builder": "^26.15.3",
-    "esbuild": "^0.25.11",
+    "esbuild": "^0.28.1",
     "typescript": "~6.0.3"
   },
   "build": {
     "appId": "net.tensamin.client",
     "productName": "Tensamin",
+    "executableName": "tensamin",
     "artifactName": "Tensamin-${version}-${os}-${arch}.${ext}",
+    "icon": "build/icons/icon.png",
     "directories": {
       "output": "release"
     },
+    "toolsets": {
+      "appimage": "1.0.3"
+    },
     "files": [
       "dist/**/*",
       "package.json"
@@ -51,18 +55,50 @@
       {
         "from": "../web/dist",
         "to": "web"
+      },
+      {
+        "from": "build/icons",
+        "to": "icons",
+        "filter": [
+          "32x32.png",
+          "icon.png"
+        ]
       }
     ],
     "linux": {
-      "target": ["AppImage", "deb", "rpm"],
+      "target": [
+        "AppImage",
+        "deb",
+        "rpm"
+      ],
+      "icon": "build/icons",
+      "executableName": "tensamin",
       "category": "Network",
-      "maintainer": "methanium"
+      "maintainer": "Methanium",
+      "syncDesktopName": true,
+      "desktop": {
+        "entry": {
+          "Name": "Tensamin",
+          "StartupWMClass": "Tensamin"
+        }
+      }
     },
     "win": {
-      "target": ["nsis", "portable"]
+      "target": [
+        "nsis",
+        "portable"
+      ],
+      "icon": "build/icons/icon.ico"
     },
     "mac": {
-      "target": ["dmg"]
+      "target": [
+        "dmg"
+      ],
+      "icon": "build/icons/icon.icns",
+      "extendInfo": {
+        "NSCameraUsageDescription": "Tensamin uses your camera when you choose to share it in a call.",
+        "NSMicrophoneUsageDescription": "Tensamin uses your microphone for calls."
+      }
     },
     "publish": null
   }

apps/electron/scripts/generate-release-metadata.ts

@@ -1,5 +1,11 @@
 import { createHash } from "node:crypto";
-import { createReadStream, existsSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import {
+  createReadStream,
+  existsSync,
+  readdirSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import { basename, join } from "node:path";
 import rootPackage from "../../../package.json" with { type: "json" };
 
@@ -55,7 +61,10 @@ const metadata = {
   artifacts,
 };
 
-writeFileSync(join(outDir, "electron-release-metadata.json"), `${JSON.stringify(metadata, null, 2)}\n`);
+writeFileSync(
+  join(outDir, "electron-release-metadata.json"),
+  `${JSON.stringify(metadata, null, 2)}\n`,
+);
 writeFileSync(
   join(outDir, "SHA256SUMS"),
   `${artifacts.map((artifact) => `${artifact.sha256}  ${artifact.name}`).join("\n")}\n`,

apps/electron/src/main/main.ts

@@ -1,14 +1,41 @@
 import { execFile } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { dirname, join, resolve } from "node:path";
-import { app, BrowserWindow, desktopCapturer, ipcMain, session, shell } from "electron";
+import {
+  app,
+  BrowserWindow,
+  desktopCapturer,
+  globalShortcut,
+  ipcMain,
+  session,
+  shell,
+} from "electron";
 import { checkForUpdates } from "./updates.js";
-import { ipcChannels, type DesktopScreenShareCapabilities } from "../shared/ipc.js";
+import {
+  ipcChannels,
+  type DesktopCallStatus,
+  type DesktopGlobalHotkeyBinding,
+  type DesktopScreenShareAudioOutput,
+  type DesktopScreenShareCapabilities,
+} from "../shared/ipc.js";
+import { initTray, setTrayCallStatus } from "./tray.js";
+import {
+  clearSecureStorage,
+  deleteSecureStorage,
+  getSecureStorageStatus,
+  loadSecureStorage,
+  saveSecureStorage,
+} from "./secureStorage.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const verbose = process.argv.includes("--verbose");
 let mainWindow: BrowserWindow | null = null;
 let selectedScreenShareSourceId: string | null = null;
+let globalHotkeyBindings: DesktopGlobalHotkeyBinding[] = [];
+let globalHotkeysSuspended = false;
+
+app.setName("tensamin");
+app.setPath("userData", join(app.getPath("appData"), "tensamin", "electron"));
 
 if (verbose) {
   app.commandLine.appendSwitch("enable-logging", "stderr");
@@ -16,7 +43,25 @@ if (verbose) {
   app.commandLine.appendSwitch("log-level", "0");
 }
 
-if (process.platform === "linux" && process.env.XDG_SESSION_TYPE === "wayland" && !process.env.TENSAMIN_ENABLE_VULKAN) {
+if (
+  process.platform === "linux" &&
+  !app.commandLine.hasSwitch("password-store")
+) {
+  app.commandLine.appendSwitch("password-store", "gnome-libsecret");
+}
+
+if (
+  process.platform === "linux" &&
+  process.env.XDG_SESSION_TYPE === "wayland"
+) {
+  app.commandLine.appendSwitch("enable-features", "GlobalShortcutsPortal");
+}
+
+if (
+  process.platform === "linux" &&
+  process.env.XDG_SESSION_TYPE === "wayland" &&
+  !process.env.TENSAMIN_ENABLE_VULKAN
+) {
   app.commandLine.appendSwitch("disable-features", "Vulkan");
 }
 
@@ -34,6 +79,12 @@ function getRendererIndex() {
   return join(process.resourcesPath, "web", "index.html");
 }
 
+function getWindowIcon() {
+  if (process.platform === "darwin") return undefined;
+  if (app.isPackaged) return join(process.resourcesPath, "icons", "icon.png");
+  return resolve(__dirname, "../../build/icons/icon.png");
+}
+
 function getPlatform(): DesktopScreenShareCapabilities["platform"] {
   if (process.platform === "linux") return "linux";
   if (process.platform === "darwin") return "macos";
@@ -68,7 +119,7 @@ function execJson(command: string, args: string[]) {
   });
 }
 
-async function listAudioOutputs() {
+async function listAudioOutputs(): Promise<DesktopScreenShareAudioOutput[]> {
   verboseLog("listAudioOutputs", { platform: process.platform });
 
   if (process.platform !== "linux") return [];
@@ -81,11 +132,14 @@ async function listAudioOutputs() {
       if (!sink || typeof sink !== "object") return null;
       const record = sink as Record<string, unknown>;
       const id = record.index == null ? undefined : String(record.index);
-      const name = typeof record.description === "string" ? record.description : id;
+      const name =
+        typeof record.description === "string" ? record.description : id;
       if (!id || !name) return null;
       return { id, name, isDefault: false };
     })
-    .filter(Boolean);
+    .filter(
+      (output): output is DesktopScreenShareAudioOutput => output != null,
+    );
 }
 
 async function listScreenShareSources() {
@@ -107,30 +161,57 @@ async function listScreenShareSources() {
 }
 
 function registerDisplayMediaHandler() {
-  session.defaultSession.setDisplayMediaRequestHandler(async (_request, callback) => {
+  session.defaultSession.setDisplayMediaRequestHandler(
-    verboseLog("display media request", { selectedScreenShareSourceId });
+    async (_request, callback) => {
+      verboseLog("display media request", { selectedScreenShareSourceId });
 
-    const sources = await desktopCapturer.getSources({
+      const sources = await desktopCapturer.getSources({
-      types: ["screen", "window"],
+        types: ["screen", "window"],
-      thumbnailSize: { width: 0, height: 0 },
+        thumbnailSize: { width: 0, height: 0 },
-    });
+      });
 
-    const selected = sources.find((source) => source.id === selectedScreenShareSourceId);
+      const selected = sources.find(
-    selectedScreenShareSourceId = null;
+        (source) => source.id === selectedScreenShareSourceId,
-    const video = selected ?? sources[0];
+      );
+      selectedScreenShareSourceId = null;
+      const video = selected ?? sources[0];
 
-    if (!video) {
+      if (!video) {
-      callback({});
+        callback({});
-      return;
+        return;
+      }
+
+      if (process.platform === "win32") {
+        callback({ video, audio: "loopback" });
+        return;
+      }
+
+      callback({ video });
+    },
+  );
+}
+
+function registerMediaPermissionHandler() {
+  const isTrustedRenderer = (url: string) => {
+    try {
+      const parsed = new URL(url);
+      return parsed.protocol === "file:";
+    } catch {
+      return false;
     }
+  };
 
-    if (process.platform === "win32") {
+  session.defaultSession.setPermissionCheckHandler(
-      callback({ video, audio: "loopback" });
+    (_webContents, permission, requestingOrigin) =>
-      return;
+      permission === "media" && isTrustedRenderer(requestingOrigin),
-    }
+  );
-
+  session.defaultSession.setPermissionRequestHandler(
-    callback({ video });
+    (_webContents, permission, callback, details) => {
-  });
+      callback(
+        permission === "media" && isTrustedRenderer(details.requestingUrl),
+      );
+    },
+  );
 }
 
 function registerIpc() {
@@ -138,18 +219,77 @@ function registerIpc() {
 
   ipcMain.handle(ipcChannels.listScreenShareSources, listScreenShareSources);
   ipcMain.handle(ipcChannels.listScreenShareAudioOutputs, listAudioOutputs);
-  ipcMain.handle(ipcChannels.getScreenShareCapabilities, getScreenShareCapabilities);
+  ipcMain.handle(
-  ipcMain.handle(ipcChannels.selectScreenShareSource, (_event, sourceId: unknown) => {
+    ipcChannels.getScreenShareCapabilities,
-    if (typeof sourceId !== "string" || sourceId.length === 0 || sourceId.length > 256) {
+    getScreenShareCapabilities,
-      throw new Error("Invalid screen share source id.");
+  );
-    }
+  ipcMain.handle(
+    ipcChannels.selectScreenShareSource,
+    (_event, sourceId: unknown) => {
+      if (
+        typeof sourceId !== "string" ||
+        sourceId.length === 0 ||
+        sourceId.length > 256
+      ) {
+        throw new Error("Invalid screen share source id.");
+      }
 
-    selectedScreenShareSourceId = sourceId;
+      selectedScreenShareSourceId = sourceId;
-    verboseLog("selected screen share source", sourceId);
+      verboseLog("selected screen share source", sourceId);
-    return true;
+      return true;
-  });
+    },
+  );
   ipcMain.handle(ipcChannels.getVersion, () => app.getVersion());
   ipcMain.handle(ipcChannels.checkForUpdates, checkForUpdates);
+  ipcMain.handle(ipcChannels.getSecureStorageStatus, getSecureStorageStatus);
+  ipcMain.handle(ipcChannels.loadSecureStorage, (_event, key: unknown) =>
+    loadSecureStorage(key),
+  );
+  ipcMain.handle(
+    ipcChannels.saveSecureStorage,
+    (_event, key: unknown, value: unknown) => saveSecureStorage(key, value),
+  );
+  ipcMain.handle(ipcChannels.deleteSecureStorage, (_event, key: unknown) =>
+    deleteSecureStorage(key),
+  );
+  ipcMain.handle(ipcChannels.clearSecureStorage, clearSecureStorage);
+  ipcMain.handle(
+    ipcChannels.setGlobalHotkeyBindings,
+    (event, bindings: unknown) => {
+      assertTrustedRenderer(event);
+      return setGlobalHotkeyBindings(bindings);
+    },
+  );
+  ipcMain.handle(
+    ipcChannels.setGlobalHotkeysSuspended,
+    (event, suspended: unknown) => {
+      assertTrustedRenderer(event);
+      if (typeof suspended !== "boolean") {
+        throw new Error("Invalid hotkey suspension state.");
+      }
+      globalHotkeysSuspended = suspended;
+      return applyGlobalHotkeyBindings();
+    },
+  );
+  ipcMain.handle(ipcChannels.setCallStatus, (_event, status: unknown) => {
+    if (
+      typeof status !== "object" ||
+      status === null ||
+      typeof (status as DesktopCallStatus).inCall !== "boolean" ||
+      typeof (status as DesktopCallStatus).speaking !== "boolean" ||
+      ((status as DesktopCallStatus).iconDataUrl !== undefined &&
+        (typeof (status as DesktopCallStatus).iconDataUrl !== "string" ||
+          !(status as DesktopCallStatus).iconDataUrl?.startsWith(
+            "data:image/png;base64,",
+          ) ||
+          (status as DesktopCallStatus).iconDataUrl!.length > 16_384))
+    ) {
+      throw new Error("Invalid call status.");
+    }
+
+    const { inCall, iconDataUrl } = status as DesktopCallStatus;
+    setTrayCallStatus(inCall, iconDataUrl);
+  });
   ipcMain.handle(ipcChannels.minimizeWindow, () => {
     verboseLog("window:minimize");
     mainWindow?.minimize();
@@ -171,6 +311,90 @@ function registerIpc() {
   });
 }
 
+function assertTrustedRenderer(event: Electron.IpcMainInvokeEvent) {
+  const target = mainWindow;
+  if (
+    !target ||
+    target.isDestroyed() ||
+    event.sender !== target.webContents ||
+    event.senderFrame !== target.webContents.mainFrame
+  ) {
+    throw new Error("Untrusted hotkey IPC sender.");
+  }
+
+  try {
+    if (fileURLToPath(event.senderFrame.url) === getRendererIndex()) return;
+  } catch {
+    // Fall through to the rejection below.
+  }
+  throw new Error("Untrusted hotkey IPC sender.");
+}
+
+function validGlobalHotkeyBindings(
+  value: unknown,
+): value is DesktopGlobalHotkeyBinding[] {
+  return (
+    Array.isArray(value) &&
+    value.length <= 64 &&
+    value.every(
+      (binding) =>
+        binding &&
+        typeof binding === "object" &&
+        typeof (binding as DesktopGlobalHotkeyBinding).id === "string" &&
+        /^[a-z0-9.-]+$/i.test((binding as DesktopGlobalHotkeyBinding).id) &&
+        (binding as DesktopGlobalHotkeyBinding).id.length > 0 &&
+        (binding as DesktopGlobalHotkeyBinding).id.length <= 128 &&
+        typeof (binding as DesktopGlobalHotkeyBinding).accelerator ===
+          "string" &&
+        (binding as DesktopGlobalHotkeyBinding).accelerator.length > 0 &&
+        (binding as DesktopGlobalHotkeyBinding).accelerator.length <= 128,
+    )
+  );
+}
+
+function applyGlobalHotkeyBindings() {
+  globalShortcut.unregisterAll();
+  const statuses = Object.fromEntries(
+    globalHotkeyBindings.map(({ id }) => [id, false]),
+  );
+  if (globalHotkeysSuspended) return statuses;
+
+  const grouped = new Map<string, string[]>();
+  for (const { id, accelerator } of globalHotkeyBindings) {
+    const ids = grouped.get(accelerator) ?? [];
+    ids.push(id);
+    grouped.set(accelerator, ids);
+  }
+
+  for (const [accelerator, ids] of grouped) {
+    let registered = false;
+    try {
+      registered = globalShortcut.register(accelerator, () => {
+        const target = mainWindow;
+        if (!target || target.isDestroyed()) return;
+        ids.forEach((id) =>
+          target.webContents.send(ipcChannels.globalHotkeyTriggered, id),
+        );
+      });
+    } catch (error) {
+      console.error("Failed to register global hotkey", accelerator, error);
+    }
+    ids.forEach((id) => {
+      statuses[id] = registered;
+    });
+  }
+
+  return statuses;
+}
+
+function setGlobalHotkeyBindings(bindings: unknown) {
+  if (!validGlobalHotkeyBindings(bindings)) {
+    throw new Error("Invalid global hotkey bindings.");
+  }
+  globalHotkeyBindings = bindings;
+  return applyGlobalHotkeyBindings();
+}
+
 async function createWindow() {
   const rendererIndex = getRendererIndex();
   verboseLog("creating main window", {
@@ -191,6 +415,7 @@ async function createWindow() {
     minWidth: 900,
     minHeight: 600,
     title: "Tensamin",
+    icon: getWindowIcon(),
     frame: false,
     autoHideMenuBar: true,
     webPreferences: {
@@ -210,18 +435,24 @@ async function createWindow() {
   });
 
   if (verbose) {
-    mainWindow.webContents.on("console-message", (_event, level, message, line, sourceId) => {
+    mainWindow.webContents.on(
-      const target = level >= 2 ? console.error : console.log;
+      "console-message",
-      target("[tensamin:renderer]", message, { level, line, sourceId });
+      (_event, level, message, line, sourceId) => {
-    });
+        const target = level >= 2 ? console.error : console.log;
+        target("[tensamin:renderer]", message, { level, line, sourceId });
+      },
+    );
 
-    mainWindow.webContents.on("did-fail-load", (_event, errorCode, errorDescription, validatedURL) => {
+    mainWindow.webContents.on(
-      console.error("[tensamin:electron] renderer failed to load", {
+      "did-fail-load",
-        errorCode,
+      (_event, errorCode, errorDescription, validatedURL) => {
-        errorDescription,
+        console.error("[tensamin:electron] renderer failed to load", {
-        validatedURL,
+          errorCode,
-      });
+          errorDescription,
-    });
+          validatedURL,
+        });
+      },
+    );
 
     mainWindow.webContents.on("did-finish-load", () => {
       verboseLog("renderer finished loading", mainWindow?.webContents.getURL());
@@ -249,6 +480,10 @@ app.on("activate", () => {
   if (BrowserWindow.getAllWindows().length === 0) void createWindow();
 });
 
+app.on("will-quit", () => {
+  globalShortcut.unregisterAll();
+});
+
 if (verbose) {
   process.on("uncaughtException", (error) => {
     console.error("[tensamin:electron] uncaught exception", error);
@@ -265,6 +500,8 @@ async function start() {
   verboseLog("app ready");
   registerIpc();
   registerDisplayMediaHandler();
+  registerMediaPermissionHandler();
+  initTray(() => mainWindow);
   await createWindow();
 }
 

apps/electron/src/main/secureStorage.ts

@@ -0,0 +1,128 @@
+import { app, safeStorage } from "electron";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import {
+  secureStorageLimits,
+  type DesktopSecureStorageStatus,
+} from "../shared/ipc.js";
+
+type StoredValues = Record<string, string>;
+
+let pendingWrite = Promise.resolve();
+
+function storagePath() {
+  return join(app.getPath("userData"), "secure-storage.json");
+}
+
+function validateKey(key: unknown): asserts key is string {
+  if (
+    typeof key !== "string" ||
+    key.length === 0 ||
+    Buffer.byteLength(key, "utf8") > secureStorageLimits.maxKeyBytes
+  ) {
+    throw new Error("Invalid secure storage key.");
+  }
+}
+
+function validateValue(value: unknown): asserts value is string {
+  if (
+    typeof value !== "string" ||
+    Buffer.byteLength(value, "utf8") > secureStorageLimits.maxValueBytes
+  ) {
+    throw new Error("Invalid secure storage value.");
+  }
+}
+
+export function getSecureStorageStatus(): DesktopSecureStorageStatus {
+  const backend =
+    process.platform === "linux"
+      ? safeStorage.getSelectedStorageBackend()
+      : process.platform === "darwin"
+        ? "keychain"
+        : process.platform === "win32"
+          ? "dpapi"
+          : null;
+
+  return {
+    available:
+      safeStorage.isEncryptionAvailable() &&
+      (process.platform !== "linux" || backend !== "basic_text"),
+    backend,
+  };
+}
+
+function requireAvailable() {
+  if (!getSecureStorageStatus().available) {
+    throw new Error("Secure storage is unavailable.");
+  }
+}
+
+async function readValues(): Promise<StoredValues> {
+  try {
+    const parsed: unknown = JSON.parse(await readFile(storagePath(), "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("Invalid secure storage data.");
+    }
+
+    const values = parsed as Record<string, unknown>;
+    if (Object.values(values).some((value) => typeof value !== "string")) {
+      throw new Error("Invalid secure storage data.");
+    }
+    return values as StoredValues;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return {};
+    throw error;
+  }
+}
+
+async function writeValues(values: StoredValues) {
+  const path = storagePath();
+  const temporaryPath = `${path}.tmp`;
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  await writeFile(temporaryPath, JSON.stringify(values), { mode: 0o600 });
+  await rename(temporaryPath, path);
+}
+
+function mutateValues(mutation: (values: StoredValues) => void) {
+  const operation = pendingWrite.then(async () => {
+    const values = await readValues();
+    mutation(values);
+    await writeValues(values);
+  });
+  pendingWrite = operation.catch(() => undefined);
+  return operation;
+}
+
+export async function loadSecureStorage(key: unknown): Promise<string | null> {
+  requireAvailable();
+  validateKey(key);
+  await pendingWrite;
+  const encrypted = (await readValues())[key];
+  if (encrypted === undefined) return null;
+  return safeStorage.decryptString(Buffer.from(encrypted, "base64"));
+}
+
+export function saveSecureStorage(key: unknown, value: unknown) {
+  requireAvailable();
+  validateKey(key);
+  validateValue(value);
+  const encrypted = safeStorage.encryptString(value).toString("base64");
+  return mutateValues((values) => {
+    values[key] = encrypted;
+  });
+}
+
+export function deleteSecureStorage(key: unknown) {
+  requireAvailable();
+  validateKey(key);
+  return mutateValues((values) => {
+    delete values[key];
+  });
+}
+
+export function clearSecureStorage() {
+  requireAvailable();
+  return mutateValues((values) => {
+    for (const key of Object.keys(values)) delete values[key];
+  });
+}

apps/electron/src/main/tray.ts

@@ -0,0 +1,60 @@
+import { app, BrowserWindow, Menu, nativeImage, Tray } from "electron";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+let tray: Tray | null = null;
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+function getTrayIconPath(filename: string) {
+  if (app.isPackaged)
+    return path.join(process.resourcesPath, "icons", filename);
+  return path.resolve(__dirname, "../../build/icons", filename);
+}
+
+export function setTrayCallStatus(inCall: boolean, iconDataUrl?: string) {
+  if (!tray) return;
+
+  if (inCall && iconDataUrl) {
+    const image = nativeImage.createFromDataURL(iconDataUrl);
+    if (!image.isEmpty()) {
+      tray.setImage(image);
+      return;
+    }
+  }
+
+  tray.setImage(getTrayIconPath("32x32.png"));
+}
+
+export function initTray(getMainWindow: () => BrowserWindow | null) {
+  tray = new Tray(getTrayIconPath("32x32.png")); // keep reference alive
+
+  const contextMenu = Menu.buildFromTemplate([
+    {
+      label: "Restart",
+      type: "normal",
+      click: () => {
+        app.relaunch();
+        app.quit();
+      },
+    },
+    { label: "Quit", type: "normal", click: () => app.quit() },
+  ]);
+
+  tray.setContextMenu(contextMenu);
+
+  tray.on("click", () => {
+    const mainWindow = getMainWindow();
+    if (!mainWindow) return;
+
+    if (mainWindow.isVisible()) {
+      mainWindow.hide();
+      return;
+    }
+
+    if (mainWindow.isMinimized()) mainWindow.restore();
+    mainWindow.show();
+    mainWindow.focus();
+  });
+}

apps/electron/src/main/updates.ts

@@ -3,13 +3,21 @@ import { createReadStream } from "node:fs";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { app, net } from "electron";
-import type { ReleaseArtifact, ReleaseMetadata, UpdateCheckResult } from "../shared/ipc.js";
+import type {
+  ReleaseArtifact,
+  ReleaseMetadata,
+  UpdateCheckResult,
+} from "../shared/ipc.js";
 
 const metadataUrl = process.env.TENSAMIN_UPDATE_METADATA_URL;
 
 function compareSemver(left: string, right: string) {
-  const leftParts = left.split(/[.-]/).map((part) => Number.parseInt(part, 10) || 0);
+  const leftParts = left
-  const rightParts = right.split(/[.-]/).map((part) => Number.parseInt(part, 10) || 0);
+    .split(/[.-]/)
+    .map((part) => Number.parseInt(part, 10) || 0);
+  const rightParts = right
+    .split(/[.-]/)
+    .map((part) => Number.parseInt(part, 10) || 0);
   const length = Math.max(leftParts.length, rightParts.length);
 
   for (let index = 0; index < length; index += 1) {
@@ -42,7 +50,9 @@ function requestText(url: string): Promise<string> {
     const request = net.request(url);
     request.on("response", (response) => {
       if (response.statusCode < 200 || response.statusCode >= 300) {
-        reject(new Error(`Update request failed with HTTP ${response.statusCode}.`));
+        reject(
+          new Error(`Update request failed with HTTP ${response.statusCode}.`),
+        );
         return;
       }
 
@@ -86,7 +96,9 @@ async function sha256File(filePath: string) {
   return hash.digest("hex");
 }
 
-function selectArtifact(metadata: ReleaseMetadata): ReleaseArtifact | undefined {
+function selectArtifact(
+  metadata: ReleaseMetadata,
+): ReleaseArtifact | undefined {
   const platform = platformName();
   const arch = archName();
 
@@ -102,16 +114,26 @@ export async function checkForUpdates(): Promise<UpdateCheckResult> {
     return { available: false, currentVersion, latestVersion: currentVersion };
   }
 
-  const metadata = JSON.parse(await requestText(metadataUrl)) as ReleaseMetadata;
+  const metadata = JSON.parse(
+    await requestText(metadataUrl),
+  ) as ReleaseMetadata;
   const artifact = selectArtifact(metadata);
 
   if (isDevVersion(metadata.version) !== isDevVersion(currentVersion)) {
-    return { available: false, currentVersion, latestVersion: metadata.version };
+    return {
+      available: false,
+      currentVersion,
+      latestVersion: metadata.version,
+    };
   }
 
   if (isDevVersion(currentVersion)) {
     if (!artifact || metadata.version === currentVersion) {
-      return { available: false, currentVersion, latestVersion: metadata.version };
+      return {
+        available: false,
+        currentVersion,
+        latestVersion: metadata.version,
+      };
     }
 
     return {
@@ -123,7 +145,11 @@ export async function checkForUpdates(): Promise<UpdateCheckResult> {
   }
 
   if (!artifact || compareSemver(metadata.version, currentVersion) <= 0) {
-    return { available: false, currentVersion, latestVersion: metadata.version };
+    return {
+      available: false,
+      currentVersion,
+      latestVersion: metadata.version,
+    };
   }
 
   return {
@@ -140,7 +166,9 @@ export async function downloadVerifiedArtifact(artifact: ReleaseArtifact) {
   await mkdir(updatesDir, { recursive: true });
 
   const destination = join(updatesDir, basename(artifact.name));
-  await writeFile(destination, await requestBuffer(artifact.url), { mode: 0o600 });
+  await writeFile(destination, await requestBuffer(artifact.url), {
+    mode: 0o600,
+  });
 
   const actualHash = await sha256File(destination);
   if (actualHash !== artifact.sha256) {

apps/electron/src/preload/preload.ts

@@ -1,10 +1,24 @@
 import { contextBridge, ipcRenderer } from "electron";
-import { ipcChannels, type DesktopScreenShareSource } from "../shared/ipc.js";
+import {
+  ipcChannels,
+  type DesktopCallStatus,
+  type DesktopGlobalHotkeyBinding,
+  type DesktopScreenShareSource,
+  secureStorageLimits,
+} from "../shared/ipc.js";
 
 function windowAction(channel: string) {
   return () => ipcRenderer.invoke(channel);
 }
 
+function validKey(key: string) {
+  return (
+    typeof key === "string" &&
+    key.length > 0 &&
+    Buffer.byteLength(key, "utf8") <= secureStorageLimits.maxKeyBytes
+  );
+}
+
 const desktopApi = {
   media: {
     listScreenShareSources: () =>
@@ -27,6 +41,56 @@ const desktopApi = {
   updates: {
     checkForUpdates: () => ipcRenderer.invoke(ipcChannels.checkForUpdates),
   },
+  call: {
+    setStatus: (status: DesktopCallStatus) => {
+      if (
+        typeof status?.inCall !== "boolean" ||
+        typeof status?.speaking !== "boolean" ||
+        (status.iconDataUrl !== undefined &&
+          (typeof status.iconDataUrl !== "string" ||
+            !status.iconDataUrl.startsWith("data:image/png;base64,")))
+      ) {
+        return Promise.reject(new Error("Invalid call status."));
+      }
+
+      return ipcRenderer.invoke(ipcChannels.setCallStatus, status);
+    },
+  },
+  hotkeys: {
+    setBindings: (bindings: DesktopGlobalHotkeyBinding[]) =>
+      ipcRenderer.invoke(ipcChannels.setGlobalHotkeyBindings, bindings),
+    setSuspended: (suspended: boolean) =>
+      typeof suspended === "boolean"
+        ? ipcRenderer.invoke(ipcChannels.setGlobalHotkeysSuspended, suspended)
+        : Promise.reject(new Error("Invalid hotkey suspension state.")),
+    onTriggered: (callback: (id: string) => void) => {
+      const listener = (_event: Electron.IpcRendererEvent, id: unknown) => {
+        if (typeof id === "string") callback(id);
+      };
+      ipcRenderer.on(ipcChannels.globalHotkeyTriggered, listener);
+      return () => {
+        ipcRenderer.removeListener(ipcChannels.globalHotkeyTriggered, listener);
+      };
+    },
+  },
+  secureStorage: {
+    getStatus: () => ipcRenderer.invoke(ipcChannels.getSecureStorageStatus),
+    load: (key: string) =>
+      validKey(key)
+        ? ipcRenderer.invoke(ipcChannels.loadSecureStorage, key)
+        : Promise.reject(new Error("Invalid secure storage key.")),
+    save: (key: string, value: string) =>
+      validKey(key) &&
+      typeof value === "string" &&
+      Buffer.byteLength(value, "utf8") <= secureStorageLimits.maxValueBytes
+        ? ipcRenderer.invoke(ipcChannels.saveSecureStorage, key, value)
+        : Promise.reject(new Error("Invalid secure storage key or value.")),
+    delete: (key: string) =>
+      validKey(key)
+        ? ipcRenderer.invoke(ipcChannels.deleteSecureStorage, key)
+        : Promise.reject(new Error("Invalid secure storage key.")),
+    clear: () => ipcRenderer.invoke(ipcChannels.clearSecureStorage),
+  },
   window: {
     minimize: () => windowAction(ipcChannels.minimizeWindow),
     maximize: () => windowAction(ipcChannels.maximizeWindow),

apps/electron/src/shared/ipc.ts

@@ -20,6 +20,27 @@ export type DesktopScreenShareCapabilities = {
   hasReliableSystemAudio: boolean;
 };
 
+export type DesktopCallStatus = {
+  inCall: boolean;
+  speaking: boolean;
+  iconDataUrl?: string;
+};
+
+export type DesktopSecureStorageStatus = {
+  available: boolean;
+  backend: string | null;
+};
+
+export type DesktopGlobalHotkeyBinding = {
+  id: string;
+  accelerator: string;
+};
+
+export const secureStorageLimits = {
+  maxKeyBytes: 256,
+  maxValueBytes: 1024 * 1024,
+} as const;
+
 export type ReleaseArtifact = {
   name: string;
   platform: string;
@@ -55,4 +76,13 @@ export const ipcChannels = {
   closeWindow: "window:close",
   getVersion: "app:getVersion",
   checkForUpdates: "updates:checkForUpdates",
+  setCallStatus: "call:setStatus",
+  getSecureStorageStatus: "secureStorage:getStatus",
+  loadSecureStorage: "secureStorage:load",
+  saveSecureStorage: "secureStorage:save",
+  deleteSecureStorage: "secureStorage:delete",
+  clearSecureStorage: "secureStorage:clear",
+  setGlobalHotkeyBindings: "hotkeys:setBindings",
+  setGlobalHotkeysSuspended: "hotkeys:setSuspended",
+  globalHotkeyTriggered: "hotkeys:triggered",
 } as const;

apps/pwa/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@tensamin/pwa",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    "./vite": "./src/vite.ts",
+    "./runtime": "./src/runtime.tsx"
+  },
+  "scripts": {
+    "format": "pnpm exec prettier --write .",
+    "lint": "eslint src",
+    "build": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.worker.json --noEmit"
+  },
+  "dependencies": {
+    "@methanium/ui": "*",
+    "@tauri-apps/api": "^2.11.1",
+    "@tensamin/crypto": "workspace:*",
+    "@tensamin/shared": "workspace:*",
+    "@tensamin/storage": "workspace:*",
+    "mtp": "*",
+    "react": "^19.2.8",
+    "sonner": "^2.0.7",
+    "vite-plugin-pwa": "^1.1.0",
+    "workbox-core": "^7.3.0",
+    "workbox-precaching": "^7.3.0",
+    "workbox-routing": "^7.3.0",
+    "workbox-strategies": "^7.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.2",
+    "@types/react": "^19.2.18",
+    "typescript": "~6.0.3",
+    "vite": "^8.2.1"
+  }
+}

apps/pwa/src/runtime.tsx

@@ -0,0 +1,189 @@
+import { useEffect } from "react";
+import { toast } from "sonner";
+
+import { setDatabaseEntry } from "@tensamin/shared/indexedDb";
+import { isTauri } from "@tauri-apps/api/core";
+
+import "./style.css";
+
+const launchedFiles: File[] = [];
+const fileListeners = new Set<(file: File) => void>();
+
+function emitLaunchedFile(file: File) {
+  if (fileListeners.size === 0) launchedFiles.push(file);
+  else for (const listener of fileListeners) listener(file);
+}
+
+export function subscribeTuFileLaunch(listener: (file: File) => void) {
+  fileListeners.add(listener);
+  for (const file of launchedFiles.splice(0)) listener(file);
+  return () => {
+    fileListeners.delete(listener);
+  };
+}
+
+function isInstalledPwa() {
+  return (
+    window.matchMedia("(display-mode: standalone)").matches ||
+    window.matchMedia("(display-mode: window-controls-overlay)").matches ||
+    (navigator as Navigator & { standalone?: boolean }).standalone === true
+  );
+}
+
+function applicationServerKey(value: string) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+
+async function enablePush() {
+  if (!("Notification" in window))
+    throw new Error("Notifications are not supported by this browser.");
+  const permission = await Notification.requestPermission();
+  if (permission !== "granted")
+    throw new Error("Notification permission was not granted.");
+
+  const publicKey = import.meta.env.VITE_WEB_PUSH_PUBLIC_KEY;
+  if (
+    !publicKey ||
+    !("serviceWorker" in navigator) ||
+    !("PushManager" in window)
+  ) {
+    return;
+  }
+  const registration = await navigator.serviceWorker.ready;
+  const subscription =
+    (await registration.pushManager.getSubscription()) ??
+    (await registration.pushManager.subscribe({
+      userVisibleOnly: true,
+      applicationServerKey: applicationServerKey(publicKey),
+    }));
+  await setDatabaseEntry("keys", "push-subscription", subscription.toJSON());
+}
+
+function InstalledPwaRuntime() {
+  useEffect(() => {
+    if (
+      !("serviceWorker" in navigator) ||
+      !["http:", "https:"].includes(window.location.protocol)
+    ) {
+      return;
+    }
+    let reloading = false;
+    const handleControllerChange = () => {
+      if (reloading) return;
+      reloading = true;
+      // A newly activated service worker must reload the document it controls.
+      // eslint-disable-next-line tensamin/no-window-location-reload
+      window.location.reload();
+    };
+    navigator.serviceWorker.addEventListener(
+      "controllerchange",
+      handleControllerChange,
+    );
+    void navigator.serviceWorker
+      .register(
+        import.meta.env.DEV ? "/dev-sw.js?dev-sw" : "/serviceWorker.js",
+        {
+          type: "module",
+        },
+      )
+      .then((registration) => {
+        const watchWorker = (worker: ServiceWorker) => {
+          worker.addEventListener("statechange", () => {
+            if (worker.state !== "installed") return;
+            if (!navigator.serviceWorker.controller) {
+              toast.success("Tensamin is ready for offline startup");
+              return;
+            }
+            toast("A Tensamin update is ready", {
+              duration: Infinity,
+              action: {
+                label: "Update",
+                onClick: () => worker.postMessage({ type: "SKIP_WAITING" }),
+              },
+            });
+          });
+        };
+        if (registration.installing) watchWorker(registration.installing);
+        registration.addEventListener("updatefound", () => {
+          if (registration.installing) watchWorker(registration.installing);
+        });
+      })
+      .catch((error: unknown) => {
+        console.error("Failed to register the Tensamin service worker", error);
+      });
+    return () => {
+      navigator.serviceWorker.removeEventListener(
+        "controllerchange",
+        handleControllerChange,
+      );
+    };
+  }, []);
+
+  useEffect(() => {
+    const launchQueue = (
+      window as Window & {
+        launchQueue?: {
+          setConsumer: (
+            consumer: (params: {
+              files?: Array<{ getFile: () => Promise<File> }>;
+            }) => void,
+          ) => void;
+        };
+      }
+    ).launchQueue;
+    launchQueue?.setConsumer((params) => {
+      for (const handle of params.files ?? []) {
+        void handle.getFile().then(emitLaunchedFile);
+      }
+    });
+  }, []);
+
+  useEffect(() => {
+    if (
+      !("Notification" in window) ||
+      Notification.permission !== "default" ||
+      localStorage.getItem("pwa-push-hint")
+    ) {
+      return;
+    }
+    localStorage.setItem("pwa-push-hint", "shown");
+    toast("Enable message notifications", {
+      duration: Infinity,
+      action: {
+        label: "Enable",
+        onClick: () => {
+          void enablePush()
+            .then(() => toast.success("Notifications enabled"))
+            .catch((error: unknown) =>
+              toast.error(
+                error instanceof Error
+                  ? error.message
+                  : "Could not enable notifications",
+              ),
+            );
+        },
+      },
+    });
+  }, []);
+
+  useEffect(() => {
+    if (
+      "Notification" in window &&
+      Notification.permission === "granted" &&
+      import.meta.env.VITE_WEB_PUSH_PUBLIC_KEY
+    ) {
+      void enablePush().catch((error: unknown) => {
+        console.error("Failed to refresh the Web Push subscription", error);
+      });
+    }
+  }, []);
+
+  return null;
+}
+
+export default function PwaRuntime() {
+  if (isTauri() || !isInstalledPwa()) return null;
+  return <InstalledPwaRuntime />;
+}

apps/pwa/src/serviceWorker.ts

@@ -0,0 +1,161 @@
+/// <reference lib="webworker" />
+
+import { base64ToBytes } from "mtp";
+import { clientsClaim } from "workbox-core";
+import { cleanupOutdatedCaches, precacheAndRoute } from "workbox-precaching";
+import { NavigationRoute, registerRoute } from "workbox-routing";
+import { createHandlerBoundToURL } from "workbox-precaching";
+import { CacheFirst } from "workbox-strategies";
+
+import { decryptChatText, unwrapChatSecret } from "@tensamin/crypto/chatSecret";
+import { loadSecureBrowserValue } from "@tensamin/storage/browserSecure";
+
+declare let self: ServiceWorkerGlobalScope;
+
+type PushPayload = {
+  version: 1;
+  senderId: number;
+  sender: string;
+  avatar?: string;
+  message: { content: string };
+  secret: {
+    chatId: string;
+    secretId: string;
+    version: number;
+    encryptedSecret: string;
+    kemCiphertext: string;
+    wrappingScheme: string;
+  };
+};
+
+function isPushPayload(value: unknown): value is PushPayload {
+  if (!value || typeof value !== "object") return false;
+  const payload = value as Partial<PushPayload>;
+  const message = payload.message as
+    Partial<PushPayload["message"]> | undefined;
+  const secret = payload.secret as Partial<PushPayload["secret"]> | undefined;
+  const stringValues = [
+    payload.sender,
+    message?.content,
+    secret?.chatId,
+    secret?.secretId,
+    secret?.encryptedSecret,
+    secret?.kemCiphertext,
+    secret?.wrappingScheme,
+  ];
+  return (
+    payload.version === 1 &&
+    typeof payload.senderId === "number" &&
+    Number.isSafeInteger(payload.senderId) &&
+    payload.senderId > 0 &&
+    typeof secret?.version === "number" &&
+    stringValues.every((item) => typeof item === "string")
+  );
+}
+
+async function decryptPush(payload: PushPayload) {
+  const keyring = await loadSecureBrowserValue<string>("mtp_keyring");
+  if (!keyring) throw new Error("MTP credentials are unavailable.");
+  const chatSecret = await unwrapChatSecret({
+    encryptedSecret: base64ToBytes(payload.secret.encryptedSecret),
+    kemCiphertext: base64ToBytes(payload.secret.kemCiphertext),
+    keyring,
+    chatId: payload.secret.chatId,
+    secretId: payload.secret.secretId,
+    version: payload.secret.version,
+    wrappingScheme: payload.secret.wrappingScheme,
+  });
+  try {
+    return await decryptChatText(chatSecret, payload.message.content);
+  } finally {
+    chatSecret.fill(0);
+  }
+}
+
+clientsClaim();
+cleanupOutdatedCaches();
+const precacheManifest = self.__WB_MANIFEST;
+precacheAndRoute(precacheManifest);
+
+if (
+  precacheManifest.some((entry) =>
+    (typeof entry === "string" ? entry : entry.url).endsWith("index.html"),
+  )
+) {
+  registerRoute(
+    new NavigationRoute(createHandlerBoundToURL("index.html"), {
+      denylist: [/^\/api\//],
+    }),
+  );
+}
+registerRoute(
+  ({ request, url }) =>
+    url.origin === self.location.origin &&
+    ["font", "image", "style"].includes(request.destination),
+  new CacheFirst({ cacheName: "tensamin-static-v1" }),
+);
+
+self.addEventListener("push", (event) => {
+  event.waitUntil(
+    (async () => {
+      let payload: PushPayload | undefined;
+      try {
+        const value = event.data?.json() as unknown;
+        if (isPushPayload(value)) payload = value;
+      } catch {
+        // The generic notification below is safe for malformed payloads.
+      }
+
+      let body = "Open Tensamin to view the encrypted message.";
+      if (payload) {
+        try {
+          body = await decryptPush(payload);
+        } catch {
+          // Do not leak credential or decryption failures in the notification.
+        }
+      }
+
+      await self.registration.showNotification(payload?.sender ?? "Tensamin", {
+        body,
+        icon: payload?.avatar || "./icons/icon-192.png",
+        badge: "./icons/notification-badge.png",
+        tag: payload ? `message-${payload.senderId}` : "message",
+        data: { url: payload ? `/chat?id=${payload.senderId}` : "/" },
+      });
+
+      const navigatorWithBadge = self.navigator as WorkerNavigator & {
+        setAppBadge?: (contents?: number) => Promise<void>;
+      };
+      await navigatorWithBadge.setAppBadge?.().catch(() => undefined);
+    })(),
+  );
+});
+
+self.addEventListener("notificationclick", (event) => {
+  event.notification.close();
+  event.waitUntil(
+    (async () => {
+      const target = new URL(
+        String(
+          (event.notification.data as { url?: string } | undefined)?.url ?? "/",
+        ),
+        self.location.origin,
+      );
+      const windows = await self.clients.matchAll({
+        type: "window",
+        includeUncontrolled: true,
+      });
+      for (const client of windows) {
+        if ("navigate" in client) await client.navigate(target.href);
+        return client.focus();
+      }
+      return self.clients.openWindow(target.href);
+    })(),
+  );
+});
+
+self.addEventListener("message", (event) => {
+  if ((event.data as { type?: string } | undefined)?.type === "SKIP_WAITING") {
+    void self.skipWaiting();
+  }
+});

apps/pwa/src/style.css

@@ -0,0 +1,18 @@
+@media (display-mode: standalone), (display-mode: fullscreen) {
+  [data-pwa-root] {
+    padding-top: env(safe-area-inset-top, 0px);
+    padding-right: env(safe-area-inset-right, 0px);
+    padding-left: env(safe-area-inset-left, 0px);
+  }
+}
+
+@media (display-mode: window-controls-overlay) and (min-width: 768px) {
+  [data-pwa-navbar] {
+    min-height: env(titlebar-area-height, 3.375rem);
+    padding-left: max(1px, env(titlebar-area-x, 0px));
+    padding-right: max(
+      0px,
+      calc(100vw - env(titlebar-area-x, 0px) - env(titlebar-area-width, 100vw))
+    );
+  }
+}

apps/pwa/src/vite.ts

@@ -0,0 +1,218 @@
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import type { Plugin } from "vite";
+import { VitePWA } from "vite-plugin-pwa";
+
+const pwaDirectory = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const tauriIcons = resolve(pwaDirectory, "../tauri/src-tauri/icons");
+const androidResources = resolve(
+  pwaDirectory,
+  "../tauri/src-tauri/gen/android/app/src/main/res",
+);
+
+function emitIcons(): Plugin {
+  const icons = [
+    {
+      fileName: "icons/icon-180.png",
+      source: resolve(tauriIcons, "ios/AppIcon-60x60@3x.png"),
+    },
+    {
+      fileName: "icons/icon-192.png",
+      source: resolve(androidResources, "mipmap-xxxhdpi/ic_launcher.png"),
+    },
+    {
+      fileName: "icons/icon-96.png",
+      source: resolve(androidResources, "mipmap-xhdpi/ic_launcher.png"),
+    },
+    {
+      fileName: "icons/icon-512.png",
+      source: resolve(tauriIcons, "icon.png"),
+    },
+    {
+      fileName: "icons/icon-maskable-512.png",
+      source: resolve(tauriIcons, "icon.png"),
+    },
+    {
+      fileName: "icons/icon-monochrome-432.png",
+      source: resolve(
+        androidResources,
+        "mipmap-xxxhdpi/ic_launcher_monochrome.png",
+      ),
+    },
+    {
+      fileName: "icons/notification-badge.png",
+      source: resolve(androidResources, "drawable/ic_notification_small.png"),
+    },
+  ];
+
+  return {
+    name: "tensamin-pwa-icons",
+    configureServer(server) {
+      server.middlewares.use((request, response, next) => {
+        const pathname = request.url
+          ? new URL(request.url, "http://localhost").pathname.slice(1)
+          : "";
+        const icon = icons.find(({ fileName }) => fileName === pathname);
+        if (!icon) {
+          next();
+          return;
+        }
+        response.statusCode = 200;
+        response.setHeader("Content-Type", "image/png");
+        response.setHeader("Cache-Control", "no-cache");
+        response.end(readFileSync(icon.source));
+      });
+    },
+    generateBundle() {
+      for (const icon of icons) {
+        this.emitFile({
+          type: "asset",
+          fileName: icon.fileName,
+          source: readFileSync(icon.source),
+        });
+      }
+    },
+    transformIndexHtml: {
+      order: "post",
+      handler() {
+        return [
+          {
+            tag: "link",
+            attrs: {
+              rel: "apple-touch-icon",
+              sizes: "180x180",
+              href: "./icons/icon-180.png",
+            },
+            injectTo: "head",
+          },
+          {
+            tag: "meta",
+            attrs: { name: "apple-mobile-web-app-capable", content: "yes" },
+            injectTo: "head",
+          },
+          {
+            tag: "meta",
+            attrs: {
+              name: "apple-mobile-web-app-status-bar-style",
+              content: "black-translucent",
+            },
+            injectTo: "head",
+          },
+          {
+            tag: "meta",
+            attrs: {
+              name: "apple-mobile-web-app-title",
+              content: "Tensamin",
+            },
+            injectTo: "head",
+          },
+          {
+            tag: "meta",
+            attrs: { name: "theme-color", content: "#006a67" },
+            injectTo: "head",
+          },
+        ];
+      },
+    },
+  };
+}
+
+export function tensaminPwa(): Plugin[] {
+  return [
+    emitIcons(),
+    ...VitePWA({
+      strategies: "injectManifest",
+      srcDir: resolve(pwaDirectory, "src"),
+      filename: "serviceWorker.ts",
+      injectRegister: null,
+      registerType: "prompt",
+      buildBase: "/",
+      manifestFilename: "manifest.json",
+      includeAssets: ["favicon.ico", "icons/*.png"],
+      manifest: {
+        id: "/",
+        name: "Tensamin",
+        short_name: "Tensamin",
+        description: "Private messaging and calls with Tensamin.",
+        start_url: "/",
+        scope: "/",
+        display: "standalone",
+        display_override: ["window-controls-overlay", "standalone"],
+        background_color: "#001f1e",
+        theme_color: "#006a67",
+        categories: ["social", "communication"],
+        orientation: "any",
+        launch_handler: { client_mode: "focus-existing" },
+        icons: [
+          {
+            src: "icons/icon-192.png",
+            sizes: "192x192",
+            type: "image/png",
+            purpose: "any",
+          },
+          {
+            src: "icons/icon-512.png",
+            sizes: "512x512",
+            type: "image/png",
+            purpose: "any",
+          },
+          {
+            src: "icons/icon-maskable-512.png",
+            sizes: "512x512",
+            type: "image/png",
+            purpose: "maskable",
+          },
+          {
+            src: "icons/icon-monochrome-432.png",
+            sizes: "432x432",
+            type: "image/png",
+            purpose: "monochrome",
+          },
+        ],
+        shortcuts: [
+          {
+            name: "Chats",
+            short_name: "Chats",
+            url: "/",
+            icons: [
+              {
+                src: "icons/icon-96.png",
+                sizes: "96x96",
+                type: "image/png",
+              },
+            ],
+          },
+          {
+            name: "Settings",
+            short_name: "Settings",
+            url: "/settings",
+            icons: [
+              {
+                src: "icons/icon-96.png",
+                sizes: "96x96",
+                type: "image/png",
+              },
+            ],
+          },
+        ],
+        file_handlers: [
+          {
+            action: "/login",
+            accept: { "application/x-tensamin-user": [".tu"] },
+          },
+        ],
+      },
+      injectManifest: {
+        globPatterns: ["**/*.{js,css,html,ico,png,svg,woff2,wasm,mp3,wav}"],
+        globIgnores: ["assets/v2/**"],
+        maximumFileSizeToCacheInBytes: 15 * 1024 * 1024,
+      },
+      devOptions: {
+        enabled: true,
+        type: "module",
+      },
+    }),
+  ];
+}

apps/pwa/todo.md

@@ -0,0 +1,33 @@
+# Web Push Backend TODO
+
+The client can subscribe and decrypt version 1 push payloads, but reliable delivery requires backend support.
+
+- Generate and securely store a VAPID key pair. Expose only the public key to the web build as `VITE_WEB_PUSH_PUBLIC_KEY`.
+- Add authenticated MTP requests for registering, replacing, and deleting a browser `PushSubscription` per user and installation.
+- Persist the endpoint, `p256dh`, `auth`, expiration time, stable installation ID, and last-seen time.
+- Remove subscriptions when a push service returns HTTP 404 or 410 and rate-limit registrations per user.
+- Send pushes when an encrypted live message cannot be delivered to an active browser client. Define duplicate suppression for clients that receive both MTP and Web Push.
+- Keep the JSON payload within push-provider limits and use this version 1 shape:
+
+```json
+{
+  "version": 1,
+  "senderId": 123,
+  "sender": "Display name",
+  "avatar": "https://optional.example/avatar",
+  "message": { "content": "base64 encrypted message content" },
+  "secret": {
+    "chatId": "123:456",
+    "secretId": "chat:123:456:main",
+    "version": 1,
+    "encryptedSecret": "base64 wrapped chat secret",
+    "kemCiphertext": "base64 KEM ciphertext",
+    "wrappingScheme": "mtp-chat-secret-kem-chacha20poly1305-hkdf-sha256-v1"
+  }
+}
+```
+
+- Ensure the wrapped secret is intended for the receiving user's MTP keyring. The server must never receive plaintext message content or plaintext chat secrets.
+- Decide how edits, deletions, reactions, calls, read states, and per-chat notification cancellation map to push events.
+- Add subscription rotation handling and unregister subscriptions when a user logs out or clears application data.
+- Configure production HTTPS, SPA route fallback, `application/manifest+json` for `manifest.json`, and `Cache-Control: no-cache` for the service worker.

apps/pwa/tsconfig.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "module": "ESNext",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "types": ["vite/client", "vite-plugin-pwa/client", "node"],
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true
+  },
+  "include": ["src/runtime.tsx", "src/vite.ts"]
+}

apps/pwa/tsconfig.worker.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "lib": ["ES2022", "WebWorker"],
+    "types": ["vite-plugin-pwa/client"],
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true
+  },
+  "include": ["src/serviceWorker.ts"]
+}

apps/tauri/.gitignore

@@ -24,6 +24,3 @@ dist-ssr
 *.sw?
 
 .android
-
-/src-tauri/gen/android/keystore.properties
-/src-tauri/gen/android/keystore.jks

apps/tauri/flake.lock

@@ -1,96 +0,0 @@
-{
-  "nodes": {
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1775036866,
-        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1744536153,
-        "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "18dd725c29603f582cf1900e0d25f9f1063dbf11",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs",
-        "rust-overlay": "rust-overlay"
-      }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1775272153,
-        "narHash": "sha256-FwYb64ysv8J2TxaqsYYcDyHAHBUEaQlriPMWPMi1K7M=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "740fb0203b2852917b909a72b948d34d0b171ec0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

apps/tauri/flake.nix

@@ -1,108 +0,0 @@
-{
-  description = "Tauri mobile development environment";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    rust-overlay.url = "github:oxalica/rust-overlay";
-    flake-utils.url = "github:numtide/flake-utils";
-  };
-
-  outputs = {
-    self,
-    nixpkgs,
-    rust-overlay,
-    flake-utils,
-  }:
-    flake-utils.lib.eachDefaultSystem (
-      system: let
-        overlays = [(import rust-overlay)];
-        pkgs = import nixpkgs {
-          inherit system overlays;
-          config = {
-            allowUnfree = true;
-            android_sdk.accept_license = true;
-          };
-        };
-
-        projectRoot = ".";
-        androidHome = "${projectRoot}/.android";
-        sdkRoot = "${androidHome}/sdk";
-        ndkVersion = "29.0.14206865";
-
-        android = pkgs.androidenv.composeAndroidPackages {
-          cmdLineToolsVersion = "8.0";
-          toolsVersion = "26.1.1";
-          platformToolsVersion = "35.0.2";
-          buildToolsVersions = ["35.0.0"];
-          platformVersions = ["35" "36"];
-          includeSources = false;
-          includeSystemImages = false;
-          includeNDK = true;
-          ndkVersions = [ndkVersion];
-          useGoogleAPIs = false;
-        };
-
-        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
-          extensions = ["rust-src" "rust-analyzer"];
-          targets = [
-            "aarch64-linux-android"
-            "armv7-linux-androideabi"
-            "i686-linux-android"
-            "x86_64-linux-android"
-            "wasm32-unknown-unknown"
-          ];
-        };
-
-      in {
-        devShells.default = pkgs.mkShell {
-          buildInputs = with pkgs;
-            [
-              jdk17
-              rustToolchain
-              gradle
-              nodejs
-              pkg-config
-            ]
-            ++ [
-              android.androidsdk
-              pkgs.android-studio-tools
-            ];
-
-          shellHook = ''
-            sdkSource="${android.androidsdk}/libexec/android-sdk"
-
-            mkdir -p "${androidHome}"
-            if [ -L "${sdkRoot}" ]; then
-              rm -f "${sdkRoot}"
-            fi
-            mkdir -p "${sdkRoot}"
-
-            ln -sfn "$sdkSource/build-tools" "${sdkRoot}/build-tools"
-            ln -sfn "$sdkSource/cmake" "${sdkRoot}/cmake"
-            ln -sfn "$sdkSource/licenses" "${sdkRoot}/licenses"
-            ln -sfn "$sdkSource/ndk" "${sdkRoot}/ndk"
-            ln -sfn "$sdkSource/ndk-bundle" "${sdkRoot}/ndk-bundle"
-            ln -sfn "$sdkSource/platforms" "${sdkRoot}/platforms"
-            ln -sfn "$sdkSource/platform-tools" "${sdkRoot}/platform-tools"
-            ln -sfn "$sdkSource/tools" "${sdkRoot}/tools"
-
-            mkdir -p "${sdkRoot}/cmdline-tools"
-            ln -sfn "$sdkSource/cmdline-tools/8.0" "${sdkRoot}/cmdline-tools/8.0"
-            ln -sfn "8.0" "${sdkRoot}/cmdline-tools/latest"
-
-            sdkRootAbs="$(realpath "${sdkRoot}")"
-            ndkRootAbs="''${sdkRootAbs}/ndk/${ndkVersion}"
-
-            export PATH="''${sdkRootAbs}/cmdline-tools/latest/bin:''${sdkRootAbs}/platform-tools:''${ndkRootAbs}:${pkgs.android-studio-tools}/bin:$PATH"
-            export ANDROID_HOME="''${sdkRootAbs}"
-            export ANDROID_SDK_ROOT="''${sdkRootAbs}"
-            export ANDROID_NDK_ROOT="''${ndkRootAbs}"
-            export ANDROID_NDK_HOME="$ANDROID_NDK_ROOT"
-            export NDK_HOME="$ANDROID_NDK_ROOT"
-            export NDK_PATH="$ANDROID_NDK_ROOT"
-            export JAVA_HOME="${pkgs.jdk17}"
-          '';
-        };
-      }
-    );
-}

apps/tauri/logo.json

@@ -5,4 +5,4 @@
   "android_bg": "./background.png",
   "android_fg_scale": 100,
   "android_monochrome": "./monochrome.png"
-}
+}

apps/tauri/logo.svg

@@ -2,14 +2,14 @@
 <!-- Created with Inkscape (http://www.inkscape.org/) -->
 
 <svg
-   width="90mm"
+   width="90.476906mm"
-   height="90mm"
+   height="90.476906mm"
-   viewBox="0 0 90 90"
+   viewBox="0 0 90.476906 90.476906"
    version="1.1"
    id="svg1"
    xml:space="preserve"
    inkscape:version="1.4.4 (dcaf3e7d9e, 2026-05-05)"
-   sodipodi:docname="logo_raw.svg"
+   sodipodi:docname="logo_square_outline_gen.svg"
    xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
    xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
    xmlns:xlink="http://www.w3.org/1999/xlink"
@@ -24,16 +24,32 @@
      inkscape:pagecheckerboard="1"
      inkscape:deskcolor="#505050"
      inkscape:document-units="mm"
-     inkscape:zoom="0.99999999"
+     inkscape:zoom="2"
-     inkscape:cx="450"
+     inkscape:cx="191.5"
-     inkscape:cy="291.5"
+     inkscape:cy="117.25"
-     inkscape:window-width="1223"
+     inkscape:window-width="2500"
-     inkscape:window-height="1369"
+     inkscape:window-height="1403"
-     inkscape:window-x="26"
+     inkscape:window-x="0"
-     inkscape:window-y="23"
+     inkscape:window-y="0"
-     inkscape:window-maximized="0"
+     inkscape:window-maximized="1"
      inkscape:current-layer="layer1" /><defs
-     id="defs1"><linearGradient
+     id="defs1"><inkscape:path-effect
+       effect="fillet_chamfer"
+       id="path-effect1"
+       is_visible="true"
+       lpeversion="1"
+       nodesatellites_param="F,0,0,1,0,0.26458333,0,1 @ F,0,0,1,0,0.26458333,0,1 @ F,0,0,1,0,0.26458333,0,1 @ F,0,0,1,0,0.26458333,0,1 @ F,0,0,1,0,0.26458333,0,1 @ F,0,0,1,0,0.26458333,0,1 @ F,0,0,1,0,0.26458333,0,1"
+       radius="1"
+       unit="px"
+       method="auto"
+       mode="F"
+       chamfer_steps="1"
+       flexible="false"
+       use_knot_distance="true"
+       apply_no_radius="true"
+       apply_with_radius="true"
+       only_selected="false"
+       hide_knots="false" /><linearGradient
        id="swatch15"
        inkscape:swatch="solid"><stop
          style="stop-color:#000000;stop-opacity:1;"
@@ -51,7 +67,7 @@
          id="stop3" /></linearGradient><linearGradient
        id="swatch2"
        inkscape:swatch="solid"><stop
-         style="stop-color:#000000;stop-opacity:1;"
+         style="stop-color:#b8f8ff;stop-opacity:1;"
          offset="0"
          id="stop2" /></linearGradient><linearGradient
        id="swatch1"
@@ -184,13 +200,23 @@
        x1="63.191292"
        y1="148.5"
        x2="146.82355"
-       y2="148.5" /></defs><g
+       y2="148.5" /><linearGradient
+       inkscape:collect="always"
+       xlink:href="#swatch2"
+       id="linearGradient1"
+       gradientUnits="userSpaceOnUse"
+       x1="63.191292"
+       y1="148.5"
+       x2="146.82355"
+       y2="148.5"
+       gradientTransform="matrix(1.0144629,0,0,1.0151924,217.46226,13.830072)" /></defs><g
      inkscape:label="Layer 1"
      inkscape:groupmode="layer"
      id="layer1"
-     transform="translate(-62.941767,-104.13688)"><g
+     transform="translate(-281.06837,-119.33314)"
+     ><g
        id="g2"
-       transform="matrix(0.78671048,0,0,0.83608014,-116.36038,-50.640745)"
+       transform="matrix(0.77770172,0,0,0.82714179,104.17421,-33.291714)"
        inkscape:label="background"
        style="display:inline;stroke:url(#linearGradient15);stroke-width:0.616508;stroke-dasharray:none"
        clip-path="url(#clipPath1)"><path
@@ -213,11 +239,19 @@
          id="rect1-1-3-6-2"
          style="fill:#12a89e;stroke:url(#linearGradient21);stroke-width:0.616508;stroke-dasharray:none"
          transform="rotate(-75)"
-         d="m -227.83395,371.18179 h 146.303341 v 24.39636 H -227.83395 Z" /></g><g
+         d="m -227.83395,371.18179 h 146.303341 v 24.39636 H -227.83395 Z" /></g><path
+       id="path1-5"
+       style="fill:none;stroke:url(#linearGradient1);stroke-width:2;stroke-dasharray:none"
+       inkscape:label="glow_outline"
+       d="m 323.73413,119.91784 -40.80246,15.9513 c -0.13609,0.0532 -0.26542,0.21326 -0.28843,0.35757 -2.90631,18.22859 -0.19736,34.27444 8.28042,47.36302 0.0794,0.12264 0.10916,0.33484 0.0657,0.47436 l -7.08112,22.75509 a 0.11130973,0.11130973 40.101955 0 0 0.15695,0.13218 l 18.7652,-9.59506 c 0.13011,-0.0665 0.32608,-0.044 0.43816,0.0497 5.75202,4.81168 12.45464,8.67546 20.46583,11.84762 0.13586,0.0538 0.3564,0.0538 0.49225,-3e-5 32.16862,-12.74646 46.41741,-39.59704 41.09168,-73.02692 -0.023,-0.14431 -0.15232,-0.30436 -0.28841,-0.35757 l -40.80297,-15.9513 a 0.67679193,0.67679193 179.99988 0 0 -0.49284,0 z"
+       sodipodi:nodetypes="cccccccc"
+       inkscape:original-d="m 323.98055,119.8215 -41.2953,16.14398 c -2.99079,18.43973 -0.24934,34.65473 8.38277,47.84598 l -7.23836,23.26035 19.23635,-9.83596 c 5.85568,4.9403 12.69983,8.88741 20.91454,12.11489 32.42602,-12.73985 46.75142,-39.74883 41.29581,-73.38526 z"
+       inkscape:path-effect="#path-effect1"
+       transform="matrix(0.98854883,0,0,0.98930922,6.03231,1.7325084)" /><g
        id="g3"
        inkscape:label="foreground"
        style="stroke:url(#linearGradient16);stroke-width:0.5;stroke-dasharray:none"
-       transform="translate(3.3653788,0.84760028)"><g
+       transform="matrix(0.98854883,0,0,0.98930922,222.52896,17.64618)"><g
          id="g1"
          inkscape:label="outline"
          style="stroke:url(#linearGradient23);stroke-width:0.5;stroke-dasharray:none"><path

apps/tauri/package.json

@@ -4,41 +4,33 @@
   "version": "0.0.0",
   "type": "module",
   "exports": {
-    "./controls": {
-      "types": "./src/windowControls.tsx",
-      "default": "./src/windowControls.tsx"
-    },
     "./deeplinkHandler": {
       "types": "./src/deeplinkHandler.tsx",
       "default": "./src/deeplinkHandler.tsx"
-    },
-    "./qrCodeScanner": {
-      "types": "./src/qrCodeScanner.tsx",
-      "default": "./src/qrCodeScanner.tsx"
     }
   },
   "scripts": {
-    "dev:mobile:raw": "tauri android dev",
+    "dev:mobile:raw": "adb reverse tcp:3000 tcp:3000 && tauri android dev --host ${TAURI_DEV_HOST:-127.0.0.1}",
+    "start-adb:mobile:raw": "adb devices",
     "build:mobile:raw": "tauri android build",
-    "dev:mobile": "if command -v nix >/dev/null 2>&1; then nix develop --command bun dev:mobile:raw; else bun dev:mobile:raw; fi",
+    "build:mobile:ci": "node render-version.ts && trap 'node render-version.ts --unrender' EXIT && tauri android build --debug",
-    "build:mobile": "bun run render-version.ts && if command -v nix >/dev/null 2>&1; then nix develop --command bun build:mobile:raw; else bun build:mobile:raw; fi && bun run render-version.ts --unrender",
+    "dev:mobile": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop ../..#tauri --command pnpm run dev:mobile:raw; else pnpm run dev:mobile:raw; fi",
-    "gen-icons": "tauri icon ./logo.json",
+    "start-adb:mobile": "if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop ../..#tauri --command pnpm run start-adb:mobile:raw; else pnpm run start-adb:mobile:raw; fi",
-    "format": "bunx prettier --write .",
+    "build:mobile": "node render-version.ts && trap 'node render-version.ts --unrender' EXIT && if command -v nix >/dev/null 2>&1 && [ -z \"$IN_NIX_SHELL\" ]; then nix develop ../..#tauri --command pnpm run build:mobile:raw; else pnpm run build:mobile:raw; fi",
+    "gen-icons": "tauri icon ./logo.json && node scripts/sync-electron-icons.ts",
+    "format": "pnpm exec prettier --write .",
     "lint": "eslint src"
   },
   "dependencies": {
-    "@tauri-apps/api": "^2",
+    "@methanium/ui": "*",
-    "@tauri-apps/plugin-barcode-scanner": "~2",
+    "@tauri-apps/api": "^2.11.1",
-    "@tauri-apps/plugin-deep-link": "~2",
+    "@tauri-apps/plugin-deep-link": "~2.4.9",
-    "@tauri-apps/plugin-opener": "^2",
-    "@tensamin/ui": "*",
     "@tensamin/shared": "workspace:*",
-    "lucide-react": "^1.14.0",
+    "react": "^19.2.8",
-    "react": "^19.2.0",
+    "react-dom": "^19.2.8"
-    "react-dom": "^19.2.0"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2",
+    "@tauri-apps/cli": "^2.11.4",
-    "@types/node": "^25.9.1"
+    "@types/node": "^26.1.2"
   }
 }

apps/tauri/render-version.ts

@@ -1,9 +1,12 @@
 import fs from "fs";
 import path from "path";
+import { fileURLToPath } from "url";
 
 // Config
 const PLACEHOLDER_VERSION = "0.0.0";
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
 const rootPackageJsonPath = path.resolve(__dirname, "../../package.json");
 const cargoTomlPath = path.resolve(__dirname, "./src-tauri/Cargo.toml");
 const tauriConfigPath = path.resolve(__dirname, "./src-tauri/tauri.conf.json");

apps/tauri/scripts/delete-mobile.ts

@@ -0,0 +1,53 @@
+import { spawnSync } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+
+const devicesResult = spawnSync("adb", ["devices", "-l"], {
+  encoding: "utf8",
+});
+
+if (devicesResult.status !== 0) {
+  process.stderr.write(devicesResult.stderr);
+  process.exit(devicesResult.status ?? 1);
+}
+
+const devices = devicesResult.stdout
+  .split("\n")
+  .slice(1)
+  .map((line) => line.trim())
+  .filter((line) => /\sdevice(?:\s|$)/.test(line));
+
+if (devices.length === 0) {
+  console.error("No connected ADB devices found.");
+  process.exit(1);
+}
+
+let selectedDevice = devices[0];
+
+if (devices.length > 1) {
+  console.log("Select a device:");
+  devices.forEach((device, index) => console.log(`${index + 1}) ${device}`));
+
+  const readline = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  const answer = await readline.question("Device: ");
+  readline.close();
+
+  const selectedIndex = Number(answer) - 1;
+  if (!Number.isInteger(selectedIndex) || !devices[selectedIndex]) {
+    console.error("Invalid device selection.");
+    process.exit(1);
+  }
+
+  selectedDevice = devices[selectedIndex];
+}
+
+const serial = selectedDevice.split(/\s+/, 1)[0];
+const uninstallResult = spawnSync(
+  "adb",
+  ["-s", serial, "uninstall", "net.tensamin.client.dev"],
+  { stdio: "inherit" },
+);
+
+process.exit(uninstallResult.status ?? 1);

apps/tauri/scripts/sync-electron-icons.ts

@@ -0,0 +1,31 @@
+import { copyFile, mkdir } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const tauriDir = resolve(scriptDir, "..");
+const clientDir = resolve(tauriDir, "../..");
+const tauriIconsDir = join(tauriDir, "src-tauri", "icons");
+const electronIconsDir = join(clientDir, "apps", "electron", "build", "icons");
+
+const desktopIcons = [
+  "32x32.png",
+  "64x64.png",
+  "128x128.png",
+  "128x128@2x.png",
+  "icon.png",
+  "icon.ico",
+  "icon.icns",
+];
+
+await mkdir(electronIconsDir, { recursive: true });
+
+await Promise.all(
+  desktopIcons.map((icon) =>
+    copyFile(join(tauriIconsDir, icon), join(electronIconsDir, icon)),
+  ),
+);
+
+console.log(
+  `Synced ${desktopIcons.length} desktop icons to ${electronIconsDir}`,
+);

apps/tauri/src-tauri/Cargo.toml

@@ -15,23 +15,34 @@ name = "mobile_lib"
 crate-type = ["staticlib", "cdylib", "rlib"]
 
 [build-dependencies]
-tauri-build = { version = "2", features = [] }
+tauri-build = { git = "https://github.com/tauri-apps/tauri", rev = "4af26a3f7f8b692d62cca549bbacd93f5ce90b41", features = [] }
 
 [dependencies]
 tauri-plugin-opener = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+base64 = "0.22"
+reqwest = { version = "0.13", default-features = false, features = ["json", "rustls"] }
+tokio = { version = "1", features = ["rt-multi-thread", "sync", "time"] }
+mtp = { git = "https://git.methanium.net/Methanium/mtp.git", rev = "a5c8d4f0c898c78351e9d54124886c86e789a22a", features = ["client", "crypto"] }
+webpki-root-certs = "1"
 tauri-plugin-deep-link = "2"
+tauri-plugin-notification = "2"
+tauri-plugin-log = "2"
 
 [target.'cfg(target_os = "android")'.dependencies.tauri]
 version = "2"
 features = []
 default-features = true
 
-[target.'cfg(any(target_os = "android", target_os = "ios"))'.dependencies]
+[target.'cfg(not(target_os = "android"))'.dependencies.tauri]
-tauri-plugin-barcode-scanner = "2"
+version = "2"
-tauri-plugin-app-events = "0.2"
+features = []
+default-features = true
+
+[target.'cfg(target_os = "android")'.dependencies]
+jni = "0.22"
 
 [patch.crates-io.tauri]
 git = "https://github.com/tauri-apps/tauri"
-branch = "feat/cef"
+rev = "4af26a3f7f8b692d62cca549bbacd93f5ce90b41"

apps/tauri/src-tauri/capabilities/default.json

@@ -6,14 +6,9 @@
     "main"
   ],
   "permissions": [
-    "core:default",
     "opener:default",
-    "core:window:default",
+    "deep-link:default",
-    "core:window:allow-start-dragging",
+    "notification:default",
-    "core:window:allow-close",
+    "log:default"
-    "core:window:allow-toggle-maximize",
-    "core:window:allow-minimize",
-    "core:event:default",
-    "deep-link:default"
   ]
-}
+}

apps/tauri/src-tauri/capabilities/mobile.json

@@ -1,17 +1,11 @@
 {
   "identifier": "mobile-capability",
-  "platforms": [
+  "platforms": ["android", "iOS"],
-    "android",
+  "windows": ["main"],
-    "iOS"
-  ],
-  "windows": [
-    "main"
-  ],
   "permissions": [
+    "core:event:default",
     "deep-link:default",
-    "app-events:default",
+    "notification:default",
-    "barcode-scanner:default",
+    "log:default"
-    "barcode-scanner:allow-scan",
-    "barcode-scanner:allow-cancel"
   ]
 }

apps/tauri/src-tauri/gen/android/app/build.gradle.kts

@@ -1,3 +1,4 @@
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 import java.util.Properties
 import java.io.FileInputStream
 
@@ -40,6 +41,7 @@ android {
     }
     buildTypes {
         getByName("debug") {
+            applicationIdSuffix = ".dev"
             manifestPlaceholders["usesCleartextTraffic"] = "true"
             isDebuggable = true
             isJniDebuggable = true
@@ -60,26 +62,29 @@ android {
             )
         }
     }
-    kotlinOptions {
-        jvmTarget = "1.8"
-    }
     buildFeatures {
         buildConfig = true
     }
 }
 
+kotlin {
+    compilerOptions {
+        jvmTarget = JvmTarget.JVM_1_8
+    }
+}
+
 rust {
     rootDirRel = "../../../"
 }
 
 dependencies {
-    implementation("androidx.webkit:webkit:1.14.0")
+    implementation("androidx.webkit:webkit:1.16.0")
     implementation("androidx.appcompat:appcompat:1.7.1")
-    implementation("androidx.activity:activity-ktx:1.10.1")
+    implementation("androidx.activity:activity-ktx:1.13.0")
-    implementation("com.google.android.material:material:1.12.0")
+    implementation("com.google.android.material:material:1.14.0")
     testImplementation("junit:junit:4.13.2")
-    androidTestImplementation("androidx.test.ext:junit:1.1.4")
+    androidTestImplementation("androidx.test.ext:junit:1.3.0")
-    androidTestImplementation("androidx.test.espresso:espresso-core:3.5.0")
+    androidTestImplementation("androidx.test.espresso:espresso-core:3.7.0")
 }
 
-apply(from = "tauri.build.gradle.kts")
+apply(from = "tauri.build.gradle.kts")

apps/tauri/src-tauri/gen/android/app/proguard-rules.pro

@@ -18,4 +18,4 @@
 
 # If you keep the line number information, uncomment this to
 # hide the original source file name.
-#-renamesourcefileattribute SourceFile
+#-renamesourcefileattribute SourceFile

apps/tauri/src-tauri/gen/android/app/src/main/AndroidManifest.xml

@@ -1,6 +1,16 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
     <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
+    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
 
     <!-- AndroidTV support -->
     <uses-feature android:name="android.software.leanback" android:required="false" />
@@ -39,6 +49,30 @@
             <!-- DEEP LINK PLUGIN. AUTO-GENERATED. DO NOT REMOVE. -->
         </activity>
 
+        <service
+            android:name=".MediaProjectionService"
+            android:exported="false"
+            android:foregroundServiceType="mediaProjection" />
+
+        <service
+            android:name=".MtpForegroundService"
+            android:exported="false"
+            android:stopWithTask="false"
+            android:foregroundServiceType="specialUse">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="Maintains the user-enabled encrypted messaging connection and receives incoming messages" />
+        </service>
+
+        <receiver
+            android:name=".MtpBootReceiver"
+            android:enabled="true"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.BOOT_COMPLETED" />
+            </intent-filter>
+        </receiver>
+
         <provider
           android:name="androidx.core.content.FileProvider"
           android:authorities="${applicationId}.fileprovider"

apps/tauri/src-tauri/gen/android/app/src/main/java/net/tensamin/client/MainActivity.kt

@@ -1,28 +1,114 @@
 package net.tensamin.client
 
-import android.graphics.Rect
+import android.Manifest
+import android.app.Activity
+import android.content.pm.PackageManager
+import android.media.projection.MediaProjectionManager
 import android.os.Bundle
-import android.view.ViewGroup
+import android.view.MotionEvent
 import android.view.ViewTreeObserver
 import android.view.WindowManager
+import android.webkit.JavascriptInterface
+import android.webkit.WebView
 import android.widget.FrameLayout
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.core.content.ContextCompat
 import androidx.core.view.ViewCompat
 import androidx.core.view.WindowCompat
 import androidx.core.view.WindowInsetsCompat
+import org.json.JSONObject
 
 class MainActivity : TauriActivity() {
   private var contentRoot: FrameLayout? = null
   private var contentChild: android.view.View? = null
   private var previousUsableHeight = 0
   private var attachLayoutListener: ViewTreeObserver.OnGlobalLayoutListener? = null
+  private var mediaWebView: WebView? = null
+  private var pendingScreenAudio: Boolean? = null
+
+  private val screenCaptureLauncher = registerForActivityResult(
+    ActivityResultContracts.StartActivityForResult(),
+  ) { result ->
+    val includeAudio = pendingScreenAudio
+    pendingScreenAudio = null
+
+    if (includeAudio == null) return@registerForActivityResult
+    val data = result.data
+    if (result.resultCode != Activity.RESULT_OK || data == null) {
+      MobileMediaEvents.emitError("Screen capture permission was denied")
+      return@registerForActivityResult
+    }
+
+    MediaProjectionService.start(this, result.resultCode, data, includeAudio)
+  }
+
+  private val cameraPermissionLauncher = registerForActivityResult(
+    ActivityResultContracts.RequestMultiplePermissions(),
+  ) {
+    emitCameraPermission()
+  }
+
+  private val screenAudioPermissionLauncher = registerForActivityResult(
+    ActivityResultContracts.RequestPermission(),
+  ) {
+    launchScreenCaptureIntent()
+  }
+
+  override fun onWebViewCreate(webView: WebView) {
+    webView.settings.apply {
+      setSupportZoom(false)
+      builtInZoomControls = false
+      displayZoomControls = false
+    }
+
+    var blockingMultiTouch = false
+    webView.setOnTouchListener { _, event ->
+      val shouldBlock = blockingMultiTouch || event.pointerCount > 1
+
+      when (event.actionMasked) {
+        MotionEvent.ACTION_POINTER_DOWN -> {
+          // Cancel the one-finger gesture before consuming the rest of the pinch.
+          MotionEvent.obtain(event).let { cancelEvent ->
+            cancelEvent.action = MotionEvent.ACTION_CANCEL
+            webView.onTouchEvent(cancelEvent)
+            cancelEvent.recycle()
+          }
+          blockingMultiTouch = true
+        }
+        MotionEvent.ACTION_UP, MotionEvent.ACTION_CANCEL -> blockingMultiTouch = false
+      }
+
+      shouldBlock
+    }
+
+    NativeAccessibilityBridge.attach(webView)
+    mediaWebView = webView
+    MobileMediaEvents.attach(webView)
+    webView.addJavascriptInterface(MobileMediaJavascriptInterface(), "tensaminMobileMedia")
+  }
 
   override fun onCreate(savedInstanceState: Bundle?) {
     WindowCompat.setDecorFitsSystemWindows(window, true)
     window.setSoftInputMode(WindowManager.LayoutParams.SOFT_INPUT_ADJUST_NOTHING)
     super.onCreate(savedInstanceState)
+    NativeMtpBridge.nativeAttach(applicationContext)
+    if (MtpSecureStore.isEnabled(this) && MtpSecureStore.hasConfig(this)) {
+      NativeMtpBridge.startService(this)
+    }
+    NativeAccessibilityBridge.nativeAttach(applicationContext)
     installKeyboardResizeWorkaround()
   }
 
+  override fun onResume() {
+    super.onResume()
+    NativeMtpBridge.nativeSetUiState(true)
+  }
+
+  override fun onPause() {
+    NativeMtpBridge.nativeSetUiState(false)
+    super.onPause()
+  }
+
   override fun onDestroy() {
     attachLayoutListener?.let { listener ->
       contentRoot?.viewTreeObserver?.removeOnGlobalLayoutListener(listener)
@@ -30,9 +116,87 @@ class MainActivity : TauriActivity() {
     attachLayoutListener = null
     contentRoot = null
     contentChild = null
+    mediaWebView?.let {
+      NativeAccessibilityBridge.detach(it)
+      it.removeJavascriptInterface("tensaminMobileMedia")
+    }
+    mediaWebView = null
+    MobileMediaEvents.detach()
     super.onDestroy()
   }
 
+  private fun startScreenShare(includeAudio: Boolean) {
+    runOnUiThread {
+      if (pendingScreenAudio != null) {
+        MobileMediaEvents.emitError("Screen capture permission is already pending")
+        return@runOnUiThread
+      }
+
+      pendingScreenAudio = includeAudio
+      if (
+        includeAudio &&
+        ContextCompat.checkSelfPermission(this, Manifest.permission.RECORD_AUDIO) !=
+          PackageManager.PERMISSION_GRANTED
+      ) {
+        screenAudioPermissionLauncher.launch(Manifest.permission.RECORD_AUDIO)
+      } else {
+        launchScreenCaptureIntent()
+      }
+    }
+  }
+
+  private fun launchScreenCaptureIntent() {
+    val manager = getSystemService(MediaProjectionManager::class.java)
+    screenCaptureLauncher.launch(manager.createScreenCaptureIntent())
+  }
+
+  private fun stopScreenShare() {
+    runOnUiThread {
+      pendingScreenAudio = null
+      MediaProjectionService.stop(this)
+    }
+  }
+
+  private fun requestCameraPermission() {
+    runOnUiThread {
+      cameraPermissionLauncher.launch(
+        arrayOf(Manifest.permission.CAMERA, Manifest.permission.RECORD_AUDIO),
+      )
+    }
+  }
+
+  private fun emitCameraPermission() {
+    val detail = JSONObject()
+      .put(
+        "camera",
+        ContextCompat.checkSelfPermission(this, Manifest.permission.CAMERA) ==
+          PackageManager.PERMISSION_GRANTED,
+      )
+      .put(
+        "microphone",
+        ContextCompat.checkSelfPermission(this, Manifest.permission.RECORD_AUDIO) ==
+          PackageManager.PERMISSION_GRANTED,
+      )
+    MobileMediaEvents.emit("tensamin-mobile-camera-permission", detail)
+  }
+
+  private inner class MobileMediaJavascriptInterface {
+    @JavascriptInterface
+    fun startScreenShare(includeAudio: Boolean) {
+      this@MainActivity.startScreenShare(includeAudio)
+    }
+
+    @JavascriptInterface
+    fun stopScreenShare() {
+      this@MainActivity.stopScreenShare()
+    }
+
+    @JavascriptInterface
+    fun requestCameraPermission() {
+      this@MainActivity.requestCameraPermission()
+    }
+  }
+
   private fun installKeyboardResizeWorkaround() {
     val content = window.decorView.findViewById<FrameLayout>(android.R.id.content)
     contentRoot = content
@@ -68,16 +232,20 @@ class MainActivity : TauriActivity() {
     child: android.view.View,
     insets: WindowInsetsCompat? = ViewCompat.getRootWindowInsets(child),
   ) {
-    val visibleFrame = Rect()
-    child.getWindowVisibleDisplayFrame(visibleFrame)
-
     val rootHeight = child.rootView.height
     if (rootHeight <= 0) return
 
-    val imeHeight = insets?.getInsets(WindowInsetsCompat.Type.ime())?.bottom ?: 0
+    val imeVisible = insets?.isVisible(WindowInsetsCompat.Type.ime()) == true
-    val keyboardHeight = maxOf(imeHeight, rootHeight - visibleFrame.bottom)
+    val imeHeight = if (imeVisible) {
-    val keyboardVisible = keyboardHeight > rootHeight * 0.15
+      insets.getInsets(WindowInsetsCompat.Type.ime()).bottom
-    val usableHeight = if (keyboardVisible) rootHeight - keyboardHeight else ViewGroup.LayoutParams.MATCH_PARENT
+    } else {
+      0
+    }
+    val usableHeight = if (imeHeight in 1 until rootHeight) {
+      rootHeight - imeHeight
+    } else {
+      WindowManager.LayoutParams.MATCH_PARENT
+    }
 
     if (previousUsableHeight == usableHeight) return
 

apps/tauri/src-tauri/gen/android/app/src/main/java/net/tensamin/client/MediaProjectionService.kt

@@ -0,0 +1,345 @@
+package net.tensamin.client
+
+import android.Manifest
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.content.pm.ServiceInfo
+import android.graphics.Bitmap
+import android.graphics.PixelFormat
+import android.hardware.display.DisplayManager
+import android.hardware.display.VirtualDisplay
+import android.media.AudioAttributes
+import android.media.AudioFormat
+import android.media.AudioPlaybackCaptureConfiguration
+import android.media.AudioRecord
+import android.media.projection.MediaProjection
+import android.media.projection.MediaProjectionManager
+import android.media.ImageReader
+import android.os.Build
+import android.os.Handler
+import android.os.HandlerThread
+import android.os.IBinder
+import android.util.Base64
+import android.util.DisplayMetrics
+import androidx.core.app.NotificationCompat
+import androidx.core.content.ContextCompat
+import java.io.ByteArrayOutputStream
+import java.util.concurrent.atomic.AtomicBoolean
+import org.json.JSONObject
+
+class MediaProjectionService : Service() {
+  private var projection: MediaProjection? = null
+  private var virtualDisplay: VirtualDisplay? = null
+  private var imageReader: ImageReader? = null
+  private var captureThread: HandlerThread? = null
+  private var audioRecord: AudioRecord? = null
+  private var audioThread: Thread? = null
+  private val captureActive = AtomicBoolean(false)
+  private var lastFrameAt = 0L
+
+  private val projectionCallback = object : MediaProjection.Callback() {
+    override fun onStop() {
+      stopCapture(stopProjection = false, emitStopped = true)
+      stopSelf()
+    }
+  }
+
+  override fun onBind(intent: Intent?): IBinder? = null
+
+  override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+    if (intent?.action == ACTION_STOP) {
+      stopCapture(stopProjection = true, emitStopped = true)
+      stopSelf()
+      return START_NOT_STICKY
+    }
+
+    val permissionData = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+      intent?.getParcelableExtra(EXTRA_PERMISSION_DATA, Intent::class.java)
+    } else {
+      @Suppress("DEPRECATION")
+      intent?.getParcelableExtra(EXTRA_PERMISSION_DATA)
+    }
+    val resultCode = intent?.getIntExtra(EXTRA_RESULT_CODE, Int.MIN_VALUE) ?: Int.MIN_VALUE
+    if (permissionData == null || resultCode == Int.MIN_VALUE) {
+      MobileMediaEvents.emitError("Screen capture permission data is missing")
+      stopSelf()
+      return START_NOT_STICKY
+    }
+
+    val includeAudio = intent?.getBooleanExtra(EXTRA_INCLUDE_AUDIO, false) ?: false
+    try {
+      startForegroundNotification()
+      startCapture(resultCode, permissionData, includeAudio)
+    } catch (error: Throwable) {
+      stopCapture(stopProjection = true, emitStopped = false)
+      stopForeground(STOP_FOREGROUND_REMOVE)
+      stopSelf()
+      MobileMediaEvents.emitError(error.message ?: "Unable to start screen capture")
+    }
+    return START_NOT_STICKY
+  }
+
+  override fun onDestroy() {
+    stopCapture(stopProjection = true, emitStopped = true)
+    super.onDestroy()
+  }
+
+  private fun startForegroundNotification() {
+    val notificationManager = getSystemService(NotificationManager::class.java)
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+      notificationManager.createNotificationChannel(
+        NotificationChannel(
+          NOTIFICATION_CHANNEL_ID,
+          "Screen sharing",
+          NotificationManager.IMPORTANCE_LOW,
+        ),
+      )
+    }
+
+    val stopIntent = Intent(this, MediaProjectionService::class.java).setAction(ACTION_STOP)
+    val stopPendingIntent = PendingIntent.getService(
+      this,
+      0,
+      stopIntent,
+      PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+    )
+    val notification = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
+      .setSmallIcon(android.R.drawable.ic_menu_share)
+      .setContentTitle("Tensamin is sharing your screen")
+      .setContentText("Tap Stop to end screen sharing")
+      .setOngoing(true)
+      .setCategory(NotificationCompat.CATEGORY_SERVICE)
+      .addAction(android.R.drawable.ic_media_pause, "Stop", stopPendingIntent)
+      .build()
+
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+      startForeground(
+        NOTIFICATION_ID,
+        notification,
+        ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION,
+      )
+    } else {
+      startForeground(NOTIFICATION_ID, notification)
+    }
+  }
+
+  @Suppress("DEPRECATION")
+  private fun startCapture(resultCode: Int, permissionData: Intent, includeAudio: Boolean) {
+    stopCapture(stopProjection = true, emitStopped = false)
+
+    val manager = getSystemService(MediaProjectionManager::class.java)
+    val newProjection = manager.getMediaProjection(resultCode, permissionData)
+      ?: error("Android did not provide a screen capture session")
+    projection = newProjection
+
+    val thread = HandlerThread("tensamin-screen-capture").also { it.start() }
+    captureThread = thread
+    val handler = Handler(thread.looper)
+    newProjection.registerCallback(projectionCallback, handler)
+
+    val metrics = DisplayMetrics()
+    getSystemService(android.view.WindowManager::class.java).defaultDisplay.getRealMetrics(metrics)
+    val displayWidth = metrics.widthPixels
+    val displayHeight = metrics.heightPixels
+    val width = minOf(displayWidth, MAX_FRAME_WIDTH)
+    val height = (displayHeight.toLong() * width / displayWidth).toInt()
+    val density = metrics.densityDpi
+    val reader = ImageReader.newInstance(width, height, PixelFormat.RGBA_8888, 2)
+    imageReader = reader
+    reader.setOnImageAvailableListener({ source -> captureFrame(source, width, height) }, handler)
+
+    virtualDisplay = newProjection.createVirtualDisplay(
+      "Tensamin screen sharing",
+      width,
+      height,
+      density,
+      DisplayManager.VIRTUAL_DISPLAY_FLAG_AUTO_MIRROR,
+      reader.surface,
+      null,
+      handler,
+    )
+    captureActive.set(true)
+
+    val audioStarted = includeAudio && startAudioCapture(newProjection)
+    MobileMediaEvents.emit(
+      "tensamin-mobile-screen-started",
+      JSONObject().put("includeAudio", audioStarted),
+    )
+  }
+
+  private fun captureFrame(source: ImageReader, width: Int, height: Int) {
+    val image = source.acquireLatestImage() ?: return
+    try {
+      val now = System.currentTimeMillis()
+      if (!captureActive.get() || now - lastFrameAt < FRAME_INTERVAL_MS) return
+      lastFrameAt = now
+
+      val plane = image.planes[0]
+      val paddedWidth = plane.rowStride / plane.pixelStride
+      val paddedBitmap = Bitmap.createBitmap(paddedWidth, height, Bitmap.Config.ARGB_8888)
+      paddedBitmap.copyPixelsFromBuffer(plane.buffer)
+      val croppedBitmap = if (paddedWidth == width) {
+        paddedBitmap
+      } else {
+        Bitmap.createBitmap(paddedBitmap, 0, 0, width, height).also { paddedBitmap.recycle() }
+      }
+      val outputBitmap = croppedBitmap
+
+      val bytes = ByteArrayOutputStream()
+      outputBitmap.compress(Bitmap.CompressFormat.JPEG, JPEG_QUALITY, bytes)
+      val outputWidth = outputBitmap.width
+      val outputHeight = outputBitmap.height
+      outputBitmap.recycle()
+      MobileMediaEvents.emit(
+        "tensamin-mobile-screen-frame",
+        JSONObject()
+          .put("data", Base64.encodeToString(bytes.toByteArray(), Base64.NO_WRAP))
+          .put("mimeType", "image/jpeg")
+          .put("width", outputWidth)
+          .put("height", outputHeight),
+      )
+    } catch (error: Throwable) {
+      if (captureActive.get()) {
+        MobileMediaEvents.emitError(error.message ?: "Unable to read a screen frame")
+      }
+    } finally {
+      image.close()
+    }
+  }
+
+  private fun startAudioCapture(activeProjection: MediaProjection): Boolean {
+    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
+      MobileMediaEvents.emitError("System audio capture requires Android 10 or newer")
+      return false
+    }
+    if (ContextCompat.checkSelfPermission(this, Manifest.permission.RECORD_AUDIO) !=
+      PackageManager.PERMISSION_GRANTED
+    ) {
+      MobileMediaEvents.emitError("Microphone permission is required for system audio capture")
+      return false
+    }
+
+    return try {
+      val format = AudioFormat.Builder()
+        .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+        .setSampleRate(AUDIO_SAMPLE_RATE)
+        .setChannelMask(AudioFormat.CHANNEL_IN_MONO)
+        .build()
+      val configuration = AudioPlaybackCaptureConfiguration.Builder(activeProjection)
+        .addMatchingUsage(AudioAttributes.USAGE_MEDIA)
+        .addMatchingUsage(AudioAttributes.USAGE_GAME)
+        .build()
+      val minimumBuffer = AudioRecord.getMinBufferSize(
+        AUDIO_SAMPLE_RATE,
+        AudioFormat.CHANNEL_IN_MONO,
+        AudioFormat.ENCODING_PCM_16BIT,
+      )
+      check(minimumBuffer > 0) { "Android could not allocate a system audio buffer" }
+      val bufferSize = maxOf(minimumBuffer * 2, AUDIO_BATCH_BYTES)
+      val record = AudioRecord.Builder()
+        .setAudioFormat(format)
+        .setAudioPlaybackCaptureConfig(configuration)
+        .setBufferSizeInBytes(bufferSize)
+        .build()
+      check(record.state == AudioRecord.STATE_INITIALIZED) {
+        "Android could not initialize system audio capture"
+      }
+      audioRecord = record
+      record.startRecording()
+      audioThread = Thread({ readAudio(record) }, "tensamin-audio-capture").also { it.start() }
+      true
+    } catch (error: Throwable) {
+      audioRecord?.release()
+      audioRecord = null
+      MobileMediaEvents.emitError(error.message ?: "Unable to capture system audio")
+      false
+    }
+  }
+
+  private fun readAudio(record: AudioRecord) {
+    val buffer = ByteArray(AUDIO_BATCH_BYTES)
+    while (captureActive.get() && !Thread.currentThread().isInterrupted) {
+      val read = record.read(buffer, 0, buffer.size, AudioRecord.READ_BLOCKING)
+      if (read > 0 && captureActive.get()) {
+        MobileMediaEvents.emit(
+          "tensamin-mobile-screen-audio",
+          JSONObject()
+            .put("data", Base64.encodeToString(buffer, 0, read, Base64.NO_WRAP))
+            .put("sampleRate", AUDIO_SAMPLE_RATE)
+            .put("channelCount", 1)
+            .put("encoding", "pcm16le"),
+        )
+      } else if (read < 0 && captureActive.get()) {
+        MobileMediaEvents.emitError("System audio capture stopped with code $read")
+        return
+      }
+    }
+  }
+
+  @Synchronized
+  private fun stopCapture(stopProjection: Boolean, emitStopped: Boolean) {
+    val wasActive = captureActive.getAndSet(false)
+
+    val record = audioRecord
+    audioRecord = null
+    try {
+      record?.stop()
+    } catch (_: IllegalStateException) {
+    }
+    record?.release()
+    audioThread?.interrupt()
+    audioThread = null
+
+    imageReader?.setOnImageAvailableListener(null, null)
+    virtualDisplay?.release()
+    virtualDisplay = null
+    imageReader?.close()
+    imageReader = null
+
+    val oldProjection = projection
+    projection = null
+    oldProjection?.unregisterCallback(projectionCallback)
+    if (stopProjection) oldProjection?.stop()
+
+    captureThread?.quitSafely()
+    captureThread = null
+    lastFrameAt = 0L
+
+    if (wasActive && emitStopped) {
+      MobileMediaEvents.emit("tensamin-mobile-screen-stopped")
+    }
+  }
+
+  companion object {
+    private const val ACTION_STOP = "net.tensamin.client.STOP_SCREEN_SHARE"
+    private const val EXTRA_RESULT_CODE = "resultCode"
+    private const val EXTRA_PERMISSION_DATA = "permissionData"
+    private const val EXTRA_INCLUDE_AUDIO = "includeAudio"
+    private const val NOTIFICATION_CHANNEL_ID = "screen-sharing"
+    private const val NOTIFICATION_ID = 7314
+    private const val FRAME_INTERVAL_MS = 75L
+    private const val MAX_FRAME_WIDTH = 1280
+    private const val JPEG_QUALITY = 72
+    private const val AUDIO_SAMPLE_RATE = 48_000
+    private const val AUDIO_BATCH_BYTES = 9_600
+
+    fun start(context: Context, resultCode: Int, data: Intent, includeAudio: Boolean) {
+      val intent = Intent(context, MediaProjectionService::class.java)
+        .putExtra(EXTRA_RESULT_CODE, resultCode)
+        .putExtra(EXTRA_PERMISSION_DATA, data)
+        .putExtra(EXTRA_INCLUDE_AUDIO, includeAudio)
+      ContextCompat.startForegroundService(context, intent)
+    }
+
+    fun stop(context: Context) {
+      context.startService(
+        Intent(context, MediaProjectionService::class.java).setAction(ACTION_STOP),
+      )
+    }
+  }
+}

apps/tauri/src-tauri/gen/android/app/src/main/java/net/tensamin/client/MobileMediaEvents.kt

@@ -0,0 +1,29 @@
+package net.tensamin.client
+
+import android.webkit.WebView
+import java.lang.ref.WeakReference
+import org.json.JSONObject
+
+object MobileMediaEvents {
+  private var webView = WeakReference<WebView>(null)
+
+  fun attach(value: WebView) {
+    webView = WeakReference(value)
+  }
+
+  fun detach() {
+    webView.clear()
+  }
+
+  fun emitError(message: String) {
+    emit("tensamin-mobile-screen-error", JSONObject().put("message", message))
+  }
+
+  fun emit(name: String, detail: JSONObject = JSONObject()) {
+    val view = webView.get() ?: return
+    val script = "window.dispatchEvent(new CustomEvent(" +
+      JSONObject.quote(name) +
+      ", { detail: " + detail.toString() + " }));"
+    view.post { view.evaluateJavascript(script, null) }
+  }
+}

apps/tauri/src-tauri/gen/android/app/src/main/java/net/tensamin/client/MtpBootReceiver.kt

@@ -0,0 +1,17 @@
+package net.tensamin.client
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+
+class MtpBootReceiver : BroadcastReceiver() {
+  override fun onReceive(context: Context, intent: Intent) {
+    if (
+      intent.action == Intent.ACTION_BOOT_COMPLETED &&
+      MtpSecureStore.isEnabled(context) &&
+      MtpSecureStore.hasConfig(context)
+    ) {
+      NativeMtpBridge.startService(context)
+    }
+  }
+}

apps/tauri/src-tauri/gen/android/app/src/main/java/net/tensamin/client/MtpForegroundService.kt

@@ -0,0 +1,167 @@
+package net.tensamin.client
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.content.pm.ServiceInfo
+import android.net.ConnectivityManager
+import android.net.Network
+import android.net.NetworkCapabilities
+import android.os.Build
+import android.os.IBinder
+import android.os.Process
+import android.os.SystemClock
+import androidx.core.app.NotificationCompat
+
+class MtpForegroundService : Service() {
+  private var started = false
+  private val networkCallback = object : ConnectivityManager.NetworkCallback() {
+    override fun onAvailable(network: Network) = refreshNotification()
+    override fun onLost(network: Network) = refreshNotification()
+    override fun onCapabilitiesChanged(network: Network, capabilities: NetworkCapabilities) =
+      refreshNotification()
+  }
+
+  override fun onBind(intent: Intent?): IBinder? = null
+
+  override fun onCreate() {
+    super.onCreate()
+    getSystemService(ConnectivityManager::class.java)
+      .registerDefaultNetworkCallback(networkCallback)
+  }
+
+  override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+    if (intent?.action == ACTION_STOP) {
+      MtpSecureStore.setEnabled(this, false)
+      stopForeground(STOP_FOREGROUND_REMOVE)
+      stopSelf()
+      return START_NOT_STICKY
+    }
+
+    if (started) return START_STICKY
+
+    createChannel(this)
+    connectionStatus = "Connecting"
+    val notification = buildNotification(this, displayedStatus(this))
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+      startForeground(
+        NOTIFICATION_ID,
+        notification,
+        ServiceInfo.FOREGROUND_SERVICE_TYPE_SPECIAL_USE,
+      )
+    } else {
+      startForeground(NOTIFICATION_ID, notification)
+    }
+    val config = MtpSecureStore.loadConfig(this)
+    if (config == null || !MtpSecureStore.isEnabled(this)) {
+      stopForeground(STOP_FOREGROUND_REMOVE)
+      stopSelf()
+      return START_NOT_STICKY
+    }
+
+    try {
+      NativeMtpBridge.nativeAttach(applicationContext)
+      NativeMtpBridge.nativeStart(config)
+      started = true
+      NativeMtpBridge.log(2, "Started MTP foreground service")
+    } catch (error: Throwable) {
+      NativeMtpBridge.log(0, "Failed to start MTP foreground service", error)
+      updateNotification(this, "Connection failed")
+    }
+    return START_STICKY
+  }
+
+  override fun onTaskRemoved(rootIntent: Intent?) {
+    val preferences = getSharedPreferences(SERVICE_PREFERENCES, Context.MODE_PRIVATE)
+    val now = SystemClock.elapsedRealtime()
+    if (now - preferences.getLong(LAST_TASK_RESTART, 0) < TASK_RESTART_COOLDOWN_MS) {
+      super.onTaskRemoved(rootIntent)
+      return
+    }
+    preferences.edit().putLong(LAST_TASK_RESTART, now).commit()
+    if (MtpSecureStore.isEnabled(this) && MtpSecureStore.hasConfig(this)) {
+      startService(Intent(this, MtpForegroundService::class.java))
+    }
+    super.onTaskRemoved(rootIntent)
+    // Tauri cannot recreate its WebView after the UI task is removed while this process survives.
+    Process.killProcess(Process.myPid())
+  }
+
+  override fun onDestroy() {
+    getSystemService(ConnectivityManager::class.java).unregisterNetworkCallback(networkCallback)
+    if (!MtpSecureStore.isEnabled(this)) NativeMtpBridge.nativeStop()
+    super.onDestroy()
+  }
+
+  private fun refreshNotification() {
+    updateNotification(this, connectionStatus)
+  }
+
+  companion object {
+    private const val CHANNEL_ID = "tensamin-connection"
+    private const val NOTIFICATION_ID = 2201
+    private const val ACTION_STOP = "net.tensamin.client.STOP_MTP"
+    private const val SERVICE_PREFERENCES = "tensamin-service"
+    private const val LAST_TASK_RESTART = "last-task-restart"
+    private const val TASK_RESTART_COOLDOWN_MS = 15_000L
+    @Volatile private var connectionStatus = "Connecting"
+
+    fun updateNotification(context: Context, status: String) {
+      if (!MtpSecureStore.isEnabled(context)) return
+      connectionStatus = status
+      createChannel(context)
+      context.getSystemService(NotificationManager::class.java)
+        .notify(NOTIFICATION_ID, buildNotification(context, displayedStatus(context)))
+    }
+
+    private fun displayedStatus(context: Context): String {
+      val connectivity = context.getSystemService(ConnectivityManager::class.java)
+      val network = connectivity.activeNetwork ?: return "No network"
+      val capabilities = connectivity.getNetworkCapabilities(network) ?: return "No network"
+      return if (
+        capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) &&
+        capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)
+      ) connectionStatus else "No network"
+    }
+
+    private fun createChannel(context: Context) {
+      if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+      context.getSystemService(NotificationManager::class.java).createNotificationChannel(
+        NotificationChannel(
+          CHANNEL_ID,
+          "Background connection",
+          NotificationManager.IMPORTANCE_LOW,
+        ).apply { description = "Keeps Tensamin connected for incoming messages" },
+      )
+    }
+
+    private fun buildNotification(context: Context, status: String): Notification {
+      val openIntent = PendingIntent.getActivity(
+        context,
+        0,
+        Intent(context, MainActivity::class.java),
+        PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+      )
+      val stopIntent = PendingIntent.getService(
+        context,
+        1,
+        Intent(context, MtpForegroundService::class.java).setAction(ACTION_STOP),
+        PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+      )
+      return NotificationCompat.Builder(context, CHANNEL_ID)
+        .setSmallIcon(android.R.drawable.stat_notify_sync)
+        .setContentTitle("Tensamin")
+        .setContentText(status)
+        .setContentIntent(openIntent)
+        .setOngoing(true)
+        .setCategory(Notification.CATEGORY_SERVICE)
+        .setPriority(NotificationCompat.PRIORITY_LOW)
+        .addAction(android.R.drawable.ic_menu_close_clear_cancel, "Stop", stopIntent)
+        .build()
+    }
+  }
+}

apps/tauri/src-tauri/gen/android/app/src/main/java/net/tensamin/client/MtpSecureStore.kt

@@ -0,0 +1,74 @@
+package net.tensamin.client
+
+import android.content.Context
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.Base64
+import java.security.KeyStore
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+object MtpSecureStore {
+  private const val KEY_ALIAS = "tensamin-mtp-config"
+  private const val PREFS = "tensamin-mtp"
+  private const val CONFIG = "config"
+  private const val ENABLED = "enabled"
+
+  fun saveConfig(context: Context, config: String) {
+    val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+    cipher.init(Cipher.ENCRYPT_MODE, getOrCreateKey())
+    val encrypted = cipher.doFinal(config.toByteArray(Charsets.UTF_8))
+    val payload = Base64.encodeToString(cipher.iv + encrypted, Base64.NO_WRAP)
+    preferences(context).edit().putString(CONFIG, payload).apply()
+  }
+
+  fun loadConfig(context: Context): String? {
+    val payload = preferences(context).getString(CONFIG, null) ?: return null
+    return runCatching {
+      val bytes = Base64.decode(payload, Base64.NO_WRAP)
+      require(bytes.size > 12)
+      val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+      cipher.init(
+        Cipher.DECRYPT_MODE,
+        getOrCreateKey(),
+        GCMParameterSpec(128, bytes.copyOfRange(0, 12)),
+      )
+      String(cipher.doFinal(bytes.copyOfRange(12, bytes.size)), Charsets.UTF_8)
+    }.getOrNull()
+  }
+
+  fun hasConfig(context: Context): Boolean = loadConfig(context) != null
+
+  fun setEnabled(context: Context, enabled: Boolean) {
+    preferences(context).edit().putBoolean(ENABLED, enabled).apply()
+  }
+
+  fun isEnabled(context: Context): Boolean =
+    preferences(context).getBoolean(ENABLED, false)
+
+  private fun preferences(context: Context) =
+    context.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+
+  private fun getOrCreateKey(): SecretKey {
+    val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
+    (keyStore.getKey(KEY_ALIAS, null) as? SecretKey)?.let { return it }
+
+    val generator = KeyGenerator.getInstance(
+      KeyProperties.KEY_ALGORITHM_AES,
+      "AndroidKeyStore",
+    )
+    generator.init(
+      KeyGenParameterSpec.Builder(
+        KEY_ALIAS,
+        KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT,
+      )
+        .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+        .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+        .setKeySize(256)
+        .build(),
+    )
+    return generator.generateKey()
+  }
+}

apps/tauri/src-tauri/gen/android/app/src/main/java/net/tensamin/client/NativeAccessibilityBridge.kt

@@ -0,0 +1,51 @@
+package net.tensamin.client
+
+import android.content.Context
+import android.webkit.WebView
+import androidx.annotation.Keep
+import java.lang.ref.WeakReference
+
+@Keep
+object NativeAccessibilityBridge {
+  const val DEFAULT_INITIAL_SCALE = 290
+  private const val MIN_INITIAL_SCALE = 210
+  private const val MAX_INITIAL_SCALE = 500
+  private const val PREFERENCES = "tensamin-accessibility"
+  private const val INITIAL_SCALE = "initial-scale"
+
+  private var webView = WeakReference<WebView>(null)
+
+  init {
+    System.loadLibrary("mobile_lib")
+  }
+
+  @JvmStatic external fun nativeAttach(context: Context)
+
+  fun attach(webView: WebView) {
+    this.webView = WeakReference(webView)
+    webView.setInitialScale(getInitialScale(webView.context))
+  }
+
+  fun detach(webView: WebView) {
+    if (this.webView.get() === webView) this.webView.clear()
+  }
+
+  fun getInitialScale(context: Context): Int {
+    val preferences = context.getSharedPreferences(PREFERENCES, Context.MODE_PRIVATE)
+    val storedScale = preferences.getInt(INITIAL_SCALE, DEFAULT_INITIAL_SCALE)
+    val scale = storedScale.coerceIn(MIN_INITIAL_SCALE, MAX_INITIAL_SCALE)
+    if (scale != storedScale) preferences.edit().putInt(INITIAL_SCALE, scale).apply()
+    return scale
+  }
+
+  fun setInitialScale(context: Context, initialScale: Int) {
+    val nextScale = initialScale.coerceIn(MIN_INITIAL_SCALE, MAX_INITIAL_SCALE)
+    context.getSharedPreferences(PREFERENCES, Context.MODE_PRIVATE)
+      .edit()
+      .putInt(INITIAL_SCALE, nextScale)
+      .apply()
+    webView.get()?.let { currentWebView ->
+      currentWebView.post { currentWebView.setInitialScale(nextScale) }
+    }
+  }
+}

apps/tauri/src-tauri/gen/android/app/src/main/java/net/tensamin/client/NativeMtpBridge.kt

@@ -0,0 +1,161 @@
+package net.tensamin.client
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.graphics.BitmapFactory
+import android.net.Uri
+import android.os.Build
+import android.os.PowerManager
+import android.provider.Settings
+import android.util.Log
+import androidx.annotation.Keep
+import androidx.core.app.NotificationCompat
+import androidx.core.app.Person
+import androidx.core.content.LocusIdCompat
+import androidx.core.content.ContextCompat
+import androidx.core.content.pm.ShortcutInfoCompat
+import androidx.core.content.pm.ShortcutManagerCompat
+import androidx.core.graphics.drawable.IconCompat
+
+@Keep
+object NativeMtpBridge {
+  private const val MESSAGE_CHANNEL = "tensamin-messages"
+
+  init {
+    System.loadLibrary("mobile_lib")
+  }
+
+  @JvmStatic external fun nativeAttach(context: Context)
+  @JvmStatic external fun nativeStart(config: String)
+  @JvmStatic external fun nativeStop()
+  @JvmStatic external fun nativeSetUiState(visible: Boolean)
+  @JvmStatic external fun nativeLog(level: Int, message: String, details: String)
+
+  fun log(level: Int, message: String, error: Throwable? = null) {
+    val details = error?.stackTraceToString().orEmpty()
+    Log.println(if (level == 0) Log.ERROR else Log.INFO, "TensaminAndroid", "$message $details")
+    nativeLog(level, message, details)
+  }
+
+  fun storeConfig(context: Context, config: String) {
+    try {
+      MtpSecureStore.saveConfig(context, config)
+      if (MtpSecureStore.isEnabled(context)) startService(context)
+      log(2, "Stored native MTP credentials")
+    } catch (error: Throwable) {
+      log(0, "Failed to store native MTP credentials", error)
+      throw error
+    }
+  }
+
+  fun hasConfig(context: Context): Boolean = MtpSecureStore.hasConfig(context)
+
+  fun setServiceEnabled(context: Context, enabled: Boolean) {
+    MtpSecureStore.setEnabled(context, enabled)
+    if (enabled && MtpSecureStore.hasConfig(context)) startService(context) else stopService(context)
+  }
+
+  fun isIgnoringBatteryOptimizations(context: Context): Boolean =
+    context.getSystemService(PowerManager::class.java)
+      .isIgnoringBatteryOptimizations(context.packageName)
+
+  fun requestBatteryExemption(context: Context) {
+    val intent = Intent(
+      Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS,
+      Uri.parse("package:${context.packageName}"),
+    ).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+    context.startActivity(intent)
+  }
+
+  fun startService(context: Context) {
+    ContextCompat.startForegroundService(
+      context,
+      Intent(context, MtpForegroundService::class.java),
+    )
+  }
+
+  fun stopService(context: Context) {
+    if (!context.stopService(Intent(context, MtpForegroundService::class.java))) nativeStop()
+  }
+
+  fun updateServiceStatus(context: Context, status: String) {
+    MtpForegroundService.updateNotification(context, status)
+  }
+
+  fun postMessageNotification(
+    context: Context,
+    senderId: Long,
+    sender: String,
+    body: String,
+    avatar: ByteArray,
+  ) {
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+      context.getSystemService(NotificationManager::class.java).createNotificationChannel(
+        NotificationChannel(
+          MESSAGE_CHANNEL,
+          "Messages",
+          NotificationManager.IMPORTANCE_HIGH,
+        ).apply { description = "Incoming Tensamin messages" },
+      )
+    }
+    val openIntent = Intent(
+      Intent.ACTION_VIEW,
+      Uri.parse("tensamin://chat?id=$senderId"),
+      context,
+      MainActivity::class.java,
+    ).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
+    val pendingIntent = PendingIntent.getActivity(
+      context,
+      senderId.hashCode(),
+      openIntent,
+      PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+    )
+    val avatarBitmap = avatar.takeIf { it.isNotEmpty() }?.let {
+      BitmapFactory.decodeByteArray(it, 0, it.size)
+    }
+    val avatarIcon = avatarBitmap?.let(IconCompat::createWithAdaptiveBitmap)
+    val person = Person.Builder()
+      .setName(sender)
+      .setKey(senderId.toString())
+      .setIcon(avatarIcon)
+      .build()
+    val shortcutId = "chat-$senderId"
+    val shortcut = ShortcutInfoCompat.Builder(context, shortcutId)
+      .setShortLabel(sender)
+      .setLongLived(true)
+      .setPerson(person)
+      .setIntent(openIntent)
+      .apply { if (avatarIcon != null) setIcon(avatarIcon) }
+      .build()
+    ShortcutManagerCompat.pushDynamicShortcut(context, shortcut)
+
+    val style = NotificationCompat.MessagingStyle(
+      Person.Builder().setName("You").build(),
+    ).addMessage(body, System.currentTimeMillis(), person)
+    val notification = NotificationCompat.Builder(context, MESSAGE_CHANNEL)
+      .setSmallIcon(R.drawable.ic_notification_small)
+      .setContentTitle(sender)
+      .setContentText(body)
+      .setStyle(style)
+      .setShortcutId(shortcutId)
+      .setLocusId(LocusIdCompat(shortcutId))
+      .setLargeIcon(avatarBitmap)
+      .setCategory(Notification.CATEGORY_MESSAGE)
+      .setAutoCancel(true)
+      .setContentIntent(pendingIntent)
+      .setPriority(NotificationCompat.PRIORITY_HIGH)
+      .build()
+    context.getSystemService(NotificationManager::class.java)
+      .notify(senderId.hashCode(), notification)
+  }
+
+  fun cancelMessageNotification(context: Context, senderId: Long) {
+    context.getSystemService(NotificationManager::class.java)
+      .cancel(senderId.hashCode())
+  }
+
+}

apps/tauri/src-tauri/gen/android/build.gradle.kts

@@ -1,4 +1,4 @@
-import com.android.build.gradle.LibraryExtension
+import com.android.build.api.dsl.LibraryExtension
 
 buildscript {
     repositories {
@@ -7,7 +7,7 @@ buildscript {
     }
     dependencies {
         classpath("com.android.tools.build:gradle:8.11.0")
-        classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.25")
+        classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:2.1.20")
     }
 }
 

apps/tauri/src-tauri/gen/android/buildSrc/build.gradle.kts

@@ -20,4 +20,3 @@ dependencies {
     compileOnly(gradleApi())
     implementation("com.android.tools.build:gradle:8.11.0")
 }
-

apps/tauri/src-tauri/gen/android/buildSrc/src/main/java/net/tensamin/client/kotlin/BuildTask.kt

@@ -5,8 +5,12 @@ import org.gradle.api.GradleException
 import org.gradle.api.logging.LogLevel
 import org.gradle.api.tasks.Input
 import org.gradle.api.tasks.TaskAction
+import org.gradle.process.ExecOperations
+import javax.inject.Inject
 
-open class BuildTask : DefaultTask() {
+open class BuildTask @Inject constructor(
+    private val execOperations: ExecOperations,
+) : DefaultTask() {
     @Input
     var rootDirRel: String? = null
     @Input
@@ -50,7 +54,7 @@ open class BuildTask : DefaultTask() {
         val release = release ?: throw GradleException("release cannot be null")
         val args = listOf("tauri", "android", "android-studio-script");
 
-        project.exec {
+        execOperations.exec {
             workingDir(File(project.projectDir, rootDirRel))
             executable(executable)
             args(args)
@@ -65,4 +69,4 @@ open class BuildTask : DefaultTask() {
             args(listOf("--target", target))
         }.assertNormalExitValue()
     }
-}
+}

apps/tauri/src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 #Tue May 10 19:22:52 CST 2022
 distributionBase=GRADLE_USER_HOME
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
 distributionPath=wrapper/dists
 zipStorePath=wrapper/dists
 zipStoreBase=GRADLE_USER_HOME