Skip to content

Android phones: review fixes that missed #143 - #144

Merged
danielehrhardt merged 2 commits into
mainfrom
fix/android-phones-review
Oct 11, 2026
Merged

danielehrhardt merged 2 commits into
mainfrom
fix/android-phones-review

Conversation

@danielehrhardt

Copy link
Copy Markdown
Contributor

The last commit of #143 (be20af6, the fixes from its code review) was pushed before the merge, but GitHub never synced it into the PR, so #143 was merged without it. This brings it to main unchanged.

  • Saved logins on phones only for runs that may reveal secrets: whatever is typed on a phone can be read through its shell. Secrets go to adb shell on stdin (not in process arguments on the computer), 2FA codes are masked too, the UI dump gets a fresh name each time.
  • android_assign only gives a phone to another agent, never to the caller or its own chat.
  • adb's stderr is capped like stdout (a command writing without end to stderr could fill the memory).
  • Live view: video and still pictures side by side (viewers without WebCodecs watch along), stills reach video viewers only when the phone can't stream, restarts are spaced out per device so one slow viewer can't keep restarting everyone's stream, no screenrecord left running after a stop.
  • Input on a letterboxed video (screen edges rounded to multiples of 16) maps to the right pixel; edge pixels clamp.
  • pull_file refuses folders and cleans up after itself; a refresh that must start adb isn't swallowed by one already running.
  • Emulators nobody named, described or assigned are forgotten after a day out of sight; the phones page groups the ones that aren't connected.

Tests: test/android.test.ts 19 pass (reveal-only fills via stdin, manager self-assignment refused, letterbox mapping, folder pulls), related suites 201 pass. CI on the commit itself was green (run 38139290557).

- Saved logins on phones only for runs that may reveal secrets: what is typed
  on a phone can be read through its shell. Secrets go to adb on stdin (not in
  process arguments here), 2FA codes are masked too, the UI dump gets a fresh
  name each time.
- android_assign only gives phones to other agents, never to the caller or
  its own chat.
- adb stderr is capped like stdout.
- Live view: video and still pictures side by side (viewers without WebCodecs
  watch along), stills only go to video viewers when the phone can't stream,
  restarts are spaced out per device (a congested viewer can't restart
  everyone's stream), no screenrecord left running after a stop.
- Input on letterboxed video maps to the right pixel; edge pixels clamp.
- pull_file refuses folders and cleans up after itself; open_app quoting;
  a refresh that must start adb isn't swallowed by one in flight.
- Emulators nobody named, described or assigned are forgotten after a day
  out of sight; the page groups phones that aren't connected.
@danielehrhardt
danielehrhardt merged commit f16d6f7 into main Oct 11, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant