xieyao/opencode-mobile
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat(privacy+dist): telemetry consent gate + app store distribution prep (#4)

Browse Source 
* fix(security): fail closed on biometric init error

H-03: setting isAuthenticated: true on initialization failure was a
security bypass — any crash during biometric setup granted full access.
Fail closed instead; user sees auth prompt on next open.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): use Crypto.randomUUID for connection IDs

H-04: Math.random() is not cryptographically random. Connection IDs are
used as SecureStore key suffixes; switch to expo-crypto randomUUID for
a secure source.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(deps): pin expo-crypto to ~15.0.9

15.0.10 does not exist on npm; ~15.0.9 is the latest stable in the 15.x series compatible with Expo SDK 54.

* feat: add OpenCode Connect coming-soon waitlist card

Adds a discoverable 'OpenCode Connect — Coming Soon' card to the
add-connection quick-connect screen. Users can enter their email and
tap 'Join Waitlist' to send a pre-filled mailto. No backend required.

* fix(cua): detect actual screen dimensions and fix JSON parsing

- Get real screen size via `wm size` instead of hardcoding 1080x2400;
  emulator is 1080x1920 so y-coordinates were systematically off
- Extract first JSON object via regex when model returns multiple objects
- Use AZURE_OPENAI_MODEL env var for deployment name (defaults gpt-5.4)
- Add AZURE_DEV_AI_* path for Azure AI Foundry endpoints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): SHA-pin upload-google-play and sanitize notification bodies

M-02: Pin r0adkll/upload-google-play to commit SHA e738b9d (v1.1.5)
to prevent supply-chain hijack via tag mutation.

M-03: Sanitize all push notification bodies — strip control chars,
truncate to 200 chars. Prevents server-supplied strings (error messages,
file paths from permission patterns, session titles) from leaking
unbounded text into the OS notification drawer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(privacy): add telemetry consent gate for Sentry crash reporting

Sentry was always-on, violating F-Droid anti-feature policy and user
trust norms. Now gated behind explicit opt-in:

- First-launch consent modal (TelemetryConsentModal) shows once on
  fresh install; user can Allow or Decline.
- Consent state persisted in expo-secure-store (survives restarts).
- Settings > Privacy section: crash reporting toggle + privacy policy link.
- initSentry() called only after consent granted — not on app start.

Closes #3 (partial)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(config): add real icons and complete iOS/Android app.json config

- Add 1024×1024 app icon, 432×432 adaptive icon foreground, 200×200 splash
- iOS: push notification entitlement (aps-environment: production), speech/
  microphone/camera/photo usage descriptions for future features, disable
  ITSAppUsesNonExemptEncryption
- Android: adaptive icon with dark background (#0F172A), versionCode: 1
- expo-notifications plugin wired in app.json

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(dist): add iOS CI workflow, README rewrite, CONTRIBUTING, and LICENSE

- publish-app-store.yml: EAS Build + TestFlight submission; runs on tag/release/
  workflow_dispatch; bumps ios.buildNumber from github.run_number
- README: full rewrite — features, install badges, connection guide, contributing
- CONTRIBUTING.md: contribution guide for OSS contributors
- LICENSE: MIT

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs(dist): add store listings, strategy, privacy policy, F-Droid/IzzyOnDroid templates

- distribution/strategy.md: monetization strategy (free client + opencode Cloud)
- distribution/play-listing.md: Google Play store copy (name, description, tags)
- distribution/app-store-listing.md: App Store listing copy
- distribution/privacy-policy.{md,html}: GDPR-compliant privacy policy
- distribution/PLAY_CONSOLE_SETUP.md: Play Console setup runbook
- distribution/ios-enrollment-runbook.md: Apple Developer Program enrollment steps
- distribution/SIGNING-KEY-FINGERPRINTS.md: keystore fingerprint for reproducible builds
- distribution/fdroid-submission/: F-Droid metadata template
- distribution/izzyondroid-submission/: IzzyOnDroid submission template
- distribution/whatsnew/: Play Store release notes (en-US)
- distribution/whatsnew-ios/: TestFlight release notes
- distribution/play-graphics/: Play Store screenshot placeholders
- distribution/app-store-graphics/: App Store screenshot placeholders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(telemetry): handle SecureStore failure + Android back button

- add .catch() on loadTelemetryConsent() so SecureStore rejection
  shows the consent modal instead of blocking startup forever
- add onRequestClose={onDecline} to Modal so Android back button
  records the decline rather than silently dismissing
- fix catch block in telemetry.ts to not clobber _resolved when
  SecureStore read fails mid-session

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): run gradlew clean to prevent stale modules.json duplicate

Sentry Gradle plugin writes modules.json to src/main/assets; cached
build intermediates contain an old copy → mergeReleaseAssets fails
with 'Duplicate resources'. Running clean before assembleRelease
clears the intermediate state.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): remove android build output cache causing duplicate modules.json

Caching android/app/build/intermediates and android/app/.cxx causes
two issues:
1. Stale modules.json in intermediates → Duplicate resources error
2. .cxx CMake artifacts reference absolute paths → ninja clean fails

Keeping only Gradle distribution cache (~/.gradle) which is safe.
Expo prebuild regenerates android sources fresh each run anyway.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Den
2026-05-25 17:42:03 -07:00
committed by GitHub
parent 7ea41216c8
commit 2b9b571d6e
51 changed files with 3463 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

167
CONTRIBUTING.md Normal file
View File

@@ -0,0 +1,167 @@
# Contributing to OpenCode Mobile
Thank you for your interest in contributing. This document covers how to set up the dev environment, run the app, connect to a local opencode server for testing, code style, and the contribution process.
---
## Table of Contents
1. [Dev environment setup](#dev-environment-setup)
2. [Running on an emulator or device](#running-on-an-emulator-or-device)
3. [Connecting to a local opencode server](#connecting-to-a-local-opencode-server)
4. [Code style and linting](#code-style-and-linting)
5. [Filing a bug](#filing-a-bug)
6. [Proposing a feature](#proposing-a-feature)
7. [Submitting a pull request](#submitting-a-pull-request)
8. [Developer Certificate of Origin](#developer-certificate-of-origin)
9. [Code of Conduct](#code-of-conduct)
---
## Dev environment setup
**Prerequisites**
- Node.js 18 or 20 (check with `node --version`)
- npm 9+ or bun (bun is faster — install via `npm install -g bun`)
- Expo CLI: `npm install -g expo-cli` (optional — `npx expo` works too)
- For Android: Android Studio + an AVD or a physical device with USB debugging
- For iOS: macOS + Xcode 15+
**Clone and install**
```bash
git clone https://github.com/dzianisv/opencode-mobile.git
cd opencode-mobile
npm install # or: bun install
```
**Environment variables**
Copy the example env file and fill in optional values (Sentry DSN is only needed for crash testing):
```bash
cp .env.example .env # if the example doesn't exist yet, skip this
```
---
## Running on an emulator or device
**Android**
```bash
# Start an Android emulator from Android Studio first, then:
npx expo start --android
# Or run the dev build directly:
npm run android
```
**iOS (macOS only)**
```bash
npx expo start --ios
# Or:
npm run ios
```
**Expo Go (fastest for quick experiments)**
```bash
npx expo start
# Scan the QR code with Expo Go on your phone
```
> Note: Some native modules (biometric auth, secure store) require a development build and will not work in Expo Go. Use `npx expo run:android` / `npx expo run:ios` for a full dev build.
---
## Connecting to a local opencode server
You need a running [opencode](https://github.com/sst/opencode) server to test the app end-to-end.
```bash
# Install opencode
npm install -g opencode
# Start it in server mode on all interfaces
OPENCODE_SERVER_PASSWORD=devpassword opencode serve --hostname 0.0.0.0 --port 4096
```
In the app, add a connection:
- **Emulator on same machine**: `http://10.0.2.2:4096` (Android AVD) or `http://localhost:4096` (iOS Simulator)
- **Physical device on same LAN**: `http://<your-machine-LAN-IP>:4096`
- **Tunnel for remote testing**: run `npx cloudflared tunnel --url http://localhost:4096` and use the provided HTTPS URL
---
## Code style and linting
The project uses ESLint and TypeScript strict mode. Run before committing:
```bash
npm run lint # ESLint
npm run typecheck # TypeScript type check (tsc --noEmit)
```
There is no auto-formatter enforced by CI yet (Prettier is configured but optional). Keeping existing style consistent is more important than personal preference.
Key conventions:
- Components: functional, with typed props via TypeScript `interface`
- State: Zustand stores in `src/stores/`
- API calls: through the SDK client in `src/lib/`
- Screens: file-based routing via Expo Router under `app/`
---
## Filing a bug
Use the [Bug Report template](https://github.com/dzianisv/opencode-mobile/issues/new?template=bug_report.md).
Please include:
- App version (visible in Settings screen)
- opencode server version (`opencode --version`)
- OS and version (e.g. Android 14, iOS 17.4)
- Steps to reproduce
- What you expected vs. what happened
- Crash logs or screenshots if available
**Security vulnerabilities**: do NOT file public issues. See [SECURITY.md](SECURITY.md).
---
## Proposing a feature
Use the [Feature Request template](https://github.com/dzianisv/opencode-mobile/issues/new?template=feature_request.md) or start a [GitHub Discussion](https://github.com/dzianisv/opencode-mobile/discussions) if you want to explore the idea before opening a formal issue.
---
## Submitting a pull request
1. Fork the repo and create a branch off `main`: `git checkout -b feat/my-feature`
2. Make your changes. Keep commits focused — one logical change per commit.
3. Ensure `npm run lint` and `npm run typecheck` pass.
4. If you changed UI, include a screenshot in the PR description.
5. Open the PR against `dzianisv/opencode-mobile main`. Fill in the PR template.
6. A maintainer will review within a few business days.
PRs that add new npm dependencies will receive extra scrutiny — keep the bundle lean.
---
## Developer Certificate of Origin
This project does not require a formal Contributor License Agreement (CLA). By submitting a pull request you confirm that:
- You wrote the contribution yourself, or have the right to submit it under the MIT License.
- You grant VIBE TECHNOLOGIES, LLC and the project's users a perpetual, worldwide, royalty-free license under the MIT License terms.
That's it — no paperwork.
---
## Code of Conduct
This project follows the [Contributor Covenant Code of Conduct](CODE_OF_CONDUCT.md). Please treat everyone with respect. Report issues to [support@vibebrowser.app](mailto:support@vibebrowser.app).