xieyao/opencode-mobile
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
821672048cec63d9b69e033053cc42291641226b
opencode-mobile/CONTRIBUTING.md
Den 2b9b571d6e feat(privacy+dist): telemetry consent gate + app store distribution prep (#4) 
* fix(security): fail closed on biometric init error

H-03: setting isAuthenticated: true on initialization failure was a
security bypass — any crash during biometric setup granted full access.
Fail closed instead; user sees auth prompt on next open.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): use Crypto.randomUUID for connection IDs

H-04: Math.random() is not cryptographically random. Connection IDs are
used as SecureStore key suffixes; switch to expo-crypto randomUUID for
a secure source.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(deps): pin expo-crypto to ~15.0.9

15.0.10 does not exist on npm; ~15.0.9 is the latest stable in the 15.x series compatible with Expo SDK 54.

* feat: add OpenCode Connect coming-soon waitlist card

Adds a discoverable 'OpenCode Connect — Coming Soon' card to the
add-connection quick-connect screen. Users can enter their email and
tap 'Join Waitlist' to send a pre-filled mailto. No backend required.

* fix(cua): detect actual screen dimensions and fix JSON parsing

- Get real screen size via `wm size` instead of hardcoding 1080x2400;
  emulator is 1080x1920 so y-coordinates were systematically off
- Extract first JSON object via regex when model returns multiple objects
- Use AZURE_OPENAI_MODEL env var for deployment name (defaults gpt-5.4)
- Add AZURE_DEV_AI_* path for Azure AI Foundry endpoints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(security): SHA-pin upload-google-play and sanitize notification bodies

M-02: Pin r0adkll/upload-google-play to commit SHA e738b9d (v1.1.5)
to prevent supply-chain hijack via tag mutation.

M-03: Sanitize all push notification bodies — strip control chars,
truncate to 200 chars. Prevents server-supplied strings (error messages,
file paths from permission patterns, session titles) from leaking
unbounded text into the OS notification drawer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(privacy): add telemetry consent gate for Sentry crash reporting

Sentry was always-on, violating F-Droid anti-feature policy and user
trust norms. Now gated behind explicit opt-in:

- First-launch consent modal (TelemetryConsentModal) shows once on
  fresh install; user can Allow or Decline.
- Consent state persisted in expo-secure-store (survives restarts).
- Settings > Privacy section: crash reporting toggle + privacy policy link.
- initSentry() called only after consent granted — not on app start.

Closes #3 (partial)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(config): add real icons and complete iOS/Android app.json config

- Add 1024×1024 app icon, 432×432 adaptive icon foreground, 200×200 splash
- iOS: push notification entitlement (aps-environment: production), speech/
  microphone/camera/photo usage descriptions for future features, disable
  ITSAppUsesNonExemptEncryption
- Android: adaptive icon with dark background (#0F172A), versionCode: 1
- expo-notifications plugin wired in app.json

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(dist): add iOS CI workflow, README rewrite, CONTRIBUTING, and LICENSE

- publish-app-store.yml: EAS Build + TestFlight submission; runs on tag/release/
  workflow_dispatch; bumps ios.buildNumber from github.run_number
- README: full rewrite — features, install badges, connection guide, contributing
- CONTRIBUTING.md: contribution guide for OSS contributors
- LICENSE: MIT

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs(dist): add store listings, strategy, privacy policy, F-Droid/IzzyOnDroid templates

- distribution/strategy.md: monetization strategy (free client + opencode Cloud)
- distribution/play-listing.md: Google Play store copy (name, description, tags)
- distribution/app-store-listing.md: App Store listing copy
- distribution/privacy-policy.{md,html}: GDPR-compliant privacy policy
- distribution/PLAY_CONSOLE_SETUP.md: Play Console setup runbook
- distribution/ios-enrollment-runbook.md: Apple Developer Program enrollment steps
- distribution/SIGNING-KEY-FINGERPRINTS.md: keystore fingerprint for reproducible builds
- distribution/fdroid-submission/: F-Droid metadata template
- distribution/izzyondroid-submission/: IzzyOnDroid submission template
- distribution/whatsnew/: Play Store release notes (en-US)
- distribution/whatsnew-ios/: TestFlight release notes
- distribution/play-graphics/: Play Store screenshot placeholders
- distribution/app-store-graphics/: App Store screenshot placeholders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(telemetry): handle SecureStore failure + Android back button

- add .catch() on loadTelemetryConsent() so SecureStore rejection
  shows the consent modal instead of blocking startup forever
- add onRequestClose={onDecline} to Modal so Android back button
  records the decline rather than silently dismissing
- fix catch block in telemetry.ts to not clobber _resolved when
  SecureStore read fails mid-session

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): run gradlew clean to prevent stale modules.json duplicate

Sentry Gradle plugin writes modules.json to src/main/assets; cached
build intermediates contain an old copy → mergeReleaseAssets fails
with 'Duplicate resources'. Running clean before assembleRelease
clears the intermediate state.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): remove android build output cache causing duplicate modules.json

Caching android/app/build/intermediates and android/app/.cxx causes
two issues:
1. Stale modules.json in intermediates → Duplicate resources error
2. .cxx CMake artifacts reference absolute paths → ninja clean fails

Keeping only Gradle distribution cache (~/.gradle) which is safe.
Expo prebuild regenerates android sources fresh each run anyway.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-25 17:42:03 -07:00

5.2 KiB
Raw Blame History

Contributing to OpenCode Mobile

Thank you for your interest in contributing. This document covers how to set up the dev environment, run the app, connect to a local opencode server for testing, code style, and the contribution process.

Table of Contents

  1. Dev environment setup
  2. Running on an emulator or device
  3. Connecting to a local opencode server
  4. Code style and linting
  5. Filing a bug
  6. Proposing a feature
  7. Submitting a pull request
  8. Developer Certificate of Origin
  9. Code of Conduct

Dev environment setup

Prerequisites

  • Node.js 18 or 20 (check with node --version)
  • npm 9+ or bun (bun is faster — install via npm install -g bun)
  • Expo CLI: npm install -g expo-cli (optional — npx expo works too)
  • For Android: Android Studio + an AVD or a physical device with USB debugging
  • For iOS: macOS + Xcode 15+

Clone and install

git clone https://github.com/dzianisv/opencode-mobile.git
cd opencode-mobile
npm install       # or: bun install

Environment variables

Copy the example env file and fill in optional values (Sentry DSN is only needed for crash testing):

cp .env.example .env   # if the example doesn't exist yet, skip this

Running on an emulator or device

Android

# Start an Android emulator from Android Studio first, then:
npx expo start --android

# Or run the dev build directly:
npm run android

iOS (macOS only)

npx expo start --ios

# Or:
npm run ios

Expo Go (fastest for quick experiments)

npx expo start
# Scan the QR code with Expo Go on your phone

Note: Some native modules (biometric auth, secure store) require a development build and will not work in Expo Go. Use npx expo run:android / npx expo run:ios for a full dev build.

Connecting to a local opencode server

You need a running opencode server to test the app end-to-end.

# Install opencode
npm install -g opencode

# Start it in server mode on all interfaces
OPENCODE_SERVER_PASSWORD=devpassword opencode serve --hostname 0.0.0.0 --port 4096

In the app, add a connection:

  • Emulator on same machine: http://10.0.2.2:4096 (Android AVD) or http://localhost:4096 (iOS Simulator)
  • Physical device on same LAN: http://<your-machine-LAN-IP>:4096
  • Tunnel for remote testing: run npx cloudflared tunnel --url http://localhost:4096 and use the provided HTTPS URL

Code style and linting

The project uses ESLint and TypeScript strict mode. Run before committing:

npm run lint          # ESLint
npm run typecheck     # TypeScript type check (tsc --noEmit)

There is no auto-formatter enforced by CI yet (Prettier is configured but optional). Keeping existing style consistent is more important than personal preference.

Key conventions:

  • Components: functional, with typed props via TypeScript interface
  • State: Zustand stores in src/stores/
  • API calls: through the SDK client in src/lib/
  • Screens: file-based routing via Expo Router under app/

Filing a bug

Use the Bug Report template.

Please include:

  • App version (visible in Settings screen)
  • opencode server version (opencode --version)
  • OS and version (e.g. Android 14, iOS 17.4)
  • Steps to reproduce
  • What you expected vs. what happened
  • Crash logs or screenshots if available

Security vulnerabilities: do NOT file public issues. See SECURITY.md.

Proposing a feature

Use the Feature Request template or start a GitHub Discussion if you want to explore the idea before opening a formal issue.

Submitting a pull request

  1. Fork the repo and create a branch off main: git checkout -b feat/my-feature
  2. Make your changes. Keep commits focused — one logical change per commit.
  3. Ensure npm run lint and npm run typecheck pass.
  4. If you changed UI, include a screenshot in the PR description.
  5. Open the PR against dzianisv/opencode-mobile main. Fill in the PR template.
  6. A maintainer will review within a few business days.

PRs that add new npm dependencies will receive extra scrutiny — keep the bundle lean.

Developer Certificate of Origin

This project does not require a formal Contributor License Agreement (CLA). By submitting a pull request you confirm that:

  • You wrote the contribution yourself, or have the right to submit it under the MIT License.
  • You grant VIBE TECHNOLOGIES, LLC and the project's users a perpetual, worldwide, royalty-free license under the MIT License terms.

That's it — no paperwork.

Code of Conduct

This project follows the Contributor Covenant Code of Conduct. Please treat everyone with respect. Report issues to support@vibebrowser.app.

Reference in New Issue View Git Blame Copy Permalink