feat(KAN-53): add Android app and platform integration

native/package.json

@@ -9,7 +9,9 @@
         "build:macos": "tauri build --debug --bundles app",
         "test": "node --test tests/*.test.js && cargo test --manifest-path src-tauri/Cargo.toml --locked",
         "check": "cargo fmt --manifest-path src-tauri/Cargo.toml --check && cargo clippy --manifest-path src-tauri/Cargo.toml --locked --all-targets --all-features -- -D warnings",
-        "smoke:macos": "cargo test --manifest-path src-tauri/Cargo.toml --locked --features smoke-test,custom-protocol --test macos_smoke"
+        "smoke:macos": "cargo test --manifest-path src-tauri/Cargo.toml --locked --features smoke-test,custom-protocol --test macos_smoke",
+        "dev:android": "tauri android dev",
+        "build:android": "tauri android build --debug --apk --target aarch64"
     },
     "devDependencies": {
         "@tauri-apps/cli": "2.11.4"

native/src-tauri/gen/android/.editorconfig

@@ -0,0 +1,12 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = false
+insert_final_newline = false

native/src-tauri/gen/android/.gitignore

@@ -0,0 +1,26 @@
+*.iml
+.gradle
+/local.properties
+/.idea/caches
+/.idea/libraries
+/.idea/modules.xml
+/.idea/workspace.xml
+/.idea/navEditor.xml
+/.idea/assetWizardSettings.xml
+.DS_Store
+build
+/captures
+.externalNativeBuild
+.cxx
+local.properties
+key.properties
+keystore.properties
+
+/.tauri
+/tauri.settings.gradle
+/app/tauri.build.gradle.kts
+/app/src/main/jniLibs
+/app/src/main/java/de/kanbangit/desktop/generated
+
+.kotlin
+/app/tauri.properties

native/src-tauri/gen/android/app/.gitignore

@@ -0,0 +1,6 @@
+/src/main/**/generated
+/src/main/jniLibs/**/*.so
+/src/main/assets/tauri.conf.json
+/tauri.build.gradle.kts
+/proguard-tauri.pro
+/tauri.properties

native/src-tauri/gen/android/app/build.gradle.kts

@@ -0,0 +1,76 @@
+import java.util.Properties
+
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+    id("rust")
+}
+
+val tauriProperties = Properties().apply {
+    val propFile = file("tauri.properties")
+    if (propFile.exists()) {
+        propFile.inputStream().use { load(it) }
+    }
+}
+
+android {
+    compileSdk = 36
+    buildToolsVersion = "36.0.0"
+    namespace = "de.kanbangit.desktop"
+    defaultConfig {
+        manifestPlaceholders["usesCleartextTraffic"] = "false"
+        applicationId = "de.kanbangit.desktop"
+        minSdk = 24
+        targetSdk = 36
+        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
+        // Tauri exits the process when its last activity is destroyed; report results first.
+        testInstrumentationRunnerArguments["waitForActivitiesToComplete"] = "false"
+        versionCode = tauriProperties.getProperty("tauri.android.versionCode", "1").toInt()
+        versionName = tauriProperties.getProperty("tauri.android.versionName", "1.0")
+    }
+    buildTypes {
+        getByName("debug") {
+            manifestPlaceholders["usesCleartextTraffic"] = "false"
+            isDebuggable = true
+            isJniDebuggable = true
+            isMinifyEnabled = false
+            packaging {
+                jniLibs.keepDebugSymbols.add("*/arm64-v8a/*.so")
+                jniLibs.keepDebugSymbols.add("*/armeabi-v7a/*.so")
+                jniLibs.keepDebugSymbols.add("*/x86/*.so")
+                jniLibs.keepDebugSymbols.add("*/x86_64/*.so")
+            }
+        }
+        getByName("release") {
+            isMinifyEnabled = true
+            proguardFiles(
+                *fileTree(".") { include("**/*.pro") }
+                    .plus(getDefaultProguardFile("proguard-android-optimize.txt"))
+                    .toList().toTypedArray()
+            )
+        }
+    }
+    kotlinOptions {
+        jvmTarget = "1.8"
+    }
+    buildFeatures {
+        buildConfig = true
+    }
+}
+
+rust {
+    rootDirRel = "../../../"
+}
+
+dependencies {
+    implementation("androidx.webkit:webkit:1.14.0")
+    implementation("androidx.appcompat:appcompat:1.7.1")
+    implementation("androidx.activity:activity-ktx:1.10.1")
+    implementation("com.google.android.material:material:1.12.0")
+    implementation("androidx.lifecycle:lifecycle-process:2.10.0")
+    testImplementation("junit:junit:4.13.2")
+    androidTestImplementation("androidx.test.ext:junit:1.1.4")
+    androidTestImplementation("androidx.test.espresso:espresso-core:3.5.0")
+}
+
+apply(from = "tauri.build.gradle.kts")

native/src-tauri/gen/android/app/proguard-rules.pro

@@ -0,0 +1,21 @@
+# Add project specific ProGuard rules here.
+# You can control the set of applied configuration files using the
+# proguardFiles setting in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile

native/src-tauri/gen/android/app/src/androidTest/java/de/kanbangit/desktop/PlatformTest.kt

@@ -0,0 +1,116 @@
+package de.kanbangit.desktop
+
+import android.content.Context
+import android.os.SystemClock
+import android.view.InputDevice
+import android.view.MotionEvent
+import android.view.View
+import android.webkit.CookieManager
+import android.webkit.WebView
+import androidx.lifecycle.Lifecycle
+import androidx.test.core.app.ActivityScenario
+import androidx.test.platform.app.InstrumentationRegistry
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import org.junit.Assert.*
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicReference
+
+@RunWith(AndroidJUnit4::class)
+class PlatformTest {
+    private val instrumentation = InstrumentationRegistry.getInstrumentation()
+
+    private fun evaluate(view: WebView, script: String): String {
+        val result = AtomicReference<String>()
+        val latch = CountDownLatch(1)
+        instrumentation.runOnMainSync { view.evaluateJavascript(script) { result.set(it); latch.countDown() } }
+        assertTrue("JavaScript callback timed out", latch.await(10, TimeUnit.SECONDS))
+        return result.get()
+    }
+
+    private fun waitFor(condition: () -> Boolean) {
+        val end = System.currentTimeMillis() + 25000
+        while (System.currentTimeMillis() < end) {
+            if (condition()) return
+            Thread.sleep(100)
+        }
+        fail("Platform condition timed out")
+    }
+
+    private fun tapCenter(view: View) {
+        val position = IntArray(2)
+        instrumentation.runOnMainSync {
+            view.getLocationOnScreen(position)
+            position[0] += view.width / 2
+            position[1] += view.height / 2
+        }
+        val downTime = SystemClock.uptimeMillis()
+        for (action in listOf(MotionEvent.ACTION_DOWN, MotionEvent.ACTION_UP)) {
+            val event = MotionEvent.obtain(downTime, SystemClock.uptimeMillis(), action, position[0].toFloat(), position[1].toFloat(), 0)
+            event.source = InputDevice.SOURCE_TOUCHSCREEN
+            try {
+                instrumentation.sendPointerSync(event)
+            } finally {
+                event.recycle()
+            }
+        }
+        instrumentation.waitForIdleSync()
+    }
+
+    @Test fun workspacePreservesFormsAndIsolatesServers() {
+        instrumentation.targetContext.getSharedPreferences("workspace", Context.MODE_PRIVATE).edit().clear().commit()
+        val scenario = ActivityScenario.launch(MainActivity::class.java)
+        Thread.sleep(1500)
+        scenario.onActivity { it.openWorkspace("https://kanbangit.de/") }
+        val remote = AtomicReference<WebView>()
+        waitFor {
+            var visible = false
+            scenario.onActivity { remote.set(it.workspace); visible = it.workspace?.visibility == View.VISIBLE }
+            visible && remote.get() != null && evaluate(remote.get(), "document.readyState === 'complete' && document.querySelector('#app')?.innerText.trim().length > 100") == "true"
+        }
+        val view = remote.get()
+        assertEquals("true", evaluate(view, "typeof window.nativeLauncher === 'undefined' && typeof window.__TAURI_INTERNALS__ === 'undefined'"))
+        assertEquals("true", evaluate(view, """
+            (() => {
+                const input = document.createElement('input');
+                input.id = 'kan53-input';
+                input.value = 'retained form';
+                document.body.append(input);
+                const button = document.createElement('button');
+                button.style.cssText = 'position:fixed;inset:0;width:100%;height:100%;z-index:2147483647';
+                button.textContent = 'Navigate';
+                button.onclick = () => {
+                    history.pushState({}, '', '/kan53-history');
+                    button.remove();
+                };
+                document.body.append(button);
+                return true;
+            })()
+        """.trimIndent()))
+        tapCenter(view)
+        waitFor { evaluate(view, "location.pathname === '/kan53-history'") == "true" }
+        waitFor {
+            var canGoBack = false
+            scenario.onActivity { canGoBack = view.canGoBack() }
+            canGoBack
+        }
+        scenario.moveToState(Lifecycle.State.CREATED)
+        scenario.moveToState(Lifecycle.State.RESUMED)
+        assertEquals("\"retained form\"", evaluate(view, "document.querySelector('#kan53-input').value"))
+        scenario.onActivity { it.onBackPressedDispatcher.onBackPressed() }
+        waitFor { evaluate(view, "location.pathname !== '/kan53-history'") == "true" }
+        assertEquals("\"retained form\"", evaluate(view, "document.querySelector('#kan53-input').value"))
+        evaluate(view, "document.cookie = 'kan53_fixture=secret; Path=/; Secure; SameSite=Lax'; localStorage.setItem('kan53_fixture', 'secret')")
+        scenario.onActivity { it.openWorkspace("https://127.0.0.1:9/") }
+        waitFor {
+            val cookie = AtomicReference<String>()
+            instrumentation.runOnMainSync { cookie.set(CookieManager.getInstance().getCookie("https://kanbangit.de/")) }
+            cookie.get()?.contains("kan53_fixture") != true
+        }
+        scenario.onActivity { assertNotSame(view, it.workspace) }
+        // Let instrumentation finish the process after reporting, rather than exiting via Tauri.
+        scenario.moveToState(Lifecycle.State.CREATED)
+    }
+}

native/src-tauri/gen/android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:icon="@drawable/kanbangit"
+        android:label="@string/app_name"
+        android:theme="@style/Theme.kanbangit_native"
+        android:usesCleartextTraffic="${usesCleartextTraffic}">
+        <activity
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode"
+            android:launchMode="singleTask"
+            android:label="@string/main_activity_title"
+            android:name=".MainActivity"
+            android:windowSoftInputMode="adjustResize"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <provider
+          android:name="androidx.core.content.FileProvider"
+          android:authorities="${applicationId}.fileprovider"
+          android:exported="false"
+          android:grantUriPermissions="true">
+          <meta-data
+            android:name="android.support.FILE_PROVIDER_PATHS"
+            android:resource="@xml/file_paths" />
+        </provider>
+    </application>
+</manifest>

native/src-tauri/gen/android/app/src/main/java/de/kanbangit/desktop/MainActivity.kt

@@ -0,0 +1,306 @@
+package de.kanbangit.desktop
+
+import android.annotation.SuppressLint
+import android.content.res.Configuration
+import android.graphics.Bitmap
+import android.net.Uri
+import android.net.http.SslError
+import android.os.Bundle
+import android.os.Handler
+import android.os.Looper
+import android.view.View
+import android.view.ViewGroup
+import android.webkit.CookieManager
+import android.webkit.SslErrorHandler
+import android.webkit.WebChromeClient
+import android.webkit.WebResourceError
+import android.webkit.WebResourceRequest
+import android.webkit.WebResourceResponse
+import android.webkit.WebSettings
+import android.webkit.WebStorage
+import android.webkit.WebView
+import android.webkit.WebViewClient
+import android.widget.Button
+import android.widget.FrameLayout
+import android.widget.LinearLayout
+import android.widget.TextView
+import androidx.activity.OnBackPressedCallback
+import androidx.activity.enableEdgeToEdge
+import androidx.core.view.ViewCompat
+import androidx.core.view.WindowCompat
+import androidx.core.view.WindowInsetsCompat
+import androidx.webkit.WebViewCompat
+import androidx.webkit.WebViewFeature
+import org.json.JSONObject
+
+class MainActivity : TauriActivity() {
+    private val handler = Handler(Looper.getMainLooper())
+    private val preferences by lazy { getSharedPreferences("workspace", MODE_PRIVATE) }
+    private lateinit var launcher: WebView
+    private lateinit var root: LinearLayout
+    private lateinit var content: FrameLayout
+    private lateinit var settings: Button
+    internal var workspace: WebView? = null
+        private set
+    private var server = NavigationPolicy.DEFAULT_SERVER
+    private var phase = "idle"
+    private var ready = false
+    private var revision = 0
+    private var launcherVisible = true
+    private var keyboardVisible = false
+    private var initialized = false
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        enableEdgeToEdge()
+        super.onCreate(savedInstanceState)
+        onBackPressedDispatcher.addCallback(this, object : OnBackPressedCallback(true) {
+            override fun handleOnBackPressed() {
+                when (NavigationPolicy.backAction(keyboardVisible, launcherVisible, ready, workspace?.canGoBack() == true)) {
+                    "keyboard" -> WindowCompat.getInsetsController(window, window.decorView).hide(WindowInsetsCompat.Type.ime())
+                    "resume" -> showWorkspace()
+                    "history" -> workspace?.goBack()
+                    "settings" -> showLauncher()
+                    else -> moveTaskToBack(true)
+                }
+            }
+        })
+    }
+
+    override fun onWebViewCreate(webView: WebView) {
+        launcher = webView
+        if (WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
+            WebViewCompat.addWebMessageListener(launcher, "nativeLauncher", setOf(NavigationPolicy.LAUNCHER_ORIGIN)) {
+                _, message, origin, mainFrame, _ ->
+                if (mainFrame && origin.toString().trimEnd('/') == NavigationPolicy.LAUNCHER_ORIGIN) {
+                    launcher.post { handleAction(message.data.orEmpty()) }
+                }
+            }
+        }
+        launcher.post { attachShell() }
+    }
+
+    private fun attachShell() {
+        if (::root.isInitialized) return
+        (launcher.parent as? ViewGroup)?.removeView(launcher)
+        root = LinearLayout(this).apply { orientation = LinearLayout.VERTICAL }
+        settings = Button(this).apply {
+            text = getString(R.string.server_settings)
+            isAllCaps = false
+            visibility = View.GONE
+            setOnClickListener { showLauncher() }
+        }
+        root.addView(settings, LinearLayout.LayoutParams(-1, -2))
+        content = FrameLayout(this)
+        content.addView(launcher, FrameLayout.LayoutParams(-1, -1))
+        root.addView(content, LinearLayout.LayoutParams(-1, 0, 1f))
+        setContentView(root)
+        ViewCompat.setOnApplyWindowInsetsListener(root) { view, insets ->
+            val safe = insets.getInsets(WindowInsetsCompat.Type.systemBars() or WindowInsetsCompat.Type.displayCutout())
+            val keyboard = insets.getInsets(WindowInsetsCompat.Type.ime())
+            keyboardVisible = insets.isVisible(WindowInsetsCompat.Type.ime())
+            view.setPadding(safe.left, safe.top, safe.right, maxOf(safe.bottom, keyboard.bottom))
+            WindowInsetsCompat.CONSUMED
+        }
+        ViewCompat.requestApplyInsets(root)
+        if (!WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
+            content.removeAllViews()
+            content.addView(TextView(this).apply { text = getString(R.string.update_webview) })
+        }
+    }
+
+    private fun handleAction(value: String) {
+        attachShell()
+        val url = Uri.parse(value)
+        if (url.scheme != "https" || url.host != "tauri.localhost" || url.port != -1 || url.userInfo != null) return
+        when (url.path) {
+            "/action/ready" -> {
+                if (initialized) return
+                initialized = true
+                val saved = preferences.getString("server", null)
+                server = saved?.let(NavigationPolicy::installation) ?: NavigationPolicy.DEFAULT_SERVER
+                updateLauncher()
+                if (saved != null) openWorkspace(server)
+            }
+            "/action/open" -> openWorkspace(url.getQueryParameter("server").orEmpty())
+            "/action/resume" -> if (ready) showWorkspace()
+        }
+    }
+
+    internal fun openWorkspace(input: String) {
+        val address = NavigationPolicy.installation(input)
+        if (address == null) {
+            phase = "invalidServer"
+            showLauncher()
+            return
+        }
+        if (phase == "connecting") return
+        if (address == server && ready) {
+            if (phase == "connectionError") {
+                phase = "connecting"
+                workspace?.let { startTimeout(it); it.reload() }
+                updateLauncher()
+                return
+            }
+            showWorkspace()
+            return
+        }
+        val changed = address != preferences.getString("server", null)
+        val clearSession = changed || preferences.getBoolean("clearing", false)
+        if (!preferences.edit().putString("server", address).putBoolean("clearing", clearSession).commit()) {
+            phase = "storageError"
+            showLauncher()
+            return
+        }
+        server = address
+        ready = false
+        phase = "connecting"
+        revision++
+        workspace?.let { old ->
+            content.removeView(old)
+            old.stopLoading()
+            if (clearSession) old.clearCache(true)
+            old.destroy()
+        }
+        workspace = null
+        updateLauncher()
+        if (clearSession) {
+            WebStorage.getInstance().deleteAllData()
+            CookieManager.getInstance().removeAllCookies {
+                CookieManager.getInstance().flush()
+                if (!preferences.edit().putBoolean("clearing", false).commit()) {
+                    phase = "storageError"
+                    showLauncher()
+                } else if (!isDestroyed) {
+                    createWorkspace()
+                }
+            }
+        } else {
+            createWorkspace()
+        }
+    }
+
+    @SuppressLint("SetJavaScriptEnabled")
+    private fun createWorkspace() {
+        val remote = WebView(this)
+        workspace = remote
+        remote.settings.apply {
+            javaScriptEnabled = true
+            domStorageEnabled = true
+            allowFileAccess = false
+            allowContentAccess = false
+            mixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW
+            javaScriptCanOpenWindowsAutomatically = false
+            setSupportMultipleWindows(true)
+        }
+        CookieManager.getInstance().setAcceptThirdPartyCookies(remote, false)
+        remote.webChromeClient = WebChromeClient()
+        remote.webViewClient = object : WebViewClient() {
+            override fun shouldOverrideUrlLoading(view: WebView, request: WebResourceRequest): Boolean =
+                !NavigationPolicy.allows(server, request.url.toString())
+
+            override fun onPageStarted(view: WebView, url: String, favicon: Bitmap?) {
+                if (!NavigationPolicy.allows(server, url)) {
+                    view.stopLoading()
+                    fail(view)
+                    return
+                }
+                phase = "connecting"
+                startTimeout(view)
+                updateLauncher()
+            }
+
+            override fun onPageFinished(view: WebView, url: String) {
+                if (workspace !== view || phase != "connecting" || !NavigationPolicy.allows(server, url)) return
+                revision++
+                phase = "connected"
+                val firstLoad = !ready
+                ready = true
+                CookieManager.getInstance().flush()
+                updateLauncher()
+                if (firstLoad) showWorkspace()
+            }
+
+            override fun onReceivedError(view: WebView, request: WebResourceRequest, error: WebResourceError) {
+                if (request.isForMainFrame) fail(view)
+            }
+
+            override fun onReceivedHttpError(view: WebView, request: WebResourceRequest, response: WebResourceResponse) {
+                if (request.isForMainFrame && response.statusCode >= 500) fail(view)
+            }
+
+            override fun onReceivedSslError(view: WebView, sslHandler: SslErrorHandler, error: SslError) {
+                sslHandler.cancel()
+                fail(view)
+            }
+        }
+        remote.visibility = View.GONE
+        content.addView(remote, 0, FrameLayout.LayoutParams(-1, -1))
+        startTimeout(remote)
+        remote.loadUrl(server)
+    }
+
+    private fun startTimeout(view: WebView) {
+        val current = ++revision
+        handler.postDelayed({
+            if (current == revision && phase == "connecting" && workspace === view) {
+                view.stopLoading()
+                fail(view)
+            }
+        }, 15000)
+    }
+
+    private fun fail(view: WebView) {
+        if (workspace !== view) return
+        revision++
+        phase = "connectionError"
+        showLauncher()
+    }
+
+    private fun updateLauncher() {
+        val query = Uri.Builder().appendQueryParameter("server", server)
+            .appendQueryParameter("phase", phase).appendQueryParameter("ready", ready.toString())
+            .appendQueryParameter("platform", "android").build().encodedQuery.orEmpty()
+        launcher.evaluateJavascript("window.updateLauncher?.(${JSONObject.quote(query)})", null)
+    }
+
+    private fun showLauncher() {
+        updateLauncher()
+        launcherVisible = true
+        launcher.visibility = View.VISIBLE
+        workspace?.visibility = View.GONE
+        settings.visibility = View.GONE
+        launcher.requestFocus()
+    }
+
+    private fun showWorkspace() {
+        launcherVisible = false
+        launcher.visibility = View.GONE
+        workspace?.visibility = View.VISIBLE
+        settings.visibility = View.VISIBLE
+        workspace?.requestFocus()
+    }
+
+    override fun onPause() {
+        workspace?.onPause()
+        CookieManager.getInstance().flush()
+        super.onPause()
+    }
+
+    override fun onResume() {
+        super.onResume()
+        workspace?.onResume()
+    }
+
+    override fun onConfigurationChanged(newConfig: Configuration) {
+        super.onConfigurationChanged(newConfig)
+        enableEdgeToEdge()
+        if (::root.isInitialized) ViewCompat.requestApplyInsets(root)
+    }
+
+    override fun onDestroy() {
+        handler.removeCallbacksAndMessages(null)
+        workspace?.destroy()
+        workspace = null
+        super.onDestroy()
+    }
+}

native/src-tauri/gen/android/app/src/main/java/de/kanbangit/desktop/NavigationPolicy.kt

@@ -0,0 +1,41 @@
+package de.kanbangit.desktop
+
+import java.net.URI
+import java.util.Locale
+
+object NavigationPolicy {
+    const val DEFAULT_SERVER = "https://kanbangit.de/"
+    const val LAUNCHER_ORIGIN = "https://tauri.localhost"
+
+    fun installation(input: String): String? = runCatching {
+        val trimmed = input.trim()
+        require(trimmed.none { it.isISOControl() || it == '\\' })
+        val uri = URI(trimmed)
+        require(uri.scheme.equals("https", ignoreCase = true))
+        require(!uri.host.isNullOrBlank() && uri.rawUserInfo == null)
+        require(uri.rawQuery == null && uri.rawFragment == null)
+        require(uri.port == -1 || uri.port in 1..65535)
+        require(!uri.host.equals("tauri.localhost", ignoreCase = true))
+        val port = if (uri.port == -1 || uri.port == 443) "" else ":${uri.port}"
+        val path = uri.rawPath.orEmpty().let { if (it.endsWith('/')) it else "$it/" }
+        "https://${uri.host.lowercase(Locale.ROOT)}$port$path"
+    }.getOrNull()
+
+    fun allows(server: String, destination: String): Boolean = runCatching {
+        val base = URI(server)
+        val target = URI(destination)
+        target.scheme.equals("https", ignoreCase = true) &&
+            target.host.equals(base.host, ignoreCase = true) &&
+            (if (target.port == -1) 443 else target.port) ==
+            (if (base.port == -1) 443 else base.port) &&
+            target.rawUserInfo == null && !destination.contains('\\')
+    }.getOrDefault(false)
+
+    fun backAction(keyboard: Boolean, launcher: Boolean, ready: Boolean, history: Boolean): String = when {
+        keyboard -> "keyboard"
+        launcher && ready -> "resume"
+        !launcher && history -> "history"
+        !launcher -> "settings"
+        else -> "background"
+    }
+}

native/src-tauri/gen/android/app/src/main/res/drawable/kanbangit.xml

@@ -0,0 +1,8 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="48dp" android:height="48dp"
+    android:viewportWidth="64" android:viewportHeight="64">
+    <path android:fillColor="#22c55e" android:pathData="M12,0 H52 Q64,0 64,12 V52 Q64,64 52,64 H12 Q0,64 0,52 V12 Q0,0 12,0 Z" />
+    <path android:fillColor="@android:color/transparent" android:strokeColor="#004b1e"
+        android:strokeWidth="3" android:strokeLineCap="round" android:strokeLineJoin="round"
+        android:pathData="M19,16 H45 Q48,16 48,19 V45 Q48,48 45,48 H19 Q16,48 16,45 V19 Q16,16 19,16 Z M27,16 V48 M37,16 V48" />
+</vector>

native/src-tauri/gen/android/app/src/main/res/values-night/themes.xml

@@ -0,0 +1,6 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Theme.kanbangit_native" parent="Theme.MaterialComponents.DayNight.NoActionBar">
+        <!-- Customize your theme here. -->
+    </style>
+</resources>

native/src-tauri/gen/android/app/src/main/res/values/strings.xml

@@ -0,0 +1,6 @@
+<resources>
+    <string name="app_name">"KanbanGit"</string>
+    <string name="main_activity_title">"KanbanGit"</string>
+    <string name="server_settings">Server settings</string>
+    <string name="update_webview">Update Android System WebView to connect to your workspace.</string>
+</resources>

native/src-tauri/gen/android/app/src/main/res/values/themes.xml

@@ -0,0 +1,6 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Theme.kanbangit_native" parent="Theme.MaterialComponents.DayNight.NoActionBar">
+        <!-- Customize your theme here. -->
+    </style>
+</resources>

native/src-tauri/gen/android/app/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="root" path="." />
+        <exclude domain="sharedpref" path="." />
+        <exclude domain="database" path="." />
+        <exclude domain="file" path="." />
+        <exclude domain="external" path="." />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="root" path="." />
+        <exclude domain="sharedpref" path="." />
+        <exclude domain="database" path="." />
+        <exclude domain="file" path="." />
+        <exclude domain="external" path="." />
+    </device-transfer>
+</data-extraction-rules>

native/src-tauri/gen/android/app/src/main/res/xml/file_paths.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths xmlns:android="http://schemas.android.com/apk/res/android">
+  <external-path name="my_images" path="." />
+  <cache-path name="my_cache_images" path="." />
+</paths>

native/src-tauri/gen/android/app/src/test/java/de/kanbangit/desktop/NavigationPolicyTest.kt

@@ -0,0 +1,33 @@
+package de.kanbangit.desktop
+
+import org.junit.Assert.*
+import org.junit.Test
+
+class NavigationPolicyTest {
+    @Test fun normalizesAddressesAndRejectsCredentialsAndUnsafeSchemes() {
+        assertEquals("https://example.com/kanban/", NavigationPolicy.installation(" HTTPS://Example.com:443/kanban "))
+        assertEquals("https://[::1]:8443/", NavigationPolicy.installation("https://[::1]:8443"))
+        for (value in listOf("http://example.com", "https:example.com", "https://user:pass@example.com", "https://example.com/?token=x", "https://example.com/#x", "https://exa\nmple.com", "https://example.com\\other", "https://example.com:99999", "https://tauri.localhost/", "file:///etc/passwd", "")) {
+            assertNull(value, NavigationPolicy.installation(value))
+        }
+    }
+
+    @Test fun allowsLoginTwoFactorAndHistoryOnlyOnTheSelectedOrigin() {
+        val server = "https://example.com:8443/app/"
+        for (path in listOf("/login", "/two-factor-challenge", "/projects/1?ticket=53#details")) {
+            assertTrue(NavigationPolicy.allows(server, "https://example.com:8443$path"))
+        }
+        for (value in listOf("https://example.com/", "http://example.com:8443/", "https://other.example.com:8443/", "https://user@example.com:8443/", "https://tauri.localhost/action/open", "javascript:alert(1)", "intent://example.com", "file:///etc/passwd")) {
+            assertFalse(value, NavigationPolicy.allows(server, value))
+        }
+        assertTrue(NavigationPolicy.allows("https://example.com/", "https://example.com:443/login"))
+    }
+
+    @Test fun backClosesKeyboardBeforeNavigatingAndPreservesTheWorkspace() {
+        assertEquals("keyboard", NavigationPolicy.backAction(true, false, true, true))
+        assertEquals("resume", NavigationPolicy.backAction(false, true, true, true))
+        assertEquals("history", NavigationPolicy.backAction(false, false, true, true))
+        assertEquals("settings", NavigationPolicy.backAction(false, false, true, false))
+        assertEquals("background", NavigationPolicy.backAction(false, true, false, false))
+    }
+}

native/src-tauri/gen/android/build.gradle.kts

@@ -0,0 +1,21 @@
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath("com.android.tools.build:gradle:8.11.0")
+        classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.25")
+    }
+}
+
+allprojects {
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+tasks.register("clean").configure {
+    delete("build")
+}

native/src-tauri/gen/android/buildSrc/build.gradle.kts

@@ -0,0 +1,22 @@
+plugins {
+    `kotlin-dsl`
+}
+
+gradlePlugin {
+    plugins {
+        create("pluginsForCoolKids") {
+            id = "rust"
+            implementationClass = "RustPlugin"
+        }
+    }
+}
+
+repositories {
+    google()
+    mavenCentral()
+}
+
+dependencies {
+    compileOnly(gradleApi())
+    implementation("com.android.tools.build:gradle:8.11.0")
+}

native/src-tauri/gen/android/buildSrc/src/main/java/de/kanbangit/desktop/kotlin/BuildTask.kt

@@ -0,0 +1,68 @@
+import java.io.File
+import org.apache.tools.ant.taskdefs.condition.Os
+import org.gradle.api.DefaultTask
+import org.gradle.api.GradleException
+import org.gradle.api.logging.LogLevel
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.TaskAction
+
+open class BuildTask : DefaultTask() {
+    @Input
+    var rootDirRel: String? = null
+    @Input
+    var target: String? = null
+    @Input
+    var release: Boolean? = null
+
+    @TaskAction
+    fun assemble() {
+        val executable = """pnpm""";
+        try {
+            runTauriCli(executable)
+        } catch (e: Exception) {
+            if (Os.isFamily(Os.FAMILY_WINDOWS)) {
+                // Try different Windows-specific extensions
+                val fallbacks = listOf(
+                    "$executable.exe",
+                    "$executable.cmd",
+                    "$executable.bat",
+                )
+
+                var lastException: Exception = e
+                for (fallback in fallbacks) {
+                    try {
+                        runTauriCli(fallback)
+                        return
+                    } catch (fallbackException: Exception) {
+                        lastException = fallbackException
+                    }
+                }
+                throw lastException
+            } else {
+                throw e;
+            }
+        }
+    }
+
+    fun runTauriCli(executable: String) {
+        val rootDirRel = rootDirRel ?: throw GradleException("rootDirRel cannot be null")
+        val target = target ?: throw GradleException("target cannot be null")
+        val release = release ?: throw GradleException("release cannot be null")
+        val args = listOf("tauri", "android", "android-studio-script");
+
+        project.exec {
+            workingDir(File(project.projectDir, rootDirRel))
+            executable(executable)
+            args(args)
+            if (project.logger.isEnabled(LogLevel.DEBUG)) {
+                args("-vv")
+            } else if (project.logger.isEnabled(LogLevel.INFO)) {
+                args("-v")
+            }
+            if (release) {
+                args("--release")
+            }
+            args(listOf("--target", target))
+        }.assertNormalExitValue()
+    }
+}

native/src-tauri/gen/android/buildSrc/src/main/java/de/kanbangit/desktop/kotlin/RustPlugin.kt

@@ -0,0 +1,85 @@
+import com.android.build.api.dsl.ApplicationExtension
+import org.gradle.api.DefaultTask
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.kotlin.dsl.configure
+import org.gradle.kotlin.dsl.get
+
+const val TASK_GROUP = "rust"
+
+open class Config {
+    lateinit var rootDirRel: String
+}
+
+open class RustPlugin : Plugin<Project> {
+    private lateinit var config: Config
+
+    override fun apply(project: Project) = with(project) {
+        config = extensions.create("rust", Config::class.java)
+
+        val defaultAbiList = listOf("arm64-v8a", "armeabi-v7a", "x86", "x86_64");
+        val abiList = (findProperty("abiList") as? String)?.split(',') ?: defaultAbiList
+
+        val defaultArchList = listOf("arm64", "arm", "x86", "x86_64");
+        val archList = (findProperty("archList") as? String)?.split(',') ?: defaultArchList
+
+        val targetsList = (findProperty("targetList") as? String)?.split(',') ?: listOf("aarch64", "armv7", "i686", "x86_64")
+
+        extensions.configure<ApplicationExtension> {
+            @Suppress("UnstableApiUsage")
+            flavorDimensions.add("abi")
+            productFlavors {
+                create("universal") {
+                    dimension = "abi"
+                    ndk {
+                        abiFilters += abiList
+                    }
+                }
+                defaultArchList.forEachIndexed { index, arch ->
+                    create(arch) {
+                        dimension = "abi"
+                        ndk {
+                            abiFilters.add(defaultAbiList[index])
+                        }
+                    }
+                }
+            }
+        }
+
+        afterEvaluate {
+            for (profile in listOf("debug", "release")) {
+                val profileCapitalized = profile.replaceFirstChar { it.uppercase() }
+                val buildTask = tasks.maybeCreate(
+                    "rustBuildUniversal$profileCapitalized",
+                    DefaultTask::class.java
+                ).apply {
+                    group = TASK_GROUP
+                    description = "Build dynamic library in $profile mode for all targets"
+                }
+
+                tasks["mergeUniversal${profileCapitalized}JniLibFolders"].dependsOn(buildTask)
+
+                for (targetPair in targetsList.withIndex()) {
+                    val targetName = targetPair.value
+                    val targetArch = archList[targetPair.index]
+                    val targetArchCapitalized = targetArch.replaceFirstChar { it.uppercase() }
+                    val targetBuildTask = project.tasks.maybeCreate(
+                        "rustBuild$targetArchCapitalized$profileCapitalized",
+                        BuildTask::class.java
+                    ).apply {
+                        group = TASK_GROUP
+                        description = "Build dynamic library in $profile mode for $targetArch"
+                        rootDirRel = config.rootDirRel
+                        target = targetName
+                        release = profile == "release"
+                    }
+
+                    buildTask.dependsOn(targetBuildTask)
+                    tasks["merge$targetArchCapitalized${profileCapitalized}JniLibFolders"].dependsOn(
+                        targetBuildTask
+                    )
+                }
+            }
+        }
+    }
+}

native/src-tauri/gen/android/gradle.properties

@@ -0,0 +1,25 @@
+# Project-wide Gradle settings.
+# IDE (e.g. Android Studio) users:
+# Gradle settings configured through the IDE *will override*
+# any settings specified in this file.
+# For more details on how to configure your build environment visit
+# http://www.gradle.org/docs/current/userguide/build_environment.html
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
+# When configured, Gradle will run in incubating parallel mode.
+# This option should only be used with decoupled projects. More details, visit
+# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
+# org.gradle.parallel=true
+# AndroidX package structure to make it clearer which packages are bundled with the
+# Android operating system, and which are packaged with your app"s APK
+# https://developer.android.com/topic/libraries/support-library/androidx-rn
+android.useAndroidX=true
+# Kotlin code style for this project: "official" or "obsolete":
+kotlin.code.style=official
+# Enables namespacing of each library's R class so that its R class includes only the
+# resources declared in the library itself and none from the library's dependencies,
+# thereby reducing the size of the R class for that library
+android.nonTransitiveRClass=true
+android.nonFinalResIds=false
+android.builder.sdkDownload=false

native/src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,6 @@
+#Tue May 10 19:22:52 CST 2022
+distributionBase=GRADLE_USER_HOME
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists
+zipStoreBase=GRADLE_USER_HOME

native/src-tauri/gen/android/gradlew

@@ -0,0 +1,185 @@
+#!/usr/bin/env sh
+
+#
+# Copyright 2015 the original author or authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+##
+##  Gradle start up script for UN*X
+##
+##############################################################################
+
+# Attempt to set APP_HOME
+# Resolve links: $0 may be a link
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
+done
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null
+
+APP_NAME="Gradle"
+APP_BASE_NAME=`basename "$0"`
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD="maximum"
+
+warn () {
+    echo "$*"
+}
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+}
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+  NONSTOP* )
+    nonstop=true
+    ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+        JAVACMD="$JAVA_HOME/bin/java"
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD="java"
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
+fi
+
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+
+    JAVACMD=`cygpath --unix "$JAVACMD"`
+
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
+    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=`expr $i + 1`
+    done
+    case $i in
+        0) set -- ;;
+        1) set -- "$args0" ;;
+        2) set -- "$args0" "$args1" ;;
+        3) set -- "$args0" "$args1" "$args2" ;;
+        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
+fi
+
+# Escape application args
+save () {
+    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+    echo " "
+}
+APP_ARGS=`save "$@"`
+
+# Collect all arguments for the java command, following the shell quoting and substitution rules
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+
+exec "$JAVACMD" "$@"

native/src-tauri/gen/android/gradlew.bat

@@ -0,0 +1,89 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%" == "" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%" == "" set DIRNAME=.
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if "%ERRORLEVEL%" == "0" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if "%ERRORLEVEL%"=="0" goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
+exit /b 1
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

native/src-tauri/gen/android/settings.gradle

@@ -0,0 +1,3 @@
+include ':app'
+
+apply from: 'tauri.settings.gradle'

native/src-tauri/src/android.rs

@@ -0,0 +1,22 @@
+use tauri::{WebviewUrl, WebviewWindowBuilder};
+
+pub fn context<R: tauri::Runtime>() -> tauri::Context<R> {
+    tauri::generate_context!()
+}
+
+pub fn builder() -> tauri::Builder<tauri::Wry> {
+    tauri::Builder::default().setup(|app| {
+        WebviewWindowBuilder::new(app, "launcher", WebviewUrl::App("index.html".into()))
+            .use_https_scheme(true)
+            .on_navigation(|url| {
+                url.scheme() == "https"
+                    && url.host_str() == Some("tauri.localhost")
+                    && url.port().is_none()
+                    && url.username().is_empty()
+                    && url.password().is_none()
+                    && matches!(url.path(), "/" | "/index.html")
+            })
+            .build()?;
+        Ok(())
+    })
+}

native/src-tauri/src/desktop.rs

@@ -0,0 +1,456 @@
+use crate::locale::en;
+use crate::server::{validate_url, Server, DEFAULT_SERVER};
+use std::{path::PathBuf, sync::Mutex, time::Duration};
+use tauri::{
+    menu::{MenuBuilder, SubmenuBuilder},
+    webview::{NewWindowResponse, PageLoadEvent},
+    AppHandle, Manager, Url, WebviewUrl, WebviewWindowBuilder, WindowEvent,
+};
+
+#[derive(Default)]
+struct Connection {
+    server: Option<Server>,
+    label: Option<String>,
+    revision: u64,
+    ready: bool,
+    phase: &'static str,
+}
+
+impl Connection {
+    fn begin_navigation(&mut self) -> u64 {
+        self.revision += 1;
+        self.phase = "connecting";
+        self.revision
+    }
+
+    fn timeout(&mut self, revision: u64) -> bool {
+        if self.revision != revision || self.phase != "connecting" {
+            return false;
+        }
+        self.phase = "connectionError";
+        true
+    }
+}
+
+fn allows_server_navigation(server: &Url, destination: &Url) -> bool {
+    destination.scheme() == "https"
+        && destination.origin() == server.origin()
+        && destination.username().is_empty()
+        && destination.password().is_none()
+}
+
+fn allows_launcher_navigation(destination: &Url) -> bool {
+    destination.scheme() == "tauri"
+        && destination.host_str() == Some("localhost")
+        && destination.port().is_none()
+        && destination.username().is_empty()
+        && destination.password().is_none()
+}
+
+fn configuration_path(app: &AppHandle) -> tauri::Result<PathBuf> {
+    Ok(app.path().app_config_dir()?.join("active-server"))
+}
+
+fn update_launcher(app: &AppHandle) {
+    let state = app.state::<Mutex<Connection>>();
+    let state = state.lock().unwrap();
+    let mut message = Url::parse("tauri://localhost/").unwrap();
+    message
+        .query_pairs_mut()
+        .append_pair(
+            "server",
+            state
+                .server
+                .as_ref()
+                .map_or(DEFAULT_SERVER, |server| server.url.as_str()),
+        )
+        .append_pair("phase", state.phase)
+        .append_pair("ready", if state.ready { "true" } else { "false" });
+    if let Some(window) = app.get_webview_window("launcher") {
+        let _ = window.eval(format!(
+            "window.updateLauncher?.('{}')",
+            message.query().unwrap()
+        ));
+    }
+}
+
+fn show_launcher(app: &AppHandle) {
+    update_launcher(app);
+    if let Some(window) = app.get_webview_window("launcher") {
+        let _ = window.show();
+        let _ = window.set_focus();
+    }
+}
+
+fn begin_navigation(app: &AppHandle, label: &str) {
+    let state = app.state::<Mutex<Connection>>();
+    let revision = {
+        let mut state = state.lock().unwrap();
+        if state.label.as_deref() != Some(label) {
+            return;
+        }
+        state.begin_navigation()
+    };
+    update_launcher(app);
+    let handle = app.clone();
+    std::thread::spawn(move || {
+        std::thread::sleep(Duration::from_secs(15));
+        let state = handle.state::<Mutex<Connection>>();
+        let timed_out = state.lock().unwrap().timeout(revision);
+        if timed_out {
+            show_launcher(&handle);
+        }
+    });
+}
+
+fn open_workspace(app: &AppHandle, input: &str) -> Result<(), &'static str> {
+    let url = validate_url(input)?;
+    let state = app.state::<Mutex<Connection>>();
+    let (server, old_label, label) = {
+        let mut state = state.lock().unwrap();
+        let same_server = state
+            .server
+            .as_ref()
+            .is_some_and(|server| server.url == url);
+        if same_server && state.ready {
+            if let Some(window) = state
+                .label
+                .as_ref()
+                .and_then(|label| app.get_webview_window(label))
+            {
+                window.show().map_err(|_| "connectionError")?;
+                window.set_focus().map_err(|_| "connectionError")?;
+                return Ok(());
+            }
+        }
+        let server = if same_server {
+            state.server.clone().unwrap()
+        } else {
+            Server::new(url).map_err(|_| "storageError")?
+        };
+        server
+            .save(&configuration_path(app).map_err(|_| "storageError")?)
+            .map_err(|_| "storageError")?;
+        let old_label = state.label.take();
+        state.server = Some(server.clone());
+        state.ready = false;
+        state.revision += 1;
+        let label = format!("workspace-{}", state.revision);
+        state.label = Some(label.clone());
+        (server, old_label, label)
+    };
+    if let Some(window) = old_label.and_then(|label| app.get_webview_window(&label)) {
+        window.close().map_err(|_| "connectionError")?;
+    }
+    begin_navigation(app, &label);
+    let handle = app.clone();
+    let navigation_label = label.clone();
+    let server_url = server.url.clone();
+    let window = WebviewWindowBuilder::new(app, &label, WebviewUrl::External(server.url))
+        .title(en::APP_NAME)
+        .inner_size(1280.0, 850.0)
+        .min_inner_size(375.0, 600.0)
+        .center()
+        .visible(false)
+        .data_store_identifier(server.profile)
+        .on_navigation(move |destination| {
+            if !allows_server_navigation(&server_url, destination) {
+                return false;
+            }
+            begin_navigation(&handle, &navigation_label);
+            true
+        })
+        .on_new_window(|_, _| NewWindowResponse::Deny)
+        .on_page_load(|window, payload| {
+            if payload.event() != PageLoadEvent::Finished {
+                return;
+            }
+            let app = window.app_handle();
+            let state = app.state::<Mutex<Connection>>();
+            let should_show = {
+                let mut state = state.lock().unwrap();
+                if state.label.as_deref() != Some(window.label()) {
+                    return;
+                }
+                let first_load = !state.ready;
+                state.ready = true;
+                state.phase = "connected";
+                first_load
+            };
+            update_launcher(app);
+            if should_show {
+                let _ = window.show();
+                let _ = window.set_focus();
+                if let Some(launcher) = app.get_webview_window("launcher") {
+                    let _ = launcher.hide();
+                }
+            }
+        })
+        .build()
+        .map_err(|_| "connectionError")?;
+    let handle = app.clone();
+    window.on_window_event(move |event| {
+        if matches!(event, WindowEvent::Destroyed) {
+            let state = handle.state::<Mutex<Connection>>();
+            let current = {
+                let mut state = state.lock().unwrap();
+                if state.label.as_deref() == Some(&label) {
+                    state.label = None;
+                    state.ready = false;
+                    state.revision += 1;
+                    state.phase = "idle";
+                    true
+                } else {
+                    false
+                }
+            };
+            if current {
+                show_launcher(&handle);
+            }
+        }
+    });
+    Ok(())
+}
+
+fn handle_launcher_action(app: &AppHandle, destination: &Url) {
+    let result = match destination.path() {
+        "/action/open" => {
+            let input = destination
+                .query_pairs()
+                .find(|(key, _)| key == "server")
+                .map(|(_, value)| value.into_owned())
+                .unwrap_or_default();
+            open_workspace(app, &input)
+        }
+        "/action/resume" => {
+            let label = app
+                .state::<Mutex<Connection>>()
+                .lock()
+                .unwrap()
+                .label
+                .clone();
+            if let Some(window) = label.and_then(|label| app.get_webview_window(&label)) {
+                let _ = window.show();
+                let _ = window.set_focus();
+            }
+            Ok(())
+        }
+        _ => Ok(()),
+    };
+    if let Err(error) = result {
+        app.state::<Mutex<Connection>>().lock().unwrap().phase = error;
+        show_launcher(app);
+    }
+}
+
+pub fn context<R: tauri::Runtime>() -> tauri::Context<R> {
+    tauri::generate_context!()
+}
+
+pub fn builder() -> tauri::Builder<tauri::Wry> {
+    tauri::Builder::default().setup(|app| {
+        let (server, phase) = match Server::load(&configuration_path(app.handle())?) {
+            Ok(server) => (server, "idle"),
+            Err(_) => (None, "storageError"),
+        };
+        app.manage(Mutex::new(Connection {
+            server,
+            phase,
+            ..Default::default()
+        }));
+        let menu = MenuBuilder::new(app)
+            .item(
+                &SubmenuBuilder::new(app, en::APP_NAME)
+                    .text("server-settings", en::SERVER_SETTINGS)
+                    .separator()
+                    .quit()
+                    .build()?,
+            )
+            .item(
+                &SubmenuBuilder::new(app, en::EDIT)
+                    .undo()
+                    .redo()
+                    .separator()
+                    .cut()
+                    .copy()
+                    .paste()
+                    .select_all()
+                    .build()?,
+            )
+            .build()?;
+        app.set_menu(menu)?;
+        app.on_menu_event(|app, event| {
+            if event.id().as_ref() == "server-settings" {
+                show_launcher(app);
+            }
+        });
+        let handle = app.handle().clone();
+        let launcher =
+            WebviewWindowBuilder::new(app, "launcher", WebviewUrl::App("index.html".into()))
+                .title(en::APP_NAME)
+                .inner_size(560.0, 720.0)
+                .min_inner_size(375.0, 640.0)
+                .center()
+                .on_navigation(move |destination| {
+                    if !allows_launcher_navigation(destination) {
+                        return false;
+                    }
+                    if destination.path().starts_with("/action/") {
+                        let handle = handle.clone();
+                        let destination = destination.clone();
+                        let _ = handle.clone().run_on_main_thread(move || {
+                            handle_launcher_action(&handle, &destination)
+                        });
+                        return false;
+                    }
+                    matches!(destination.path(), "" | "/" | "/index.html")
+                })
+                .on_new_window(|_, _| NewWindowResponse::Deny)
+                .on_page_load(|window, payload| {
+                    if payload.event() == PageLoadEvent::Finished {
+                        let app = window.app_handle().clone();
+                        update_launcher(&app);
+                        std::thread::spawn(move || {
+                            let handle = app.clone();
+                            let _ = app.run_on_main_thread(move || {
+                                let server = handle
+                                    .state::<Mutex<Connection>>()
+                                    .lock()
+                                    .unwrap()
+                                    .server
+                                    .clone();
+                                if let Some(server) = server {
+                                    if let Err(error) = open_workspace(&handle, server.url.as_str())
+                                    {
+                                        handle.state::<Mutex<Connection>>().lock().unwrap().phase =
+                                            error;
+                                        show_launcher(&handle);
+                                    }
+                                }
+                            });
+                        });
+                    }
+                })
+                .build()?;
+        let window = launcher.clone();
+        launcher.on_window_event(move |event| {
+            if let WindowEvent::CloseRequested { api, .. } = event {
+                api.prevent_close();
+                let _ = window.hide();
+            }
+        });
+        Ok(())
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn navigation_is_limited_to_the_selected_https_origin() {
+        let server = validate_url("https://example.com:8443/app/").unwrap();
+        for path in [
+            "/login",
+            "/two-factor-challenge",
+            "/projects/1?ticket=52#details",
+        ] {
+            assert!(allows_server_navigation(
+                &server,
+                &server.join(path).unwrap()
+            ));
+        }
+        for destination in [
+            "http://example.com:8443/",
+            "https://example.com/",
+            "https://other.example.com:8443/",
+            "https://user:secret@example.com:8443/",
+            "tauri://localhost/action/open?server=https://evil.test",
+            "file:///etc/passwd",
+            "data:text/html,hello",
+            "javascript:alert(1)",
+        ] {
+            assert!(!allows_server_navigation(
+                &server,
+                &Url::parse(destination).unwrap()
+            ));
+        }
+    }
+
+    #[test]
+    fn launcher_actions_are_restricted_to_the_bundled_origin() {
+        assert!(allows_launcher_navigation(
+            &Url::parse("tauri://localhost/action/open").unwrap()
+        ));
+        for input in [
+            DEFAULT_SERVER,
+            "https://localhost/",
+            "tauri://other/index.html",
+            "tauri://user@localhost/index.html",
+        ] {
+            assert!(!allows_launcher_navigation(&Url::parse(input).unwrap()));
+        }
+    }
+
+    #[test]
+    fn stale_timeouts_do_not_replace_newer_connections_or_loaded_forms() {
+        let mut state = Connection::default();
+        let first = state.begin_navigation();
+        let second = state.begin_navigation();
+        assert!(!state.timeout(first));
+        state.ready = true;
+        assert!(state.timeout(second));
+        assert!(state.ready);
+        assert!(!state.timeout(second));
+        let third = state.begin_navigation();
+        state.phase = "connected";
+        assert!(!state.timeout(third));
+    }
+
+    #[test]
+    fn remote_pages_cannot_invoke_native_commands() {
+        let app = tauri::test::mock_builder().build(context()).unwrap();
+        let window = WebviewWindowBuilder::new(
+            &app,
+            "workspace-1",
+            WebviewUrl::External(Url::parse(DEFAULT_SERVER).unwrap()),
+        )
+        .build()
+        .unwrap();
+        for command in [
+            "plugin:window|close",
+            "plugin:webview|create_webview_window",
+            "plugin:path|resolve_directory",
+        ] {
+            let response = tauri::test::get_ipc_response(
+                &window,
+                tauri::webview::InvokeRequest {
+                    cmd: command.into(),
+                    callback: tauri::ipc::CallbackFn(0),
+                    error: tauri::ipc::CallbackFn(1),
+                    url: Url::parse(DEFAULT_SERVER).unwrap(),
+                    body: tauri::ipc::InvokeBody::default(),
+                    headers: Default::default(),
+                    invoke_key: tauri::test::INVOKE_KEY.into(),
+                },
+            );
+            assert!(response
+                .unwrap_err()
+                .as_str()
+                .unwrap()
+                .contains("not allowed"));
+        }
+    }
+
+    #[test]
+    fn packaged_app_exposes_no_native_capabilities_or_global_api() {
+        let config: serde_json::Value =
+            serde_json::from_str(include_str!("../tauri.conf.json")).unwrap();
+        assert_eq!(config["bundle"]["macOS"]["minimumSystemVersion"], "14.0");
+        assert_eq!(config["app"]["withGlobalTauri"], false);
+        assert_eq!(
+            config["app"]["security"]["capabilities"],
+            serde_json::json!([])
+        );
+    }
+}

native/src-tauri/src/lib.rs

@@ -1,464 +1,18 @@
+#[cfg(target_os = "android")]
+mod android;
+#[cfg(not(target_os = "android"))]
+mod desktop;
+#[cfg(not(target_os = "android"))]
 mod locale;
+#[cfg(not(target_os = "android"))]
 mod server;
 
-use locale::en;
-use server::{validate_url, Server, DEFAULT_SERVER};
-use std::{path::PathBuf, sync::Mutex, time::Duration};
-use tauri::{
-    menu::{MenuBuilder, SubmenuBuilder},
-    webview::{NewWindowResponse, PageLoadEvent},
-    AppHandle, Manager, Url, WebviewUrl, WebviewWindowBuilder, WindowEvent,
-};
-
-#[derive(Default)]
-struct Connection {
-    server: Option<Server>,
-    label: Option<String>,
-    revision: u64,
-    ready: bool,
-    phase: &'static str,
-}
-
-impl Connection {
-    fn begin_navigation(&mut self) -> u64 {
-        self.revision += 1;
-        self.phase = "connecting";
-        self.revision
-    }
-
-    fn timeout(&mut self, revision: u64) -> bool {
-        if self.revision != revision || self.phase != "connecting" {
-            return false;
-        }
-        self.phase = "connectionError";
-        true
-    }
-}
-
-fn allows_server_navigation(server: &Url, destination: &Url) -> bool {
-    destination.scheme() == "https"
-        && destination.origin() == server.origin()
-        && destination.username().is_empty()
-        && destination.password().is_none()
-}
-
-fn allows_launcher_navigation(destination: &Url) -> bool {
-    destination.scheme() == "tauri"
-        && destination.host_str() == Some("localhost")
-        && destination.port().is_none()
-        && destination.username().is_empty()
-        && destination.password().is_none()
-}
-
-fn configuration_path(app: &AppHandle) -> tauri::Result<PathBuf> {
-    Ok(app.path().app_config_dir()?.join("active-server"))
-}
-
-fn update_launcher(app: &AppHandle) {
-    let state = app.state::<Mutex<Connection>>();
-    let state = state.lock().unwrap();
-    let mut message = Url::parse("tauri://localhost/").unwrap();
-    message
-        .query_pairs_mut()
-        .append_pair(
-            "server",
-            state
-                .server
-                .as_ref()
-                .map_or(DEFAULT_SERVER, |server| server.url.as_str()),
-        )
-        .append_pair("phase", state.phase)
-        .append_pair("ready", if state.ready { "true" } else { "false" });
-    if let Some(window) = app.get_webview_window("launcher") {
-        let _ = window.eval(format!(
-            "window.updateLauncher?.('{}')",
-            message.query().unwrap()
-        ));
-    }
-}
-
-fn show_launcher(app: &AppHandle) {
-    update_launcher(app);
-    if let Some(window) = app.get_webview_window("launcher") {
-        let _ = window.show();
-        let _ = window.set_focus();
-    }
-}
-
-fn begin_navigation(app: &AppHandle, label: &str) {
-    let state = app.state::<Mutex<Connection>>();
-    let revision = {
-        let mut state = state.lock().unwrap();
-        if state.label.as_deref() != Some(label) {
-            return;
-        }
-        state.begin_navigation()
-    };
-    update_launcher(app);
-    let handle = app.clone();
-    std::thread::spawn(move || {
-        std::thread::sleep(Duration::from_secs(15));
-        let state = handle.state::<Mutex<Connection>>();
-        let timed_out = state.lock().unwrap().timeout(revision);
-        if timed_out {
-            show_launcher(&handle);
-        }
-    });
-}
-
-fn open_workspace(app: &AppHandle, input: &str) -> Result<(), &'static str> {
-    let url = validate_url(input)?;
-    let state = app.state::<Mutex<Connection>>();
-    let (server, old_label, label) = {
-        let mut state = state.lock().unwrap();
-        let same_server = state
-            .server
-            .as_ref()
-            .is_some_and(|server| server.url == url);
-        if same_server && state.ready {
-            if let Some(window) = state
-                .label
-                .as_ref()
-                .and_then(|label| app.get_webview_window(label))
-            {
-                window.show().map_err(|_| "connectionError")?;
-                window.set_focus().map_err(|_| "connectionError")?;
-                return Ok(());
-            }
-        }
-        let server = if same_server {
-            state.server.clone().unwrap()
-        } else {
-            Server::new(url).map_err(|_| "storageError")?
-        };
-        server
-            .save(&configuration_path(app).map_err(|_| "storageError")?)
-            .map_err(|_| "storageError")?;
-        let old_label = state.label.take();
-        state.server = Some(server.clone());
-        state.ready = false;
-        state.revision += 1;
-        let label = format!("workspace-{}", state.revision);
-        state.label = Some(label.clone());
-        (server, old_label, label)
-    };
-    if let Some(window) = old_label.and_then(|label| app.get_webview_window(&label)) {
-        window.close().map_err(|_| "connectionError")?;
-    }
-    begin_navigation(app, &label);
-    let handle = app.clone();
-    let navigation_label = label.clone();
-    let server_url = server.url.clone();
-    let window = WebviewWindowBuilder::new(app, &label, WebviewUrl::External(server.url))
-        .title(en::APP_NAME)
-        .inner_size(1280.0, 850.0)
-        .min_inner_size(375.0, 600.0)
-        .center()
-        .visible(false)
-        .data_store_identifier(server.profile)
-        .on_navigation(move |destination| {
-            if !allows_server_navigation(&server_url, destination) {
-                return false;
-            }
-            begin_navigation(&handle, &navigation_label);
-            true
-        })
-        .on_new_window(|_, _| NewWindowResponse::Deny)
-        .on_page_load(|window, payload| {
-            if payload.event() != PageLoadEvent::Finished {
-                return;
-            }
-            let app = window.app_handle();
-            let state = app.state::<Mutex<Connection>>();
-            let should_show = {
-                let mut state = state.lock().unwrap();
-                if state.label.as_deref() != Some(window.label()) {
-                    return;
-                }
-                let first_load = !state.ready;
-                state.ready = true;
-                state.phase = "connected";
-                first_load
-            };
-            update_launcher(app);
-            if should_show {
-                let _ = window.show();
-                let _ = window.set_focus();
-                if let Some(launcher) = app.get_webview_window("launcher") {
-                    let _ = launcher.hide();
-                }
-            }
-        })
-        .build()
-        .map_err(|_| "connectionError")?;
-    let handle = app.clone();
-    window.on_window_event(move |event| {
-        if matches!(event, WindowEvent::Destroyed) {
-            let state = handle.state::<Mutex<Connection>>();
-            let current = {
-                let mut state = state.lock().unwrap();
-                if state.label.as_deref() == Some(&label) {
-                    state.label = None;
-                    state.ready = false;
-                    state.revision += 1;
-                    state.phase = "idle";
-                    true
-                } else {
-                    false
-                }
-            };
-            if current {
-                show_launcher(&handle);
-            }
-        }
-    });
-    Ok(())
-}
-
-fn handle_launcher_action(app: &AppHandle, destination: &Url) {
-    let result = match destination.path() {
-        "/action/open" => {
-            let input = destination
-                .query_pairs()
-                .find(|(key, _)| key == "server")
-                .map(|(_, value)| value.into_owned())
-                .unwrap_or_default();
-            open_workspace(app, &input)
-        }
-        "/action/resume" => {
-            let label = app
-                .state::<Mutex<Connection>>()
-                .lock()
-                .unwrap()
-                .label
-                .clone();
-            if let Some(window) = label.and_then(|label| app.get_webview_window(&label)) {
-                let _ = window.show();
-                let _ = window.set_focus();
-            }
-            Ok(())
-        }
-        _ => Ok(()),
-    };
-    if let Err(error) = result {
-        app.state::<Mutex<Connection>>().lock().unwrap().phase = error;
-        show_launcher(app);
-    }
-}
-
-pub fn context<R: tauri::Runtime>() -> tauri::Context<R> {
-    tauri::generate_context!()
-}
-
-pub fn builder() -> tauri::Builder<tauri::Wry> {
-    tauri::Builder::default().setup(|app| {
-        let (server, phase) = match Server::load(&configuration_path(app.handle())?) {
-            Ok(server) => (server, "idle"),
-            Err(_) => (None, "storageError"),
-        };
-        app.manage(Mutex::new(Connection {
-            server,
-            phase,
-            ..Default::default()
-        }));
-        let menu = MenuBuilder::new(app)
-            .item(
-                &SubmenuBuilder::new(app, en::APP_NAME)
-                    .text("server-settings", en::SERVER_SETTINGS)
-                    .separator()
-                    .quit()
-                    .build()?,
-            )
-            .item(
-                &SubmenuBuilder::new(app, en::EDIT)
-                    .undo()
-                    .redo()
-                    .separator()
-                    .cut()
-                    .copy()
-                    .paste()
-                    .select_all()
-                    .build()?,
-            )
-            .build()?;
-        app.set_menu(menu)?;
-        app.on_menu_event(|app, event| {
-            if event.id().as_ref() == "server-settings" {
-                show_launcher(app);
-            }
-        });
-        let handle = app.handle().clone();
-        let launcher =
-            WebviewWindowBuilder::new(app, "launcher", WebviewUrl::App("index.html".into()))
-                .title(en::APP_NAME)
-                .inner_size(560.0, 720.0)
-                .min_inner_size(375.0, 640.0)
-                .center()
-                .on_navigation(move |destination| {
-                    if !allows_launcher_navigation(destination) {
-                        return false;
-                    }
-                    if destination.path().starts_with("/action/") {
-                        let handle = handle.clone();
-                        let destination = destination.clone();
-                        let _ = handle.clone().run_on_main_thread(move || {
-                            handle_launcher_action(&handle, &destination)
-                        });
-                        return false;
-                    }
-                    matches!(destination.path(), "" | "/" | "/index.html")
-                })
-                .on_new_window(|_, _| NewWindowResponse::Deny)
-                .on_page_load(|window, payload| {
-                    if payload.event() == PageLoadEvent::Finished {
-                        let app = window.app_handle().clone();
-                        update_launcher(&app);
-                        std::thread::spawn(move || {
-                            let handle = app.clone();
-                            let _ = app.run_on_main_thread(move || {
-                                let server = handle
-                                    .state::<Mutex<Connection>>()
-                                    .lock()
-                                    .unwrap()
-                                    .server
-                                    .clone();
-                                if let Some(server) = server {
-                                    if let Err(error) = open_workspace(&handle, server.url.as_str())
-                                    {
-                                        handle.state::<Mutex<Connection>>().lock().unwrap().phase =
-                                            error;
-                                        show_launcher(&handle);
-                                    }
-                                }
-                            });
-                        });
-                    }
-                })
-                .build()?;
-        let window = launcher.clone();
-        launcher.on_window_event(move |event| {
-            if let WindowEvent::CloseRequested { api, .. } = event {
-                api.prevent_close();
-                let _ = window.hide();
-            }
-        });
-        Ok(())
-    })
-}
+#[cfg(target_os = "android")]
+pub use android::{builder, context};
+#[cfg(not(target_os = "android"))]
+pub use desktop::{builder, context};
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
     builder().run(context()).expect("Could not start KanbanGit");
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn navigation_is_limited_to_the_selected_https_origin() {
-        let server = validate_url("https://example.com:8443/app/").unwrap();
-        for path in [
-            "/login",
-            "/two-factor-challenge",
-            "/projects/1?ticket=52#details",
-        ] {
-            assert!(allows_server_navigation(
-                &server,
-                &server.join(path).unwrap()
-            ));
-        }
-        for destination in [
-            "http://example.com:8443/",
-            "https://example.com/",
-            "https://other.example.com:8443/",
-            "https://user:secret@example.com:8443/",
-            "tauri://localhost/action/open?server=https://evil.test",
-            "file:///etc/passwd",
-            "data:text/html,hello",
-            "javascript:alert(1)",
-        ] {
-            assert!(!allows_server_navigation(
-                &server,
-                &Url::parse(destination).unwrap()
-            ));
-        }
-    }
-
-    #[test]
-    fn launcher_actions_are_restricted_to_the_bundled_origin() {
-        assert!(allows_launcher_navigation(
-            &Url::parse("tauri://localhost/action/open").unwrap()
-        ));
-        for input in [
-            DEFAULT_SERVER,
-            "https://localhost/",
-            "tauri://other/index.html",
-            "tauri://user@localhost/index.html",
-        ] {
-            assert!(!allows_launcher_navigation(&Url::parse(input).unwrap()));
-        }
-    }
-
-    #[test]
-    fn stale_timeouts_do_not_replace_newer_connections_or_loaded_forms() {
-        let mut state = Connection::default();
-        let first = state.begin_navigation();
-        let second = state.begin_navigation();
-        assert!(!state.timeout(first));
-        state.ready = true;
-        assert!(state.timeout(second));
-        assert!(state.ready);
-        assert!(!state.timeout(second));
-        let third = state.begin_navigation();
-        state.phase = "connected";
-        assert!(!state.timeout(third));
-    }
-
-    #[test]
-    fn remote_pages_cannot_invoke_native_commands() {
-        let app = tauri::test::mock_builder().build(context()).unwrap();
-        let window = WebviewWindowBuilder::new(
-            &app,
-            "workspace-1",
-            WebviewUrl::External(Url::parse(DEFAULT_SERVER).unwrap()),
-        )
-        .build()
-        .unwrap();
-        for command in [
-            "plugin:window|close",
-            "plugin:webview|create_webview_window",
-            "plugin:path|resolve_directory",
-        ] {
-            let response = tauri::test::get_ipc_response(
-                &window,
-                tauri::webview::InvokeRequest {
-                    cmd: command.into(),
-                    callback: tauri::ipc::CallbackFn(0),
-                    error: tauri::ipc::CallbackFn(1),
-                    url: Url::parse(DEFAULT_SERVER).unwrap(),
-                    body: tauri::ipc::InvokeBody::default(),
-                    headers: Default::default(),
-                    invoke_key: tauri::test::INVOKE_KEY.into(),
-                },
-            );
-            assert!(response
-                .unwrap_err()
-                .as_str()
-                .unwrap()
-                .contains("not allowed"));
-        }
-    }
-
-    #[test]
-    fn packaged_app_exposes_no_native_capabilities_or_global_api() {
-        let config: serde_json::Value =
-            serde_json::from_str(include_str!("../tauri.conf.json")).unwrap();
-        assert_eq!(config["bundle"]["macOS"]["minimumSystemVersion"], "14.0");
-        assert_eq!(config["app"]["withGlobalTauri"], false);
-        assert_eq!(
-            config["app"]["security"]["capabilities"],
-            serde_json::json!([])
-        );
-    }
-}

native/tests/mobile-launcher.test.js

@@ -0,0 +1,89 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+class Element {
+    constructor() {
+        this.events = {};
+        this.attributes = {};
+        this.dataset = {};
+        this.hidden = true;
+        this.value = '';
+    }
+    addEventListener(name, callback) {
+        this.events[name] = callback;
+    }
+    setAttribute(name, value) {
+        this.attributes[name] = value;
+    }
+    removeAttribute(name) {
+        delete this.attributes[name];
+    }
+    focus() {}
+    fire(name) {
+        this.events[name]({ preventDefault() {}, target: this });
+    }
+}
+
+test('Android launcher sends only explicit local actions and preserves switch confirmation', async () => {
+    const elements = new Map();
+    const element = (selector) => {
+        if (!elements.has(selector)) {
+            elements.set(selector, new Element());
+        }
+        return elements.get(selector);
+    };
+    const messages = [];
+    globalThis.document = {
+        querySelectorAll: () => [],
+        querySelector: element,
+        documentElement: new Element(),
+    };
+    globalThis.window = {
+        nativeLauncher: {
+            postMessage: (value) => messages.push(new URL(value)),
+        },
+    };
+    globalThis.location = { href: 'https://tauri.localhost/index.html' };
+    try {
+        await import('../ui/main.js');
+        assert.equal(messages.shift().pathname, '/action/ready');
+        window.updateLauncher(
+            'server=https%3A%2F%2Fexample.com%2F&phase=idle&ready=false&platform=android',
+        );
+        assert.equal(element('#server-url').value, 'https://example.com/');
+        element('#server-url').value = 'http://example.com';
+        element('#server-form').fire('submit');
+        assert.equal(messages.length, 0);
+        assert.equal(element('#server-url').attributes['aria-invalid'], 'true');
+        element('#server-url').value = 'https://example.com/';
+        element('#server-form').fire('submit');
+        assert.equal(messages[0].pathname, '/action/open');
+        assert.equal(
+            messages.shift().searchParams.get('server'),
+            'https://example.com/',
+        );
+        window.updateLauncher(
+            'server=https%3A%2F%2Fexample.com%2F&phase=connected&ready=true&platform=android',
+        );
+        assert.match(
+            element('#connection-status').textContent,
+            /Use Server settings/,
+        );
+        element('#resume').fire('click');
+        assert.equal(messages.shift().pathname, '/action/resume');
+        element('#server-url').value = 'https://other.example.com/';
+        element('#server-form').fire('submit');
+        assert.equal(messages.length, 0);
+        assert.equal(element('#switch-confirmation').hidden, false);
+        element('#confirm-switch').fire('click');
+        assert.equal(
+            messages.shift().searchParams.get('server'),
+            'https://other.example.com/',
+        );
+        assert.equal(location.href, 'https://tauri.localhost/index.html');
+    } finally {
+        delete globalThis.window;
+        delete globalThis.document;
+        delete globalThis.location;
+    }
+});

native/ui/locales/en.js

@@ -16,6 +16,8 @@ export const en = {
     connecting: 'Connecting to your server…',
     connected:
         'Your workspace is open. Use KanbanGit → Server settings to change servers.',
+    connectedMobile:
+        'Your workspace is open. Use Server settings to change servers.',
     connectionError:
         'The server did not finish loading. Check your connection, server address and HTTPS certificate, then try again. An already open workspace and its inputs are kept.',
     invalidServer:

native/ui/main.js

@@ -20,7 +20,11 @@ function action(name, server) {
     if (server) {
         url.searchParams.set('server', server);
     }
-    location.href = url.href;
+    if (window.nativeLauncher) {
+        window.nativeLauncher.postMessage(url.href);
+    } else {
+        location.href = url.href;
+    }
 }
 
 window.updateLauncher = (query) => {
@@ -34,7 +38,12 @@ window.updateLauncher = (query) => {
     if (phase === 'connecting' || phase === 'connected') {
         activeServer = server;
     }
-    status.textContent = en[phase] ?? '';
+    status.textContent =
+        en[
+            phase === 'connected' && state.get('platform') === 'android'
+                ? 'connectedMobile'
+                : phase
+        ] ?? '';
     status.dataset.state = phase;
     open.disabled = phase === 'connecting';
     open.textContent =
@@ -85,3 +94,7 @@ resume.addEventListener('click', () => action('resume'));
 document.querySelector('#appearance').addEventListener('change', (event) => {
     document.documentElement.dataset.appearance = event.target.value;
 });
+
+if (window.nativeLauncher) {
+    action('ready');
+}