feat(KAN-53): add Android app and platform integration

.dockerignore

@@ -43,3 +43,7 @@ storage/framework/sessions/*
 storage/framework/testing/*
 storage/framework/views/*
 storage/logs/*
+
+# Native build artifacts are independent of the Laravel image.
+native/src-tauri/target
+native/src-tauri/gen

.gitignore

@@ -28,3 +28,8 @@ yarn-error.log
 /.vscode
 /.zed
 .codex/config.toml
+
+/native/node_modules
+/native/src-tauri/target
+/native/src-tauri/gen/*
+!/native/src-tauri/gen/android/

AGENTS.md

@@ -1,3 +1,9 @@
+# Working Agreements
+
+## Missing programs and SDKs
+
+If implementation or verification requires a missing program, SDK, runtime, toolchain, or platform component, do not download or install a temporary copy in `/tmp` or another temporary directory. Do not use an ad hoc toolchain as a workaround. Tell the user which prerequisites are missing, ask them to install them permanently and confirm when installation is complete, and wait for that confirmation before continuing dependent work. This rule applies to every implementation task in this project.
+
 <laravel-boost-guidelines>
 === foundation rules ===
 

eslint.config.mjs

@@ -27,7 +27,9 @@ const eslintConfig = [
         ignores: [
             'bootstrap/ssr/**',
             '**/dist/**',
-            'node_modules/**',
+            '**/node_modules/**',
+            'native/src-tauri/target/**',
+            'native/src-tauri/gen/**',
             '.github/**',
             '**/*.yml',
             '**/*.yaml',

native/package.json

@@ -0,0 +1,19 @@
+{
+    "name": "kanbangit-native",
+    "version": "0.1.0",
+    "private": true,
+    "type": "module",
+    "scripts": {
+        "dev": "tauri dev",
+        "build": "tauri build",
+        "build:macos": "tauri build --debug --bundles app",
+        "test": "node --test tests/*.test.js && cargo test --manifest-path src-tauri/Cargo.toml --locked",
+        "check": "cargo fmt --manifest-path src-tauri/Cargo.toml --check && cargo clippy --manifest-path src-tauri/Cargo.toml --locked --all-targets --all-features -- -D warnings",
+        "smoke:macos": "cargo test --manifest-path src-tauri/Cargo.toml --locked --features smoke-test,custom-protocol --test macos_smoke",
+        "dev:android": "tauri android dev",
+        "build:android": "tauri android build --debug --apk --target aarch64"
+    },
+    "devDependencies": {
+        "@tauri-apps/cli": "2.11.4"
+    }
+}

native/pnpm-lock.yaml

@@ -0,0 +1,140 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    devDependencies:
+      '@tauri-apps/cli':
+        specifier: 2.11.4
+        version: 2.11.4
+
+packages:
+
+  '@tauri-apps/cli-darwin-arm64@2.11.4':
+    resolution: {integrity: sha512-1ryOF3ZhpZ/nemHV5zVwBQBz9jDGKmKPvWPADOhc83ig0P4bMc2iER4NbC6r9sjeIZ6RVQ4g3RZIYvezhcl4TQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@tauri-apps/cli-darwin-x64@2.11.4':
+    resolution: {integrity: sha512-uFsGQAAfuyz1k/yGLmkWfkBlgKAqZfxqlHmLWx81QU27RJWfmbNHCIq8T8w1e+VClleIuZUjpHWfoE4E3DLo3A==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@tauri-apps/cli-linux-arm-gnueabihf@2.11.4':
+    resolution: {integrity: sha512-IaHZn5CdBL21oUmjiVOS1ctw6Ip1O0pjp70FwOWmYz1myWe0SY96ZIj2FYf7pT0m8bI2h/hrs5ZbEXXh44/MkQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm]
+    os: [linux]
+
+  '@tauri-apps/cli-linux-arm64-gnu@2.11.4':
+    resolution: {integrity: sha512-N41/ukTRVe6XSuUTESuFdGeOW2i7k62tK+6gHK5Kd5/q5RPvvi19GaWAVPPb9u95HSGmTChSolBfzynUsssFaA==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tauri-apps/cli-linux-arm64-musl@2.11.4':
+    resolution: {integrity: sha512-v277UnT/fB64xAfSroL5N3Km3tLmvATWqJJw/wRI+g6o+HkeD0slyE7gOhNs1MbjE41R7bQOTxMVoL3aomUJmw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@tauri-apps/cli-linux-riscv64-gnu@2.11.4':
+    resolution: {integrity: sha512-qqgNkQ2u1yZHxjhxsZaxUtRDW8dIqIYm33rx/mzwQv0SfY9x1B+iraj8vWeFiXjjSVVhEMepXSOts1TqPzvXNQ==}
+    engines: {node: '>= 10'}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tauri-apps/cli-linux-x64-gnu@2.11.4':
+    resolution: {integrity: sha512-2VRNWl84FOH0m2giiDkO2h0QXlcMJeX+zJDpI5kDIQAx6s+geF3v48F4DXfJez4GS/FdoDGnPnw1C2iYGbQ7bQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@tauri-apps/cli-linux-x64-musl@2.11.4':
+    resolution: {integrity: sha512-o9GyhYor/nc7xarmwDE3ka2szuW3uuZzXjHWh64Q8YX5AtSgxdQkFWzrY4O8KiGtVNvFBI14H3Q49Qj5TOIP/A==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@tauri-apps/cli-win32-arm64-msvc@2.11.4':
+    resolution: {integrity: sha512-ld5Ehb598m0VkYyylRPNeCFsBe/km0jxis6KgMpl3IGY6I/i1RwQXO05I1AsXUXO2WC6AvB/Lw4qTf/asiuEiQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@tauri-apps/cli-win32-ia32-msvc@2.11.4':
+    resolution: {integrity: sha512-12Hxi0XX/H5VFxO/bGgHkFWhml9VMgEOu9CidjeCeTNQ1l6fpUlbiGgSP7CLI3PFtW9/FfbeHieZ+kyWK5H7CA==}
+    engines: {node: '>= 10'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@tauri-apps/cli-win32-x64-msvc@2.11.4':
+    resolution: {integrity: sha512-+vDiqBIU5dMISg/wNvX3sF+ZHfgJGJ5T0AcO+EHNXV9GGAG+P5fzodlDXD3QdKCRgZxMoCm5PPvj3BqLNjBthw==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@tauri-apps/cli@2.11.4':
+    resolution: {integrity: sha512-R8xGtMpwyetawSqm9kYOuMmEqkhUbvcUy8n0aNXIxollKBLESUu5f4Fx+64hgASYm1H+jSWq6jCW6zqTnH6hqQ==}
+    engines: {node: '>= 10'}
+    hasBin: true
+
+snapshots:
+
+  '@tauri-apps/cli-darwin-arm64@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-darwin-x64@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-arm-gnueabihf@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-arm64-gnu@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-arm64-musl@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-riscv64-gnu@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-x64-gnu@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-linux-x64-musl@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-win32-arm64-msvc@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-win32-ia32-msvc@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli-win32-x64-msvc@2.11.4':
+    optional: true
+
+  '@tauri-apps/cli@2.11.4':
+    optionalDependencies:
+      '@tauri-apps/cli-darwin-arm64': 2.11.4
+      '@tauri-apps/cli-darwin-x64': 2.11.4
+      '@tauri-apps/cli-linux-arm-gnueabihf': 2.11.4
+      '@tauri-apps/cli-linux-arm64-gnu': 2.11.4
+      '@tauri-apps/cli-linux-arm64-musl': 2.11.4
+      '@tauri-apps/cli-linux-riscv64-gnu': 2.11.4
+      '@tauri-apps/cli-linux-x64-gnu': 2.11.4
+      '@tauri-apps/cli-linux-x64-musl': 2.11.4
+      '@tauri-apps/cli-win32-arm64-msvc': 2.11.4
+      '@tauri-apps/cli-win32-ia32-msvc': 2.11.4
+      '@tauri-apps/cli-win32-x64-msvc': 2.11.4

native/pnpm-workspace.yaml

@@ -0,0 +1 @@
+minimumReleaseAge: 10080

native/src-tauri/Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+name = "kanbangit-native"
+version = "0.1.0"
+description = "KanbanGit native application"
+edition = "2021"
+publish = false
+
+[lib]
+name = "kanbangit_native"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+tauri = { version = "2", features = [] }
+
+[dev-dependencies]
+tauri = { version = "2", features = ["test"] }
+serde_json = "1"
+
+[features]
+smoke-test = []
+custom-protocol = ["tauri/custom-protocol"]
+
+[[test]]
+name = "macos_smoke"
+harness = false
+required-features = ["smoke-test"]

native/src-tauri/build.rs

@@ -0,0 +1,3 @@
+fn main() {
+    tauri_build::build();
+}

native/src-tauri/gen/android/.editorconfig

@@ -0,0 +1,12 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = false
+insert_final_newline = false

native/src-tauri/gen/android/.gitignore

@@ -0,0 +1,26 @@
+*.iml
+.gradle
+/local.properties
+/.idea/caches
+/.idea/libraries
+/.idea/modules.xml
+/.idea/workspace.xml
+/.idea/navEditor.xml
+/.idea/assetWizardSettings.xml
+.DS_Store
+build
+/captures
+.externalNativeBuild
+.cxx
+local.properties
+key.properties
+keystore.properties
+
+/.tauri
+/tauri.settings.gradle
+/app/tauri.build.gradle.kts
+/app/src/main/jniLibs
+/app/src/main/java/de/kanbangit/desktop/generated
+
+.kotlin
+/app/tauri.properties

native/src-tauri/gen/android/app/.gitignore

@@ -0,0 +1,6 @@
+/src/main/**/generated
+/src/main/jniLibs/**/*.so
+/src/main/assets/tauri.conf.json
+/tauri.build.gradle.kts
+/proguard-tauri.pro
+/tauri.properties

native/src-tauri/gen/android/app/build.gradle.kts

@@ -0,0 +1,76 @@
+import java.util.Properties
+
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+    id("rust")
+}
+
+val tauriProperties = Properties().apply {
+    val propFile = file("tauri.properties")
+    if (propFile.exists()) {
+        propFile.inputStream().use { load(it) }
+    }
+}
+
+android {
+    compileSdk = 36
+    buildToolsVersion = "36.0.0"
+    namespace = "de.kanbangit.desktop"
+    defaultConfig {
+        manifestPlaceholders["usesCleartextTraffic"] = "false"
+        applicationId = "de.kanbangit.desktop"
+        minSdk = 24
+        targetSdk = 36
+        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
+        // Tauri exits the process when its last activity is destroyed; report results first.
+        testInstrumentationRunnerArguments["waitForActivitiesToComplete"] = "false"
+        versionCode = tauriProperties.getProperty("tauri.android.versionCode", "1").toInt()
+        versionName = tauriProperties.getProperty("tauri.android.versionName", "1.0")
+    }
+    buildTypes {
+        getByName("debug") {
+            manifestPlaceholders["usesCleartextTraffic"] = "false"
+            isDebuggable = true
+            isJniDebuggable = true
+            isMinifyEnabled = false
+            packaging {
+                jniLibs.keepDebugSymbols.add("*/arm64-v8a/*.so")
+                jniLibs.keepDebugSymbols.add("*/armeabi-v7a/*.so")
+                jniLibs.keepDebugSymbols.add("*/x86/*.so")
+                jniLibs.keepDebugSymbols.add("*/x86_64/*.so")
+            }
+        }
+        getByName("release") {
+            isMinifyEnabled = true
+            proguardFiles(
+                *fileTree(".") { include("**/*.pro") }
+                    .plus(getDefaultProguardFile("proguard-android-optimize.txt"))
+                    .toList().toTypedArray()
+            )
+        }
+    }
+    kotlinOptions {
+        jvmTarget = "1.8"
+    }
+    buildFeatures {
+        buildConfig = true
+    }
+}
+
+rust {
+    rootDirRel = "../../../"
+}
+
+dependencies {
+    implementation("androidx.webkit:webkit:1.14.0")
+    implementation("androidx.appcompat:appcompat:1.7.1")
+    implementation("androidx.activity:activity-ktx:1.10.1")
+    implementation("com.google.android.material:material:1.12.0")
+    implementation("androidx.lifecycle:lifecycle-process:2.10.0")
+    testImplementation("junit:junit:4.13.2")
+    androidTestImplementation("androidx.test.ext:junit:1.1.4")
+    androidTestImplementation("androidx.test.espresso:espresso-core:3.5.0")
+}
+
+apply(from = "tauri.build.gradle.kts")

native/src-tauri/gen/android/app/proguard-rules.pro

@@ -0,0 +1,21 @@
+# Add project specific ProGuard rules here.
+# You can control the set of applied configuration files using the
+# proguardFiles setting in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile

native/src-tauri/gen/android/app/src/androidTest/java/de/kanbangit/desktop/PlatformTest.kt

@@ -0,0 +1,116 @@
+package de.kanbangit.desktop
+
+import android.content.Context
+import android.os.SystemClock
+import android.view.InputDevice
+import android.view.MotionEvent
+import android.view.View
+import android.webkit.CookieManager
+import android.webkit.WebView
+import androidx.lifecycle.Lifecycle
+import androidx.test.core.app.ActivityScenario
+import androidx.test.platform.app.InstrumentationRegistry
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import org.junit.Assert.*
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicReference
+
+@RunWith(AndroidJUnit4::class)
+class PlatformTest {
+    private val instrumentation = InstrumentationRegistry.getInstrumentation()
+
+    private fun evaluate(view: WebView, script: String): String {
+        val result = AtomicReference<String>()
+        val latch = CountDownLatch(1)
+        instrumentation.runOnMainSync { view.evaluateJavascript(script) { result.set(it); latch.countDown() } }
+        assertTrue("JavaScript callback timed out", latch.await(10, TimeUnit.SECONDS))
+        return result.get()
+    }
+
+    private fun waitFor(condition: () -> Boolean) {
+        val end = System.currentTimeMillis() + 25000
+        while (System.currentTimeMillis() < end) {
+            if (condition()) return
+            Thread.sleep(100)
+        }
+        fail("Platform condition timed out")
+    }
+
+    private fun tapCenter(view: View) {
+        val position = IntArray(2)
+        instrumentation.runOnMainSync {
+            view.getLocationOnScreen(position)
+            position[0] += view.width / 2
+            position[1] += view.height / 2
+        }
+        val downTime = SystemClock.uptimeMillis()
+        for (action in listOf(MotionEvent.ACTION_DOWN, MotionEvent.ACTION_UP)) {
+            val event = MotionEvent.obtain(downTime, SystemClock.uptimeMillis(), action, position[0].toFloat(), position[1].toFloat(), 0)
+            event.source = InputDevice.SOURCE_TOUCHSCREEN
+            try {
+                instrumentation.sendPointerSync(event)
+            } finally {
+                event.recycle()
+            }
+        }
+        instrumentation.waitForIdleSync()
+    }
+
+    @Test fun workspacePreservesFormsAndIsolatesServers() {
+        instrumentation.targetContext.getSharedPreferences("workspace", Context.MODE_PRIVATE).edit().clear().commit()
+        val scenario = ActivityScenario.launch(MainActivity::class.java)
+        Thread.sleep(1500)
+        scenario.onActivity { it.openWorkspace("https://kanbangit.de/") }
+        val remote = AtomicReference<WebView>()
+        waitFor {
+            var visible = false
+            scenario.onActivity { remote.set(it.workspace); visible = it.workspace?.visibility == View.VISIBLE }
+            visible && remote.get() != null && evaluate(remote.get(), "document.readyState === 'complete' && document.querySelector('#app')?.innerText.trim().length > 100") == "true"
+        }
+        val view = remote.get()
+        assertEquals("true", evaluate(view, "typeof window.nativeLauncher === 'undefined' && typeof window.__TAURI_INTERNALS__ === 'undefined'"))
+        assertEquals("true", evaluate(view, """
+            (() => {
+                const input = document.createElement('input');
+                input.id = 'kan53-input';
+                input.value = 'retained form';
+                document.body.append(input);
+                const button = document.createElement('button');
+                button.style.cssText = 'position:fixed;inset:0;width:100%;height:100%;z-index:2147483647';
+                button.textContent = 'Navigate';
+                button.onclick = () => {
+                    history.pushState({}, '', '/kan53-history');
+                    button.remove();
+                };
+                document.body.append(button);
+                return true;
+            })()
+        """.trimIndent()))
+        tapCenter(view)
+        waitFor { evaluate(view, "location.pathname === '/kan53-history'") == "true" }
+        waitFor {
+            var canGoBack = false
+            scenario.onActivity { canGoBack = view.canGoBack() }
+            canGoBack
+        }
+        scenario.moveToState(Lifecycle.State.CREATED)
+        scenario.moveToState(Lifecycle.State.RESUMED)
+        assertEquals("\"retained form\"", evaluate(view, "document.querySelector('#kan53-input').value"))
+        scenario.onActivity { it.onBackPressedDispatcher.onBackPressed() }
+        waitFor { evaluate(view, "location.pathname !== '/kan53-history'") == "true" }
+        assertEquals("\"retained form\"", evaluate(view, "document.querySelector('#kan53-input').value"))
+        evaluate(view, "document.cookie = 'kan53_fixture=secret; Path=/; Secure; SameSite=Lax'; localStorage.setItem('kan53_fixture', 'secret')")
+        scenario.onActivity { it.openWorkspace("https://127.0.0.1:9/") }
+        waitFor {
+            val cookie = AtomicReference<String>()
+            instrumentation.runOnMainSync { cookie.set(CookieManager.getInstance().getCookie("https://kanbangit.de/")) }
+            cookie.get()?.contains("kan53_fixture") != true
+        }
+        scenario.onActivity { assertNotSame(view, it.workspace) }
+        // Let instrumentation finish the process after reporting, rather than exiting via Tauri.
+        scenario.moveToState(Lifecycle.State.CREATED)
+    }
+}

native/src-tauri/gen/android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:icon="@drawable/kanbangit"
+        android:label="@string/app_name"
+        android:theme="@style/Theme.kanbangit_native"
+        android:usesCleartextTraffic="${usesCleartextTraffic}">
+        <activity
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|smallestScreenSize|screenLayout|uiMode"
+            android:launchMode="singleTask"
+            android:label="@string/main_activity_title"
+            android:name=".MainActivity"
+            android:windowSoftInputMode="adjustResize"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <provider
+          android:name="androidx.core.content.FileProvider"
+          android:authorities="${applicationId}.fileprovider"
+          android:exported="false"
+          android:grantUriPermissions="true">
+          <meta-data
+            android:name="android.support.FILE_PROVIDER_PATHS"
+            android:resource="@xml/file_paths" />
+        </provider>
+    </application>
+</manifest>

native/src-tauri/gen/android/app/src/main/java/de/kanbangit/desktop/MainActivity.kt

@@ -0,0 +1,306 @@
+package de.kanbangit.desktop
+
+import android.annotation.SuppressLint
+import android.content.res.Configuration
+import android.graphics.Bitmap
+import android.net.Uri
+import android.net.http.SslError
+import android.os.Bundle
+import android.os.Handler
+import android.os.Looper
+import android.view.View
+import android.view.ViewGroup
+import android.webkit.CookieManager
+import android.webkit.SslErrorHandler
+import android.webkit.WebChromeClient
+import android.webkit.WebResourceError
+import android.webkit.WebResourceRequest
+import android.webkit.WebResourceResponse
+import android.webkit.WebSettings
+import android.webkit.WebStorage
+import android.webkit.WebView
+import android.webkit.WebViewClient
+import android.widget.Button
+import android.widget.FrameLayout
+import android.widget.LinearLayout
+import android.widget.TextView
+import androidx.activity.OnBackPressedCallback
+import androidx.activity.enableEdgeToEdge
+import androidx.core.view.ViewCompat
+import androidx.core.view.WindowCompat
+import androidx.core.view.WindowInsetsCompat
+import androidx.webkit.WebViewCompat
+import androidx.webkit.WebViewFeature
+import org.json.JSONObject
+
+class MainActivity : TauriActivity() {
+    private val handler = Handler(Looper.getMainLooper())
+    private val preferences by lazy { getSharedPreferences("workspace", MODE_PRIVATE) }
+    private lateinit var launcher: WebView
+    private lateinit var root: LinearLayout
+    private lateinit var content: FrameLayout
+    private lateinit var settings: Button
+    internal var workspace: WebView? = null
+        private set
+    private var server = NavigationPolicy.DEFAULT_SERVER
+    private var phase = "idle"
+    private var ready = false
+    private var revision = 0
+    private var launcherVisible = true
+    private var keyboardVisible = false
+    private var initialized = false
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        enableEdgeToEdge()
+        super.onCreate(savedInstanceState)
+        onBackPressedDispatcher.addCallback(this, object : OnBackPressedCallback(true) {
+            override fun handleOnBackPressed() {
+                when (NavigationPolicy.backAction(keyboardVisible, launcherVisible, ready, workspace?.canGoBack() == true)) {
+                    "keyboard" -> WindowCompat.getInsetsController(window, window.decorView).hide(WindowInsetsCompat.Type.ime())
+                    "resume" -> showWorkspace()
+                    "history" -> workspace?.goBack()
+                    "settings" -> showLauncher()
+                    else -> moveTaskToBack(true)
+                }
+            }
+        })
+    }
+
+    override fun onWebViewCreate(webView: WebView) {
+        launcher = webView
+        if (WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
+            WebViewCompat.addWebMessageListener(launcher, "nativeLauncher", setOf(NavigationPolicy.LAUNCHER_ORIGIN)) {
+                _, message, origin, mainFrame, _ ->
+                if (mainFrame && origin.toString().trimEnd('/') == NavigationPolicy.LAUNCHER_ORIGIN) {
+                    launcher.post { handleAction(message.data.orEmpty()) }
+                }
+            }
+        }
+        launcher.post { attachShell() }
+    }
+
+    private fun attachShell() {
+        if (::root.isInitialized) return
+        (launcher.parent as? ViewGroup)?.removeView(launcher)
+        root = LinearLayout(this).apply { orientation = LinearLayout.VERTICAL }
+        settings = Button(this).apply {
+            text = getString(R.string.server_settings)
+            isAllCaps = false
+            visibility = View.GONE
+            setOnClickListener { showLauncher() }
+        }
+        root.addView(settings, LinearLayout.LayoutParams(-1, -2))
+        content = FrameLayout(this)
+        content.addView(launcher, FrameLayout.LayoutParams(-1, -1))
+        root.addView(content, LinearLayout.LayoutParams(-1, 0, 1f))
+        setContentView(root)
+        ViewCompat.setOnApplyWindowInsetsListener(root) { view, insets ->
+            val safe = insets.getInsets(WindowInsetsCompat.Type.systemBars() or WindowInsetsCompat.Type.displayCutout())
+            val keyboard = insets.getInsets(WindowInsetsCompat.Type.ime())
+            keyboardVisible = insets.isVisible(WindowInsetsCompat.Type.ime())
+            view.setPadding(safe.left, safe.top, safe.right, maxOf(safe.bottom, keyboard.bottom))
+            WindowInsetsCompat.CONSUMED
+        }
+        ViewCompat.requestApplyInsets(root)
+        if (!WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
+            content.removeAllViews()
+            content.addView(TextView(this).apply { text = getString(R.string.update_webview) })
+        }
+    }
+
+    private fun handleAction(value: String) {
+        attachShell()
+        val url = Uri.parse(value)
+        if (url.scheme != "https" || url.host != "tauri.localhost" || url.port != -1 || url.userInfo != null) return
+        when (url.path) {
+            "/action/ready" -> {
+                if (initialized) return
+                initialized = true
+                val saved = preferences.getString("server", null)
+                server = saved?.let(NavigationPolicy::installation) ?: NavigationPolicy.DEFAULT_SERVER
+                updateLauncher()
+                if (saved != null) openWorkspace(server)
+            }
+            "/action/open" -> openWorkspace(url.getQueryParameter("server").orEmpty())
+            "/action/resume" -> if (ready) showWorkspace()
+        }
+    }
+
+    internal fun openWorkspace(input: String) {
+        val address = NavigationPolicy.installation(input)
+        if (address == null) {
+            phase = "invalidServer"
+            showLauncher()
+            return
+        }
+        if (phase == "connecting") return
+        if (address == server && ready) {
+            if (phase == "connectionError") {
+                phase = "connecting"
+                workspace?.let { startTimeout(it); it.reload() }
+                updateLauncher()
+                return
+            }
+            showWorkspace()
+            return
+        }
+        val changed = address != preferences.getString("server", null)
+        val clearSession = changed || preferences.getBoolean("clearing", false)
+        if (!preferences.edit().putString("server", address).putBoolean("clearing", clearSession).commit()) {
+            phase = "storageError"
+            showLauncher()
+            return
+        }
+        server = address
+        ready = false
+        phase = "connecting"
+        revision++
+        workspace?.let { old ->
+            content.removeView(old)
+            old.stopLoading()
+            if (clearSession) old.clearCache(true)
+            old.destroy()
+        }
+        workspace = null
+        updateLauncher()
+        if (clearSession) {
+            WebStorage.getInstance().deleteAllData()
+            CookieManager.getInstance().removeAllCookies {
+                CookieManager.getInstance().flush()
+                if (!preferences.edit().putBoolean("clearing", false).commit()) {
+                    phase = "storageError"
+                    showLauncher()
+                } else if (!isDestroyed) {
+                    createWorkspace()
+                }
+            }
+        } else {
+            createWorkspace()
+        }
+    }
+
+    @SuppressLint("SetJavaScriptEnabled")
+    private fun createWorkspace() {
+        val remote = WebView(this)
+        workspace = remote
+        remote.settings.apply {
+            javaScriptEnabled = true
+            domStorageEnabled = true
+            allowFileAccess = false
+            allowContentAccess = false
+            mixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW
+            javaScriptCanOpenWindowsAutomatically = false
+            setSupportMultipleWindows(true)
+        }
+        CookieManager.getInstance().setAcceptThirdPartyCookies(remote, false)
+        remote.webChromeClient = WebChromeClient()
+        remote.webViewClient = object : WebViewClient() {
+            override fun shouldOverrideUrlLoading(view: WebView, request: WebResourceRequest): Boolean =
+                !NavigationPolicy.allows(server, request.url.toString())
+
+            override fun onPageStarted(view: WebView, url: String, favicon: Bitmap?) {
+                if (!NavigationPolicy.allows(server, url)) {
+                    view.stopLoading()
+                    fail(view)
+                    return
+                }
+                phase = "connecting"
+                startTimeout(view)
+                updateLauncher()
+            }
+
+            override fun onPageFinished(view: WebView, url: String) {
+                if (workspace !== view || phase != "connecting" || !NavigationPolicy.allows(server, url)) return
+                revision++
+                phase = "connected"
+                val firstLoad = !ready
+                ready = true
+                CookieManager.getInstance().flush()
+                updateLauncher()
+                if (firstLoad) showWorkspace()
+            }
+
+            override fun onReceivedError(view: WebView, request: WebResourceRequest, error: WebResourceError) {
+                if (request.isForMainFrame) fail(view)
+            }
+
+            override fun onReceivedHttpError(view: WebView, request: WebResourceRequest, response: WebResourceResponse) {
+                if (request.isForMainFrame && response.statusCode >= 500) fail(view)
+            }
+
+            override fun onReceivedSslError(view: WebView, sslHandler: SslErrorHandler, error: SslError) {
+                sslHandler.cancel()
+                fail(view)
+            }
+        }
+        remote.visibility = View.GONE
+        content.addView(remote, 0, FrameLayout.LayoutParams(-1, -1))
+        startTimeout(remote)
+        remote.loadUrl(server)
+    }
+
+    private fun startTimeout(view: WebView) {
+        val current = ++revision
+        handler.postDelayed({
+            if (current == revision && phase == "connecting" && workspace === view) {
+                view.stopLoading()
+                fail(view)
+            }
+        }, 15000)
+    }
+
+    private fun fail(view: WebView) {
+        if (workspace !== view) return
+        revision++
+        phase = "connectionError"
+        showLauncher()
+    }
+
+    private fun updateLauncher() {
+        val query = Uri.Builder().appendQueryParameter("server", server)
+            .appendQueryParameter("phase", phase).appendQueryParameter("ready", ready.toString())
+            .appendQueryParameter("platform", "android").build().encodedQuery.orEmpty()
+        launcher.evaluateJavascript("window.updateLauncher?.(${JSONObject.quote(query)})", null)
+    }
+
+    private fun showLauncher() {
+        updateLauncher()
+        launcherVisible = true
+        launcher.visibility = View.VISIBLE
+        workspace?.visibility = View.GONE
+        settings.visibility = View.GONE
+        launcher.requestFocus()
+    }
+
+    private fun showWorkspace() {
+        launcherVisible = false
+        launcher.visibility = View.GONE
+        workspace?.visibility = View.VISIBLE
+        settings.visibility = View.VISIBLE
+        workspace?.requestFocus()
+    }
+
+    override fun onPause() {
+        workspace?.onPause()
+        CookieManager.getInstance().flush()
+        super.onPause()
+    }
+
+    override fun onResume() {
+        super.onResume()
+        workspace?.onResume()
+    }
+
+    override fun onConfigurationChanged(newConfig: Configuration) {
+        super.onConfigurationChanged(newConfig)
+        enableEdgeToEdge()
+        if (::root.isInitialized) ViewCompat.requestApplyInsets(root)
+    }
+
+    override fun onDestroy() {
+        handler.removeCallbacksAndMessages(null)
+        workspace?.destroy()
+        workspace = null
+        super.onDestroy()
+    }
+}

native/src-tauri/gen/android/app/src/main/java/de/kanbangit/desktop/NavigationPolicy.kt

@@ -0,0 +1,41 @@
+package de.kanbangit.desktop
+
+import java.net.URI
+import java.util.Locale
+
+object NavigationPolicy {
+    const val DEFAULT_SERVER = "https://kanbangit.de/"
+    const val LAUNCHER_ORIGIN = "https://tauri.localhost"
+
+    fun installation(input: String): String? = runCatching {
+        val trimmed = input.trim()
+        require(trimmed.none { it.isISOControl() || it == '\\' })
+        val uri = URI(trimmed)
+        require(uri.scheme.equals("https", ignoreCase = true))
+        require(!uri.host.isNullOrBlank() && uri.rawUserInfo == null)
+        require(uri.rawQuery == null && uri.rawFragment == null)
+        require(uri.port == -1 || uri.port in 1..65535)
+        require(!uri.host.equals("tauri.localhost", ignoreCase = true))
+        val port = if (uri.port == -1 || uri.port == 443) "" else ":${uri.port}"
+        val path = uri.rawPath.orEmpty().let { if (it.endsWith('/')) it else "$it/" }
+        "https://${uri.host.lowercase(Locale.ROOT)}$port$path"
+    }.getOrNull()
+
+    fun allows(server: String, destination: String): Boolean = runCatching {
+        val base = URI(server)
+        val target = URI(destination)
+        target.scheme.equals("https", ignoreCase = true) &&
+            target.host.equals(base.host, ignoreCase = true) &&
+            (if (target.port == -1) 443 else target.port) ==
+            (if (base.port == -1) 443 else base.port) &&
+            target.rawUserInfo == null && !destination.contains('\\')
+    }.getOrDefault(false)
+
+    fun backAction(keyboard: Boolean, launcher: Boolean, ready: Boolean, history: Boolean): String = when {
+        keyboard -> "keyboard"
+        launcher && ready -> "resume"
+        !launcher && history -> "history"
+        !launcher -> "settings"
+        else -> "background"
+    }
+}

native/src-tauri/gen/android/app/src/main/res/drawable/kanbangit.xml

@@ -0,0 +1,8 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="48dp" android:height="48dp"
+    android:viewportWidth="64" android:viewportHeight="64">
+    <path android:fillColor="#22c55e" android:pathData="M12,0 H52 Q64,0 64,12 V52 Q64,64 52,64 H12 Q0,64 0,52 V12 Q0,0 12,0 Z" />
+    <path android:fillColor="@android:color/transparent" android:strokeColor="#004b1e"
+        android:strokeWidth="3" android:strokeLineCap="round" android:strokeLineJoin="round"
+        android:pathData="M19,16 H45 Q48,16 48,19 V45 Q48,48 45,48 H19 Q16,48 16,45 V19 Q16,16 19,16 Z M27,16 V48 M37,16 V48" />
+</vector>

native/src-tauri/gen/android/app/src/main/res/values-night/themes.xml

@@ -0,0 +1,6 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Theme.kanbangit_native" parent="Theme.MaterialComponents.DayNight.NoActionBar">
+        <!-- Customize your theme here. -->
+    </style>
+</resources>

native/src-tauri/gen/android/app/src/main/res/values/strings.xml

@@ -0,0 +1,6 @@
+<resources>
+    <string name="app_name">"KanbanGit"</string>
+    <string name="main_activity_title">"KanbanGit"</string>
+    <string name="server_settings">Server settings</string>
+    <string name="update_webview">Update Android System WebView to connect to your workspace.</string>
+</resources>

native/src-tauri/gen/android/app/src/main/res/values/themes.xml

@@ -0,0 +1,6 @@
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <!-- Base application theme. -->
+    <style name="Theme.kanbangit_native" parent="Theme.MaterialComponents.DayNight.NoActionBar">
+        <!-- Customize your theme here. -->
+    </style>
+</resources>

native/src-tauri/gen/android/app/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="root" path="." />
+        <exclude domain="sharedpref" path="." />
+        <exclude domain="database" path="." />
+        <exclude domain="file" path="." />
+        <exclude domain="external" path="." />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="root" path="." />
+        <exclude domain="sharedpref" path="." />
+        <exclude domain="database" path="." />
+        <exclude domain="file" path="." />
+        <exclude domain="external" path="." />
+    </device-transfer>
+</data-extraction-rules>

native/src-tauri/gen/android/app/src/main/res/xml/file_paths.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths xmlns:android="http://schemas.android.com/apk/res/android">
+  <external-path name="my_images" path="." />
+  <cache-path name="my_cache_images" path="." />
+</paths>

native/src-tauri/gen/android/app/src/test/java/de/kanbangit/desktop/NavigationPolicyTest.kt

@@ -0,0 +1,33 @@
+package de.kanbangit.desktop
+
+import org.junit.Assert.*
+import org.junit.Test
+
+class NavigationPolicyTest {
+    @Test fun normalizesAddressesAndRejectsCredentialsAndUnsafeSchemes() {
+        assertEquals("https://example.com/kanban/", NavigationPolicy.installation(" HTTPS://Example.com:443/kanban "))
+        assertEquals("https://[::1]:8443/", NavigationPolicy.installation("https://[::1]:8443"))
+        for (value in listOf("http://example.com", "https:example.com", "https://user:pass@example.com", "https://example.com/?token=x", "https://example.com/#x", "https://exa\nmple.com", "https://example.com\\other", "https://example.com:99999", "https://tauri.localhost/", "file:///etc/passwd", "")) {
+            assertNull(value, NavigationPolicy.installation(value))
+        }
+    }
+
+    @Test fun allowsLoginTwoFactorAndHistoryOnlyOnTheSelectedOrigin() {
+        val server = "https://example.com:8443/app/"
+        for (path in listOf("/login", "/two-factor-challenge", "/projects/1?ticket=53#details")) {
+            assertTrue(NavigationPolicy.allows(server, "https://example.com:8443$path"))
+        }
+        for (value in listOf("https://example.com/", "http://example.com:8443/", "https://other.example.com:8443/", "https://user@example.com:8443/", "https://tauri.localhost/action/open", "javascript:alert(1)", "intent://example.com", "file:///etc/passwd")) {
+            assertFalse(value, NavigationPolicy.allows(server, value))
+        }
+        assertTrue(NavigationPolicy.allows("https://example.com/", "https://example.com:443/login"))
+    }
+
+    @Test fun backClosesKeyboardBeforeNavigatingAndPreservesTheWorkspace() {
+        assertEquals("keyboard", NavigationPolicy.backAction(true, false, true, true))
+        assertEquals("resume", NavigationPolicy.backAction(false, true, true, true))
+        assertEquals("history", NavigationPolicy.backAction(false, false, true, true))
+        assertEquals("settings", NavigationPolicy.backAction(false, false, true, false))
+        assertEquals("background", NavigationPolicy.backAction(false, true, false, false))
+    }
+}

native/src-tauri/gen/android/build.gradle.kts

@@ -0,0 +1,21 @@
+buildscript {
+    repositories {
+        google()
+        mavenCentral()
+    }
+    dependencies {
+        classpath("com.android.tools.build:gradle:8.11.0")
+        classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.25")
+    }
+}
+
+allprojects {
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+tasks.register("clean").configure {
+    delete("build")
+}

native/src-tauri/gen/android/buildSrc/build.gradle.kts

@@ -0,0 +1,22 @@
+plugins {
+    `kotlin-dsl`
+}
+
+gradlePlugin {
+    plugins {
+        create("pluginsForCoolKids") {
+            id = "rust"
+            implementationClass = "RustPlugin"
+        }
+    }
+}
+
+repositories {
+    google()
+    mavenCentral()
+}
+
+dependencies {
+    compileOnly(gradleApi())
+    implementation("com.android.tools.build:gradle:8.11.0")
+}

native/src-tauri/gen/android/buildSrc/src/main/java/de/kanbangit/desktop/kotlin/BuildTask.kt

@@ -0,0 +1,68 @@
+import java.io.File
+import org.apache.tools.ant.taskdefs.condition.Os
+import org.gradle.api.DefaultTask
+import org.gradle.api.GradleException
+import org.gradle.api.logging.LogLevel
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.TaskAction
+
+open class BuildTask : DefaultTask() {
+    @Input
+    var rootDirRel: String? = null
+    @Input
+    var target: String? = null
+    @Input
+    var release: Boolean? = null
+
+    @TaskAction
+    fun assemble() {
+        val executable = """pnpm""";
+        try {
+            runTauriCli(executable)
+        } catch (e: Exception) {
+            if (Os.isFamily(Os.FAMILY_WINDOWS)) {
+                // Try different Windows-specific extensions
+                val fallbacks = listOf(
+                    "$executable.exe",
+                    "$executable.cmd",
+                    "$executable.bat",
+                )
+
+                var lastException: Exception = e
+                for (fallback in fallbacks) {
+                    try {
+                        runTauriCli(fallback)
+                        return
+                    } catch (fallbackException: Exception) {
+                        lastException = fallbackException
+                    }
+                }
+                throw lastException
+            } else {
+                throw e;
+            }
+        }
+    }
+
+    fun runTauriCli(executable: String) {
+        val rootDirRel = rootDirRel ?: throw GradleException("rootDirRel cannot be null")
+        val target = target ?: throw GradleException("target cannot be null")
+        val release = release ?: throw GradleException("release cannot be null")
+        val args = listOf("tauri", "android", "android-studio-script");
+
+        project.exec {
+            workingDir(File(project.projectDir, rootDirRel))
+            executable(executable)
+            args(args)
+            if (project.logger.isEnabled(LogLevel.DEBUG)) {
+                args("-vv")
+            } else if (project.logger.isEnabled(LogLevel.INFO)) {
+                args("-v")
+            }
+            if (release) {
+                args("--release")
+            }
+            args(listOf("--target", target))
+        }.assertNormalExitValue()
+    }
+}

native/src-tauri/gen/android/buildSrc/src/main/java/de/kanbangit/desktop/kotlin/RustPlugin.kt

@@ -0,0 +1,85 @@
+import com.android.build.api.dsl.ApplicationExtension
+import org.gradle.api.DefaultTask
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.kotlin.dsl.configure
+import org.gradle.kotlin.dsl.get
+
+const val TASK_GROUP = "rust"
+
+open class Config {
+    lateinit var rootDirRel: String
+}
+
+open class RustPlugin : Plugin<Project> {
+    private lateinit var config: Config
+
+    override fun apply(project: Project) = with(project) {
+        config = extensions.create("rust", Config::class.java)
+
+        val defaultAbiList = listOf("arm64-v8a", "armeabi-v7a", "x86", "x86_64");
+        val abiList = (findProperty("abiList") as? String)?.split(',') ?: defaultAbiList
+
+        val defaultArchList = listOf("arm64", "arm", "x86", "x86_64");
+        val archList = (findProperty("archList") as? String)?.split(',') ?: defaultArchList
+
+        val targetsList = (findProperty("targetList") as? String)?.split(',') ?: listOf("aarch64", "armv7", "i686", "x86_64")
+
+        extensions.configure<ApplicationExtension> {
+            @Suppress("UnstableApiUsage")
+            flavorDimensions.add("abi")
+            productFlavors {
+                create("universal") {
+                    dimension = "abi"
+                    ndk {
+                        abiFilters += abiList
+                    }
+                }
+                defaultArchList.forEachIndexed { index, arch ->
+                    create(arch) {
+                        dimension = "abi"
+                        ndk {
+                            abiFilters.add(defaultAbiList[index])
+                        }
+                    }
+                }
+            }
+        }
+
+        afterEvaluate {
+            for (profile in listOf("debug", "release")) {
+                val profileCapitalized = profile.replaceFirstChar { it.uppercase() }
+                val buildTask = tasks.maybeCreate(
+                    "rustBuildUniversal$profileCapitalized",
+                    DefaultTask::class.java
+                ).apply {
+                    group = TASK_GROUP
+                    description = "Build dynamic library in $profile mode for all targets"
+                }
+
+                tasks["mergeUniversal${profileCapitalized}JniLibFolders"].dependsOn(buildTask)
+
+                for (targetPair in targetsList.withIndex()) {
+                    val targetName = targetPair.value
+                    val targetArch = archList[targetPair.index]
+                    val targetArchCapitalized = targetArch.replaceFirstChar { it.uppercase() }
+                    val targetBuildTask = project.tasks.maybeCreate(
+                        "rustBuild$targetArchCapitalized$profileCapitalized",
+                        BuildTask::class.java
+                    ).apply {
+                        group = TASK_GROUP
+                        description = "Build dynamic library in $profile mode for $targetArch"
+                        rootDirRel = config.rootDirRel
+                        target = targetName
+                        release = profile == "release"
+                    }
+
+                    buildTask.dependsOn(targetBuildTask)
+                    tasks["merge$targetArchCapitalized${profileCapitalized}JniLibFolders"].dependsOn(
+                        targetBuildTask
+                    )
+                }
+            }
+        }
+    }
+}

native/src-tauri/gen/android/gradle.properties

@@ -0,0 +1,25 @@
+# Project-wide Gradle settings.
+# IDE (e.g. Android Studio) users:
+# Gradle settings configured through the IDE *will override*
+# any settings specified in this file.
+# For more details on how to configure your build environment visit
+# http://www.gradle.org/docs/current/userguide/build_environment.html
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
+# When configured, Gradle will run in incubating parallel mode.
+# This option should only be used with decoupled projects. More details, visit
+# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
+# org.gradle.parallel=true
+# AndroidX package structure to make it clearer which packages are bundled with the
+# Android operating system, and which are packaged with your app"s APK
+# https://developer.android.com/topic/libraries/support-library/androidx-rn
+android.useAndroidX=true
+# Kotlin code style for this project: "official" or "obsolete":
+kotlin.code.style=official
+# Enables namespacing of each library's R class so that its R class includes only the
+# resources declared in the library itself and none from the library's dependencies,
+# thereby reducing the size of the R class for that library
+android.nonTransitiveRClass=true
+android.nonFinalResIds=false
+android.builder.sdkDownload=false

native/src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,6 @@
+#Tue May 10 19:22:52 CST 2022
+distributionBase=GRADLE_USER_HOME
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
+distributionPath=wrapper/dists
+zipStorePath=wrapper/dists
+zipStoreBase=GRADLE_USER_HOME

native/src-tauri/gen/android/gradlew

@@ -0,0 +1,185 @@
+#!/usr/bin/env sh
+
+#
+# Copyright 2015 the original author or authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+##
+##  Gradle start up script for UN*X
+##
+##############################################################################
+
+# Attempt to set APP_HOME
+# Resolve links: $0 may be a link
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
+done
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null
+
+APP_NAME="Gradle"
+APP_BASE_NAME=`basename "$0"`
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD="maximum"
+
+warn () {
+    echo "$*"
+}
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+}
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+  NONSTOP* )
+    nonstop=true
+    ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+        JAVACMD="$JAVA_HOME/bin/java"
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD="java"
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
+fi
+
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+
+    JAVACMD=`cygpath --unix "$JAVACMD"`
+
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
+    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=`expr $i + 1`
+    done
+    case $i in
+        0) set -- ;;
+        1) set -- "$args0" ;;
+        2) set -- "$args0" "$args1" ;;
+        3) set -- "$args0" "$args1" "$args2" ;;
+        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
+fi
+
+# Escape application args
+save () {
+    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+    echo " "
+}
+APP_ARGS=`save "$@"`
+
+# Collect all arguments for the java command, following the shell quoting and substitution rules
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+
+exec "$JAVACMD" "$@"

native/src-tauri/gen/android/gradlew.bat

@@ -0,0 +1,89 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%" == "" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%" == "" set DIRNAME=.
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if "%ERRORLEVEL%" == "0" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if "%ERRORLEVEL%"=="0" goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
+exit /b 1
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

native/src-tauri/gen/android/settings.gradle

@@ -0,0 +1,3 @@
+include ':app'
+
+apply from: 'tauri.settings.gradle'

native/src-tauri/src/android.rs

@@ -0,0 +1,22 @@
+use tauri::{WebviewUrl, WebviewWindowBuilder};
+
+pub fn context<R: tauri::Runtime>() -> tauri::Context<R> {
+    tauri::generate_context!()
+}
+
+pub fn builder() -> tauri::Builder<tauri::Wry> {
+    tauri::Builder::default().setup(|app| {
+        WebviewWindowBuilder::new(app, "launcher", WebviewUrl::App("index.html".into()))
+            .use_https_scheme(true)
+            .on_navigation(|url| {
+                url.scheme() == "https"
+                    && url.host_str() == Some("tauri.localhost")
+                    && url.port().is_none()
+                    && url.username().is_empty()
+                    && url.password().is_none()
+                    && matches!(url.path(), "/" | "/index.html")
+            })
+            .build()?;
+        Ok(())
+    })
+}

native/src-tauri/src/desktop.rs

@@ -0,0 +1,456 @@
+use crate::locale::en;
+use crate::server::{validate_url, Server, DEFAULT_SERVER};
+use std::{path::PathBuf, sync::Mutex, time::Duration};
+use tauri::{
+    menu::{MenuBuilder, SubmenuBuilder},
+    webview::{NewWindowResponse, PageLoadEvent},
+    AppHandle, Manager, Url, WebviewUrl, WebviewWindowBuilder, WindowEvent,
+};
+
+#[derive(Default)]
+struct Connection {
+    server: Option<Server>,
+    label: Option<String>,
+    revision: u64,
+    ready: bool,
+    phase: &'static str,
+}
+
+impl Connection {
+    fn begin_navigation(&mut self) -> u64 {
+        self.revision += 1;
+        self.phase = "connecting";
+        self.revision
+    }
+
+    fn timeout(&mut self, revision: u64) -> bool {
+        if self.revision != revision || self.phase != "connecting" {
+            return false;
+        }
+        self.phase = "connectionError";
+        true
+    }
+}
+
+fn allows_server_navigation(server: &Url, destination: &Url) -> bool {
+    destination.scheme() == "https"
+        && destination.origin() == server.origin()
+        && destination.username().is_empty()
+        && destination.password().is_none()
+}
+
+fn allows_launcher_navigation(destination: &Url) -> bool {
+    destination.scheme() == "tauri"
+        && destination.host_str() == Some("localhost")
+        && destination.port().is_none()
+        && destination.username().is_empty()
+        && destination.password().is_none()
+}
+
+fn configuration_path(app: &AppHandle) -> tauri::Result<PathBuf> {
+    Ok(app.path().app_config_dir()?.join("active-server"))
+}
+
+fn update_launcher(app: &AppHandle) {
+    let state = app.state::<Mutex<Connection>>();
+    let state = state.lock().unwrap();
+    let mut message = Url::parse("tauri://localhost/").unwrap();
+    message
+        .query_pairs_mut()
+        .append_pair(
+            "server",
+            state
+                .server
+                .as_ref()
+                .map_or(DEFAULT_SERVER, |server| server.url.as_str()),
+        )
+        .append_pair("phase", state.phase)
+        .append_pair("ready", if state.ready { "true" } else { "false" });
+    if let Some(window) = app.get_webview_window("launcher") {
+        let _ = window.eval(format!(
+            "window.updateLauncher?.('{}')",
+            message.query().unwrap()
+        ));
+    }
+}
+
+fn show_launcher(app: &AppHandle) {
+    update_launcher(app);
+    if let Some(window) = app.get_webview_window("launcher") {
+        let _ = window.show();
+        let _ = window.set_focus();
+    }
+}
+
+fn begin_navigation(app: &AppHandle, label: &str) {
+    let state = app.state::<Mutex<Connection>>();
+    let revision = {
+        let mut state = state.lock().unwrap();
+        if state.label.as_deref() != Some(label) {
+            return;
+        }
+        state.begin_navigation()
+    };
+    update_launcher(app);
+    let handle = app.clone();
+    std::thread::spawn(move || {
+        std::thread::sleep(Duration::from_secs(15));
+        let state = handle.state::<Mutex<Connection>>();
+        let timed_out = state.lock().unwrap().timeout(revision);
+        if timed_out {
+            show_launcher(&handle);
+        }
+    });
+}
+
+fn open_workspace(app: &AppHandle, input: &str) -> Result<(), &'static str> {
+    let url = validate_url(input)?;
+    let state = app.state::<Mutex<Connection>>();
+    let (server, old_label, label) = {
+        let mut state = state.lock().unwrap();
+        let same_server = state
+            .server
+            .as_ref()
+            .is_some_and(|server| server.url == url);
+        if same_server && state.ready {
+            if let Some(window) = state
+                .label
+                .as_ref()
+                .and_then(|label| app.get_webview_window(label))
+            {
+                window.show().map_err(|_| "connectionError")?;
+                window.set_focus().map_err(|_| "connectionError")?;
+                return Ok(());
+            }
+        }
+        let server = if same_server {
+            state.server.clone().unwrap()
+        } else {
+            Server::new(url).map_err(|_| "storageError")?
+        };
+        server
+            .save(&configuration_path(app).map_err(|_| "storageError")?)
+            .map_err(|_| "storageError")?;
+        let old_label = state.label.take();
+        state.server = Some(server.clone());
+        state.ready = false;
+        state.revision += 1;
+        let label = format!("workspace-{}", state.revision);
+        state.label = Some(label.clone());
+        (server, old_label, label)
+    };
+    if let Some(window) = old_label.and_then(|label| app.get_webview_window(&label)) {
+        window.close().map_err(|_| "connectionError")?;
+    }
+    begin_navigation(app, &label);
+    let handle = app.clone();
+    let navigation_label = label.clone();
+    let server_url = server.url.clone();
+    let window = WebviewWindowBuilder::new(app, &label, WebviewUrl::External(server.url))
+        .title(en::APP_NAME)
+        .inner_size(1280.0, 850.0)
+        .min_inner_size(375.0, 600.0)
+        .center()
+        .visible(false)
+        .data_store_identifier(server.profile)
+        .on_navigation(move |destination| {
+            if !allows_server_navigation(&server_url, destination) {
+                return false;
+            }
+            begin_navigation(&handle, &navigation_label);
+            true
+        })
+        .on_new_window(|_, _| NewWindowResponse::Deny)
+        .on_page_load(|window, payload| {
+            if payload.event() != PageLoadEvent::Finished {
+                return;
+            }
+            let app = window.app_handle();
+            let state = app.state::<Mutex<Connection>>();
+            let should_show = {
+                let mut state = state.lock().unwrap();
+                if state.label.as_deref() != Some(window.label()) {
+                    return;
+                }
+                let first_load = !state.ready;
+                state.ready = true;
+                state.phase = "connected";
+                first_load
+            };
+            update_launcher(app);
+            if should_show {
+                let _ = window.show();
+                let _ = window.set_focus();
+                if let Some(launcher) = app.get_webview_window("launcher") {
+                    let _ = launcher.hide();
+                }
+            }
+        })
+        .build()
+        .map_err(|_| "connectionError")?;
+    let handle = app.clone();
+    window.on_window_event(move |event| {
+        if matches!(event, WindowEvent::Destroyed) {
+            let state = handle.state::<Mutex<Connection>>();
+            let current = {
+                let mut state = state.lock().unwrap();
+                if state.label.as_deref() == Some(&label) {
+                    state.label = None;
+                    state.ready = false;
+                    state.revision += 1;
+                    state.phase = "idle";
+                    true
+                } else {
+                    false
+                }
+            };
+            if current {
+                show_launcher(&handle);
+            }
+        }
+    });
+    Ok(())
+}
+
+fn handle_launcher_action(app: &AppHandle, destination: &Url) {
+    let result = match destination.path() {
+        "/action/open" => {
+            let input = destination
+                .query_pairs()
+                .find(|(key, _)| key == "server")
+                .map(|(_, value)| value.into_owned())
+                .unwrap_or_default();
+            open_workspace(app, &input)
+        }
+        "/action/resume" => {
+            let label = app
+                .state::<Mutex<Connection>>()
+                .lock()
+                .unwrap()
+                .label
+                .clone();
+            if let Some(window) = label.and_then(|label| app.get_webview_window(&label)) {
+                let _ = window.show();
+                let _ = window.set_focus();
+            }
+            Ok(())
+        }
+        _ => Ok(()),
+    };
+    if let Err(error) = result {
+        app.state::<Mutex<Connection>>().lock().unwrap().phase = error;
+        show_launcher(app);
+    }
+}
+
+pub fn context<R: tauri::Runtime>() -> tauri::Context<R> {
+    tauri::generate_context!()
+}
+
+pub fn builder() -> tauri::Builder<tauri::Wry> {
+    tauri::Builder::default().setup(|app| {
+        let (server, phase) = match Server::load(&configuration_path(app.handle())?) {
+            Ok(server) => (server, "idle"),
+            Err(_) => (None, "storageError"),
+        };
+        app.manage(Mutex::new(Connection {
+            server,
+            phase,
+            ..Default::default()
+        }));
+        let menu = MenuBuilder::new(app)
+            .item(
+                &SubmenuBuilder::new(app, en::APP_NAME)
+                    .text("server-settings", en::SERVER_SETTINGS)
+                    .separator()
+                    .quit()
+                    .build()?,
+            )
+            .item(
+                &SubmenuBuilder::new(app, en::EDIT)
+                    .undo()
+                    .redo()
+                    .separator()
+                    .cut()
+                    .copy()
+                    .paste()
+                    .select_all()
+                    .build()?,
+            )
+            .build()?;
+        app.set_menu(menu)?;
+        app.on_menu_event(|app, event| {
+            if event.id().as_ref() == "server-settings" {
+                show_launcher(app);
+            }
+        });
+        let handle = app.handle().clone();
+        let launcher =
+            WebviewWindowBuilder::new(app, "launcher", WebviewUrl::App("index.html".into()))
+                .title(en::APP_NAME)
+                .inner_size(560.0, 720.0)
+                .min_inner_size(375.0, 640.0)
+                .center()
+                .on_navigation(move |destination| {
+                    if !allows_launcher_navigation(destination) {
+                        return false;
+                    }
+                    if destination.path().starts_with("/action/") {
+                        let handle = handle.clone();
+                        let destination = destination.clone();
+                        let _ = handle.clone().run_on_main_thread(move || {
+                            handle_launcher_action(&handle, &destination)
+                        });
+                        return false;
+                    }
+                    matches!(destination.path(), "" | "/" | "/index.html")
+                })
+                .on_new_window(|_, _| NewWindowResponse::Deny)
+                .on_page_load(|window, payload| {
+                    if payload.event() == PageLoadEvent::Finished {
+                        let app = window.app_handle().clone();
+                        update_launcher(&app);
+                        std::thread::spawn(move || {
+                            let handle = app.clone();
+                            let _ = app.run_on_main_thread(move || {
+                                let server = handle
+                                    .state::<Mutex<Connection>>()
+                                    .lock()
+                                    .unwrap()
+                                    .server
+                                    .clone();
+                                if let Some(server) = server {
+                                    if let Err(error) = open_workspace(&handle, server.url.as_str())
+                                    {
+                                        handle.state::<Mutex<Connection>>().lock().unwrap().phase =
+                                            error;
+                                        show_launcher(&handle);
+                                    }
+                                }
+                            });
+                        });
+                    }
+                })
+                .build()?;
+        let window = launcher.clone();
+        launcher.on_window_event(move |event| {
+            if let WindowEvent::CloseRequested { api, .. } = event {
+                api.prevent_close();
+                let _ = window.hide();
+            }
+        });
+        Ok(())
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn navigation_is_limited_to_the_selected_https_origin() {
+        let server = validate_url("https://example.com:8443/app/").unwrap();
+        for path in [
+            "/login",
+            "/two-factor-challenge",
+            "/projects/1?ticket=52#details",
+        ] {
+            assert!(allows_server_navigation(
+                &server,
+                &server.join(path).unwrap()
+            ));
+        }
+        for destination in [
+            "http://example.com:8443/",
+            "https://example.com/",
+            "https://other.example.com:8443/",
+            "https://user:secret@example.com:8443/",
+            "tauri://localhost/action/open?server=https://evil.test",
+            "file:///etc/passwd",
+            "data:text/html,hello",
+            "javascript:alert(1)",
+        ] {
+            assert!(!allows_server_navigation(
+                &server,
+                &Url::parse(destination).unwrap()
+            ));
+        }
+    }
+
+    #[test]
+    fn launcher_actions_are_restricted_to_the_bundled_origin() {
+        assert!(allows_launcher_navigation(
+            &Url::parse("tauri://localhost/action/open").unwrap()
+        ));
+        for input in [
+            DEFAULT_SERVER,
+            "https://localhost/",
+            "tauri://other/index.html",
+            "tauri://user@localhost/index.html",
+        ] {
+            assert!(!allows_launcher_navigation(&Url::parse(input).unwrap()));
+        }
+    }
+
+    #[test]
+    fn stale_timeouts_do_not_replace_newer_connections_or_loaded_forms() {
+        let mut state = Connection::default();
+        let first = state.begin_navigation();
+        let second = state.begin_navigation();
+        assert!(!state.timeout(first));
+        state.ready = true;
+        assert!(state.timeout(second));
+        assert!(state.ready);
+        assert!(!state.timeout(second));
+        let third = state.begin_navigation();
+        state.phase = "connected";
+        assert!(!state.timeout(third));
+    }
+
+    #[test]
+    fn remote_pages_cannot_invoke_native_commands() {
+        let app = tauri::test::mock_builder().build(context()).unwrap();
+        let window = WebviewWindowBuilder::new(
+            &app,
+            "workspace-1",
+            WebviewUrl::External(Url::parse(DEFAULT_SERVER).unwrap()),
+        )
+        .build()
+        .unwrap();
+        for command in [
+            "plugin:window|close",
+            "plugin:webview|create_webview_window",
+            "plugin:path|resolve_directory",
+        ] {
+            let response = tauri::test::get_ipc_response(
+                &window,
+                tauri::webview::InvokeRequest {
+                    cmd: command.into(),
+                    callback: tauri::ipc::CallbackFn(0),
+                    error: tauri::ipc::CallbackFn(1),
+                    url: Url::parse(DEFAULT_SERVER).unwrap(),
+                    body: tauri::ipc::InvokeBody::default(),
+                    headers: Default::default(),
+                    invoke_key: tauri::test::INVOKE_KEY.into(),
+                },
+            );
+            assert!(response
+                .unwrap_err()
+                .as_str()
+                .unwrap()
+                .contains("not allowed"));
+        }
+    }
+
+    #[test]
+    fn packaged_app_exposes_no_native_capabilities_or_global_api() {
+        let config: serde_json::Value =
+            serde_json::from_str(include_str!("../tauri.conf.json")).unwrap();
+        assert_eq!(config["bundle"]["macOS"]["minimumSystemVersion"], "14.0");
+        assert_eq!(config["app"]["withGlobalTauri"], false);
+        assert_eq!(
+            config["app"]["security"]["capabilities"],
+            serde_json::json!([])
+        );
+    }
+}

native/src-tauri/src/lib.rs

@@ -0,0 +1,18 @@
+#[cfg(target_os = "android")]
+mod android;
+#[cfg(not(target_os = "android"))]
+mod desktop;
+#[cfg(not(target_os = "android"))]
+mod locale;
+#[cfg(not(target_os = "android"))]
+mod server;
+
+#[cfg(target_os = "android")]
+pub use android::{builder, context};
+#[cfg(not(target_os = "android"))]
+pub use desktop::{builder, context};
+
+#[cfg_attr(mobile, tauri::mobile_entry_point)]
+pub fn run() {
+    builder().run(context()).expect("Could not start KanbanGit");
+}

native/src-tauri/src/locale.rs

@@ -0,0 +1,5 @@
+pub mod en {
+    pub const APP_NAME: &str = "KanbanGit";
+    pub const SERVER_SETTINGS: &str = "Server settings…";
+    pub const EDIT: &str = "Edit";
+}

native/src-tauri/src/main.rs

@@ -0,0 +1,5 @@
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+fn main() {
+    kanbangit_native::run();
+}

native/src-tauri/src/server.rs

@@ -0,0 +1,137 @@
+use std::{fs, io, io::Read, path::Path};
+use tauri::Url;
+
+pub const DEFAULT_SERVER: &str = "https://kanbangit.de/";
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct Server {
+    pub url: Url,
+    pub profile: [u8; 16],
+}
+
+pub fn validate_url(input: &str) -> Result<Url, &'static str> {
+    let input = input.trim();
+    if !input
+        .get(..8)
+        .is_some_and(|prefix| prefix.eq_ignore_ascii_case("https://"))
+        || input
+            .chars()
+            .any(|character| character.is_control() || character == '\\')
+    {
+        return Err("invalidServer");
+    }
+    let mut url = Url::parse(input).map_err(|_| "invalidServer")?;
+    if url.scheme() != "https"
+        || url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.query().is_some()
+        || url.fragment().is_some()
+    {
+        return Err("invalidServer");
+    }
+    if !url.path().ends_with('/') {
+        url.set_path(&format!("{}/", url.path()));
+    }
+    Ok(url)
+}
+
+impl Server {
+    pub fn new(url: Url) -> io::Result<Self> {
+        let mut profile = [0; 16];
+        fs::File::open("/dev/urandom")?.read_exact(&mut profile)?;
+        Ok(Self { url, profile })
+    }
+
+    pub fn load(path: &Path) -> io::Result<Option<Self>> {
+        let contents = match fs::read_to_string(path) {
+            Ok(contents) => contents,
+            Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(None),
+            Err(error) => return Err(error),
+        };
+        let invalid = || io::Error::new(io::ErrorKind::InvalidData, "Invalid server configuration");
+        let (url, profile) = contents.split_once('\n').ok_or_else(invalid)?;
+        let url = validate_url(url).map_err(|_| invalid())?;
+        if profile.len() != 32 || !profile.is_ascii() {
+            return Err(invalid());
+        }
+        let mut bytes = [0; 16];
+        for (index, byte) in bytes.iter_mut().enumerate() {
+            *byte = u8::from_str_radix(&profile[index * 2..index * 2 + 2], 16)
+                .map_err(|_| invalid())?;
+        }
+        Ok(Some(Self {
+            url,
+            profile: bytes,
+        }))
+    }
+
+    pub fn save(&self, path: &Path) -> io::Result<()> {
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent)?;
+        }
+        let profile: String = self
+            .profile
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect();
+        let temporary = path.with_extension("tmp");
+        fs::write(&temporary, format!("{}\n{profile}", self.url))?;
+        fs::rename(temporary, path)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn validates_and_normalizes_installation_addresses() {
+        assert_eq!(
+            validate_url(" HTTPS://Example.com:443/kanban ")
+                .unwrap()
+                .as_str(),
+            "https://example.com/kanban/"
+        );
+        assert!(validate_url("https://[::1]:8443/").is_ok());
+        for input in [
+            "http://example.com",
+            "https:example.com",
+            "https://user:secret@example.com",
+            "https://user@example.com",
+            "https://example.com/?token=secret",
+            "https://example.com/#secret",
+            "https://exa\nmple.com",
+            "https://example.com\\other",
+            "file:///tmp/test",
+            "javascript:alert(1)",
+            "",
+        ] {
+            assert!(validate_url(input).is_err(), "{input}");
+        }
+    }
+
+    #[test]
+    fn configuration_round_trip_preserves_only_the_address_and_profile() {
+        let server = Server::new(validate_url(DEFAULT_SERVER).unwrap()).unwrap();
+        let path =
+            std::env::temp_dir().join(format!("kanbangit-server-{:x?}/active", server.profile));
+        assert_eq!(Server::load(&path).unwrap(), None);
+        server.save(&path).unwrap();
+        assert_eq!(Server::load(&path).unwrap(), Some(server.clone()));
+        let other = Server::new(validate_url("https://other.example.com:444/").unwrap()).unwrap();
+        assert_ne!(server.profile, other.profile);
+        other.save(&path).unwrap();
+        assert_eq!(Server::load(&path).unwrap(), Some(other));
+        for contents in [
+            "http://example.com/\n00000000000000000000000000000000",
+            "invalid",
+            "https://example.com/\nshort",
+            "https://example.com/\nzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz",
+        ] {
+            fs::write(&path, contents).unwrap();
+            assert!(Server::load(&path).is_err());
+        }
+        fs::remove_dir_all(path.parent().unwrap()).unwrap();
+    }
+}

native/src-tauri/tauri.conf.json

@@ -0,0 +1,25 @@
+{
+    "$schema": "https://schema.tauri.app/config/2",
+    "productName": "KanbanGit",
+    "version": "0.1.0",
+    "identifier": "de.kanbangit.desktop",
+    "build": {
+        "frontendDist": "../ui"
+    },
+    "app": {
+        "windows": [],
+        "withGlobalTauri": false,
+        "security": {
+            "csp": "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-src 'none'",
+            "capabilities": []
+        }
+    },
+    "bundle": {
+        "active": true,
+        "targets": ["app"],
+        "icon": ["icons/icon.png", "icons/icon.icns"],
+        "macOS": {
+            "minimumSystemVersion": "14.0"
+        }
+    }
+}

native/src-tauri/tests/macos_smoke.rs

@@ -0,0 +1,151 @@
+#[cfg(target_os = "macos")]
+fn main() {
+    use std::sync::{
+        atomic::{AtomicBool, AtomicUsize, Ordering},
+        Arc,
+    };
+    use tauri::{webview::PageLoadEvent, Manager};
+
+    let passed = Arc::new(AtomicBool::new(false));
+    let stage = Arc::new(AtomicUsize::new(0));
+    let page_stage = stage.clone();
+    let result_passed = passed.clone();
+    let plugin = tauri::plugin::Builder::<tauri::Wry>::new("macos-smoke")
+        .js_init_script("window.addEventListener('error', event => { location.href = 'tauri://localhost/__native_smoke_result?passed=false&error=' + encodeURIComponent(event.message || event.target.src); }, true);")
+        .on_page_load(move |webview, payload| {
+
+            if payload.event() != PageLoadEvent::Finished {
+                return;
+            }
+            if webview.label() == "launcher" {
+                webview.eval(r#"
+                    (async () => {
+                        const wait = async predicate => {
+                            for (let attempt = 0; attempt < 220; attempt++) {
+                                if (predicate()) return;
+                                await new Promise(resolve => setTimeout(resolve, 100));
+                            }
+                            throw new Error('Timed out waiting for local state');
+                        };
+                        try {
+                            await wait(() => document.querySelector('.open-workspace')?.textContent === 'Open workspace');
+                            const input = document.querySelector('#server-url');
+                            const form = document.querySelector('#server-form');
+                            const status = document.querySelector('#connection-status');
+                            input.value = 'http://example.com';
+                            form.requestSubmit();
+                            if (input.getAttribute('aria-invalid') !== 'true' || !status.textContent.includes('HTTPS')) throw new Error('Invalid address accepted');
+                            for (const [theme, expected] of [['dark', 'rgb(15, 23, 42)'], ['light', 'rgb(247, 249, 251)']]) {
+                                const appearance = document.querySelector('#appearance');
+                                appearance.value = theme;
+                                appearance.dispatchEvent(new Event('change'));
+                                if (getComputedStyle(document.documentElement).backgroundColor !== expected) throw new Error('Theme failed');
+                            }
+                            input.value = 'https://127.0.0.1:9/';
+                            form.requestSubmit();
+                            await wait(() => status.dataset.state === 'connectionError');
+                            if (input.value !== 'https://127.0.0.1:9/' || document.querySelector('.open-workspace').disabled) throw new Error('Offline recovery failed');
+                            input.value = 'https://kanbangit.de/';
+                            form.requestSubmit();
+                            if (document.querySelector('#switch-confirmation').hidden) throw new Error('Missing switch confirmation');
+                            document.querySelector('#cancel-switch').click();
+                            if (!document.querySelector('#switch-confirmation').hidden) throw new Error('Cancel failed');
+                            form.requestSubmit();
+                            document.querySelector('#confirm-switch').click();
+                        } catch (error) {
+                            location.href = 'tauri://localhost/__native_smoke_result?passed=false&reason=' + encodeURIComponent(error.message);
+                        }
+                    })();
+                "#).unwrap();
+            } else if webview.label().starts_with("workspace-") && payload.url().host_str() == Some("kanbangit.de") {
+                let current_stage = page_stage.fetch_add(1, Ordering::SeqCst);
+                if current_stage == 0 {
+                    webview.eval(r#"
+                        (async () => {
+                            for (let attempt = 0; attempt < 100; attempt++) {
+                                if (document.querySelector('#app')?.innerText.trim().length > 100) break;
+                                await new Promise(resolve => setTimeout(resolve, 100));
+                            }
+                            const rendered = document.querySelector('#app')?.innerText.trim().length > 100;
+                            let denied = true;
+                            for (const cmd of ['plugin:path|resolve_directory', 'plugin:window|get_all_windows']) {
+                                try { await window.__TAURI_INTERNALS__.invoke(cmd); denied = false; }
+                                catch (error) { denied = denied && String(error).includes('not allowed'); }
+                            }
+                            const input = document.createElement('input');
+                            input.id = 'kan52-unsaved'; input.value = 'unsaved input'; document.body.append(input);
+                            document.cookie = 'kan52_fixture=isolated; Path=/; Secure; SameSite=Lax';
+                            localStorage.setItem('kan52_fixture', 'isolated');
+                            const ok = rendered && denied && typeof window.__TAURI__ === 'undefined';
+                            location.href = '/__native_smoke_result?stage=loaded&passed=' + ok;
+                        })();
+                    "#).unwrap();
+                } else {
+                    webview.eval(r#"
+                        const isolated = !document.cookie.includes('kan52_fixture') && localStorage.getItem('kan52_fixture') === null;
+                        location.href = '/__native_smoke_result?stage=isolated&passed=' + isolated;
+                    "#).unwrap();
+                }
+            }
+        })
+        .on_navigation(move |webview, url| {
+
+            if url.path() != "/__native_smoke_result" {
+                return true;
+            }
+            let success = url.query_pairs().any(|(key, value)| key == "passed" && value == "true");
+            let loaded = url.query_pairs().any(|(key, value)| key == "stage" && value == "loaded");
+            println!("macOS WebView smoke test: {}", url.query().unwrap_or_default());
+            if success && loaded {
+                let app = webview.app_handle().clone();
+                let label = webview.label().to_string();
+                std::thread::spawn(move || {
+                    let window = app.get_webview_window(&label).unwrap();
+                    // A blocked cross-origin navigation must leave the existing input intact.
+                    window.navigate(tauri::Url::parse("https://kanbangit.de:9/unreachable").unwrap()).unwrap();
+                    std::thread::sleep(std::time::Duration::from_secs(1));
+                    window.eval(r#"
+                        if (document.querySelector('#kan52-unsaved')?.value !== 'unsaved input') {
+                            location.href = '/__native_smoke_result?passed=false&stage=preservation';
+                        }
+                    "#).unwrap();
+                    let launcher = app.get_webview_window("launcher").unwrap();
+                    launcher.show().unwrap();
+                    launcher.eval(r#"
+                        document.querySelector('#server-url').value = 'https://kanbangit.de/login/';
+                        document.querySelector('#server-form').requestSubmit();
+                        document.querySelector('#confirm-switch').click();
+                    "#).unwrap();
+                });
+            } else {
+                result_passed.store(success, Ordering::SeqCst);
+                webview.app_handle().exit(if success { 0 } else { 1 });
+            }
+            false
+        })
+        .build();
+    let mut context = kanbangit_native::context();
+    context.config_mut().identifier = format!("de.kanbangit.smoke.kan52.{}", std::process::id());
+    let app = kanbangit_native::builder()
+        .plugin(plugin)
+        .build(context)
+        .expect("The macOS application must start");
+    let config_dir = app.path().app_config_dir().unwrap();
+    let handle = app.handle().clone();
+    std::thread::spawn(move || {
+        std::thread::sleep(std::time::Duration::from_secs(60));
+        eprintln!("macOS smoke test timed out");
+        handle.exit(1);
+    });
+    app.run_return(|_, _| {});
+    let _ = std::fs::remove_dir_all(config_dir);
+    assert!(
+        passed.load(Ordering::SeqCst),
+        "The native smoke test must complete successfully"
+    );
+}
+
+#[cfg(not(target_os = "macos"))]
+fn main() {
+    panic!("Run this smoke test on macOS with an active graphical session");
+}

native/tests/launcher-browser.mjs

@@ -0,0 +1,148 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import process from 'node:process';
+
+const { chromium } = await import(
+    process.env.PLAYWRIGHT_MODULE ?? 'playwright'
+);
+const actions = [];
+const server = createServer(async (request, response) => {
+    const url = new URL(request.url, 'http://localhost');
+    if (url.pathname.startsWith('/action/')) {
+        actions.push(url);
+        response.writeHead(204).end();
+        return;
+    }
+    const file = url.pathname === '/' ? 'index.html' : url.pathname.slice(1);
+    if (
+        ![
+            'index.html',
+            'main.js',
+            'server.js',
+            'locales/en.js',
+            'styles.css',
+            'mark.svg',
+        ].includes(file)
+    ) {
+        response.writeHead(404).end();
+        return;
+    }
+    response.setHeader(
+        'Content-Type',
+        file.endsWith('.js')
+            ? 'text/javascript'
+            : file.endsWith('.css')
+              ? 'text/css'
+              : file.endsWith('.svg')
+                ? 'image/svg+xml'
+                : 'text/html',
+    );
+    response.end(await readFile(new URL(`../ui/${file}`, import.meta.url)));
+});
+await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+const browser = await chromium.launch({ channel: 'chrome', headless: true });
+const page = await browser.newPage();
+const state = (phase, ready = false, server = 'https://kanbangit.de/') =>
+    page.evaluate(
+        ({ phase, ready, server }) => {
+            window.updateLauncher(
+                new URLSearchParams({
+                    phase,
+                    ready: String(ready),
+                    server,
+                }).toString(),
+            );
+        },
+        { phase, ready, server },
+    );
+const latestAction = async (name) => {
+    await page.waitForTimeout(100);
+    assert.equal(actions.at(-1)?.pathname, `/action/${name}`);
+};
+try {
+    await page.goto(`http://127.0.0.1:${server.address().port}/`);
+    await state('idle');
+    for (const width of [320, 390, 1440]) {
+        await page.setViewportSize({ width, height: 900 });
+        for (const theme of ['light', 'dark', 'system']) {
+            await page.getByLabel('Appearance').selectOption(theme);
+            assert.equal(
+                await page.evaluate(
+                    () => document.documentElement.scrollWidth <= innerWidth,
+                ),
+                true,
+            );
+            assert.equal(
+                await page
+                    .getByRole('button', {
+                        name: 'Open workspace',
+                        exact: true,
+                    })
+                    .isVisible(),
+                true,
+            );
+        }
+    }
+    await page.getByLabel('Server address').fill('http://example.com/');
+    await page.getByLabel('Server address').press('Enter');
+    assert.equal(
+        await page.getByLabel('Server address').getAttribute('aria-invalid'),
+        'true',
+    );
+    await page.getByLabel('Server address').fill('https://first.example.com/');
+    await page.getByLabel('Server address').press('Enter');
+    await latestAction('open');
+    assert.equal(
+        actions.at(-1).searchParams.get('server'),
+        'https://first.example.com/',
+    );
+    await state('connecting', false, 'https://first.example.com/');
+    assert.equal(
+        await page
+            .getByRole('button', { name: 'Open workspace', exact: true })
+            .isDisabled(),
+        true,
+    );
+    await state('connectionError', false, 'https://first.example.com/');
+    assert.equal(
+        await page.getByLabel('Server address').inputValue(),
+        'https://first.example.com/',
+    );
+    await page.getByRole('button', { name: 'Try again', exact: true }).click();
+    await latestAction('open');
+    await state('connected', true, 'https://first.example.com/');
+    await page
+        .getByRole('button', { name: 'Return to workspace', exact: true })
+        .click();
+    await latestAction('resume');
+    await page
+        .getByLabel('Server address')
+        .fill('https://second.example.com/app');
+    await page
+        .getByRole('button', { name: 'Open workspace', exact: true })
+        .click();
+    assert.equal(
+        await page
+            .getByRole('button', { name: 'Switch server', exact: true })
+            .isVisible(),
+        true,
+    );
+    await page.getByRole('button', { name: 'Cancel', exact: true }).click();
+    await latestAction('resume');
+    await page.getByLabel('Server address').press('Enter');
+    await page
+        .getByRole('button', { name: 'Switch server', exact: true })
+        .click();
+    await latestAction('open');
+    assert.equal(
+        actions.at(-1).searchParams.get('server'),
+        'https://second.example.com/app/',
+    );
+    console.log(
+        'Launcher browser tests passed: responsive themes, keyboard, validation, offline retry, resume and confirmed switching.',
+    );
+} finally {
+    await browser.close();
+    server.close();
+}

native/tests/launcher.test.js

@@ -0,0 +1,53 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+import { en } from '../ui/locales/en.js';
+import { normalizeServer, needsConfirmation } from '../ui/server.js';
+
+const html = readFileSync(new URL('../ui/index.html', import.meta.url), 'utf8');
+
+test('every launcher text resolves to a nonempty English translation', () => {
+    for (const [, key] of html.matchAll(/data-i18n="([^"]+)"/g)) {
+        assert.equal(typeof en[key], 'string', key);
+        assert.ok(en[key].trim(), key);
+    }
+});
+
+test('installation addresses support custom domains, ports and base paths', () => {
+    assert.equal(
+        normalizeServer(' HTTPS://Example.com:443/kanban '),
+        'https://example.com/kanban/',
+    );
+    assert.equal(normalizeServer('https://[::1]:8443/'), 'https://[::1]:8443/');
+    for (const input of [
+        'http://example.com',
+        'https:example.com',
+        'https://user:secret@example.com',
+        'https://user@example.com',
+        'https://example.com/?token=secret',
+        'https://example.com/#secret',
+        'https://exa\nmple.com',
+        'https://example.com\\other',
+        'file:///tmp/test',
+        'javascript:alert(1)',
+        '',
+    ]) {
+        assert.throws(() => normalizeServer(input), undefined, input);
+    }
+});
+
+test('changing the installation requires confirmation, retrying does not', () => {
+    assert.equal(needsConfirmation(null, 'https://example.com/'), false);
+    assert.equal(
+        needsConfirmation('https://example.com/', 'https://example.com/'),
+        false,
+    );
+    assert.equal(
+        needsConfirmation('https://example.com/', 'https://example.com:8443/'),
+        true,
+    );
+    assert.equal(
+        needsConfirmation('https://example.com/a/', 'https://example.com/b/'),
+        true,
+    );
+});

native/tests/mobile-launcher.test.js

@@ -0,0 +1,89 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+class Element {
+    constructor() {
+        this.events = {};
+        this.attributes = {};
+        this.dataset = {};
+        this.hidden = true;
+        this.value = '';
+    }
+    addEventListener(name, callback) {
+        this.events[name] = callback;
+    }
+    setAttribute(name, value) {
+        this.attributes[name] = value;
+    }
+    removeAttribute(name) {
+        delete this.attributes[name];
+    }
+    focus() {}
+    fire(name) {
+        this.events[name]({ preventDefault() {}, target: this });
+    }
+}
+
+test('Android launcher sends only explicit local actions and preserves switch confirmation', async () => {
+    const elements = new Map();
+    const element = (selector) => {
+        if (!elements.has(selector)) {
+            elements.set(selector, new Element());
+        }
+        return elements.get(selector);
+    };
+    const messages = [];
+    globalThis.document = {
+        querySelectorAll: () => [],
+        querySelector: element,
+        documentElement: new Element(),
+    };
+    globalThis.window = {
+        nativeLauncher: {
+            postMessage: (value) => messages.push(new URL(value)),
+        },
+    };
+    globalThis.location = { href: 'https://tauri.localhost/index.html' };
+    try {
+        await import('../ui/main.js');
+        assert.equal(messages.shift().pathname, '/action/ready');
+        window.updateLauncher(
+            'server=https%3A%2F%2Fexample.com%2F&phase=idle&ready=false&platform=android',
+        );
+        assert.equal(element('#server-url').value, 'https://example.com/');
+        element('#server-url').value = 'http://example.com';
+        element('#server-form').fire('submit');
+        assert.equal(messages.length, 0);
+        assert.equal(element('#server-url').attributes['aria-invalid'], 'true');
+        element('#server-url').value = 'https://example.com/';
+        element('#server-form').fire('submit');
+        assert.equal(messages[0].pathname, '/action/open');
+        assert.equal(
+            messages.shift().searchParams.get('server'),
+            'https://example.com/',
+        );
+        window.updateLauncher(
+            'server=https%3A%2F%2Fexample.com%2F&phase=connected&ready=true&platform=android',
+        );
+        assert.match(
+            element('#connection-status').textContent,
+            /Use Server settings/,
+        );
+        element('#resume').fire('click');
+        assert.equal(messages.shift().pathname, '/action/resume');
+        element('#server-url').value = 'https://other.example.com/';
+        element('#server-form').fire('submit');
+        assert.equal(messages.length, 0);
+        assert.equal(element('#switch-confirmation').hidden, false);
+        element('#confirm-switch').fire('click');
+        assert.equal(
+            messages.shift().searchParams.get('server'),
+            'https://other.example.com/',
+        );
+        assert.equal(location.href, 'https://tauri.localhost/index.html');
+    } finally {
+        delete globalThis.window;
+        delete globalThis.document;
+        delete globalThis.location;
+    }
+});

native/ui/index.html

@@ -0,0 +1,40 @@
+<!doctype html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <meta name="color-scheme" content="light dark" />
+        <title>KanbanGit</title>
+        <link rel="stylesheet" href="./styles.css" />
+        <script type="module" src="./main.js"></script>
+    </head>
+    <body>
+        <main>
+            <img class="brand" src="./mark.svg" alt="" width="48" height="48" />
+            <p class="eyebrow" data-i18n="appName"></p>
+            <h1 data-i18n="title"></h1>
+            <p class="description" data-i18n="description"></p>
+            <form id="server-form" novalidate>
+                <label for="server-url" data-i18n="serverLabel"></label>
+                <input id="server-url" type="url" inputmode="url" autocomplete="url" spellcheck="false" aria-describedby="server-help connection-status" value="https://kanbangit.de/" required />
+                <p id="server-help" class="description" data-i18n="serverHelp"></p>
+                <button class="open-workspace" type="submit" data-i18n="openWorkspace"></button>
+            </form>
+            <p id="connection-status" class="description" role="status" aria-live="polite"></p>
+            <div id="switch-confirmation" hidden>
+                <p class="description" data-i18n="switchWarning"></p>
+                <button id="confirm-switch" type="button" data-i18n="confirmSwitch"></button>
+                <button id="cancel-switch" type="button" data-i18n="cancel"></button>
+            </div>
+            <button id="resume" type="button" data-i18n="resume" hidden></button>
+            <label class="appearance">
+                <span data-i18n="appearance"></span>
+                <select id="appearance">
+                    <option value="system" data-i18n="system"></option>
+                    <option value="light" data-i18n="light"></option>
+                    <option value="dark" data-i18n="dark"></option>
+                </select>
+            </label>
+        </main>
+    </body>
+</html>

native/ui/locales/en.js

@@ -0,0 +1,31 @@
+export const en = {
+    appName: 'KanbanGit',
+    title: 'Choose your workspace.',
+    description: 'Connect to your KanbanGit installation over HTTPS.',
+    serverLabel: 'Server address',
+    serverHelp:
+        'Use the installation address without login details, a query or a fragment.',
+    openWorkspace: 'Open workspace',
+    retry: 'Try again',
+    resume: 'Return to workspace',
+    switchWarning:
+        'Switching servers closes the current workspace and discards unsaved inputs. You will sign in separately on the new server.',
+    confirmSwitch: 'Switch server',
+    cancel: 'Cancel',
+    idle: '',
+    connecting: 'Connecting to your server…',
+    connected:
+        'Your workspace is open. Use KanbanGit → Server settings to change servers.',
+    connectedMobile:
+        'Your workspace is open. Use Server settings to change servers.',
+    connectionError:
+        'The server did not finish loading. Check your connection, server address and HTTPS certificate, then try again. An already open workspace and its inputs are kept.',
+    invalidServer:
+        'Enter a valid HTTPS installation address without login details, a query or a fragment.',
+    storageError:
+        'The server setting could not be read or saved. Check your local storage permissions and try again.',
+    appearance: 'Appearance',
+    system: 'System',
+    light: 'Light',
+    dark: 'Dark',
+};

native/ui/main.js

@@ -0,0 +1,100 @@
+import { en } from './locales/en.js';
+import { normalizeServer, needsConfirmation } from './server.js';
+
+for (const element of document.querySelectorAll('[data-i18n]')) {
+    element.textContent = en[element.dataset.i18n];
+}
+
+const form = document.querySelector('#server-form');
+const input = document.querySelector('#server-url');
+const status = document.querySelector('#connection-status');
+const open = document.querySelector('.open-workspace');
+const resume = document.querySelector('#resume');
+const confirmation = document.querySelector('#switch-confirmation');
+let activeServer = null;
+let pendingServer = null;
+let initialized = false;
+
+function action(name, server) {
+    const url = new URL(`/action/${name}`, location.href);
+    if (server) {
+        url.searchParams.set('server', server);
+    }
+    if (window.nativeLauncher) {
+        window.nativeLauncher.postMessage(url.href);
+    } else {
+        location.href = url.href;
+    }
+}
+
+window.updateLauncher = (query) => {
+    const state = new URLSearchParams(query);
+    const phase = state.get('phase');
+    const server = state.get('server');
+    if (!initialized) {
+        input.value = server;
+        initialized = true;
+    }
+    if (phase === 'connecting' || phase === 'connected') {
+        activeServer = server;
+    }
+    status.textContent =
+        en[
+            phase === 'connected' && state.get('platform') === 'android'
+                ? 'connectedMobile'
+                : phase
+        ] ?? '';
+    status.dataset.state = phase;
+    open.disabled = phase === 'connecting';
+    open.textContent =
+        en[phase === 'connectionError' ? 'retry' : 'openWorkspace'];
+    resume.hidden = state.get('ready') !== 'true';
+    form.setAttribute('aria-busy', String(phase === 'connecting'));
+};
+
+function connect(server) {
+    confirmation.hidden = true;
+    pendingServer = null;
+    action('open', server);
+}
+
+form.addEventListener('submit', (event) => {
+    event.preventDefault();
+    let server;
+    try {
+        server = normalizeServer(input.value);
+    } catch {
+        status.textContent = en.invalidServer;
+        input.setAttribute('aria-invalid', 'true');
+        input.focus();
+        return;
+    }
+    input.removeAttribute('aria-invalid');
+    if (needsConfirmation(activeServer, server)) {
+        pendingServer = server;
+        confirmation.hidden = false;
+        document.querySelector('#confirm-switch').focus();
+        return;
+    }
+    connect(server);
+});
+
+document.querySelector('#confirm-switch').addEventListener('click', () => {
+    if (pendingServer) {
+        connect(pendingServer);
+    }
+});
+document.querySelector('#cancel-switch').addEventListener('click', () => {
+    confirmation.hidden = true;
+    pendingServer = null;
+    input.focus();
+});
+resume.addEventListener('click', () => action('resume'));
+
+document.querySelector('#appearance').addEventListener('change', (event) => {
+    document.documentElement.dataset.appearance = event.target.value;
+});
+
+if (window.nativeLauncher) {
+    action('ready');
+}

native/ui/mark.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 64 64">
+    <rect width="64" height="64" rx="12" fill="#22c55e" />
+    <g fill="none" stroke="#004b1e" stroke-width="3" stroke-linecap="round" stroke-linejoin="round">
+        <rect x="16" y="16" width="32" height="32" rx="3" />
+        <path d="M27 16v32M37 16v32" />
+    </g>
+</svg>

native/ui/server.js

@@ -0,0 +1,33 @@
+export function normalizeServer(input) {
+    const value = input.trim();
+    if (
+        !/^https:\/\//i.test(value) ||
+        [...value].some(
+            (character) =>
+                character.charCodeAt(0) < 32 ||
+                character.charCodeAt(0) === 127 ||
+                character === '\\',
+        )
+    ) {
+        throw new Error('invalidServer');
+    }
+    const url = new URL(value);
+    if (
+        url.protocol !== 'https:' ||
+        !url.hostname ||
+        url.username ||
+        url.password ||
+        value.includes('?') ||
+        value.includes('#')
+    ) {
+        throw new Error('invalidServer');
+    }
+    if (!url.pathname.endsWith('/')) {
+        url.pathname += '/';
+    }
+    return url.href;
+}
+
+export function needsConfirmation(activeServer, nextServer) {
+    return activeServer !== null && activeServer !== nextServer;
+}

native/ui/styles.css

@@ -0,0 +1,180 @@
+:root {
+    --surface: #f7f9fb;
+    --foreground: #191c1e;
+    --muted: #505f76;
+    --primary: #006e2f;
+    --border: #bccbb9;
+    --control: #ffffff;
+    font-family: Inter, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+    color-scheme: light dark;
+    color: var(--foreground);
+    background: var(--surface);
+    font-synthesis: none;
+}
+
+:root[data-appearance='light'] {
+    color-scheme: light;
+}
+
+:root[data-appearance='dark'] {
+    color-scheme: dark;
+    --surface: #0f172a;
+    --foreground: #f8fafc;
+    --muted: #b7c8e1;
+    --primary: #4ae176;
+    --border: #334155;
+    --control: #1e293b;
+}
+
+@media (prefers-color-scheme: dark) {
+    :root:not([data-appearance='light']) {
+        --surface: #0f172a;
+        --foreground: #f8fafc;
+        --muted: #b7c8e1;
+        --primary: #4ae176;
+        --border: #334155;
+        --control: #1e293b;
+    }
+}
+
+* {
+    box-sizing: border-box;
+}
+
+body {
+    margin: 0;
+    min-height: 100vh;
+    display: grid;
+    place-items: center;
+    padding: 32px;
+}
+
+main {
+    width: min(100%, 380px);
+}
+
+.brand {
+    display: block;
+    margin-bottom: 24px;
+}
+
+.eyebrow {
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--primary);
+}
+
+h1 {
+    margin: 12px 0;
+    font-size: 28px;
+    font-weight: 600;
+    line-height: 1.2;
+    letter-spacing: -0.02em;
+}
+
+.description,
+.server,
+.appearance {
+    color: var(--muted);
+    font-size: 14px;
+    line-height: 1.5;
+}
+
+.open-workspace {
+    display: block;
+    margin-top: 28px;
+    padding: 12px 20px;
+    border-radius: 4px;
+    color: #004b1e;
+    background: #22c55e;
+    text-align: center;
+    text-decoration: none;
+    font-size: 14px;
+    font-weight: 600;
+}
+
+.open-workspace:hover {
+    background: #4ae176;
+}
+
+:focus-visible {
+    outline: 2px solid var(--primary);
+    outline-offset: 4px;
+}
+
+.server {
+    text-align: center;
+    font-size: 12px;
+}
+
+.appearance {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    margin-top: 32px;
+}
+
+select {
+    min-height: 36px;
+    padding: 4px 10px;
+    font: inherit;
+    border: 1px solid var(--border);
+    border-radius: 4px;
+    color: inherit;
+    background: var(--control);
+}
+
+[hidden] {
+    display: none !important;
+}
+
+form {
+    margin-top: 24px;
+}
+
+label {
+    font-size: 14px;
+    font-weight: 600;
+}
+
+input,
+button {
+    min-height: 44px;
+    padding: 10px 12px;
+    border: 1px solid var(--border);
+    border-radius: 4px;
+    font: inherit;
+    color: var(--foreground);
+    background: var(--control);
+}
+
+input {
+    display: block;
+    width: 100%;
+    margin-top: 8px;
+    font-size: 16px;
+}
+
+button {
+    cursor: pointer;
+}
+
+button:disabled {
+    cursor: wait;
+    opacity: 0.65;
+}
+
+.open-workspace {
+    width: 100%;
+    border: 0;
+    margin-top: 16px;
+}
+
+#switch-confirmation {
+    border: 1px solid var(--border);
+    border-radius: 4px;
+    padding: 12px;
+    margin-bottom: 16px;
+}

tests/Fixtures/auth-browser.mjs

@@ -68,16 +68,14 @@ try {
             ]) {
                 await open(path);
                 await page
-                    .getByRole('button', {
-                        name: theme === 'light' ? 'Light' : 'Dark',
-                        exact: true,
+                    .getByRole('radio', {
+                        name: theme === 'light' ? /^Light / : /^Dark /,
                     })
-                    .click();
+                    .press('Space');
                 await page
-                    .getByRole('button', {
-                        name: theme === 'light' ? 'Light' : 'Dark',
-                        exact: true,
-                        pressed: true,
+                    .getByRole('radio', {
+                        name: theme === 'light' ? /^Light / : /^Dark /,
+                        checked: true,
                     })
                     .waitFor();
                 assert.equal(
@@ -118,7 +116,7 @@ try {
     }
     await page.setViewportSize({ width: 390, height: 480 });
     await open('/login');
-    await page.getByRole('button', { name: 'System', exact: true }).click();
+    await page.getByRole('radio', { name: /^System / }).press('Space');
     await page.emulateMedia({ colorScheme: 'light' });
     await page.waitForFunction(
         () => !document.documentElement.classList.contains('dark'),