* fix: add input validation for protocol decoding and fragment reassembly
* fix:subtract the old entry's size before adding the new one, so duplicate/retransmitted fragments don't inflate the counter
* fix: FragmentManager.handleFragment() can be entered concurrently (e.g., fragments for the same fragmentID arriving from multiple peers/relays). In order for this to happen multiple devices would be needed to connect to the mesh. even with a per-fragmentID byte cap, an attacker could open many fragment IDs at once and force the device to buffer lots of fragment data overall (risking memory pressure/OOM). In this fix we made fragments atomic and thread safe. When a fragment index is retransmitted, we compute the size delta (new - old) so duplicates don’t inflate counters and can’t be used to bypass limits. Under heavy load/attack the app will drop/reject fragment sets earlier instead of growing memory usage without bound to reduce risk of oom. tested on pixel 6 and pixel 8.
* fix: add fragmenttest
* Add 'Send private message' action to chat user sheet
* Change 'Send private message' action color to purple
* Fix: Resolve short ID against all participants, not just cached nicknames
* Fix: Correctly open private chat sheet for mesh peers
---------
Co-authored-by: a1denvalu3 <>
- Added DisposableEffect to LocationChannelsSheet to ensure cleanup runs when composable is removed
- Fixed ChatViewModel.endGeohashSampling() to correctly delegate to GeohashViewModel instead of being a no-op
- Prevents lingering kind 20001 subscriptions after closing the sheet
* feat: Introduce Gradle property to control APK splits
This commit introduces a new Gradle project property, `buildSplitApks`, to conditionally enable or disable the generation of ABI-specific (arm64, x86_64) and universal APKs.
Key changes:
- In `app/build.gradle.kts`, the `splits.abi.isEnable` flag is now dynamically set based on the `buildSplitApks` property.
- APK splitting is disabled by default to support standard Android App Bundle (`bundleRelease`) builds.
- The release workflow (`release.yml`) is updated to pass `-PbuildSplitApks=true` when building release APKs for GitHub.
- The general Android build workflow (`android-build.yml`) is also modified to enable splits only for the `Release` variant, ensuring debug builds are not affected.
* chore: Simplify and automate APK split builds
This commit simplifies the build process by automatically enabling ABI splits for APKs (`assemble`) and disabling them for AABs (`bundle`).
This removes the need to manually pass the `-PbuildSplitApks=true` property. The build script now intelligently determines whether to create architecture-specific APKs based on the task being executed (e.g., `assembleRelease` vs. `bundleRelease`).
The GitHub Actions workflows (`release.yml`, `android-build.yml`) have been updated to remove this now-redundant property, streamlining the CI configuration.
* Automated update of relay data - Sun Sep 21 06:21:05 UTC 2025
* Automated update of relay data - Sun Sep 28 06:20:40 UTC 2025
* refactor: new close button like ios(but not liquid glass)
* Automated update of relay data - Sun Oct 5 06:20:09 UTC 2025
* Automated update of relay data - Sun Oct 12 06:20:12 UTC 2025
* Automated update of relay data - Sun Oct 19 06:21:51 UTC 2025
* Automated update of relay data - Sun Oct 26 06:21:31 UTC 2025
* Automated update of relay data - Sun Nov 2 06:22:16 UTC 2025
* Automated update of relay data - Sun Nov 9 06:21:43 UTC 2025
* Automated update of relay data - Sun Nov 16 06:22:37 UTC 2025
* Automated update of relay data - Sun Nov 23 06:22:51 UTC 2025
* Automated update of relay data - Sun Nov 30 06:24:08 UTC 2025
* Automated update of relay data - Sun Dec 7 06:22:59 UTC 2025
* Automated update of relay data - Sun Dec 14 06:24:33 UTC 2025
* Automated update of relay data - Sun Dec 21 06:24:49 UTC 2025
* Automated update of relay data - Sun Dec 28 06:25:38 UTC 2025
* Automated update of relay data - Sun Jan 4 06:26:28 UTC 2026
* Automated update of relay data - Sun Jan 11 06:26:19 UTC 2026
* feat: Add BitchatSheetTopBar component
* Refactor: Use BitchatSheetTopBar in bottom sheets
This commit refactors several bottom sheet components to use the new reusable `BitchatSheetTopBar` composable.
This change provides a consistent look and feel for top bars across the following sheets:
- DebugSettingsSheet
- MeshPeerListSheet
- LocationNotesSheet
- LocationChannelsSheet
- LocationNotesSheetPresenter (for the location unavailable state)
The `BitchatSheetCenterTopBar` has been removed as its functionality is now covered by the more flexible `BitchatSheetTopBar`.
* Refactor: Use BitchatSheetTopBar in MeshPeerListSheet
---------
Co-authored-by: GitHub Action <action@github.com>
* Private Key Stored in Plaintext(SharedPreference) in EncryptionService migrated to EncryptedSharedPreferences.
* Fix: Safe migration to EncryptedSharedPreferences and restore testability
- Use distinct filename for encrypted prefs to avoid collision with legacy plaintext file
- Move Keystore setup to initialize() to support Robolectric test mocks
- Implement safe read-old/write-new migration logic
---------
Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>
* fix(ui): Show acquiring location state instead of unavailable
This change updates the LocationNotesSheetPresenter to display an 'Acquiring Location' sheet when location permissions are granted but the location is still loading. This prevents the misleading 'Location Unavailable' error on devices with slow GPS start-up (e.g., GrapheneOS).
Fixes#578
* Adjust text
---------
Co-authored-by: a1denvalu3 <>
* fix: Ensure empty neighbor lists in newer announcements clear mesh edges
- Refactored MeshGraphService.updateFromAnnouncement to prioritize timestamp checks.
- Treated null neighbor lists (omitted TLV) as empty lists to allow peer disconnection/isolation updates to propagate.
- Added MeshGraphServiceTest to verify timestamp logic and edge eviction.
* fix(test): Use TestOnly API to reset singleton instead of reflection
- Added MeshGraphService.resetForTesting()
- Updated MeshGraphServiceTest to use the new API, avoiding fragile reflection on companion object fields.
Closes#591
- Added FileUtils.clearAllMedia() to recursively delete media directories and cache.
- Called clearAllMedia() in ChatViewModel.panicClearAllData().
fix: correct voice notes directory path for cleanup
- Updated FileUtils.clearAllMedia to use 'voicenotes' instead of 'voice_notes' to match VoiceRecorder.kt
fix: update media cleanup to include cache directories
- Updated FileUtils.clearAllMedia to explicitly clean 'files/incoming' and 'images/incoming' from context.cacheDir, reflecting the storage location change from issue #592.
- Maintained legacy cleanup for context.filesDir.
Co-authored-by: a1denvalu3 <>
* fix(security): Clear in-memory keys during panic mode #588
* feat: Recreate mesh service after panic clear (#602)
* feat: Recreate mesh service after panic clear
This commit refactors the panic clear process to ensure a new mesh identity is immediately created and applied.
Previously, the `ChatViewModel` would clear sensitive data, but the recreation of the `BluetoothMeshService` was handled externally. This could lead to a delay or failure in adopting the new identity.
Key changes:
- Introduces `MeshServiceHolder` to manage the lifecycle of the `BluetoothMeshService` instance.
- Adds `recreateMeshServiceAfterPanic()` to `ChatViewModel`, which now explicitly clears the old service instance and creates a new one with a regenerated identity.
- The `meshService` property in `ChatViewModel` is now a `var` to allow it to be replaced with the fresh instance post-panic.
- The new service is started, and a broadcast announcement is sent immediately, ensuring the new peer ID is used on the network.
* fix: Ensure mesh service is properly managed in foreground service
* refactor: Decouple handlers from direct service reference
This commit updates the `VerificationHandler` and `MediaSendingManager` to receive the `meshService` via a lambda function (`getMeshService`) instead of a direct reference.
This change decouples the handlers from the service instance, preventing them from holding a stale reference if the service reconnects or changes. By invoking the lambda to get the current service instance when needed, it ensures they always interact with the active `meshService`.
* fix: restart bluetooth
---------
Co-authored-by: Moe Hamade <69801237+moehamade@users.noreply.github.com>
* refactor: abstract LocationProvider, use FusedLocationProvider
* Refactor: Sync permission state on check
Replaces manual updatePermissionState calls with a unified checkAndSyncPermission method. This ensures that _permissionState flow always reflects the actual system permission status whenever it is checked (e.g. in requestOneShotLocation), preventing desync issues when permissions are revoked at runtime.
* Refactor: Add timeout and tracking to SystemLocationProvider
Implements robust cleanup and timeout logic for location requests.
- SystemLocationProvider: Adds 30s timeout and listener tracking for legacy one-shot requests to prevent memory leaks on pre-Android 11 devices.
- FusedLocationProvider: Adds 30s duration to requests.
- LocationProvider: Adds cancel() method for full resource cleanup.
- LocationChannelManager: Ensures cancel() is called during cleanup.
* try catch
GitHub Action