pneumo

M4: Home history, composer, share sheet (text), Devices and Settings (ENG-264) #28

Merged

demi.dev 1w ago

targeting main from stoopkidddd/eng-264-m4-home-history-composer-share-sheet-text-devices-and

Merged opened by and assigned to

demi.dev 1w ago targeting main from stoopkidddd/eng-264-m4-home-history-composer-share-sheet-text-devices-and

Linear: https://linear.app/engineereddev/issue/ENG-264

What's in this PR (142 files, all under apps/android/):

Home: history from the Room Flow (newest first), decrypted through the repository, paging older items via GET /api/pushes; rows by type (file rows show name and size); Copy, Open, Delete with a 5-second undo snackbar before DELETE; scroll-to and highlight for the notification pushId; empty, loading and offline states.
Composer: multi-line text, link indicator (existing http(s) rule), target picker with online dots, Send with pending and error states.
ShareActivity (exported, bottom sheet): ACTION_SEND + text/plain → note or link (single URL), title from EXTRA_SUBJECT, target picker, optional message; Send enqueues a WorkManager job and finishes. The job's encrypted envelope is spooled to a private file (WorkManager's Data is capped at 10 KB). Not paired → "Pair Pneumo first".
Devices: list, rename any device, remove other devices. Settings: connection state, notification and battery-optimization status with buttons, server host, app version, Sign out.
Session/sync integration hardened against stale cache writes after sign-out and premature catch-up end (no protocol or Room schema change).
Dependency: WorkManager 2.12.0 (libs.versions.toml, app/build.gradle.kts).
Tests: ViewModel (Turbine) for send note/link, delete with undo, targets, errors, races; share-intent parsing; managed-device HomeShareSmokeTest; 66 new Roborazzi goldens and 12 re-recorded shell goldens (named in the commit).

Verify (lead, on 82cd724):

mise run check:android → exit 0
./gradlew testDebugUnitTest --rerun → exit 0 (283 tests, 0 failures)
./gradlew pixel6Api34DebugAndroidTest --rerun → exit 0 (11 tests, 0 failures)
Acceptance (implementer, API 34 Google APIs emulator, local random-port server): am start -a SEND … https://example.com -n dev.pneumo.app/.ShareActivity → dev-client listen received the link in 631 ms; Home shows it as a link (screenshot checked by the lead, not committed).

Deviations: none functional; WorkManager added as permitted; encrypted spool files for the share job.

🤖 Generated with Claude Code

Commits 2

M4: Retry transient shares and decrypt history off Main (ENG-264)

+230 -51

M4: Add Android history, composer and sharing (ENG-264)

+6343 -213

Comments

v0 1w ago

demi.dev 1w ago

pneumo-reviewer: round 1, REQUEST_CHANGES #

PR #28 covers the whole issue: Room-backed Home with HTTP paging and scroll-to, the composer, an exported text-only ShareActivity with an encrypted WorkManager spool, Devices and Settings; previews, 66 new goldens (12 re-recorded, named in the commit) and the managed-device smoke are present; check:android is green. Deviation 3 (SessionCache, SyncEngine) is in scope and keeps ENG-259's pairing lower bound.

FIX (score ≥ 5)

often=3 bad=6 score=18 — ui/share/SharePushWorker.kt:30-56,85: every exception is terminal, so a network blip, timeout, DNS failure, 5xx or 429 deletes the spool and returns failure() after the sheet closed; the share silently never arrives. Fix: Result.retry() (spool kept) for IOException and 5xx/429; delete only on terminal cases. Retrying is safe (same id + body → 200, §8).
often=3 bad=3 score=9 — ui/home/HomeDataSource.kt:33: observeAll() decrypts and validates the whole (unpruned) Room table on Main for every pushes-table change. Fix: flowOn(Dispatchers.Default).

FILE (score < 5, code left alone, recorded on ENG-275)

score=4 — the 5 s pending delete is lost if the activity is destroyed during the grace.
score=4 — Load older pages from page 1's cursor, not the oldest Room row.
score=4 — cold-start notification lookup goes to the network before Room; offline shows "Could not find that push".
score=4 — "Pair Pneumo" from ShareActivity starts MainActivity without NEW_TASK.
score=4 — one undecryptable row ends the history collector until restart.
score=4 — Open doesn't catch ActivityNotFoundException.
score=1 — sign-out doesn't cancel share work or clear the (encrypted) spool.
score=2 — test gaps: real 404 delete handling; a dropped cursor assertion in SyncEngineTest.
score=3 — row-type icons: pencil for files, share glyph for links.

Spec §14.8, §14.10, §5.2, §8 OK apart from finding 1; plaintext stays off disk. Next: omp round 2 for findings 1–2.

v1 1w ago

demi.dev 1w ago

pneumo-reviewer: round 2 (head f9fb0f0), APPROVE #

The round fixes both round-1 FIX findings and touches only the 7 listed files.

FIX 1 resolved (share failures all terminal): SharePushWorker returns Result.retry() and keeps the encrypted spool for IOException (timeouts, DNS, dropped connections) and ApiError 5xx/429; every other ApiError (401, 400, 403, 404, 409, 413) and an unreadable spool or session/device mismatch is terminal and deletes the spool. Retrying resends the same id and envelope (§8 idempotent). No retry cap is acceptable: WorkManager backoff tops out at 5 h, and sign-out or re-pairing makes the next attempt terminal. New tests cover retryable, terminal and undecodable cases; the managed-device smoke answers 503 first and gets exactly one push with two identical POSTs.
FIX 2 resolved (decrypt on Main): observeAll().flowOn(Dispatchers.Default); the new dispatcher test fails on the round-1 HomeDataSource.kt (checked in a scratch copy).
No new findings; the nine round-1 FILE findings stay on ENG-275.

Verify (reviewer and lead): check:android exit 0; testDebugUnitTest --rerun 286/0 failures; pixel6Api34DebugAndroidTest --rerun 12/0. CI 3/3 on f9fb0f0.

Versions

pneumo-reviewer: round 1, REQUEST_CHANGES #

pneumo-reviewer: round 2 (head f9fb0f0), APPROVE #