feat(frontend): add native alarms and voice recording - #133
Conversation
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
| } | ||
|
|
||
| const application = AndroidConfig.Manifest.getMainApplicationOrThrow(manifest); | ||
| application.$['android:usesCleartextTraffic'] = 'true'; |
There was a problem hiding this comment.
Security: This enables cleartext traffic for the entire application, not just the intended LAN WebSocket connection. Any HTTP request made by the app can now silently downgrade to http://, which exposes credentials and data on an untrusted network. Keep cleartext narrowly scoped (or use wss:// in release builds) rather than setting the global application flag.
| android:turnScreenOn="true" | ||
| android:taskAffinity="" | ||
| android:theme="@android:style/Theme.DeviceDefault.NoActionBar"/> | ||
| <receiver |
There was a problem hiding this comment.
Reliability: The scheduler persists alarms in SharedPreferences, but this receiver is only registered for the explicit fire PendingIntent; there is no BOOT_COMPLETED receiver or rebuild path. Android removes AlarmManager entries on reboot, so every scheduled reminder is lost after a device restart even though its record remains persisted. Register a boot/package-replaced rebuild receiver or otherwise reschedule persisted records.
| include_deleted: false, | ||
| }); | ||
| if (generation !== this.loadGeneration) return; | ||
| this.deps.cache.replaceAll(schedules); |
There was a problem hiding this comment.
Bug: system_schedule_ref_id is a local AlarmManager ID and is not part of the server upsert payload. Replacing the cache with the server list on bootstrap/resync therefore drops the local alarm IDs, so later edits/deletes cannot cancel existing native alarms; resync also never re-arms them. Preserve local refs while merging server entities and reconcile/reschedule alarms during bootstrap.
| latitude: 31.236305, | ||
| longitude: 121.480237, | ||
| }; | ||
| const initialJson = JSON.stringify(initialLocation); |
There was a problem hiding this comment.
Security: JSON.stringify output is inserted directly into an inline <script>. A user/backend-controlled address containing </script> can terminate this script and execute arbitrary JavaScript inside the WebView (with access to the React Native bridge). Escape HTML-significant characters such as </> (or pass the data through a non-script channel) before embedding it.
|
|
||
| @Override | ||
| public int onStartCommand(Intent intent, int flags, int startId) { | ||
| requestCode = intent == null |
There was a problem hiding this comment.
Bug: Android reuses one service instance for repeated starts, but these fields represent only one alarm. If two alarms fire while the first is ringing, the second onStartCommand overwrites requestCode/alarmId/alarmTitle; mediaPlayer != null and overlayView != null then suppress the second alarm, while cleanup only cancels the latest notification/record. Queue or independently track concurrent alarms instead of overwriting the active one.
1 participant
Summary
Why
Web APIs cannot provide reliable Android alarm delivery or the recorder contract used by the assistant. These local modules supply the native capabilities while keeping the feature layers behind typed JavaScript adapters.
Dependency