Shevery v13.8.0-r27 Hotfix

Shevery v13.8.0-r27 Hotfix

This hotfix release resolves a rish timeout bug on Android 16 (API 36+) and localizes all Gemini prompt and explanation logic to match the current system user interface language.

---

Changes

1. Rish Timeout Fix on Android 16+:
   • Integrated fallback startActivityAsUser and dynamic �roadcastIntentWithFeature lookup from Rikka's shell loader.
   • Bypasses background broadcast delivery blocks introduced in Android 16.
2. Gemini Prompt Language Localization:
   • Updated Gemini prompt generator logic to fetch current system locale (Locale.getDefault()).
   • Enforces that all responses/explanations generated by Gemini are translated into the user's UI/system language automatically.
3. Translations Update:
   • Completed 25 missing translation strings in �alues-ru/strings.xml.

---

Attached Artifacts

• shizuku-v13.8.0.r27-release.apk: Release build with local network & system permissions.
• shizuku-v13.8.0.r27-debug.apk: Debug build with full logs.

Shevery v13.8.0-r27

Shevery v13.8.0-r27

What's New

GitHub-Based Module Catalog

• Module discovery via GitHub Topics (shevery-modules topic). No hardcoded catalog — any developer can publish modules by tagging their repo.
• Module validation: repos are checked for module.prop in root or subdirectories.
• Per-user module limit: max 4 modules per GitHub user (HmnDev-Tech exempt).
• GitHub PAT authentication with rate limit tracking (5,000 req/hour authenticated vs 60 unauthenticated).
• Discovery cache with 6-hour TTL and ETag conditional requests.

Module Install System

• Install from sources: fetches files via GitHub Contents API, resolves default branch dynamically, builds clean ZIP (module.prop, .sh, banner., webui/**).
• Install from release ZIP: downloads asset from GitHub Releases, matches by module ID pattern.

Automatic Update Checking

• GitHub Releases API update checking for installed and catalog ADB modules.
• Direct download to device Downloads directory and direct in-app installation.

Update Settings UI

• Dedicated update settings screen with GitHub PAT management, catalog toggle, and per-module update controls.

Removed

• Hardcoded CatalogModuleManager replaced with dynamic GitHub Topics discovery.
• Sample test-modules/adb-test-module removed.
• Obsolete docs/diff-v13.8.0-r20.md and docs/blame-v13.8.0-r20.md removed.

Build

• Version name format simplified: 13.8.0.r27 (git commit hash removed from versionName).
• Added kotlinx-serialization, OkHttp 4.12.0, Coil Compose 2.7.0, security-crypto dependencies.

Binary Builds

• shevery-v13.8.0-r27-release.apk
• shevery-v13.8.0-r27-debug.apk

Credits

• kerneldroid for ADB Modules Catalog fix.

Shevery v13.8.0-r26

Shevery v13.8.0-r26

Changes and Improvements

1. Application Package Name Update:

   • Application ID updated to com.hamondev.shevery.
   • Full compatibility with third-party Shizuku API clients preserved by maintaining moe.shizuku.manager.permission.API_V23 permission, dual ContentProvider authorities (moe.shizuku.privileged.api.shizuku and ${applicationId}.shizuku), and matching Intent Action filters.

2. ADB Module Catalog:

   • Added Catalog tab inside the ADB Modules section.
   • Included official ShizuConfigs module by Shevery developer with an OFFICIAL badge (ADB device monitoring and system settings editor utility).
   • Removed sample and placeholder test modules.

3. Automatic Module Update Checks:

   • Integrated GitHub Latest Release API update checking for installed and catalog ADB modules.
   • Supported direct download to the device Downloads directory and direct in-app installation.

Binary Builds

• Release APK: shizuku-v13.8.0.r26.ead1ef3-release.apk
• Debug APK: shizuku-v13.8.0.r26.ead1ef3-debug.apk

v13.8.0 r25

Shevery version 13.8.0 r25 Release

Key Changes:

• Added settings, modules, API keys, and allowed apps backup & restore.
• Added terminal macro recording/playback inside Comput.
• Added Gemini AI Explain failure analysis for console command runs and module action launches.
• Added Commandium prompt generator inside Comput.

Shevery v13.8.0-r21

Changes

• Added Android 17 compatibility (fixed getInstalledPackages returning empty list)
• Resolved rish timeouts on Android 16+ using activity-based fallback
• Resolved rish timeouts on Android 14+ termux (unset LD_LIBRARY_PATH)
• Bumped Shevery version to r21

Shevery v13.8.0 r20

Shevery v13.8.0-r20

This is the latest release of Shevery featuring native Google TV launcher support and permanent in-notification status controls (Start/Stop).

Code Diffs & Blame Pages

We have generated dedicated documentation pages inside the repository tracking the precise changes:

• Release Code Diff Page — Detailed file-by-file changes and code snippets.
• Release Git Blame Page — Line-by-line authorship mapping and explanations.

Direct Comparison

• GitHub Compare v13.7.0-r16...v13.8.0-r20

Changelog

• Google TV/Leanback Support: Un-commented LEANBACK_LAUNCHER activity filter to enable native Google TV integration while fully preserving the original phone/wear UI layouts and tab navigation.
• Persistent notification controls: Shows a Low-importance persistent notification with Start and Stop buttons mapping directly to service control calls.
• Compatibility Layer Fixes: Corrected IPermissionManager reflection parameter matching in Android17Compat.java.
• DHizuku Thread fixes: Integrated thread-safety improvements and timeout leak fixes in DhizukuService.
• Coroutine Memory leaks: Fixed continuation coroutine leak on ModuleWebViewActivity destruction.

Shevery v13.7.0-r19

Shevery v13.7.0 r19

---

Detailed Fixes & Under-the-Hood Improvements (Commit 87d881f)

1. Restoration of Dhizuku Support in StarterActivity

• Fix Details: Replaced the unsupported mock exception with actual Dhizuku initialization (com.rosan.dhizuku.api.Dhizuku.init), permission checking, user service binding, and execution of the Shevery server startup command with Device Owner/admin privileges. Added proper clean-up using unbindUserService in a finally block to prevent leaks.
• Links: StarterActivity.kt Blame | StarterActivity.kt Diff

2. Fixes for Non-Daemon Thread Leaks on Timeouts

• Fix Details: Fixed critical memory and thread leaks where the stdout and stderr streams of remote processes were left open when processes timed out and were destroyed via remote.destroy(). Since the background stream-reading threads were non-daemon and blocked on read operations, they would leak permanently. Added explicit stream close logic upon timeout to immediately wake up and terminate those threads.
• Affected Files:
  • ComputScreen.kt: Blame | Diff
  • AdbModuleManager.kt: Blame | Diff
  • ModuleJsBridge.kt: Blame | Diff

3. Elimination of Unused Gemini Strings

• Fix Details: Cleaned up the resource files by removing deprecated and unused Gemini string entries (such as modules_ai_model_gemini_31_pro, modules_ai_model_gemini_3_flash, and modules_ai_model_gemini_31_flash_lite) from both default and Russian localization resources.
• Affected Files:
  • strings.xml (Russian): Blame | Diff
  • strings.xml: Blame | Diff

---

📦 Attached Assets

• manager-debug.apk - Debug build package.
• manager-release.apk - Release build package.

v13.7.0-r16

Shevery Release v13.7.0-r16

• Security: Fixed path traversal vulnerabilities in WebView module loading.
• Console: Resolved UI hangs and process leaks by enforcing a 120-second command execution timeout and asynchronous stream consumption.
• Dhizuku: Removed non-functional Device Owner initialization process, failing fast with diagnostic logs.
• TCP Mode: Corrected settings description to accurately reflect watchdog reconnect behavior on local port 5555.

Shevery v13.7.0.r15 hotfix-2

Release r15 hotfix-2

Bug Fixes and Technical Improvements

1. Android 17 / API 37 Compatibility Layer

   • Fixed dynamic reflection type mismatch when passing default device IDs as integer parameters (switched to default String).
   • Resolved parameter transposition in package checks.
   • Refactored UID permission auditing to look up the correct signature.

2. Comput Console Deadlock Resolution

   • Replaced sequential blocking stream reads with concurrent coroutine-based async/await draining, eliminating deadlocks when reading stdout and stderr pipes.

3. KeyStore API Key Encryption

   • Implemented real AES-GCM-NoPadding encryption backed by Android KeyStore, securing the Gemini API key.
   • Automatically migrates existing plain text keys.

4. WebView JS Bridge Isolation

   • Constrained WebView client navigations to open HTTP/HTTPS links in system browsers.
   • Restricted Javascript interface usage to same-origin checks comparing caller context to local module root paths.

5. Dhizuku Integration

   • Fully restored the Dhizuku integration and verified build compatibility.

Commits

• 2200390 fix(project): resolve Comput screen deadlocks, Gemini KeyStore encryption, WebView JS bridge security, and Android 17 compat

Line-by-Line Changes Diff

--- a/docs/adb-modules-api.md
+++ b/docs/adb-modules-api.md
@@ -252,14 +252,10 @@
-The optional AI checker is hidden by default. It is toggled from Settings by tapping the translation contributors row five times quickly. After unlock:
-
-- the AI settings row appears in module settings;
-- the Gemini star appears in ReCommand dialogs;
-- the API key is stored encrypted with Android Keystore;
-- supported model ids are `gemini-3.1-pro-preview`, `gemini-3-flash-preview`, and `gemini-3.1-flash-lite-preview`.
-
-Repeating the same five-tap gesture hides the AI settings row and Gemini star again.
+The optional AI checker is fully integrated into the manager:
+- Gemini console explanation is available in the Comput screen.
+- The API key is securely encrypted using Android Keystore.
+- Configurable settings are directly accessible under Comput Console settings.

--- a/manager/src/main/java/moe/shizuku/manager/logs/ComputScreen.kt
+++ b/manager/src/main/java/moe/shizuku/manager/logs/ComputScreen.kt
@@ -71,6 +71,8 @@
+import kotlinx.coroutines.async
+import kotlinx.coroutines.coroutineScope
@@ -202,9 +204,15 @@
-                    val stdoutText = ParcelFileDescriptor.AutoCloseInputStream(remote.getInputStream()).bufferedReader().use { it.readText() }
-                    val stderrText = ParcelFileDescriptor.AutoCloseInputStream(remote.getErrorStream()).bufferedReader().use { it.readText() }
+                    val (stdoutText, stderrText) = kotlinx.coroutines.coroutineScope {
+                        val stdoutDeferred = async {
+                            ParcelFileDescriptor.AutoCloseInputStream(remote.getInputStream()).bufferedReader().use { it.readText() }
+                        }
+                        val stderrDeferred = async {
+                            ParcelFileDescriptor.AutoCloseInputStream(remote.getErrorStream()).bufferedReader().use { it.readText() }
+                        }
+                        stdoutDeferred.await() to stderrDeferred.await()
+                    }

--- a/manager/src/main/java/moe/shizuku/manager/module/ModuleJsBridge.kt
+++ b/manager/src/main/java/moe/shizuku/manager/module/ModuleJsBridge.kt
+    private fun isOriginValid(): Boolean {
+        val latch = java.util.concurrent.CountDownLatch(1)
+        var url: String? = null
+        webView.post {
+            url = webView.url
+            latch.countDown()
+        }
+        try {
+            latch.await(500, java.util.concurrent.TimeUnit.MILLISECONDS)
+        } catch (e: Exception) {
+            return false
+        }
+        val currentUrl = url ?: return false
+        if (!currentUrl.startsWith("file://", ignoreCase = true)) {
+            return false
+        }
+        val cleanUrl = currentUrl.substring(7).split("?")[0].split("#")[0]
+        val root = module.webRoot ?: return false
+        return try {
+            val rootPath = root.canonicalPath
+            val filePath = File(cleanUrl).canonicalPath
+            filePath.startsWith(rootPath)
+        } catch (e: Exception) {
+            false
+        }
+    }

--- a/server/src/main/java/rikka/shizuku/server/util/Android17Compat.java
+++ b/server/src/main/java/rikka/shizuku/server/util/Android17Compat.java
@@ -148,7 +148,8 @@
-                    return (int) invokeMethod(pm, sCheckPermissionMethod, permissionName, packageName, userId);
+                    // Pass packageName first, permissionName second to match IPermissionManager signature
+                    return (int) invokeMethod(pm, sCheckPermissionMethod, packageName, permissionName, userId);
@@ -168,17 +169,16 @@
-                            sCheckPermissionUidMethod = findMethod(pm, "checkPermission", String.class, int.class);
+                            sCheckPermissionUidMethod = findMethod(pm, "checkUidPermission", int.class, String.class);
-                    if (paramTypes.length == 3 && paramTypes[1] == int.class && paramTypes[2] == int.class) {
-                        // (String permission, int deviceId, int uid)
-                        return (int) sCheckPermissionUidMethod.invoke(pm, permissionName, DEVICE_ID_DEFAULT, uid);
+                    if (paramTypes.length == 3 && paramTypes[0] == int.class && paramTypes[1] == String.class && paramTypes[2] == int.class) {
+                        // (int uid, String permission, int deviceId)
+                        return (int) sCheckPermissionUidMethod.invoke(pm, uid, permissionName, 0);
-                    return (int) sCheckPermissionUidMethod.invoke(pm, permissionName, uid);
@@ -227,7 +227,7 @@
-                        sRevokeRuntimePermissionMethod.invoke(pm, packageName, permissionName, DEVICE_ID_DEFAULT, userId, "shizuku");
+                        sRevokeRuntimePermissionMethod.invoke(pm, packageName, permissionName, "default", userId, "shizuku");
@@ -272,7 +272,11 @@
-            args[prefixLen] = DEVICE_ID_DEFAULT;
+            if (paramTypes[prefixLen] == String.class) {
+                args[prefixLen] = "default";
+            } else {
+                args[prefixLen] = 0; // DEVICE_ID_DEFAULT
+            }
+```

Shevery v13.7.0 r15 Hotfix

Shevery v13.7.0 r15 Hotfix Release

This hotfix release resolves several critical bugs in both the frontend (UI) and backend components of Shevery.

Bug Fixes

1. WebView Command Queueing & Concurrency:
   • Fixed a race condition in ModuleWebViewActivity where concurrent commands sent from WebView JS would overwrite the activity's single pending command fields, causing previous commands to hang indefinitely in
     unBlocking and leaking coroutine resources. Added a reactive Compose-backed mutableStateListOf queue.
2. Logcat Leak & Output Spam:
   • Removed device-wide logcat streaming from AdbModuleManager.runModuleScriptStreaming to prevent leakage of private system-wide logs from other applications and reduce output spam.
3. WebView Network Policy Enforcement:
   • Fixed a bypass where untrusted modules could make arbitrary web network calls via Shizuku.download(url, path) regardless of the WebView's blocked network status. Now explicitly enforces canUseWebNetwork policy check before allowing downloads.
4. UTF-8 Multi-byte Stream Chunk Parsing:
   • Fixed multi-byte character corruption at buffer chunk boundaries in ModuleJsBridge.readStreamTail by reading using a proper InputStreamReader into a CharArray buffer instead of decoding arbitrary byte-chunks directly.
5. Dhizuku Service Binding Connection Leak:
   • Resolved a memory leak in WatchdogManager and StarterActivity where the Dhizuku ServiceConnection was never unbound after starting the service. Added a 10-second timeout and clean up unbinding in invokeOnCancellation and inally blocks.
6. NSD Discovery Background Leak:
   • Fixed AdbMdns background discovery scan leak when stop() is called quickly after start(), before the async onDiscoveryStarted confirms state. Now stops discovery unconditionally.
7. Windows ZIP Path Verification Compatibility:
   • Fixed ZIP path validation in AdbModuleManager.ensureInside to use Java NIO Path.startsWith instead of hardcoded forward slash checks (childPath.startsWith("/")), fixing "Unsafe module path" failures when compiling or testing on Windows.