cccodroid v0.6.10

简体中文 · English

这一版修完了 chenshi723 对 0.6.9 的整份审计（#180–#200）和一份私下报告的安全问题，又接着加固了两轮破甲检查，一共一百多处修复。

安全

• 判断「是不是应用私有目录」改按目录本身认，换个写法、软链、上级目录都绕不过去；项目、文件面板、Git、预览、Office 各处入口统一走这一道。
• 发行版封口补齐：项目说明里的 @ 引用不能出项目根；skill、子代理头里写的钩子在副本里去掉；项目的输出风格顶替不了内置和你自己的风格；发行版回填进来的 MCP 和权限规则也要你在卡片上确认。
• Git 只信任登记过的项目目录；守卫部署时只认核过的源码；写 shell 启动文件、~/.cccodroid/bin 之前先问。
• 破甲检查认得更多改形写法（同形字、词间加分隔、多种外壳、多国语言直球），并收录红队新交来的整族载荷短语；日常说法照旧放行。
• 安卓侧：内部动作口令改由系统密钥库派生、不再明文存；系统文件选择器选不了应用自己的内部文件；Docs 文件访问不交出 Claude Code 的设置文件；界面每次请求先核网关身份，端口被别的应用占了不会把输入发过去。
• 组件和工具包：组件索引防回滚、缓存按签名复核；devkit.lock.json 验签；卸载只删前缀内的路径；技能包条目数有上限。

修复

• 运行链路：网关被结束时带走正在跑的 Claude；权限确认 30 分钟没人答按拒绝停下；一条事件出错不再带走整个网关；Claude 退出后管道被占也能按时收尾。
• 中断与恢复：中断卡分清是 App 更新、网关被关掉或重启、还是被系统结束；被结束的轮次恢复后不再误报「历史被改」；还没起进程就被停的给「重发」不给「继续」。
• 厂商配置：坏文件留底不覆盖；换主机清掉旧 Key；切厂商时清掉自动起名的旧型号；配置写错的字段不再当真。
• 定时任务：被系统推迟 30 分钟以内的照常补跑，不再记成错过；跑完后后台服务自己退出；后台起不了时发通知请你打开应用。
• 工具包升级不再删掉你放在 $PREFIX 里的东西；组件升级中途失败自动回滚到旧版。
• 状态文件、项目说明、账本统一原子写，读坏了留底；会话删除、搜索、导入导出、书签、Git 面板、文件与 Office 预览、终端各修了一批。
• 上游接口报错时，提示里多一句该怎么办（上下文太长、Key 不对、余额不足、限流、服务端出错等）。
• 从别的应用分享文件进来，先问一句再收；从附件栏移除时删掉拷进来的那份。
• 用手机浏览器直接打开网关地址时，提示「请在 cccodroid 应用里打开」，不再显示网关离线；网页页签换成应用图标。

行为变化

• Git 只信任登记过的项目目录；工作区外、没登记的目录不再往上级读 CLAUDE.md；项目说明里的 @ 引用不能出项目根。
• 特权免确认时长可以选，最长一周。
• 发行版改了 MCP 或权限规则，要在卡片上确认才生效；有没确认的改动时，定时任务先不运行。
• 换全局接口时，跟随全局的项目和定时任务里旧接口的模型名会被清掉。
• 指定的工作目录不在了，这一轮报错不跑，不再悄悄换到工作区。
• 「继续」那一轮要真答出来，中断卡才撤掉。
• 系统文件选择器里选本应用的内部文件会被忽略，工作区文件请用输入框的 @ 引用。
• 网关重启后，第一个请求可能先失败一次，随即自动恢复。
• 升级前发出、还挂在通知栏里的旧通知，点了不再响应。
• 新装后第一次升级，只显示当前这一版的说明。
• 分屏时正看着对话，跑完或待确认不再发通知。
• 定时任务跑完后，后台通知约一分钟内消失。
• 手动装回旧版 APK 不再当成升级，会提示文件被改动过、已按安装包还原。
• 从本地文件或暂存包装比现在旧的工具包，先要你确认。
• 技能包里文件超过 4096 个的直接拒绝。

感谢 chenshi723 对 0.6.9 做的完整审计，这一版绝大部分修复都来自这份审计；感谢红队主力 1fish26 和其他红队群友持续的破甲测试。

安装

下载 cccodroid.apk 安装（系统提示「与此版本的安卓不兼容」、装不上时，改装 cccodroid-36.apk）。首次打开先勾选要装的工具包模块（默认约 330 MB，全部约 700 MB，断点续传），再下载官方 Claude Code（约 275 MB）。

校验

• cccodroid.apk sha256：4fad67c05394a10777c4ac88f8dba2731b2b998bd7d07e7b44520a7644fe41e9
• cccodroid-36.apk（targetSdk 36）sha256：31738fcb41e9721ed3c79b8987170a946e64c84bacca05a3fc89c39aa376244c
• 配套开发工具包：devkit-2026.10.28
• 源码提交：63f70215fcf3df9fa409691b11fbd14ef92b1333

---

English

This release fixes everything in chenshi723's full audit of 0.6.9 (#180–#200) plus a privately reported security issue, and adds two more rounds of jailbreak-check hardening — over a hundred fixes in all.

Security

• "Is this the app's private directory?" is now decided by the directory's identity, so alternate spellings, symlinks and parent directories no longer get around it; projects, the file panel, Git, previews and Office all go through the same check.
• Release-edition lockdown tightened: @ imports in project instructions can't leave the project root; hooks in skill / subagent front matter are stripped from the copies; a project's output style can't replace the built-in or your own styles; MCP servers and permission rules carried in by the release edition need your confirmation on a card.
• Git only trusts registered project directories; the guard deploys only verified source; writing shell startup files or ~/.cccodroid/bin now asks first.
• The jailbreak check recognizes more disguised forms (look-alike letters, separators between words, layered wrappers, direct phrasing in several languages) and a whole family of payload phrases from the red team; everyday wording still passes.
• Android side: the internal action key is derived from the system keystore instead of stored in plain text; the system file picker can't hand back the app's own internal files; Docs file access no longer exposes Claude Code's settings files; the UI verifies the gateway on every request, so input is never sent to another app squatting on the port.
• Components and toolkit: the component index can't be rolled back and its cache is re-verified by signature; devkit.lock.json is signature-checked; uninstall only deletes paths inside the prefix; skill packages have an entry limit.

Fixes

• Run pipeline: stopping the gateway takes the running Claude with it; a permission prompt nobody answers for 30 minutes counts as denied; one bad event no longer brings the gateway down; a run still finishes on time when Claude has exited but something holds its pipes.
• Interruption and recovery: the interrupted card tells apart an app update, the gateway being closed or restarted, and the system killing it; recovered runs no longer report "history was edited"; a run stopped before it started offers "resend" instead of "continue".
• Provider settings: a broken file is kept aside instead of overwritten; changing the host clears the old key; switching providers clears the old auto-title model; malformed fields are ignored.
• Scheduled tasks: a run the system delayed by up to 30 minutes still runs instead of counting as missed; the background service exits after the run; if it can't start in the background you get a notification to open the app.
• Toolkit upgrades no longer delete your own files under $PREFIX; a component upgrade that fails halfway rolls back to the old version.
• State files, project instructions and the ledger are written atomically and kept aside when unreadable; plus batches of fixes to session delete / search / import / export, bookmarks, the Git panel, file and Office previews, and the terminal.
• When the upstream API returns an error, the message now adds what to do about it (context too long, wrong key, out of credit, rate-limited, server error, …).
• Files shared in from other apps are only saved after you confirm; removing one from the attachment bar deletes the copy.
• Opening the gateway address in a phone browser now says "Open this in the cccodroid app" instead of "gateway offline", and the browser tab shows the app icon.

Behavior changes

• Git only trusts registered project directories; outside the workspace, unregistered directories no longer pull CLAUDE.md from parent folders; @ imports in project instructions can't leave the project root.
• The "don't ask again" window for privileged commands is selectable, up to one week.
• In the release edition, changed MCP or permission rules take effect only after you confirm them on a card; scheduled tasks wait while such changes are unconfirmed.
• Switching the global provider clears the old provider's model name from projects and scheduled tasks that follow the global setting.
• If the chosen working directory no longer exists, the run fails with an error instead of quietly running in the workspace.
• The interrupted card goes away only after the "continue" run actually answers.
• Picking the app's own internal files in the system file picker is ignored; use @ in the input box for workspace files.
• After the gateway restarts, the first request may fail once and then recover by itself.
• Old notifications posted before the upgrade no longer respond when tapped.
• On the first upgrade after a fresh install, only the current version's notes are shown.
• In split screen, while you're looking at the chat, finished runs and pending prompts no longer send notifications.
• After a scheduled run, the background notification disappears within about a minute.
• Manually installing an older APK is no longer treated as an upgrade; you're told the files were changed and restored from the package.
• Installing an older toolkit from a local file or staged package asks you first.
• Skill packages with more than 4096 files are rejected.

Thanks to chenshi723 for the complete audit of 0.6.9 — most of this release comes from it — and to red-team lead 1fish26 and the other red-team members for their ongoing jailbreak testing.

Install

Download and install cccodroid.apk (if Android says it isn’t compatible and won’t install it, use cccodroid-36.apk instead). On first launch you pick toolchain modules (about 330 MB by default, about 700 MB for all, resumable), then the official Claude Code is downloaded (about 275 MB).

Verification

• cccodroid.apk sha256: 4fad67c05394a10777c4ac88f8dba2731b2b998bd7d07e7b44520a7644fe41e9
• cccodroid-36.apk (targetSdk 36) sha256: 31738fcb41e9721ed3c79b8987170a946e64c84bacca05a3fc89c39aa376244c
• Matching toolchain: devkit-2026.10.28
• Source commit: 63f7021