Compare commits

...
8 Commits
Author SHA1 Message Date
n0tst3v3andClaude Opus 5 60feffc256 feat(track): record which devices are paired, and report it on upload
The app knew about bonded devices only in passing - syncPairedDevices marked
them tracked and threw the bond state away - so nothing downstream could tell
a paired device from one merely seen. Adds devices.paired (schema 17), set
from ACTION_BOND_STATE_CHANGED and from the bonded list at startup, and sends
it as a `paired` column on every uploaded row.

The flag is its own column rather than inferred from is_tracked, which answers
a different question: a device can be tracked without ever having been paired.

syncPairedDevices clears the flag before re-asserting it from getBondedDevices.
A device unpaired while the service was dead never broadcast BOND_NONE, so the
bonded list is the only reliable answer at startup, and without the clear such
a device would stay marked paired forever.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 18:03:11 -06:00
n0tst3v3andClaude Opus 5 07504555b6 build: stop tracking app/build, which shadowed new classes in AIDE
.gitignore has listed /app/build since it was written, but 187 files under it
were already tracked by then, and ignore rules do not apply to tracked files.
So every `git reset --hard origin/main` restored a set of .class files built on
18 August into app/build/bin/classesdebug/.

Those stale classes cover com.wytehat.btlogger and contain no
DeviceRegistration, SecureStore or DeviceIdentity. AIDE resolved the package
against them rather than against the sources beside them and reported
"Unknown entity 'DeviceRegistration'" in ServerUploader - code that compiles
clean against android.jar.

The committed app/build/gen/R.java is the same problem one step along: it
predates the sort_button id, so anything compiling against it fails on a
button that has been in res/layout/main.xml for days.

Removed from the index only. The directory stays on disk, AIDE keeps its
incremental build, and it will not travel between machines again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 17:20:04 -06:00
n0tst3v3andClaude Opus 5 320b4b2825 feat(upload): register for a per-device key, and fix the upload host
Registration
------------
On first upload the app trades the bootstrap token and its device id at
/api/v1/register-device for a key belonging to this device alone, keeps it in
the Keystore-encrypted store, and uses it from then on. The bootstrap token is
never sent again.

The only secret shipped in the APK now grants enrolment and nothing else.
Extracting it lets someone register a device; it does not let them read points
or upload as a phone that is already enrolled.

A 401 on upload means the key was revoked or rotated elsewhere. The uploader
forgets it, registers again and retries once, rather than leaving the user to
find the Server dialog.

The registration URL is derived from the configured upload URL, so pointing
the app at another server moves both together.

Keystore storage
----------------
The AES-GCM/Keystore code moves out of DeviceIdentity into SecureStore, now
that there are two secrets to keep rather than one. Below API 23 there is no
Keystore AES: SecureStore refuses to write instead of silently storing
secrets in the clear, and both callers keep their value in memory for the
process lifetime.

Upload host
-----------
DEFAULT_URL moves to com.org.bz. bt.justbug.me resolves elsewhere and has no
certificate on the proxy, so every upload there died in the TLS handshake with
TLSV1_ALERT_UNRECOGNIZED_NAME before a request was sent. Installs that already
saved the old default are migrated across on read; a URL the user chose is
left alone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 17:16:08 -06:00
n0tst3v3andClaude Opus 5 97c1e48e91 feat(upload): identify this device to the ingestion server
Sends X-Device-ID on every upload so the server can attribute sightings to the
phone that recorded them; it now rejects uploads without one.

Prefers Settings.Secure.ANDROID_ID: it survives reinstalls, costs nothing to
read and needs no permission. It is not always trustworthy though - null
before first boot completes, and a known family of builds all report the same
constant - so those readings are rejected outright rather than repaired, and a
random UUID is generated and kept instead. Guessing at a malformed reading
would produce an identifier that changes between reads, which is worse than
falling back.

The fallback UUID is stored encrypted under an AES-GCM key held in the
AndroidKeyStore, so the key material never enters the app process and cannot
be lifted out of a backup or off a rooted device. androidx.security's
EncryptedSharedPreferences does exactly this, but it needs AndroidX and API
23; this project builds in AIDE with no dependency resolution and minSdk 14,
so the same construction is done directly against the platform Keystore. The
Keystore calls sit behind SDK_INT checks and are never resolved below 23,
where the identifier is kept in memory for the process lifetime rather than
written out in the clear.

A stored value that will not decrypt - key cleared, or restored onto another
device - yields a new identity rather than a crash. The old one is genuinely
unrecoverable at that point.

Upload errors now surface the server's "error" field instead of the raw JSON
envelope, so a rejected device ID reads as a sentence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 16:25:56 -06:00
n0tst3v3andClaude Opus 5 308d63b8d8 feat(map): upload recorded sightings to the ingestion server
Adds ServerUploader plus an "Upload to Server" button and a Server…
settings dialog in the map filter panel.

The uploader builds a CSV of every device fix and every recorded history
point - the history rows are the interesting ones, since they carry each
device's location trail - and POSTs it as multipart/form-data with the API
key in X-API-Key. Timestamps are written ISO-8601 in UTC, because sending
local time would shift every point by the phone's offset.

It uploads the whole database every time rather than tracking what was sent
before. The server deduplicates on (mac, timestamp, latitude, longitude), so
re-sending is idempotent: anything it already holds comes back counted as a
duplicate instead of stored twice. Keeping the client dumb is what makes a
failed or partial upload safe to simply retry, with no sync state to get out
of step.

Network work runs on a background thread and the result is delivered on the
main thread; the button disables itself while a run is in flight and the
panel shows the returned metrics.

The URL and key default to the deployment at bt.justbug.me and are editable
in the dialog, stored in the server_settings preferences.

Verified against the real server: the exact CSV this emits - including empty
RSSI cells for history rows and a device name containing a comma - ingests as
4 points, and re-uploading the same file returns 4 duplicates and 0 added.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 11:26:29 -06:00
n0tst3v3andClaude Opus 5 6808e88599 feat(map): use Font Awesome link icons for the point events
Swaps the emoji for Font Awesome Free 6.5.2 "link" and "link-slash"
(solid), inlined as SVG paths instead of loaded from a CDN. Pulling
the icon font would be a ~75KB network download for two glyphs, and
the popups need to render whether or not that request succeeds.

Inline SVG also takes a fill colour, so connected draws green and
dropped draws red, and it renders identically regardless of the
device's emoji font - 💔 was a stand-in because the literal broken
chain (U+26D3 U+FE0F U+200D U+1F4A5) is a 2023 addition that shows
as a blank box on older Android.

Both paths verified byte-for-byte against upstream.

Icons: CC BY 4.0, Copyright 2024 Fonticons, Inc.
https://fontawesome.com/license/free

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 10:48:48 -06:00
n0tst3v3andClaude Opus 5 f16efce66e perf(scanner): stop redoing everything on every advertisement, plus map point events
Yes, the scanner was duplicating. refreshCategoryOptions(),
updateRadar() and pairedAdapter.notifyDataSetChanged() ran from
acceptSignal on every advertisement AND from pruneTask once a second
- the same three calls either way.

Worse, the whole persist path ran per advertisement, and ScanCallback
is delivered on the main looper: a hex dump of the advertisement,
lookupCompany(), get(), lookupOui(), then telemetry(),
setDetectedCategory(), recordObservation() and setVendor(). Eight
database operations on the UI thread per beacon, at
SCAN_MODE_LOW_LATENCY, times every transmitter in range. The radar
sweep re-posts itself every 33ms and was competing for that thread,
which is why it dragged.

A device already on the radar now only gets its RSSI and last-seen
stamp refreshed until PERSIST_INTERVAL_MS (3s) is up. A device's
first sighting still takes the full path and refreshes at once.

The radar view also allocated per frame at 30fps: a six-stop
RadialGradient plus two arrays, and a fresh ArrayList and Comparator
for the target sort. Both reused now. setTargets no longer
invalidates while scanning, since onDraw already re-posts itself.
Left setLayerType(SOFTWARE) alone - setShadowLayer only works on text
under hardware acceleration, so removing it would drop the ring glow.

Separately, history points now say why they exist. location_history
had no event column, so schema 16 adds one; connected() and
disconnected() stamp it and a plain position refresh leaves it null.
The popup shows a linked or broken-link line for the two states and
stays quiet for older rows that predate the column.

History points also render as the device's own marker at half size
rather than a plain circle, sharing one divIcon per device so a long
trail does not build a DOM node per point.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 10:27:15 -06:00
n0tst3v3andClaude Opus 5 0f01b836c6 fix(map): un-clip the date buttons, link every popup's coordinates
Date/time buttons carry a two-line label ("From\nAug 19, 2026") but
sat in a fixed dp(40) row, so the date line was cut off and only
From/To was readable. My own compaction pass tightened that row from
48dp to 40dp and made it worse. They now measure wrap-content, at
11sp, with all-caps off (Buttons upper-case by default, which is
what pushed the date past the edge) and 4dp side padding instead of
the stock ~16dp.

Historical, normalized and removed points now render their
coordinates as the same tappable geo: link the live device popup
already used - MapActivity's WebViewClient hands geo: to the maps
app, so all four popups behave the same. Factored into gpsLink().

Drops the "View: Normalized" line from the device popup; the filter
panel already says which view is active.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 09:39:38 -06:00
199 changed files with 1671 additions and 251 deletions
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.

Some files were not shown because too many files have changed in this diff Show More