2 Commits

Author	SHA1	Message	Date
Krzysztof kuhy Rudnicki	01778d4f05	Put focus_owner on the shared palette, and stop curfew hiding todo ... focus_owner had drifted entirely off the frozen palette -- a cool blue #5B9DD9 accent on a #1B1D21 field -- while its own doc comment claimed it matched the other com.kuhy.* apps. It did not: every other app is on the gold #B8862E. lib/theme.dart now aliases design_system-v0.1.0, so the ~80 call sites keep reading the same names but the values come from one place and cannot drift again. The six constants duplicated verbatim in main.dart are deleted -- the old comment said they had been "lifted out" into theme.dart, but the originals were never removed, so there were two copies of a wrong palette. Separately: dev.kuhy.todo was in the day allowlist but not the night one, so a release build installed at 23:07 was hidden by the enforcer ~80ms later. It is now in night_allowed_packages. That is a deliberate loosening of the curfew's "answer the phone, reach a bank, handle an emergency" rule -- writing an idea down at night is the one thing that app does -- and it is recorded as such in both config files. Deploying the shell mirror of that list surfaced two pre-existing latent bugs in phone_focus_mode/config.sh: comment lines inside the double-quoted WHITELIST string referenced the night list (defined ~70 lines below) and an ALWAYS_BLOCKED that is never defined anywhere, so under set -u the entire deploy aborted with "unbound variable". Both are now written plainly, with a note saying why a dollar sign or a double quote must never appear inside that string. Verified on the Pixel 6a: analyze clean, 94/94 tests, colour literals 15 -> 2 (both Colors.transparent sentinels), and an ad-hoc assertion confirming kAccent is really ffb8862e rather than merely compiling. The installed APK shows CURFEW and the action links in gold, "Allowed apps 29 (16 at night)" (was 15) and "restored 1"; todo then launched and rendered at 23:19, inside the curfew window, with all 108 notes intact. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XS1m7b1piBtAL22USLW6jL	2026-08-14 23:21:06 +02:00
Krzysztof kuhy Rudnicki	f636d2b21b	Make focus policy and blocklist usable without root; fix workout CDN unblock ... phone_focus_mode is built for a rooted phone: the hosts layer is a read-only bind mount over /system/etc/hosts, chosen so that even root-in-a-terminal cannot overwrite it. None of that ports to a stock locked device. This splits out the parts that are device-independent so one policy can drive both. python_pkg/focus_policy parses config.sh rather than copying it, so the shell config stays the source of truth and the two cannot drift. It rejects the shipped REDACTED_* coordinate placeholder instead of defaulting to (0,0), which would move "home" to the Atlantic and quietly disable the location gate. blocklist.py converts the hosts file to domains for a DoT resolver or a local VpnService. Three properties of the real 194k-line file make the obvious parser wrong, and all three are handled: generate_hosts_file.sh *comments out* deliberate unblocks rather than deleting them, so stripping '#' re-blocks facebook/messenger/linkedin/4chan; the StevenBlack header carries loopback and IPv6 housekeeping that would blackhole localhost; and ~1060 upstream annotation tokens ('#[adware.zeno]', '"spam') render as address=/"spam/, which makes dnsmasq refuse to start -- taking DNS down rather than blocking anything. Verified with dnsmasq --test over all 185681 generated domains. strip_workout_hosts.py had the same class of bug on the live rooted phone: exact set membership meant the allowlisted googlevideo.com never matched the dynamic r*---sn-*.googlevideo.com hosts YouTube actually streams from, so the workout unblock was only partly working. Now suffix-matched (17 lines stripped, was 14). The three new tests were checked against the original code in a throwaway worktree; two of them fail there, so they pin the fix rather than passing vacuously. focus_owner is a device-owner app that deliberately does nothing yet. It ships clearDeviceOwnerApp() implemented and tested first, because dpm remove-active-admin does not work on a device owner: an app that locks the device down before proving it can let go leaves a soft-brick recoverable only through fastboot on a locked bootloader. Built, installed and launched on the Pixel 6a; dumpsys afterwards confirms Device Owner Type -1 and no user restrictions, i.e. the phone is unchanged. Measured while scoping this, and not yet reflected in any enforcement code: on Android 16 both pm suspend and pm disable-user are cleared by a reboot, so shell-level app blocking is per-session only. setApplicationHidden is assumed to persist under Device Owner but is untested. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AwepyL5Lxs5QKbKkMpxxxL	2026-08-05 09:15:02 +02:00