@@ -4,18 +4,29 @@ on:
   push:
   pull_request:
 
+# Read-only token: this workflow builds and tests, it never writes to the repo
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      # Actions pinned to full commit SHAs (tag in the comment): a moved tag cannot change what runs here
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Fails if gradle-wrapper.jar is not an official Gradle one, so a PR cannot slip in a tampered wrapper
+      - uses: gradle/actions/wrapper-validation@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: 17
       - run: chmod +x gradlew
       - run: ./gradlew test assembleDebug
-      - uses: actions/upload-artifact@v4
+      # Only for the repo's own pushes: a pull request's build is never offered as a download here
+      - if: github.event_name == 'push'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: sugarglass-debug
           path: app/build/outputs/apk/debug/app-debug.apk
@@ -33,8 +33,8 @@ What it deliberately does **not** do: alarms, treatments, uploading, statistics.
 
 ## Install
 
-1. On your phone, [download the APK](https://github.com/federicomameli1/sugarglass/releases/latest/download/sugarglass.apk) and open it. Android will ask you to **allow installing apps** from your browser or file manager the first time: allow it, then tap **Install**. If Google Play Protect warns that the app comes from an unknown developer, that is because it isn't on the Play Store: tap **More details → Install anyway**. Updates install the same way, over the old version, and keep your settings.
-2. Open Sugarglass, enter your Nightscout address and, if your site is not public, a token (recommended, with the `readable` role) or your API secret. Tap **Save and start**. A Nightscout on your home network (`http://192.168.…`) works too.
+1. On your phone, [download the APK](https://github.com/federicomameli1/sugarglass/releases/latest/download/sugarglass.apk) and open it. Android will ask you to **allow installing apps** from your browser or file manager the first time: allow it, then tap **Install**. If Google Play Protect warns that the app comes from an unknown developer, that is because it isn't on the Play Store: tap **More details → Install anyway**. Updates install the same way, over the old version, and keep your settings. If an update ever refuses to install over the app you have ("package conflicts"), **don't uninstall**: it may not be a genuine build. Check it as described under [Is it the real one?](#is-it-the-real-one) and open an issue.
+2. Open Sugarglass, enter your Nightscout address and, if your site is not public, a token (recommended, with the `readable` role) or your API secret. Tap **Save and start**. A Nightscout on your home network (`http://192.168.…`) works too, with a token rather than the API secret.
 3. Allow notifications and let it **ignore battery optimisation**: without that Android may stop it.
 4. Long-press the home screen and add the Sugarglass widget.
 
@@ -53,13 +53,24 @@ Tested on HyperOS only so far; if the steps for your phone differ, please open a
 
 Sugarglass talks to your Nightscout site and nothing else. Your address and token stay on your phone. No analytics, no ads, no account.
 
-- Your token only travels encrypted: plain `http://` is accepted just for addresses on your home network (like `192.168.x.x` or `nightscout.local`), everything else needs `https://`.
+- Your credentials only travel encrypted: plain `http://` is accepted just for addresses on your home network (like `192.168.x.x` or `nightscout.local`), and there only with a `readable` token, never the API secret. Everything else needs `https://`. Addresses on the phone itself (`localhost`) are refused, since any app on it could pretend to be Nightscout.
+- The saved token is never shown again, and stays with the site it was given to: change the address and you type it again.
 - If your site redirects somewhere else, Sugarglass stops and tells you the new address instead of following it with your credentials.
 - The settings are left out of Android's cloud backups and phone-to-phone transfers, so the token never leaves the phone; on a new phone you enter it again.
 - Prefer a token with only the `readable` role over the API secret: it can read your data but not change anything.
 
 Permissions: internet (Nightscout), notifications, foreground service (to stay alive), start at boot, and the request to be excluded from battery optimisation.
 
+## Is it the real one?
+
+Every Sugarglass release is signed with the same key. Its certificate's SHA-256 fingerprint is:
+
+```
+0C:56:17:BC:89:17:34:81:82:9D:EF:19:A9:E8:EC:06:09:C0:D3:92:84:D4:06:4F:25:78:0C:DB:C1:45:1A:86
+```
+
+Check a downloaded APK with `apksigner verify --print-certs sugarglass.apk`, or on the phone with an app like AppVerifier. If it doesn't match, don't install it.
+
 ## Not a medical device
 
 Sugarglass is a hobby project and is not a medical device. It can show old, wrong or missing data. **Do not use it to make treatment decisions**; always check your CGM app or a meter.
@@ -72,7 +83,7 @@ JDK 17 and the Android SDK (platform 34).
 ./gradlew test assembleDebug
 ```
 
-The debug build installs next to the real app as **Sugarglass debug**, and its settings have a Debug page with fake readings: pick any value, trend or a stale reading and see the widget, notification and status bar with it. While fake readings are on, everything showing them says **DEMO**. A prebuilt one is attached to each release.
+The debug build installs next to the real app as **Sugarglass debug**, and its settings have a Debug page with fake readings: pick any value, trend or a stale reading and see the widget, notification and status bar with it. While fake readings are on, everything showing them says **DEMO**. It is not published: it is debuggable and signed with a development key, so build it yourself (`./gradlew assembleDebug`) or take the one from the latest CI run.
 
 Release builds are signed with a key kept outside the repo: create `keystore.properties` in the project root with `storeFile`, `storePassword`, `keyAlias` and `keyPassword`, then `./gradlew assembleRelease`.
 
 
@@ -14,8 +14,8 @@ android {
         applicationId 'io.github.federicomameli1.sugarglass'
         minSdk 26
         targetSdk 34
-        versionCode 4
-        versionName '1.1.1'
+        versionCode 5
+        versionName '1.1.2'
     }
 
     signingConfigs {
 
@@ -10,6 +10,7 @@
 
     <application
         android:allowBackup="false"
+        android:taskAffinity=""
         android:dataExtractionRules="@xml/data_extraction_rules"
         android:fullBackupContent="false"
         android:icon="@mipmap/ic_launcher"
 
@@ -10,6 +10,8 @@ final class Glucose {
 
     static final long WINDOW_MS = 3 * 60 * 60_000L; // fetched from Nightscout and drawn
     static final long STALE_MS = 15 * 60_000L;
+    static final long HIDE_MS = 5 * 60_000L;        // the widget stops showing a value this long without a new one
+    static final int LOW = 39, HIGH = 401;          // Nightscout's codes for below and above the sensor's range
     static final long GAP_MS = 10 * 60_000L;        // the graph line breaks across longer gaps
     static final int MIN_SPAN = 80;                 // mg/dl, floor on the graph's vertical range
     static final double MGDL_PER_MMOL = 18.0182;
@@ -44,8 +46,18 @@ static final class Config {
             this.urgentHigh = urgentHigh;
         }
 
+        /**
+         * In order, and each in a plausible band: a dropped or extra digit, or mg/dl values typed with
+         * mmol/L selected, would otherwise silently turn the urgent colours off.
+         */
         boolean valid() {
-            return 0 < urgentLow && urgentLow < low && low < high && high < urgentHigh;
+            return urgentLow < low && low < high && high < urgentHigh
+                    && between(urgentLow, 40, 90) && between(low, 55, 120)
+                    && between(high, 120, 300) && between(urgentHigh, 150, 400);
+        }
+
+        private static boolean between(int v, int min, int max) {
+            return v >= min && v <= max;
         }
     }
 
@@ -66,6 +78,8 @@ static String arrow(String direction) {
     }
 
     static String value(int mgdl, Config c) {
+        if (mgdl <= LOW) return "LOW";   // below what the sensor reads: not a measured 39
+        if (mgdl >= HIGH) return "HIGH";
         return c.mmol ? String.format(Locale.getDefault(), "%.1f", mgdl / MGDL_PER_MMOL) : String.valueOf(mgdl);
     }
 
@@ -80,7 +94,7 @@ static String delta(List<Reading> newestFirst, Config c) {
             past = r;
             if (ago >= 5 * 60_000) break;
         }
-        if (past == null) return "";
+        if (past == null || clamped(now) || clamped(past)) return ""; // LOW/HIGH have no real slope
         double mgdl = (now.sgv - past.sgv) * 5 * 60_000.0 / (now.date - past.date);
         if (!c.mmol) {
             long d = Math.round(mgdl);
@@ -90,6 +104,10 @@ static String delta(List<Reading> newestFirst, Config c) {
         return (tenths > 0 ? "+" : "") + String.format(Locale.getDefault(), "%.1f", tenths / 10.0);
     }
 
+    private static boolean clamped(Reading r) {
+        return r.sgv <= LOW || r.sgv >= HIGH;
+    }
+
     static long minutesAgo(Reading r, long now) {
         return Math.max(0, (now - r.date) / 60_000);
     }
@@ -113,7 +131,8 @@ static int[] scale(List<Reading> r, Config c, int[] fixed) {
 
     /**
      * Whether the app will send credentials to this Nightscout address: https anywhere, plain http only
-     * on the home network, where nothing crosses the internet unencrypted.
+     * on the home network, where nothing crosses the internet unencrypted. Not the phone itself: any app
+     * on it could listen on a local port and serve made-up readings.
      */
     static boolean safeAddress(String url) {
         URI u;
@@ -126,10 +145,72 @@ static boolean safeAddress(String url) {
         String scheme = u.getScheme().toLowerCase(Locale.ROOT), host = u.getHost().toLowerCase(Locale.ROOT);
         if (scheme.equals("https")) return true;
         if (!scheme.equals("http")) return false;
-        return host.equals("localhost") || host.endsWith(".local") || host.endsWith(".lan")
-                || host.endsWith(".home.arpa") || privateIPv4(host)
-                // IPv6: unique local (fc00::/7), link-local and loopback
-                || host.startsWith("[fc") || host.startsWith("[fd") || host.startsWith("[fe80") || host.equals("[::1]");
+        return host.endsWith(".local") || host.endsWith(".lan") || host.endsWith(".home.arpa") || privateIPv4(host)
+                // IPv6: unique local (fc00::/7) and link-local
+                || host.startsWith("[fc") || host.startsWith("[fd") || host.startsWith("[fe80");
+    }
+
+    /** Nightscout access tokens look like "name-0123456789abcdef"; anything else is the API secret. */
+    static boolean isToken(String secret) {
+        return secret.matches("[\\w-]+-[0-9a-f]{16}");
+    }
+
+    /**
+     * Whether this secret may go to this address. Over plain http only a token (give it the read-only
+     * role) or nothing: the API secret is admin access, and even a home network can be someone else's
+     * when the phone joins a hotel or café Wi-Fi with the same addresses.
+     */
+    static boolean secretAllowed(String url, String secret) {
+        return secret.isEmpty() || isToken(secret) || url.toLowerCase(Locale.ROOT).startsWith("https://");
+    }
+
+    /** An address as typed, split into a clean site address and any credential that was inside it. */
+    static final class Address {
+        final String url, secret;
+
+        Address(String url, String secret) {
+            this.url = url;
+            this.secret = secret;
+        }
+    }
+
+    /**
+     * Cleans a typed or pasted address: https:// when no scheme is given, the credential moved out of
+     * "https://SECRET@site" or "?token=", query and fragment dropped, a trailing /api/v1 removed.
+     * Returns null when it is not an address at all.
+     */
+    static Address cleanAddress(String typed) {
+        String s = typed.trim();
+        if (s.isEmpty()) return new Address("", "");
+        if (!s.contains("://")) s = "https://" + s;
+        URI u;
+        try {
+            u = new URI(s);
+        } catch (URISyntaxException e) {
+            return null;
+        }
+        if (u.getScheme() == null || u.getHost() == null) return null;
+        String secret = u.getUserInfo() == null ? "" : u.getUserInfo();
+        if (u.getQuery() != null) {
+            for (String part : u.getQuery().split("&")) {
+                if (part.startsWith("token=")) secret = part.substring(6);
+            }
+        }
+        String path = u.getPath() == null ? "" : u.getPath().replaceAll("/+$", "");
+        if (path.toLowerCase(Locale.ROOT).endsWith("/api/v1")) path = path.substring(0, path.length() - 7);
+        String url = u.getScheme().toLowerCase(Locale.ROOT) + "://" + u.getHost()
+                + (u.getPort() == -1 ? "" : ":" + u.getPort()) + path;
+        return new Address(url, secret);
+    }
+
+    /** Scheme, host and port: the stored secret only stays with the site it was given to. */
+    static String origin(String url) {
+        try {
+            URI u = new URI(url);
+            return (u.getScheme() + "://" + u.getHost() + ":" + u.getPort()).toLowerCase(Locale.ROOT);
+        } catch (URISyntaxException e) {
+            return "";
+        }
     }
 
     private static boolean privateIPv4(String host) {
@@ -141,14 +222,19 @@ private static boolean privateIPv4(String host) {
             o[i] = Integer.parseInt(parts[i]);
             if (o[i] > 255) return false;
         }
-        return o[0] == 10 || o[0] == 127 || (o[0] == 172 && o[1] >= 16 && o[1] <= 31)
+        return o[0] == 10 || (o[0] == 172 && o[1] >= 16 && o[1] <= 31)
                 || (o[0] == 192 && o[1] == 168) || (o[0] == 169 && o[1] == 254);
     }
 
     static boolean stale(Reading r, long now) {
         return now - r.date > STALE_MS;
     }
 
+    /** The widget hides the value once no new reading has come for a while, until one does. */
+    static boolean hidden(Reading r, long now) {
+        return now - r.date > HIDE_MS;
+    }
+
     static int band(int sgv, Config c) {
         if (sgv < c.urgentLow || sgv > c.urgentHigh) return URGENT;
         if (sgv < c.low || sgv > c.high) return OUT_OF_RANGE;