johannesjo
diff --git a/‎.github/workflows/build.yml‎
Lines changed: 33 additions & 0 deletions b/‎.github/workflows/build.yml‎
Lines changed: 33 additions & 0 deletions
diff --git a/‎.github/workflows/play-internal.yml‎
Lines changed: 3 additions & 0 deletions b/‎.github/workflows/play-internal.yml‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎.github/workflows/release.yml‎
Lines changed: 3 additions & 0 deletions b/‎.github/workflows/release.yml‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎README.md‎
Lines changed: 6 additions & 3 deletions b/‎README.md‎
Lines changed: 6 additions & 3 deletions
diff --git a/‎android/app/src/main/java/com/minded/minded/MainActivity.kt‎
Lines changed: 94 additions & 0 deletions b/‎android/app/src/main/java/com/minded/minded/MainActivity.kt‎
Lines changed: 94 additions & 0 deletions
diff --git a/‎android/app/src/main/java/com/minded/minded/MainActivityJavaScriptInterface.kt‎
Lines changed: 26 additions & 0 deletions b/‎android/app/src/main/java/com/minded/minded/MainActivityJavaScriptInterface.kt‎
Lines changed: 26 additions & 0 deletions
diff --git a/‎android/app/src/main/java/com/minded/minded/MyAccessibilityService.kt‎
Lines changed: 14 additions & 0 deletions b/‎android/app/src/main/java/com/minded/minded/MyAccessibilityService.kt‎
Lines changed: 14 additions & 0 deletions
diff --git a/‎android/app/src/main/java/com/minded/minded/detection/DetectionHealth.kt‎
Lines changed: 34 additions & 0 deletions b/‎android/app/src/main/java/com/minded/minded/detection/DetectionHealth.kt‎
Lines changed: 34 additions & 0 deletions
@@ -42,6 +42,9 @@ jobs:
       - name: Lint
         run: npm run lint
 
+      - name: Typecheck
+        run: npm run typecheck
+
       - name: Test Unit
         run: npm test
 
@@ -54,3 +57,33 @@ jobs:
         with:
           name: minded-download
           path: extension/minded.zip
+
+  android-unit-tests:
+    # The Android host has its own JVM test suite (decision engine, detection
+    # confidence, widget copy rules, sync-data serialization). It never ran in
+    # CI before, so a regression there only surfaced on a device. Pure JVM
+    # tests, so no emulator and no web bundle are needed (assets/ only holds
+    # a .gitkeep; the WebView bundle is a build-time artifact).
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: ./android
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: gradle
+      - name: Android unit tests
+        run: ./gradlew :app:testDebugUnitTest --console=plain
+      - name: Upload test reports
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: android-unit-test-reports
+          path: android/app/build/reports/tests/
@@ -87,6 +87,9 @@ jobs:
           # Timestamp codes are opaque; record code -> commit so a versionCode
           # seen in the Play Console can be traced back to a SHA.
           echo "internal versionCode \`$ANDROID_VERSION_CODE\` ← \`$GITHUB_SHA\`" >> "$GITHUB_STEP_SUMMARY"
+          # The JVM unit suite gates the artifact: a red decision-engine or
+          # widget-copy test must never ship (#151).
+          ./gradlew :app:testDebugUnitTest --console=plain
           ./gradlew bundleRelease
       - name: Upload AAB as workflow artifact
         if: always()
 
@@ -111,6 +111,9 @@ jobs:
           # Timestamp codes are opaque; record code -> tag/commit so a
           # versionCode seen in the Play Console can be traced back.
           echo "production versionCode \`$ANDROID_VERSION_CODE\` ← \`$GITHUB_REF_NAME\` (\`$GITHUB_SHA\`)" >> "$GITHUB_STEP_SUMMARY"
+          # The JVM unit suite gates the artifact: a red decision-engine or
+          # widget-copy test must never ship (#151).
+          ./gradlew :app:testDebugUnitTest --console=plain
           ./gradlew bundleRelease
       - name: Upload AAB as workflow artifact
         if: always()
 
@@ -102,8 +102,10 @@ npm run buildDroid # production android assets
 
 ```bash
 cd extension
-npm test           # jest
-npm run lint       # eslint --fix
+npm test              # jest
+npm run typecheck     # tsc --noEmit (CI runs this too)
+npm run lint          # eslint --fix
+npm run test:android  # the Android host's JVM unit tests (needs the Android SDK)
 ```
 
 Run a single test: `npx jest path/to/test.spec.ts`.
@@ -113,11 +115,12 @@ Run a single test: `npx jest path/to/test.spec.ts`.
 ```
 extension/      Browser-extension build (Vite + CRXJS) and shared SolidJS UI
 android/        Native Android host (Kotlin) wrapping the shared web UI
-landing-page/   Marketing site (Astro) at minded.today
 common/         Shared assets (logos, icons)
 docs/           Architecture and design notes
 ```
 
+The marketing site lives in its own repository.
+
 The web UI under `extension/src/shared/` is reused across all platforms. Platform-specific data access goes through the **dataInterface pattern** documented in [`CLAUDE.md`](./CLAUDE.md) - that file is the best entry point for understanding the architecture.
 
 > **iOS note:** iOS ships as a deliberately minimal **widget-only variant** - the companion sun as a Home Screen widget (`extension/ios/App/MindedWidget/`), presence + invitation only. It does *not* attempt the forced intervention/overlay, which is the wrong shape for iOS (see [`docs/ios-platform-fit.md`](./docs/ios-platform-fit.md)). New *intervention* features still target the browser extension and Android. iOS builds and TestFlight ship from CI with no local Mac - see [`RELEASING.md`](./RELEASING.md).
 
@@ -1,5 +1,6 @@
 package com.minded.minded
 
+import com.minded.minded.detection.DetectionHealth
 import com.minded.minded.data.SharedPreferenceService
 import android.annotation.SuppressLint
 import android.content.Intent
@@ -10,6 +11,7 @@ import android.provider.Settings
 import android.util.Log
 import android.view.ViewGroup
 import android.webkit.ValueCallback
+import android.webkit.WebChromeClient
 import android.webkit.WebResourceRequest
 import android.webkit.WebSettings
 import android.webkit.WebView
@@ -18,6 +20,7 @@ import androidx.activity.OnBackPressedCallback
 import androidx.activity.SystemBarStyle
 import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.fillMaxSize
@@ -41,6 +44,7 @@ import com.minded.minded.util.isAccessibilityServiceEnabled
 import com.minded.minded.util.isDarkModeNow
 import com.minded.minded.widget.WidgetPrompts
 import kotlinx.coroutines.launch
+import java.io.File
 
 
 enum class MissingCapability {
@@ -59,6 +63,63 @@ class MainActivity : AppCompatActivity() {
     private val logTag = "MainActivity"
     private val baseUrl = "file:///android_asset/web/src/android/main/index.html"
 
+    // Answer-journal backup, native half (see extension util/fileTransfer.ts).
+    // "Save a copy": the web layer's text is parked in a cache file while the
+    // system "save as" sheet (another process) is in front, then copied to the
+    // document the user chose. A *file*, not a field: if this process is
+    // reclaimed behind the picker the activity is recreated and the result still
+    // arrives - a field would be null by then and the picker-created document
+    // would be left empty, the worst outcome for a backup. Writes go through
+    // "wt" so a re-chosen existing document is truncated, never appended to.
+    private val pendingSaveTextFile: File
+        get() = File(cacheDir, "journal-export.json")
+    private val createDocumentLauncher = registerForActivityResult(
+        ActivityResultContracts.CreateDocument("application/json"),
+    ) { uri ->
+        isSaveTextFilePending = false
+        val source = pendingSaveTextFile
+        try {
+            if (uri == null || !source.exists()) return@registerForActivityResult
+            contentResolver.openOutputStream(uri, "wt")?.use { out ->
+                source.inputStream().use { it.copyTo(out) }
+            } ?: Log.e(logTag, "saveTextFile: provider gave no stream for $uri")
+        } catch (e: Exception) {
+            Log.e(logTag, "saveTextFile: writing the document failed", e)
+        } finally {
+            source.delete()
+        }
+    }
+    private var isSaveTextFilePending = false
+
+    // "Bring a copy back": a plain <input type="file"> in the WebView lands in
+    // WebChromeClient.onShowFileChooser, which opens the system document picker
+    // and hands the chosen URI back to the WebView - so the web side reads it
+    // like on any browser.
+    private var pendingFileChooser: ValueCallback<Array<Uri>>? = null
+    private val openDocumentLauncher = registerForActivityResult(
+        ActivityResultContracts.OpenDocument(),
+    ) { uri ->
+        pendingFileChooser?.onReceiveValue(if (uri == null) null else arrayOf(uri))
+        pendingFileChooser = null
+    }
+
+    private fun saveTextFile(filename: String, content: String) {
+        // JS-bridge calls arrive off the main thread; launchers want it.
+        runOnUiThread {
+            // A second tap while the sheet is up would stack a second picker
+            // whose cancel wipes the first one's payload; ignore it instead.
+            if (isSaveTextFilePending) return@runOnUiThread
+            try {
+                pendingSaveTextFile.writeText(content, Charsets.UTF_8)
+            } catch (e: Exception) {
+                Log.e(logTag, "saveTextFile: staging the export failed", e)
+                return@runOnUiThread
+            }
+            isSaveTextFilePending = true
+            createDocumentLauncher.launch(filename)
+        }
+    }
+
     companion object {
         /** Intent extra naming a hash route to open on launch (allow-listed below). */
         const val EXTRA_LAUNCH_ROUTE = "launch_route"
@@ -229,9 +290,37 @@ class MainActivity : AppCompatActivity() {
                                     this,
                                     ::onMissingCapabilityTap,
                                     ::getMissingCapabilities,
+                                    getDetectionHealthI = ::getDetectionHealth,
+                                    onSaveTextFileI = ::saveTextFile,
                                     safeAreaInsets = safeAreaInsetsHolder,
                                 )
                                 addJavascriptInterface(jsInterface, jsInterfaceNameProp)
+                                // Note: installing any WebChromeClient also
+                                // makes the WebView show JS alert()/confirm()
+                                // as native dialogs (without one Chromium
+                                // drops them silently). The only alert the web
+                                // layer raises here is the honest save-failure
+                                // notice (handleDataError, alertUser) - which
+                                // should be seen, so this is accepted.
+                                webChromeClient = object : WebChromeClient() {
+                                    override fun onShowFileChooser(
+                                        webView: WebView?,
+                                        filePathCallback: ValueCallback<Array<Uri>>?,
+                                        fileChooserParams: FileChooserParams?,
+                                    ): Boolean {
+                                        if (filePathCallback == null) return false
+                                        // A chooser that never returned must be
+                                        // released before a new one is armed.
+                                        pendingFileChooser?.onReceiveValue(null)
+                                        pendingFileChooser = filePathCallback
+                                        // Any type: the web side validates the
+                                        // file's content, and a narrow MIME filter
+                                        // hides json files some providers label
+                                        // as octet-stream.
+                                        openDocumentLauncher.launch(arrayOf("*/*"))
+                                        return true
+                                    }
+                                }
                                 // Stay invisible until the first real frame commits; the
                                 // half-initialised transparent surface would otherwise
                                 // show as the cold-start teal/orange compositing stripes.
@@ -451,6 +540,11 @@ class MainActivity : AppCompatActivity() {
         }
     }
 
+    private fun getDetectionHealth(): DetectionHealth = DetectionHealth(
+        accessibilityEnabled = isAccessibilityServiceEnabled(this),
+        serviceConnected = MyAccessibilityService.isConnected,
+    )
+
     private fun getMissingCapabilities(): List<MissingCapability> {
         Log.v(
             logTag,
 
@@ -11,6 +11,7 @@ import android.view.inputmethod.InputMethodManager
 import android.webkit.JavascriptInterface
 import android.webkit.WebView
 import com.minded.minded.MissingCapability
+import com.minded.minded.detection.DetectionHealth
 import com.minded.minded.util.SafeAreaInsetsHolder
 import com.minded.minded.util.getAppUsageObservation
 import com.minded.minded.widget.MyAppWidgetReceiver
@@ -22,6 +23,11 @@ open class MainActivityJavaScriptInterface(
     protected open val webView: WebView,
     protected val onMissingCapabilityClickI: (MissingCapability) -> Unit = {},
     protected val getMissingCapabilitiesI: () -> List<MissingCapability> = { emptyList<MissingCapability>() },
+    protected val getDetectionHealthI: () -> DetectionHealth = {
+        DetectionHealth(accessibilityEnabled = false, serviceConnected = false)
+    },
+    /** Opens the system "save as" sheet for a text file (see [saveTextFile]). */
+    protected val onSaveTextFileI: (filename: String, content: String) -> Unit = { _, _ -> },
     /**
      * Latest system-bar + display-cutout insets, written by
      * [com.minded.minded.util.ForwardSafeAreaInsetsToWebView] and read by
@@ -149,6 +155,26 @@ open class MainActivityJavaScriptInterface(
         return jsonArray.toString()
     }
 
+    /**
+     * The answer-journal backup: the web layer hands over a file name and its
+     * text, the activity opens ACTION_CREATE_DOCUMENT so the user picks where it
+     * goes. The name is reduced to a safe character set here - it names a
+     * document, never a path.
+     */
+    @JavascriptInterface
+    fun saveTextFile(filename: String, content: String) {
+        Log.v(logTag, "saveTextFile() $filename (${content.length} chars)")
+        val safeName = filename.replace(Regex("[^A-Za-z0-9._-]"), "_").ifBlank { "minded.json" }
+        onSaveTextFileI(safeName, content)
+    }
+
+    /** See [DetectionHealth]: lets the dashboard say when minded can't see apps. */
+    @JavascriptInterface
+    fun getDetectionHealth(): String {
+        Log.v(logTag, "getDetectionHealth()")
+        return getDetectionHealthI().toJson()
+    }
+
     @JavascriptInterface
     fun getAllApps(): String {
         val allApps = getInstalledApps()
 
@@ -104,6 +104,17 @@ class MyAccessibilityService : AccessibilityService() {
     private var detectionCollectionJob: kotlinx.coroutines.Job? = null
 
     companion object {
+        /**
+         * True between onServiceConnected() and onUnbind()/onDestroy(): the
+         * system currently holds a live binding to this service, so detection
+         * is running. Read by the main activity for the dashboard's detection-
+         * health line (see detection/DetectionHealth.kt) - the one signal that
+         * tells "enabled in settings" apart from "actually running".
+         */
+        @Volatile
+        var isConnected: Boolean = false
+            private set
+
         const val INTENT_EXTRA_CURRENT_PACKAGE_NAME = "INTENT_EXTRA_CURRENT_PACKAGE_NAME"
         const val INTENT_EXTRA_DETECTION_TIMESTAMP = "INTENT_EXTRA_DETECTION_TIMESTAMP"
         const val INTENT_EXTRA_HIDE_OVERLAY = "INTENT_EXTRA_HIDE_OVERLAY"
@@ -313,11 +324,13 @@ class MyAccessibilityService : AccessibilityService() {
 
     override fun onUnbind(intent: Intent?): Boolean {
         Log.d(TAG, "onUnbind()")
+        isConnected = false
         return super.onUnbind(intent)
     }
 
     override fun onDestroy() {
         super.onDestroy()
+        isConnected = false
 
         // Stop detection collection job first
         detectionCollectionJob?.cancel()
@@ -358,6 +371,7 @@ class MyAccessibilityService : AccessibilityService() {
     override fun onServiceConnected() {
         Log.d(TAG, "onServiceConnected()")
         super.onServiceConnected()
+        isConnected = true
 
         // Configure the service programmatically to ensure it works reliably
         val config = AccessibilityServiceInfo().apply {
 
@@ -0,0 +1,34 @@
+package com.minded.minded.detection
+
+import org.json.JSONObject
+
+/**
+ * Whether minded can currently see which app is in front - the fact the
+ * dashboard needs in order to say, calmly, when it can't.
+ *
+ * Detection lives inside the accessibility service and dies with it (see
+ * docs/sun-escalation-and-detection-reliability.md, "Accessibility optional").
+ * The failure mode this exists for is the one the permission checks miss: the
+ * service is still *enabled* in system settings, so no capability is reported
+ * missing, but its binding is dead (an OEM battery manager killed it, or the
+ * well-known post-update state where the toggle shows on but nothing runs
+ * until it is switched off and on again). Then no intervention ever fires and
+ * nothing tells the user - a local-only app has no other way to learn it has
+ * gone quiet.
+ *
+ * Deliberately NOT based on "no accessibility events for N minutes": a phone
+ * sitting idle produces no events either, and a wrong "minded isn't seeing
+ * your apps" would break the 90%-sure bar for anything we say to the user.
+ * A live binding is a fact; silence is not.
+ */
+data class DetectionHealth(
+    /** The accessibility service is enabled in system settings. */
+    val accessibilityEnabled: Boolean,
+    /** The service is currently bound and connected (between onServiceConnected and onUnbind/onDestroy). */
+    val serviceConnected: Boolean,
+) {
+    fun toJson(): String = JSONObject()
+        .put("accessibilityEnabled", accessibilityEnabled)
+        .put("serviceConnected", serviceConnected)
+        .toString()
+}