Add a debug-only ADB authoring adapter #17

New issue

Closed

opened 2026-09-16 12:05:38 +02:00 by morten-olsen · 1 comment

morten-olsen commented

2026-09-16 12:05:38 +02:00

Owner

Context

Issue #10 exposes the authoring tools through a bound Messenger service for authorized apps. Stock ADB cannot conveniently invoke that interface. A debug-only ContentProvider.call() adapter would let repository tooling and agents author and fixture-test workflows on an emulator through adb shell content call while reusing the same contract.

Scope

Add a debug-build-only content-provider adapter for AuthoringToolModule.
Add an explicit ADB authoring switch under Settings → Authoring. Shell access remains denied until the user enables it and is denied again immediately when disabled.
Accept only Android's platform-derived shell UID and only when ApplicationInfo.FLAG_DEBUGGABLE is present; fail closed otherwise.
Keep the provider absent from release artifacts.
Carry the versioned JSON tool request and result through bounded string extras and Bundle values without defining a second command interface.
Support tool discovery, reads, validated mutations, workflow validation, and deterministic workflow/node fixture tests.
Return structured errors suitable for command-line automation and record content-free outcomes.
Add a concise Taskfile command for invoking the adapter on a connected emulator or device.

Non-goals

Do not treat ADB shell access as normal third-party app authorization.
Do not permit live workflow execution, Android side effects, arbitrary code, or raw database access.
Do not ship a release-build shell backdoor.

Acceptance

A debug build exposes no ADB authoring access until the user enables ADB authoring in Settings → Authoring.
Disabling the switch revokes shell access immediately without clearing normal app-client grants.
When enabled, adb shell content call can discover tools and complete one create/describe/validate/delete workflow cycle.
Fixture tests remain deterministic and side-effect free.
Non-shell callers, disabled access, malformed requests, and oversized payloads are rejected without mutation.
A release APK contains no ADB authoring provider.
An on-device scenario proves opt-in gating, shell authorization, end-to-end authoring, and release/debug manifest separation.

## Context Issue #10 exposes the authoring tools through a bound Messenger service for authorized apps. Stock ADB cannot conveniently invoke that interface. A debug-only `ContentProvider.call()` adapter would let repository tooling and agents author and fixture-test workflows on an emulator through `adb shell content call` while reusing the same contract. ## Scope - Add a debug-build-only content-provider adapter for `AuthoringToolModule`. - Add an explicit **ADB authoring** switch under Settings → Authoring. Shell access remains denied until the user enables it and is denied again immediately when disabled. - Accept only Android's platform-derived shell UID and only when `ApplicationInfo.FLAG_DEBUGGABLE` is present; fail closed otherwise. - Keep the provider absent from release artifacts. - Carry the versioned JSON tool request and result through bounded string extras and Bundle values without defining a second command interface. - Support tool discovery, reads, validated mutations, workflow validation, and deterministic workflow/node fixture tests. - Return structured errors suitable for command-line automation and record content-free outcomes. - Add a concise Taskfile command for invoking the adapter on a connected emulator or device. ## Non-goals - Do not treat ADB shell access as normal third-party app authorization. - Do not permit live workflow execution, Android side effects, arbitrary code, or raw database access. - Do not ship a release-build shell backdoor. ## Acceptance - A debug build exposes no ADB authoring access until the user enables **ADB authoring** in Settings → Authoring. - Disabling the switch revokes shell access immediately without clearing normal app-client grants. - When enabled, `adb shell content call` can discover tools and complete one create/describe/validate/delete workflow cycle. - Fixture tests remain deterministic and side-effect free. - Non-shell callers, disabled access, malformed requests, and oversized payloads are rejected without mutation. - A release APK contains no ADB authoring provider. - An on-device scenario proves opt-in gating, shell authorization, end-to-end authoring, and release/debug manifest separation.

morten-olsen commented

2026-09-16 12:19:42 +02:00

Author

Owner

Implemented and pushed in 817da5a.

Delivered:

debug-manifest-only ContentProvider.call() adapter over the shared AuthoringToolModule
shell UID and debuggable-build enforcement
Settings → Authoring opt-in switch, default off, with immediate revocation
bounded raw/base64 request transport, structured responses, serialized mutations, and content-free audit entries
task adb:authoring REQUEST='<protocol JSON>'
access-policy and transport-boundary tests
ENGINE.md architecture documentation

Verified:

disabled shell request is denied
enabled shell request discovers tools
validate/create/describe/delete workflow cycle succeeds over adb shell content call
disabling the switch immediately denies the next request
debug merged manifest contains the provider; release merged manifest does not
task ci:quality passes

Implemented and pushed in `817da5a`. Delivered: - debug-manifest-only `ContentProvider.call()` adapter over the shared `AuthoringToolModule` - shell UID and debuggable-build enforcement - Settings → Authoring opt-in switch, default off, with immediate revocation - bounded raw/base64 request transport, structured responses, serialized mutations, and content-free audit entries - `task adb:authoring REQUEST='<protocol JSON>'` - access-policy and transport-boundary tests - ENGINE.md architecture documentation Verified: - disabled shell request is denied - enabled shell request discovers tools - validate/create/describe/delete workflow cycle succeeds over `adb shell content call` - disabling the switch immediately denies the next request - debug merged manifest contains the provider; release merged manifest does not - `task ci:quality` passes

morten-olsen closed this issue

2026-09-16 12:19:42 +02:00

No labels

bug

enhancement

feature

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

incubator/macros#17

No description provided.

Rows
Columns