From 6ebfc86392a74dc0ae18f0d2703a3f91b8977d46 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Fri, 2 Oct 2026 12:14:01 +0200
Subject: feat(android): client shell with the interface from the package

WebView over the packaged UI (copied from hub/static at build time), the
desktop CSP as a header, a bridge answering our top-level document only,
hub calls from native to the signed-in hub. Keys stay in the page for now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../app/src/main/res/xml/data_extraction_rules.xml            | 11 +++++++++++
 .../app/src/main/res/xml/network_security_config.xml          | 11 +++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 packages/meshbay-android/app/src/main/res/xml/data_extraction_rules.xml
 create mode 100644 packages/meshbay-android/app/src/main/res/xml/network_security_config.xml

(limited to 'packages/meshbay-android/app/src/main/res/xml')

diff --git a/packages/meshbay-android/app/src/main/res/xml/data_extraction_rules.xml b/packages/meshbay-android/app/src/main/res/xml/data_extraction_rules.xml
new file mode 100644
index 0000000..f0abf11
--- /dev/null
+++ b/packages/meshbay-android/app/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="root" /><exclude domain="file" /><exclude domain="database" />
+        <exclude domain="sharedpref" /><exclude domain="external" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="root" /><exclude domain="file" /><exclude domain="database" />
+        <exclude domain="sharedpref" /><exclude domain="external" />
+    </device-transfer>
+</data-extraction-rules>
diff --git a/packages/meshbay-android/app/src/main/res/xml/network_security_config.xml b/packages/meshbay-android/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..8bf3e82
--- /dev/null
+++ b/packages/meshbay-android/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Plain http only to a hub on this device's own loopback — the desktop rule
+     ("http only to localhost or 127.*"). Anywhere else a session token would
+     cross the network in clear. -->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false" />
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="false">localhost</domain>
+        <domain includeSubdomains="false">127.0.0.1</domain>
+    </domain-config>
+</network-security-config>
-- 
cgit v1.2.3