feat: add mobile harness strategy modes

.gitattributes

@@ -0,0 +1,3 @@
+# This legacy source is stored with CRLF line endings. Treat CR as part of the
+# line terminator so semantic changes can still pass Git's whitespace checks.
+mobile_agent/lib/core/evidence/action_runner.dart whitespace=cr-at-eol

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - mobilecode-device-lab

.github/workflows/android-apk.yml

@@ -6,7 +6,7 @@ on:
       release_tag:
         description: GitHub Release tag to upload the APK to
         required: false
-        default: v0.1.39
+        default: v0.1.78
   push:
     tags:
       - 'v*'
@@ -22,6 +22,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Enforce public release credential policy
+        run: python3 scripts/verify_public_release_workflows.py
+
       - name: Setup Java
         uses: actions/setup-java@v5
         with:
@@ -34,20 +37,18 @@ jobs:
           channel: stable
           cache: true
 
-      - name: Recreate Android platform project
-        working-directory: mobile_agent
-        run: |
-          rm -rf android
-          flutter create --platforms=android --project-name mobile_agent --org com.mobilecode .
-          python3 tooling/prepare_android_project.py
+      - name: Prepare checked-in Android platform project
+        working-directory: mobile_agent
+        run: |
+          python3 tooling/prepare_android_project.py
 
       - name: Resolve Flutter dependencies
         working-directory: mobile_agent
         run: flutter pub get
 
       - name: Analyze Flutter sources
         working-directory: mobile_agent
-        run: flutter analyze lib/main.dart lib/screens/home_screen.dart lib/screens/github_screen.dart lib/screens/github_repo_hub_screen.dart lib/screens/role_manager_screen.dart lib/screens/api_usage_screen.dart lib/screens/device_telemetry_screen.dart lib/services/github_deep_service.dart lib/services/github_oauth_flow.dart lib/services/role_library_service.dart lib/services/token_usage_service.dart lib/services/token_pricing_service.dart lib/services/device_telemetry_service.dart lib/services/agent_loop_controller.dart --no-fatal-infos --no-fatal-warnings
+        run: flutter analyze lib/main.dart lib/screens/home_screen.dart lib/screens/github_screen.dart lib/screens/github_repo_hub_screen.dart lib/screens/role_manager_screen.dart lib/screens/api_usage_screen.dart lib/screens/device_telemetry_screen.dart lib/services/github_deep_service.dart lib/services/github_oauth_flow.dart lib/services/role_library_service.dart lib/services/token_usage_service.dart lib/services/token_pricing_service.dart lib/services/device_telemetry_service.dart lib/services/agent_loop_controller.dart lib/services/model_provider_preset_service.dart lib/services/tuima_provider_service.dart --no-fatal-infos --no-fatal-warnings
 
       - name: Configure stable Android release signing
         working-directory: mobile_agent
@@ -75,58 +76,46 @@ jobs:
       - name: Build release APK
         working-directory: mobile_agent
         env:
-          MOBILECODE_MANAGED_API_KEY: ${{ secrets.MOBILECODE_MANAGED_API_KEY }}
-          MOBILECODE_DEEPSEEK_API_KEY: ${{ secrets.MOBILECODE_DEEPSEEK_API_KEY || secrets.DEEPSEEK_API_KEY }}
           MOBILECODE_MANAGED_RELAY_URL: ${{ vars.MOBILECODE_MANAGED_RELAY_URL }}
-          MOBILECODE_MANAGED_RELAY_TOKEN: ${{ secrets.MOBILECODE_MANAGED_RELAY_TOKEN }}
-          MOBILECODE_GITHUB_OAUTH_CLIENT_ID: ${{ secrets.MOBILECODE_GITHUB_OAUTH_CLIENT_ID }}
-          MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET: ${{ secrets.MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET }}
+          MOBILECODE_GITHUB_OAUTH_CLIENT_ID: ${{ vars.MOBILECODE_GITHUB_OAUTH_CLIENT_ID }}
           MOBILECODE_GITHUB_OAUTH_REDIRECT_URI: ${{ vars.MOBILECODE_GITHUB_OAUTH_REDIRECT_URI }}
         run: |
           DART_DEFINES=()
           if [ -n "$MOBILECODE_MANAGED_RELAY_URL" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_RELAY_URL="$MOBILECODE_MANAGED_RELAY_URL")
-          fi
-          if [ -n "$MOBILECODE_MANAGED_RELAY_TOKEN" ]; then
-            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_RELAY_TOKEN="$MOBILECODE_MANAGED_RELAY_TOKEN")
-          fi
-          if [ -n "$MOBILECODE_MANAGED_API_KEY" ] || [ -n "$MOBILECODE_MANAGED_RELAY_URL" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_PROVIDER=true)
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_BASE_URL=https://token-plan-cn.xiaomimimo.com/anthropic)
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_MODEL=mimo-v2.5-pro)
-          fi
-          if [ -z "$MOBILECODE_MANAGED_RELAY_URL" ] && [ -n "$MOBILECODE_MANAGED_API_KEY" ]; then
-            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_API_KEY="$MOBILECODE_MANAGED_API_KEY")
-          fi
-          if [ -n "$MOBILECODE_DEEPSEEK_API_KEY" ] || [ -n "$MOBILECODE_MANAGED_RELAY_URL" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_DEEPSEEK_PROVIDER=true)
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_DEEPSEEK_BASE_URL=https://api.deepseek.com)
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_DEEPSEEK_MODEL=deepseek-v4-flash)
           fi
-          if [ -z "$MOBILECODE_MANAGED_RELAY_URL" ] && [ -n "$MOBILECODE_DEEPSEEK_API_KEY" ]; then
-            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_DEEPSEEK_API_KEY="$MOBILECODE_DEEPSEEK_API_KEY")
-          fi
           if [ -n "$MOBILECODE_GITHUB_OAUTH_CLIENT_ID" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_GITHUB_OAUTH_CLIENT_ID="$MOBILECODE_GITHUB_OAUTH_CLIENT_ID")
-          fi
-          if [ -n "$MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET" ]; then
-            DART_DEFINES+=(--dart-define=MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET="$MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET")
           fi
           if [ -n "$MOBILECODE_GITHUB_OAUTH_REDIRECT_URI" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_GITHUB_OAUTH_REDIRECT_URI="$MOBILECODE_GITHUB_OAUTH_REDIRECT_URI")
           fi
-          flutter build apk --release --target lib/main.dart "${DART_DEFINES[@]}"
+          flutter build apk --release --flavor pure --dart-define=MOBILECODE_BUILD_CHANNEL=pure --target lib/main.dart "${DART_DEFINES[@]}"
 
       - name: Stage APK
         id: stage_apk
         env:
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.39' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.78' }}
         run: |
           mkdir -p artifacts
           APK_PATH="artifacts/mobilecode-${RELEASE_TAG}.apk"
-          cp mobile_agent/build/app/outputs/flutter-apk/app-release.apk "$APK_PATH"
+          cp mobile_agent/build/app/outputs/flutter-apk/app-pure-release.apk "$APK_PATH"
           echo "apk_path=$APK_PATH" >> "$GITHUB_OUTPUT"
 
+      - name: Verify release version consistency
+        env:
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.78' }}
+        run: |
+          python3 scripts/verify_mobilecode_release_version.py \
+            --apk "${{ steps.stage_apk.outputs.apk_path }}" \
+            --expected-tag "$RELEASE_TAG"
+
       - name: Upload workflow artifact
         uses: actions/upload-artifact@v7
         with:
@@ -136,7 +125,7 @@ jobs:
       - name: Ensure GitHub Release exists
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.39' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.78' }}
         run: |
           if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "Release $RELEASE_TAG already exists."
@@ -152,6 +141,6 @@ jobs:
       - name: Upload APK to GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.39' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.78' }}
         run: |
           gh release upload "$RELEASE_TAG" "${{ steps.stage_apk.outputs.apk_path }}" --clobber --repo "$GITHUB_REPOSITORY"

.github/workflows/android-app-test.yml

@@ -1,89 +1,92 @@
-name: Android App Smoke Test
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - 'mobile_agent/**'
-      - '.github/workflows/android-app-test.yml'
-      - '.github/workflows/android-apk.yml'
-
-permissions:
-  contents: read
-
-jobs:
-  emulator-smoke:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: '17'
-
-      - name: Setup Flutter
-        uses: subosito/flutter-action@v2
-        with:
-          channel: stable
-          cache: true
-
-      - name: Recreate Android platform project
-        working-directory: mobile_agent
-        run: |
-          rm -rf android
-          flutter create --platforms=android --project-name mobile_agent --org com.mobilecode .
-          python3 tooling/prepare_android_project.py
-
-      - name: Resolve Flutter dependencies
-        working-directory: mobile_agent
-        run: flutter pub get
-
+name: Android App Smoke Test
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'mobile_agent/**'
+      - 'docs/mobilecode-accessibility-background-permissions-qa.md'
+      - 'roadmap/tasks/T25-accessibility-background-permissions.md'
+      - '.github/workflows/android-app-test.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'mobile_agent/**'
+      - 'docs/mobilecode-accessibility-background-permissions-qa.md'
+      - 'roadmap/tasks/T25-accessibility-background-permissions.md'
+      - 'scripts/run_android_app_smoke_ci.sh'
+      - '.github/workflows/android-app-test.yml'
+      - '.github/workflows/android-apk.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  emulator-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Enable KVM for Android emulator
+        run: |
+          test -e /dev/kvm
+          sudo chmod 0666 /dev/kvm
+          test -r /dev/kvm
+          test -w /dev/kvm
+
+      - name: Setup Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+
+      - name: Verify checked-in Android project
+        working-directory: mobile_agent
+        run: |
+          python3 -m py_compile tooling/prepare_android_project.py
+          test -f android/app/src/main/kotlin/com/mobilecode/app/MobileCodeHelperService.kt
+          test -f android/app/src/main/kotlin/com/mobilecode/app/MobileCodeHelperLauncherActivity.kt
+
+      - name: Resolve Flutter dependencies
+        working-directory: mobile_agent
+        run: flutter pub get
+
       - name: Analyze Flutter entry surfaces
         working-directory: mobile_agent
-        run: flutter analyze lib/main.dart lib/screens/home_screen.dart lib/screens/github_screen.dart lib/screens/github_repo_hub_screen.dart lib/screens/role_manager_screen.dart lib/screens/api_usage_screen.dart lib/screens/device_telemetry_screen.dart lib/services/github_deep_service.dart lib/services/github_oauth_flow.dart lib/services/role_library_service.dart lib/services/token_usage_service.dart lib/services/token_pricing_service.dart lib/services/device_telemetry_service.dart --no-fatal-infos --no-fatal-warnings
-
-      - name: Build debug APK for emulator
-        working-directory: mobile_agent
-        run: flutter build apk --debug --target lib/main.dart
-
-      - name: Run APK on Android emulator
-        uses: reactivecircus/android-emulator-runner@v2
-        with:
-          api-level: 29
-          arch: x86_64
-          profile: pixel_2
-          target: default
-          disable-animations: true
-          script: |
-            set -eux
-            mkdir -p artifacts
-            adb wait-for-device
-            installed=0; for attempt in 1 2 3; do if adb install -r mobile_agent/build/app/outputs/flutter-apk/app-debug.apk; then installed=1; break; fi; adb kill-server; adb start-server; adb wait-for-device; sleep 20; done; test "$installed" = 1
-            adb shell am start -n com.mobilecode.mobile_agent/.MobileCodeHelperLauncherActivity
-            adb forward tcp:18765 tcp:8765
-            helper_ready=0; for attempt in $(seq 1 20); do if curl -fsS http://127.0.0.1:18765/v1/health > artifacts/android-helper-health.json; then helper_ready=1; break; fi; sleep 1; done; if [ "$helper_ready" != 1 ]; then adb shell dumpsys activity services com.mobilecode.mobile_agent > artifacts/helper-services.txt || true; adb logcat -d -t 1500 > artifacts/android-logcat.txt || true; exit 1; fi
-            curl -fsS http://127.0.0.1:18765/v1/health | tee artifacts/android-helper-health.json
-            curl -fsS -H 'Content-Type: application/json' -X POST http://127.0.0.1:18765/v1/execute -d '{"command":"pwd","timeoutMs":10000}' | tee artifacts/android-helper-execute.json
-            curl -fsS http://127.0.0.1:18765/v1/tasks/current | tee artifacts/android-helper-task.json
-            grep '"name":"MobileCode Helper Service"' artifacts/android-helper-health.json
-            grep '"ready":true' artifacts/android-helper-health.json
-            grep '"backgroundService":true' artifacts/android-helper-health.json
-            grep '"exitCode":0' artifacts/android-helper-execute.json
-            grep '"failureKind":"none"' artifacts/android-helper-execute.json
-            adb logcat -c || true
-            adb shell am start -W -n com.mobilecode.mobile_agent/.MainActivity | tee artifacts/main-start.txt
-            app_drawn=0; for attempt in $(seq 1 24); do adb shell pidof com.mobilecode.mobile_agent; adb shell dumpsys window windows > artifacts/window-focus.txt || true; if awk '/Window #[0-9]+/ { in_app = ($0 ~ /com\.mobilecode\.mobile_agent\/com\.mobilecode\.mobile_agent\.MainActivity/) } in_app && /Surface: shown=true/ { ok=1 } END { exit ok ? 0 : 1 }' artifacts/window-focus.txt; then app_drawn=1; break; fi; sleep 5; done; echo "$app_drawn" > artifacts/app-drawn.txt; adb shell pidof com.mobilecode.mobile_agent; adb exec-out screencap -p > artifacts/mobilecode-android-smoke.png || true; adb logcat -d -t 2000 > artifacts/android-logcat.txt || true; grep -q "com.mobilecode.mobile_agent" artifacts/window-focus.txt; grep -E "FATAL EXCEPTION|E AndroidRuntime|NoSuchMethodError|MissingPluginException|ANR in com.mobilecode.mobile_agent" artifacts/android-logcat.txt && exit 1 || true; test "$app_drawn" = 1
-
-      - name: Upload Android smoke artifacts
-        uses: actions/upload-artifact@v7
-        if: always()
-        with:
-          name: mobilecode-android-smoke
-          path: artifacts/
+        run: flutter analyze lib/main.dart lib/screens/home_screen.dart lib/screens/settings_screen.dart lib/screens/github_screen.dart lib/screens/github_repo_hub_screen.dart lib/screens/role_manager_screen.dart lib/screens/api_usage_screen.dart lib/screens/device_telemetry_screen.dart lib/services/github_deep_service.dart lib/services/github_oauth_flow.dart lib/services/role_library_service.dart lib/services/token_usage_service.dart lib/services/token_pricing_service.dart lib/services/device_telemetry_service.dart lib/services/mobile_code_helper_auth.dart lib/services/phone_use_accessibility_service.dart lib/services/model_provider_preset_service.dart lib/services/tuima_provider_service.dart test/services/model_provider_preset_service_test.dart test/services/tuima_provider_service_test.dart --no-fatal-infos --no-fatal-warnings
+
+      - name: Build debug APK for emulator
+        working-directory: mobile_agent
+        run: >-
+          flutter build apk --debug --flavor pure
+          --dart-define=MOBILECODE_BUILD_CHANNEL=pure
+          --target lib/main.dart
+
+      - name: Run APK on Android emulator
+        uses: reactivecircus/android-emulator-runner@v2
+        with:
+          api-level: 29
+          arch: x86_64
+          profile: pixel_2
+          target: default
+          disable-animations: true
+          # android-emulator-runner executes each script line in a separate shell.
+          # Keep stateful control flow in a checked-in POSIX shell script.
+          script: sh scripts/run_android_app_smoke_ci.sh
+
+      - name: Upload Android smoke artifacts
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: mobilecode-android-smoke
+          path: artifacts/