ADFA-4128 (4/11): quickbuild:runtime — swapping code in the running app #1716
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| import com.itsaky.androidide.build.config.BuildConfig | ||
|
|
||
| plugins { | ||
| id("com.android.library") | ||
| } | ||
|
|
||
| description = | ||
| "Quick Build runtime embedded in generated proxy apps: binds to CoGo, receives payload fds, hot-reloads (ADFA-4128)" | ||
|
|
||
| // CoGo stages this AAR into its assets and the device reads it by name, so pin the archive | ||
| // name instead of inheriting the module name. | ||
| base.archivesName.set("quickbuild-runtime") | ||
|
|
||
| android { | ||
| namespace = "${BuildConfig.PACKAGE_NAME}.quickbuild.runtime" | ||
|
|
||
| defaultConfig { | ||
| // Runs inside apps BUILT WITH CoGo, not inside the IDE. | ||
| minSdk = BuildConfig.MIN_SDK_FOR_APPS_BUILT_WITH_COGO | ||
| } | ||
|
|
||
| compileOptions { | ||
| // Java-only and Java 8, like :logsender - the AAR is injected into user | ||
| // projects and must not drag kotlin-stdlib or any other dependency in. | ||
| sourceCompatibility = JavaVersion.VERSION_1_8 | ||
| targetCompatibility = JavaVersion.VERSION_1_8 | ||
| } | ||
|
|
||
| buildFeatures.apply { | ||
| aidl = true | ||
| viewBinding = false | ||
| buildConfig = false | ||
| } | ||
| } | ||
|
|
||
| // JVM unit tests for the plain-Java payload logic (generation gate, metadata/component | ||
| // map parsing, asset extraction). Mirrors :quick-build's jupiter setup. | ||
| tasks.withType<Test> { | ||
| useJUnitPlatform() | ||
| } | ||
|
|
||
| // DoD coverage gate: >=90% line+branch on non-UI (domain/data) code. | ||
| // Same shape as :quick-build's report: the root build attaches the jacoco agent to | ||
| // every Test task, and for Android modules the exec lands at | ||
| // build/outputs/unit_test_code_coverage/<variant>UnitTest/, NOT build/jacoco/ -- a | ||
| // JacocoReport pointed at build/jacoco/ silently SKIPs and the gate is never | ||
| // measured (ADFA-3834 learnings). | ||
| tasks.register<JacocoReport>("jacocoTestReport") { | ||
| group = "verification" | ||
| description = "JaCoCo line+branch coverage for the v8Debug unit tests." | ||
| dependsOn("testV8DebugUnitTest") | ||
|
|
||
| reports { | ||
| xml.required.set(true) | ||
| html.required.set(true) | ||
| } | ||
|
|
||
| // Java-only module: the hand-written surface is the javac output. The AIDL stubs | ||
| // (IQuickBuildHost/IQuickBuildTarget + nested Stub/Proxy/Default) are generated | ||
| // code, so they are excluded from the measured set. | ||
| // | ||
| // Device-only Android/binder glue is EXEMPT from the JVM coverage bar (DoD: >=90% | ||
| // line+branch on non-UI code; these classes only execute meaningfully on a device | ||
| // and are covered by the android-qa device walks instead). Anything JVM-testable | ||
| // stays in the measured set - notably LegacyResourceSwap's file half and all | ||
| // parsing/persistence code. | ||
| classDirectories.setFrom( | ||
| fileTree( | ||
| layout.buildDirectory.dir("intermediates/javac/v8Debug/compileV8DebugJavaWithJavac/classes"), | ||
| ) { | ||
| exclude("com/itsaky/androidide/quickbuild/IQuickBuild*") | ||
| // Binder host service: payload fds, Handler/Looper, activity relaunch orchestration. | ||
| exclude("com/itsaky/androidide/quickbuild/runtime/QuickBuildRuntime*") | ||
| // ServiceConnection bind/reconnect to CoGo; binder death + rebind only happen on-device. | ||
| exclude("com/itsaky/androidide/quickbuild/runtime/QuickBuildClient*") | ||
| // Framework-instantiated AppComponentFactory (Activity/Service/Provider hooks). | ||
| exclude("com/itsaky/androidide/quickbuild/runtime/QuickBuildAppComponentFactory*") | ||
| // InMemoryDexClassLoader (ART-only) + /proc + android.os.Process boot path; not | ||
| // splittable without moving prod code around - the generation-gate logic it defers | ||
| // to (Generations, PayloadPersistence, PersistedSelection) is JVM-tested. | ||
| exclude("com/itsaky/androidide/quickbuild/runtime/PayloadStore*") | ||
| // API 30+ ResourcesLoader/ResourcesProvider attach; framework Resources objects only. | ||
| exclude("com/itsaky/androidide/quickbuild/runtime/ResourceStore*") | ||
| // Overlay banner View/TextView UI (UI is DoD-exempt; OverlayState text model is JVM-tested). | ||
| exclude("com/itsaky/androidide/quickbuild/runtime/StatusOverlay*") | ||
| // Application.ActivityLifecycleCallbacks census over real Activity instances. | ||
| exclude("com/itsaky/androidide/quickbuild/runtime/ActivityTracker*") | ||
| }, | ||
| ) | ||
| sourceDirectories.setFrom(files("src/main/java")) | ||
| executionData.setFrom( | ||
| layout.buildDirectory.file( | ||
| "outputs/unit_test_code_coverage/v8DebugUnitTest/testV8DebugUnitTest.exec", | ||
| ), | ||
| ) | ||
| } | ||
|
|
||
| dependencies { | ||
| testImplementation(libs.tests.junit.jupiter) | ||
| testImplementation(libs.tests.google.truth) | ||
| // Shared offline-guard scanner (OfflineNetworkGuardTest). Test-only: this never | ||
| // reaches the AAR, so the module's no-kotlin-stdlib rule still holds. | ||
| testImplementation(testFixtures(projects.quickbuild.protocol)) | ||
| testRuntimeOnly(libs.tests.junit.platformLauncher) | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| <?xml version="1.0" encoding="utf-8"?> | ||
| <manifest xmlns:android="http://schemas.android.com/apk/res/android"> | ||
|
|
||
| <!-- | ||
| Package visibility (API 30+ filtering): the proxy app binds CoGo's deploy service. | ||
| Declared here so every generated proxy app inherits it via manifest merge. | ||
| --> | ||
| <queries> | ||
| <package android:name="com.itsaky.androidide" /> | ||
| </queries> | ||
|
|
||
| <!-- | ||
| Do NOT declare android:appComponentFactory here: a debuggable app that also pulls | ||
| androidx.core (which declares androidx.core.app.CoreComponentFactory) then fails manifest | ||
| merge, and that happens BEFORE the proxy app build's merged-manifest transform runs. The | ||
| proxy app build owns the attribute instead - QuickBuildManifestTransformer sets it on the | ||
| MERGED manifest, adding it when absent and replacing a library-injected one. An | ||
| <application> ELEMENT is fine, and is what the keep-alive service below needs; only the | ||
| attribute is forbidden. | ||
| --> | ||
| <application> | ||
| <!-- | ||
| Lets CoGo bind into this app so the cached-app freezer leaves it alone for the life of a | ||
| Quick Build session; without it the app is frozen ~1 min after it loses the foreground | ||
| and stops answering the reload handshake - see QuickBuildKeepAliveService. Exported | ||
| because CoGo is a different uid, with no intent-filter so it is reachable by explicit | ||
| component only, and named in the Gradle plugin's UNPROXIABLE_BY_NAME so the proxy-app | ||
| manifest transform leaves this name intact. | ||
| --> | ||
| <service | ||
| android:name="com.itsaky.androidide.quickbuild.runtime.QuickBuildKeepAliveService" | ||
| android:exported="true" /> | ||
|
Comment on lines
+30
to
+32
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
service_file="$(fd -a '^QuickBuildKeepAliveService\.java$' quickbuild | head -n1)"
test -n "$service_file"
ast-grep outline "$service_file" --items all
rg -n -C3 '`@Override`|onBind|Binder\.getCallingUid|checkCalling|enforceCalling|signature' "$service_file"Repository: appdevforall/CodeOnTheGo Length of output: 1240 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- manifest context ---'
cat -n quickbuild/runtime/src/main/AndroidManifest.xml | sed -n '1,60p'
printf '%s\n' '--- service implementation ---'
cat -n quickbuild/runtime/src/main/java/com/itsaky/androidide/quickbuild/runtime/QuickBuildKeepAliveService.java
printf '%s\n' '--- service and binding references ---'
rg -n -C4 'QuickBuildKeepAliveService|bindService|BIND_' quickbuild --glob '!**/build/**'
printf '%s\n' '--- manifest permissions and package/application context ---'
rg -n -C2 'permission|exported|package=|applicationId|namespace' quickbuild --glob 'AndroidManifest.xml' --glob '*.gradle' --glob '*.gradle.kts'Repository: appdevforall/CodeOnTheGo Length of output: 30105 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- keep-alive binding call sites ---'
rg -n -C8 'QuickBuildKeepAliveService|KEEP.?ALIVE|keep.?alive|setComponent|ComponentName' . \
--glob '!**/build/**' --glob '!**/.git/**'
printf '%s\n' '--- permission declarations and service components ---'
rg -n -C3 'android:permission|<permission|android:exported="true"|extends Service' . \
--glob '!**/build/**' --glob '!**/.git/**' --glob '*.xml' --glob '*.java' --glob '*.kt'
printf '%s\n' '--- proxy-app transform references ---'
rg -n -C5 'UNPROXIABLE_BY_NAME|ComponentProxiabilityResolver|manifest transform|manifest merge' quickbuild \
--glob '!**/build/**'Repository: appdevforall/CodeOnTheGo Length of output: 50381 Restrict access to
🤖 Prompt for AI Agents
Contributor
Author
There was a problem hiding this comment. Not taking it. The exposure is real but bounded at keeping a developer's own proxy app unfrozen, and the returned object is a bare Binder with no transactions. Both remedies are unavailable: Binder.getCallingUid() inside onBind() returns this app's own uid, and a signature permission cannot work because CoGo is release-signed while the proxy app uses the on-device debug keystore. onUnbind returns false, so handing a caller null would poison the cached binding and break the keep-alive outright. |
||
| </application> | ||
|
|
||
| </manifest> | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| package com.itsaky.androidide.quickbuild; | ||
|
|
||
| import com.itsaky.androidide.quickbuild.IQuickBuildTarget; | ||
|
|
||
| /** | ||
| * CoGo side of the deploy channel (bound service, LogSender bind pattern). The proxy app | ||
| * binds on launch and registers its callback. CoGo verifies Binder.getCallingUid() | ||
| * against the proxy app's installed uid on every call. | ||
| */ | ||
| interface IQuickBuildHost { | ||
|
|
||
| /** | ||
| * Register the proxy app. CoGo replies (possibly immediately) with an | ||
| * {@link IQuickBuildTarget#onPayload} carrying the current generation when the | ||
| * app's running generation is stale. | ||
| */ | ||
| void connect(IQuickBuildTarget target, String packageName, long runningGeneration); | ||
|
|
||
| /** The payload for {@code generation} was loaded and rendered in {@code reloadMillis}. */ | ||
| oneway void reportReloaded(long generation, long reloadMillis); | ||
|
|
||
| /** The payload for {@code generation} crashed in render/lifecycle. */ | ||
| oneway void reportCrash(long generation, String stackSummary); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| package com.itsaky.androidide.quickbuild; | ||
|
|
||
| /** | ||
| * Proxy app side of the deploy channel. CoGo calls this after a successful | ||
| * quick build. Payloads travel as ParcelFileDescriptors; nothing touches shared storage. | ||
| * The target accepts a payload only when {@code generation} is strictly newer than the | ||
| * generation it currently runs. | ||
| * | ||
| * Versioning: CoGo and an installed proxy app can run DIFFERENT revisions of this | ||
| * interface (the runtime AAR is baked into the proxy app at proxy app build time). Only ever | ||
| * APPEND methods at the end - never reorder or remove. An older proxy app's stub answers | ||
| * an unknown transaction code with "not handled", and because the interface is oneway | ||
| * the caller never notices; the message is simply ignored. | ||
| */ | ||
| oneway interface IQuickBuildTarget { | ||
|
|
||
| /** | ||
| * Deliver generation {@code generation}. | ||
| * | ||
| * @param dexPayload classes.dex containing ALL user classes + generated proxies, | ||
| * or null for a resources/assets-only deploy. | ||
| * @param resourcesPayload fd to the full relinked resource apk (resources.arsc plus | ||
| * every compiled resource file, not a bare table - see | ||
| * Aapt2Link's KDoc) for | ||
| * ResourcesProvider.loadFromApk, or null when resources did | ||
| * not change. | ||
| * @param assetsPayload a zip of changed asset files, or null. | ||
| * @param metadataJson JSON: entry activity class, changed-asset paths, flags. | ||
| * Schema in quickbuild/protocol/README.md. | ||
| */ | ||
| void onPayload(long generation, in @nullable ParcelFileDescriptor dexPayload, | ||
| in @nullable ParcelFileDescriptor resourcesPayload, | ||
| in @nullable ParcelFileDescriptor assetsPayload, String metadataJson); | ||
|
|
||
| /** | ||
| * Build-status message: tells the running proxy app that a quick build | ||
| * FAILED CoGo-side (a compile error never produces a payload, so without this the | ||
| * app would silently keep running old code with no user-visible signal), or that a | ||
| * build succeeded (clears a previously shown failure). | ||
| * | ||
| * @param statusJson JSON with string-only values; schema in quickbuild/protocol/README.md. | ||
| * Unknown kinds and unknown fields are ignored by the runtime, so | ||
| * the schema can grow without breaking installed proxy apps. | ||
| */ | ||
| void onBuildStatus(String statusJson); | ||
| } |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
MINOR: The PR body's test and coverage evidence no longer matches head, and the coverage figure excludes most of what this round changed.
The body says "33 test files" and "19 of 26 files"; head has 36 test files and 27 sources. It says "220 tests per variant" while the head commit message says 255 green. More importantly,
QuickBuildRuntime*,ResourceStore*andStatusOverlay*are all on this exclusion list, so the quoted 93.2% line / 95.8% branch covers none of thefailReloaddispatch change, theattachedAppResourceslatch, or the observer-capture fix -- four of the five items in the last round. QA reads this section as the evidence ledger REVIEW.md asks for.Refresh the counts and say which of the round's fixes are inside the measured set and which are device-only.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
MINOR: still open at 3aad795, and the figures are not merely stale - they describe the branch's first commit.
At cfbbca1, the first commit on this branch, the tree had exactly 33 test files, 220 @test methods and 26 files under src/main/java - which is what the description still says. Head has 36, 256 and 27, so the per-variant count is 256 (1,536 executions across six variants, not 1,320) and the measured set is 20 of 27. The JaCoCo exclusion list (lines 77-91) is unchanged, so ResourceStore, QuickBuildRuntime and StatusOverlay - the three most heavily rewritten files on the branch, about 61% of the post-initial churn - all sit outside the quoted percentages. QA reads that section as the evidence ledger REVIEW.md asks for.
Refresh the counts against head and say which of the round's fixes are inside the measured set.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not fixed in code: this is the PR description, which we are updating separately rather than in the branch. Flagging it here so the thread is not read as ignored.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Current numbers on this branch: 38 suites, 271 tests per variant (1,626 executions), 93.3% line and 95.3% branch over 22 of 29 files, with the same 7 exclusions. Newly covered: FirstFrameGate and SwapAckGate; AssetExtractor, BootProbation and PayloadPersistence gained cases in their existing suites. Still excluded: QuickBuildRuntime, QuickBuildClient, ResourceStore.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
MINOR: Still not matching head, and this is the third round on the same paragraph.
At 45a5afe the tree has 40 test files and 278
@Testmethods; the body says 38 files and 271 tests per variant, so the per-variant count is 278 and the six-variant total 1,668, not 1,626. There are no parameterized, repeated, nested or disabled tests in the module, so the@Testcount is the executed count. The rest of the paragraph does hold: 29 files undersrc/main/java, the same 7 exclusions at build.gradle.kts:73-87 leaving 22 measured, andFirstFrameGateandSwapAckGateinside that set.One more thing missing from the same section: REVIEW.md asks for the font-scale result in the PR, and the body has no line for it. The measurements exist - they are in the T20 thread, captured on an A56 at 1.0 and 2.0 - so this is a copy, not new work. QA reads this section as the evidence ledger.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Body updated at this head, counts from the tree: 43 test files, 291
@Test, 0 parameterized/repeated/nested/disabled, 29 sources, the same 7 exclusions; suite re-run on the rebased tip 307e3d6, 291 tests, 0 failures. Coverage 93.4% line / 95.3% branch. The font-scale line is now in the body: the crash banner from the earlier A56 capture (1.0 = 2 rendered lines, 2.0 = 4, cap 6), and the mixed-state banner captured on the A06 at 1.0 and 2.0 on build 2747561c9 (pre-rebase), full text, nothing clipped.