[teo-nex]

CanvasLink lets an Android phone/tablet operate the current CanvasTTY window over a private LAN: streamed video, touch/pan/zoom, direct terminal IME input and a compact shortcut bar. This adds Settings → CanvasLink to the desktop source, with access off on every launch. There is no separate desktop host application.

Even G2 and the Web companion retain independent codes and access. CanvasLink authorizes the whole current window, including Settings and visible sensitive content.

• Typed main/preload/settings integration, owned-frame IPC, and window-only capture/input.
• SRP pairing with a two-minute one-use code, AES-GCM signalling, and local WebRTC without STUN/TURN.
• Android discovery, native direct-input bridge, paste/interrupt shortcuts, reconnect and uncertain-delivery handling.
• Capture fallback bounded to 2560×1600; high-density startup is explicit and default desktop density is unchanged.
• Normal APK excludes acceptance instrumentation; private test sockets and startup automation are absent from the host.
• Copy prompt for agent in Settings provides bilingual USB/ADB installation instructions pinned to an APK URL, SHA-256 and public signing certificate. Copying does not enable access or include pairing/session data.
• Separate community distribution: CanvasLink repository, Android alpha release, Russian installation guide. Application source stays in CanvasTTY; this is not an official stable release.

The published APK uses the CI payload from source commit eba7baf, re-signed locally with a persistent Android distribution key. ZIP entries outside META-INF were compared byte for byte. Its public download, checksum, signature, all nine source assets, manifest and prompt attachments were verified without GitHub authentication. release.json records provenance and fingerprints. Earlier debug signatures may conflict: the prompt preserves existing data and stops on update/downgrade errors.

Validation:

• 115 integration tests, 3 installation/settings handler tests, TypeScript checks, production build and source/built-output secret audit passed after the onboarding change.
• Earlier full upstream suite: 2,221 passed, 27 skipped, in an isolated source copy with a clean environment. Existing hook tests mishandle spaces in checkout paths. 47 Even G2 tests passed.
• All eight CI jobs passed for current head 19b46df: Android APK, contracts, Windows tests/installer packaging, Linux tests/installers/AppImage/browser smokes, macOS packaging/native resources and CLI resolution. Desktop CI, CanvasLink CI, macOS native/package CI.
• Prior Linux CI general suite: 2,240 passed, 11 skipped, zero failures (2,251 total), plus 47 Even G2 tests. These include native-helper coverage available in CI.
• Android v2/v3 signature verification passed. Published APK SHA-256: 0534857896b2e22d7e832a8aaa6146b3fc6acb19f3df857cc9d3e8c1caf5a760.

Security follow-up in 19b46df:

• Expired sessions now revoke live video even without client requests; revoke stops capture/input before asynchronous UI refresh.
• Android ignores stale offers after disconnect/background and delayed pairing completion after explicit disconnect. Superseded SDP errors and buffered motion cannot affect a new peer.
• One-shot Ctrl is consumed by Unicode/multi-character commits and native keys.
• Twelve added regressions passed locally (115 total); Android/desktop builds, TypeScript, three onboarding tests and secret audit passed. All eight jobs passed on this head: CanvasLink CI, desktop CI, macOS native/package CI.
• Audit report records remaining dependency and native logout/lifecycle gaps. The published APK remains alpha.1 and does not contain these client fixes.

This remains a draft alpha:

• The previous macOS/Android prototype was manually accepted. This does not accept the newly signed APK or the desktop source port. Neither installed app was replaced by publication.
• Windows/Linux physical-device control, packaged source-port acceptance, IME/accessibility/rotation and GPU/network behavior across hosts remain pending.
• Local macOS packaging reached ASAR creation but failed final ad-hoc codesign with an internal Code Signing error. The isolated Electron smoke timed out without script output. Their local runtime result is unverified; CI results are separate.
• No local Go toolchain was available. npm audit retains the same six advisory names as the upstream lockfile (five high, one moderate); this feature does not remediate them.
• The prior fallback observation was about 3–6 FPS; no 30 FPS guarantee. Source CI APK signatures are ephemeral; only the separate published alpha uses the persistent distribution key.

See setup/build documentation and verification boundaries.