Receivers hard-cap reassembly at MAX_FRAGMENTS_PER_ID (256), but the
generic send path fragmented packets with no caller cap (0xFFFF), so
broadcast file transfers above ~120 KB were fully transmitted yet
undeliverable. FragmentingPacketSender now caps fragmentation at
MAX_FRAGMENTS_PER_ID and reports failure via a new
TransferProgressEvent.failed flag, which surfaces as
DeliveryStatus.Failed in the UI and as a file_send error in the debug
test hook instead of an indefinite wait.
Adds FragmentingPacketSenderTest and a file_oversize mesh-lab scenario
asserting sender-side rejection.
- header star wobbles and its outline turns orange when the peer
favorites you; it only fills once you favorite them back
- mirror the 'favorited you' system notice into the private
conversation (mesh path), matching the main chat
- expose reactive peerFavoritedUs state driven by
FavoritesPersistenceService; keep system notices silent
(no unread badge, read receipt or push)
C1 from security review: SymmetricState/HandshakeState logged raw X25519
shared secrets, chaining keys, and handshake hashes in hex to logcat on
every handshake, in release builds. A logcat transcript of a handshake
allowed full session decryption. Both classes no longer log at all.
Also reduces excessive logging across the app (~50% fewer log calls in
the noisiest files):
- NoiseSession emits one line per completed handshake; per-message
encrypt/decrypt and per-handshake-step debug logs removed
- Removes all content/key logging: decrypted DM content, file names,
payload hex dumps, pubkeys, event IDs, lat/lon, peer IPs, arti log
forwarding
- Collapses multi-line banner/emoji log sequences into single factual
lifecycle lines (connect/disconnect, relay/Tor state transitions)
- Keeps security-relevant warnings (signature failures, replay
detection, key mismatches, panic wipe) in compact form
No logic changes. Includes the full security review report in
docs/security-review-jul-27.md.
* Bind Noise sessions to claimed peer identities
* Make Wi-Fi peer rebinding atomic
* Migrate private media without silent downgrades (#728)
* Migrate private media without silent downgrades
* Accept prerelease private media payloads
* Authenticate private media capability per Noise session
* updates
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: jack <jack@deck.local>
Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>
* Authenticate BLE links before peer binding (#749)
* Authenticate BLE links before peer binding
* Fix BLE link authentication races
---------
Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>
* Use canonical Maven repository for Robolectric
---------
Co-authored-by: jack <jack@deck.local>
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>
Co-authored-by: a1denvalu3 <43107113+a1denvalu3@users.noreply.github.com>
* wifi aware wip
* wifi aware wip
* starting to work
* werk
* dms work
* wip
* fix(wifi-aware): use bindSocket and scoped IPv6 instead of bindProcessToNetwork
* Merge branch 'upstream/main' into fix/wifi-aware-socket-binding
* Fix Wi-Fi Aware connectivity and UI integration post-merge
- Replace bindProcessToNetwork with bindSocket for VPN compatibility.
- Implement Scoped IPv6 address resolution (aware0) for mesh routing.
- Bridge Wi-Fi Aware incoming messages to AppStateStore for UI visibility.
- Fix syntax errors and variable name conflicts in Debug UI.
* Enhance Wi-Fi Aware robustness and debug UI display
- Clean up transport resources (sockets, server sockets, network callbacks) immediately on peer disconnection.
- Implement resolveScopedAddress to show scoped IPv6 (e.g., %aware0) in Debug UI.
- Fix Map type mismatch warning in ChatViewModel bridge.
- Filter self-ID from peer cleanup tables to prevent recursive self-removal.
* Share GossipSyncManager across transports to prevent redundant message synchronization
- Registered BluetoothMeshService's GossipSyncManager as a singleton in MeshServiceHolder.
- Modified WifiAwareMeshService to use the shared GossipSyncManager if available.
- Added background cleanup for peer mappings on socket disconnection.
- Fixed Kotlin type mismatch during nickname map merging.
* Restore VPN acquisition logic and improve peer cleanup
- Revert removal of NET_CAPABILITY_NOT_VPN to allow hardware handle acquisition while VPN is active.
- Refactor handlePeerDisconnection to more reliably cleanup initial and routed IDs.
- Switch cleanup logging to debug level to reduce log noise.
* Fix wifi aware socket binding 2 (#536)
* Background persistence (#505)
* persistence step 1
* fix build
* messages in the background work, notifications not yet
* app state store
* DM icon shows up
* notification launches when app is closed!
* keep ui updated
* lifecycle fixes
* extensive logging, maybe revert later
* send nickname in announcement
* quit in notification
* setting in about sheet
* fix quit bitchat
* lifecycle fixes
* power mode based on background state
* stats for both direciotns
* fix graph persistence
* better counting
* count per device
* only compute when debug sheet is open? untested
* fix read receipts
* fix read receipts fully
* fix unread badge if messages have been read in focus
* foreground promotion fix
* fix app kill in notification
* adjust to new tor
* nice
* about sheet design
* bump version 1.6.0 (#524)
* Automated update of relay data - Sun Dec 14 06:06:53 UTC 2025
* bump targetSdk (#526)
* Automated update of relay data - Sun Dec 21 06:06:56 UTC 2025
* Automated update of relay data - Sun Dec 28 06:07:12 UTC 2025
* Prevent quit notification from reappearing (#530)
* shutdown sequence
* Prevent quit notification from reappearing
* Restrict force-finish broadcast
* Cancel quit shutdown on relaunch
* fix(wifi-aware): use bindSocket and scoped IPv6 instead of bindProcessToNetwork
* Merge branch 'upstream/main' into fix/wifi-aware-socket-binding
* Fix Wi-Fi Aware connectivity and UI integration post-merge
- Replace bindProcessToNetwork with bindSocket for VPN compatibility.
- Implement Scoped IPv6 address resolution (aware0) for mesh routing.
- Bridge Wi-Fi Aware incoming messages to AppStateStore for UI visibility.
- Fix syntax errors and variable name conflicts in Debug UI.
* Enhance Wi-Fi Aware robustness and debug UI display
- Clean up transport resources (sockets, server sockets, network callbacks) immediately on peer disconnection.
- Implement resolveScopedAddress to show scoped IPv6 (e.g., %aware0) in Debug UI.
- Fix Map type mismatch warning in ChatViewModel bridge.
- Filter self-ID from peer cleanup tables to prevent recursive self-removal.
* Share GossipSyncManager across transports to prevent redundant message synchronization
- Registered BluetoothMeshService's GossipSyncManager as a singleton in MeshServiceHolder.
- Modified WifiAwareMeshService to use the shared GossipSyncManager if available.
- Added background cleanup for peer mappings on socket disconnection.
- Fixed Kotlin type mismatch during nickname map merging.
* Restore VPN acquisition logic and improve peer cleanup
- Revert removal of NET_CAPABILITY_NOT_VPN to allow hardware handle acquisition while VPN is active.
- Refactor handlePeerDisconnection to more reliably cleanup initial and routed IDs.
- Switch cleanup logging to debug level to reduce log noise.
---------
Co-authored-by: GitHub Action <action@github.com>
Co-authored-by: aidenvalue <>
* Fix wifi aware routing (#534)
* Background persistence (#505)
* persistence step 1
* fix build
* messages in the background work, notifications not yet
* app state store
* DM icon shows up
* notification launches when app is closed!
* keep ui updated
* lifecycle fixes
* extensive logging, maybe revert later
* send nickname in announcement
* quit in notification
* setting in about sheet
* fix quit bitchat
* lifecycle fixes
* power mode based on background state
* stats for both direciotns
* fix graph persistence
* better counting
* count per device
* only compute when debug sheet is open? untested
* fix read receipts
* fix read receipts fully
* fix unread badge if messages have been read in focus
* foreground promotion fix
* fix app kill in notification
* adjust to new tor
* nice
* about sheet design
* bump version 1.6.0 (#524)
* Automated update of relay data - Sun Dec 14 06:06:53 UTC 2025
* bump targetSdk (#526)
* Automated update of relay data - Sun Dec 21 06:06:56 UTC 2025
* Automated update of relay data - Sun Dec 28 06:07:12 UTC 2025
* Prevent quit notification from reappearing (#530)
* shutdown sequence
* Prevent quit notification from reappearing
* Restrict force-finish broadcast
* Cancel quit shutdown on relaunch
* fix(wifi-aware): use bindSocket and scoped IPv6 instead of bindProcessToNetwork
* Merge branch 'upstream/main' into fix/wifi-aware-socket-binding
* Fix Wi-Fi Aware connectivity and UI integration post-merge
- Replace bindProcessToNetwork with bindSocket for VPN compatibility.
- Implement Scoped IPv6 address resolution (aware0) for mesh routing.
- Bridge Wi-Fi Aware incoming messages to AppStateStore for UI visibility.
- Fix syntax errors and variable name conflicts in Debug UI.
* Enhance Wi-Fi Aware robustness and debug UI display
- Clean up transport resources (sockets, server sockets, network callbacks) immediately on peer disconnection.
- Implement resolveScopedAddress to show scoped IPv6 (e.g., %aware0) in Debug UI.
- Fix Map type mismatch warning in ChatViewModel bridge.
- Filter self-ID from peer cleanup tables to prevent recursive self-removal.
* Share GossipSyncManager across transports to prevent redundant message synchronization
- Registered BluetoothMeshService's GossipSyncManager as a singleton in MeshServiceHolder.
- Modified WifiAwareMeshService to use the shared GossipSyncManager if available.
- Added background cleanup for peer mappings on socket disconnection.
- Fixed Kotlin type mismatch during nickname map merging.
* Restore VPN acquisition logic and improve peer cleanup
- Revert removal of NET_CAPABILITY_NOT_VPN to allow hardware handle acquisition while VPN is active.
- Refactor handlePeerDisconnection to more reliably cleanup initial and routed IDs.
- Switch cleanup logging to debug level to reduce log noise.
* fix wifi aware routing
---------
Co-authored-by: GitHub Action <action@github.com>
Co-authored-by: aidenvalue <>
* unify connection tracker for ble and wifi (#537)
* unify connection tracker for ble and wifi
* cleanup nicely
* Wifi aware skip bluetooth (#538)
* unify connection tracker for ble and wifi
* bluetooth optional
* refactor mesh core
* tests
* share gossip
* refresh peer list more often
* patches: wifi aware mesh refactor core (#549)
* Refactor WifiAware memory management and lifecycle handling
* Fix Wi-Fi Aware reconnection by ensuring callback unregistration and session watchdog
* fix(wifiaware): allow WifiAwareController to restart service if session drops
* Enhance WiFi Aware logging with network request timeouts and detailed callback status
* Ensure explicit release of WiFi Aware network callbacks on failure or disconnection
---------
Co-authored-by: aidenvalue <>
* fix: wifi aware mesh private dms (#561)
* fix(wifi-aware): restore peer check and remove aggressive session restarts
* synchronized access to sockets.
* clear old peer socket `onClientConnected` if one was found.
* address second round of review
* fix: Restart publish session on termination in WifiAwareMeshService
* fix: cleanup connection tracker resources when handling peer disconnection without active socket
---------
Co-authored-by: aidenvalu3 <>
* fix(mesh): address memory leaks and background persistence issues in Wi-Fi Aware
- Move message persistence and background notifications for Wi-Fi Aware into the service layer via MeshCore hooks.
- Fix memory leak in MainActivity by properly detaching WifiAwareMeshDelegate on pause.
- Ensure BluetoothMeshService is initialized before WifiAwareMeshService to guarantee shared GossipSyncManager instance.
- Deduplicate persistence logic from MainActivity delegate.
* wifi aware working
* more robust
* fragments work
* new files
* wifi improvements
* handshake works
* improve
* wifi mesh more robust
* fix review
* check for support
* wifi aware fixes
---------
Co-authored-by: aidenvalue <>
Co-authored-by: GitHub Action <action@github.com>
Co-authored-by: aidenvalu3 <erendentman@gmail.com>
Co-authored-by: a1denvalu3 <43107113+a1denvalu3@users.noreply.github.com>
Co-authored-by: CC <cc@ggg.local>
* fix: add input validation for protocol decoding and fragment reassembly
* fix:subtract the old entry's size before adding the new one, so duplicate/retransmitted fragments don't inflate the counter
* fix: FragmentManager.handleFragment() can be entered concurrently (e.g., fragments for the same fragmentID arriving from multiple peers/relays). In order for this to happen multiple devices would be needed to connect to the mesh. even with a per-fragmentID byte cap, an attacker could open many fragment IDs at once and force the device to buffer lots of fragment data overall (risking memory pressure/OOM). In this fix we made fragments atomic and thread safe. When a fragment index is retransmitted, we compute the size delta (new - old) so duplicates don’t inflate counters and can’t be used to bypass limits. Under heavy load/attack the app will drop/reject fragment sets earlier instead of growing memory usage without bound to reduce risk of oom. tested on pixel 6 and pixel 8.
* fix: add fragmenttest
* fix(security): Clear in-memory keys during panic mode #588
* feat: Recreate mesh service after panic clear (#602)
* feat: Recreate mesh service after panic clear
This commit refactors the panic clear process to ensure a new mesh identity is immediately created and applied.
Previously, the `ChatViewModel` would clear sensitive data, but the recreation of the `BluetoothMeshService` was handled externally. This could lead to a delay or failure in adopting the new identity.
Key changes:
- Introduces `MeshServiceHolder` to manage the lifecycle of the `BluetoothMeshService` instance.
- Adds `recreateMeshServiceAfterPanic()` to `ChatViewModel`, which now explicitly clears the old service instance and creates a new one with a regenerated identity.
- The `meshService` property in `ChatViewModel` is now a `var` to allow it to be replaced with the fresh instance post-panic.
- The new service is started, and a broadcast announcement is sent immediately, ensuring the new peer ID is used on the network.
* fix: Ensure mesh service is properly managed in foreground service
* refactor: Decouple handlers from direct service reference
This commit updates the `VerificationHandler` and `MediaSendingManager` to receive the `meshService` via a lambda function (`getMeshService`) instead of a direct reference.
This change decouples the handlers from the service instance, preventing them from holding a stale reference if the service reconnects or changes. By invoking the lambda to get the current service instance when needed, it ensures they always interact with the active `meshService`.
* fix: restart bluetooth
---------
Co-authored-by: Moe Hamade <69801237+moehamade@users.noreply.github.com>
* try catch the foreground location service if not available
* ask for background permissions
* background permissions in onboarding
* small improvements
* Automated update of relay data - Sun Sep 21 06:21:05 UTC 2025
* Automated update of relay data - Sun Sep 28 06:20:40 UTC 2025
* refactor: new close button like ios(but not liquid glass)
* Automated update of relay data - Sun Oct 5 06:20:09 UTC 2025
* Automated update of relay data - Sun Oct 12 06:20:12 UTC 2025
* Automated update of relay data - Sun Oct 19 06:21:51 UTC 2025
* Automated update of relay data - Sun Oct 26 06:21:31 UTC 2025
* Automated update of relay data - Sun Nov 2 06:22:16 UTC 2025
* Automated update of relay data - Sun Nov 9 06:21:43 UTC 2025
* Automated update of relay data - Sun Nov 16 06:22:37 UTC 2025
* Automated update of relay data - Sun Nov 23 06:22:51 UTC 2025
* Automated update of relay data - Sun Nov 30 06:24:08 UTC 2025
* Automated update of relay data - Sun Dec 7 06:22:59 UTC 2025
* Automated update of relay data - Sun Dec 14 06:24:33 UTC 2025
* Automated update of relay data - Sun Dec 21 06:24:49 UTC 2025
* Automated update of relay data - Sun Dec 28 06:25:38 UTC 2025
* feat: Add ZXing dependency for QR code scanning
* feat: Request camera permission for QR verification
* Add QR verification payloads and mesh wiring
* Wire verification state, system messages, and notifications
* Add verification sheets and UI affordances
* Show verified badges in sidebar and add strings
* Persist fingerprint caches for offline verification
* Handle bitchat://verify deep links
* feat: Replace zxing-android-embedded with ML Kit and CameraX
* Refactor(Verification): Replace zxing with MLKit for QR scanning
* Replace `AndroidView` with `CameraXViewfinder` for camera preview
* Refactor QR verification: Extract VerificationHandler and fix concurrency issues
* Extract and translate strings for QR verification feature
* Fix build errors: Escape ampersands in strings and restore missing methods in ChatViewModel
* return to main
* return to main 2
---------
Co-authored-by: GitHub Action <action@github.com>
Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>
* wifi aware wip
* wifi aware wip
* starting to work
* werk
* dms work
* wip
* fix(wifi-aware): use bindSocket and scoped IPv6 instead of bindProcessToNetwork
* Merge branch 'upstream/main' into fix/wifi-aware-socket-binding
* Fix Wi-Fi Aware connectivity and UI integration post-merge
- Replace bindProcessToNetwork with bindSocket for VPN compatibility.
- Implement Scoped IPv6 address resolution (aware0) for mesh routing.
- Bridge Wi-Fi Aware incoming messages to AppStateStore for UI visibility.
- Fix syntax errors and variable name conflicts in Debug UI.
* Enhance Wi-Fi Aware robustness and debug UI display
- Clean up transport resources (sockets, server sockets, network callbacks) immediately on peer disconnection.
- Implement resolveScopedAddress to show scoped IPv6 (e.g., %aware0) in Debug UI.
- Fix Map type mismatch warning in ChatViewModel bridge.
- Filter self-ID from peer cleanup tables to prevent recursive self-removal.
* Share GossipSyncManager across transports to prevent redundant message synchronization
- Registered BluetoothMeshService's GossipSyncManager as a singleton in MeshServiceHolder.
- Modified WifiAwareMeshService to use the shared GossipSyncManager if available.
- Added background cleanup for peer mappings on socket disconnection.
- Fixed Kotlin type mismatch during nickname map merging.
* Restore VPN acquisition logic and improve peer cleanup
- Revert removal of NET_CAPABILITY_NOT_VPN to allow hardware handle acquisition while VPN is active.
- Refactor handlePeerDisconnection to more reliably cleanup initial and routed IDs.
- Switch cleanup logging to debug level to reduce log noise.
---------
Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>
Co-authored-by: aidenvalue <>
* persistence step 1
* fix build
* messages in the background work, notifications not yet
* app state store
* DM icon shows up
* notification launches when app is closed!
* keep ui updated
* lifecycle fixes
* extensive logging, maybe revert later
* send nickname in announcement
* quit in notification
* setting in about sheet
* fix quit bitchat
* lifecycle fixes
* power mode based on background state
* stats for both direciotns
* fix graph persistence
* better counting
* count per device
* only compute when debug sheet is open? untested
* fix read receipts
* fix read receipts fully
* fix unread badge if messages have been read in focus
* foreground promotion fix
* fix app kill in notification
* adjust to new tor
* nice
* about sheet design
* tor voice wip
* worky BLE a bit
* can send sound
* remove tor
* ui cleanup
* recording time
* progress bar color
* nicknames for audio
* onboarding permissions no microphone
* may work
* fix destionation
* extend
* refactor voice input component
* fix keyboard collapse issue
* send images
* wip image open
* image sending works
* wip waveforms
* better
* better animation
* fix cursor for sending audio
* image sending animation
* image sending animation
* full screen image viewer
* gossip sync for fragments too
* reduce delays
* fix keyboard focus
* use v2 for file transfers
* do not sync fragments
* scrollable image viewer
* ui
* ui adjustments
* nicer animation
* seek through audio
* add spec
* add more details to documentation
* File sharing E2E:
- Add TLV BitchatFilePacket, FileSharingManager
- Implement sendFileNote in ChatViewModel
- File receive path: save to files/incoming and render [file] messages with FileMessageItem or FileSendingAnimation during transfer
- SAF FilePickerButton and dispatcher wiring; image/file choice to follow in MediaPickerOptions
- Add FileViewerDialog with system open/save, FileProvider and file_paths
- Hook transfer progress to file sending UI
- Manifest: READ_MEDIA_* and FileProvider
- Fix MessageHandler saving and prefix for non-image payloads
- Add helper utils (FileUtils)
* kinda wip
* fix buttons
* files half working
* wip file transfer
* file packet has 2-byte TLV and chunks. it wokrs but it sucks
* clean
* remove gossip sync for fragments
* fix audio and image rendering
* adjust FILE_SIZE TLV size too
* cleanup
* haptic
* private messages media
* read receipts for media
* use enum for message type not string
* delivery ack checks dont push content
* check
* animation fix
* refactor
* ui adjustments
* comments
* refactor
* fix crash on send and receive of the same file
* refactor notifications
* tests
