mirror of
https://github.com/permissionlesstech/bitchat-android.git
synced 2026-08-08 06:46:11 +00:00
141adf5468
removeGroup() is device-scoped: it removes whatever Wi-Fi Direct group exists, including one owned by Cast, Android Auto or Quick Share. stopHotspot() called it unconditionally, so the path built to protect a foreign group tore that group down anyway. Removal on stop is now gated on a createdGroup flag, set once our own createGroup command is accepted; with nothing of ours on the framework, stop closes the channel and leaves the group alone. When a group we did not record creating is active at start, the app no longer guesses about ownership - it asks. A confirmation dialog explains that starting will disconnect the current Wi-Fi Direct connection; confirming retries the start with replacement authorized, cancelling leaves everything untouched. Consent is bound to the group it was given for: the conflicting group's name travels through the dialog, and the policy only authorizes removing a group with exactly that name - one that appeared later, or swapped in mid-retry, re-prompts instead of riding on stale approval. Because consent replaces ownership proof, the DIRECT-BC- prefix heuristic is gone: a prefix match is not ownership (this device can be connected to another phone's bitchat group), so only the exact recorded name counts. The record is also kept honest: never taken from a group we do not host, and never overwritten while an old group of ours may still exist, so a BUSY retry cannot misclassify our own stale group as foreign. Also: SecurityException guards on the removeGroup() sites reached from framework callbacks (permission revoked mid-session crashed instead of failing cleanly); stopHotspot() takes a completion callback so the ViewModel releases its Wi-Fi Aware lease only after the framework acknowledges the removal, with an idempotent 10s fallback so a dropped acknowledgement cannot pin the mesh down; and the confirm/cancel handlers guard on the ConfirmDisconnect state so a tap landing through a screen transition cannot tear down a just-confirmed session. Replaces the state-machine approach of #811 - same protection at proportionate cost. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
bitchat for Android
A decentralized peer-to-peer messaging app with dual transport architecture: local Bluetooth mesh networks for offline communication and internet-based Nostr protocol for global reach. No accounts, no phone numbers, no central servers.
This is the Android implementation of bitchat, fully protocol-compatible with the iOS version for cross-platform mesh communication.
License
This project is released into the public domain. See the LICENSE file for details.
Features
- Dual Transport Architecture: Bluetooth LE mesh for offline messaging, Nostr relays for internet-based messaging
- Location-Based Channels: Geographic chat rooms using geohash coordinates over Nostr relays
- Intelligent Message Routing: Automatically chooses the best transport, with queuing and retry when a peer is unreachable
- End-to-End Encryption: Noise Protocol (XX pattern, X25519 + ChaCha20-Poly1305) for private messages over the mesh
- Decentralized Mesh Network: Automatic peer discovery and multi-hop relay over Bluetooth LE (max 7 hops)
- Wi-Fi Aware Transport: Higher-bandwidth local mesh on supported devices
- Channel Chats: Topic-based group messaging with optional password protection (Argon2id + AES-256-GCM)
- IRC-Style Commands: Familiar
/join,/msg,/whostyle interface - Tor Support: Built-in Tor (Arti) for private internet connectivity
- Emergency Wipe: Triple-tap to instantly clear all data
- Cross-Platform: Binary protocol compatible with bitchat on iOS and macOS
Technical Architecture
Bluetooth Mesh Network (Offline)
- Direct peer-to-peer within Bluetooth range, multi-hop relay through nearby devices
- Noise Protocol sessions with forward secrecy; peer identities derived from static keys
- Compact binary packet format with fragmentation, TTL routing, and deduplication
- Adaptive duty cycling and connection limits for battery efficiency
- Foreground service keeps the mesh alive within Android background execution limits
Nostr Protocol (Internet)
- Global reach via public relays, geohash-based location channels
- Private messages fall back to Nostr for mutual favorites when the mesh is unavailable
- Ephemeral keys per geohash area
Android Stack
- Kotlin, Jetpack Compose (Material 3), MVVM
- Coroutines and Flow for all networking and state
- Core components:
MeshForegroundService(persistent connectivity),BluetoothMeshService/WifiAwareMeshService(transports),UnifiedMeshService(transport selection),NoiseSessionManager(encryption sessions),MessageRouter(mesh/Nostr routing with outbox retry)
Building
Requires Android Studio and the Android SDK (API 26+).
git clone https://github.com/permissionlesstech/bitchat-android.git
cd bitchat-android
./gradlew assembleDebug
Install on a connected device:
adb install -r app/build/outputs/apk/debug/app-debug.apk
The app requests Bluetooth, location (required for BLE scanning), and notification permissions at runtime.
Release APKs and the Android App Bundle can be rebuilt byte-for-byte in the pinned Linux container. Maintainers should follow the Android release guide. See Reproducible builds for the build trust model and public GitHub/Google Play verification procedures.
Testing
# Unit tests
./gradlew test
# Lint
./gradlew lint
# Instrumented tests (requires a device or emulator)
./gradlew connectedAndroidTest
Note that BLE mesh behavior is difficult to emulate; protocol and session logic is covered by unit tests, while radio-level behavior needs real devices.