Kayos
10154c380b
Round-7 Opus audits explicitly flagged the audit loop as past
diminishing returns. Landing the few real items + one race-order
fix; leaving the comment-hygiene tail for the next time someone
reads the files.
MED
R7-1 SearchViewModel cache-preview race: vc=41 wrote the cached
preview to UI before cancelling the prior inFlight, so the
prior coroutine (already past its ensureActive() gate)
could reach its terminal _ui.update and clobber the cache
preview. Moved inFlight?.cancel() above the preview write.
R7-2 StrawActivity.YT_HOSTS duplicated util.YtUrl.ALLOWED_YT_HOSTS
— drift risk where one gets a new host and the other
doesn't. Collapsed StrawActivity.looksLikeYouTube to call
util.isAllowedYtUrl, picking up the scheme + trailing-dot
defenses for free.
R7-3 Dropped dead once_cell dep from rust/strawcore/Cargo.toml.
Round-4's runtime rewrite uses AtomicBool + Mutex; nothing
consumes once_cell anymore.
Audit explicitly called out (and we agree) these as past the value
threshold for further rounds:
- Verified-clean: try_lock no deadlock, ensureActive fence, bad-URL
early-return cancel, duplicate-zip-entry rejection, LIMIT clauses,
SponsorBlock 50ms exclusion drop, applied++ count.
- False positive: H1 "Related videos always empty" — the section
already gates on `d.related.isNotEmpty()`; UI doesn't paint when
extractor stub returns empty.
- Deferred: R8 enable, Nav rememberSaveable, LazyColumn keys,
collectAsStateWithLifecycle, DASH/HLS max-resolution cap,
Gradle cargo-build input/output declarations (CI cost, not
runtime), legacy :app module trim, stale comment cleanup.
49 lines
2.1 KiB
TOML
49 lines
2.1 KiB
TOML
[package]
|
|
name = "strawcore"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
authors.workspace = true
|
|
repository.workspace = true
|
|
|
|
[lib]
|
|
# cdylib — the .so that Android loads via System.loadLibrary("strawcore").
|
|
# staticlib — kept in case we ever want to link statically for a benchmark.
|
|
crate-type = ["cdylib", "staticlib"]
|
|
|
|
[dependencies]
|
|
# UniFFI generates the Kotlin bindings + the JNI glue. proc-macro mode
|
|
# (no .udl file) — annotate Rust fns directly with #[uniffi::export].
|
|
# `tokio` feature wires `#[uniffi::export(async_runtime = "tokio")]` so async
|
|
# fns surface as suspend fun on the Kotlin side.
|
|
uniffi = { version = "0.28", features = ["cli", "tokio"] }
|
|
# Tokio multi-thread runtime — needed to host spawn_blocking around the
|
|
# blocking strawcore_core HTTP calls so Kotlin `suspend fun` semantics
|
|
# survive.
|
|
tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync"] }
|
|
# The actual YT extractor lives in Sulkta-Coop/strawcore. Renamed locally
|
|
# to `strawcore_core` to avoid collision with this wrapper crate's name
|
|
# (which has to stay `strawcore` so the .so name + Kotlin loadLibrary
|
|
# call keep working).
|
|
strawcore-core = { path = "../../../strawcore" }
|
|
# rquickjs-sys is pulled transitively by strawcore-core → rquickjs. The
|
|
# Android target has no pre-generated bindings — flip on the `bindgen`
|
|
# feature so cargo regenerates at build time. Direct dep so the feature
|
|
# flag propagates (cargo's unified feature resolver lifts this to the
|
|
# transitive use). Crafting-table has libclang preinstalled.
|
|
rquickjs-sys = { version = "0.11", default-features = false, features = ["bindgen"] }
|
|
# Error glue.
|
|
thiserror = "1"
|
|
# Android log integration — `log::info!()` ends up in `adb logcat -s strawcore`.
|
|
log = "0.4"
|
|
android_logger = { version = "0.14", default-features = false }
|
|
|
|
[build-dependencies]
|
|
uniffi = { version = "0.28", features = ["build"] }
|
|
|
|
[[bin]]
|
|
# Generates Kotlin bindings from the compiled .so:
|
|
# cargo run --bin uniffi-bindgen generate --library target/.../libstrawcore.so \
|
|
# --language kotlin --out-dir ../../strawApp/src/main/kotlin
|
|
name = "uniffi-bindgen"
|
|
path = "src/uniffi-bindgen.rs"
|