Skip to content

feat: add Root hotspot routing and configurable Web listeners - #7

Merged
fython merged 2 commits into
fython:mainfrom
TioaChan:codex/web-listen-root-compat
Oct 10, 2026
Merged

fython merged 2 commits into
fython:mainfrom
TioaChan:codex/web-listen-root-compat

Conversation

@TioaChan

@TioaChan TioaChan commented Oct 10, 2026 •

Copy link
Copy Markdown
Contributor

#4 中的 Tesla IPv4 VPN 地址无法直接共享给 Android 热点设备。本 PR 将该入口改为基于 VPN Hotspot 的内置 Root 路由适配,并将普通 Web 监听设置与 Tesla 端口映射分开。

变化

  • 普通 HTTP / HTTPS 监听使用高位端口,无需 Root;统一配置 Web 域名,增加 HTTPS 开关、自定义端口及页面内证书类型选择,支持默认证书、PEM 证书与私钥、PKCS#12。
  • Tesla 兼容模式提供自定义 IPv4 地址与 HTTP / HTTPS 低位端口映射(默认 80 / 443),只匹配配置的访问 IP;Root 检查成功后显示相关设置。启动时后台检查一次 Root,保留手动授权与重试按钮。
  • 路由事务在失败、热点变化和服务退出时撤销所安装的规则,不清空系统规则;失败信息保留具体命令。若启动回滚清理未确认,会保持阻塞,手动重试、配置变化及停止/重启 Web 服务均不会安装新规则。移除冗余 addrtype 匹配,兼容缺少该内核模块的 ROM。
  • 修复 Android Conscrypt 导入 EC PEM 私钥时的算法名称匹配问题,兼容传统 EC 私钥前置的命名/显式 EC PARAMETERS,仍拒绝缺失或多把私钥及额外对象,保留导入失败时的原证书和监听器;迁移旧的端口与域名偏好。
  • 保留有线 CarPlay 的 IPv6 VPN。内置适配仅共享 WheelPlay 本地 Web 服务,不提供通用的第三方 VPN Internet 转发。记录 VPN Hotspot 来源和 Apache-2.0 许可。

验证

  • :common:testDebugUnitTest:197 项;:shared:testDebugUnitTest:239 项,均无失败、错误或跳过。
  • 网页代码未变,沿用此前 npm test 64 项通过及 JavaScript 语法检查结果。
  • :mobile:lintDebug:0 错误、18 项警告;:mobile:assembleDebug 通过。
  • 合并后的完整回归覆盖上游认证启动限制、资源导入与浏览器全屏启动,以及本 PR 的监听、证书、Root 授权、事务回滚和清理;已检查设置页面原生渲染。
  • 新增回归先复现旧代码的启动回滚保护与 EC 参数块问题,再验证修复:真实事务 shell 模拟启动/回滚双重失败;Android Conscrypt KeyManager 进行可信 TLS 握手与身份保存重载,同时检查单把私钥约束。
  • 本机认证资产与 APK 未提交,测试使用合成认证资源。

同步至上游 main 的 1dc11aa,保留新增的认证资源导入、认证校验与全屏启动功能。

此前在一加 7 Pro / EvolutionX Android 16 / Magisk 上通过 ADB 验证了自动 Root 授权、HTTP 80 和 HTTPS 443 映射、HTTPS 系统 CA / 主机名验证,以及强制停止后的规则清理和冷启动恢复。真机测试使用同步上游前的版本;其他热点客户端及 Tesla 实机浏览器仍待验证。

@TioaChan

Copy link
Copy Markdown
Contributor Author
IMG_8185

@TioaChan

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

To use Codex here, create a Codex account and connect to github.

@TioaChan

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-10T07:10:09.861434Z 0408cdd Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0408cddd2a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread common/src/main/java/com/shilapi/xcertplay/web/RootHttpRouting.kt
Comment thread common/src/main/java/com/shilapi/xcertplay/web/LanTls.kt Outdated
Replace the Tesla VPN alias with a VPN Hotspot-based Root routing adapter
so hotspot clients can reach WheelPlay's local HTTP and HTTPS services.
Manage the custom IPv4 alias, scoped return routing, and low-port mappings
in one transaction with rollback and cleanup on service/hotspot changes.

Keep ordinary HTTP/HTTPS listeners independent of Root in Web listener
settings. Add a persistent HTTPS switch and inline default, PEM, and
PKCS#12 certificate choices. Label the shared HTTP/HTTPS hostname as Web
domain and migrate existing listener/domain preferences. Normalize imported
EC private-key algorithms for Android Conscrypt and retain active listeners
and identities when configuration changes fail.

Check Root once in the background at startup, refresh Tesla controls after
authorization, and retain the manual retry button. Remove the redundant
addrtype match from destination-scoped DNAT rules for kernels without that
extension. Report the failing routing command and preserve it after rollback.
Block new installations after unconfirmed startup rollback, including retries
and plan changes. Accept one optional leading EC PARAMETERS block in PEM
while still enforcing a single private key and rejecting trailing objects.

Preserve upstream authentication import and activation checks when rebasing
onto main: listeners and wake locks still require a validated identity.

Validation on upstream main 1dc11aa: Common 197 and Shared 239 tests passed;
Android Lint reported 0 errors and Debug assembly passed. Browser 64 tests
passed before the final Root/TLS fixes and their code is unchanged.
Before this upstream sync, the signed arm64 APK passed packaging checks
and OnePlus 7 Pro / EvolutionX Android 16 / Magisk device checks for startup
Root authorization, HTTP 80 and HTTPS 443, TLS hostname/CA validation, and
rule cleanup/restoration. Other hotspot clients and Tesla remain untested.

Co-authored-by: Codex <noreply@openai.com>
@TioaChan
TioaChan force-pushed the codex/web-listen-root-compat branch from 0408cdd to 63e8557 Compare October 10, 2026 07:21
Use the App's audio buffer setting (300, 500 or 1000 ms; 300 ms by
default) for browser media playback instead of a fixed short start
delay. Changing the setting is now persisted and pushed through
WebSession so connected browsers rebuild their media playback buffer;
first playback and recovery after buffer exhaustion both use the
selected delay. Calls, navigation and other non-media audio keep the
short buffer, and microphone sampling is unaffected.

Mark media PCM packets with a reserved flags word in the WPA1 header.
The sender sizes each stream's queue by PCM duration: media keeps the
configured buffer plus 200 ms, non-media keeps 100 ms, with a 128-frame
total cap and four frames awaiting acknowledgement. The browser accepts
a media burst above the selected start buffer, drops newly arriving
audio once the backlog limit is reached instead of tearing down sound
that is already queued, and applies a buffer change to the affected
stream only.

Add bridge, sender, server and browser regressions, and document the
buffer behaviour in BROWSER_AUDIO.md. Bump the version to 0.3.0 (21)
for the signed arm64 release build.

Validation: Common 201 and Shared 239 tests passed, 0 failures; Android
Lint reported 0 errors and 18 warnings; browser 67 tests and the
JavaScript syntax check passed. The arm64 release APK passed package,
signature, 16 KiB alignment, arm64-only, authentication asset and web
asset checks, and was installed over the previous signed build on
OnePlus 7 Pro / Android 16 with app data preserved.

Co-authored-by: Codex <noreply@openai.com>
@TioaChan

Copy link
Copy Markdown
Contributor Author

新增修复web媒体通道播放断断续续的问题,可考虑单独为 web 播放缓冲设置时间,电话通道没有这种现象。

@fython

我这日志显示五个统计窗口内,maxGapMs 分别是 423、416、398、401、396ms,这远超浏览器目前 60ms 的播放缓冲。

@fython
fython merged commit f3d94e1 into fython:main Oct 10, 2026
1 check passed
@fython

fython commented Oct 10, 2026

Copy link
Copy Markdown
Owner

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants