Work/2026 09 14

.github/workflows/ci.yml

@@ -101,3 +101,44 @@ jobs:
       # needs secrets a fork's pull request cannot have, and gating CI on them
       # would mean no outside contribution could ever go green.
       - run: flutter build apk --debug
+
+  # The same argument as build-android, applied to the desktop side: a broken
+  # CMakeLists, a plugin with no Linux implementation or a missing system
+  # library is invisible to the analyzer and only surfaces on release day, in
+  # the job that is supposed to be publishing.
+  #
+  # Linux only, on purpose. A windows-latest runner bills at twice the Linux
+  # rate and its builds are the slowest of the three, which would roughly
+  # triple the cost of every pull request to catch a narrow class of
+  # Windows-only breakage. Most desktop plugin failures are not platform
+  # specific, and Linux catches those for the price of the cheapest runner
+  # GitHub sells. If Windows-only breakage ever actually reaches a release,
+  # that is the evidence for adding the job — not this comment.
+  build-linux:
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    env:
+      # Some transitive native dependencies still declare a cmake_minimum_required
+      # below 3.5, which current CMake refuses outright. Mirrors release.yml.
+      CMAKE_POLICY_VERSION_MINIMUM: '3.5'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+
+      # Kept in step with the same list in release.yml's linux job; a build that
+      # goes green here and red there teaches nobody anything.
+      - name: Install Linux desktop + plugin system deps
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            clang cmake ninja-build pkg-config \
+            libgtk-3-dev liblzma-dev libstdc++-12-dev \
+            libmpv-dev mpv \
+            libsecret-1-dev libjsoncpp-dev libsecret-1-0
+
+      - run: touch .env
+      - run: flutter pub get
+      - run: flutter build linux --debug

.github/workflows/release.yml

@@ -579,10 +579,23 @@ jobs:
       - run: flutter --version
       - run: flutter pub get
       - run: flutter build windows --release
+      # /DMyAppVersion, because the .iss cannot read pubspec.yaml. Without it the
+      # installer falls back to its own placeholder and every release would show
+      # up under the same version in Add/Remove Programs.
       - name: Build installer (Inno Setup)
+        shell: pwsh
+        env:
+          NAME: ${{ needs.version.outputs.name }}
         run: |
           choco install innosetup --no-progress -y
-          & "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" "windows\installer\Sozo.iss"
+          # /D emulates `#define public <name> <value>`, and the value is handed
+          # to the preprocessor as source: a bare 3.0.4 is not something ISPP can
+          # parse, so the version has to arrive already wrapped in literal double
+          # quotes to be unambiguously a string. PowerShell re-quotes arguments on
+          # their way to a native command and would eat those quotes, so --% hands
+          # the rest of the line to ISCC verbatim — which also means the version
+          # has to come in as cmd-style %NAME%, the one expansion --% still does.
+          & "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" --% /DMyAppVersion="%NAME%" windows\installer\Sozo.iss
       - name: Also zip the raw build (portable)
         shell: pwsh
         run: |
@@ -648,9 +661,32 @@ jobs:
       - run: flutter --version
       - run: flutter pub get
       - run: flutter build linux --release
+      # The bundle on its own is a binary in a folder: no menu entry, no icon,
+      # and nothing claiming the sozo:// scheme, so a Linux user got a strictly
+      # worse app than the Windows and macOS ones from the same release. The
+      # three files from linux/packaging travel with it and install.sh wires
+      # them into the user's session without root — which is the only kind of
+      # install a tarball can honestly offer.
       - name: Package (tar.gz)
         run: |
-          cd build/linux/x64/release/bundle
+          set -euo pipefail
+          BUNDLE=build/linux/x64/release/bundle
+          # Copied one at a time, and only when present. A missing packaging file
+          # costs the desktop integration; it does not make the build unusable,
+          # and under `set -e` a single `cp` of all three would turn that into a
+          # failed release. ::warning:: surfaces it on the run summary instead, so
+          # a file that never got committed is visible rather than fatal.
+          for f in sozo.desktop sozo.png install.sh; do
+            if [ -f "linux/packaging/$f" ]; then
+              cp "linux/packaging/$f" "$BUNDLE/"
+            else
+              echo "::warning::linux/packaging/$f is missing from the checkout — the Linux tarball ships without it."
+            fi
+          done
+          if [ -f "$BUNDLE/install.sh" ]; then
+            chmod +x "$BUNDLE/install.sh"
+          fi
+          cd "$BUNDLE"
           tar -czf "$GITHUB_WORKSPACE/Sozo-Linux-x64.tar.gz" .
       - uses: actions/upload-artifact@v4
         with:

.metadata

@@ -15,12 +15,21 @@ migration:
     - platform: root
       create_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
       base_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
+    - platform: android
+      create_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
+      base_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
+    - platform: ios
+      create_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
+      base_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
     - platform: linux
       create_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
       base_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
     - platform: macos
       create_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
       base_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
+    - platform: windows
+      create_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
+      base_revision: ff37bef603469fb030f2b72995ab929ccfc227f0
 
   # User provided section
 

SECURITY.md

@@ -0,0 +1,72 @@
+# Security policy
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.** An issue is visible to
+everyone the moment it is filed, including to people who would use it before it
+is fixed.
+
+Report it privately through GitHub's own channel:
+
+> **[Report a vulnerability](https://github.com/professorDeveloper/sozo/security/advisories/new)**
+
+That opens a draft advisory only the maintainers and you can read. If you cannot
+use it for any reason, say so in a normal issue **without any detail** — just
+"I would like to report a security issue privately" — and you will be contacted.
+
+### What helps
+
+- What an attacker can do, in one sentence. That is what decides how fast this
+  moves.
+- The version — the one on the About screen, or a commit hash.
+- The platform and OS version.
+- The smallest reproduction you have. A log with the secret parts removed is
+  worth more than a description of a log.
+
+You do not need a proof-of-concept exploit, and you do not need to write the
+fix. A clear description of the flaw is enough.
+
+### What to expect
+
+- An acknowledgement within a few days.
+- An assessment, and the reasoning behind it, once the report has been read
+  properly — including when the answer is that it is not a vulnerability.
+- Credit in the advisory and the release notes, under whatever name you choose,
+  unless you ask not to be named.
+
+Please give a fix a reasonable chance to ship before disclosing publicly. If a
+report goes unanswered, that is a failure on this end and not a reason to keep
+waiting indefinitely.
+
+## What is in scope
+
+Anything in this repository, and anything the app does on a user's device:
+
+- The app itself, on every platform it ships to.
+- The stored data. The session and tracker tokens and the PIN-hidden private
+  list are AES-encrypted at rest with a key held in the platform keystore; a way
+  to read any of it without the keystore is a vulnerability.
+- The app lock, and any way around it.
+- The deep-link handlers (`sozo://`, `https://`) and the "Open with" paths.
+- Anything that lets a source, an extension or a page it loads reach further
+  than the content it is meant to serve — the file system, the keystore, another
+  source's cookies, or the app's own JavaScript runtime.
+- Secrets in the repository or in a shipped artifact.
+
+## What is not
+
+- **Third-party sources.** Sozo does not host content; a source's site being
+  hostile, wrong or down is that site's business. If a source can escape the
+  sandbox it runs in, that IS in scope — report it.
+- A vulnerability in a dependency that Sozo does not actually reach. Report it
+  upstream; mention it here if you believe our usage makes it exploitable.
+- Reports that only say a scanner flagged something, with no path to an effect.
+- Anything requiring a rooted or jailbroken device and physical access, unless
+  it defeats the app lock or the encryption at rest, which are the two things
+  that exist for exactly that case.
+
+## Supported versions
+
+The latest release. Fixes go into the next release rather than into patches of
+older ones — there is no long-term support branch, and asking users to stay on
+an old version is not a security answer.

android/app/src/main/kotlin/com/soplay/sozo/MainActivity.kt

@@ -70,6 +70,7 @@ class MainActivity : FlutterFragmentActivity() {
     private val cloudstreamChannelName = "soplay/cloudstream"
     private var cloudstreamChannel: MethodChannel? = null
     private var previewChannel: MethodChannel? = null
+    private var tilesChannel: MethodChannel? = null
     private val cloudstreamScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
     private val pluginHost by lazy {
         // CloudflareKiller is constructed by plugins with no arguments, so it
@@ -171,6 +172,12 @@ class MainActivity : FlutterFragmentActivity() {
         platformChannel?.setMethodCallHandler { call, result ->
             when (call.method) {
                 "isTv" -> result.success(isLeanbackDevice())
+                "isEmulator" -> result.success(
+                    Build.HARDWARE == "goldfish" || Build.HARDWARE == "ranchu" ||
+                        Build.MODEL.startsWith("sdk_gphone") ||
+                        Build.MODEL.contains("Android SDK built for") ||
+                        Build.PRODUCT.startsWith("sdk_gphone")
+                )
                 "openExternalVideo" -> {
                     val url = call.argument<String>("url").orEmpty()
                     val title = call.argument<String>("title").orEmpty()
@@ -741,6 +748,54 @@ class MainActivity : FlutterFragmentActivity() {
             }
         }
 
+        // Sharp zoom on a manga page. See PageTiles: the whole point is that
+        // nothing here ever holds a full-size bitmap, so every call is off the
+        // platform thread — a region of a large JPEG is tens of milliseconds
+        // and the reader is being panned while it runs.
+        tilesChannel = MethodChannel(
+            flutterEngine.dartExecutor.binaryMessenger,
+            "soplay/tiles",
+        )
+        tilesChannel?.setMethodCallHandler { call, result ->
+            when (call.method) {
+                "open" -> {
+                    val path = call.argument<String>("path").orEmpty()
+                    cloudstreamScope.launch {
+                        val opened = com.soplay.sozo.tiles.PageTiles.open(path)
+                        withContext(Dispatchers.Main) { result.success(opened) }
+                    }
+                }
+                "region" -> {
+                    val handle = (call.argument<Number>("handle") ?: 0).toLong()
+                    val left = (call.argument<Number>("left") ?: 0).toInt()
+                    val top = (call.argument<Number>("top") ?: 0).toInt()
+                    val right = (call.argument<Number>("right") ?: 0).toInt()
+                    val bottom = (call.argument<Number>("bottom") ?: 0).toInt()
+                    val sample = (call.argument<Number>("sampleSize") ?: 1).toInt()
+                    cloudstreamScope.launch {
+                        val bytes = com.soplay.sozo.tiles.PageTiles.region(
+                            handle, left, top, right, bottom, sample,
+                        )
+                        withContext(Dispatchers.Main) { result.success(bytes) }
+                    }
+                }
+                "close" -> {
+                    val handle = (call.argument<Number>("handle") ?: 0).toLong()
+                    cloudstreamScope.launch {
+                        com.soplay.sozo.tiles.PageTiles.close(handle)
+                        withContext(Dispatchers.Main) { result.success(true) }
+                    }
+                }
+                "closeAll" -> {
+                    cloudstreamScope.launch {
+                        com.soplay.sozo.tiles.PageTiles.closeAll()
+                        withContext(Dispatchers.Main) { result.success(true) }
+                    }
+                }
+                else -> result.notImplemented()
+            }
+        }
+
         setupBridgeChannel(flutterEngine)
         // Restart the bridge if the user had "share sources to desktop" on.
         if (bridgePrefs().getBoolean("enabled", false)) startBridgeServer()

android/app/src/main/kotlin/com/soplay/sozo/aniyomi/AniyomiHost.kt

@@ -11,6 +11,7 @@ import eu.kanade.tachiyomi.animesource.model.AnimesPage
 import eu.kanade.tachiyomi.animesource.model.SAnime
 import eu.kanade.tachiyomi.animesource.model.SAnimeImpl
 import eu.kanade.tachiyomi.animesource.model.Hoster
+import eu.kanade.tachiyomi.animesource.model.SEpisode
 import eu.kanade.tachiyomi.animesource.model.SEpisodeImpl
 import eu.kanade.tachiyomi.animesource.model.Video
 import eu.kanade.tachiyomi.animesource.online.AnimeHttpSource
@@ -429,13 +430,80 @@ class AniyomiHost(private val context: Context) {
     private fun failureReason(id: String): String =
         AniyomiRuntime.lastError ?: lastError ?: "source unavailable: an:$id"
 
+    /**
+     * A browse or search row.
+     *
+     * [SAnimeImpl.title] is `lateinit`, so an entry whose source never set one
+     * does not read back as empty — the getter throws
+     * `UninitializedPropertyAccessException`, and one such entry anywhere in a
+     * page took the whole page with it. The log line below already knew this
+     * and guarded its own read; the card that the reader actually sees did not,
+     * and the details path guards it separately.
+     *
+     * A row with no name falls back to the slug the site itself uses. It is
+     * legible and, more to the point, it still opens.
+     */
+    /**
+     * A url a browser can open, out of the path an extension stores.
+     *
+     * An Aniyomi source keeps `SAnime.url` and `SEpisode.url` as paths relative
+     * to its own `baseUrl`, so the app held nothing it could hand to a browser.
+     * The source object knows the base; this is the only place that has both.
+     *
+     * Empty when there is nothing openable, and the caller omits the field
+     * entirely then — an action that cannot work should not be on screen.
+     */
+    private fun webUrl(src: Any?, path: String?): String {
+        val p = path?.trim().orEmpty()
+        if (p.isEmpty()) return ""
+        if (p.startsWith("http://") || p.startsWith("https://")) return p
+        val base = (src as? AnimeHttpSource)?.baseUrl?.trimEnd('/').orEmpty()
+        if (base.isEmpty()) return ""
+        return if (p.startsWith("/")) base + p else "$base/$p"
+    }
+
+    /**
+     * An episode's page, asked of the source rather than assembled here.
+     *
+     * `SEpisode.url` is not always a path — for some sources it is a key the
+     * source turns into the real address, which is why
+     * [AnimeHttpSource.getEpisodeUrl] exists and why joining baseUrl to the
+     * stored string 404s on those. Its default IS the join, so a source that
+     * does not override it loses nothing. Same three fallbacks as the manga
+     * host: not an AnimeHttpSource, the source threw, or the answer is not
+     * http(s).
+     */
+    private fun episodeWebUrl(src: Any?, episode: SEpisode): String {
+        val http = src as? AnimeHttpSource ?: return webUrl(src, episode.url)
+        val asked = try {
+            http.getEpisodeUrl(episode).trim()
+        } catch (_: Throwable) {
+            ""
+        }
+        if (asked.startsWith("http://") || asked.startsWith("https://")) return asked
+        if (asked.isNotEmpty() && asked != episode.url) return webUrl(src, asked)
+        return webUrl(src, episode.url)
+    }
+
+    private fun titleOf(a: SAnime): String {
+        val given = try { a.title } catch (_: Throwable) { "" }
+        if (given.isNotBlank()) return given
+        return a.url.trimEnd('/')
+            .substringAfterLast('/')
+            .substringBefore('?')
+            .replace('-', ' ')
+            .replace('_', ' ')
+            .trim()
+            .ifEmpty { "Untitled" }
+    }
+
     private fun cardJson(a: SAnime, id: String) = JSONObject().apply {
         put("provider", "an:$id")
         put("externalId", a.url)
-        put("title", a.title)
+        put("title", titleOf(a))
         put("slug", a.url)
         put("contentUrl", a.url)
-        put("thumbnail", a.thumbnail_url)
+        put("thumbnail", try { a.thumbnail_url } catch (_: Throwable) { null })
         put("type", "Anime")
     }
 
@@ -627,12 +695,13 @@ class AniyomiHost(private val context: Context) {
                 put("episode", num)
                 put("label", label)
                 put("mediaRef", e.url)
+                episodeWebUrl(src, e).takeIf { it.isNotEmpty() }?.let { put("webUrl", it) }
             })
         }
         if (eps.isEmpty() && failure == null) {
             failure = "no episodes returned for this title"
         }
-        val title = try { details.title } catch (_: Throwable) { "" }
+        val title = titleOf(details)
         val author = try { details.author } catch (_: Throwable) { null }
         val status = statusLabel(try { details.status } catch (_: Throwable) { 0 })
         val desc = buildString {