feat: the terminal on the bridge, end to end

.env.example

@@ -72,3 +72,7 @@ GIT_REPO=https://github.com/your-username/your-repo.git
 # set them here (or add them on the phone).
 # CODEDECK_DIRECT_LISTEN=0.0.0.0:7447
 # CODEDECK_DIRECT_ENDPOINTS=wss://192.168.1.20:7447
+# Terminals: 1 lets an approved phone open a shell in the container (off by
+# default). Approve each phone with `docker compose exec codedeck-bridge
+# codedeck-bridge terminal allow <device>`; docs/TERMINAL.md has the rest.
+# CODEDECK_TERMINAL=1

apps/android/app/build.gradle.kts

@@ -155,6 +155,11 @@ dependencies {
     implementation(libs.markdown.renderer.m3)
     implementation(libs.kotlinx.serialization.json)
 
+    // The vendored Termux terminal view and its emulator (Apache-2.0) — a
+    // Compose screen hosts the view; see terminal-view/README.md.
+    implementation(project(":terminal-view"))
+    implementation(project(":terminal-emulator"))
+
     testImplementation(libs.junit)
     testImplementation(libs.kotlinx.coroutines.test)
     testImplementation(libs.robolectric)

apps/android/app/src/main/AndroidManifest.xml

@@ -11,6 +11,8 @@
     <!-- Camera is only for the pairing-QR scan (ui/screens/PairingScanView.kt);
          requested on the first scan tap, never at launch. -->
     <uses-permission android:name="android.permission.CAMERA" />
+    <!-- The fingerprint or screen-lock prompt before a terminal opens, when the user asks for it. -->
+    <uses-permission android:name="android.permission.USE_BIOMETRIC" />
 
     <!-- Camera-less devices can still install and run: a scan tap on one
          falls into the denied/unavailable no-scan path instead of the app

apps/android/app/src/main/java/com/codedeck/plus/core/CoreHost.kt

@@ -68,6 +68,10 @@ class CoreHost(
     dbPath: String,
     proxy: String?,
     tor: Boolean,
+    /** This phone's name for the bridge, built by the top-level `deviceLabel`
+     *  function. Sent on every session-key grant, shown in the bridge's
+     *  terminal allowlist and in a refusal to open a terminal. */
+    deviceLabel: String,
 ) : CoreListener {
     private val scope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
 
@@ -91,6 +95,18 @@ class CoreHost(
     )
     val events: SharedFlow<CoreEvent> = _events.asSharedFlow()
 
+    /**
+     * Where the terminal on screen takes its output (`CoreEvent.TerminalOutput`),
+     * called on the core's thread. Kept off [events] on purpose: a shell can
+     * send a frame every 16 ms, which would push every other event out of
+     * that flow's small buffer, and dropping a terminal frame there would
+     * leave a hole in the screen that no offset check could see. Set by the
+     * terminal screen before it opens or attaches, so a replay that answers
+     * at once is not missed; null while no terminal is on screen.
+     */
+    @Volatile
+    var terminalOutput: ((CoreEvent.TerminalOutput) -> Unit)? = null
+
     private val _machines = MutableStateFlow<UniffiMachinesView?>(null)
     val machines: StateFlow<UniffiMachinesView?> = _machines.asStateFlow()
 
@@ -161,7 +177,7 @@ class CoreHost(
     // Constructed last: `Core` holds `this` as its listener and may call back
     // from its own thread straight away, so every field a callback touches
     // (the refreshers above) must already be initialized.
-    private val core: Core = Core(identity, sessionKeys, this, notifier, CoreHttpFetch(), dbPath, proxy, tor)
+    private val core: Core = Core(identity, sessionKeys, this, notifier, CoreHttpFetch(), dbPath, proxy, tor, deviceLabel)
 
     fun start() {
         core.start()
@@ -218,6 +234,15 @@ class CoreHost(
         }
     }
 
+    /**
+     * [dispatch] on the host's own scope, for a caller whose scope is going
+     * away — a screen telling the core it closed, from its `onDispose`, where
+     * a launch on the composition's scope would be cancelled before it ran.
+     */
+    fun dispatchDetached(intent: UniffiIntent) {
+        scope.launch { dispatch(intent) }
+    }
+
     /**
      * The phone's own Nostr id in bech32 `npub1…` form — derived by the core
      * at construction from the identity secret it holds, so callers get the
@@ -289,6 +314,10 @@ class CoreHost(
     }
 
     override fun onEvent(event: CoreEvent) {
+        if (event is CoreEvent.TerminalOutput) {
+            terminalOutput?.invoke(event)
+            return
+        }
         _events.tryEmit(event)
         when (event) {
             is CoreEvent.StateChanged -> when (event.slice) {
@@ -326,3 +355,31 @@ class CoreHost(
 
     private fun refreshPairing() = pairingRefresher.request()
 }
+
+/**
+ * This phone's name for the bridge's terminal allowlist and its refusal
+ * message, built from the platform's own model string ([model]) and the
+ * manufacturer. The make is added only when the model does not already name
+ * it: a "Google Pixel 8a" says nothing "Pixel 8a" does not, while a bare
+ * model code like "SM-S918B" names no make on its own. The manufacturer is
+ * capitalized because `Build.MANUFACTURER` is often lowercase ("samsung").
+ *
+ * The bridge sanitizes and caps the name before showing it (see
+ * `CoreConfig::device_label`), so a name that is empty here is simply no
+ * name.
+ */
+internal fun deviceLabel(manufacturer: String, model: String): String {
+    val make = capitalizeAscii(manufacturer.trim())
+    val name = model.trim()
+    return when {
+        name.isEmpty() -> make
+        make.isEmpty() -> name
+        // Already names its make: either it starts with the make, or it reads
+        // as a product name (it carries lowercase) rather than a model code.
+        name.startsWith(make, ignoreCase = true) || name.any { it.isLowerCase() } -> name
+        else -> "$make $name"
+    }.ifBlank { "Android device" }
+}
+
+private fun capitalizeAscii(value: String): String =
+    if (value.isEmpty()) "" else value.take(1).uppercase() + value.drop(1)