chore: release Papyrus 0.1.1 for Android - #8
Conversation
Replace Papyrus app icons on Android, iOS, macOS, Windows, and Web platforms. Adds new icon asset (assets/icons/app_icon.png), expands iOS icon set with additional sizes (50x50, 57x57, 72x72), and updates web manifest colors from blue to white. Reformats macOS icon configuration JSON.
Fix app icon sharpness and Windows multi-size packaging.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1c14b85d6b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| Future<void> _startService() async { | ||
| try { | ||
| await startMCPService(); |
There was a problem hiding this comment.
When this runs at app startup, any desktop/mobile instance automatically exposes the unauthenticated local MCP HTTP API. The server still allows Access-Control-Allow-Origin: * (lib/mcp/mcp_server.dart:41) and the new tool handler can list, update, and delete cards by id, so a malicious website can POST to http://127.0.0.1:8787/call while Papyrus is open and modify the user's local study data without consent. Please keep MCP disabled by default or require an explicit token/setting before starting it.
Useful? React with 👍 / 👎.
| @@ -0,0 +1,5 @@ | |||
| import 'mcp_isolate.dart'; | |||
|
|
|||
| Future<void> startMCPService() => MCPIsolate.start(); | |||
There was a problem hiding this comment.
On Android release builds, dart.library.io selects this implementation and the app now calls it on startup, but the release manifest in android/app/src/main has no android.permission.INTERNET declaration (only debug/profile manifests do). The release APK/AAB produced by this workflow will therefore fail the HttpServer.bind with a permission SocketException, leaving MCP silently unavailable in the Android release; either gate this implementation away from Android or add the release permission if MCP is intended there.
Useful? React with 👍 / 👎.
1 participant
Summary
0.1.1+2SHA256SUMS.txtValidation
flutter pub getdart run build_runner build --delete-conflicting-outputsflutter analyze --no-fatal-infosflutter test(31 tests passed)git diff --checkLocal Android packaging could not start because this Windows environment has no Android SDK configured; GitHub Actions is the final Android build verification.