[man612]

Summary

This PR turns the current Wirebound 1.0.x codebase into a safer and more reproducible 1.1.0 beta baseline without rewriting the application stack.

Runtime correctness

• removes the simulated Math.random() traffic monitor and its misleading product claim
• separates ADB failures from the valid "no Android device connected" state
• serializes device polling so slow ADB calls cannot overlap
• caches device metadata to reduce repeated ADB process churn
• makes Connected require both a live desktop Gnirehtet relay and an active Android Gnirehtet client
• performs graceful relay/client cleanup on stop and application shutdown
• runs Wirebound on a dedicated ADB server port (5038) so closing Wirebound does not kill or interfere with a normal ADB server on 5037 used by Android Studio or other tools
• adds single-instance protection to avoid multiple Wirebound instances competing for the dedicated ADB daemon

Electron/security hardening

• upgrades Electron to 44.4.1
• enables renderer sandboxing and keeps Node integration disabled
• blocks renderer navigation and permission requests by default
• validates privileged IPC calls against the trusted main frame
• restricts external URLs to the HTTPS hosts Wirebound actually uses
• removes remote Google Fonts and narrows the renderer CSP
• unifies the Windows App User Model ID / application ID

Settings and UI honesty

• moves settings normalization into a shared, testable module
• writes settings asynchronously through a temporary file + rename instead of synchronous per-keystroke writes
• keeps DNS/port inputs as drafts until valid rather than normalizing while the user types
• reports ADB unavailable / unauthorized / offline / no-access states separately
• reads the application version from Electron instead of hard-coding v1.0.0
• updates EN/ID copy so connection state does not claim end-to-end internet has been measured

Reproducible Windows builds

• removes checked-in runtime/vendor binaries from source control
• adds scripts/prepare-runtime.ps1
• pins Gnirehtet 2.5.1 and Android Platform Tools 37.0.1
• verifies downloaded archives with SHA-256 before extraction
• removes unsupported macOS/Linux packaging scripts/configuration
• switches CI to Windows and adds an unpacked package smoke test
• adds a tag-driven Windows release workflow that verifies tag/package version agreement and publishes installer checksums
• updates package version to 1.1.0

Tests and maintenance

• adds Vitest coverage for ADB parsing, Gnirehtet input normalization, and settings normalization
• removes unused Recharts / preload dependencies
• updates dependencies and resolves current npm audit findings
• rewrites README, roadmap, security policy, and third-party notices to match actual behavior and support status

Verification performed on Windows

• npm run lint -- --no-cache ✅
• npm run typecheck ✅
• npm test — 9/9 tests ✅
• npm audit --audit-level=moderate — 0 vulnerabilities ✅
• npm run build ✅
• npm run build:win — NSIS installer generated successfully ✅
• packaged app launch/close smoke test ✅
• runtime presence verified inside packaged resources/bin ✅
• build → packaged launch → close → rebuild verified after fixing the former ADB DLL lock ✅
• ADB isolation test: normal server on 5037 remained alive while Wirebound's dedicated 5038 server was created and then removed on shutdown ✅
• git diff --check ✅
• no new .exe, .dll, or .apk artifacts are committed ✅

Remaining validation before tagging 1.1.0

The code/package gates above are green, but Wirebound should remain labeled beta until the 1.1.0 build has been exercised on multiple real Android devices, Windows USB driver combinations, and ADB authorization edge cases. Connected intentionally means relay + Android client are active; the UI still recommends a device speed test when the user wants to confirm actual internet connectivity.