shiaho777/web-to-app

This release introduces a comprehensive AI Agent interface with modular session management, alongside a major shell and native library refactoring for Android 15+ compatibility. The app features a new WTA design system, updated media playback, and a suite of new modules including Reading Mode, YouTube Player, and TV D-Pad navigation. Under the hood, the data layer and navigation structure have been reorganized, with significant improvements to PHP routing, ProGuard rules, and build tooling.

A new 'Auto Open Video Player' module has been added, which automatically detects video URLs via XHR, Fetch, JWPlayer, and HTML5 media element interception, then opens them in an external player after a 5-second countdown. The module includes an exclusion list for known test domains and provides a persistent fallback button for manual triggering.

modules/auto-open-video-player · high confidence

A new CloneLauncherActivity has been added to the clone-host module, along with its corresponding AndroidManifest entry. This activity serves as the entry point for cloned applications, managing the display of splash screens (images or videos), handling user activation codes (both local and remote verification), and processing announcements before launching the target application.

clone-host · high confidence

A new Hello World example module has been added to the module marketplace. It displays a configurable floating banner with a greeting message, allowing users to customize the text and display duration. The module is available as a template for creating custom modules.

modules/hello-world · high confidence

A new PHP router server script (php\_router\_server.php) is introduced to handle HTTP requests within the shell environment. This script implements custom polyfills for PHP's header and session management functions (such as header(), headers\_list(), session\_start()), ensuring that web applications running through this router receive correct HTTP headers and maintain session state via local files, addressing the lack of native SAPI support in the embedded PHP environment.

shell/src/main/assets · high confidence

Users on Android TV, Fire TV, and other TV boxes can now navigate websites using the remote's D-pad or arrow keys. This new module injects a virtual mouse cursor that moves with directional input, simulates clicks and hovers, and provides a settings menu for adjusting speed, acceleration, and page zoom.

modules/tv-dpad-cursor · high confidence

A new Python script, check\_config\_field\_drift.py, is introduced to detect mismatches between the export payload and the runtime ShellConfig. It validates that every field in the payload has a corresponding @SerializedName in the shell config (and vice versa), ensuring consistency between what is exported and what the app runtime expects. An accompanying allowlist (config\_field\_drift\_allowlist.json) documents known, intentional divergences—such as nested object fields serialized by Gson or preview-only fields—preventing false positives for these specific cases.

scripts · high confidence

A new 'YouTube Fullscreen Player' module has been added, introducing a floating play button on YouTube pages that opens the current video in a clean fullscreen playback overlay via the privacy-friendly youtube-nocookie embed. The module includes URL polling to ensure the button appears correctly even when navigating from the homepage, and handles ad/sponsor cleanup via the built-in Video Enhance module.

modules/youtube-player · high confidence

The AI Agent feature has been restructured into distinct, focused classes: a new RemoteActivationVerifier handles secure, encrypted URL delivery and device-bound code verification; the AgentEngine now manages turn-based LLM streaming with support for thinking segments, tool calls, and file changes; a CompactService automatically summarizes long conversation histories to manage context window limits; and new use cases (SaveSessionAsAppUseCase, SaveSessionAsModuleUseCase) allow users to convert agent sessions into reusable apps or browser extensions. These changes improve reliability, performance, and the ability to save and continue agent work.

app/src/main/java/com/webtoapp/core · high confidence

The agent's user interface has been reorganized into a new set of Compose components within the app/src/main/java/com/webtoapp/ui/agent/components directory. This includes a new AgentDrawer for managing sessions and files, a Composer for input and attachments, a ContextPickerDialog for selecting apps and modules, and dedicated components for rendering code, markdown, and message bubbles. These changes reflect the broader refactoring of the AI Coding feature into the Agent, providing a more structured and feature-rich interaction model for users.

app/src/main/java/com/webtoapp/ui/agent/components · medium confidence

The app now features a dedicated Agent screen that consolidates the previous AI Coding capabilities into a unified interface. Users can now interact with the agent through a chat-based composer that supports attachments (images, files, folders), view streaming responses with interleaved thinking segments, and manage sessions, files, and context within a sidebar. The Agent handles tool calls, permissions, and built APK artifacts, providing a cohesive experience for AI-assisted development.

app/src/main/java/com/webtoapp/ui/agent · high confidence

The app now uses a unified Wta design system, providing new composable UI components such as WtaButton, WtaCard, WtaTextField, and WtaSwitch. This includes a centralized token system for spacing, typography, and colors, along with helper functions for haptic feedback and animation. The change standardizes the visual language across the application.

app/src/main/java/com/webtoapp/ui/design · high confidence

The application now includes a dedicated shell-mode entry point (WebToAppApplication) that initializes core managers (activation, announcements, ad-blocking) and handles system events like low memory or boot completion. Additionally, new components enable automatic app launching on device boot or via scheduled alarms, allowing the app to start itself in the background without user interaction.

shell/src/main/java-overrides · high confidence

The shell module has been significantly refactored to improve maintainability and add new capabilities. A new Console Panel has been introduced, allowing users to view and copy browser console logs directly within the app. Error handling has been overhauled with a dedicated ShellErrorScreen that provides detailed, copyable error reports for debugging. Navigation logic has been extracted into a dedicated utility to better handle back-button behavior for SPAs and local content. Additionally, the app now enforces startup permissions (such as overlay and battery optimization) and implements runtime hardening guards to detect and respond to potential threats. The legacy 'Forced Run' state management has been removed.

app/src/main/java/com/webtoapp/ui/shell · high confidence

Added a new 'Selection Actions' module that displays a floating action bar when text is selected, offering options to search (Google, DuckDuckGo, Bing, Baidu, Wikipedia), copy, open as URL, translate (Google, DeepL, MyMemory), or share the selection. Also added a new 'Web Tint' module that applies visual filters to any page, including night shift (amber filter), grayscale, high contrast, invert colors, and custom color tint, with adjustable intensity and color temperature. Both modules replace older single-purpose modules (Floating Search and Night Shift) with more versatile, configurable alternatives.

modules/selection-actions, modules/web-tint · high confidence

The app introduces several new UI components in the ui/components package. A new ApkExportPreflightPanel displays validation reports with error, warning, and success states. Code editing is enhanced with a CodeSyntaxTransformation that provides syntax highlighting for JavaScript and CSS, supporting both light and dark themes. A DnsConfigCard allows users to configure DNS settings, including DoH, ECH, and custom URLs. The app also adds an ExtensionSourceBrowser for managing Chrome extensions and a GreasyForkSearchContent for browsing and installing user scripts from GreasyFork. Additionally, new cards for Node.js and notification configurations are added, supporting custom extensions and various notification types like WebSocket and FCM.

app/src/main/java/com/webtoapp/ui/components · high confidence

The app introduces several new screens to enhance app creation and management. A dedicated 'Build APK' screen allows users to configure and export APKs with options for encryption, isolation, background running, notifications, and browser engine selection. A new 'App Capabilities' screen organizes app settings into sections like Basic, Browser, Appearance, Run, Lab, and Export, each with configurable options. A 'File Manager' screen provides access to build outputs, logs, and user projects with search, sort, and bulk actions. Additionally, a 'Create Offline Pack' screen enables website scraping with customizable depth and link-following, and an 'Install Project Dependencies' card supports PHP, Python, and Node.js environments. The navigation system also gains new transition animations for smoother screen changes.

app/src/main/java/com/webtoapp/ui/screens · high confidence

Added two new official sample modules to the module market. Reading Mode strips pages to their core content, hiding sidebars and ads while offering three themes (light, sepia, dark), font size and family customization, and an automatic entry mode for long-form articles. Auto-Scroll provides smooth, frame-rate-based scrolling with a floating control panel, speed adjustment, and keyboard shortcuts. Both modules register with the app's UI system and persist state via sessionStorage.

modules/reading-mode · high confidence

The app's data model layer has been reorganized: \AppCategory\ has been moved from the UI package to the core data model package. A new \AiConfig.kt\ file introduces a comprehensive set of AI provider configurations, including predefined providers like Google, OpenAI, and Anthropic, each with specific base URLs and model endpoints. Additionally, \RuntimePermissionSync.kt\ was added to handle runtime permission synchronization based on app features, and \ToolbarVisibility.kt\ was introduced to manage toolbar button visibility states. These changes support the new AI coding stability features and improved permission management.

app/src/main/java/com/webtoapp/data/model · high confidence

The data access objects and repositories for web apps and app categories have been relocated from the ui/data and ui/data/repository directories to the central data package (com.webtoapp.data). This reorganization groups all persistence and repository logic under a single data module, simplifying the project structure and clarifying that these components belong to the application's core data layer rather than the UI layer.

app/src/main/java/com/webtoapp/data/dao, app/src/main/java/com/webtoapp/data/repository · high confidence

Added a new \proguard-rules.pro\ file in the shell module to configure R8/ProGuard for the release build. The rules disable code obfuscation and aggressive optimization to prevent reflection-related runtime crashes, while enabling code shrinking to reduce the APK size. Specific classes and methods required for Android components, Kotlin coroutines, Gson, Koin, and Coil are preserved to ensure stability.

shell · high confidence

A new WebExtension named 'WTA Native Bridge' has been added to the app's assets. This extension installs a content script that intercepts and wraps the browser's native \fetch\ and \XMLHttpRequest\ APIs. By routing these calls through a native bridge, the app can bypass standard browser security restrictions such as CORS and same-origin policies, allowing static SPAs to make HTTP requests to external APIs.

_app/src/main/assets/web\extensions · high confidence

The app editing and management experience has been restructured. A new EditState data class and builder functions (EditState, WebAppDraftBuilder) now handle the creation and editing of web apps, consolidating configuration for features like activation codes, ad blocking, and splash screens. The MainViewModel was updated to use a new WebAppSummary for the app list and introduced a deleteAppById function that ensures orphaned project directories are cleaned up when an app is deleted. Additionally, dead code including the AiModuleDeveloperViewModel, AuthViewModel, CloudViewModel, and CommunityViewModel was removed to simplify the codebase.

app/src/main/java/com/webtoapp/ui/viewmodel · high confidence

The local database schema has been upgraded from version 33 to 43, introducing new columns and tables such as app\_categories and categoryId, while removing obsolete fields like browserExtensionEnabled. This update ensures the app's data storage aligns with the latest feature set and removes legacy data structures.

app/src/main/java/com/webtoapp/data/database · high confidence

The data converter was silently dropping enum values (e.g., NotificationType.WEB\_API) during Room serialization, causing settings to be lost on every save. This change introduces a lenient enum adapter that resolves values by @SerializedName, alternate names, and case-insensitive fallbacks, ensuring that all configuration models (such as AdConfig, SplashConfig, and others) are correctly restored from the database.

app/src/main/java/com/webtoapp/data/converter · high confidence

The app's ProGuard configuration has been comprehensively updated to prevent reflection-related runtime crashes. The new rules disable obfuscation and aggressive optimizations that previously caused issues with Gson, Koin, and reflection, while explicitly keeping classes and members required by Android components, Kotlin coroutines, Room, and WebView interfaces. This change improves app stability by ensuring that all necessary classes and methods are preserved during the build process.

app · medium confidence

The media player now preserves the original aspect ratio of videos and images, ensuring content is not distorted during playback. This is achieved by introducing a new \AspectRatioSurface\ component, which replaces the previous implementation that relied on \SurfaceView\ and \SurfaceHolder\. The removal of these Android View-based components from the media and gallery activities simplifies the codebase and aligns the media playback behavior with the rest of the Compose-based UI.

app/src/main/java/com/webtoapp/ui/gallery, app/src/main/java/com/webtoapp/ui/media · medium confidence

The C/C++ build configuration (CMakeLists.txt) was updated to link all native targets with the linker flag -Wl,-z,max-page-size=16384, ensuring 16KB page alignment required for Android 15+ compatibility. Additionally, the legacy hardware control native library was removed and replaced with new executables: node\_launcher, which loads the Node.js runtime, and go\_exec\_loader, which handles Go binary execution via memfd and execveat syscalls.

app/src/main/cpp · high confidence

The WebView screen dependencies are now centralized in a dedicated data class, and the rememberWebViewManager composable is extracted for reuse. The ConsolePanel, which previously displayed debug logs, has been removed from the UI. Preview state classes (WordPress, PHP, Python, Node.js, Go) have been refactored to include a 'StartingServer' state and carry the original throwable in error states. The error overlay components now accept and display detailed error reports, providing users with more context about preview failures.

app/src/main/java/com/webtoapp/ui/webview · high confidence

The bundled 'BewlyCat' extension has been removed from the app. This includes deleting its assets (logo), background scripts, and configuration rules, indicating a cleanup of obsolete or unused bundled content.

app/src/main/assets/extensions · high confidence

The announcement UI has been streamlined by removing the previous template selector component and reducing the number of available announcement styles. The system now supports only two templates—Minimal and Dark—replacing the previous ten distinct styles. Correspondingly, the configuration model has been simplified by removing the 'showEmoji' and 'animationEnabled' options, as well as the 'description' field for templates. Users will see a more limited but cleaner set of announcement styles in the interface.

app/src/main/java/com/webtoapp/ui/components/announcement · high confidence

The app's navigation and app creation flows have been reorganized. The previous bottom-tab-based navigation with community and profile tabs has been replaced with a more direct structure, removing community, profile, and store tabs from the main navigation. App creation now supports a wider range of templates including Node.js, WordPress, PHP, Python, Go, and multi-web apps, with dedicated routes for each. The navigation system now handles these new app types directly, streamlining the path from the home screen to app creation.

app/src/main/java/com/webtoapp/ui/navigation · medium confidence

The splash screen activity now accepts a single JSON payload (AppModifyPayload) instead of numerous individual intent extras. This change removes the need to pass separate parameters for splash type, duration, activation codes, and announcement details, making the launch process more robust and easier to maintain.

app/src/main/java/com/webtoapp/ui/splash · high confidence

The sample project in app/src/main/assets/sample\_projects/python-django-shared has been updated to use Django 5.0, including its associated metadata and license files. The update also includes the asgiref 3.11.1 package, which provides the ASGI specification and adapter code required by Django 5.0.

_app/src/main/assets/sample\projects · high confidence

The application's visual style has been updated with new color definitions for light and dark modes, including adjusted primary, secondary, and surface colors. Additionally, the timing and easing curves for UI animations have been recalibrated to improve responsiveness and feel more native.

app/src/main/java/com/webtoapp/ui/theme · high confidence

Video content now preserves its aspect ratio in media players, ensuring correct display without distortion. Additionally, the status bar background alpha is now correctly applied to the actual status bar, fixing an issue where the alpha setting had no visual effect.

app/src/main/java/com/webtoapp/ui/shared · high confidence

The PHP router server now runs indefinitely by removing the default execution time limit, and includes enhanced error handling to catch and report fatal errors (500 status) during shutdown. Additionally, the router now correctly serves static assets (CSS, JS, images, etc.) instead of routing them to the entry file, and logs include the requested URI and relevant headers for better debugging.

app/src/main/assets · high confidence

New unit tests were added to app/src/test to verify core features: ActivationCode and ActivationStatus handle JSON parsing, expiration, and usage limits; RemoteActivationVerifier validates signatures and AES-256-GCM encrypted URL delivery; DeviceIdGenerator ensures stable, package-scoped device IDs with legacy migration; AdBlockerHostRuntime tests confirm filter caching, rule compilation, and process-death recovery; ReasoningContentContractTest ensures assistant messages correctly serialize reasoning\_content for LLM providers; SessionStoreDraftTest covers draft lifecycle (upsert, finalize, drop) for agent sessions; AdBlockExportWiringTest checks ad-block configuration wiring; and ApkBuilder tests verify cache planning, native lib injection, and artifact verification. These tests improve confidence in activation, ad blocking, APK building, and agent features.

app/src/test · high confidence

The Gradle wrapper has been updated from version 8.14.4 to 9.4.1, ensuring that the project uses the newer version of the Gradle build tool for consistent builds.

gradle · high confidence

The project upgrades its build tooling, moving to Gradle 9.2.0 and Kotlin 2.2.10, and adds the protobuf and Compose Kotlin plugins. The Gradle configuration is updated to use 8 GB of memory for the Kotlin daemon, enable G1GC, and disable parallel builds. Additionally, new modules for 'shell' and 'clone-host' are introduced, and sample Python projects are updated to use specific versions of FastAPI, Uvicorn, and Pydantic.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 45 → 33 (-12.2)
• Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

• Code Health 48 → 57 (+9.2)
• Maturity 64 → 59 (-4.7)
• Readiness 31 → 17 (-13.4)
• Security 58 → 40 (-17.6)

• Change coupling: ApkBuilder.kt ↔ ApkConfigJsonFactory.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkBuilder.kt)
• Change coupling: ApkBuilder.kt ↔ ShellWebViewConfig.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkBuilder.kt)
• Change coupling: ApkConfig.kt ↔ ShellWebViewConfig.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfig.kt)
• Change coupling: ApkConfig.kt ↔ Strings.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfig.kt)
• Change coupling: ApkConfigJsonFactory.kt ↔ ShellModeManager.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfigJsonFactory.kt)
• Change coupling: ApkConfigJsonFactory.kt ↔ ShellWebViewConfig.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfigJsonFactory.kt)
• Change coupling: ApkConfigJsonFactory.kt ↔ Strings.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfigJsonFactory.kt)
• Change coupling: ApkConfigJsonFactory.kt ↔ WebApp.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfigJsonFactory.kt)
• Change coupling: CreateAppWebViewCards.kt ↔ ShellWebViewConfig.kt (app/src/main/java/com/webtoapp/ui/screens/CreateAppWebViewCards.kt)
• Change coupling: ExtensionPanelScript.kt ↔ PanelScripts.kt (app/src/main/java/com/webtoapp/core/extension/ExtensionPanelScript.kt)
• Coverage not included — suite not readable by the collector
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• Duplicated block (11 lines × 2) (.github/scripts/ci/generate_submissions.py)
• Duplicated block (8 lines × 2) (.github/scripts/ci/generate_submissions.py)
• Duplicated block (8 lines × 2) (.github/scripts/ci/validate_modules.py)
• Further orphaned files (smaller)
• Medium CVE: PYSEC-2024-38 (app/src/main/assets/sample_projects/python-fastapi-ar/requirements.txt)
• Medium CVE: PYSEC-2026-2151 (app/src/main/assets/sample_projects/python-flask-ar/requirements.txt)
• Off-boarding risk: anonymized user #1
• Orphaned knowledge (app/src/main/java/com/webtoapp/core/forcedrun/ForcedRunManager.kt)
• …and 2 more

• (anonymous) (cognitive 18) (app/src/main/assets/sample_projects/nodejs-express/server.js)
• (anonymous) (cyclomatic 16) (app/src/main/assets/sample_projects/nodejs-express/server.js)
• Coverage not measured — test suite did not build
• Critical CVE: [GHSA redacted] (app/src/main/assets/sample_projects/go-fiber-ar/go.mod)
• Critical CVE: [GHSA redacted] (app/src/main/assets/sample_projects/go-fiber-ar/go.mod)
• Critical CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
• Dimension evaluation failed
• High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
• High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
• High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
• High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
• High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
• High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
• High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/go-fiber-ar/go.mod)
• High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
• High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
• Hotspot: app/src/main/assets/sample_projects/nodejs-express-ar/server.js (app/src/main/assets/sample_projects/nodejs-express-ar/server.js)
• Hotspot: app/src/main/assets/sample_projects/nodejs-express-en/server.js (app/src/main/assets/sample_projects/nodejs-express-en/server.js)
• Hotspot: app/src/main/assets/sample_projects/nodejs-express/server.js (app/src/main/assets/sample_projects/nodejs-express/server.js)
• Hotspot: app/src/main/assets/sample_projects/nodejs-koa-ar/server.js (app/src/main/assets/sample_projects/nodejs-koa-ar/server.js)
• …and 54 more

• 105 commits — 54 feature/other, 51 fixes

• app/src — 88 commits
• (root) — 12 commits
• docs/.vitepress — 2 commits
• .github/CONTRIBUTING.md — 1 commit
• docs/guide — 1 commit
• shell/src — 1 commit

• fix: Fix #471: Lift bottom action bars above system navigation bar (#484)
• fix: Revert "docs: revamp homepage with stats, app-type matrix, quick-start steps and CTA banner"
• fix: docs: sync docs with recent features (media session, page zoom, console) + fix FCM wording (#464)
• fix: feat(runtime): configurable port-conflict policy for all runtime apps + fix preview-switch leak (#478) (#479)
• fix: fix(aab): drop resource-table references to skipped plaintext res XML (#334)
• fix: fix(about): correct license name from MIT to The Unlicense (#365)
• fix: fix(activation): enforce device-bound codes via remote verifier + honest local labeling (#448) (#489)
• fix: fix(adblock): stop the OutOfMemoryError crash loop on startup and the App Creation screen (#359)
• fix: fix(agent): OpenAI-compat tool-call streaming dropped the tool call (#395)
• fix: fix(agent): always send reasoning_content for assistant messages (GLM compat) (#452)
• fix: fix(agent): don't lose permission/choice prompts (loop froze after a question) (#389)
• fix: fix(agent): file click opens preview; add per-file context menu (open / copy path) (#446)
• fix: fix(agent): guard thinkingSegments against null from legacy session JSON (#436)
• fix: fix(agent): interleave thinking with output; preserve per-turn thinking segments (#435)
• fix: fix(agent): intermittent stall — one bad SSE field no longer drops the whole chunk (#414)
• fix: fix(agent): multi-select choice options were not toggleable (#412)
• fix: fix(agent): omit max_tokens to let API use its own default (true unlimited) (#442)
• fix: fix(agent): per-turn reasoning + service-side persistence for backgrounded/killed UIs (#430)
• fix: fix(agent): persist built APKs to session so they survive app restart (#447)
• fix: fix(agent): prevent inline-marker leaks and wedged prompts (#437)
• …and 85 more

• Containers 0 added · 0 removed · contexts 0 added · 1 removed · edges 0 added · 0 removed

• python

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

shiaho777/web-to-app was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.