peach-android / 933dfea7fdd0

feat: Let users fill any entry from an unverified origin via explicit picker choice (v2.8.7) Product decision: autofill is always an explicit user action — Peach never fills on its own. The manual picker therefore lets the user fill any vault entry they deliberately tap, even for an unverified origin (native apps without App Links, unknown apps, browsers with unconfirmed pins). The prior exact-domain-confirmation gate blocked native apps entirely (no domain to type) and protected nothing the user's explicit tap doesn't already cover. Picker (AutofillEntryPickerActivity): - returnDataset fills any explicitly-picked entry; removed the UNKNOWN-origin domain-match gate and the confirmedTarget concept. - Unverified-origin search is now the same full-vault substring search (matchesPickerSearch over title/username/email/url) as trusted origins; it shows nothing until the user types, so the vault is never pre-listed for an unknown caller. - Warning copy: 'Peach couldn't verify this app or site. Make sure you trust it before filling a login.' Create-new falls back to the raw origin (package name for native apps) when the search text is not a domain. Security boundary preserved (verified): - AutofillResponseBuilder.matchEntries(parsed) still returns ZERO entries for AutofillOriginTrust.UNKNOWN — the system dropdown never preselects credentials for an unverified origin. That is the only place Peach acts without a deliberate choice. - Picker origin-trust re-derivation and the fail-closed signer-set are unchanged. - Filling a knowingly-trusted malicious app is the user's informed decision (out of scope). Gate: 813 tests 0 failures/errors/skips (114 suites); lintDebug 0 errors; assembleRelease.

dev · 4 weeks ago · 2026-07-29 · 5.5 MB

parent: 3b3fd73ab28f