peach-android / ab8531a9baeb

fix: Serialize duress slot wire JSON with explicit version 1 (v2.9.7) GPT-5.6-Sol HIGH finding from the v2.9.6 boundary review: Android's androidDuressSlotToBrowserJson was using BrowserSlotJson.encodeToString against a data class with plus the module's encodeDefaults = false, so the wire JSON never carried . The browser's hasValidVaultSchema strictly requires and silently dropped Android-origin duress slots on adoption. Also fixed a misleading comment in VaultAdopt.kt that claimed snapshot_capable was always serialized explicitly, when Android omits the false default. Root cause: kotlinx-serialization's encodeDefaults = false drops default field values from the wire. The browser parses with strict validation; an omitted field is the same as a wrong value to it. Solution: Build the wire JSON via JsonObject/JsonPrimitive so version: 1 is always serialized. Also added ctAndTag to the zero-in-finally block. Added a unit test that asserts the wire JSON contains "version":1 and round-trips through BrowserSlot.parse. Changes: - vault/VaultRepository.kt: rewrite androidDuressSlotToBrowserJson to build JsonObject with explicit version: 1; add ctAndTag to finally-zero. - sync/VaultAdopt.kt: rewrite the misleading always-send-explicit comment to match actual wire behavior (Android omits false; browser explicit). - vault/AdoptDuressSlotTest.kt: new test exportDuressSlotForAdoption JSON includes explicit version 1 for browser strict check — asserts JSON contains "version":1 and decodes via BrowserSlot.parse. - VERSION: 2.9.6 -> 2.9.7. app/build.gradle: versionCode 240152 -> 240153.

dev · 4 weeks ago · 2026-07-30 · 5.6 MB

parent: e5993569bbf6