feat: on-device crash log, plus CI to run the tests

[JMAN730]

Closes #17.

Scope

Issue #17 was title-only — no body, no comments — so the scope below was chosen and is open to correction:

• Capture: uncaught crashes only. Not handled/non-fatal errors, not a full app log buffer.
• Storage: Room table, consistent with the existing persistence layer. No third-party SDK.
• UI: new Crash Log screen reached from Settings.
• Retention: keep the 50 most recent, silent (no next-launch dialog).

What this does

The app had no crash handling at all — no uncaught exception handler, no crash reporting SDK — so a crash left nothing behind but a logcat line the user could not reach.

OpenDroidCrashHandler is installed first in OpenDroidApp.onCreate, records the crash, then delegates to the system handler so the process still dies normally. Crashes go to a new crash_logs Room table (migration 6 → 7, purely additive) capped at the 50 most recent, and are viewable, shareable, copyable, and clearable from the new screen.

Everything stays on device: no SDK, no network egress.

Design notes

Two deliberate choices worth flagging for review:

• runBlocking on a suspend DAO is load-bearing. Room dispatches suspend queries to its own executor, so its "cannot access database on the main thread" guard does not fire. Most crashes are main-thread crashes, so a blocking DAO call would fail exactly when it is needed. The write is bounded by a shared 2s monotonic budget so a wedged database turns a crash into a lost report rather than an ANR.
• The recorder and handler swallow every Throwable, including Error. Failing to log a crash must never replace a real, diagnosable crash with one from the crash logger itself.

The recording path is split so its logic is testable without Android: CrashReportFormatter and CrashReportExporter are pure, CrashLogRecorder talks to a CrashLogSink interface, and only RoomCrashLogSink touches Room.

Testing

Not run locally. The machine this was written on has no JDK and no Android SDK, so nothing here was compiled and no test was executed by hand. 46 unit tests across 4 files are included but were unverified at the time of writing.

In place of a compiler, the change went through two static review passes (standards + spec). Those caught and fixed a missing copy action, a 4s worst-case crash-path stall, a StateFlow convention mismatch, a misleading comment, and two dead methods — see 0afcc51.

The "please run it before merging" ask above is now automated — see the next section. This PR's own CI run is the first execution of the suite. Read it before merging.

CI (b5dbc5c)

Writing 46 tests that nothing runs is most of the way to writing none. The repo's only workflow deployed the marketing site; nothing compiled the app or ran a test. So app/src/test — sixteen files, four of them the crash log ones above — ran only when someone remembered to. The "restore Android debug build compilation" fix a few commits back is what that gap costs.

.github/workflows/android-ci.yml runs testDebugUnitTest assembleDebug on pull requests to main and pushes to main.

• JDK 21 Temurin, matching JavaVersion.VERSION_21 / jvmTarget '21' in app/build.gradle.
• Only main writes the Gradle cache, so pull requests read one warm shared cache instead of each seeding its own.
• permissions: contents: read — deliberately not inheriting the contents: write that deploy.yml needs for gh-pages.
• No secrets. gradle.properties is gitignored, so hasSigningConfig (app/build.gradle:29) is false in CI and assembleDebug never reads the release signing config.
• paths-ignore for website/**, docs/**, **.md; concurrency cancels superseded runs.
• Test reports upload with if: always(), so a red run is diagnosable from the run page without reproducing it.

Verified without a JVM: the workflow YAML parses, gradlew is mode 100755 in the index, and gradle-wrapper.jar is tracked — so the wrapper bootstraps.

Lint and instrumented tests are deliberately out of scope. A first lint run on a codebase that has never had one lands a large backlog needing triage or a baseline, which would block this. Instrumented tests need an androidTest source set that does not exist yet.

Known follow-up

Tracked in #37.

The six device/app fields are a data clump: @Embedded val device: DeviceMetadata would collapse CrashLogEntity and both mirror-image mappers in RoomCrashLogSink (~30 lines), with column names and migration SQL unchanged. Skipped here only because it touches Room codegen and could not be compile-checked.

The Room 6 → 7 migration still has no automated coverage — it needs Robolectric or an emulator, neither of which this PR sets up. That is the largest remaining hole, and the CI added here does not close it.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0afcc51cf1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Share large logs outside Intent extras

When the toolbar's “Share all” action exports 50 near-limit records, the payload can exceed 800,000 characters (50 × the 16,000-character stack limit, plus messages and headers). Putting that string in Intent.EXTRA_TEXT makes startActivity marshal a payload larger than Binder's transaction buffer, causing TransactionTooLargeException instead of opening the chooser; share aggregate logs through a file-backed content URI or enforce a substantially smaller aggregate limit.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Prune by insertion order rather than wall-clock time

When the device clock moves backward—for example after correcting an erroneously future clock—the newly inserted crash has the greatest id but an older timestamp. Once 50 records already exist, this ordering excludes that new row from the retained subquery and immediately deletes it, losing the crash that just occurred; use id DESC as the retention order while keeping timestamp ordering only for presentation if desired.

Useful? React with 👍 / 👎.

[greptile-apps]

Confidence Score: 5/5

Safe to merge; all crash-path invariants (delegate always called, write always time-bounded, credentials always redacted before storage) are enforced in code and backed by 46 unit tests.

The crash handler, recorder, sink, redactor, DAO, and view model are each well-scoped and the design decisions (runBlocking on a suspend DAO, insert-before-prune, monotonic budget, AtomicBoolean one-shot latch) are explicitly documented and correct. The Room migration is purely additive and the column definitions match the entity. The two comments left are style nits.

Files Needing Attention: No files require special attention beyond the two minor style suggestions on CrashLogRecorder.kt and CrashLogScreen.kt.

Important Files Changed

Filename	Overview
app/src/main/java/com/opendroid/ai/core/crash/OpenDroidCrashHandler.kt	New uncaught exception handler — installs idempotently, uses AtomicBoolean one-shot latch, and always delegates to the system handler in a finally block.
app/src/main/java/com/opendroid/ai/core/crash/CrashLogRecorder.kt	Builds and stores crash records; swallows all Throwables on the crash path. buildRecord is declared public with no external callers — should be internal or private.
app/src/main/java/com/opendroid/ai/core/crash/CrashLogRedactor.kt	Credential scrubber applied at capture time; ordered rules handle URL params, Bearer tokens, headers, JSON fields, and vendor-prefixed keys. Rule ordering and \Q...\E escaping are correct.
app/src/main/java/com/opendroid/ai/data/crash/RoomCrashLogSink.kt	Uses runBlocking + withTimeoutOrNull with a shared monotonic budget per crash to avoid ANR on a wedged DB; insert-before-prune ordering is correct.
app/src/main/java/com/opendroid/ai/data/db/OpenDroidDatabase.kt	Additive MIGRATION_6_7 creates crash_logs table and timestamp index; column definitions match CrashLogEntity. Migration registered in DatabaseModule.
app/src/main/java/com/opendroid/ai/ui/viewmodel/CrashLogViewModel.kt	Maps Room entities to CrashLogItem before exposing as StateFlow; exportAll re-reads from DAO for share consistency.
app/src/main/java/com/opendroid/ai/ui/screens/CrashLogScreen.kt	Crash list UI with expand/collapse, share, copy, and delete-all. Icons.Default.ArrowBack is deprecated — RTL layouts would render the wrong direction.
.github/workflows/android-ci.yml	New CI workflow: JDK 21 Temurin, shared Gradle cache (read-only for PRs), testDebugUnitTest + assembleDebug, test report upload on always().
app/src/main/java/com/opendroid/ai/OpenDroidApp.kt	installCrashHandler() called first in onCreate after super (which triggers Hilt injection), wrapped in try/catch so setup failure never prevents app start.

Sequence Diagram

sequenceDiagram
    participant App as OpenDroidApp.onCreate
    participant Handler as OpenDroidCrashHandler
    participant Recorder as CrashLogRecorder
    participant Redactor as CrashLogRedactor
    participant Sink as RoomCrashLogSink
    participant DAO as CrashLogDao (Room)
    participant System as System UEH

    App->>Handler: install(recorder)
    Note over Handler: wraps existing default UEH

    Note over System: crash occurs on any thread
    System-->>Handler: uncaughtException(thread, throwable)
    Handler->>Handler: compareAndSet(false→true)
    Handler->>Recorder: record(thread, throwable)
    Recorder->>Redactor: redact(message + stackTrace)
    Redactor-->>Recorder: redacted strings
    Recorder->>Sink: record(CrashLogRecord)
    Sink->>DAO: insert() [runBlocking, 2s budget]
    Sink->>DAO: pruneToMostRecent(50) [remaining budget]
    Recorder-->>Handler: (returns)
    Handler->>System: delegate.uncaughtException(thread, throwable)
    Note over System: process killed normally

Loading

_{Reviews (7): Last reviewed commit: "fix: bound the aggregate share payload a..." | Re-trigger Greptile}

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.

[JMAN730]

Review addressed in 38a36be, plus 873384b for the CI failure.

Share large logs outside Intent extras (codex, P2) — valid. 50 records × the 16,000-character stack limit approaches 800,000 characters in Intent.EXTRA_TEXT, which overruns the Binder transaction buffer. Took the second of the two suggested routes — a smaller aggregate limit rather than a file-backed content URI, since there is no FileProvider in the manifest yet and this keeps the change unit-testable in the existing JVM suite.

CrashReportExporter.export now spends a 120,000-character budget from the newest record down, appends a notice saying how many older records it left out, and truncates rather than drops the newest record when that one alone overruns the budget. Five tests added, including one asserting a full 50-record log of maximum-size traces stays bounded.

Prune by insertion order rather than wall-clock time (codex, P2) — valid. pruneToMostRecent ordered retention by timestamp, so a device correcting a clock that had been set into the future gives the newest row the largest id but an older timestamp, ranking the crash that just happened outside the keep set and deleting it. Retention now orders by id DESC; getAllFlow/getAll still order by timestamp for presentation, as suggested.

Separately, the red CI run. CrashLogRedactorTest > redacts a bearer token was failing at CrashLogRedactorTest.kt:73. The Bearer rule produced Authorization: Bearer [REDACTED], then the header rule ran over that output and matched Bearer itself as the header value, giving Authorization: [REDACTED] [REDACTED]. The token was redacted either way — the assertion that failed is the one requiring the Bearer prefix to survive. Fixed with a negative lookahead so the header rule skips a value the Bearer rule already handled, and skips an existing [REDACTED] so the rule set is idempotent.

Local verification: ./gradlew :app:testDebugUnitTest → 161 tests, 0 failures, 0 errors. ./gradlew :app:assembleDebug succeeds.