A program's own app

lindroids export com.vscodium.codium     # builds VSCodium's app and offers it for install

Built VSCodium's app (org.lindroids.app.com.vscodium.codium, 181 KB, 24 ms).
...tap VSCodium.apk, then Install...
Once it is installed, tap Open (or its icon in the app list): VSCodium starts through Termux the
first time, then by itself, in a window of its own with its name and icon in Recents.

​

What the app is

​

How it is built: no SDK on the phone

1. The template (crates/lindroids-apk/template/window-app.apk, unsigned, about 160 KB) is built by packaging/build-app-template.sh with the SDK, from packaging/webview-app and AndroidManifest.program.xml, whose package, label and meta-data are placeholder strings. It is committed, like the helper’s shortcut.dex, and carried inside the lindroids binary.
2. On the phone (crates/lindroids-apk, pure Rust: p256, sha2, flate2, crc32fast):
   • the binary manifest’s string pool is decoded, the placeholders replaced (package, name, start page, launch URL, terminal app, id) and written again; versionCode (minutes since 1970, so a new export is always an update) and versionName are set in place. An unchanged manifest comes out byte for byte (a test checks it);
   • the three icon PNGs are swapped;
   • the ZIP is written again, stored entries aligned to 4 bytes (zipalign -p 4: Android 11+ refuses a compressed or unaligned resources.arsc);
   • it is signed with APK Signature Scheme v2, ECDSA P-256 with SHA-256, and a self-signed certificate “Lindroids on this phone”. v2 is all Android 7 (the minimum) and later need. Google’s apksigner verify accepts the result.

​

How it reaches Android’s installer

​

Tested on a real phone

• Termux cannot see the app it offered. Termux from Google Play targets Android 15+ without QUERY_ALL_PACKAGES, so package lookups (getPackageInfo, pm path) do not see other apps; “is it installed?” always said no. Lindroids no longer asks.
• Termux cannot open the app from behind the installer. Opening it while My Files was in front was refused: Abort background activity starts from 10160, BAL_BLOCK, result 102 (which is not an error code: the helper now treats every result but 0–3 as a failure). So the app is not opened by export: its first start, from the user’s tap, hands its launch to Termux.
• The app’s WebView has storage of its own, not paired with this Lindroids: its start page would have asked for lindroids pair’s code. An unpaired start page in an app now starts the program through Termux instead; the window then opened in the app carries its run’s ticket and pairs it, and later starts need nothing.
• Two windows: the start page (“not running”) stayed in Recents as a second VSCodium card next to the program’s window. Now the icon’s activity is single-task and the program’s windows load in it (see above).
• MediaStore cannot be used from the helper: app_process running as Termux is not an app Activity Manager knows (“Unable to find app for caller … when getting content provider media”), and a Context made there calls itself android (“Given calling package android does not match caller’s uid”). Writing the file path in Download directly works instead.
• The service worker the browser apps use for their offline page is not registered inside a Lindroids app (the app shows its own offline page).

​

Clean starts and single runs (third round)

• “VSCodium runs in Termux, which is not running now”, all the time. The app’s window still showed a run whose server had gone (the binary was replaced while it ran); when a new server answered, the offline page’s retry loaded that dead run’s page again. The retry now goes back to the program’s start page, which finds the program running or starts it, and only while the app is in front.
• “Another instance of VSCodium is running but not responding”. That VSCodium (under proot) had outlived its server: nothing ended the programs a stopping server had launched, and an orphan without a display hangs. It also made the next launch think VSCodium’s app was busy, so that window went to Chrome. The server now ends every program it launched when it stops (the process tree, SIGTERM then SIGKILL), and a program’s app takes a new run in place.

• A clean first start. Opening a program’s icon with Lindroids not running starts it through Termux by itself (no Start tap): tested, the icon handed the launch to Termux within 0.2 s and VSCodium’s window loaded in the same task.
• Single runs in a window app of their own. lindroids app install builds the windows app (org.lindroids.windows, “Lindroids”) on the phone from the same template, with no page of its own. lindroids run <program> opens each run there as one task, with the program’s name and icon on it (setTaskDescription), closed when the program ends and when the server stops (tested: GNOME Calculator’s window opened in it and went with lindroids stop). One UI draws the windows app’s icon on such a card, not the program’s: it ignores task icons (tested earlier with Chrome’s Custom Tabs). Only an installed app of the program’s own (export) gets its icon there; installing one per run would mean an installer prompt per run.

​

Touch, keyboard and speed (fourth round, lab VM)

​

Input and the GPU (fifth round, lab VM)

• The window app asks Android for unbuffered pointer events (requestUnbufferedDispatch, Android 11+): touches reach the page as they come, not batched to the screen’s next frame. It also asks for the screen’s fastest refresh rate, and declares hardware acceleration.
• The page draws in a worker that owns the canvas (OffscreenCanvas, data/web/draw.js), on the GPU: each changed tile goes into a WebGL texture (texSubImage2D) that one triangle draws. Software GL (SwiftShader, llvmpipe) falls back to putImageData; browsers without OffscreenCanvas run the same code in the page. A lost GPU context gets a whole frame again. LZ4 decoding copies repeated runs in doubling chunks (2.4x faster on the same data, and checked byte for byte against lz4_flex on 60 generated payloads).
• Input leaves at once: the lines one event makes go in one WebSocket message; mouse, pen (and in WebView, touch) moves come from pointerrawupdate; the canvas position is kept, not read on every event.
• The server packs and sends frames with fewer copies (rows, not pixels; the payload straight into the link’s buffer), and converts client buffers in loops the compiler vectorizes.
• Only what changed (second pass): a client’s damage/damage_buffer rectangles are all that is converted from its new buffer, into the memory the surface already has (a new allocation per commit was megabytes of page faults); when no surface moved, only their union is composed and diffed again. A whole buffer is converted on up to four cores; lz4_flex compresses with its fast (non-safe) encoder. LINDROIDS_STATS=1 now also logs the server’s own time per frame.
• Keys from the first one: the window app gives its WebView Android’s focus when the window opens (a WebView without it took the first D-pad or arrow key to gain focus, and moved the page’s focus to a button or the hidden text area instead of passing the key on; reported on b15 with Tux Typing); the page’s buttons and that text area are out of key focus; a window’s canvas takes the focus when it is activated.

​

Switching between apps (sixth round, lab VM)

​

A window and its program go together (seventh round)

​

On the tablet (2026-11-10)

​

Ctrl+C in Termux, and a card swiped away late (after 0.1.187)

• Ctrl+C. A run’s program gets the terminal (it may read it). Once nobody is left in its group who could (the launcher ended; under proot only proot stays, which Termux from Google Play shows as linker64), lindroids takes the terminal back, within a second. Ctrl+C then reaches lindroids, which passes it on to everything the run started and, 5 s later, ends what ignored it. A program that is still in the terminal’s group keeps Ctrl+C to itself, as before (a shell, a REPL).
• The early question. Only a clear “its card is gone” ends the run that early. No answer within 15 s keeps it for the usual limit, after which no answer ends it, as before.
• The Recents icon of a single run stays the windows app’s on One UI. The task has the program’s icon (dumpsys activity recents: taskDescription { ... iconBitmap=true }), and One UI’s Recents draws the installed app’s icon all the same. Only an app of the program’s own (lindroids export) has its icon there.

​

Menus under a finger (after 0.1.189)

​

A window that jumped as the keyboard came and went (after 0.1.189)

• In the window app, once a bar like that was seen (the height changed by 100 CSS px or less) its strip stays the keyboard’s: the stage keeps the size it has above it, with or without the bar, until the window is left, turned, or a keyboard that takes real room comes up. The strip is black while the keyboard is away.
• A window’s canvas is shown at its frame’s own size from the top left, not stretched to the stage: while a program has not drawn at a new size yet, its last frame stays where it was.

​

Review fixes (template 2)

​

What Android allows, and what we assume

• An app may start an activity of an app it cannot see (explicit intent); it may not look it up. Starting needs the caller in front (or another background-start exemption).
• Android’s installer acts only for an app that declares REQUEST_INSTALL_PACKAGES; the user’s “install unknown apps” switch is per source app. My Files, Chrome, Samsung Internet and Firefox declare it on the tablet.
• An app targeting Android 11+ may create files in Download/ by path without any storage permission. Assumed to hold on other vendors’ Android 11+ builds.
• Play Protect’s prompt for unknown apps is shown by com.android.vending on devices with Google Play; assumed absent on devices without it (LineageOS, Huawei, Fire).
• Google’s developer verification (2026–2027, see BROWSER_AGNOSTIC_APK.md): apps signed by an unregistered key will need the user’s one-time “advanced flow” or ADB once it covers all installs. Untested: it was not enforced on the tablet on 2026-10-29.
• The per-phone key: if Termux’s data is cleared, the key is gone and the installed apps can only be uninstalled and installed again (Android refuses an update signed by another key).

​

Still to test

• The browser route (a terminal app that may neither install nor write to Download).
• Other launchers’ and vendors’ Recents (Pixel, Launcher3), Android 7–10 (minSdk 24).
• An app installed but never started, then started from Termux (lindroids launch).