Android rejects HTTPS environments signed by a CA installed in the Android user certificate store. On a Pixel 9 running Android API 36, Chrome trusts the same endpoint while the base T3 app fails environment discovery with a Transport error and a TLS CERTIFICATE_UNKNOWN alert.
Generate an Android network security configuration that trusts system and user certificate stores, and reference it from the manifest. Preserve existing cleartext HTTP support in the configuration because Android ignores usesCleartextTraffic once a network security configuration is present. This applies user-installed CA trust app-wide and requires a new native Android client build.
Fixes https://github.com/pingdotgg/t3code/issues/5639
GitCafe: #5639
Triaged bug via the automated issue flow. The change is limited to the existing Android network configuration plugin and its registration.
expo config --type introspect and expo prebuild --platform android --no-install: generated manifest references the XML configuration; generated XML trusts system and user roots and permits cleartext.vp run check:changed: format, lint, both knip passes and both affected-package typechecks passed on final integrated head 235e42ec4a. The worktree is clean.Pixel 9, Android API 36, portrait 1080×2424, light appearance, font scale 1.0. Base source: 9bc0c33438; native fix: 853aceb5a1. Head native fingerprint e9cabfd8aa6930799024d4e47fefcd0c8220fc7d, APK SHA-256 643269934f0ae53037e5fcb094303b67cb121034a4262916a941dc7695c1dcd7. Captures use the debug development client.
Before (left): Chrome trusts the private CA, but base T3 fails discovery. After (right): rebuilt T3 connects and receives a fresh provider status response.
Before and after: Android private-CA environment connection
| Fixture | Result and runtime evidence |
|---|---|
| Base, private CA installed | Chrome succeeds; T3 discovery fails; TLS-observed retry. |
| Head, private CA installed | HTTPS pairing, WSS 101 and response frames; fresh read and reconnect/read pass. |
| Head, private CA removed | Retained reconnect rejects after process restart; fresh discovery rejects. |
| Head, system CA, private CA absent | Pairing and fresh read over HTTPS/WSS pass with only that route saved. |
| Head, cleartext | HTTP pairing and fresh read over HTTP/WS pass with only that route saved. |
Full evidence index and timelines, fixture matrix, sanitized transport observations, proxy driver, and reproduction drivers. Pairing credentials are masked in recordings.
No render paths changed; the comparison demonstrates connection behavior, with the changed connection state and provider response visible. Independent WSS rejection with the private CA absent could not be reached because HTTPS descriptor preflight rejects first. A first private-CA refresh encountered a transient SocketReadError; subsequent fresh reads and reconnect/read passed. A separate release APK was not run. iOS is unaffected by this Android-only plugin change.
After merging main, the primary agent repeated a provider refresh successfully on the isolated system-CA route. Final integrated client capture. The Android plugin/config bytes remain identical to the captured native-fix commit. Final integrated source: 235e42ec4a. Independent proof audit: sufficient.
Final scoped check log · Final cached native-fingerprint check.
Implementation: Claude Opus 5.5 through Claude Code; triage, integration and proof: GPT-6.1-sol through Codex in T3 Code.
Taken over from @juliusmarminge's automated issue flow. The plugin shape was already right and is kept. The plugin no longer sets android:usesCleartextTraffic: with minSdk 24, Android ignores it once a network security config exists, and the config's base-config already permits cleartext (C1 below shows HTTP/WS still work). A short note in docs/user/remote-access.md explains installing a private CA on Android. No tests: a plugin unit test would only restate the XML. The proof is on-device. The "both manifest attributes" line above describes the original commit; only android:networkSecurityConfig remains.
Real Android app on a pooled Pixel 9, Android 16 (API 36), portrait 1080×2424, light theme, font scale 1.0. Status-bar time is masked and pairing codes are redacted. Builds: base 71ba6b374c (native fingerprint ed36a9cc) vs head bbb9042e92 (0b110f6b). One isolated backend with synthetic data serves every row. The final head 9e3e0af976 adds only docs and a merge of main, with the same plugin and config.
| Row | Build | Result | Recording | Transcript |
|---|---|---|---|---|
| B1: private CA in user store | base | Rejected at TLS (certificate unknown), full error shown | B1.mp4 | B1-transcript.txt |
| U1: same CA | head | HTTPS pairing, WSS 101, live read; forced socket close, then automatic reconnect with a new ticket and upgrade | U1.mp4 | U1-transcript.txt |
| N1: CA removed, app relaunched | head | Same endpoint rejected at TLS | N1.mp4 | N1-transcript.txt |
| S1: public (Let's Encrypt) cert, no private CA | head | HTTPS, WSS 101, live read | S1.mp4 | S1-transcript.txt |
C1: plain http:// | head | HTTP, WS 101, live read, no TLS redirect | C1.mp4 | C1-transcript.txt |
Before (left, B1): the base app rejects the private-CA endpoint. After (right, U1): the head app is connected.
Before: base rejects private-CA endpoint. After: head connected
What else changed: no rendered UI code changed. The two sides differ only in connection outcome and the screen it leads to (pairing sheet vs environment details), endpoint text, and synthetic canary names. The private root was regenerated for the B1/N1 retakes; U1 used the original. N1 has two labelled cuts and rejects at the HTTPS preflight, so a separate WSS rejection is never attempted. All captures use development APKs. native-artifact-proof.txt shows the APK's merged manifest and its resolved system + user + cleartext policy, with no debug overrides.
Full evidence index with narrated timestamps · fixture matrix · scripts: generate-certs.sh, proxy.mjs, seed-and-canary.mjs, pair-row.mjs, prepare-public-cert.sh, http-observer.mjs
expo prebuild is idempotent. Nothing under node_modules declares its own network security config. The native fingerprint includes the plugin, so the dev client rebuilds.vp run check:changed passes on 9e3e0af976. CI: 31/31 green on 9e3e0af976. CodeRabbit: no blocking issue. Macroscope: needs human approval (trust boundary).🤖 Generated with Claude Code
Added 2 commits
Verdict: Needs Human Approval
Macroscope's review found this PR requires human approval — Android now trusts user-installed CAs app-wide while preserving existing cleartext support. Human review must confirm that this broader default trust boundary is intended, rather than restricting private-CA trust to selected endpoints.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review.
26404964-52e9-48b9-be3b-63bcc8e52358Reviewing files that changed from the base of the PR and between 235e42ec4a001a223ac33c1f3a604dda800a9ded and 9e3e0af976da374c060164cdad51de2b61981a5f.
apps/mobile/app.config.tsapps/mobile/plugins/withAndroidNetworkSecurityConfig.cjsdocs/user/remote-access.mdIncluded review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.
The Android app now uses a network security configuration that permits cleartext traffic and trusts system and user-installed certificates. The Expo configuration applies the new plugin instead of the previous cleartext-only plugin. The remote-access guide explains how to install a private CA on Android.
Changes: Android network security
| Layer / File(s) | Summary |
|---|---|
Define and apply Android network security apps/mobile/plugins/withAndroidNetworkSecurityConfig.cjs | The plugin defines system and user trust anchors, updates the manifest to reference the network security configuration, and writes the XML resource. |
Activate and document the network security plugin apps/mobile/app.config.ts, apps/mobile/plugins/withAndroidCleartextTraffic.cjs, docs/user/remote-access.md | The Expo plugin list now uses the new network security plugin. The previous cleartext-only plugin is removed. The guide explains that Android users must install a private CA as a CA certificate. |
Priority: External image Normal
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix · Severity of issue fixed: Medium
Suggested reviewers: t3dotgg
9e3e0The Android configuration adds user-installed CA trust while retaining cleartext support. No merge-blocking issue was identified.
| Check name | Status | Explanation |
|---|---|---|
| Title check | Passed | The title clearly and concisely describes the primary change: enabling Android trust for user-installed CA certificates. |
| Linked Issues check | Passed | Issue #5639 requires Android HTTPS traffic to trust user-installed CA certificates and retain cleartext support. withAndroidNetworkSecurityConfig.cjs writes network_security_config.xml with `syste… |
| Out of Scope Changes check | Passed | The changes remain within issue #5639. The implementation replaces the existing Android cleartext plugin with the Android network security plugin. The plugin changes only the Android manifest and XML … |
| Description check | Passed | The pull request description includes all required sections: Problem, Change, Scope and approval, and Verification. It identifies the linked issue, explains the focused Android configuration change an… |
Explanation
Issue #5639 requires Android HTTPS traffic to trust user-installed CA certificates and retain cleartext support. withAndroidNetworkSecurityConfig.cjs writes network_security_config.xml with system and user trust anchors and cleartextTrafficPermitted="true". It sets android:networkSecurityConfig and registers the plugin in apps/mobile/app.config.ts. The PR reports generated-config checks, APK inspection, runtime private-CA pairing, and cleartext verification. The added Android guidance is consistent with the issue.
Explanation
The changes remain within issue #5639. The implementation replaces the existing Android cleartext plugin with the Android network security plugin. The plugin changes only the Android manifest and XML resource. The added documentation addresses private-CA setup for the Android app. No unrelated platform or product behavior changes are shown.
Explanation
The pull request description includes all required sections: Problem, Change, Scope and approval, and Verification. It identifies the linked issue, explains the focused Android configuration change and its app-wide effect, documents validation commands and runtime evidence, includes before/after screenshots and recordings, and states known limitations and unverified cases.
Comment @coderabbitai help to get the list of available commands.
Taking over this one
Added 5 commits