Conduit 2.3.1: hosted conduits, web app, and sound effects

.dockerignore

@@ -0,0 +1,27 @@
+node_modules/
+.expo/
+web-build/
+.git/
+.worktrees/
+.npm/
+.gradle/
+npm-debug.*
+
+.env*
+!.env.example
+
+android/.gradle/
+android/app/build/
+android/app/upload-keystore.jks
+android/app/upload-keystore.jks.base64
+android/keystore.properties
+ios/build/
+
+.DS_Store
+.idea/
+.vscode/
+
+playwright-report/
+test-results/
+blob-report/
+.playwright-mcp/

.env.e2e.example

@@ -0,0 +1,32 @@
+# Example environment for Maestro E2E builds (copy to .env.e2e for the build).
+# EXPO_PUBLIC_* vars are inlined at BUILD TIME, so changing these requires a
+# rebuild.
+#
+# The E2E build itself is produced by ALSO exporting the build-only flags inline:
+#   EXPO_PUBLIC_E2E=true ...                      (enables the email-code sign-in
+#                                                  UI + LogBox suppression)
+#   EXPO_PUBLIC_E2E_MOCK_PROXY=1 ...              (Android: use the mock inproxy
+#                                                  for deterministic local flows)
+# scripts/e2e-build.sh and scripts/e2e-cloud.sh load .env.e2e automatically.
+# See maestro/README.md.
+
+# --- Dev Conduit server -------------------------------------------------------
+EXPO_PUBLIC_HOSTED_BASE_URL="https://your-dev-api.example.com"
+EXPO_PUBLIC_HOSTED_PROVIDER="google"
+
+# --- RevenueCat TestStore (storeless purchases) -------------------------------
+# Use the test_* TestStore keys (NOT the appl_/goog_ production keys).
+EXPO_PUBLIC_REVENUECAT_IOS_PUBLIC_KEY="test_YOUR_TESTSTORE_KEY"
+EXPO_PUBLIC_REVENUECAT_ANDROID_PUBLIC_KEY="test_YOUR_TESTSTORE_KEY"
+EXPO_PUBLIC_REVENUECAT_WEB_PUBLIC_KEY="test_YOUR_TESTSTORE_KEY"
+
+# Web phase only: optionally use a RevenueCat Web Billing (Stripe) sandbox key
+# instead of the TestStore key above.
+
+# --- Clerk DEV instance -------------------------------------------------------
+# Development instance publishable key (pk_test_...). The dev instance must have
+# Email verification code enabled and a JWT template named per
+# EXPO_PUBLIC_CLERK_HCB_JWT_TEMPLATE (default "hcb").
+EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY="pk_test_YOUR_CLERK_DEV_INSTANCE_KEY"
+EXPO_PUBLIC_CLERK_HCB_JWT_TEMPLATE="hcb"
+EXPO_PUBLIC_CLERK_REDIRECT_SCHEME="ca.psiphon.conduit"

.gitignore

@@ -3,12 +3,22 @@ node_modules/
 dist/
 npm-debug.*
 *.jks
+*.idsig
 *.p8
 *.p12
 *.key
 *.mobileprovision
 *.orig.*
 web-build/
+/conduit-e2e-*.apk
+/conduit-sim.zip
+/public/canvaskit/
+
+# Playwright generated artifacts
+.playwright-mcp/
+playwright-report/
+test-results/
+blob-report/
 
 # macOS
 .DS_Store
@@ -39,8 +49,16 @@ android/.kotlin
 .env*.local
 .env.production
 .env.local.true
+.env.e2e*
+!.env.e2e.example
 
 TODO/
 
+# generated by scripts/write-git-hash.js (npm run get-git-hash)
+src/git-hash.ts
+
 android/keystore.properties
 android/dev-trusted-signatures.local.json
+
+# git worktrees
+.worktrees/

android/app/build.gradle

@@ -101,8 +101,8 @@ android {
         applicationId 'ca.psiphon.conduit'
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 82
-        versionName "2.1.4"
+        versionCode 90
+        versionName "2.3.1"
     }
     signingConfigs {
         if (hasCustomKeystoreProperties) {
@@ -126,6 +126,13 @@ android {
             if (hasCustomKeystoreProperties) {
                 signingConfig signingConfigs.config
             }
+            // E2E builds (scripts/e2e-build.sh) mark the release variant
+            // debuggable so the RevenueCat SDK accepts the Test Store
+            // (test_*) API key; in non-debuggable builds it shows a blocking
+            // "Wrong API Key" dialog and exits. Never set for real releases.
+            if (findProperty('conduitE2eDebuggable')?.toBoolean() ?: false) {
+                debuggable true
+            }
             shrinkResources (findProperty('android.enableShrinkResourcesInReleaseBuilds')?.toBoolean() ?: false)
             minifyEnabled enableProguardInReleaseBuilds
             proguardFiles getDefaultProguardFile("proguard-android.txt"), "proguard-rules.pro"

android/app/src/main/AndroidManifest.xml

@@ -1,6 +1,7 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android" xmlns:tools="http://schemas.android.com/tools">
   <uses-permission android:name="android.permission.INTERNET"/>
   <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
+  <uses-permission android:name="android.permission.RECORD_AUDIO" tools:node="remove"/>
   <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
   <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
   <uses-permission android:name="android.permission.VIBRATE"/>
@@ -36,4 +37,4 @@
       </intent-filter>
     </activity>
   </application>
-</manifest>
+</manifest>

android/fastlane/Appfile

@@ -0,0 +1 @@
+app_identifier(ENV.fetch("ANDROID_APP_ID", "ca.psiphon.conduit"))

android/fastlane/Fastfile

@@ -0,0 +1,30 @@
+default_platform(:android)
+
+platform :android do
+  desc "Upload an AAB to Google Play internal testing"
+  lane :internal_release do
+    package_name = ENV.fetch("ANDROID_APP_ID", "ca.psiphon.conduit")
+    aab_path = ENV.fetch("ANDROID_AAB_PATH", nil)
+    json_key = ENV.fetch("GOOGLE_PLAY_SERVICE_ACCOUNT_JSON", nil)
+    version_name = ENV.fetch("ANDROID_VERSION_NAME", nil)
+
+    UI.user_error!("ANDROID_AAB_PATH is required") unless aab_path && File.exist?(aab_path)
+    UI.user_error!("GOOGLE_PLAY_SERVICE_ACCOUNT_JSON is required") unless json_key && File.exist?(json_key)
+
+    upload_options = {
+      package_name: package_name,
+      aab: aab_path,
+      track: "internal",
+      release_status: "completed",
+      json_key: json_key,
+      skip_upload_metadata: true,
+      skip_upload_images: true,
+      skip_upload_screenshots: true,
+      skip_upload_changelogs: true,
+      validate_only: false
+    }
+    upload_options[:version_name] = version_name if version_name && !version_name.empty?
+
+    upload_to_play_store(**upload_options)
+  end
+end