From 6b709981de0b4aa9273eaf38861db18a99ad11b1 Mon Sep 17 00:00:00 2001
From: davotoula <david.kaspar@gmail.com>
Date: Thu, 30 Apr 2026 11:48:33 +0200
Subject: [PATCH] fix(android): silence StrictMode cleartext violations for Tor
 SOCKS on 127.0.0.1

Add a network_security_config.xml that keeps cleartext globally permitted
(so user-configured ws:// relays still work) but adds an explicit
domain-config for 127.0.0.1 and localhost. This stops StrictMode's
detectCleartextNetwork from flooding logcat with CleartextNetworkViolation
stacks each time the app talks to the local Tor SOCKS proxy
(220+ per benchmark session previously).

Verified on a playBenchmark build: zero CleartextNetworkViolation lines
to 127.0.0.1 even though the app continued attempting Tor connections
on port 9050.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 amethyst/src/main/AndroidManifest.xml           |  1 +
 .../main/res/xml/network_security_config.xml    | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 amethyst/src/main/res/xml/network_security_config.xml

diff --git a/amethyst/src/main/AndroidManifest.xml b/amethyst/src/main/AndroidManifest.xml
index fd3b4f035..a006b8382 100644
--- a/amethyst/src/main/AndroidManifest.xml
+++ b/amethyst/src/main/AndroidManifest.xml
@@ -86,6 +86,7 @@
         android:theme="@style/Theme.Amethyst"
         android:largeHeap="true"
         android:usesCleartextTraffic="true"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:hardwareAccelerated="true"
         android:localeConfig="@xml/locales_config"
         tools:targetApi="34">
diff --git a/amethyst/src/main/res/xml/network_security_config.xml b/amethyst/src/main/res/xml/network_security_config.xml
new file mode 100644
index 000000000..78948e969
--- /dev/null
+++ b/amethyst/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Cleartext traffic is permitted globally so user-configured ws:// relays keep working.
+    The explicit localhost domain-config silences StrictMode CleartextNetworkViolation
+    for the Tor SOCKS proxy on 127.0.0.1.
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="false">127.0.0.1</domain>
+        <domain includeSubdomains="false">localhost</domain>
+    </domain-config>
+</network-security-config>