chore: sync upstream changes (2026-10-27)

.github/upstream-sync-baseline

@@ -1 +1 @@
-48ce3af5b4cd9b818d44edca4249a15d48e2170f
+5f320126e14b9324db7a84f33e48fa9fdbdc30ca

.opencode/skills/upstream-sync/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: upstream-sync
+description: Sync this fork with upstream agrahn/Android-Password-Store by selectively porting non-passkey changes into a dated PR. Use when the user asks to sync, reconcile, pull or bring changes from upstream / agrahn.
+---
+
+## Purpose
+
+Bring relevant upstream changes from [`agrahn/Android-Password-Store`](https://github.com/agrahn/Android-Password-Store) (`develop`) into this fork without importing upstream's passkey implementation. The full policy lives in `docs/upstream-reconciliation.md`; read it first.
+
+Key facts:
+
+- **Never `git merge upstream/develop`.** The fork has its own passkey/WebAuthn architecture. Changes are cherry-picked (`-x`) or ported one upstream commit/PR at a time.
+- **The review baseline is an upstream SHA**, stored in `.github/upstream-sync-baseline`. It is *not* the Git merge-base: selective ports create no ancestry, so the merge-base stays old forever.
+- **Passkey-owned paths are protected**: `passkeys/`, app passkey provider/injection packages, passkey provider XML, `PASSKEYS.md` and passkey docs. Upstream passkey changes are only an invariant/interoperability source; take the classic Password Store/Autofill part of mixed commits.
+- **Dependency bumps are owned by the fork's Renovate.** Upstream CI, release, changelog and snapshot-bump commits are skipped. Only bump a dependency when a ported change requires it.
+
+## Workflow
+
+### 1. Audit
+
+```bash
+git fetch upstream            # remote: https://github.com/agrahn/Android-Password-Store.git
+scripts/upstream-audit.sh "$SCRATCH/audit.md"
+git rev-parse upstream/develop   # write down: this is the SHA you are reviewing up to
+```
+
+The report lists every upstream commit after the baseline plus changed files classified by area (PASSKEY-PROTECTED, AUTOFILL, PGP/CRYPTO, ...). Filter out dependency/action/PSL/release noise to get the list of meaningful commits.
+
+### 2. Branch
+
+```bash
+DATE=$(date +%F)
+git switch -c sync/upstream-$DATE main
+```
+
+### 3. Port by area, with subagents
+
+Group the meaningful commits by area (e.g. autofill/password creation, SSH/git/network, misc UI/strings/build) and give each group to its own subagent in its own worktree so they run in parallel:
+
+```bash
+git worktree add -b sync/$DATE-<group> ../wt/<group> main
+cp local.properties ../wt/<group>/   # untracked SDK config needed to build
+```
+
+Brief each subagent with: the worktree path, the exact upstream SHAs in its scope, the policy doc, the passkey boundary, "skip upstream CHANGELOG.md hunks", "no `clean`, no full lint (sibling builds)", and ask for a final table `| upstream SHA | PR | disposition | note |` covering **every** commit in scope. Use a stronger model for large or security-sensitive groups (autofill series, host-key verification, crypto); a cheaper one for mechanical groups.
+
+Per commit:
+
+- applies cleanly or with trivial conflicts → `git cherry-pick -x <sha>` (or `scripts/adopt-upstream-pr.sh <PR>`, which refuses passkey paths)
+- needs rework → port manually, cite upstream SHA/PR in the commit message
+- disposition is one of **adopted / adapted / already solved / skipped**
+
+Also handle in one place:
+
+- Public Suffix List: refresh `autofill-parser` PSL once from `upstream/develop` instead of replaying each update commit.
+- Compare `gradle/libs.versions.toml` with upstream and list versions where the fork lags (report, don't bump unless needed).
+
+### 4. Integrate
+
+```bash
+git switch sync/upstream-$DATE
+git merge --no-ff sync/$DATE-<group>   # for each group; resolve strings.xml / CHANGELOG conflicts
+./gradlew spotlessApply
+CI=true ./gradlew lint spotlessCheck test -PslimTests assembleDebug
+```
+
+All checks must pass, including passkey compatibility tests. Then remove the temporary worktrees and branches (`git worktree remove ../wt/<group>`; `git branch -D sync/$DATE-<group>`).
+
+### 5. Record
+
+- Add a `## Reconciliation (<DATE>)` section to `docs/upstream-reconciliation.md` with the reviewed-through SHA and the disposition table (adopted/adapted rows individually, skipped categories summarised).
+- Set the baseline to the SHA recorded in step 1 (do not run `scripts/mark-upstream-reviewed.sh` if upstream moved during the review — it writes the *current* upstream head):
+
+  ```bash
+  echo <reviewed-sha> > .github/upstream-sync-baseline
+  ```
+
+- Add user-visible changes to the `## [Unreleased]` section of `CHANGELOG.md`.
+
+### 6. Pull request
+
+```bash
+git push -u origin sync/upstream-$DATE
+gh pr create --repo pando85/Android-Password-Store --base main \
+  --title "chore: sync upstream changes ($DATE)" --body-file <body.md>
+```
+
+PR body sections: Summary (upstream range `<old-baseline>..<reviewed-sha>`), Adopted/adapted changes (with upstream PR numbers), Skipped (with reasons), Passkey boundary, Lagging dependencies, Validation.
+
+## Pitfalls
+
+- `scripts/upstream-audit.sh` and `mark-upstream-reviewed.sh` reset the `upstream` remote URL to HTTPS.
+- Upstream "autofill" commits sometimes touch passkey screens too (e.g. shortening passkey ids); port only the classic part.
+- Upstream runtime-permission and SSH host-key changes are security relevant; review them rather than blindly cherry-picking.
+- The fork's applicationId, CI workflows and release pipeline differ from upstream; never take upstream `.github/workflows/` or release commits.

CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project will be documented in this file
 
 ## [Unreleased]
 
+### Added
+
+- Option to keep the password store in a shared external folder (`Documents/PasswordStore`); passkeys follow the selected repository
+- Setting to enable Autofill directly from the app settings
+- Dialog showing the SSH server's authentication banner, if any
+- Android 17: runtime request for the local network permission and a connectivity check for local Git servers
+
+### Changed
+
+- Autofill search pane: whitespace-tolerant search, persistent filter switches, start-ellipsised paths, better username lookup (also from the file path) and more inline suggestions
+- New password entries and Autofill-saved credentials honour the directory structure setting and keep the subfolder of the entry
+- Bouncy Castle and coroutines versions are aligned through BOMs
+
+### Fixed
+
+- Classic Autofill no longer offers or fills passkey entries
+- Autofill-saved credentials are filled in right after creation, with the username pre-filled
+- SSH host key verification and compatibility with sshj 0.41
+- Alert dialogs are no longer clipped by the keyboard on short screens
+- An empty Git author email is now allowed
+- Spanish translation fixes
+
 ## [1.26.0] - 2026-10-27
 
 ### Changed

app/build.gradle.kts

@@ -42,6 +42,7 @@ android {
 
 dependencies {
   implementation(platform(libs.compose.bom))
+  implementation(platform(libs.thirdparty.bouncycastle.bom))
   ksp(libs.dagger.hilt.compiler)
   implementation(libs.androidx.annotation)
   coreLibraryDesugaring(libs.android.desugarJdkLibs)
@@ -76,7 +77,7 @@ dependencies {
   implementation(libs.dagger.hilt.android)
 
   implementation(libs.kotlinx.collections.immutable)
-  implementation(libs.kotlinx.coroutines.android)
+  implementation(platform(libs.kotlinx.coroutines.bom))
   implementation(libs.kotlinx.coroutines.core)
   implementation(libs.kotlinx.serialization.json)
 

app/src/main/AndroidManifest.xml

@@ -88,7 +88,7 @@
     <activity
       android:name=".ui.git.config.GitServerConfigActivity"
       android:exported="false"
-      android:label="@string/title_activity_git_clone"
+      android:label="@string/title_activity_git_remote"
       android:windowSoftInputMode="adjustResize" />
 
     <activity
@@ -182,8 +182,8 @@
       android:theme="@style/NoBackgroundThemeM3" />
     <activity
       android:name=".ui.autofill.AutofillFilterView"
-      android:configChanges="orientation|keyboardHidden"
       android:exported="false"
+      android:configChanges="orientation|screenSize|keyboardHidden"
       android:theme="@style/DialogLikeThemeM3"
       android:windowSoftInputMode="adjustNothing" />
     <activity

app/src/main/java/app/passwordstore/Application.kt

@@ -18,7 +18,6 @@ import android.os.StrictMode
 import android.view.View
 import android.view.WindowInsetsController
 import androidx.appcompat.app.AppCompatDelegate
-import app.passwordstore.injection.context.FilesDirPath
 import app.passwordstore.injection.prefs.PGPPassphrases
 import app.passwordstore.injection.prefs.SettingsPreferences
 import app.passwordstore.passkeys.PasskeyPassphraseCache
@@ -48,7 +47,6 @@ import logcat.logcat
 class Application : android.app.Application(), SharedPreferences.OnSharedPreferenceChangeListener {
 
   @Inject @SettingsPreferences lateinit var prefs: SharedPreferences
-  @Inject @FilesDirPath lateinit var filesDirPath: String
   @Inject @PGPPassphrases lateinit var persistentPassphrases: SharedPreferences
   @Inject lateinit var dispatcherProvider: DispatcherProvider
   @Inject lateinit var gitSettings: GitSettings
@@ -73,7 +71,7 @@ class Application : android.app.Application(), SharedPreferences.OnSharedPrefere
     logcat { "Debug logging enabled." }
     prefs.registerOnSharedPreferenceChangeListener(this)
     setNightMode()
-    runMigrations(filesDirPath, prefs, gitSettings, persistentPassphrases)
+    runMigrations(prefs, gitSettings, persistentPassphrases)
     proxyUtils.setDefaultProxy()
     DynamicColors.applyToActivitiesIfAvailable(this)
     setupScreenOffHandler()

app/src/main/java/app/passwordstore/data/repo/PasswordRepository.kt

@@ -4,6 +4,7 @@
  */
 package app.passwordstore.data.repo
 
+import android.os.Environment
 import androidx.core.content.edit
 import app.passwordstore.Application
 import app.passwordstore.data.password.PasswordItem
@@ -15,6 +16,14 @@ import com.github.michaelbull.result.getOrElse
 import com.github.michaelbull.result.onErr
 import com.github.michaelbull.result.runCatching
 import java.io.File
+import java.io.IOException
+import java.nio.file.FileVisitResult
+import java.nio.file.Files
+import java.nio.file.Path
+import java.nio.file.Paths
+import java.nio.file.SimpleFileVisitor
+import java.nio.file.attribute.BasicFileAttributes
+import kotlin.io.path.name
 import org.eclipse.jgit.api.Git
 import org.eclipse.jgit.lib.BranchTrackingStatus
 import org.eclipse.jgit.lib.Constants
@@ -26,6 +35,9 @@ import org.eclipse.jgit.transport.URIish
 
 object PasswordRepository {
 
+  const val TYPE_FILE: Int = 1
+  const val TYPE_DIR: Int = 2
+
   var repository: Repository? = null
   private val settings by unsafeLazy { Application.instance.sharedPrefs }
   private val filesDir
@@ -105,12 +117,30 @@ object PasswordRepository {
   fun closeRepository() {
     repository?.close()
     repository = null
+    settings.edit {
+      putBoolean(PreferenceKeys.REPOSITORY_INITIALIZED, false)
+      putBoolean(PreferenceKeys.PREF_SHARED_REPO, false)
+    }
   }
 
-  fun getRepositoryDirectory(): File {
-    return File(filesDir.toString(), "/store")
+  fun deleteRepository() {
+    getRepositoryDirectory().let { dir ->
+      dir.deleteRecursively()
+    }
+    closeRepository()
   }
 
+  fun getRepositoryDirectory(): File =
+    if (settings.getBoolean(PreferenceKeys.PREF_SHARED_REPO, false))
+      File(
+        File(
+          Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOCUMENTS),
+          "PasswordStore",
+        ),
+        "store",
+      )
+    else File(filesDir, "store")
+
   /* referencePath: /a/b/c
    * /a/b/c/d/e/dir -> /d/e/dir
    * /a/b/c/d/e/file.ext -> /d/e/file.ext
@@ -255,4 +285,58 @@ object PasswordRepository {
     passwordList.sortWith(sortOrder.comparator)
     return passwordList
   }
+
+  /**
+   * Recursively finds files and/or directories (see [type]) below [startPath] whose name equals
+   * [name]. Hidden directories (such as `.git`) are not descended into.
+   */
+  fun findByName(
+    startPath: String,
+    name: String,
+    type: Int = TYPE_DIR or TYPE_FILE,
+    ignoreCase: Boolean = false,
+  ): List<Path> =
+    walkNonHidden(Paths.get(startPath), type) { it.name.equals(name, ignoreCase = ignoreCase) }
+
+  /**
+   * Recursively finds files and/or directories (see [type]) below [startPath] whose parent
+   * directory's name equals [name]. Hidden directories (such as `.git`) are not descended into.
+   */
+  fun findByParentName(
+    startPath: String,
+    name: String,
+    type: Int = TYPE_DIR or TYPE_FILE,
+    ignoreCase: Boolean = false,
+  ): List<Path> =
+    walkNonHidden(Paths.get(startPath), type) { path ->
+      val parent: Path? = path.parent
+      parent != null && parent.name.equals(name, ignoreCase = ignoreCase)
+    }
+
+  private fun walkNonHidden(start: Path, type: Int, predicate: (Path) -> Boolean): List<Path> {
+    val matches = mutableListOf<Path>()
+    if (!Files.isDirectory(start)) return matches
+    Files.walkFileTree(
+      start,
+      object : SimpleFileVisitor<Path>() {
+        override fun preVisitDirectory(
+          dir: Path,
+          attrs: BasicFileAttributes,
+        ): FileVisitResult {
+          if (dir != start && dir.name.startsWith('.')) return FileVisitResult.SKIP_SUBTREE
+          if (dir != start && type and TYPE_DIR != 0 && predicate(dir)) matches.add(dir)
+          return FileVisitResult.CONTINUE
+        }
+
+        override fun visitFile(file: Path, attrs: BasicFileAttributes): FileVisitResult {
+          if (type and TYPE_FILE != 0 && attrs.isRegularFile && predicate(file)) matches.add(file)
+          return FileVisitResult.CONTINUE
+        }
+
+        override fun visitFileFailed(file: Path, exc: IOException): FileVisitResult =
+          FileVisitResult.CONTINUE
+      },
+    )
+    return matches
+  }
 }

app/src/main/java/app/passwordstore/injection/passkeys/PasskeysModule.kt

@@ -16,6 +16,7 @@ import app.passwordstore.crypto.PGPainlessCryptoHandler
 import app.passwordstore.crypto.PgpainlessPasskeyDecryptor
 import app.passwordstore.data.crypto.OpenPgpInteractionCoordinator
 import app.passwordstore.data.crypto.OpenPgpProviderRepository
+import app.passwordstore.data.repo.PasswordRepository
 import app.passwordstore.injection.prefs.SettingsPreferences
 import app.passwordstore.passkeys.BiometricPasskeyAuthenticator
 import app.passwordstore.passkeys.DefaultRepositoryGenerationProvider
@@ -46,7 +47,6 @@ import dagger.Provides
 import dagger.hilt.InstallIn
 import dagger.hilt.android.qualifiers.ApplicationContext
 import dagger.hilt.components.SingletonComponent
-import java.io.File
 import javax.inject.Singleton
 
 @Module
@@ -89,20 +89,17 @@ object PasskeysModule {
 
   @Provides
   @Singleton
-  fun provideRepositoryGenerationProvider(
-    @ApplicationContext context: Context
-  ): RepositoryGenerationProvider =
-    DefaultRepositoryGenerationProvider(File(context.filesDir, "store"))
+  fun provideRepositoryGenerationProvider(): RepositoryGenerationProvider =
+    DefaultRepositoryGenerationProvider(PasswordRepository.getRepositoryDirectory())
 
   @Provides
   @Singleton
   fun providePassRecipientResolver(
-    @ApplicationContext context: Context,
     keyManager: PGPKeyManager,
     providerRepository: OpenPgpProviderRepository,
     interactionCoordinator: OpenPgpInteractionCoordinator,
   ): PassRecipientResolver<PGPKey> {
-    val repositoryRoot = File(context.filesDir, "store")
+    val repositoryRoot = PasswordRepository.getRepositoryDirectory()
     val localResolver = DefaultPassRecipientResolver(repositoryRoot, keyManager)
     return OpenPgpPassRecipientResolver(
       localResolver,
@@ -114,15 +111,14 @@ object PasskeysModule {
   @Provides
   @Singleton
   fun providePasskeyStorage(
-    @ApplicationContext context: Context,
     cryptoHandler: PGPainlessCryptoHandler,
     passkeyPgpDecryptor: PasskeyPgpDecryptor,
     pgpUnlockContext: PgpUnlockContext,
     recipientResolver: PassRecipientResolver<PGPKey>,
     generationProvider: RepositoryGenerationProvider,
     metadataIndex: PasskeyMetadataIndex,
   ): PasskeyStorage {
-    val repositoryRoot = File(context.filesDir, "store")
+    val repositoryRoot = PasswordRepository.getRepositoryDirectory()
     val passkeyConfig = PasskeyStorageConfig(passkeyDirectory = "fido2", fileExtension = ".gpg")
     val fileStorage =
       FilePasskeyStorage(