Harden the APK reader and build downloads after review

- frame_apk: android: attributes win over same-named attributes in
  other namespaces; string attributes that keep only a typed value (no
  raw string) still resolve; a failed icon read leaves the icon out
  instead of failing the install.
- The clipboard IPC origin check can't throw on odd frame URLs.
- fetch-deps.js: 60 s download timeout, at most 5 redirects, a SystemRoot
  fallback for tar.exe, and prunes pydoc_data, venv and the static
  libpython.
- Docs keep the clipboard-tool note for running the UI in a browser.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

app/build/fetch-deps.js

@@ -39,22 +39,23 @@ const PRUNE = [
   "include", "share", "Scripts", "libs", "tcl", "lib/pkgconfig", "lib/itcl4", "lib/tcl8", "lib/tcl8.6",
   "lib/tk8.6", "lib/thread2.8", "bin/idle3", "bin/idle3.12", "bin/pip", "bin/pip3", "bin/pip3.12",
   "bin/pydoc3", "bin/pydoc3.12", "bin/2to3", "bin/2to3-3.12", "bin/python3-config", "bin/python3.12-config",
-  ...["test", "idlelib", "tkinter", "turtledemo", "ensurepip", "lib2to3", "site-packages/pip"]
+  ...["test", "idlelib", "tkinter", "turtledemo", "ensurepip", "lib2to3", "site-packages/pip", "pydoc_data", "venv"]
     .flatMap((d) => [`lib/python3.12/${d}`, `Lib/${d}`]),
 ];
 
-function get(url) {
+function get(url, redirects = 5) {
   return new Promise((resolve, reject) => {
-    https.get(url, (res) => {
+    https.get(url, { timeout: 60000 }, (res) => {
       if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
         res.resume();
-        return resolve(get(res.headers.location));
+        if (!redirects) return reject(new Error(`${url}: too many redirects`));
+        return resolve(get(new URL(res.headers.location, url).href, redirects - 1));
       }
       if (res.statusCode !== 200) return reject(new Error(`${url}: HTTP ${res.statusCode}`));
       const chunks = [];
       res.on("data", (c) => chunks.push(c));
       res.on("end", () => resolve(Buffer.concat(chunks)));
-    }).on("error", reject);
+    }).on("timeout", function () { this.destroy(new Error(`${url}: timed out`)); }).on("error", reject);
   });
 }
 
@@ -66,7 +67,7 @@ async function download(url, sha256, file) {
 }
 
 // Windows' own bsdtar: Git's GNU tar, often first on PATH, reads C:\ as a remote host.
-const TAR = process.platform === "win32" ? path.join(process.env.SystemRoot, "System32", "tar.exe") : "tar";
+const TAR = process.platform === "win32" ? path.join(process.env.SystemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
 
 function extract(file, dir) {
   fs.mkdirSync(dir, { recursive: true });
@@ -97,6 +98,12 @@ async function fetch(os, arch) {
   await download(PY_URL(triple), pySha, tgz);
   extract(tgz, out);  // unpacks to python/
   for (const p of PRUNE) fs.rmSync(path.join(out, "python", p), { recursive: true, force: true });
+  const stdlib = path.join(out, "python", "lib", "python3.12");  // macOS and Linux: drop the static libpython
+  if (fs.existsSync(stdlib)) {
+    for (const d of fs.readdirSync(stdlib)) {
+      if (d.startsWith("config-3.12")) fs.rmSync(path.join(stdlib, d), { recursive: true, force: true });
+    }
+  }
 
   const tools = path.join(out, "tools");
   fs.mkdirSync(tools);

app/main.js

@@ -234,7 +234,10 @@ async function firstRunCheck() {
 }
 
 ipcMain.handle("clipboard:read", (e) => {
-  if (!win || e.sender !== win.webContents || !url || new URL(e.senderFrame.url).origin !== new URL(url).origin) return "";
+  if (!win || e.sender !== win.webContents || !url) return "";
+  try {
+    if (new URL(e.senderFrame.url).origin !== new URL(url).origin) return "";
+  } catch { return ""; }
   return clipboard.readText();
 });
 

docs/frame-control.md

@@ -121,7 +121,9 @@ The arm64 build also needs your distribution's `adb` for Android apps, because
 Google publishes no arm64 Linux platform-tools. Set Up Connection runs
 `ui/frame_connect.py` in your terminal emulator (GNOME Terminal, Konsole, xterm
 and others). The log is at
-`~/.config/Frame Control/logs/server.log`.
+`~/.config/Frame Control/logs/server.log`. Running `ui/server.py` in a browser
+instead of the app, sending the clipboard needs `wl-clipboard` (Wayland) or
+`xclip` (X11).
 
 ## Building
 

tests/test_frame_apk.py

@@ -27,10 +27,14 @@ def pool(strings, utf8=False):
     return struct.pack('<HHIIIIII', 1, 28, 28 + len(body), len(strings), 0, 0x100 if utf8 else 0, start, 0) + body
 
 
-def manifest(package, label_ref, version_ref, min_sdk):
-    """<manifest package versionName><uses-sdk minSdkVersion/><application label icon/></manifest>."""
+def manifest(package, label_ref, version_ref, min_sdk, package_raw=True, foreign_label=False):
+    """<manifest package versionName><uses-sdk minSdkVersion/><application label icon/></manifest>.
+
+    package_raw=False drops the package's raw string (as some repackers do);
+    foreign_label adds a non-android `label` attribute after android:label.
+    """
     strings = ['label', 'icon', 'versionName', 'minSdkVersion', 'package', 'manifest', 'uses-sdk',
-               'application', package]
+               'application', package, 'junk', 'label']  # the second 'label' has no android id
     resmap = struct.pack('<4I', 0x01010001, 0x01010002, 0x0101021c, 0x0101020c)
     resmap = struct.pack('<HHI', 0x0180, 8, 8 + len(resmap)) + resmap
 
@@ -42,9 +46,11 @@ def manifest(package, label_ref, version_ref, min_sdk):
 
     none = 0xffffffff
     chunks = (pool(strings) + resmap
-              + element(5, [(4, 8, frame_apk.T_STRING, 8), (2, none, frame_apk.T_REF, version_ref)])
+              + element(5, [(4, 8 if package_raw else none, frame_apk.T_STRING, 8),
+                            (2, none, frame_apk.T_REF, version_ref)])
               + element(6, [(3, none, frame_apk.T_INT_DEC, min_sdk)])
-              + element(7, [(0, none, frame_apk.T_REF, label_ref), (1, none, frame_apk.T_REF, 0x7f020000)]))
+              + element(7, [(0, none, frame_apk.T_REF, label_ref), (1, none, frame_apk.T_REF, 0x7f020000)]
+                        + ([(10, 9, frame_apk.T_STRING, 9)] if foreign_label else [])))
     return struct.pack('<HHI', 3, 8, 8 + len(chunks)) + chunks
 
 
@@ -111,6 +117,18 @@ class ApkInfo(unittest.TestCase):
         self.assertEqual(info['version'], '')
         self.assertEqual(info['abis'], [])
 
+    def test_repacked_manifest(self):
+        # Package kept only as a typed value; a foreign `label` mustn't beat android:label.
+        arsc = resources({(1, '', 0): {0: 1, 1: 2}})
+        info = self.read(apk({
+            'AndroidManifest.xml': manifest('com.example.repacked', 0x7f010000, 0x7f010001, 24,
+                                            package_raw=False, foreign_label=True),
+            'resources.arsc': arsc,
+        }))
+        self.assertEqual(info['package'], 'com.example.repacked')
+        self.assertEqual(info['label'], 'App label')
+        self.assertIsNone(info['icon_png'])
+
     def test_rejects_non_apks(self):
         for data in (b'not a zip', apk({'classes.dex': b''}), apk({'AndroidManifest.xml': b'<manifest/>'})):
             with self.assertRaises(frame_apk.ApkError):

ui/frame_apk.py

@@ -71,9 +71,14 @@ def manifest_elements(data):
             for i in range(count):
                 a = off + hsize + astart + i * asize
                 aname, raw, dtype, value = struct.unpack_from('<4xII3xBI', data, a)
-                key = ATTR.get(resmap[aname]) if aname < len(resmap) else None
-                key = key or (strings[aname] if aname < len(strings) else '')
-                attrs[key] = (dtype, value, strings[raw] if raw < len(strings) else None)
+                raw = strings[raw] if raw < len(strings) else None
+                if raw is None and dtype == T_STRING and value < len(strings):
+                    raw = strings[value]  # some repackers keep only the typed value
+                android = ATTR.get(resmap[aname]) if aname < len(resmap) else None
+                if android:  # android: attributes win over same-named ones in other namespaces
+                    attrs[android] = (dtype, value, raw)
+                else:
+                    attrs.setdefault(strings[aname] if aname < len(strings) else '', (dtype, value, raw))
             out.append((strings[name] if name < len(strings) else '', attrs))
     return out
 
@@ -197,18 +202,23 @@ def apk_info(path):
             'min_sdk': min_sdk[1] if min_sdk and min_sdk[0] in (T_INT_DEC, T_INT_HEX) else None,
             'icon_png': None,
         }
-        for icon in _icons(app.get('icon'), res):
-            if icon.endswith('.png') and icon in names:
-                info['icon_png'] = z.read(icon)
-                break
-        else:  # adaptive icons are XML; fall back to the largest launcher PNG
-            pngs = sorted((n for n in names if n.endswith('.png') and 'ic_launcher' in n and 'foreground' not in n),
-                          key=lambda n: z.getinfo(n).file_size)
-            if pngs:
-                info['icon_png'] = z.read(pngs[-1])
+        try:
+            info['icon_png'] = _icon_png(z, names, _icons(app.get('icon'), res))
+        except (zipfile.BadZipFile, RuntimeError, OSError):
+            pass  # a missing icon shouldn't stop the install
     return info
 
 
+def _icon_png(z, names, icons):
+    for icon in icons:
+        if icon.endswith('.png') and icon in names:
+            return z.read(icon)
+    # Adaptive icons are XML; fall back to the largest launcher PNG.
+    pngs = sorted((n for n in names if n.endswith('.png') and 'ic_launcher' in n and 'foreground' not in n),
+                  key=lambda n: z.getinfo(n).file_size)
+    return z.read(pngs[-1]) if pngs else None
+
+
 if __name__ == '__main__':
     import sys
     for p in sys.argv[1:]: