chore: bump version to 4.11.87 [skip ci]

Capacitor CLI and Android libraries need to be in root node_modules since capacitor.config.json and android/ folder are at root. The overlay no longer needs to add these deps to cinny.

.gitea/workflows/build.yml

@@ -28,14 +28,18 @@ jobs:
         run: |
           CURRENT=$(grep -Po '"version":\s*"\K[^"]+' package.json | head -1)
           echo "Current version: $CURRENT"
+          
           MAJOR=$(echo $CURRENT | cut -d. -f1)
           MINOR=$(echo $CURRENT | cut -d. -f2)
           PATCH=$(echo $CURRENT | cut -d. -f3)
           NEW_PATCH=$((PATCH + 1))
           NEW_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}"
           echo "New version: $NEW_VERSION"
+          
           sed -i "s/\"version\": \"${CURRENT}\"/\"version\": \"${NEW_VERSION}\"/" package.json
+          
           grep '"version"' package.json | head -1
+          
           echo "VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
           echo "SHOULD_BUILD=true" >> $GITHUB_OUTPUT
       
@@ -81,22 +85,29 @@ jobs:
         uses: android-actions/setup-android@v3
       
       - name: Install dependencies (root)
+        run: npm ci --prefer-offline
+      
+      - name: Apply overlay
+        run: npm run apply-overlay
+      
+      - name: Install dependencies (cinny)
+        working-directory: ./cinny
         run: npm install --prefer-offline
       
-      - name: Clean previous cinny dist
+      - name: Clean previous builds
         run: rm -rf cinny/dist
       
       - name: Make gradlew executable
         run: chmod +x android/gradlew
       
-      - name: Apply overlay and build Android APK
+      - name: Build Android APK
         run: npm run android:apk:linux
       
       - name: Upload APK
         uses: actions/upload-artifact@v3
         with:
-          name: Paarrot-Android-debug.apk
-          path: android/app/build/outputs/apk/debug/app-debug.apk
+          name: Paarrot-Android.apk
+          path: android/app/build/outputs/apk/debug/Paarrot-*.apk
 
   create-release:
     runs-on: ubuntu-latest
@@ -130,8 +141,10 @@ jobs:
         run: |
           VERSION="${{ steps.version.outputs.VERSION }}"
           if git rev-parse "v$VERSION" >/dev/null 2>&1; then
+            echo "Tag v$VERSION already exists"
             echo "exists=true" >> $GITHUB_OUTPUT
           else
+            echo "Tag v$VERSION does not exist"
             echo "exists=false" >> $GITHUB_OUTPUT
           fi
       
@@ -151,14 +164,10 @@ jobs:
       - name: Prepare release files
         run: |
           mkdir -p release-files
-          find artifacts -type f \( -name "*.exe" -o -name "*.AppImage" -o -name "*.nupkg" -o -name "RELEASES*" \) -exec cp {} release-files/ \;
-          APK=$(find artifacts -type f -name "*.apk" | head -1)
-          if [ -n "$APK" ]; then
-            cp "$APK" "release-files/Paarrot.apk"
-          fi
+          find artifacts -type f -name "*.apk" -exec cp {} release-files/ \;
           ls -la release-files/
       
-      - name: Create or Update Release
+      - name: Create or Update Gitea Release
         env:
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -179,10 +188,12 @@ jobs:
               "${API_BASE}/repos/${REPO}/releases" | jq -r '.id')
             echo "Created release with ID: ${RELEASE_ID}"
           else
-            echo "Release exists with ID: ${RELEASE_ID}, deleting existing assets..."
+            echo "Release exists with ID: ${RELEASE_ID}"
+            echo "Deleting existing assets..."
             ASSETS=$(curl -s -H "Authorization: token ${GITEA_TOKEN}" \
               "${API_BASE}/repos/${REPO}/releases/${RELEASE_ID}/assets" | jq -r '.[].id')
             for ASSET_ID in $ASSETS; do
+              echo "Deleting asset ${ASSET_ID}..."
               curl -s -X DELETE -H "Authorization: token ${GITEA_TOKEN}" \
                 "${API_BASE}/repos/${REPO}/releases/${RELEASE_ID}/assets/${ASSET_ID}"
             done
@@ -190,7 +201,7 @@ jobs:
           
           echo "Uploading assets..."
           for FILE in release-files/*; do
-            FILENAME=$(basename "$FILE")
+            FILENAME="Paarrot-${VERSION}.apk"
             echo "Uploading ${FILENAME}..."
             curl -s -X POST \
               -H "Authorization: token ${GITEA_TOKEN}" \
@@ -200,4 +211,44 @@ jobs:
             echo ""
           done
           
-          echo "Release complete!"
+          echo "Gitea release complete!"
+      
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GHTOKEN }}
+        run: |
+          VERSION="${{ steps.version.outputs.VERSION }}"
+          TAG_NAME="v${VERSION}"
+          GITHUB_REPO="Paarrot/Paarrot-Mobile"
+          
+          RELEASE_ID=$(curl -s -H "Authorization: token ${GH_TOKEN}" \
+            "https://api.github.com/repos/${GITHUB_REPO}/releases/tags/${TAG_NAME}" | jq -r '.id // empty')
+          
+          if [ -z "$RELEASE_ID" ]; then
+            echo "Creating new GitHub release for ${TAG_NAME}..."
+            RELEASE_ID=$(curl -s -X POST \
+              -H "Authorization: token ${GH_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "{\"tag_name\": \"${TAG_NAME}\", \"name\": \"Release ${TAG_NAME}\", \"body\": \"Release ${VERSION}\", \"draft\": false, \"prerelease\": false}" \
+              "https://api.github.com/repos/${GITHUB_REPO}/releases" | jq -r '.id')
+            echo "Created GitHub release with ID: ${RELEASE_ID}"
+          else
+            echo "GitHub release exists with ID: ${RELEASE_ID}"
+          fi
+          
+          echo "Uploading assets to GitHub..."
+          UPLOAD_URL=$(curl -s -H "Authorization: token ${GH_TOKEN}" \
+            "https://api.github.com/repos/${GITHUB_REPO}/releases/${RELEASE_ID}" | jq -r '.upload_url' | sed 's/{?name,label}//')
+          
+          for FILE in release-files/*; do
+            FILENAME="Paarrot-${VERSION}.apk"
+            echo "Uploading ${FILENAME} to GitHub..."
+            curl -s -X POST \
+              -H "Authorization: token ${GH_TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@${FILE}" \
+              "${UPLOAD_URL}?name=${FILENAME}"
+            echo ""
+          done
+          
+          echo "GitHub release complete!"

.gitea/workflows/clean.yml

@@ -0,0 +1,30 @@
+name: Clean
+
+on:
+  workflow_dispatch:
+
+jobs:
+  clean:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: false
+
+      - name: Clean build artifacts
+        run: |
+          echo "Cleaning cinny dist..."
+          rm -rf cinny/dist
+
+          echo "Cleaning Android build outputs..."
+          rm -rf android/app/build
+
+          echo "Cleaning root node_modules..."
+          rm -rf node_modules
+
+          echo "Cleaning cinny node_modules..."
+          rm -rf cinny/node_modules
+
+          echo "Done."

.github/FUNDING.yml

@@ -1,3 +0,0 @@
-github: ajbura
-liberapay: ajbura
-open_collective: cinny

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,58 +0,0 @@
-name: 🐞 Bug Report
-description: Report a bug
-labels: 'type: bug'
-
-body:
-  - type: markdown
-    attributes:
-      value: |
-        ## First of all
-        1. Please search for [existing issues](https://github.com/cinnyapp/cinny-desktop/issues?q=is%3Aissue) about this problem first.
-        2. Make sure Cinny is up to date.
-        3. Make sure it's an issue with Cinny and not something else you are using.
-        4. Remember to be friendly.
-
-  - type: textarea
-    id: description
-    attributes:
-      label: Describe the bug
-      description: A clear description of what the bug is. Include screenshots if applicable.
-      placeholder: Bug description
-    validations:
-      required: true
-
-  - type: textarea
-    id: reproduction
-    attributes:
-      label: Reproduction
-      description: Steps to reproduce the behavior.
-      placeholder: |
-        1. Go to ...
-        2. Click on ...
-        3. See error
-
-  - type: textarea
-    id: expected-behavior
-    attributes:
-      label: Expected behavior
-      description: A clear description of what you expected to happen.
-
-  - type: textarea
-    id: info
-    attributes:
-      label: Platform and versions
-      description: "Provide OS, browser and Cinny version with your Homeserver."
-      placeholder: |
-       1. OS: [e.g. Windows 10, MacOS]
-       2. Cinny version: [e.g. 1.8.1]
-       3. Matrix homeserver: [e.g. matrix.org]
-       4. Downloaded from: [e.g. GitHub, Flatpak]
-      render: shell
-    validations:
-      required: true
-
-  - type: textarea
-    id: context
-    attributes:
-      label: Additional context
-      description: Add any other context about the problem here.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +0,0 @@
-contact_links:
-  - name: 💬 Matrix Chat
-    url: https://matrix.to/#/#cinny:matrix.org
-    about: Ask questions and talk to other Cinny users and the maintainers

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,34 +0,0 @@
-name: 💡 Feature Request
-description: Suggest an idea
-labels: 'type: feature'
-
-body:
-  - type: textarea
-    id: problem
-    attributes:
-      label: Describe the problem
-      description: A clear description of the problem this feature would solve
-      placeholder: "I'm always frustrated when..."
-    validations:
-      required: true
-
-  - type: textarea
-    id: solution
-    attributes:
-      label: "Describe the solution you'd like"
-      description: A clear description of what change you would like
-      placeholder: "I would like to..."
-    validations:
-      required: true
-
-  - type: textarea
-    id: alternatives
-    attributes:
-      label: Alternatives considered
-      description: "Any alternative solutions you've considered"
-
-  - type: textarea
-    id: context
-    attributes:
-      label: Additional context
-      description: Add any other context about the problem here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,22 +0,0 @@
-<!-- Please read https://github.com/cinnyapp/cinny/blob/dev/CONTRIBUTING.md before submitting your pull request -->
-
-### Description
-<!-- Please include a summary of the change. Please also include relevant motivation and context. List any dependencies that are required for this change. -->
-
-
-Fixes #
-
-#### Type of change
-
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] This change requires a documentation update
-
-### Checklist:
-
-- [ ] My code follows the style guidelines of this project
-- [ ] I have performed a self-review of my own code
-- [ ] I have commented my code, particularly in hard-to-understand areas
-- [ ] I have made corresponding changes to the documentation
-- [ ] My changes generate no new warnings

.github/SECURITY.md

@@ -1,3 +0,0 @@
-# Reporting a Vulnerability
-
-**If you've found a security vulnerability, please report it to cinnyapp@gmail.com**

.github/dependabot.yml

@@ -1,30 +0,0 @@
-# Docs: <https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates>
-
-version: 2
-updates:
-#   - package-ecosystem: npm
-#     directory: /
-#     schedule:
-#       interval: weekly
-#       day: "tuesday"
-#       time: "01:00"
-#       timezone: "Asia/Kolkata"
-#     open-pull-requests-limit: 15
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: "tuesday"
-      time: "01:00"
-      timezone: "Asia/Kolkata"
-    open-pull-requests-limit: 5
-
-#   - package-ecosystem: cargo
-#     directory: /src-tauri/
-#     schedule:
-#       interval: weekly
-#       day: "tuesday"
-#       time: "01:00"
-#       timezone: "Asia/Kolkata"
-#     open-pull-requests-limit: 5

.github/renovate.json

@@ -1,21 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    ":dependencyDashboardApproval"
-  ],
-  "labels": [
-    "Dependencies"
-  ],
-  "packageRules": [
-    {
-      "matchUpdateTypes": [
-        "lockFileMaintenance"
-      ]
-    }
-  ],
-  "lockFileMaintenance": {
-    "enabled": true
-  },
-  "dependencyDashboard": true
-}

.github/workflows/archive.yml

@@ -1,22 +0,0 @@
-name: "Upload zip-archive"
-on:
-  release:
-    types: [published]
-
-jobs:
-  zip-archive:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4.2.0
-        with:
-          submodules: true
-      - name: Create zip including submodules
-        run: |
-          cd ..
-          zip ${{ github.event.repository.name }}/${{ github.event.repository.name }}-${{ github.ref_name }}.zip ${{ github.event.repository.name }} -r
-      - name: Upload zip to release
-        uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836
-        with:
-          files: |
-            ${{ github.event.repository.name }}-${{ github.ref_name }}.zip

.github/workflows/cla.yml

@@ -1,36 +0,0 @@
-name: 'CLA Assistant'
-on:
-  issue_comment:
-    types: [created]
-  pull_request_target:
-    types: [opened, closed, synchronize]
-
-jobs:
-  CLAssistant:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'CLA Assistant'
-        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
-        # Beta Release
-        uses: cla-assistant/github-action@v2.6.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # the below token should have repo scope and must be manually added by you in the repository's secret
-          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_PAT }}
-        with:
-          path-to-signatures: 'signatures.json'
-          path-to-document: 'https://github.com/cinnyapp/cla/blob/main/cla.md' # e.g. a CLA or a DCO document
-          # branch should not be protected
-          branch: 'main'
-          allowlist: ajbura,bot*
-
-          #below are the optional inputs - If the optional inputs are not given, then default values will be taken
-          remote-organization-name: cinnyapp
-          remote-repository-name: cla
-          #create-file-commit-message: 'For example: Creating file for storing CLA Signatures'
-          #signed-commit-message: 'For example: $contributorName has signed the CLA in #$pullRequestNo'
-          #custom-notsigned-prcomment: 'pull request comment with Introductory message to ask new contributors to sign'
-          #custom-pr-sign-comment: 'The signature to be committed in order to sign the CLA'
-          #custom-allsigned-prcomment: 'pull request comment when all contributors has signed, defaults to **CLA Assistant Lite bot** All Contributors have signed the CLA.'
-          #lock-pullrequest-aftermerge: false - if you don't want this bot to automatically lock the pull request after merging (default - true)
-          #use-dco-flag: true - If you are using DCO instead of CLA

.github/workflows/lockfile.yml

@@ -1,26 +0,0 @@
-name: NPM Lockfile Changes
-
-on:
-  pull_request:
-    paths:
-      - 'package-lock.json'
-
-jobs:
-  lockfile_changes:
-    runs-on: ubuntu-latest
-    # Permission overwrite is required for Dependabot PRs, see "Common issues" below.
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4.2.0
-      - name: NPM Lockfile Changes
-        uses: codepunkt/npm-lockfile-changes@b40543471c36394409466fdb277a73a0856d7891
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          # Optional inputs, can be deleted safely if you are happy with default values.
-          collapsibleThreshold: 25
-          failOnDowngrade: false
-          path: package-lock.json
-          updateComment: true

.github/workflows/test.yml

@@ -1,40 +0,0 @@
-name: "Build pull request"
-on:
-  #pull_request:
-    #types: ['opened', 'synchronize']
-
-jobs:
-  publish-tauri:
-    strategy:
-      fail-fast: false
-      matrix:
-        platform: [macos-latest, ubuntu-20.04, windows-latest]
-
-    runs-on: ${{ matrix.platform }}
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4.2.0
-      with: 
-        submodules: true
-    - name: Setup node
-      uses: actions/setup-node@v4.4.0
-      with:
-        node-version: 20.12.2
-        cache: 'npm'
-    - name: Install Rust stable
-      uses: actions-rs/toolchain@v1.0.7
-      with:
-        toolchain: stable
-    - name: Install dependencies (ubuntu only)
-      if: matrix.platform == 'ubuntu-20.04'
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y libgtk-3-dev webkit2gtk-4.0 libappindicator3-dev librsvg2-dev patchelf
-    - name: Install cinny dependencies
-      run: cd cinny && npm ci
-    - name: Install tauri dependencies
-      run: npm ci
-    - name: Build desktop app with Tauri
-      uses: tauri-apps/tauri-action@v0.5.14
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

android/.gitignore

@@ -52,10 +52,10 @@ captures/
 # Comment next line if keeping position of elements in Navigation Editor is relevant for you
 .idea/navEditor.xml
 
-# Keystore files
-# Uncomment the following lines if you do not want to check your keystore files in.
-#*.jks
-#*.keystore
+# Keystore files - NEVER commit these!
+*.jks
+*.keystore
+keystore.properties
 
 # External native build folder generated in Android Studio 2.2 and later
 .externalNativeBuild

android/SIGNING_SETUP.md

@@ -0,0 +1,61 @@
+# Android App Signing Setup
+
+## Why This Matters
+Android requires apps to be signed with the same key for updates to work. Without proper signing, users cannot update your app - they must uninstall and reinstall, losing all data.
+
+## Setup Instructions
+
+### 1. Create a Keystore (if you don't have one)
+
+Run this command in the `android/` directory:
+
+```bash
+keytool -genkey -v -keystore paarrot-release.keystore -alias paarrot -keyalg RSA -keysize 2048 -validity 10000
+```
+
+You'll be asked for:
+- Keystore password (remember this!)
+- Key password (remember this!)  
+- Your name, organization, etc.
+
+**IMPORTANT**: Back up this keystore file and remember the passwords! If you lose either, you cannot update your app.
+
+### 2. Create keystore.properties
+
+Copy the example file:
+
+```bash
+cp keystore.properties.example keystore.properties
+```
+
+Then edit `keystore.properties` and fill in:
+- `storeFile`: path to your keystore (e.g., `paarrot-release.keystore`)
+- `storePassword`: the keystore password you set
+- `keyAlias`: the alias (e.g., `paarrot`)
+- `keyPassword`: the key password you set
+
+### 3. Verify
+
+The file `keystore.properties` should be gitignored (check `.gitignore`).
+
+### 4. Build
+
+Now your release builds will be properly signed:
+
+```bash
+cd android
+./gradlew assembleRelease
+```
+
+The signed APK will be in: `app/build/outputs/apk/release/`
+
+## Troubleshooting
+
+### "Updates not installing"
+- You're using a different keystore than the original APK
+- Solution: Use the same keystore that was used for the first release
+
+### "keystore.properties not found"
+- Normal for debug builds
+- Only needed for release builds
+- Create the file following step 2 above

android/app/build.gradle

@@ -1,8 +1,28 @@
 apply plugin: 'com.android.application'
+apply plugin: 'kotlin-android'
+
+// Load keystore properties
+def keystorePropertiesFile = rootProject.file("keystore.properties")
+def keystoreProperties = new Properties()
+if (keystorePropertiesFile.exists()) {
+    keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
+}
 
 android {
     namespace = "com.paarrot.app"
     compileSdk = rootProject.ext.compileSdkVersion
+    
+    signingConfigs {
+        release {
+            if (keystorePropertiesFile.exists()) {
+                storeFile file(keystoreProperties['storeFile'])
+                storePassword keystoreProperties['storePassword']
+                keyAlias keystoreProperties['keyAlias']
+                keyPassword keystoreProperties['keyPassword']
+            }
+        }
+    }
+    
     defaultConfig {
         applicationId "com.paarrot.app"
         minSdkVersion rootProject.ext.minSdkVersion
@@ -20,6 +40,14 @@ android {
         release {
             minifyEnabled false
             proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+            if (keystorePropertiesFile.exists()) {
+                signingConfig signingConfigs.release
+            }
+        }
+    }
+    applicationVariants.all { variant ->
+        variant.outputs.all { output ->
+            outputFileName = "Paarrot-${variant.versionName}.apk"
         }
     }
 }
@@ -36,6 +64,7 @@ dependencies {
     implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
     implementation "androidx.core:core-splashscreen:$coreSplashScreenVersion"
     implementation project(':capacitor-android')
+    implementation 'org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.3'
     testImplementation "junit:junit:$junitVersion"
     androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
     androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"

android/app/src/main/AndroidManifest.xml

@@ -33,12 +33,29 @@
                 android:name="android.support.FILE_PROVIDER_PATHS"
                 android:resource="@xml/file_paths"></meta-data>
         </provider>
+
+        <service
+            android:name=".MatrixSyncService"
+            android:foregroundServiceType="dataSync"
+            android:exported="false"
+            android:stopWithTask="false" />
+
+        <receiver
+            android:name=".BootReceiver"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.BOOT_COMPLETED" />
+            </intent-filter>
+        </receiver>
     </application>
 
     <!-- Permissions -->
 
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
+    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
     <uses-permission android:name="android.permission.RECORD_AUDIO" />
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />

android/app/src/main/java/com/paarrot/app/BootReceiver.kt

@@ -0,0 +1,36 @@
+package com.paarrot.app
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+
+/**
+ * Restarts [MatrixSyncService] after the device boots, using credentials
+ * previously persisted by [SyncServicePlugin].
+ */
+class BootReceiver : BroadcastReceiver() {
+
+    override fun onReceive(context: Context, intent: Intent) {
+        if (intent.action != Intent.ACTION_BOOT_COMPLETED) return
+
+        val prefs = context.getSharedPreferences(SyncServicePlugin.PREFS, Context.MODE_PRIVATE)
+        val homeserver = prefs.getString(MatrixSyncService.EXTRA_HOMESERVER, null) ?: return
+        val token = prefs.getString(MatrixSyncService.EXTRA_TOKEN, null) ?: return
+        val userId = prefs.getString(MatrixSyncService.EXTRA_USER_ID, null) ?: ""
+        val deviceId = prefs.getString(MatrixSyncService.EXTRA_DEVICE_ID, null) ?: ""
+
+        val serviceIntent = Intent(context, MatrixSyncService::class.java).apply {
+            putExtra(MatrixSyncService.EXTRA_HOMESERVER, homeserver)
+            putExtra(MatrixSyncService.EXTRA_TOKEN, token)
+            putExtra(MatrixSyncService.EXTRA_USER_ID, userId)
+            putExtra(MatrixSyncService.EXTRA_DEVICE_ID, deviceId)
+        }
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            context.startForegroundService(serviceIntent)
+        } else {
+            context.startService(serviceIntent)
+        }
+    }
+}

android/app/src/main/java/com/paarrot/app/MainActivity.java

@@ -1,5 +1,12 @@
 package com.paarrot.app;
 
+import android.os.Bundle;
 import com.getcapacitor.BridgeActivity;
 
-public class MainActivity extends BridgeActivity {}
+public class MainActivity extends BridgeActivity {
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        registerPlugin(SyncServicePlugin.class);
+        super.onCreate(savedInstanceState);
+    }
+}

android/app/src/main/java/com/paarrot/app/MatrixSyncService.kt

@@ -0,0 +1,239 @@
+package com.paarrot.app
+
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.app.Service
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import android.util.Log
+import androidx.core.app.NotificationCompat
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import org.json.JSONObject
+import java.net.HttpURLConnection
+import java.net.URL
+import java.net.URLEncoder
+
+/**
+ * Persistent ForegroundService that maintains a Matrix /sync long-poll loop,
+ * showing native notifications for new messages when the main app process is alive
+ * but the UI is not in the foreground, and when the app has been swiped away.
+ *
+ * Start via [SyncServicePlugin]. Credentials are persisted in SharedPreferences
+ * so [BootReceiver] can restart it after a device reboot.
+ */
+class MatrixSyncService : Service() {
+
+    private val job = SupervisorJob()
+    private val serviceScope = CoroutineScope(Dispatchers.IO + job)
+
+    /** Event IDs already shown as notifications this session — prevents duplicates on restart. */
+    private val shownEventIds = HashSet<String>(64)
+
+    override fun onBind(intent: Intent?) = null
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        val prefs = applicationContext.getSharedPreferences(SyncServicePlugin.PREFS, Context.MODE_PRIVATE)
+
+        val homeserver = intent?.getStringExtra(EXTRA_HOMESERVER)
+            ?: prefs.getString(EXTRA_HOMESERVER, null)
+        val token = intent?.getStringExtra(EXTRA_TOKEN)
+            ?: prefs.getString(EXTRA_TOKEN, null)
+        val userId = intent?.getStringExtra(EXTRA_USER_ID)
+            ?: prefs.getString(EXTRA_USER_ID, null) ?: ""
+
+        if (homeserver == null || token == null) {
+            stopSelf()
+            return START_NOT_STICKY
+        }
+
+        startForeground(NOTIF_ID_STATUS, buildStatusNotification())
+
+        serviceScope.launch {
+            runSyncLoop(homeserver, token, userId)
+        }
+
+        return START_STICKY
+    }
+
+    override fun onDestroy() {
+        super.onDestroy()
+        job.cancel()
+    }
+
+    private suspend fun runSyncLoop(homeserver: String, token: String, userId: String) {
+        val prefs = applicationContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+        var since = prefs.getString(KEY_SINCE, null)
+        var isFirstSync = since == null
+
+        while (serviceScope.isActive) {
+            try {
+                val url = buildSyncUrl(homeserver.trimEnd('/'), since)
+                val (responseCode, body) = doHttpGet(url, token)
+
+                when (responseCode) {
+                    200 -> {
+                        val json = JSONObject(body ?: "{}")
+                        val nextBatch = json.optString("next_batch").takeIf { it.isNotBlank() }
+
+                        if (nextBatch != null) {
+                            prefs.edit().putString(KEY_SINCE, nextBatch).apply()
+
+                            if (!isFirstSync && !appInForeground) {
+                                processRoomEvents(json, userId)
+                            }
+                            isFirstSync = false
+                            since = nextBatch
+                        }
+                    }
+                    401, 403 -> {
+                        Log.w(TAG, "Auth error $responseCode — stopping sync")
+                        stopSelf()
+                        return
+                    }
+                    else -> delay(BACKOFF_ERRS_MS)
+                }
+            } catch (e: CancellationException) {
+                throw e
+            } catch (e: Exception) {
+                Log.w(TAG, "Sync error: ${e.message}")
+                delay(BACKOFF_ERRS_MS)
+            }
+        }
+    }
+
+    private fun buildSyncUrl(base: String, since: String?): String {
+        val filter = """{"room":{"timeline":{"limit":10,"types":["m.room.message"]},"state":{"types":[]},"account_data":{"types":[]},"ephemeral":{"types":[]}},"account_data":{"types":[]},"presence":{"types":[]}}"""
+        val encodedFilter = URLEncoder.encode(filter, "UTF-8")
+        val sinceParam = if (since != null) "&since=${URLEncoder.encode(since, "UTF-8")}" else ""
+        return "$base/_matrix/client/v3/sync?timeout=30000&filter=$encodedFilter$sinceParam"
+    }
+
+    private suspend fun doHttpGet(urlString: String, token: String): Pair<Int, String?> =
+        withContext(Dispatchers.IO) {
+            val conn = URL(urlString).openConnection() as HttpURLConnection
+            try {
+                conn.requestMethod = "GET"
+                conn.setRequestProperty("Authorization", "Bearer $token")
+                conn.setRequestProperty("Accept", "application/json")
+                conn.connectTimeout = 5_000
+                conn.readTimeout = 35_000
+                val code = conn.responseCode
+                val body = if (code == 200) conn.inputStream.bufferedReader().readText() else null
+                Pair(code, body)
+            } catch (e: Exception) {
+                Pair(-1, null)
+            } finally {
+                conn.disconnect()
+            }
+        }
+
+    private fun processRoomEvents(sync: JSONObject, myUserId: String) {
+        val joinedRooms = sync.optJSONObject("rooms")?.optJSONObject("join") ?: return
+        val nm = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        ensureMessageChannel(nm)
+
+        val roomIds = joinedRooms.keys().asSequence().toList()
+        for (roomId in roomIds) {
+            val timeline = joinedRooms.optJSONObject(roomId)
+                ?.optJSONObject("timeline") ?: continue
+            val events = timeline.optJSONArray("events") ?: continue
+
+            for (i in 0 until events.length()) {
+                val event = events.optJSONObject(i) ?: continue
+                val eventId = event.optString("event_id")
+
+                if (event.optString("type") != "m.room.message") continue
+                if (event.optString("sender") == myUserId) continue
+                if (eventId.isNotBlank() && !shownEventIds.add(eventId)) continue
+
+                val content = event.optJSONObject("content") ?: continue
+                val body = content.optString("body").takeIf { it.isNotBlank() } ?: continue
+                val sender = event.optString("sender")
+                val senderName = sender.substringAfter("@").substringBefore(":")
+
+                showMessageNotification(nm, senderName, body)
+            }
+        }
+    }
+
+    private fun showMessageNotification(nm: NotificationManager, sender: String, body: String) {
+        val launchIntent = packageManager.getLaunchIntentForPackage(packageName)
+            ?: Intent(this, MainActivity::class.java)
+        val pi = PendingIntent.getActivity(
+            this, 0, launchIntent,
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+        )
+
+        val notification = NotificationCompat.Builder(this, CHANNEL_MESSAGES)
+            .setSmallIcon(R.drawable.ic_stat_paarrot)
+            .setContentTitle(sender)
+            .setContentText(body)
+            .setAutoCancel(true)
+            .setContentIntent(pi)
+            .setPriority(NotificationCompat.PRIORITY_HIGH)
+            .build()
+
+        nm.notify(System.currentTimeMillis().toInt(), notification)
+    }
+
+    private fun buildStatusNotification(): Notification {
+        val nm = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            val channel = NotificationChannel(
+                CHANNEL_STATUS, "Sync Status",
+                NotificationManager.IMPORTANCE_MIN,
+            ).apply {
+                description = "Paarrot background sync status"
+                setShowBadge(false)
+            }
+            nm.createNotificationChannel(channel)
+        }
+
+        return NotificationCompat.Builder(this, CHANNEL_STATUS)
+            .setSmallIcon(R.drawable.ic_stat_paarrot)
+            .setContentTitle("Paarrot")
+            .setContentText("Connected")
+            .setPriority(NotificationCompat.PRIORITY_MIN)
+            .setOngoing(true)
+            .build()
+    }
+
+    private fun ensureMessageChannel(nm: NotificationManager) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            val channel = NotificationChannel(
+                CHANNEL_MESSAGES, "Messages",
+                NotificationManager.IMPORTANCE_HIGH,
+            ).apply { description = "Matrix message notifications" }
+            nm.createNotificationChannel(channel)
+        }
+    }
+
+    companion object {
+        private const val TAG = "MatrixSyncService"
+        const val EXTRA_HOMESERVER = "homeserver_url"
+        const val EXTRA_TOKEN = "access_token"
+        const val EXTRA_USER_ID = "user_id"
+        const val EXTRA_DEVICE_ID = "device_id"
+        const val PREFS = "matrix_sync_prefs"
+        const val KEY_SINCE = "since_token"
+        private const val NOTIF_ID_STATUS = 1001
+        private const val CHANNEL_STATUS = "sync_status"
+        private const val CHANNEL_MESSAGES = "messages"
+        private const val BACKOFF_ERRS_MS = 10_000L
+
+        /** Set by [SyncServicePlugin] — true when the Capacitor WebView UI is visible. */
+        @Volatile
+        var appInForeground = false
+    }
+}

android/app/src/main/java/com/paarrot/app/SyncServicePlugin.kt

@@ -0,0 +1,94 @@
+package com.paarrot.app
+
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import com.getcapacitor.JSObject
+import com.getcapacitor.Plugin
+import com.getcapacitor.PluginCall
+import com.getcapacitor.PluginMethod
+import com.getcapacitor.annotation.CapacitorPlugin
+
+/**
+ * Capacitor plugin that controls [MatrixSyncService] from JS.
+ *
+ * JS API:
+ * - `start({ homeserverUrl, accessToken, userId, deviceId })` — start/update sync service
+ * - `stop()` — stop sync service and clear persisted credentials
+ * - `setAppForeground({ foreground })` — tell the service whether the app UI is visible
+ * - `getStatus()` — returns `{ running: boolean }`
+ */
+@CapacitorPlugin(name = "MatrixBackgroundSync")
+class SyncServicePlugin : Plugin() {
+
+    /**
+     * Starts the [MatrixSyncService] with the provided Matrix credentials.
+     * Persists credentials in SharedPreferences so [BootReceiver] can restart
+     * the service after a device reboot.
+     */
+    @PluginMethod
+    fun start(call: PluginCall) {
+        val homeserver = call.getString("homeserverUrl")
+            ?: return call.reject("homeserverUrl required")
+        val token = call.getString("accessToken")
+            ?: return call.reject("accessToken required")
+        val userId = call.getString("userId") ?: ""
+        val deviceId = call.getString("deviceId") ?: ""
+
+        context.getSharedPreferences(PREFS, Context.MODE_PRIVATE).edit()
+            .putString(MatrixSyncService.EXTRA_HOMESERVER, homeserver)
+            .putString(MatrixSyncService.EXTRA_TOKEN, token)
+            .putString(MatrixSyncService.EXTRA_USER_ID, userId)
+            .putString(MatrixSyncService.EXTRA_DEVICE_ID, deviceId)
+            .apply()
+
+        val intent = Intent(context, MatrixSyncService::class.java).apply {
+            putExtra(MatrixSyncService.EXTRA_HOMESERVER, homeserver)
+            putExtra(MatrixSyncService.EXTRA_TOKEN, token)
+            putExtra(MatrixSyncService.EXTRA_USER_ID, userId)
+            putExtra(MatrixSyncService.EXTRA_DEVICE_ID, deviceId)
+        }
+
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+            context.startForegroundService(intent)
+        } else {
+            context.startService(intent)
+        }
+
+        call.resolve()
+    }
+
+    /** Stops the sync service and erases persisted credentials. */
+    @PluginMethod
+    fun stop(call: PluginCall) {
+        context.getSharedPreferences(PREFS, Context.MODE_PRIVATE).edit().clear().apply()
+        context.stopService(Intent(context, MatrixSyncService::class.java))
+        call.resolve()
+    }
+
+    /**
+     * Notifies the service whether the Capacitor WebView UI is currently visible.
+     * When `foreground == true` the service skips firing notifications because
+     * the JS layer handles them directly via LocalNotifications.
+     */
+    @PluginMethod
+    fun setAppForeground(call: PluginCall) {
+        MatrixSyncService.appInForeground = call.getBoolean("foreground", false) ?: false
+        call.resolve()
+    }
+
+    /** Returns whether the sync service is currently running. */
+    @PluginMethod
+    fun getStatus(call: PluginCall) {
+        val am = context.getSystemService(Context.ACTIVITY_SERVICE)
+            as android.app.ActivityManager
+        @Suppress("DEPRECATION")
+        val running = am.getRunningServices(Int.MAX_VALUE)
+            .any { it.service.className == MatrixSyncService::class.java.name }
+        call.resolve(JSObject().apply { put("running", running) })
+    }
+
+    companion object {
+        const val PREFS = "sync_service_prefs"
+    }
+}

android/build.gradle

@@ -1,6 +1,9 @@
 // Top-level build file where you can add configuration options common to all sub-projects/modules.
 
 buildscript {
+    ext {
+        kotlin_version = '1.9.25'
+    }
 
     repositories {
         google()
@@ -9,6 +12,7 @@ buildscript {
     dependencies {
         classpath 'com.android.tools.build:gradle:8.13.0'
         classpath 'com.google.gms:google-services:4.4.4'
+        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
 
         // NOTE: Do not place your application dependencies here; they belong
         // in the individual module build.gradle files

android/keystore.properties.example

@@ -0,0 +1,14 @@
+# Copy this file to keystore.properties and fill in your actual values
+# NEVER commit keystore.properties to git!
+
+# Path to your keystore file (relative to android/ directory)
+storeFile=paarrot-release.keystore
+
+# Keystore password
+storePassword=your_keystore_password_here
+
+# Key alias
+keyAlias=paarrot
+
+# Key password
+keyPassword=your_key_password_here

overlay/package-additions.json

@@ -1,8 +1,3 @@
 {
-  "dependencies": {
-    "@capacitor/android": "8.3.0",
-    "@capacitor/cli": "8.3.0",
-    "@capacitor/core": "8.3.0",
-    "@capacitor/local-notifications": "8.0.2"
-  }
+  "dependencies": {}
 }

overlay/src/app/pages/client/ClientNonUIFeatures.tsx

@@ -36,6 +36,11 @@ import {
   setupNotificationTapListener,
 } from '../../utils/tauri';
 import { setPaarrotNavigate, initPaarrotAPI } from '../../paarrot-api';
+import {
+  startBackgroundSync,
+  stopBackgroundSync,
+  setAppForegroundState,
+} from '../../utils/backgroundSync';
 
 /**
  * Applies the selected emoji style font to the document.
@@ -413,6 +418,31 @@ function MessageNotifications() {
   return null;
 }
 
+/**
+ * Starts the native Android background sync service on login, keeps it
+ * informed of foreground state so it doesn't double-fire notifications,
+ * and stops it cleanly on unmount (logout).
+ * Only active on Android Capacitor builds.
+ */
+function BackgroundSyncSetup() {
+  const mx = useMatrixClient();
+
+  useEffect(() => {
+    startBackgroundSync(mx);
+
+    const onVisibility = () => setAppForegroundState(!document.hidden);
+    document.addEventListener('visibilitychange', onVisibility);
+    setAppForegroundState(!document.hidden);
+
+    return () => {
+      document.removeEventListener('visibilitychange', onVisibility);
+      stopBackgroundSync();
+    };
+  }, [mx]);
+
+  return null;
+}
+
 /**
  * Initializes the Paarrot API for Electron integration
  * Registers the navigate function and sets up IPC handlers
@@ -475,6 +505,7 @@ export function ClientNonUIFeatures({ children }: ClientNonUIFeaturesProps) {
       <FaviconUpdater />
       <InviteNotifications />
       <MessageNotifications />
+      <BackgroundSyncSetup />
       <PaarrotAPIInitializer />
       <TaskbarFlashStopper />
       {children}

overlay/src/app/utils/backgroundSync.ts

@@ -0,0 +1,91 @@
+import { Capacitor, registerPlugin } from '@capacitor/core';
+import type { MatrixClient } from 'matrix-js-sdk';
+ 
+interface MatrixBackgroundSyncPlugin {
+  /** Start the background sync service with the given Matrix credentials. */
+  start(options: {
+    homeserverUrl: string;
+    accessToken: string;
+    userId: string;
+    deviceId: string;
+  }): Promise<void>;
+  /** Stop the background sync service and clear persisted credentials. */
+  stop(): Promise<void>;
+  /**
+   * Notify the service whether the app UI is visible.
+   * When foreground is true, the service suppresses native notifications
+   * because the JS layer handles them via LocalNotifications.
+   */
+  setAppForeground(options: { foreground: boolean }): Promise<void>;
+  /** Returns whether the sync service is currently running. */
+  getStatus(): Promise<{ running: boolean }>;
+}
+
+const MatrixBackgroundSync = registerPlugin<MatrixBackgroundSyncPlugin>('MatrixBackgroundSync');
+
+/** Returns true when the current platform is Android Capacitor. */
+export const isBackgroundSyncSupported = (): boolean =>
+  Capacitor.isNativePlatform() && Capacitor.getPlatform() === 'android';
+
+/**
+ * Starts the native Matrix background sync service.
+ * Reads credentials directly from the active MatrixClient.
+ * Safe to call on every login — the service is idempotent.
+ * @param mx Authenticated Matrix client
+ */
+export const startBackgroundSync = async (mx: MatrixClient): Promise<void> => {
+  if (!isBackgroundSyncSupported()) return;
+
+  const homeserverUrl = mx.getHomeserverUrl();
+  const accessToken = mx.getAccessToken();
+  const userId = mx.getUserId();
+  const deviceId = mx.getDeviceId();
+
+  if (!homeserverUrl || !accessToken || !userId) {
+    console.warn('[BackgroundSync] Missing credentials, not starting');
+    return;
+  }
+
+  try {
+    await MatrixBackgroundSync.start({
+      homeserverUrl,
+      accessToken,
+      userId,
+      deviceId: deviceId ?? '',
+    });
+    console.log('[BackgroundSync] Service started');
+  } catch (err) {
+    console.warn('[BackgroundSync] Failed to start:', err);
+  }
+};
+
+/**
+ * Stops the native Matrix background sync service.
+ * Call on logout so the service stops and credentials are wiped.
+ */
+export const stopBackgroundSync = async (): Promise<void> => {
+  if (!isBackgroundSyncSupported()) return;
+
+  try {
+    await MatrixBackgroundSync.stop();
+    console.log('[BackgroundSync] Service stopped');
+  } catch (err) {
+    console.warn('[BackgroundSync] Failed to stop:', err);
+  }
+};
+
+/**
+ * Tells the native service whether the app UI is in the foreground.
+ * Call when document visibility changes so the service can suppress
+ * duplicate notifications while the JS layer is active.
+ * @param foreground true if the WebView UI is currently visible
+ */
+export const setAppForegroundState = async (foreground: boolean): Promise<void> => {
+  if (!isBackgroundSyncSupported()) return;
+
+  try {
+    await MatrixBackgroundSync.setAppForeground({ foreground });
+  } catch (err) {
+    console.warn('[BackgroundSync] setAppForeground failed:', err);
+  }
+};

package.json

@@ -1,22 +1,19 @@
 {
   "name": "paarrot",
-  "version": "4.11.78",
+  "version": "4.11.87",
   "description": "Paarrot - A Matrix client based on Cinny",
   "engines": {
     "node": ">=18.0.0"
   },
   "scripts": {
-    "android:prepare": "node scripts/apply-overlay.mjs && cd cinny && npm install && npm run build && npx cap sync android",
-    "android:patch-settings:linux": "sed -i 's|../node_modules/|../cinny/node_modules/|g' android/capacitor.settings.gradle",
-    "android:restore": "node scripts/restore-cinny.mjs",
-    "android:open": "cd cinny && npx cap open android",
-    "android:run": "cd cinny && npx cap run android",
-    "android:apk": "npm run android:prepare && cd cinny/android && gradlew.bat assembleDebug && cd ../.. && node scripts/restore-cinny.mjs",
-    "android:apk:linux": "npm run android:prepare && npm run android:patch-settings:linux && cd cinny/android && ./gradlew assembleDebug && cd ../.. && node scripts/restore-cinny.mjs",
-    "android:apk:release": "npm run android:prepare && cd cinny/android && gradlew.bat assembleRelease && cd ../.. && node scripts/restore-cinny.mjs",
-    "android:apk:release:linux": "npm run android:prepare && npm run android:patch-settings:linux && cd cinny/android && ./gradlew assembleRelease && cd ../.. && node scripts/restore-cinny.mjs",
-    "android:aab": "npm run android:prepare && cd cinny/android && gradlew.bat bundleRelease && cd ../.. && node scripts/restore-cinny.mjs",
-    "android:aab:linux": "npm run android:prepare && npm run android:patch-settings:linux && cd cinny/android && ./gradlew bundleRelease && cd ../.. && node scripts/restore-cinny.mjs"
+    "apply-overlay": "node scripts/apply-overlay.mjs",
+    "android:prepare": "cd cinny && npm run build && cd .. && npx cap sync android",
+    "android:open": "npx cap open android",
+    "android:run": "npx cap run android",
+    "android:apk": "npm run apply-overlay && npm run android:prepare && cd android && gradlew.bat assembleDebug",
+    "android:apk:release": "npm run apply-overlay && npm run android:prepare && cd android && gradlew.bat assembleRelease",
+    "android:apk:linux": "cd cinny && npm run build && cd .. && npx cap sync android && cd android && ./gradlew assembleDebug",
+    "android:aab": "npm run apply-overlay && npm run android:prepare && cd android && gradlew.bat bundleRelease"
   },
   "keywords": [],
   "author": {
@@ -24,6 +21,12 @@
     "email": "mates.media@users.noreply.github.com"
   },
   "license": "AGPL-3.0-only",
+  "dependencies": {
+    "@capacitor/android": "8.3.0",
+    "@capacitor/cli": "8.3.0",
+    "@capacitor/core": "8.3.0",
+    "@capacitor/local-notifications": "8.0.2"
+  },
   "devDependencies": {
     "node-fetch": "3.3.2",
     "png2icons": "2.0.1",

scripts/apply-overlay.mjs

@@ -120,7 +120,23 @@ if (!existsSync(androidJunction)) {
   console.log(`  android/ link already exists, skipping`);
 }
 
-// 7. Write android/local.properties with the current machine's Android SDK path
+// 8. Sync version from root package.json into android/app/build.gradle
+console.log('[apply-overlay] Syncing version into build.gradle...');
+const rootPkg = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'));
+const version = rootPkg.version ?? '1.0.0';
+const parts = version.split('.').map(Number);
+// versionCode: major*10000 + minor*100 + patch  (e.g. 4.11.78 -> 41178)
+const versionCode = (parts[0] ?? 0) * 10000 + (parts[1] ?? 0) * 100 + (parts[2] ?? 0);
+
+const buildGradlePath = join(androidTarget, 'app', 'build.gradle');
+let buildGradle = readFileSync(buildGradlePath, 'utf8');
+buildGradle = buildGradle
+  .replace(/versionCode\s+\d+/, `versionCode ${versionCode}`)
+  .replace(/versionName\s+"[^"]+"/, `versionName "${version}"`);
+writeFileSync(buildGradlePath, buildGradle, 'utf8');
+console.log(`  versionName "${version}", versionCode ${versionCode}`);
+
+// 9. Write android/local.properties with the current machine's Android SDK path
 const androidHome = process.env.ANDROID_HOME || process.env.ANDROID_SDK_ROOT;
 if (androidHome) {
   console.log('[apply-overlay] Writing android/local.properties...');