ADFA-4128: qb-10 review fixes - alias attributes, skipped launchers, universal APK

Applies the fix-now items from the 2026-08-31 review triage (items 1, 5, 6,
7, 8, 9, 10, 11, 12; 2 retracted, 3 is PR-body-only, 4 deferred to its own
ticket).

- The synthesized activity-alias copies its target's android:permission and
  android:enabled beside android:exported, with the same raw copy-through
  (any of them can be a resource reference). Both are alias-DECLARED
  attributes, not inherited, so dropping them left an exported,
  permission-guarded activity reachable unguarded under its real name.
- A skipped activity is recorded as ProxiedComponent(proxyClass = null)
  instead of dropped, so a skipped LAUNCHER no longer misreports
  entryActivity == null - it keeps its real manifest name and is launchable
  as-is. The alias loop skips null-proxy entries; the skip path also
  normalises the element's android:name to the FQN like the other
  kept-under-real-name sites.
- The proxy-app report selects the built artifact with empty filters (the
  universal APK) instead of firstOrNull(); an all-splits output fails with a
  GradleException naming the enabled splits, since guessing a split fails
  later, on device.
- QuickBuildPayloadTransformTask filters both copy loops (and the
  retained-jar pass) on existence, matching the tolerance its own
  walkTopDown path already had.
- ClassOpener passes the reader to ClassWriter, making its copy-through KDoc
  true - in lockstep with qb-09's identical FinalStripper change.
- Three UNPROXIABLE_BY_NAME reasons rewritten to their real current effect
  (kept out of the component list / deploy policy); the rename they argued
  against no longer happens for services and receivers.
- Doc corrections: the jacoco block's comment no longer claims a coverage
  gate nothing enforces, and the dex min-API KDoc states the payload floor
  (d8 skips desugaring at 30) rather than a nonexistent device gate.

Tests verified RED first against the pre-fix code: the extended alias test,
both skipped-activity tests, the divert missing-input test, and both
universal-APK selection tests (the selection seam initially carried the old
first-element behavior). One pre-existing test pinning the old
drop-the-skipped-activity contract was updated. Full :gradle-plugin:test
green.

Triage item 13 (utils.kt indentation) is NOT here: the prescribed remedy,
spotlessApply, is a no-op on the file under this ktlint config.

Also: plain-language pass over the comments added by these fixes

Also: stop the build when a variant exposes no assets source set. A null variant.sources.assets used to skip wiring the payload dex and the baseline stamp, producing a proxy APK whose manifest names classes with no dex behind them; requireAssets fails the build with the variant name instead, matching requireRuntimeConfiguration, and a JVM test pins it (Akash's 08-31 MINOR on QuickBuildPlugin.kt:248, #1722).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01STCsdMzx9daNBcqMN424Ci

Author: fryanpan

gradle-plugin/build.gradle.kts

@@ -163,11 +163,13 @@ tasks.named<Jar>("jar") {
 	archiveVersion.set("")
 }
 
-// DoD coverage gate: >=90% line+branch. This JVM module keeps the default
-// build/jacoco/test.exec location; the report only needs xml enabled (for
-// tooling to read the percentages) and the explicit test dependency so
-// `:gradle-plugin:jacocoTestReport` is runnable on its own. Test failures do
-// not block it: the root build sets ignoreFailures on every Test task.
+// Coverage REPORTING only - no verification gate is wired here. This JVM
+// module keeps the default build/jacoco/test.exec location; the report just
+// needs xml enabled (for tooling to read the percentages) and the explicit
+// test dependency so `:gradle-plugin:jacocoTestReport` is runnable on its own.
+// The percentages under-count: the TestKit-driven tests exercise the plugin in
+// a separate Gradle JVM this JaCoCo run does not instrument. Test failures do
+// not block the report: the root build sets ignoreFailures on every Test task.
 tasks.named<JacocoReport>("jacocoTestReport") {
 	dependsOn(tasks.named("test"))
 	reports {

gradle-plugin/src/main/java/com/itsaky/androidide/gradle/QuickBuildPlugin.kt

@@ -6,6 +6,7 @@ import com.android.build.api.component.analytics.AnalyticsEnabledApplicationVari
 import com.android.build.api.variant.ApplicationAndroidComponentsExtension
 import com.android.build.api.variant.ApplicationVariant
 import com.android.build.api.variant.ScopedArtifacts
+import com.android.build.api.variant.SourceDirectories
 import com.android.build.api.variant.impl.ApplicationVariantImpl
 import com.itsaky.androidide.gradle.quickbuild.BaselineGenerationAsset
 import com.itsaky.androidide.gradle.quickbuild.QuickBuildBaselineGenerationTask
@@ -107,6 +108,24 @@ class QuickBuildPlugin : Plugin<Project> {
 						"here; this AGP version needs QuickBuildPlugin.runtimeConfigurationOrNull " +
 						"taught about its variant type. Use a Standard Run meanwhile.",
 				)
+
+		/**
+		 * The variant's assets source set, which carries the payload dex and the baseline
+		 * stamp into the proxy APK.
+		 *
+		 * AGP declares it nullable, but every application variant this plugin configures has
+		 * one. Should a future AGP ever return null, wiring nothing would build a proxy APK
+		 * whose manifest names classes with no dex behind them, so the build stops here.
+		 *
+		 * @throws GradleException when the variant exposes no assets source set.
+		 */
+		internal fun requireAssets(variant: ApplicationVariant): SourceDirectories.Layered =
+			variant.sources.assets
+				?: throw GradleException(
+					"Quick Build cannot add its payload dex to variant '${variant.name}': the " +
+						"variant exposes no assets source set. Without the dex the proxy app would " +
+						"crash at launch, so the build stops here. Use a Standard Run meanwhile.",
+				)
 	}
 
 	override fun apply(target: Project) {
@@ -244,8 +263,8 @@ class QuickBuildPlugin : Plugin<Project> {
 				task.minApiLevel.set(payloadMinApi)
 				task.proxyClasses.set(buildDirectory.dir("$variantDir/proxy-classes"))
 			}
-		variant.sources.assets
-			?.addGeneratedSourceDirectory(dex, QuickBuildPayloadDexTask::generatedAssets)
+		requireAssets(variant)
+			.addGeneratedSourceDirectory(dex, QuickBuildPayloadDexTask::generatedAssets)
 
 		val stamp =
 			project.tasks.register(
@@ -262,8 +281,8 @@ class QuickBuildPlugin : Plugin<Project> {
 				)
 				task.generatedAssets.set(buildDirectory.dir("$variantDir/baseline-generation-assets"))
 			}
-		variant.sources.assets
-			?.addGeneratedSourceDirectory(stamp, QuickBuildBaselineGenerationTask::generatedAssets)
+		requireAssets(variant)
+			.addGeneratedSourceDirectory(stamp, QuickBuildBaselineGenerationTask::generatedAssets)
 
 		val report =
 			project.tasks.register(

gradle-plugin/src/main/java/com/itsaky/androidide/gradle/quickbuild/ClassOpener.kt

@@ -33,7 +33,10 @@ object ClassOpener {
 	 */
 	fun stripFinalModifier(classBytes: ByteArray): ByteArray {
 		val reader = ClassReader(classBytes)
-		val writer = ClassWriter(0)
+		// The reader enables ASM's copy-through of the constant pool and untouched methods
+		// (roughly halving the rewrite); the access flags still change because the visitors
+		// below rewrite them explicitly. Mirrors the daemon's FinalStripper.
+		val writer = ClassWriter(reader, 0)
 		reader.accept(
 			object : ClassVisitor(Opcodes.ASM9, writer) {
 				override fun visit(

gradle-plugin/src/main/java/com/itsaky/androidide/gradle/quickbuild/ComponentProxiabilityResolver.kt

@@ -103,11 +103,14 @@ class ComponentProxiabilityResolver(
 				"androidx.startup.InitializationProvider" to
 					"resolves its own component by name at runtime; a renamed proxy breaks androidx App Startup",
 				"androidx.profileinstaller.ProfileInstallReceiver" to
-					"not on every proxy compile classpath, so the generated subclass would not compile",
+					"library plumbing whose class never travels in the payload; skipping keeps it out " +
+					"of the component list and the deploy policy's restart rule",
 				"com.itsaky.androidide.quickbuild.runtime.QuickBuildKeepAliveService" to
-					"CoGo binds this keep-alive by component name; a renamed proxy would leave the app freezer-eligible",
+					"the quick-build runtime's own keep-alive, not user code; skipping keeps it out " +
+					"of the component list and the deploy policy's restart rule",
 				"com.google.firebase.components.ComponentDiscoveryService" to
-					"Firebase reads this service's own metadata by component name; a renamed proxy makes it discover zero ComponentRegistrars",
+					"Firebase plumbing whose class never travels in the payload; skipping keeps it out " +
+					"of the component list and the deploy policy's restart rule",
 			)
 
 		/**

gradle-plugin/src/main/java/com/itsaky/androidide/gradle/quickbuild/QuickBuildManifestTransformer.kt

@@ -34,12 +34,14 @@ enum class ComponentType(
  * the user FQN in the manifest and the runtime's instantiate hooks route them through the payload
  * loader by that real name. For the Application nothing addresses it by manifest name anyway; for
  * services and receivers the real name IS the addressing - see
- * [QuickBuildManifestTransformer.transformComponents].
+ * [QuickBuildManifestTransformer.transformComponents]. An activity the proxiability resolver
+ * skipped also carries a null [proxyClass]: it keeps its real `<activity>` entry, so it stays
+ * launchable and its [isLauncher] fact must survive.
  *
  * @property type which manifest element this came from.
  * @property userClass fully-qualified user class.
  * @property proxyClass fully-qualified generated proxy class that replaces it in the
- *   manifest, or null for the Application, service and receiver entries.
+ *   manifest, or null for the Application, service, receiver and skipped-activity entries.
  * @property isLauncher whether an activity declares the MAIN/LAUNCHER intent filter.
  */
 data class ProxiedComponent(
@@ -66,19 +68,23 @@ data class UnproxiedComponent(
  *
  * @property document the transformed manifest, mutated in place from the parsed input.
  * @property components every recorded component, in manifest order per type - proxied or (for
- *   services, receivers and the Application) kept under its real name with a null proxyClass.
+ *   services, receivers, the Application and skipped activities) kept under its real name with
+ *   a null proxyClass.
  * @property unproxied components left under their real name, for the caller to log.
  */
 class ManifestTransformResult(
 	val document: Document,
 	val components: List<ProxiedComponent>,
 	val unproxied: List<UnproxiedComponent> = emptyList(),
 ) {
-	/** The proxied activities, in manifest order. */
+	/** The recorded activities, in manifest order; a skipped one carries a null proxyClass. */
 	val activities: List<ProxiedComponent>
 		get() = components.filter { it.type == ComponentType.ACTIVITY }
 
-	/** User class of the LAUNCHER activity, or null when the manifest declares none. */
+	/**
+	 * User class of the LAUNCHER activity, or null when the manifest declares none. A skipped
+	 * launcher still counts: it keeps its real manifest name, so it is launchable as-is.
+	 */
 	val entryActivity: String?
 		get() = activities.firstOrNull { it.isLauncher }?.userClass
 }
@@ -201,32 +207,51 @@ class QuickBuildManifestTransformer(
 	 * @param application the `<application>` element, mutated in place.
 	 * @param manifestPackage the manifest's package, for expanding android:name shorthand.
 	 * @param unproxied accumulator for components [skipProxy] rejects.
-	 * @return the proxied activities, in manifest order; skipped ones are absent.
+	 * @return the recorded activities, in manifest order; a skipped one appears with a null
+	 *   [ProxiedComponent.proxyClass] and consumes no proxy index.
 	 */
 	private fun transformActivities(
 		application: Element,
 		manifestPackage: String,
 		unproxied: MutableList<UnproxiedComponent>,
 	): List<ProxiedComponent> {
 		val activities = mutableListOf<ProxiedComponent>()
-		// android:exported per renamed activity, so the back-reference alias below can carry the
-		// target's own value. The raw attribute, not a parsed boolean: the value may be a
-		// resource reference (@bool/...), which parses as neither true nor false and must be
-		// copied through rather than collapsed. Kept local rather than added to
+		// The alias-declared attributes per renamed activity, so the back-reference alias below
+		// can carry the target's own values. The raw attributes, not parsed booleans: any of
+		// them may be a resource reference (@bool/...), which parses as neither true nor false
+		// and must be copied through rather than collapsed. Kept local rather than added to
 		// ProxiedComponent, which is shared with the setup.json writer.
-		val exportedByUserClass = mutableMapOf<String, String>()
+		val aliasAttrsByUserClass = mutableMapOf<String, Map<String, String>>()
 		var proxyIndex = 0
 		application.childElements("activity").forEachIndexed { index, activity ->
 			val userClass = requireComponentName(activity, "activity", index, manifestPackage)
 			rejectUnsupported(activity, "activity", userClass)
-			// An alias targeting a skipped activity (below) then finds no proxy mapping
+			// An alias targeting a skipped activity (below) then finds a null proxy mapping
 			// and correctly leaves its targetActivity pointed at the real class.
 			if (skipProxy(userClass, unproxied)) {
+				// Written back fully qualified, for the same reason as the non-proxied kinds
+				// in transformComponents: consumers resolve this name against the payload
+				// dex, so shorthand left verbatim is fragile.
+				activity.setAttributeNS(ANDROID_NS, "android:name", userClass)
+				// Recorded with a null proxyClass rather than dropped: the activity keeps its
+				// real manifest name and stays launchable, so dropping it would discard the
+				// isLauncher fact and misreport a skipped launcher as entryActivity == null.
+				activities.add(
+					ProxiedComponent(
+						type = ComponentType.ACTIVITY,
+						userClass = userClass,
+						proxyClass = null,
+						isLauncher = isLauncher(activity),
+					),
+				)
 				return@forEachIndexed
 			}
 			val proxyClass = "$proxyPackage.${proxySimpleName(proxyIndex, ComponentType.ACTIVITY)}"
 			proxyIndex++
-			exportedByUserClass[userClass] = activity.getAttributeNS(ANDROID_NS, "exported")
+			aliasAttrsByUserClass[userClass] =
+				listOf("exported", "permission", "enabled").associateWith {
+					activity.getAttributeNS(ANDROID_NS, it)
+				}
 			activity.setAttributeNS(ANDROID_NS, "android:name", proxyClass)
 			activities.add(
 				ProxiedComponent(
@@ -260,19 +285,33 @@ class QuickBuildManifestTransformer(
 		// activity was reachable under its real name before the rename, and a pinned shortcut or
 		// share target the app itself published records that name, so forcing false rejects a
 		// launch that works under a standard run. Never widen it - an absent attribute reads as
-		// false, which is also what a merged manifest states explicitly from API 31.
+		// false, which is also what a merged manifest states explicitly from API 31. The
+		// target's permission and enabled travel with it: both are alias-DECLARED attributes,
+		// not inherited, so dropping them would leave a permission-guarded activity reachable
+		// unguarded under its real name, or resurrect a disabled entry point.
 		val document = application.ownerDocument
 		activities.forEach { component ->
+			// A skipped activity kept its real <activity> entry, so it needs no alias - and one
+			// with the same name would collide with it at install time.
+			val proxyClass = component.proxyClass ?: return@forEach
+			val attrs = aliasAttrsByUserClass[component.userClass].orEmpty()
 			val alias = document.createElement("activity-alias")
 			alias.setAttributeNS(ANDROID_NS, "android:name", component.userClass)
-			alias.setAttributeNS(ANDROID_NS, "android:targetActivity", component.proxyClass!!)
+			alias.setAttributeNS(ANDROID_NS, "android:targetActivity", proxyClass)
 			alias.setAttributeNS(
 				ANDROID_NS,
 				"android:exported",
 				// An absent attribute is only implicitly false before API 31, where it is a hard
 				// manifest error, so the alias states it.
-				exportedByUserClass[component.userClass]?.takeIf { it.isNotBlank() } ?: "false",
+				attrs["exported"]?.takeIf { it.isNotBlank() } ?: "false",
 			)
+			// Unlike exported, these stay absent when the target declares neither: an empty
+			// android:permission is not "no permission".
+			listOf("permission", "enabled").forEach { name ->
+				attrs[name]?.takeIf { it.isNotBlank() }?.let {
+					alias.setAttributeNS(ANDROID_NS, "android:$name", it)
+				}
+			}
 			application.appendChild(alias)
 		}
 		return activities

gradle-plugin/src/main/java/com/itsaky/androidide/gradle/quickbuild/QuickBuildTasks.kt

@@ -1,5 +1,6 @@
 package com.itsaky.androidide.gradle.quickbuild
 
+import com.android.build.api.variant.BuiltArtifact
 import com.android.build.api.variant.BuiltArtifactsLoader
 import com.android.tools.r8.CompilationFailedException
 import com.android.tools.r8.CompilationMode
@@ -177,14 +178,19 @@ abstract class QuickBuildPayloadTransformTask : DefaultTask() {
 	@TaskAction
 	fun divert() {
 		val root = payloadClasses.get().asFile.cleanDirectory()
-		allJars.get().forEachIndexed { index, jar ->
+		// AGP hands over declared artifact locations, not guaranteed files. The retained-jar
+		// walk below already tolerates a missing directory, so the copies here skip missing
+		// inputs the same way instead of throwing on them.
+		val jars = allJars.get().filter { it.asFile.exists() }
+		val directories = allDirectories.get().filter { it.asFile.exists() }
+		jars.forEachIndexed { index, jar ->
 			jar.asFile.copyTo(File(root, "jars/$index.jar"))
 		}
-		allDirectories.get().forEachIndexed { index, dir ->
+		directories.forEachIndexed { index, dir ->
 			dir.asFile.copyRecursively(File(root, "dirs/$index"))
 		}
 
-		writeRetainedApkJar()
+		writeRetainedApkJar(jars, directories)
 	}
 
 	/**
@@ -199,15 +205,18 @@ abstract class QuickBuildPayloadTransformTask : DefaultTask() {
 		return name == "R.class" || (name.startsWith("R$") && name.endsWith(".class"))
 	}
 
-	/** Collects every R class from the inputs into [outputJar] so the APK keeps them. */
-	private fun writeRetainedApkJar() {
+	/** Collects every R class from the (existing) inputs into [outputJar] so the APK keeps them. */
+	private fun writeRetainedApkJar(
+		jars: List<RegularFile>,
+		directories: List<Directory>,
+	) {
 		val seen = HashSet<String>()
 		JarOutputStream(outputJar.get().asFile.outputStream()).use { out ->
 			// A zip must contain at least one entry even when no R classes exist.
 			out.putNextEntry(JarEntry("META-INF/com.itsaky.androidide.quickbuild.diverted"))
 			out.closeEntry()
 
-			allDirectories.get().forEach { dir ->
+			directories.forEach { dir ->
 				dir.asFile.walkTopDown().filter { it.isFile && isResourceClass(it.name) }.forEach { file ->
 					val entry = file.relativeTo(dir.asFile).invariantSeparatorsPath
 					if (seen.add(entry)) {
@@ -217,7 +226,7 @@ abstract class QuickBuildPayloadTransformTask : DefaultTask() {
 					}
 				}
 			}
-			allJars.get().forEach { jar ->
+			jars.forEach { jar ->
 				JarFile(jar.asFile).use { jf ->
 					jf.entries().asSequence().filter { !it.isDirectory && isResourceClass(it.name) }.forEach { entry ->
 						if (seen.add(entry.name)) {
@@ -273,7 +282,11 @@ abstract class QuickBuildPayloadDexTask : DefaultTask() {
 	@get:Classpath
 	abstract val runtimeAar: ConfigurableFileCollection
 
-	/** Effective dex min API; at least 30 because Quick Build is gated to API 30+ devices. */
+	/**
+	 * Effective dex min API - the payload floor, NOT the device floor: at least 30 so d8 skips
+	 * desugaring, while the emitted dex format still loads on the API 28+ devices Quick Build
+	 * supports. See QuickBuildPlugin.MIN_PAYLOAD_API.
+	 */
 	@get:Input
 	abstract val minApiLevel: Property<Int>
 
@@ -643,8 +656,8 @@ abstract class QuickBuildProxyAppReportTask : DefaultTask() {
 				.get()
 				.load(apkDirectory.get())
 				?.elements
-				?.firstOrNull()
-				?.outputFile
+				?.takeIf { it.isNotEmpty() }
+				?.let { selectUniversalApk(it, apkDirectory.get().asFile) }
 				?: apkDirectory
 					.get()
 					.asFile
@@ -734,6 +747,39 @@ abstract class QuickBuildProxyAppReportTask : DefaultTask() {
 	 * @return absolute paths of every `.flat` unit found, sorted; empty when neither source
 	 *   exists, which the caller logs rather than treating as an error.
 	 */
+	companion object {
+		/**
+		 * Picks the one APK every device can install out of AGP's built-artifact metadata.
+		 *
+		 * With APK splits enabled the metadata lists each split beside the universal APK in no
+		 * contractual order, so "the first element" is an arbitrary split that installs - or
+		 * fails to - depending on the device it meets. Only the unfiltered (universal) element
+		 * is safe to hand to CoGo.
+		 *
+		 * @param elements the loaded metadata's artifacts; must be non-empty.
+		 * @param apkDirectory the APK output directory, for the error message only.
+		 * @return the universal APK's path, as recorded in the metadata.
+		 * @throws GradleException when every element is a split: Quick Build does not support
+		 *   splits, and picking one here would only fail later, on the device.
+		 */
+		internal fun selectUniversalApk(
+			elements: Collection<BuiltArtifact>,
+			apkDirectory: File,
+		): String =
+			elements.firstOrNull { it.filters.isEmpty() }?.outputFile
+				?: throw GradleException(
+					"Quick Build: every APK under '$apkDirectory' is a split (" +
+						elements
+							.flatMap { it.filters }
+							.map { "${it.filterType}=${it.identifier}" }
+							.distinct()
+							.sorted()
+							.joinToString(", ") +
+						"); Quick Build does not support APK splits yet - disable splits for " +
+						"this variant or use a Standard Run",
+				)
+	}
+
 	private fun collectLibraryResourcePaths(): List<String> {
 		val mergedRes =
 			mergedResSearchDir.orNull