--- title: "Review: what is left in amethyst/ and desktopApp/, and what each platform can share with the other" type: refactor status: in-progress (§1, §2 and the §5 step-2 quick wins done) date: 2026-10-17 owner: commons consumers: amethyst, desktopApp, commonsUI, commons, nestsClient depends-on: commons/plans/2026-09-27-one-ui-android-desktop.md --- # What is left on each platform, and what it can share The one-UI plan ([2026-09-27-one-ui-android-desktop.md](2026-09-27-one-ui-android-desktop.md)) has moved 231 of 252 screens, the navigation shell and the app root to `commonsUI`. This review covers what is still platform-side: - `amethyst/src/{main,play,fdroid}`: 350 Kotlin files in `main`; - `desktopApp/src/jvmMain`: 85 files. For each file, the question was whether it can move to `commons`/`commonsUI` so the other platform gets the feature, and whether the other platform already has a copy that could be unified. **Method.** - The imports of every file were read, and every Android/Desktop slot implementation was compared against the `AppPlatform`, `NotePlatform` and `RichTextPlatform` defaults. - Every finding in "Bugs" was confirmed by reading the code. None was reproduced in a running app. - Licences quoted below come from Maven POMs, not from LICENSE files. Re-check them against the LICENSE file before adding a dependency, as AGENTS.md requires. Paths are relative to `amethyst/src/main/java/com/vitorpamplona/amethyst/` (Android), `desktopApp/src/jvmMain/kotlin/com/vitorpamplona/amethyst/desktop/` (Desktop) or the module root. ## 1. Desktop bugs found on the way **Fixed 2026-10-18.** 1. GIFs take `MediaHttp.imageClient`, the image role's client. 2. `LoadCityName` defaults to the known place name, or else the geohash. 3. The meeting slots are gone; `NoteCompose` calls the shared renderers. 4. Desktop's `DesktopQrScannerDialog` scans a picture from a file or the clipboard, with zxing core. 5. A shared `CalendarReminderScanner` (commons) runs from Android's worker and from a once-a-minute `DesktopCalendarReminders`. On Desktop, reminders also need OS notifications on, and pause during do-not-disturb. 6. Desktop runs `syncIfStale()` for the logged-in account on login and then every hour. 7. Payment cards, `blossom:` resolution (`BlossomUriRenderer` over `blossomServerFinder`) and the secret-emoji reveal (`SecretMessageContent`) are in the shared renderer. `BlossomFetcher` moved to `commonsUI/jvmAndroid`; Desktop builds a `BlossomServerResolver` and registers the fetcher. LaTeX stays Android's. 8. The Concord decryption moved to `commonsUI/jvmAndroid` (`rememberDecryptedConcordImageModel`); Desktop keeps the plaintext in `concord-images/` under its data directory. | # | Bug | Evidence | Fix | |---|---|---|---| | 1 | **Animated GIFs bypass Tor.** | `ui/media/AnimatedGifImage.kt:53` fetches through `DesktopHttpClient.currentClient()`. Nothing in the new app calls `DesktopHttpClient.setInstance`, so `currentClient()` returns `simpleClient`, a direct connection (`network/DesktopHttpClient.kt:184`). Notes (`app/DesktopNotePlatform.kt:215`) and the lightbox (`ui/media/ZoomableImage.kt:125`) both go through it. Coil itself is wired correctly (`app/AmethystDesktop.kt:160`). | Use `roleBasedHttpClientBuilder.okHttpClientForImage(url)`, as Coil does. Then delete `DesktopHttpClient` and drop the default argument in `DesktopImageLoaderSetup`. | | 2 | **Geohash place names are blank.** | The `NotePlatform.LoadCityName` default is `{}` (`commonsUI/…/ui/note/platform/NotePlatform.kt:182-186`), so neither `content` nor `onLoading` runs. Desktop does not override it. Affected: the geohash feed and chat headers, `FeedFilterSpinner`, relay-group metadata, active subscriptions and geohash bubbles. | Change the shared default to `content(geohashStr)`, or to the cached place name when one exists. | | 3 | **Meeting events (kinds 30312, 30313 and 10312) render blank.** | The renderers are already shared (`commonsUI/…/note/types/MeetingSpace.kt`). Android only forwards to them (`ui/note/platform/AndroidNotePlatform.kt:399-430`); the slot defaults are `{}` (`NotePlatform.kt:314-332`). | Call the shared renderers directly and delete the three slots. | | 4 | **QR scanning is a dead end.** | The `AppPlatform.QrCodeScannerDialog` default is `{}` (`AppPlatform.kt:207-210`), so `onDismiss` never fires. Six shared flows open it unguarded: show-QR, the NWC and Clink wallet setup, the NIP-46 signer, the geocache log and the Cordn migration. | Short term: dismiss at once, or hide the scan button when no scanner exists. Proper fix: §3, A2. | | 5 | **The calendar-reminder switch does nothing.** | The shared settings screen calls `AppServices.setCalendarRemindersScheduled`, whose default is a no-op (`commons/…/service/AppServices.kt:132`); Desktop does not override it. | §3, A4. | | 6 | **The web-of-trust index is never refreshed.** | `TrustNetworkState.syncDue()` has a single caller, Android's `service/wot/TrustNetworkSyncWorker.kt:61`. A long-running Desktop app keeps the first download. | §3, A5. | | 7 | **Payment and Blossom content shows as raw text.** | Desktop uses the base `DefaultRichTextSegmentRenderer`. Invoices, withdrawals, Cashu and Clink offers, and `blossom:` URIs render as text, and LaTeX and secret emoji stay unrendered. | §3, A1. | | 8 | **Encrypted Concord community images fall back to robohash.** | `rememberConcordImageModel` uses the plain URL by default; only Android decrypts. | §3, A6. | ## 2. Dead code in `desktopApp` (delete) **Done 2026-10-18.** - Deleted, with their tests: `AccountManager`, `LoginProgress`, `DesktopHttpClient`, the four theme files, `PlatformMaterialTheme`, `LocalWindowState` and `DesktopScheduleAtPickerTest`. - `MediaHttp` and `DesktopImageLoaderSetup` no longer fall back to a direct client: a fetch before `main` installs them fails instead of skipping Tor. - `BlossomClientTest`, `MediaCompressorTest`, `MediaMetadataReaderTest` and `UploadOrchestratorClientTest` (renamed: commons already has an `UploadOrchestratorTest`) moved to `commons/jvmTest`, and `NwcRpcIntegrationTest` to `quartz/jvmTest`. - The Compose UI tests and `DecodeImageWithSkiaTest` stay in `desktopApp`. They need Compose's UI test library or Skia, and only the desktop smoke job runs them under Xvfb. Reachability was checked with grep from `desktop/app/`: - `account/AccountManager.kt` (1,076 lines) and `account/LoginProgress.kt`. The only references are a KDoc mention in `DesktopAccountStorage.kt:87` and their own tests (9 `AccountManager*Test` files). - `network/DesktopHttpClient.kt` and its test, once bug 1 is fixed. - `platform/PlatformColorScheme.kt`, `PlatformShapes.kt`, `PlatformTypography.kt` and `ui/theme/AmethystSpacing.kt`. These are reached only from `PlatformMaterialTheme` in `platform/PlatformTheme.kt`, which nothing calls. Keep `applyNativeWindowChrome` and `titleBarInsetTop` from that file. - `jvmTest/…/ui/scheduling/DesktopScheduleAtPickerTest`. It tests a copy of picker math whose class no longer exists. - **Later:** `account/DesktopAccountStorage.kt`, `EncryptedKeyBackupTest` and the four `app/Legacy*Import.kt`, once the legacy-app migration window closes. These Desktop tests exercise `commons`/`commonsUI` code and belong in those modules' `jvmTest`: `service/upload/*`, `ui/BlockInteractionsUiTest`, `ui/chats/*`, `ui/search/*`, `ui/uploads/*`, `nwc/NwcRpcIntegrationTest`, `app/DecodeImageWithSkiaTest` and `app/InlineImageSizeTest`. ## 3. Moves Effort: XS is under an hour, S is a day, M is a few days, L is a project. ### A. Android code that would give Desktop a feature | # | What | Blockers today | Move | Effort | |---|---|---|---|---| | A1 | **Rich-text leaves.** The `Payment` and `SecretMessage` branches of `ui/components/AmethystRichText.kt`, plus the Blossom renderers and secret emoji in `RichTextPlatformLeaves.kt`. | The `Payment` and `SecretMessage` branches have none: they call shared composables (`MayBeInvoicePreview`, `CashuPreview`, …). The Blossom renderers use `Amethyst.instance.blossomResolver` (`:429-474`). | Fold them into `DefaultRichTextSegmentRenderer`, and read Blossom through `LocalAppServices.blossomServerFinder`, which Desktop must wire. LaTeX stays a slot. | S | | A2 | **QR from an image or the clipboard.** `QrScannerState`, `QrScannerOverlay`, `QrImageImport` and `ScanQrImageScreen`. | `QrScannerState` and `QrScannerOverlay` have none. `QrImageImport` uses `Bitmap` and zxing-cpp. `ScanQrImageScreen` uses `Intent`. | Move the state and the overlay as they are. Split the import behind a decoder interface: zxing core on the JVM, which `commonsUI/jvmAndroid` already links. Desktop's scanner slot opens the import path. The CameraX dialog stays native. | S–M | | A3 | **Notification gate.** The filter rules in `service/notifications/EventNotificationConsumer.kt:188-260` (own events, chat toggles, muted threads, `curatedHidesByTrust`) and `NotificationDispatcher.NOTIFICATION_KINDS`. | `MainActivity.isResumed`, a wakelock and the renderers. | A commons `(account, event) → decision + draft`, with "in foreground" injected. Desktop's `ui/notifications/DesktopNotificationAutoDispatcher.kt:125-200`, which has no mute, WoT or chat-toggle checks, then calls it. Merge the three kind taxonomies: `NotificationTopic`, `NotifKind` and `NotificationCategory`. | M | | A4 | **Calendar reminder scan.** The body of `service/calendar/CalendarReminderWorker.kt` (`acceptedRsvpsInCache`, `couldStillFire`). | WorkManager and the notifier only. | A commons `CalendarReminderScanner` with a notifier port. Desktop runs it on a timer through `DesktopNotifications`. This fixes bug 5. | S | | A5 | **Daily WoT sync.** The 4-line body of `service/wot/TrustNetworkSyncWorker.kt:52-61`. | None. | A commons `syncAllDue(accounts)`, plus a Desktop ticker. This fixes bug 6. | XS | | A6 | **`ui/screen/loggedIn/chats/publicChannels/concord/ConcordCommunityImage.kt`.** | `context.cacheDir` only. | Move to `commonsUI/jvmAndroid` with a cache-dir port. This fixes bug 8. | S | | A7 | **Image loading.** `service/images/BlossomFetcher.kt` (`blossom:` URIs, read-auth), `ProfilePictureFetcher.kt`, and the assembly in `ImageLoaderSetup.kt`. | `BlossomFetcher` has none (Coil, OkHttp, commons). `ProfilePictureFetcher` sits on `ThumbnailDiskCache`, which uses `Bitmap`. `ImageLoaderSetup` uses `Context` and `Build.VERSION`. | Move `BlossomFetcher` to `commonsUI/jvmAndroid` as it is. Add one shared `buildAmethystImageLoader(decoders, diskCache, callFactory, readAuth)` that replaces `service/images/DesktopImageLoaderSetup.kt`, including its duplicate `TorAwareOkHttpFactory`. Put the thumbnail cache behind an expect. | S | | A8 | **Blossom upload policy.** In `service/uploads/AndroidMediaUploader.kt`: `mirrorToOtherServers` (`:423`), `SharedUploadAuth` (`:292`) and `sanitizeForBuzzWorkspace` (`:273`). | Mixed into the Android uploader. | Lift them into the shared `UploadOrchestrator`. Fold `service/uploads/blossom/BlossomUploader.kt` (a second OkHttp BUD-02 client) into `commons/jvmAndroid/…/BlossomClient` as a streaming overload. Desktop gains BUD-04 mirroring and Buzz-workspace sanitising. | M | | A9 | **Upload header and audio stripping.** `FileHeader.prepare(url)` (`service/uploads/FileHeaderPreparation.kt:35`) and `stripMp3Metadata` (`MetadataStripper.kt:386`), which is pure byte logic. | `Context` temp-file plumbing; `Bitmap` for the blurhash. | Move both to `commons/jvmAndroid`, with a `PreviewHasher` expect (Android uses `Bitmap`, the JVM uses the existing `MediaMetadata.compute`). Desktop's `stripMetadata` (`app/DesktopMediaUploader.kt:600-611`) leaves audio tags in place today. | S | | A10 | **NIP-38 now playing.** `service/nowPlaying/InAppPlayback.kt` and `NowPlayingStatusCoordinator.kt`. | The registry map is keyed by media3 `Player`. | Key it by `Any`, move both to commons, and have Desktop's `service/media/GlobalMediaPlayer` feed it. | S | | A11 | **Napplet logic with no blocker, or one trivial blocker.** `NappletManifestLookup`, `gateways/AccountIdentityReader`, `connectedApps/consent/Nip46ConsentInfoBuilder`, `SignerConsentDetails`, `NappletLaunchRegistry`, the DataStore permission and storage stores. | None, or DataStore (already used in commons commonMain). | Move them as they are. Desktop then replaces `InMemoryNappletPermissionStore` (`app/DesktopAppModules.kt:371-372`) with persistent grants. | S | | A12 | **Napplet logic after a small cut.** `NostrSignerOpLabels` and `NappletConsentSummary` (an unused `Context` and `browserIcons`, which is on `AppServices`); `NappletLiveSubscriptions` and `NappletIncBus` (`Messenger` used only as an owner key); `gateways/NappletResourceFetcher` (one `android.util.Base64` call); the network and permission registries (`Amethyst.instance.appStores`); the consent dialogs inside the three consent Activities. The `nappletHost` blob cache, prefetcher and CSP response building are pure as well. | The cuts named in this row. | Move to commons/commonsUI. This is the groundwork for a Desktop napplet host (C6). | M | | A13 | **Tor state machine.** `ui/tor/TorManager.kt` (591 lines) and `TorBackend.kt` have no Android import; `ArtiGuardState` uses Jackson only; `TorConnectionFailureDialog` is Compose plus `Res`. `ui/tor/TorServiceStatus.kt` duplicates `commons/tor/TorServiceStatus.kt`, and `AndroidAppServices.kt:82-88` maps one onto the other. | None. | Move to commons/commonsUI and merge the two status classes. `tor/DesktopTorManager.kt` (kmp-tor, the C tor binary) becomes a ~100-line `TorBackend`. Desktop gains the stuck-connecting watchdog, the one-hour session bypass, the self-heal cooldown, network-change resets and the failure dialog. Android keeps `TorService` and `ArtiNative`. | M | | A14 | **Settings › Resource usage.** `ResourceUsageScreen` and `UsageTrendChart`. | Vico is already `api` in commonsUI. `Amethyst.instance.resourceUsage` (`:179`, `:215`), and one `ACTION_SEND` (`:700`) that `FileSharer` covers. | Move both, and expose the accountant (already in `commons/jvmAndroid`) on `AppServices`. Desktop also needs its meters wired. Plan step 9 says the screen stays; its Android ties are this thin. | S | | A15 | **`ConnectedAppDetailScreen`** (914 lines). | `Amethyst.instance` ledgers that Desktop's `AppServices` already provides, a `Toast`, and `NappletBrokerService.revokeSessionGrants`. | Split it. The shared connected-apps lists already navigate to `Route.ConnectedAppDetail`, which Desktop does not register. | S–M | | A16 | **Share note as image.** `ui/note/share/ShareNoteAsImageScreen.kt`. The capture already uses Compose's `rememberGraphicsLayer`. | `R.drawable.amethyst` (`:506`), `Bitmap.compress` + `FileProvider` (`:528-536`). | Move the logo to Compose resources and add an image-sharer port. Desktop saves a PNG or copies it to the clipboard. | M | | A17 | **Audio rooms.** `NestFullScreen`, `NestActionBar`, `ParticipantHostActionsSheet` and `NestActivityContent`. `NestViewModel` is already in `commons/jvmAndroid` and talks to `AudioCapture`, `AudioPlayer` and Opus interfaces. | `RECORD_AUDIO` and the Settings intent, `payViaIntent` (the shared `WalletAppLauncher` exists), one share intent. | Move the UI. Add JVM `AudioCapture`/`AudioPlayer`/Opus actuals in `nestsClient/jvmMain` (javax.sound, plus the JNA Opus already in jvmTest; licence check needed) and a Desktop `openNestRoom`, which is a no-op today. Plan step 9 keeps the room UI native; most of it does not need to be. | L | **Small leftovers.** These move with little or no change; the shared side gains their tests, and there is little to gain beyond that: - `service/playback/composable/RenderPlaybackError.kt` and `controls/SkipButton.kt` (no Android imports; Desktop's `ui/media/VideoControls.kt:86-95` re-declares `SKIP_SECONDS` and its own skip button); - `playerPool/positions/VideoViewedPositionCache.kt` (androidx `LruCache` instead of the Android one; it duplicates `savedPositions` in `GlobalMediaPlayer.kt:207`); - `service/cast/{CastMediaSummary,CastRoutePlan}`; - `service/resourceusage/MeteringNostrSigner`; - `model/accountsCache/MarmotStreamTransport.kt`, which `DesktopAppModules.kt:436-437` repeats inline: give `:marmotQuic` a default instead; - the host-agnostic browser chrome state in `ui/screen/loggedIn/embed/` (`ConsoleBridge`, `FindBridge`, `SelectionUiState`, `EmbeddedLoadStatus`, `EmbeddedAutoRecovery`, `EmbeddedTabChrome`, …). ### B. Desktop code that would give Android (and iOS) a feature | # | What | Move | Effort | |---|---|---|---| | B1 | **`ui/map/DesktopTileMap.kt`** (505 lines), `DesktopLocationPreviewMap` and `DesktopGeocacheMapTab`: pure Compose, Coil and `Res`. | Move them to `commonsUI/commonMain` as they are. Then rebuild Android's osmdroid screens on them: `LocationPickerMap`, `LocationPreviewMap`, `GeocacheMapTab` and the map part of `GeohashLocationPickerDialog` (788 lines; `GeoPoint`/`BoundingBox` and the forward geocoder go behind a port). Desktop gets the geohash picker and teleport screen, which are blank today. Android can drop osmdroid and iOS gets maps. | M | | B2 | **`service/images/SkiaDownsamplingDecoder.kt`, `SkiaGifDecoder.kt`.** They import only Coil and Skia. | Move to `commonsUI/skikoMain`, so iOS gets downsampled decoding and GIFs. | XS | | B3 | **`ui/media/NowPlayingBar.kt`.** Android has no persistent now-playing bar. | Move it with C2. | with C2 | | B4 | **Scheduled posts.** Desktop's `DesktopScheduledPostScheduler.drainOnce` uses the shared `ScheduledPostPublisher.drainDue`. Android's `service/scheduledposts/ScheduledPostWorker.kt:132-212` re-implements it (`publishAndConfirmDetailed` at `:173`) without the publisher's pubkey and signature checks. | Call `drainDue` from the worker and keep only the WorkManager scheduling. | XS | ### C. Copies on both platforms to unify | # | Android | Desktop | Unify as | Effort | |---|---|---|---|---| | C1 | `ui/tor/TorManager` (Arti) | `tor/DesktopTorManager` (kmp-tor) | A13 | M | | C2 | The `service/playback/composable/controls/*` chrome | `ui/media/VideoControls`, `NowPlayingBar` | The `PlaybackController` port the plan defers ("do it when Desktop gets a player"). Desktop has one now: `GlobalMediaPlayer` on composemediaplayer, MIT per its POM. | L | | C3 | `ui/components/ZoomableContentView` + `ZoomableContentDialog` (1,688 lines) | `ui/media/LightboxOverlay` + `ZoomableImage` (742 lines, hand-rolled gestures) | One shared image viewer on `net.engawapg` zoomable (already a commonsUI dependency). Video, save and share stay slots. | M | | C4 | `service/playback/composable/mainVideo/VideoPlayerActiveMutex` | `ui/media/VideoVisibilityMutex` | A shared "nearest to centre wins" election, with a per-platform bounds source. | S | | C5 | `service/images/ImageLoaderSetup` | `service/images/DesktopImageLoaderSetup` | A7 | S | | C6 | Napplet and nsite host (WebView in the `:napplet` process) | `DesktopAppLauncher` does nothing for `FavoriteApp.NostrApp` (`app/DesktopAppPlatform.kt:115-122`); napplet cards render nothing on Desktop | After A11 and A12: a JCEF/KCEF host behind an `EmbeddedWebSurface` port. Chromium renderers run out of process; `CefResourceRequestHandler` plays the content server; `CefMessageRouter` reaches an in-process `NappletBroker`. Per their POMs, kcef and jcefmaven are Apache-2.0 and jcef-api is BSD. The licences of the Chromium binaries bundled in CEF are unverified, and ffmpeg may be LGPL (a WARN). | L | | C7 | `app/AmethystLocalCacheHost.kt` | `app/DesktopLocalCacheHost.kt` | Nearly identical; they differ only in `usageCounter` and the NIP-95 directory. Not worth a seam on its own. | — | | C8 | `AppModules.kt` (1,677 lines) | `app/DesktopAppModules.kt` (682 lines) | Later: a commons builder for the shared graph (relay client, HTTP builders, connectors), so new services stop being wired twice. | M | **Slots that a shared implementation would make redundant:** - `NotePlatform`: the five Git slots, the three meeting slots (bug 3) and the three URL-preview slots; - `AppPlatform.AppBottomBar`. Both platforms pass the same shared composable through each of them, so call it directly. ## 4. What stays native (no action) **Android:** - media3 and PiP, CameraX, WebRTC calls (`stream-webrtc-android`), LightCompressor HLS and video compression, Health Connect, `TextToSpeech`; - notifications (`NotificationCompat`, channels, receivers, the tile, `ConversationShortcuts`), the foreground services, WorkManager scheduling, push and FCM/UnifiedPush; - Arti JNI, Android's Geocoder, `MediaRecorder` voice capture, MediaStore saving and `FileProvider` sharing; - the Messenger IPC between the main and `:napplet` processes, the consent and launcher Activities and the `SurfaceControlViewHost` tab layer; - the legacy `EncryptedSharedPreferences` migration, and the flavours (ML Kit, Chromecast, AppFunctions). **Desktop:** - the window, menu bar and `platform/*` (UI scale, Wayland, fonts and window chrome); - the keyring and the OS scheduler for scheduled posts; - the auto-updater, the spell-check engines (the text field side is already shared) and the composemediaplayer engine. **The call screens** (`CallScreen`, `ConnectedCallUI`, `PipCallUI`, ~1,000 lines) are Compose over the shared `CallManager`. They could move behind a video-renderer slot, but only pay off once a JVM WebRTC engine is chosen (licence gate first). ## 5. Suggested order 1. **Bugs 1–4 and the dead code** (§1, §2). One small PR each, and no new ports needed. 2. **Quick wins that close Desktop gaps.** All done 2026-10-18: - A5 (WoT sync), A1 (rich-text leaves), A4 (calendar reminders) and A6 (Concord images), with the §1 bugs; - B4 (scheduled-post publisher): Android's worker runs `ScheduledPostPublisher` per loaded account; the publisher no longer marks a post FAILED when its drain is cancelled; - A7/C5 (one image loader): `buildAmethystImageLoader` in `commonsUI/jvmAndroid`, used by both apps. Desktop still lacks the avatar thumbnail cache (`ProfilePictureFetcher` sits on Android's `Bitmap` cache); - B2 (Skia decoders to `skikoMain`). 3. **One version of a feature where there are two today:** - B1 (shared tile map, osmdroid retired); - A13/C1 (one Tor state machine); - A3 (one notification gate); - A8/A9 (one Blossom upload policy); - A2 (QR import); - C3/C4 (image viewer and video mutex). 4. **Larger features:** - A11/A12, then C6 (Desktop napplets); - C2/B3 (`PlaybackController`, the now-playing bar on both platforms); - A17 (audio rooms on Desktop); - A14–A16 (resource usage, connected-app detail, share as image). Each step follows the one-UI rules: check with `run-headless.sh` before calling a UI change done, and gate every new library on its licence.