@agentprojectcontext/apx 1.80.2 → 1.89.1

package/src/host/daemon/whisper-server.py

@@ -54,20 +54,71 @@ def _load_model_if_needed(model_name, device, compute_type):
     return m
 
 
+def _silent_clip_path():
+    """A one-second 16 kHz mono WAV of near-silence, written to a temp file.
+
+    Deliberately not pure zeroes: a digitally silent clip can be short-circuited
+    before the model runs, which is the opposite of what a warmup wants.
+    """
+    import struct
+    import tempfile
+
+    rate, secs = 16000, 1
+    frames = rate * secs
+    # A whisper of dither — inaudible, but real samples the model must decode.
+    pcm = b"".join(struct.pack("<h", (i % 7) - 3) for i in range(frames))
+    data_size = len(pcm)
+    header = (
+        b"RIFF" + struct.pack("<I", 36 + data_size) + b"WAVEfmt "
+        + struct.pack("<IHHIIHH", 16, 1, 1, rate, rate * 2, 2, 16)
+        + b"data" + struct.pack("<I", data_size)
+    )
+    tmp = tempfile.NamedTemporaryFile(suffix=".wav", delete=False)
+    tmp.write(header + pcm)
+    tmp.close()
+    return tmp.name
+
+
 def _warmup_model():
-    """Eagerly load the active backend's model into RAM. Returns True if loaded."""
-    global _mlx_loaded
-    if _Handler.backend == "mlx":
-        import mlx_whisper  # noqa: F401  (raises ImportError if the stack is missing)
-        try:
-            from mlx_whisper.load_models import load_model
-            load_model(_Handler.model_name)
+    """Make the model ready to answer FAST, not merely resident.
+
+    Loading the weights is only half the cost. On MLX the first real
+    transcription also compiles the Metal graph, and that half is the expensive
+    one: measured on this machine, a freshly loaded model still spent ~10s on
+    its first utterance and 0.7s on every one after it. A warmup that stops at
+    load_model() therefore moves nothing — the user goes on paying the compile.
+
+    So we transcribe a throwaway clip. It costs the daemon a second at boot and
+    takes the stall out of the first thing anyone says.
+    """
+    global _mlx_loaded, _model
+    clip = None
+    try:
+        if _Handler.backend == "mlx":
+            import mlx_whisper  # noqa: F401  (raises ImportError if the stack is missing)
+            clip = _silent_clip_path()
+            mlx_whisper.transcribe(clip, path_or_hf_repo=_Handler.model_name)
             _mlx_loaded = True
-        except Exception:
-            pass  # first transcribe will load it lazily
-        return _mlx_loaded
-    _load_model_if_needed(_Handler.model_name, _Handler.device, _Handler.compute_type)
-    return _model is not None
+            return True
+        _load_model_if_needed(_Handler.model_name, _Handler.device, _Handler.compute_type)
+        clip = _silent_clip_path()
+        # Consume the generator — faster-whisper decodes lazily.
+        segments, _info = _model.transcribe(clip, beam_size=1)
+        for _ in segments:
+            pass
+        return True
+    except ImportError:
+        raise
+    except Exception as e:
+        # A warmup that fails is a slow first request, not a broken server.
+        print(f"[whisper-server] warmup failed: {e}", file=sys.stderr, flush=True)
+        return _mlx_loaded if _Handler.backend == "mlx" else (_model is not None)
+    finally:
+        if clip:
+            try:
+                os.unlink(clip)
+            except Exception:
+                pass
 
 
 def _transcribe_file(audio_path, language, beam_size):
@@ -141,7 +192,13 @@ class _Handler(BaseHTTPRequestHandler):
 
     def do_GET(self):
         if self.path == "/health":
-            _touch()
+            # Deliberately does NOT _touch(). A health check is someone asking
+            # whether we are alive, not someone using us — and because the
+            # desktop window polls /health, counting it as use kept the idle
+            # watchdog permanently reset. The server then lived for days
+            # holding a port while its weights were long since paged out: it
+            # neither died nor stayed warm. Real use (/transcribe, /warmup)
+            # is what resets the timer now.
             loaded = _mlx_loaded if _Handler.backend == "mlx" else (_model is not None)
             self._send_json(200, {
                 "ok": True,

package/src/host/daemon/ws-auth.js

@@ -0,0 +1,28 @@
+// Who may open a WebSocket on this daemon.
+//
+// Every WS channel here is gated the same way and for the same reason: the
+// daemon binds 0.0.0.0 when the panel is reachable from the LAN or a tailnet,
+// so "can reach the port" is not "may open a channel". The upgrade request must
+// carry a token the store already knows — the master token or a paired client's
+// — exactly like the HTTP routes do. See QA BUG-WS-AUTH.
+//
+// One home for the check (rule 8): it started inside desktop-ws.js, which was
+// fine while the desktop was the only channel. It now guards the terminal and
+// the live event feed too, and a per-channel copy is how one of them ends up
+// with a weaker rule than the others.
+
+/** Extract the bearer token from an upgrade request (header first, ?token= fallback).
+ *  Browsers cannot set headers on a WebSocket handshake, hence the query fallback. */
+export function extractWsToken(req) {
+  const auth = (req && req.headers && req.headers["authorization"]) || "";
+  if (auth.startsWith("Bearer ")) return auth.slice(7);
+  try {
+    return new URL((req && req.url) || "", "http://localhost").searchParams.get("token") || "";
+  } catch { return ""; }
+}
+
+/** True iff the upgrade request carries a token the store recognizes. */
+export function isWsUpgradeAuthorized(req, tokenStore) {
+  if (!tokenStore || typeof tokenStore.has !== "function") return false;
+  return tokenStore.has(extractWsToken(req));
+}

package/src/interfaces/android/app/build.gradle

@@ -0,0 +1,42 @@
+plugins {
+    id "com.android.application"
+}
+
+android {
+    namespace "dev.agentprojectcontext.apx"
+    compileSdk 35
+
+    defaultConfig {
+        applicationId "dev.agentprojectcontext.apx"
+        minSdk 26
+        targetSdk 35
+        versionCode 1
+        versionName "0.1.0"
+
+        testInstrumentationRunner "android.test.InstrumentationTestRunner"
+    }
+
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro"
+        }
+    }
+
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
+    }
+}
+
+dependencies {
+    implementation "androidx.core:core:1.16.0"
+    implementation "com.squareup.okhttp3:okhttp:4.12.0"
+    // The Android Auto chip. A MessagingStyle notification only ever gets two
+    // controls on a head unit (reply, mark-read), so four answers need the
+    // template library — see ApxCarAppService.
+    implementation "androidx.car.app:app:1.4.0"
+    implementation "androidx.car.app:app-projected:1.4.0"
+    testImplementation "junit:junit:4.13.2"
+    testImplementation "org.json:json:20240303"
+}

package/src/interfaces/android/app/proguard-rules.pro

@@ -0,0 +1,4 @@
+# Keep methods exposed to the trusted /mobile WebView if shrinking is enabled.
+-keepclassmembers class * {
+    @android.webkit.JavascriptInterface <methods>;
+}

package/src/interfaces/android/app/src/main/AndroidManifest.xml

@@ -0,0 +1,139 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-permission android:name="android.permission.INTERNET" />
+    <!-- Not for dialling out: the socket's reconnect ladder asks whether there
+         is any network at all before it retries, and wakes on the callback
+         instead of on a timer. A phone away from the daemon used to retry
+         every 15 s all day. -->
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <!-- So the notification socket survives a reboot. Without it APX is silent
+         from the moment the phone restarts until someone opens the app, and
+         nothing about that looks broken from the outside. -->
+    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
+    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
+    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.ACCESS_NOTIFICATION_POLICY" />
+    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+    <!-- A foreground service typed `location` is what lets APX keep reading
+         the position while the phone is in a pocket or a dock, WITHOUT asking
+         for ACCESS_BACKGROUND_LOCATION: the ongoing notification is the
+         permission model. Tracking runs only while a trip is active. -->
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_LOCATION" />
+    <!-- Asked for from the native menu and nowhere else: on this phone Android
+         holds back the trip's start and end events until the owner exempts APX
+         by hand, and that is a system decision, not one an app may make for
+         them. -->
+    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
+
+    <application
+        android:allowBackup="false"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/AppTheme"
+        android:usesCleartextTraffic="true">
+
+        <meta-data
+            android:name="com.google.android.gms.car.application"
+            android:resource="@xml/automotive_app_desc" />
+
+        <!-- The lowest car API this app needs. 1 is the floor and everything
+             used here (ListTemplate, Row, CarToast) is in it — asking for more
+             would hide the chip on older head units for no gained feature. -->
+        <meta-data
+            android:name="androidx.car.app.minCarApiLevel"
+            android:value="1" />
+
+        <!-- The chip itself. exported=true because the HOST starts it: Android
+             Auto binds this service to draw the screen. HostValidator inside is
+             what decides which hosts are allowed to. -->
+        <service
+            android:name=".ApxCarAppService"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="androidx.car.app.CarAppService" />
+                <!-- POI: APX points at places you have an errand for. It is not
+                     a navigation app (Maps does the driving) and not a media
+                     one, and claiming either category would put it in the wrong
+                     part of the launcher. -->
+                <category android:name="androidx.car.app.category.POI" />
+            </intent-filter>
+        </service>
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:launchMode="singleTask">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="apx" android:host="pair" />
+            </intent-filter>
+            <intent-filter android:label="Compartir viaje con APX">
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="text/plain" />
+            </intent-filter>
+        </activity>
+
+        <service
+            android:name=".MascotOverlayService"
+            android:exported="false"
+            android:foregroundServiceType="specialUse">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="User-enabled floating APX mascot and live message indicator" />
+        </service>
+
+        <service
+            android:name=".TripLocationService"
+            android:exported="false"
+            android:foregroundServiceType="location" />
+
+        <service
+            android:name=".MapsNavigationListenerService"
+            android:exported="false"
+            android:label="Detección de viajes APX"
+            android:permission="android.permission.BIND_NOTIFICATION_LISTENER_SERVICE">
+            <intent-filter>
+                <action android:name="android.service.notification.NotificationListenerService" />
+            </intent-filter>
+        </service>
+
+        <receiver
+            android:name=".CarMessageActionReceiver"
+            android:exported="false" />
+
+        <!-- The four proximity answers. Not exported: only our own
+             PendingIntents fire it, and an exported receiver would let any app
+             answer an alert on the owner's behalf. -->
+        <receiver
+            android:name=".ProximityActionReceiver"
+            android:exported="false" />
+
+        <!-- exported=true because both of these are SYSTEM broadcasts: the
+             sender is Android, not APX, and a non-exported receiver is never
+             handed them. MY_PACKAGE_REPLACED is the app's own update, which
+             force-stops it and leaves the service down. -->
+        <receiver
+            android:name=".StartupReceiver"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.BOOT_COMPLETED" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.MY_PACKAGE_REPLACED" />
+            </intent-filter>
+        </receiver>
+    </application>
+</manifest>

package/src/interfaces/android/app/src/main/java/dev/agentprojectcontext/apx/AlertScreen.java

@@ -0,0 +1,139 @@
+package dev.agentprojectcontext.apx;
+
+import android.content.Intent;
+import android.net.Uri;
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+import androidx.car.app.CarContext;
+import androidx.car.app.CarToast;
+import androidx.car.app.Screen;
+import androidx.car.app.model.Action;
+import androidx.car.app.model.ItemList;
+import androidx.car.app.model.ListTemplate;
+import androidx.car.app.model.Row;
+import androidx.car.app.model.Template;
+
+/**
+ * One proximity alert on the head unit, with its four answers.
+ *
+ * A LIST, NOT A MESSAGE TEMPLATE. `MessageTemplate` takes two actions; there
+ * are four here, and dropping two of them would mean the car offering a
+ * different question than the phone. Rows are the only shape on this platform
+ * that holds four choices, and they are also the biggest touch targets it
+ * draws — which is what you want from a control used at speed.
+ *
+ * The text is read aloud by Assistant, which is why the daemon strips emoji
+ * before it ever reaches here (core/mobility/geofence.js) and why nothing in
+ * this file decorates it.
+ */
+final class AlertScreen extends Screen {
+    private static final String TAG = "APXTravel";
+
+    private final String alertId;
+
+    AlertScreen(@NonNull CarContext carContext, @NonNull String alertId) {
+        super(carContext);
+        this.alertId = alertId;
+    }
+
+    @Override
+    @NonNull
+    public Template onGetTemplate() {
+        MessageFrameParser.MobilityAlert alert = CarAlertStore.get(alertId);
+        if (alert == null) {
+            // Answered elsewhere — on the phone, or on Telegram — while this
+            // screen was open. Say so and go back rather than offering answers
+            // to a question that is already settled.
+            return new ListTemplate.Builder()
+                .setSingleList(new ItemList.Builder()
+                    .addItem(new Row.Builder()
+                        .setTitle(getCarContext().getString(R.string.car_alert_gone))
+                        .build())
+                    .build())
+                .setTitle(getCarContext().getString(R.string.car_trip_title))
+                .setHeaderAction(Action.BACK)
+                .build();
+        }
+
+        ItemList.Builder items = new ItemList.Builder();
+        // The alert itself, as the first row: on a head unit the title bar is
+        // one line, and the address does not fit in it.
+        items.addItem(new Row.Builder()
+            .setTitle(alert.title())
+            .addText(alert.body())
+            .build());
+
+        // The daemon owns the four and their wording. Android renders what it
+        // was sent — a fifth answer would need no new APK.
+        for (MessageFrameParser.Action action : alert.actions()) {
+            items.addItem(new Row.Builder()
+                .setTitle(action.label())
+                .setBrowsable(false)
+                .setOnClickListener(() -> answer(alert, action.id()))
+                .build());
+        }
+
+        return new ListTemplate.Builder()
+            .setSingleList(items.build())
+            .setTitle(alert.title())
+            .setHeaderAction(Action.BACK)
+            .build();
+    }
+
+    /**
+     * Answer, then navigate — the same order the phone's receiver uses, for the
+     * same reason: handing the screen to Maps is where an answer gets lost.
+     */
+    private void answer(MessageFrameParser.MobilityAlert alert, String actionId) {
+        ApxPreferences preferences = new ApxPreferences(getCarContext());
+        DaemonClient.answerAlert(
+            preferences.daemonUrl(),
+            preferences.token(),
+            alert.id(),
+            actionId,
+            new DaemonClient.AnswerCallback() {
+                @Override public void onAnswered() {
+                    Log.i(TAG, "car answer " + actionId + " recorded for " + alert.id());
+                }
+                @Override public void onAnswerFailed(String message) {
+                    Log.w(TAG, "car answer " + actionId + " failed: " + message);
+                }
+            }
+        );
+
+        // Locally too: the head unit must not keep offering an answered alert
+        // while the daemon's reply is still in flight over a mobile link.
+        CarAlertStore.remove(alert.id());
+        ProximityNotification.cancel(getCarContext(), ProximityNotification.notificationId(alert.id()));
+
+        String url = switch (actionId) {
+            case "navigate" -> alert.navigateUrl();
+            case "add_stop" -> alert.addStopUrl();
+            default -> null;
+        };
+        if (url != null && !url.isBlank()) {
+            try {
+                // The car host owns which navigation app runs; handing it a
+                // plain geo/Maps intent is how an app asks for a route without
+                // taking over the screen itself.
+                getCarContext().startCarApp(new Intent(CarContext.ACTION_NAVIGATE, Uri.parse(url)));
+            } catch (Exception error) {
+                Log.w(TAG, "car navigate refused: " + error.getMessage());
+                CarToast.makeText(getCarContext(),
+                    getCarContext().getString(R.string.car_navigate_failed),
+                    CarToast.LENGTH_SHORT).show();
+            }
+        } else {
+            CarToast.makeText(getCarContext(), okText(actionId), CarToast.LENGTH_SHORT).show();
+        }
+
+        getScreenManager().pop();
+    }
+
+    private String okText(String actionId) {
+        return "skip".equals(actionId)
+            ? getCarContext().getString(R.string.car_ack_dismissed)
+            : getCarContext().getString(R.string.car_ack_later);
+    }
+}

package/src/interfaces/android/app/src/main/java/dev/agentprojectcontext/apx/AndroidAutoDetector.java

@@ -0,0 +1,106 @@
+package dev.agentprojectcontext.apx;
+
+import java.text.Normalizer;
+import java.util.Locale;
+
+/**
+ * Recognises "the phone is projecting to Android Auto right now" from the
+ * notification Android Auto itself posts while a session is live.
+ *
+ * Why the notification and not the Car App Library: CarConnection would mean
+ * pulling androidx.car.app in for one boolean, and its content provider is
+ * only queryable by apps the Auto host already knows about. APX is not a car
+ * app — it is a phone app that wants to know the owner is driving — and it
+ * ALREADY holds notification-listener access for the Google Maps trip
+ * detector next door. One permission, two signals.
+ *
+ * The distinction that matters and is easy to get wrong: Android Auto posts
+ * notifications when it is NOT running too ("tap to set up", "Android Auto is
+ * available", update prompts). Those are invitations, not sessions. Treating
+ * one as a connection would put APX in a trip while the phone sits on a desk,
+ * so a match needs an ongoing notification whose text reads like a running
+ * session rather than an offer to start one.
+ */
+final class AndroidAutoDetector {
+    static final String AUTO_PACKAGE = "com.google.android.projection.gearhead";
+
+    // A live session says it is running / connected / driving.
+    private static final String[] RUNNING_TERMS = {
+        "en ejecucion", "ejecutando", "esta corriendo", "conectado", "conectada",
+        "modo conduccion", "modo de conduccion", "en el auto", "en el coche",
+        "is running", "running", "connected", "driving mode", "in car", "car mode",
+    };
+
+    // An invitation says: do something to make a session happen.
+    private static final String[] OFFER_TERMS = {
+        "toca para", "tocar para", "presiona", "configur", "instal", "actualiz",
+        "disponible", "prueba", "conecta tu", "conecta el",
+        "tap to", "set up", "setup", "install", "update", "available", "try ",
+        "connect your",
+    };
+
+    // Developer mode posts its own persistent notification while the head unit
+    // SERVER is listening — "Programador de Android Auto · Servidor de unidad
+    // principal en ejecución". A server waiting for a head unit is not a car,
+    // and on a phone with developer mode left on it would otherwise hold APX
+    // in a permanent trip. Found on a real device while testing against the
+    // Desktop Head Unit, which is exactly when that notification exists.
+    private static final String[] DEVELOPER_TERMS = {
+        "programador", "developer", "servidor de unidad principal", "head unit server",
+    };
+
+    private AndroidAutoDetector() {}
+
+    /** Every notification this app must inspect for a projection session. */
+    static boolean isAutoPackage(String packageName) {
+        return AUTO_PACKAGE.equals(packageName);
+    }
+
+    /**
+     * True when this notification is Android Auto reporting a LIVE projection
+     * session. An offer to set Auto up is never a session, no matter how it is
+     * worded, so the offer check wins over the running check.
+     *
+     * `persistent` must be computed from BOTH FLAG_ONGOING_EVENT and
+     * FLAG_FOREGROUND_SERVICE. A real session on a Galaxy A55 posts
+     * "Android Auto · Conectado al vehículo" with flags NO_CLEAR |
+     * FOREGROUND_SERVICE and no ONGOING_EVENT at all: gating on the ongoing
+     * flag alone silently detected nothing, on the one signal this feature
+     * exists for. A foreground-service notification is the stronger claim of
+     * the two anyway — a service is actually running behind it.
+     */
+    static boolean isProjectionActive(
+        String packageName,
+        boolean persistent,
+        CharSequence title,
+        CharSequence text
+    ) {
+        if (!isAutoPackage(packageName)) return false;
+        // A session notification cannot be swiped away while the car screen is
+        // up. An announcement can.
+        if (!persistent) return false;
+
+        String content = normalize(String.valueOf(title) + " " + String.valueOf(text));
+        if (containsAny(content, DEVELOPER_TERMS)) return false;
+        if (containsAny(content, OFFER_TERMS)) return false;
+        if (containsAny(content, RUNNING_TERMS)) return true;
+        // Android Auto localises this notification into languages this list
+        // does not cover, and an ongoing notification from the projection app
+        // that is not an offer is a session in every one of them. Falling back
+        // to "yes" here is deliberate: the alternative is a driver whose phone
+        // never notices the car it is plugged into.
+        return true;
+    }
+
+    private static boolean containsAny(String value, String... needles) {
+        for (String needle : needles) {
+            if (value.contains(needle)) return true;
+        }
+        return false;
+    }
+
+    private static String normalize(String value) {
+        String lower = value.toLowerCase(Locale.ROOT);
+        return Normalizer.normalize(lower, Normalizer.Form.NFD).replaceAll("\\p{M}+", "");
+    }
+}

package/src/interfaces/android/app/src/main/java/dev/agentprojectcontext/apx/ApxCarAppService.java

@@ -0,0 +1,57 @@
+package dev.agentprojectcontext.apx;
+
+import androidx.annotation.NonNull;
+import androidx.car.app.CarAppService;
+import androidx.car.app.Session;
+import androidx.car.app.Screen;
+import androidx.car.app.validation.HostValidator;
+
+/**
+ * APX on the head unit — the chip in Android Auto's launcher, beside Maps and
+ * whatever is playing music.
+ *
+ * WHY A CAR APP AND NOT A NOTIFICATION. Android Auto renders a MessagingStyle
+ * notification with exactly two controls: reply and mark-as-read. That is the
+ * shape of a chat, and a proximity alert is not one — it is four answers, and
+ * the two of them that matter most ("Navegar ahora", "Sumar a la ruta") are
+ * navigation actions a messaging card has no way to offer. The template
+ * library is the only surface on this platform that draws four.
+ *
+ * It shows the trip: where the car is going, and the errands APX is watching
+ * for along the way. When something comes into range the alert goes to the top
+ * of that same list, so the driver's glance lands in one place instead of
+ * hunting a banner that has already gone.
+ *
+ * NOTHING HERE PAINTS ANYTHING ITSELF. Templates are described and the host
+ * draws them, which is what keeps the app legal to use while driving — the
+ * platform enforces the reading limits, not us.
+ */
+public final class ApxCarAppService extends CarAppService {
+
+    @Override
+    @NonNull
+    public HostValidator createHostValidator() {
+        // Debug builds talk to the Desktop Head Unit, which is not a signed
+        // Google host — pinning the production allowlist here would make the
+        // whole feature untestable without a car. Release builds keep the
+        // real check: an unvalidated host can drive the screen.
+        if ((getApplicationInfo().flags & android.content.pm.ApplicationInfo.FLAG_DEBUGGABLE) != 0) {
+            return HostValidator.ALLOW_ALL_HOSTS_VALIDATOR;
+        }
+        return new HostValidator.Builder(getApplicationContext())
+            .addAllowedHosts(androidx.car.app.R.array.hosts_allowlist_sample)
+            .build();
+    }
+
+    @Override
+    @NonNull
+    public Session onCreateSession() {
+        return new Session() {
+            @Override
+            @NonNull
+            public Screen onCreateScreen(@NonNull android.content.Intent intent) {
+                return new TripScreen(getCarContext());
+            }
+        };
+    }
+}