react-native-facefusion 0.1.0

package/android/src/main/java/com/facefusion/ContentGate.kt

@@ -0,0 +1,86 @@
+package com.facefusion
+
+import com.facefusion.mobile.NativePipe
+
+/**
+ * Upstream's NSFW content gate (ADR-0003), run on the public API path where a JS caller
+ * cannot skip it -- no `skipCheck` option exists anywhere above [PhotoSwap]/[VideoSwap].
+ *
+ * **This is the one file a personal, gate-free build deletes.** `android/build.gradle`
+ * generates a no-op stand-in with this class's public surface when the file is absent, so
+ * deleting it is the only change needed -- [PhotoSwap]/[VideoSwap] call [ContentGate]
+ * exactly the same way either build compiles it. That build renames itself `-dev` with a
+ * distinct `applicationId` (see `example/android/app/build.gradle`), upstream's own switch,
+ * not a bypass flag.
+ *
+ * Gates on `nsfw_2` alone, not upstream's 2-of-3 vote across three models -- 461 MB was not
+ * worth it against a 266 MB app (`docs/roadmap.md` 2) -- and the quantised build every tier
+ * but v79 uses sits ~0.087 mean closer to flagging. Both limits belong in the README, not
+ * hidden, per ADR-0003.
+ */
+object ContentGate {
+
+  /** Refused. [isQuantised] lets a caller mention the known quantisation bias in its own
+   *  message without this class importing any UI concern. */
+  class Refused(message: String, val isQuantised: Boolean) : Exception(message)
+
+  // content_analyser.py:detect_with_nsfw_2 -- logit[0] - logit[1] > 0.25 flags a frame.
+  private const val THRESHOLD = 0.25f
+
+  // Refuse a video only on the AGGREGATE rate across its sampled frames, not on the first
+  // flagged one -- a single false positive should not sink an otherwise-clean clip.
+  private const val VIDEO_FLAG_RATE = 0.10
+
+  /**
+   * One frame -- a still photo. Call with the TARGET frame, the content actually being
+   * processed, before [NativePipe.processFrame] runs: refusing up front skips the swap
+   * entirely instead of doing the work and then discarding it.
+   */
+  fun checkFrame(bgr: ByteArray, w: Int, h: Int) {
+    val quantised = NativePipe.contentGateIsQuantised()
+    val score = NativePipe.contentScore(bgr, w, h)
+    // A failure to measure is treated as an error, never as "allow" (docs/02-upstream.md).
+    if (score.isNaN()) {
+      throw Refused("Content check failed: ${NativePipe.lastError()}", quantised)
+    }
+    if (score > THRESHOLD) {
+      throw Refused("Content check flagged this image (score %.2f)".format(score), quantised)
+    }
+  }
+
+  /**
+   * Accumulates one sampled frame per second of a video target. [VideoSwap] already decodes
+   * every frame for the swap itself and buffers every encoded frame until the whole clip is
+   * done before muxing -- so [sample] rides that same loop for free, and [finish] applies the
+   * rate rule before the muxer (and thus [outputPath]) is ever touched, exactly like refusing
+   * a still up front.
+   */
+  class VideoSampler {
+    private var sampled = 0
+    private var flagged = 0
+    private var quantised = false
+
+    fun sample(bgr: ByteArray, w: Int, h: Int) {
+      quantised = NativePipe.contentGateIsQuantised()
+      val score = NativePipe.contentScore(bgr, w, h)
+      if (score.isNaN()) {
+        throw Refused("Content check failed: ${NativePipe.lastError()}", quantised)
+      }
+      sampled++
+      if (score > THRESHOLD) flagged++
+    }
+
+    /** Call once, after every frame has been offered to [sample]. A clip too short to have
+     *  sampled anything is not refused -- there is nothing measured to refuse it on. */
+    fun finish() {
+      if (sampled == 0) return
+      val rate = flagged.toDouble() / sampled
+      if (rate > VIDEO_FLAG_RATE) {
+        throw Refused(
+          "Content check flagged ${(rate * 100).toInt()}% of sampled frames (limit 10%)",
+          quantised,
+        )
+      }
+    }
+  }
+}

package/android/src/main/java/com/facefusion/DeviceProbe.kt

@@ -0,0 +1,158 @@
+package com.facefusion
+
+import android.content.Context
+import com.facefusion.mobile.NativePipe
+
+/**
+ * What this phone's Hexagon NPU says about itself.
+ *
+ * [ok] is the only field that decides whether the rest mean anything. `false` means the
+ * probe failed — no QNN runtime, no Hexagon DSP, an emulator — and **not** that the chip
+ * is old or unsupported. [tier] and [tierChain] are still filled in either way, because
+ * the native layer's fallback (`v68`, the floor that runs on every HTP) is a usable
+ * answer even when nothing could be measured.
+ */
+data class DeviceProbe(
+  val ok: Boolean,
+  val tier: String,
+  val tierChain: List<String>,
+  val arch: Int,
+  val vtcmMb: Int,
+  val socModel: Int,
+  val signedPd: Boolean,
+  val dlbc: Boolean,
+  val error: String,
+) {
+  companion object {
+    /** The tier every unmeasured device falls back to; mirrors `tierChain()` in ffqnn.cpp. */
+    private const val FALLBACK_TIER = "v68"
+
+    /**
+     * Cached because the chain is a property of the *silicon* and cannot change while the
+     * process lives, and because measuring it brings the QNN backend up — far too expensive
+     * to repeat every time a screen wants to know which models to download.
+     *
+     * Only a real answer is cached. A probe that failed must not be remembered as "this chip
+     * can load nothing" for the rest of the process, and the fallback is not a measurement.
+     *
+     * The chain is cached; the tier [ModelPaths.tier] resolves against disk deliberately is
+     * not. What a device *can* load is fixed; what is *on disk* changes the moment a
+     * download finishes.
+     */
+    @Volatile
+    private var chainCache: List<String>? = null
+
+    /**
+     * Every tier this chip can load, best first — `["v81", "v73", "v68"]`.
+     *
+     * **Not** "this tier and every older one": the native `tierChain()` skips arches the
+     * chip cannot run, so it must never be reconstructed from a single tier.
+     *
+     * Falls back to a one-entry `v68` chain when nothing could be measured, which is a
+     * usable answer rather than an error — see the class docs.
+     */
+    fun tierChain(context: Context): List<String> {
+      chainCache?.let { return it }
+      if (NativePipe.loadError != null) return listOf(FALLBACK_TIER)
+
+      val libDir = context.applicationInfo.nativeLibraryDir
+      val chain = NativePipe.probeTierChain(libDir, libDir)
+        .split(',')
+        .map { it.trim() }
+        .filter { it.isNotEmpty() }
+
+      if (chain.isEmpty()) return listOf(FALLBACK_TIER)
+      chainCache = chain
+      return chain
+    }
+
+    /**
+     * Runs the probe. **Blocking** — it `dlopen`s the QNN backend and creates a device
+     * handle, which is tens of milliseconds on real hardware and a failed `dlopen`
+     * anywhere else. Call it off the main thread.
+     */
+    fun probe(context: Context): DeviceProbe {
+      NativePipe.loadError?.let { return failed("libffnative.so did not load: $it") }
+
+      val chain = tierChain(context)
+
+      // Both directories are the same one. The QAIRT runtime ships as ordinary .so files
+      // in jniLibs, so the installer extracts backend, stub and skel side by side into
+      // the app's nativeLibraryDir -- and that extraction is exactly what
+      // `useLegacyPackaging = true` guarantees, because the backend is opened by path.
+      val libDir = context.applicationInfo.nativeLibraryDir
+      val info = parse(NativePipe.probeDeviceInfo(libDir, libDir))
+      val ok = info["ok"] == "1"
+
+      return DeviceProbe(
+        ok = ok,
+        tier = chain.first(),
+        tierChain = chain,
+        arch = info["arch"]?.toIntOrNull() ?: 0,
+        vtcmMb = info["vtcm"]?.toIntOrNull() ?: 0,
+        socModel = info["soc"]?.toIntOrNull() ?: 0,
+        signedPd = info["signedPd"] == "1",
+        dlbc = info["dlbc"] == "1",
+        // lastError() is whatever failed most recently, so it is only meaningful when
+        // something did. Reading it on the success path would report a stale message.
+        error = if (ok) "" else explain(NativePipe.lastError(), libDir),
+      )
+    }
+
+    /**
+     * Turns the native layer's `deviceCreate failed -- the DSP is not reachable from this
+     * process` into something a person can act on.
+     *
+     * That message is accurate and useless: the overwhelmingly common cause is not a broken
+     * phone but a **missing Hexagon skel for this chip's architecture**. `libQnnHtp.so`
+     * loads `libQnnHtpV<arch>Skel.so` chosen from the *silicon*, not from the model tier --
+     * so a build that bundles v73/v79/v81 cannot reach the DSP on an 8 Gen 1 (v69) no
+     * matter which models are on disk. Reported 2026-09-12 by the first person outside
+     * Saad's own 8 Elite to run this.
+     *
+     * The arch cannot be named here: it is measured by the very call that just failed, so
+     * on this path it reads 0. What *can* be named is what this build actually ships, which
+     * is enough for anyone to see the mismatch.
+     */
+    private fun explain(nativeError: String, libDir: String): String {
+      if (!nativeError.contains("deviceCreate")) return nativeError
+      val bundled = java.io.File(libDir)
+        .list { _, name -> SKEL.matches(name) }
+        ?.map { SKEL.find(it)!!.groupValues[1] }
+        ?.sortedBy { it.toIntOrNull() ?: 0 }
+        .orEmpty()
+      return when {
+        bundled.isEmpty() ->
+          "$nativeError. No Hexagon runtime is bundled in this build at all -- see the " +
+            "QAIRT SDK step in the README."
+        else ->
+          "$nativeError. This build bundles the Hexagon runtime for " +
+            bundled.joinToString(", ") { "v$it" } +
+            " only; this chip needs a different one, so no swap can run here."
+      }
+    }
+
+    private val SKEL = Regex("""libQnnHtpV(\d+)Skel\.so""")
+
+    private fun failed(reason: String) = DeviceProbe(
+      ok = false,
+      tier = FALLBACK_TIER,
+      tierChain = listOf(FALLBACK_TIER),
+      arch = 0,
+      vtcmMb = 0,
+      socModel = 0,
+      signedPd = false,
+      dlbc = false,
+      error = reason,
+    )
+
+    /** `ok=1;arch=79;vtcm=8;…` -> a map. Pairs without an `=` are dropped. */
+    private fun parse(info: String): Map<String, String> =
+      info.split(';')
+        .mapNotNull { field ->
+          val i = field.indexOf('=')
+          if (i <= 0) null else field.substring(0, i) to field.substring(i + 1)
+        }
+        .toMap()
+  }
+}

package/android/src/main/java/com/facefusion/FaceCrop.kt

@@ -0,0 +1,57 @@
+package com.facefusion
+
+/**
+ * Crops a packed BGR frame to one face's box, and pastes a same-sized crop back — how
+ * [PhotoSwap]/[VideoSwap] swap only a chosen *target* face without a new native entry
+ * point: [com.facefusion.mobile.NativePipe.processFrame] already swaps every face it's
+ * handed, so handing it a tight crop around one face swaps only that one. The same trick
+ * [SourceFaces] already uses on the source side for `setSource` — this is the BGR-buffer
+ * version of it, since [PhotoSwap]/[VideoSwap] both work in packed BGR, not `Bitmap`s, by
+ * the time a target face box would apply.
+ */
+object FaceCrop {
+
+  /** Same margin [SourceFaces] uses on the source side, for the same reason: the
+   *  detector/landmarker inside `processFrame` need a bit of surrounding context, not a
+   *  box drawn exactly to the model's own edges. */
+  const val MARGIN = 0.4f
+
+  /** [box] (`[left, top, right, bottom]`, as returned by [TargetFaces.detect]) expanded by
+   *  [margin] and clamped to `0..w`/`0..h`, as pixel ints. */
+  fun rect(box: FloatArray, w: Int, h: Int, margin: Float = MARGIN): IntArray {
+    require(box.size == 4) { "box must be [left, top, right, bottom]" }
+    val (boxLeft, boxTop, boxRight, boxBottom) = box
+    val bw = boxRight - boxLeft
+    val bh = boxBottom - boxTop
+    val left = (boxLeft - bw * margin).toInt().coerceIn(0, w - 1)
+    val top = (boxTop - bh * margin).toInt().coerceIn(0, h - 1)
+    val right = (boxRight + bw * margin).toInt().coerceIn(left + 1, w)
+    val bottom = (boxBottom + bh * margin).toInt().coerceIn(top + 1, h)
+    return intArrayOf(left, top, right, bottom)
+  }
+
+  /** Extracts `rect` from a packed BGR buffer (3 bytes/pixel, no row padding) of width [w]. */
+  fun crop(bgr: ByteArray, w: Int, rect: IntArray): ByteArray {
+    val left = rect[0]
+    val top = rect[1]
+    val cw = rect[2] - left
+    val ch = rect[3] - top
+    val out = ByteArray(cw * ch * 3)
+    for (row in 0 until ch) {
+      System.arraycopy(bgr, ((top + row) * w + left) * 3, out, row * cw * 3, cw * 3)
+    }
+    return out
+  }
+
+  /** Writes a buffer from [crop] back into [bgr] (width [w]) at [rect]. The inverse of
+   *  [crop] — call with the same `rect` used to produce it. */
+  fun paste(bgr: ByteArray, w: Int, cropped: ByteArray, rect: IntArray) {
+    val left = rect[0]
+    val top = rect[1]
+    val cw = rect[2] - left
+    val ch = rect[3] - top
+    for (row in 0 until ch) {
+      System.arraycopy(cropped, row * cw * 3, bgr, ((top + row) * w + left) * 3, cw * 3)
+    }
+  }
+}