[P0][Android/Termux] Safe Termux bootstrap plugin + agentprolog-termux daemon #28

New issue

Open

opened 2026-09-19 04:27:35 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-19 04:27:35 +00:00

Owner

Parent: #undefined

Implement the Android local-runtime path without turning Termux into an arbitrary shell escape hatch.

Bootstrap

Create an Android/Kotlin Tauri plugin that:

detects Termux;
checks package visibility/setup;
requests/diagnoses com.termux.permission.RUN_COMMAND;
diagnoses allow-external-apps=true;
launches only the fixed AgentProlog bootstrap/service command with typed argv;
receives startup result/status;
never accepts arbitrary shell strings.

Daemon

Add agentprolog-termux:

starts AgentProlog/prolog-rlm in Termux;
binds authenticated loopback or local-domain socket;
exposes canonical frontend protocol;
writes bounded machine-readable health/descriptor state;
supports stop/status/version;
handles stale daemon/socket cleanup;
pins/proves protocol/runtime versions.

Security

RUN_COMMAND is bootstrap/control-plane only. Normal agent/tool traffic goes over the authenticated canonical protocol and remains under Prolog-RLM authority.

Acceptance

Fresh Termux setup path has actionable diagnostics.
Missing permission/config fails closed.
No arbitrary command field exists in the Android bridge API.
Local daemon completes a real AgentProlog session from Android.
Restart/reconnect preserves canonical persisted state where supported.

Verified Termux interop facts — 2026-09-19

Current Termux upstream documentation confirms:

third-party apps may invoke RunCommandService using the com.termux.RUN_COMMAND intent;
the Android app must request com.termux.permission.RUN_COMMAND;
Termux must have allow-external-apps=true in ~/.termux/termux.properties;
apps targeting Android 11 / SDK 30+ need package visibility for com.termux;
Java/Kotlin callers can receive command results through a PendingIntent;
upstream recommends using termux-shared constants instead of hardcoding intent extra names.

Reference:

https://github.com/termux/termux-app/wiki/RUN_COMMAND-Intent

Design consequence: use RUN_COMMAND only to start/stop/status a fixed AgentProlog service command, then switch to the authenticated canonical AgentProlog protocol transport. Do not serialize tool calls or user shell strings into RUN_COMMAND.

Parent: #undefined Implement the Android local-runtime path without turning Termux into an arbitrary shell escape hatch. ### Bootstrap Create an Android/Kotlin Tauri plugin that: - detects Termux; - checks package visibility/setup; - requests/diagnoses `com.termux.permission.RUN_COMMAND`; - diagnoses `allow-external-apps=true`; - launches only the fixed AgentProlog bootstrap/service command with typed argv; - receives startup result/status; - never accepts arbitrary shell strings. ### Daemon Add `agentprolog-termux`: - starts AgentProlog/prolog-rlm in Termux; - binds authenticated loopback or local-domain socket; - exposes canonical frontend protocol; - writes bounded machine-readable health/descriptor state; - supports stop/status/version; - handles stale daemon/socket cleanup; - pins/proves protocol/runtime versions. ### Security RUN_COMMAND is bootstrap/control-plane only. Normal agent/tool traffic goes over the authenticated canonical protocol and remains under Prolog-RLM authority. ### Acceptance - [ ] Fresh Termux setup path has actionable diagnostics. - [ ] Missing permission/config fails closed. - [ ] No arbitrary command field exists in the Android bridge API. - [ ] Local daemon completes a real AgentProlog session from Android. - [ ] Restart/reconnect preserves canonical persisted state where supported. ## Verified Termux interop facts — 2026-09-19 Current Termux upstream documentation confirms: - third-party apps may invoke `RunCommandService` using the `com.termux.RUN_COMMAND` intent; - the Android app must request `com.termux.permission.RUN_COMMAND`; - Termux must have `allow-external-apps=true` in `~/.termux/termux.properties`; - apps targeting Android 11 / SDK 30+ need package visibility for `com.termux`; - Java/Kotlin callers can receive command results through a `PendingIntent`; - upstream recommends using `termux-shared` constants instead of hardcoding intent extra names. Reference: - https://github.com/termux/termux-app/wiki/RUN_COMMAND-Intent Design consequence: use RUN_COMMAND only to start/stop/status a fixed AgentProlog service command, then switch to the authenticated canonical AgentProlog protocol transport. Do not serialize tool calls or user shell strings into RUN_COMMAND.