[A-EDev]

Summary

Connections on the local network are now bounded before they prove anything.

• WsServer stops reading a socket once a few frames are queued. That needed Ktor's incoming channel bounded as well, since it queues without limit by default. A server for one session closes any further connection.
• A LAN hello can inflate to at most 4 KiB, and other LAN frames stop inflating at the content limit instead of checking it after.
• Each hello message has 10 seconds. A silent connection ends without touching the roster, which isn't read until a hello arrives.
• At most 16 connections can be in their hello at once (LanGreeter); further ones are closed until one finishes.
• LAN dials no longer follow redirects.

Related issue

None.

Change type

• Bug fix
• Feature
• Refactor or maintenance
• Build, packaging, or CI
• Documentation

Validation

• ./gradlew --offline ... :app:testGithubDebugUnitTest --tests 'io.github.aedev.flow.sync2.*' --tests 'io.github.aedev.flow.sync.*': 489 tests, 0 failed.

• ./gradlew --offline ... ktlintCheck: passed.

• python3 .github/scripts/nightly_notes.py --check: passed.

• New LanLimitsTest: 8 passed. With every limit removed at once, all 8 fail. With only the hello timeout removed, 3 fail.

• Not run on a device or between real devices. The memory bound is checked by whether a sender stalls, not measured.

• ./gradlew :app:assembleGithubDebug: not run locally, CI builds it.

• ./gradlew :app:testGithubDebugUnitTest: full suite not run locally, CI runs it.

• I manually tested the affected behavior on an Android device or emulator: not done.

Test device and Android version: none.

Risk and compatibility

Touches the transport FLOW-SYNC/1 shares: a server for one session now closes a second connection, and its queue is bounded too. A receiver that stops reading for longer than the ping timeout (45 s) now loses the connection. A flood of 16 silent connections can delay a real member's connection until they time out.

• The change does not introduce secrets, private data, or unexpected telemetry.
• New user-facing text uses Android string resources, or this PR adds none.
• Dependency and lockfile changes are intentional and limited to this PR. There are none.
• Room schema changes include the required version bump and migration, or this PR does not change the Room schema.
• Breaking changes and upgrade steps are clearly documented. There are none.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.