# Changelog

## Score

- CAI 45 → 33 (-12.2)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 48 → 57 (+9.2)
- Maturity 64 → 59 (-4.7)
- Readiness 31 → 17 (-13.4)
- Security 58 → 40 (-17.6)

## Resolved (22)

- Change coupling: ApkBuilder.kt ↔ ApkConfigJsonFactory.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkBuilder.kt)
- Change coupling: ApkBuilder.kt ↔ ShellWebViewConfig.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkBuilder.kt)
- Change coupling: ApkConfig.kt ↔ ShellWebViewConfig.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfig.kt)
- Change coupling: ApkConfig.kt ↔ Strings.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfig.kt)
- Change coupling: ApkConfigJsonFactory.kt ↔ ShellModeManager.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfigJsonFactory.kt)
- Change coupling: ApkConfigJsonFactory.kt ↔ ShellWebViewConfig.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfigJsonFactory.kt)
- Change coupling: ApkConfigJsonFactory.kt ↔ Strings.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfigJsonFactory.kt)
- Change coupling: ApkConfigJsonFactory.kt ↔ WebApp.kt (app/src/main/java/com/webtoapp/core/apkbuilder/ApkConfigJsonFactory.kt)
- Change coupling: CreateAppWebViewCards.kt ↔ ShellWebViewConfig.kt (app/src/main/java/com/webtoapp/ui/screens/CreateAppWebViewCards.kt)
- Change coupling: ExtensionPanelScript.kt ↔ PanelScripts.kt (app/src/main/java/com/webtoapp/core/extension/ExtensionPanelScript.kt)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Duplicated block (11 lines × 2) (.github/scripts/ci/generate_submissions.py)
- Duplicated block (8 lines × 2) (.github/scripts/ci/generate_submissions.py)
- Duplicated block (8 lines × 2) (.github/scripts/ci/validate_modules.py)
- Further orphaned files (smaller)
- Medium CVE: PYSEC-2024-38 (app/src/main/assets/sample_projects/python-fastapi-ar/requirements.txt)
- Medium CVE: PYSEC-2026-2151 (app/src/main/assets/sample_projects/python-flask-ar/requirements.txt)
- Off-boarding risk: anonymized user #1
- Orphaned knowledge (app/src/main/java/com/webtoapp/core/forcedrun/ForcedRunManager.kt)
- …and 2 more

## New (74)

- (anonymous) (cognitive 18) (app/src/main/assets/sample_projects/nodejs-express/server.js)
- (anonymous) (cyclomatic 16) (app/src/main/assets/sample_projects/nodejs-express/server.js)
- Coverage not measured — test suite did not build
- Critical CVE: [GHSA redacted] (app/src/main/assets/sample_projects/go-fiber-ar/go.mod)
- Critical CVE: [GHSA redacted] (app/src/main/assets/sample_projects/go-fiber-ar/go.mod)
- Critical CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
- Dimension evaluation failed
- High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
- High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
- High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
- High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
- High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
- High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
- High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/go-fiber-ar/go.mod)
- High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
- High CVE: [GHSA redacted] (app/src/main/assets/sample_projects/python-django-ar/requirements.txt)
- Hotspot: app/src/main/assets/sample_projects/nodejs-express-ar/server.js (app/src/main/assets/sample_projects/nodejs-express-ar/server.js)
- Hotspot: app/src/main/assets/sample_projects/nodejs-express-en/server.js (app/src/main/assets/sample_projects/nodejs-express-en/server.js)
- Hotspot: app/src/main/assets/sample_projects/nodejs-express/server.js (app/src/main/assets/sample_projects/nodejs-express/server.js)
- Hotspot: app/src/main/assets/sample_projects/nodejs-koa-ar/server.js (app/src/main/assets/sample_projects/nodejs-koa-ar/server.js)
- …and 54 more

## Changes since last survey

- 105 commits — 54 feature/other, 51 fixes

## By area

- app/src — 88 commits
- (root) — 12 commits
- docs/.vitepress — 2 commits
- .github/CONTRIBUTING.md — 1 commit
- docs/guide — 1 commit
- shell/src — 1 commit

## Notable commits

- fix: Fix #471: Lift bottom action bars above system navigation bar (#484)
- fix: Revert "docs: revamp homepage with stats, app-type matrix, quick-start steps and CTA banner"
- fix: docs: sync docs with recent features (media session, page zoom, console) + fix FCM wording (#464)
- fix: feat(runtime): configurable port-conflict policy for all runtime apps + fix preview-switch leak (#478) (#479)
- fix: fix(aab): drop resource-table references to skipped plaintext res XML (#334)
- fix: fix(about): correct license name from MIT to The Unlicense (#365)
- fix: fix(activation): enforce device-bound codes via remote verifier + honest local labeling (#448) (#489)
- fix: fix(adblock): stop the OutOfMemoryError crash loop on startup and the App Creation screen (#359)
- fix: fix(agent): OpenAI-compat tool-call streaming dropped the tool call (#395)
- fix: fix(agent): always send reasoning_content for assistant messages (GLM compat) (#452)
- fix: fix(agent): don't lose permission/choice prompts (loop froze after a question) (#389)
- fix: fix(agent): file click opens preview; add per-file context menu (open / copy path) (#446)
- fix: fix(agent): guard thinkingSegments against null from legacy session JSON (#436)
- fix: fix(agent): interleave thinking with output; preserve per-turn thinking segments (#435)
- fix: fix(agent): intermittent stall — one bad SSE field no longer drops the whole chunk (#414)
- fix: fix(agent): multi-select choice options were not toggleable (#412)
- fix: fix(agent): omit max_tokens to let API use its own default (true unlimited) (#442)
- fix: fix(agent): per-turn reasoning + service-side persistence for backgrounded/killed UIs (#430)
- fix: fix(agent): persist built APKs to session so they survive app restart (#447)
- fix: fix(agent): prevent inline-marker leaks and wedged prompts (#437)
- …and 85 more

## Architecture

- Containers 0 added · 0 removed · contexts 0 added · 1 removed · edges 0 added · 0 removed

## Removed bounded contexts (1)

- python