Fix paste race, privacy, and detection false positives

- Sync DataStore fields independently to prevent partial writes
  from clobbering the other field during paste
- Only fetch public IP after server is configured (no third-party
  requests before setup completes)
- Narrow network activity window from 24h to 2h for running
  detection to avoid stale false positives

Author: GeiserX

app/src/main/java/com/cashpilot/android/service/AppDetector.kt

@@ -46,23 +46,25 @@ class AppDetector(private val context: Context) {
     private fun detect(app: MonitoredApp): AppStatus {
         val notificationActive = AppNotificationListener.isAppNotificationActive(app.packageName)
         val lastActive = getLastActiveTime(app.packageName)
-        val (tx, rx) = getNetworkStats(app.packageName)
+        val (tx24h, rx24h) = getNetworkStats(app.packageName, hours = 24)
+        // Use a 2h window for the "running" heuristic to avoid stale 24h false positives
+        val (tx2h, rx2h) = getNetworkStats(app.packageName, hours = 2)
 
         // App is "running" if:
         // 1. It has an active foreground notification, OR
         // 2. It was in foreground within the last 15 minutes, OR
-        // 3. It has network activity in the last 24h (bandwidth apps run as background services)
+        // 3. It has network activity in the last 2h (bandwidth apps run as background services)
         val recentlyActive = lastActive?.let {
             (System.currentTimeMillis() - it) < 15 * 60 * 1000
         } ?: false
-        val hasNetworkActivity = (tx + rx) > 1024 // >1KB to filter noise
+        val hasRecentNetworkActivity = (tx2h + rx2h) > 1024 // >1KB in last 2h
 
         return AppStatus(
             slug = app.slug,
-            running = notificationActive || recentlyActive || hasNetworkActivity,
+            running = notificationActive || recentlyActive || hasRecentNetworkActivity,
             notificationActive = notificationActive,
-            netTx24h = tx,
-            netRx24h = rx,
+            netTx24h = tx24h,
+            netRx24h = rx24h,
             lastActive = lastActive?.let {
                 Instant.ofEpochMilli(it)
                     .atOffset(ZoneOffset.UTC)
@@ -87,7 +89,7 @@ class AppDetector(private val context: Context) {
     }
 
     @Suppress("DEPRECATION")
-    private fun getNetworkStats(packageName: String): Pair<Long, Long> {
+    private fun getNetworkStats(packageName: String, hours: Int = 24): Pair<Long, Long> {
         val nsm = networkStatsManager ?: return 0L to 0L
         val uid = try {
             packageManager.getApplicationInfo(packageName, 0).uid
@@ -96,7 +98,7 @@ class AppDetector(private val context: Context) {
         }
 
         val now = System.currentTimeMillis()
-        val dayAgo = now - 24 * 60 * 60 * 1000
+        val start = now - hours.toLong() * 60 * 60 * 1000
         var tx = 0L
         var rx = 0L
 
@@ -106,9 +108,8 @@ class AppDetector(private val context: Context) {
             ConnectivityManager.TYPE_MOBILE,
         )) {
             try {
-                val bucket = nsm.querySummaryForDevice(networkType, null, dayAgo, now)
                 // querySummary gives per-app breakdowns
-                val summary = nsm.querySummary(networkType, null, dayAgo, now)
+                val summary = nsm.querySummary(networkType, null, start, now)
                 val b = android.app.usage.NetworkStats.Bucket()
                 while (summary.hasNextBucket()) {
                     summary.getNextBucket(b)

app/src/main/java/com/cashpilot/android/ui/MainViewModel.kt

@@ -80,7 +80,6 @@ class MainViewModel(application: Application) : AndroidViewModel(application) {
 
     init {
         checkPermissions()
-        fetchPublicIp()
     }
 
     fun refreshStatuses() {
@@ -135,6 +134,10 @@ class MainViewModel(application: Application) : AndroidViewModel(application) {
             totalRx = result.mapNotNull { it.status?.netRx24h }.sum(),
         )
         checkPermissions()
+        // Only fetch public IP once the server is configured (post-setup)
+        if (_publicIp.value == null && settings.value.serverUrl.isNotBlank()) {
+            fetchPublicIp()
+        }
         _isRefreshing.value = false
     }
 

app/src/main/java/com/cashpilot/android/ui/screen/SettingsScreen.kt

@@ -50,13 +50,19 @@ fun SettingsScreen(viewModel: MainViewModel, onBack: () -> Unit) {
     var localUrl by rememberSaveable { mutableStateOf("") }
     var localKey by rememberSaveable { mutableStateOf("") }
 
-    // Sync once when DataStore loads real values (won't re-trigger after)
-    var synced by rememberSaveable { mutableStateOf(false) }
-    LaunchedEffect(settings.serverUrl, settings.apiKey) {
-        if (!synced && (settings.serverUrl.isNotEmpty() || settings.apiKey.isNotEmpty())) {
+    // Sync each field independently so a partial DataStore write doesn't clobber the other
+    var urlSynced by rememberSaveable { mutableStateOf(false) }
+    var keySynced by rememberSaveable { mutableStateOf(false) }
+    LaunchedEffect(settings.serverUrl) {
+        if (!urlSynced && settings.serverUrl.isNotEmpty()) {
             localUrl = settings.serverUrl
+            urlSynced = true
+        }
+    }
+    LaunchedEffect(settings.apiKey) {
+        if (!keySynced && settings.apiKey.isNotEmpty()) {
             localKey = settings.apiKey
-            synced = true
+            keySynced = true
         }
     }
 

app/src/main/java/com/cashpilot/android/ui/screen/SetupScreen.kt

@@ -57,13 +57,19 @@ fun SetupScreen(viewModel: MainViewModel, onComplete: () -> Unit) {
     var localUrl by rememberSaveable { mutableStateOf("") }
     var localKey by rememberSaveable { mutableStateOf("") }
 
-    // Sync once when DataStore loads real values (won't re-trigger after)
-    var synced by rememberSaveable { mutableStateOf(false) }
-    LaunchedEffect(settings.serverUrl, settings.apiKey) {
-        if (!synced && (settings.serverUrl.isNotEmpty() || settings.apiKey.isNotEmpty())) {
+    // Sync each field independently so a partial DataStore write doesn't clobber the other
+    var urlSynced by rememberSaveable { mutableStateOf(false) }
+    var keySynced by rememberSaveable { mutableStateOf(false) }
+    LaunchedEffect(settings.serverUrl) {
+        if (!urlSynced && settings.serverUrl.isNotEmpty()) {
             localUrl = settings.serverUrl
+            urlSynced = true
+        }
+    }
+    LaunchedEffect(settings.apiKey) {
+        if (!keySynced && settings.apiKey.isNotEmpty()) {
             localKey = settings.apiKey
-            synced = true
+            keySynced = true
         }
     }