Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@mobile/app/build.gradle.kts`:
- Around line 64-65: The inline comment "//ne pon" above the dependency
implementation("androidx.lifecycle:lifecycle-viewmodel-compose:2.8.+") is
unclear—either replace it with a short descriptive comment stating that this
dependency provides Jetpack Lifecycle ViewModel integration for Compose (enables
using ViewModel with Compose lifecycle-aware state) or remove the comment if
redundant; update the comment near the implementation(...) line so readers
understand why the dependency is included.
- Around line 44-46: The dependency version is malformed: the implementation
line uses "$nav_version+" which yields "2.9.7+" (invalid). Fix by removing the
trailing "+" from the implementation usage so it uses the exact nav_version
value, or if you intended a wildcard, change the nav_version declaration to a
segment wildcard like "2.9.+" and keep the implementation as
implementation("androidx.navigation:navigation-compose:$nav_version"); update
the nav_version variable or the implementation string accordingly (refer to the
nav_version variable and the
implementation("androidx.navigation:navigation-compose:$nav_version+")
occurrence).
- Around line 49-65: The build file uses dynamic versions with '+' (e.g.,
dependency coordinates in build.gradle.kts like
"com.squareup.retrofit2:retrofit:2.11.+", "com.squareup.okhttp3:okhttp:4.12.+",
"com.squareup.retrofit2:converter-gson:2.11.+",
"com.squareup.okhttp3:logging-interceptor:4.12.+",
"androidx.datastore:datastore-preferences:1.1.+",
"org.jetbrains.kotlinx:kotlinx-coroutines-android:1.9.+",
"androidx.lifecycle:lifecycle-viewmodel-compose:2.8.+") which makes builds
non-reproducible; replace each '+' wildcard with a specific, exact version
number (pin each artifact to a concrete release) by looking up the current
stable versions for Retrofit, OkHttp, converter-gson, logging-interceptor,
datastore-preferences, kotlinx-coroutines-android, and
lifecycle-viewmodel-compose and update the corresponding implementation(...)
lines accordingly, and optionally centralize those version numbers in a versions
object or Gradle extra properties for maintainability.

In `@mobile/app/src/main/java/com/smartjam/app/data/api/AuthApi.kt`:
- Around line 13-20: The `@POST` annotation for the refresh endpoint uses a
relative path ("api/auth/refresh") while register and login use absolute paths
("/api/auth/..."), which can cause BASE_URL-dependent bugs; update the `@POST` on
the refresh function (refresh) to use the leading slash ("/api/auth/refresh") so
all endpoints (register, login, refresh) use consistent absolute path formatting
in AuthApi.kt.

In `@mobile/app/src/main/java/com/smartjam/app/data/api/NetworkModule.kt`:
- Around line 32-36: The loggingInterceptor currently uses
HttpLoggingInterceptor.Level.BODY which can leak sensitive data; update the lazy
initializer for loggingInterceptor to enable BODY only in debug builds by
checking BuildConfig.DEBUG (import BuildConfig), otherwise use a safer level
(e.g., NONE or BASIC); reference the loggingInterceptor property and the
HttpLoggingInterceptor.Level enum when making the conditional change.
- Around line 14-45: authApi and roomApi each build an identical Retrofit
instance; extract a single shared Retrofit instance (e.g., a private val
retrofit by lazy) configured with BASE_URL, okHttpClient and
GsonConverterFactory, then use retrofit.create(AuthApi::class.java) and
retrofit.create(RoomApi::class.java) to create authApi and roomApi. Keep the
existing okHttpClient and loggingInterceptor as-is and ensure the new shared
Retrofit is referenced by the existing authApi and roomApi properties (use the
same lazy pattern).
- Line 12: The BASE_URL constant in NetworkModule.kt is malformed
("http:/10.0.2.2:8000/") which breaks all network calls; update the private
const val BASE_URL in NetworkModule.kt to the correct URL string
"http://10.0.2.2:8000/" (note the double slash after "http:") so Retrofit/HTTP
client uses a valid base URL.

In `@mobile/app/src/main/java/com/smartjam/app/data/api/RoomApi.kt`:
- Around line 9-12: The joinRoom endpoint in RoomApi lacks Authorization; either
add a `@Header`("Authorization") parameter to suspend fun
joinRoom(`@Header`("Authorization") auth: String, `@Body` request: JoinRoomRequest):
Response<RoomResponse> so callers pass "Bearer <token>", or (preferred) update
your NetworkModule where the OkHttpClient is built to add an interceptor that
reads the stored access token (from your token storage/session manager) and
injects an "Authorization: Bearer <token>" header for every request; modify the
client creation code and ensure Retrofit uses that OkHttpClient so RoomApi
requests include the Bearer token automatically.

In `@mobile/app/src/main/java/com/smartjam/app/data/local/TokenStorage.kt`:
- Around line 75-77: The isAuthenticated() function currently returns false when
the access token is expired, which forces logout instead of allowing a refresh;
change isAuthenticated() to consider the session authenticated as long as the
refresh token is not expired (i.e., return !isRefreshTokenExpired()), so an
expired access token will trigger the refresh flow instead of immediate
unauthentication; update any callers or comments if they rely on the old
behavior and ensure isAccessTokenExpired() is only used to decide whether to
call the refresh routine, not to mark the session unauthenticated.
- Around line 27-33: The tokens are being persisted in plaintext to Preferences
DataStore via saveToken (storing ACCESS_TOKEN, REFRESH_TOKEN, ACCESS_EXPIRED_AT,
REFRESH_EXPIRED_AT); change this to store encrypted values by using AndroidX
Security (MasterKey/AndroidKeyStore) and encrypting the token strings before
writing and decrypting them when reading, or migrate to an encrypted storage
implementation (EncryptedSharedPreferences or an encrypted DataStore wrapper) so
secrets are protected by the platform keystore; update saveToken to perform
encryption of accessToken/refreshToken and update any accessor functions that
read ACCESS_TOKEN/REFRESH_TOKEN to decrypt them, ensuring the encryption key is
created with MasterKey (AndroidKeyStore) and never hard-coded.

In `@mobile/app/src/main/java/com/smartjam/app/data/model/RegisterRequest.kt`:
- Around line 3-8: Replace the raw String role in the RegisterRequest data class
with the existing UserRole enum type (i.e., change RegisterRequest(role: String)
to RegisterRequest(role: UserRole)), import the enum, and update all call sites
that construct RegisterRequest to pass a UserRole instance (or map from string
via UserRole.valueOf(...) where needed); ensure your JSON library is configured
to serialize enums (for Gson no extra change is needed, for Moshi add the proper
adapter) so the enum is converted to/from its string representation during
network (de)serialization.

In
`@mobile/app/src/main/java/com/smartjam/app/domain/repository/AuthRepository.kt`:
- Around line 93-112: The expiry helpers getAccessTokenExpiredIn and
getRefreshTokenExpiredIn subtract System.currentTimeMillis() (milliseconds) from
expiry values provided by tokenStorage.accessExpiredAt / refreshExpiredAt (epoch
seconds), causing ~1000x error; fix by converting the current time to seconds
(e.g. currTimeSec = System.currentTimeMillis() / 1000) before doing the
subtraction so the math uses the same units as tokenStorage, and keep null
checks and return types unchanged.
- Around line 16-30: The suspend methods register, login, and refreshToken
currently catch Exception which also swallows CancellationException; update each
to first catch CancellationException and rethrow it (e.g., catch (e:
CancellationException) { throw e }) before the generic catch (e: Exception)
block so coroutine cancellation remains cooperative and refreshToken won't clear
tokens on cancellation; locate the handlers in register(), login(), and
refreshToken() and insert the rethrowing CancellationException catch above the
existing Exception catch.

In `@mobile/app/src/main/java/com/smartjam/app/MainActivity.kt`:
- Around line 22-36: The app currently always starts SmartJamNavGraph with
startDestination = Screen.Home.route which lets unauthenticated users land on
Home; check TokenStorage.getAccessToken() at startup and compute a
startDestination variable (use Screen.Home.route when token exists, otherwise
Screen.Login.route) and pass that startDestination into SmartJamNavGraph (update
the call site where SmartJamNavGraph is invoked to accept the computed
startDestination and use TokenStorage/ getAccessToken() to decide the initial
route).
- Line 31: Replace the hardcoded Color(0xFF05050A) used in MainActivity (the
color assignment on the composable background) with your theme color (e.g.,
MaterialTheme.colorScheme.background) and define that hex value in your app
theme color scheme (e.g., in your Theme.kt where dark/light ColorScheme or
Background variable is declared) so the background uses the themed color instead
of a literal.

In `@mobile/app/src/main/java/com/smartjam/app/ui/navigation/NavGraph.kt`:
- Around line 78-83: RoomRepository is being instantiated inside the composable
and will be recreated on every recomposition; wrap the repository creation with
remember to keep a single instance per composition (e.g., use remember {
RoomRepository(NetworkModule.roomApi) }) and then pass that remembered instance
into HomeViewModelFactory when calling viewModel (referencing RoomRepository,
NetworkModule.roomApi, HomeViewModelFactory, and the viewModel call in the
composable).
- Around line 3-5: Remove the unused imports to clean up NavGraph.kt: delete the
imports for Box, fillMaxSize and Text (the symbols: Box, fillMaxSize, Text) at
the top of the file so only required Compose imports remain; verify no other
references to these symbols exist in functions like NavGraph or related
composables before committing.
- Around line 37-40: The NavHost currently uses Screen.Home.route as the
unconditional startDestination, allowing unauthenticated users to land on Home;
change this by computing an isAuthenticated boolean in MainActivity (by checking
the token store for valid tokens) and pass the appropriate start destination
into NavHost (e.g., Screen.Home.route if isAuthenticated true, otherwise the
auth/login route). Locate the NavHost usage in NavGraph and update its
startDestination to use that flag, and ensure MainActivity exposes or injects
isAuthenticated into NavGraph instead of hardcoding Screen.Home.route.

In `@mobile/app/src/main/java/com/smartjam/app/ui/screens/home/HomeScreen.kt`:
- Line 10: Remove the unused import CircularProgressIndicator from
HomeScreen.kt; locate the import statement "import
androidx.compose.material3.CircularProgressIndicator" at the top of the file and
delete it so unused imports are cleaned up and lint warnings are resolved.
- Around line 121-133: The Box in HomeScreen.kt currently displays both
state.errorMessage and state.successMessage simultaneously which can overlap;
update the rendering logic inside that Box (the block that checks
state.errorMessage and state.successMessage) to make them mutually exclusive
(e.g., use if (state.errorMessage != null) { ... } else if (state.successMessage
!= null) { ... }) so only one Text is composed at a time, keeping the existing
color and fontSize for each message and prioritizing the error message when both
are present.

In `@mobile/app/src/main/java/com/smartjam/app/ui/screens/home/HomeViewModel.kt`:
- Around line 32-33: The Channel is created with default RENDEZVOUS capacity
which can drop/suspend sends if no collector is active; change the declaration
of eventChannel to use a buffered capacity (e.g., Channel(capacity =
Channel.BUFFERED) or a small fixed capacity) so send() won’t suspend or lose
events, keep the public events flow as eventChannel.receiveAsFlow(), and update
any send sites that rely on non-blocking behavior if you choose a bounded vs
unlimited capacity; references: eventChannel, HomeEvent, events,
receiveAsFlow().
- Around line 35-37: The current onInviteCodeChanged function trims the input on
every keystroke which blocks users from entering spaces; change
onInviteCodeChanged to store the raw input (remove the .trim()) by updating
_state via onInviteCodeChanged(code) to set inviteCodeInput = code and clear
messages as before, and move trimming/normalization to the submission/validation
path (e.g., wherever invite code is validated/submitted — the submitInviteCode
or validateInviteCode function) so that you call code.trim() there before
processing or comparing.

In `@mobile/app/src/main/java/com/smartjam/app/ui/screens/login/LoginScreen.kt`:
- Around line 47-52: The LoginScreen function must not call viewModel() as a
default parameter since LoginViewModel requires AuthRepository; remove the
default parameter and require callers to pass an instantiated LoginViewModel (or
call viewModel(factory = LoginViewModelFactory(...)) themselves). Update the
LoginScreen signature (referencing LoginScreen and LoginViewModel) to take a
non-default viewModel: LoginViewModel and change all call sites including
LoginScreenModernPreview to supply a LoginViewModel instance or use
viewModel(factory = LoginViewModelFactory(...)); ensure use of
LoginViewModelFactory where appropriate so the AuthRepository dependency is
provided.

In
`@mobile/app/src/main/java/com/smartjam/app/ui/screens/login/LoginViewModel.kt`:
- Around line 57-60: In LoginViewModel, the blank-field validation sets
_state.value = _state.value.copy(errorMessage = "Fill in all fields") but
execution continues and immediately enters viewModelScope.launch, which clears
the error and submits empty credentials; fix by returning early after setting
the error (or move the viewModelScope.launch into the else branch) so that when
currentPassword or currentEmail is blank the method exits and does not call
viewModelScope.launch or the submission logic.
- Around line 63-73: authRepository.login(...) returns Result<Unit>, so the
current LoginViewModel code unconditionally sends
eventChannel.send(LoginEvent.NavigateToHome) even when login failed; change the
try block to inspect the Result returned by authRepository.login(currentEmail,
currentPassword) and only send LoginEvent.NavigateToHome when result.isSuccess,
otherwise set _state.value = _state.value.copy(errorMessage =
result.exceptionOrNull()?.message ?: "Login failed") (or use result.fold to
handle success/failure). Keep the existing finally block that sets isLoading =
false and keep using eventChannel for navigation on success.

In
`@mobile/app/src/main/java/com/smartjam/app/ui/screens/register/RegisterScreen.kt`:
- Around line 161-165: The RegisterScreen's registration button
(GoldenStringsButton) is not disabled during loading, allowing duplicate
submissions; update the button in RegisterScreen.kt to prevent clicks while
state.isLoading by either setting its enabled/disabled prop (e.g., enabled =
!state.isLoading) or short-circuiting the onClick to no-op when state.isLoading,
and keep calling viewModel.onRegisterClicked() only when not loading so
duplicate requests are prevented.
- Line 46: The LocalContext.current value is assigned to a variable named
context but never used; remove the unused declaration "val context =
LocalContext.current" from RegisterScreen (and also delete the corresponding
import of androidx.compose.ui.platform.LocalContext if it becomes unused) so
there are no unused variables or imports left in the RegisterScreen.kt code.
- Line 3: Remove the unused import android.widget.Toast from RegisterScreen.kt
to clean up imports; locate the top-level imports in the RegisterScreen
class/file and delete the Toast import line (ensure no other code references
Toast in functions like RegisterScreen or any nested composables before
removing).

In
`@mobile/app/src/main/java/com/smartjam/app/ui/screens/register/RegisterViewModel.kt`:
- Around line 68-109: Prevent duplicate submissions by checking and setting the
loading flag before launching registration: at the start of onRegisterClicked()
read currentState and return immediately if currentState.isLoading is true; then
set isLoading = true (and clear errorMessage) via _state.update {
it.copy(isLoading = true, errorMessage = null) } before calling
viewModelScope.launch so a second tap sees isLoading and is ignored; keep the
existing post-result _state.update { it.copy(isLoading = false) } and error
handling as-is. Use the existing symbols onRegisterClicked, _state, isLoading,
viewModelScope.launch and authRepository.register to locate where to apply this
change.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@mobile/app/build.gradle.kts`:
- Around line 74-76: The Room compiler dependency version is out of sync: the
build file adds implementation("androidx.room:room-runtime:2.6.1") and
implementation("androidx.room:room-ktx:2.6.1") but uses
ksp("androidx.room:room-compiler:2.5.0"); update the room-compiler coordinate
used in the ksp(...) declaration to match the runtime/ktx version (2.6.1) so the
compiler and runtime are aligned (change the
ksp("androidx.room:room-compiler:2.5.0") entry to use 2.6.1).

In `@mobile/app/src/main/java/com/smartjam/app/data/api/NetworkModule.kt`:
- Around line 14-37: The current shared loggingInterceptor uses
HttpLoggingInterceptor.Level.BODY which will log sensitive JSON payloads for
both AuthApi and SmartJamApi; change the shared logging level to a non-body
level (e.g., HttpLoggingInterceptor.Level.HEADERS or BASIC) so
createRetrofit(tokenStorage) no longer emits request/response bodies, and add a
new, dedicated factory (e.g., createAuthRetrofit or createAuthOkHttpClient) that
uses a separate HttpLoggingInterceptor with Level.BODY only when you explicitly
need it for non-production debug of non-shared clients; locate and update the
loggingInterceptor lazy val and the createRetrofit function to use the safer
shared logger and add the separate auth-specific factory so MainActivity uses
the appropriate client for AuthApi.

In `@mobile/app/src/main/java/com/smartjam/app/data/local/dao/ConnectionDao.kt`:
- Around line 13-20: Queries getConnectionsFlow and clearConnections filter by
myRole and need an index to avoid table scans; add an `@Index` on the myRole
column in the ConnectionEntity (e.g., `@Entity`(..., indices = [Index(value =
["myRole"])]) referencing the myRole property) and update your Room schema
version plus provide a migration to add the index so existing databases are
handled; ensure the indexed column name matches the field/columnName used by
ConnectionEntity.

In `@mobile/app/src/main/java/com/smartjam/app/domain/model/Connection.kt`:
- Around line 4-9: Change the free-form status String on the Connection data
class to a constrained enum: create a ConnectionStatus enum (e.g., PENDING,
ACTIVE, REJECTED, UNKNOWN/default) and change Connection.status: String to
Connection.status: ConnectionStatus; add a mapping function (e.g.,
ConnectionStatus.from(value: String)) that normalizes backend values
(case-insensitive) and returns UNKNOWN for unexpected values, and update all
construction/deserialization sites and any filtering logic that previously
compared raw strings to use the enum values instead.

In
`@mobile/app/src/main/java/com/smartjam/app/domain/repository/AuthRepository.kt`:
- Around line 75-82: The catch block currently clears tokens for any
non-CancellationException, which logs users out on transient failures; update
the error handling in the function containing this catch so that you only call
tokenStorage.clearTokens() when the exception is a confirmed auth rejection
(e.g., an HttpException with 401/403 or a TokenInvalidException), rethrow
CancellationException as before, and for all other exceptions just return false
(or propagate a retryable error) without clearing tokens; reference
tokenStorage.clearTokens(), CancellationException, and the surrounding catch (e:
Exception) block to locate and implement the check.

In
`@mobile/app/src/main/java/com/smartjam/app/domain/repository/ConnectionRepository.kt`:
- Around line 50-51: The two DAO calls dao.clearConnections(role.name) and
dao.insertConnections(allEntities) must be executed inside a single Room
transaction to avoid leaving the cache empty on failure; either add a new DAO
method (e.g., fun refreshConnectionsForRole(roleName: String, entities:
List<...>)) annotated with `@Transaction` that calls clearConnections(...) then
insertConnections(...), and call that from the repository, or use your
RoomDatabase instance's withTransaction { dao.clearConnections(role.name);
dao.insertConnections(allEntities) } at the call site so both operations commit
or roll back together.

In `@mobile/app/src/main/java/com/smartjam/app/ui/navigation/NavGraph.kt`:
- Around line 23-27: The NavGraph is missing a registered composable for the
Room route (Screen.Room / "room_screen") and the navigation call that goes to
"room_screen" does not include the required connectionId parameter, causing
runtime failures; add a composable destination for Screen.Room in NavGraph that
accepts a connectionId navArg (e.g., navArgument("connectionId") { type =
NavType.StringType }) and update the navigation call from Home to navigate to
the Room route with the connectionId included (e.g., build the route with the
connectionId param) so the destination can read it from NavBackStackEntry and
open the correct room.

In `@mobile/app/src/main/java/com/smartjam/app/ui/screens/home/HomeScreen.kt`:
- Around line 52-57: HomeEvent.NavigateToRoom is emitting a connectionId but the
NavGraph and the onNavigateToRoom handler drop it and don't register a room
route; update the navigation to accept and pass the connectionId (e.g., add a
route that includes a connectionId param in NavGraph.kt and change the
onNavigateToRoom callback used in HomeScreen (the handler invoked for
HomeEvent.NavigateToRoom) to navigate to that route with the
event.connectionId), and ensure the destination/composable for the room screen
is registered to read the connectionId param so tapping a connection opens the
correct room.
- Around line 101-106: The PendingRequestCard actions allow duplicate
submissions because the onAccept/onReject callbacks remain enabled during
state.isLoading; update the caller to pass a disabled flag into
PendingRequestCard (e.g., disabled = state.isLoading) and ensure
PendingRequestCard uses that flag to disable both accept and reject buttons
while true; do the same change for the other usage (the block referencing items
at the second occurrence around lines 261-279) so status-changing requests
cannot be double-submitted until the first response completes.
- Around line 241-245: The KeyboardActions onDone currently calls onJoin()
unconditionally and bypasses the button's guard; update the onDone handler in
KeyboardActions to perform the same check used by the Button (enabled =
!isLoading && inputValue.isNotBlank()) before calling onJoin(), e.g., only
invoke onJoin() when !isLoading and inputValue.isNotBlank() (apply the same
trimming/validation logic if the Button uses it) to prevent empty or duplicate
submissions from the keyboard.
- Around line 166-177: The header's clickable debug role toggle (Column with
Modifier.clickable calling onToggleDebugRole()) must be disabled in non-debug
builds; update HomeScreen to gate the clickable behavior behind
BuildConfig.DEBUG so only debug builds allow toggling the role. Concretely, use
BuildConfig.DEBUG to conditionally add the clickable modifier (or choose a
non-clickable Modifier) when rendering the Column that displays "SmartJam" and
the role text (symbols: Column, Modifier.clickable, onToggleDebugRole(), role,
UserRole.TEACHER) so release builds cannot flip the UI role.

In `@mobile/app/src/main/java/com/smartjam/app/ui/screens/home/HomeViewModel.kt`:
- Around line 107-125: The click handlers (e.g., onJoinRoomClicked) currently
start network writes regardless of state; guard against re-entrancy by checking
_state.value.isLoading at the top of each handler and returning immediately if
true, then atomically set isLoading = true before launching the network call
(and clear it in a finally block) so rapid taps won't start duplicate
viewModelScope.launch calls; apply the same pattern to the other write handlers
that call connectionRepository (the methods launching viewModelScope.launch and
calling connectionRepository.joinByCode, other invite creation/response methods,
eventChannel.send, and syncNetworkData) to ensure only one in-flight request at
a time.
- Around line 181-183: The create() method in HomeViewModelFactory should
validate the incoming modelClass instead of unconditionally casting; update
HomeViewModelFactory.create(modelClass: Class<T>) to check if
modelClass.isAssignableFrom(HomeViewModel::class.java) (or the Kotlin
equivalent) and only then return HomeViewModel(connectionRepository,
authRepository) as T, otherwise throw an IllegalArgumentException with a clear
message referencing modelClass; this mirrors the safer pattern used in
RegisterViewModelFactory and prevents later ClassCastException.
- Around line 68-100: The sync coroutine is launched on viewModelScope inside
syncNetworkData(), so it isn’t cancelled when connectionJob is cancelled and can
overwrite state for a new role; make syncNetworkData cancellable by turning it
into a suspending function (suspend fun syncNetworkData()) or by accepting a
CoroutineScope and running its work in the caller’s coroutine, remove the
internal viewModelScope.launch, and call it directly from inside the
connectionJob coroutine in startObservingConnections so
connectionRepository.syncConnections(_state.value.currentRole) and subsequent
_state updates run as children of connectionJob and will be cancelled on role
switch.

In
`@mobile/app/src/main/java/com/smartjam/app/ui/screens/login/LoginViewModel.kt`:
- Around line 66-80: The generic catch in LoginViewModel around
authRepository.login swallows coroutine cancellation; update the handler to
re-throw CancellationException before handling other exceptions by adding a
specific catch for CancellationException that re-throws (preserving cooperative
cancellation), then keep the existing catch for Exception to update
_state.errorMessage and send events; reference the authRepository.login call,
the catch (e: Exception) block, and _state/update logic and replace the single
catch with two catches (CancellationException re-thrown, Exception handled).

---

Duplicate comments:
In `@mobile/app/build.gradle.kts`:
- Around line 51-72: Update the floating dependency versions to explicit, fixed
versions: replace the dynamic ranges using "+" (e.g.,
"androidx.navigation:navigation-compose:$nav_version+",
"com.squareup.retrofit2:retrofit:2.11.+", "com.squareup.okhttp3:okhttp:4.12.+",
"com.squareup.retrofit2:converter-gson:2.11.+",
"com.squareup.okhttp3:logging-interceptor:4.12.+",
"androidx.datastore:datastore-preferences:1.1.+",
"org.jetbrains.kotlinx:kotlinx-coroutines-android:1.9.+", and
"androidx.lifecycle:lifecycle-viewmodel-compose:2.8.+") with exact version
strings (set nav_version to a specific patch like "2.9.7" and use exact artifact
versions for retrofit/okhttp/gson/datastore/coroutines/lifecycle) so dependency
resolution is deterministic across environments.

In `@mobile/app/src/main/java/com/smartjam/app/data/local/TokenStorage.kt`:
- Around line 14-16: Persisted bearer tokens are being written in plaintext via
the Context.dataStore PreferencesDataStore and saveToken(); change this to
keystore-backed encryption by using Jetpack Security (MasterKey) to encrypt
token values before writing and decrypt after reading. Update saveToken(), any
token-read functions (the getters around lines 27-33), and the Context.dataStore
usage to call helper encryptToken()/decryptToken() that use a MasterKey-backed
Cipher (AES-GCM) or EncryptedSharedPreferences/EncryptedFile under the hood, so
only ciphertext is stored in the DataStore and plaintext is only held
transiently in memory.

In
`@mobile/app/src/main/java/com/smartjam/app/domain/repository/AuthRepository.kt`:
- Around line 103-122: The helpers getAccessTokenExpiredIn and
getRefreshTokenExpiredIn subtract System.currentTimeMillis() (ms) from
tokenStorage.accessExpiredAt / refreshExpiredAt which are stored as epoch
seconds, producing values off by ~1000x; fix by converting current time to
seconds (e.g., use System.currentTimeMillis() / 1000 or
TimeUnit.MILLISECONDS.toSeconds(...)) before subtraction so accessExpiredAt -
currTimeSeconds and refreshExpiredAt - currTimeSeconds return correct remaining
seconds, keeping the existing null checks and return types.

In `@mobile/app/src/main/java/com/smartjam/app/MainActivity.kt`:
- Around line 52-57: Decide the start destination from stored auth state before
instantiating SmartJamNavGraph: query the auth state (via authRepository or
tokenStorage) in MainActivity (or a suspend/LaunchedEffect) to determine whether
user is authenticated, then either create SmartJamNavGraph with an explicit
startDestination parameter set to "home" or "login", or pass a boolean like
isAuthenticated into SmartJamNavGraph and have the graph use that to set the
initial route; ensure this decision is made prior to constructing
SmartJamNavGraph (where navController, authRepository, connectionRepository,
tokenStorage are currently passed).

In `@mobile/app/src/main/java/com/smartjam/app/ui/navigation/NavGraph.kt`:
- Around line 37-40: NavHost is currently hardcoded to startDestination =
Screen.Home.route which bypasses auth; compute a startDestination beforehand by
reading the persisted auth state (e.g., isLoggedIn/token) and pass that variable
into NavHost instead of Screen.Home.route. Locate the NavHost usage and replace
the literal with a startDestination derived from your auth persistence check (or
a small loading/composed guard that waits for persisted state via
remember/LaunchedEffect), e.g., determine if user is authenticated then choose
Screen.Home.route or Screen.Login.route and use that variable in NavHost to
ensure the auth flow runs on cold start.

In `@mobile/app/src/main/java/com/smartjam/app/ui/screens/home/HomeViewModel.kt`:
- Around line 107-114: In onJoinRoomClicked(), read and use a trimmed invite
code: replace the raw access of _state.value.inviteCodeInput with a trimmed
value (e.g., val code = _state.value.inviteCodeInput.trim()), use that for the
isBlank() check and pass the trimmed code to
connectionRepository.joinByCode(code); ensure any state updates or logging that
rely on the code use the trimmed variable rather than the original input.