Foundations & UI
Settings Menu & Blocklist
Two Android companion fixes: surface native Settings through the in-app menu (the floating spanner button is now unreachable under the status bar), and flip notification forwarding from an allowlist to a blocklist.
Situation
Edge-to-edge enforcement (carried over from Wave A) pushed the floating settingsButton under the status bar, making native Settings untappable from the app.
Separately, the on-device notification filter was an allowlist of 6 chosen apps — and Fastmail (the user's email) wasn't among them, so useful notifications were silently dropped. The desired default is forward-everything, minus a small blocklist.
Key decisions
Minimal JS→native bridge
MainActivity exposes a single-method MalloryNative.openSettings() JavaScript interface on the WebView — one first-party origin, one method, negligible attack surface.
Spanner removed, menu item added
The floating settingsButton is deleted from the layout and its click handler; a "Settings" item is added to the web menu, gated on window.MalloryNative existing so it only shows inside the app.
Allowlist → blocklist inversion
Prefs.allowlist is replaced by Prefs.blocklist (default: system UI, the Honor launcher, and the app itself); the listener flips from if (pkg !in allowlist) return to if (pkg in blocklist) return, forwarding everything else by default.
No migration for the old key
The old "allowlist" preference key is simply abandoned — single user, no migration path needed.
Risks & guardrails
Privacy trade-off accepted
Forward-all means sensitive notifications (2FA codes, banking, personal messages) now reach the Worker and are stored in events (redacted to title/text only) — an accepted trade-off for usefulness since the seeded blocklist only removes pure system noise.
Master toggle preserved
notificationForwardingEnabled stays as a global kill switch — off still means forward nothing, regardless of the blocklist.
Delivery
Task 1
Native Settings bridge + remove the spanner.
Task 2
"Settings" item in the web menu.
Task 3
Invert allowlist → blocklist (Prefs, listener, Settings UI label).
Final
Deploy, install, and verify end-to-end (logcat + a read-only D1 event count).
Out of scope
docs/superpowers/specs/2026-06-08-settings-menu-and-blocklist-design.mdplan ·
docs/superpowers/plans/2026-06-08-settings-menu-and-blocklist.md