If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:

1. Verify the contract. Run the bash script in Verify before trusting below. If any check returns FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding.
2. Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
3. Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/Universal-Debloater-Alliance/universal-android-debloater-next-generation shows verifiable citations alongside every claim.

If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.

WAIT — Mixed signals — read the receipts

• Last commit 2d ago
• 28+ active contributors
• Distributed ownership (top contributor 31% of recent commits)
• GPL-3.0 licensed
• CI configured
• ⚠ GPL-3.0 is copyleft — check downstream compatibility
• ⚠ No test directory detected

_{Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests}

This artifact was generated by RepoPilot at a point in time. Before an agent acts on it, the checks below confirm that the live Universal-Debloater-Alliance/universal-android-debloater-next-generation repo on your machine still matches what RepoPilot saw. If any fail, the artifact is stale — regenerate it at repopilot.app/r/Universal-Debloater-Alliance/universal-android-debloater-next-generation.

What it runs against: a local clone of Universal-Debloater-Alliance/universal-android-debloater-next-generation — the script inspects git remote, the LICENSE file, file paths in the working tree, and git log. Read-only; no mutations.

| # | What we check | Why it matters | |---|---|---| | 1 | You're in Universal-Debloater-Alliance/universal-android-debloater-next-generation | Confirms the artifact applies here, not a fork | | 2 | License is still GPL-3.0 | Catches relicense before you depend on it | | 3 | Default branch main exists | Catches branch renames | | 4 | Last commit ≤ 32 days ago | Catches sudden abandonment since generation |

#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of Universal-Debloater-Alliance/universal-android-debloater-next-generation. If you don't
# have one yet, run these first:
#
#   git clone https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation.git
#   cd universal-android-debloater-next-generation
#
# Then paste this script. Every check is read-only — no mutations.

set +e
fail=0
ok()   { echo "ok:   $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }

# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
  echo "FAIL: not inside a git repository. cd into your clone of Universal-Debloater-Alliance/universal-android-debloater-next-generation and re-run."
  exit 2
fi

# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "Universal-Debloater-Alliance/universal-android-debloater-next-generation(\\.git)?\\b" \\
  && ok "origin remote is Universal-Debloater-Alliance/universal-android-debloater-next-generation" \\
  || miss "origin remote is not Universal-Debloater-Alliance/universal-android-debloater-next-generation (artifact may be from a fork)"

# 2. License matches what RepoPilot saw
(grep -qiE "^(GPL-3\\.0)" LICENSE 2>/dev/null \\
   || grep -qiE "\"license\"\\s*:\\s*\"GPL-3\\.0\"" package.json 2>/dev/null) \\
  && ok "license is GPL-3.0" \\
  || miss "license drift — was GPL-3.0 at generation time"

# 3. Default branch
git rev-parse --verify main >/dev/null 2>&1 \\
  && ok "default branch main exists" \\
  || miss "default branch main no longer exists"

# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 32 ]; then
  ok "last commit was $days_since_last days ago (artifact saw ~2d)"
else
  miss "last commit was $days_since_last days ago — artifact may be stale"
fi

echo
if [ "$fail" -eq 0 ]; then
  echo "artifact verified (0 failures) — safe to trust"
else
  echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/Universal-Debloater-Alliance/universal-android-debloater-next-generation"
  exit 1
fi

Each check prints ok: or FAIL:. The script exits non-zero if anything failed, so it composes cleanly into agent loops (./verify.sh || regenerate-and-retry).

Universal Android Debloater NG is a cross-platform Rust GUI (built with Iced 0.14.0 and WebGPU backend) that connects to Android devices via ADB to remove bloatware and system apps without requiring root access. It improves device privacy, security, and battery life by reducing attack surface through selective uninstallation of unnecessary packages fetched from resources/assets/uad_lists.json. Monolithic Rust binary: src/core/ contains ADB bridge (adb.rs), config management (config.rs), package list sync (sync.rs, uad_lists.rs), theme/UI state (theme.rs), and persistence (save.rs). GUI layer sits above core via Iced framework. Resources in resources/assets/ hold static package metadata (uad_lists.json, icons.ttf, manifest.rc). Build configuration in build.rs (Windows resource embedding via embed-resource), Cargo.toml defines feature flags (wgpu, self-update, img).

Privacy-conscious Android users who want to debloat non-rooted devices without adb knowledge, and developers/maintainers who contribute device-specific package lists and app descriptions. Secondary audience: developers of companion projects like Canta and AppManager who integrate with UAD-ng's package data.

Actively developed and production-ready. Version 1.2.0 with v1.0.2+ release screenshots and established CI/CD (build_artifacts.yml, release.yml, ci.yml). Community-backed with issue templates for bugs, features, packages, and documentation. Stable enough for end-users with active governance (Universal-Debloater-Alliance organization), though the disclaimer in README acknowledges inherent risk of system app removal.

Low code risk: dependencies are minimal and well-established (iced, serde, ureq, fern). Primary risk is domain-specific—removing wrong system apps can brick devices, but this is user risk not code risk. Single-organization maintenance (Universal-Debloater-Alliance) means bus factor is organizational rather than individual. No obvious stale code (CI workflows exist, Cargo.lock present).

Active development cycle: v1.2.0 is current; release.yml and build_artifacts.yml suggest automated CI/CD pipeline. Issue templates indicate ongoing focus on package list curation (3-add-new-packages.yml), debloat accuracy (4-debloat-issue-report.yml), and documentation. Discord/Matrix channels active for real-time support. Self-update feature (src/core/update.rs) suggests rolling release cadence.

git clone https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation.git
cd universal-android-debloater-next-generation
cargo build --release
# Binary will be in target/release/uad-ng

Note: Requires Rust toolchain (Edition 2024) and ADB installed separately on system. For dev/debug builds, use cargo build (no --release flag).

Daily commands: Debug: cargo run (default features include wgpu, self-update, img). Release: cargo build --release then ./target/release/uad-ng. Optimized build (for distribution): cargo build --profile opt (thin LTO, codegen-units=4, release optimizations, strip enabled). Binaries automatically embed Windows resources (manifest.rc) via build.rs.

• src/core/adb.rs: Core bridge between GUI and Android devices—all adb shell commands for package inspection and removal flow through this module
• resources/assets/uad_lists.json: The canonical package database; defines which apps are safe to debloat by device/vendor, fetched at runtime by src/core/uad_lists.rs
• src/core/uad_lists.rs: Fetches and parses uad_lists.json from GitHub; implements retry logic and caching; critical for package recommendation accuracy
• src/core/config.rs: Serde-based config serialization to TOML; manages user preferences, selected packages, and state persistence via dirs crate
• src/core/sync.rs: Orchestrates multi-device sync logic; likely handles batch operations and state reconciliation across devices
• Cargo.toml: Defines feature flags (wgpu, self-update, img), platform-specific dependencies (Windows vs Unix), and profile optimizations (release vs opt)
• .github/workflows/ci.yml: CI pipeline definition; reveals test strategy, build matrix, and quality gates required for PRs

To add new packages: Edit resources/assets/uad_lists.json (JSON array of package objects) and file issue using .github/ISSUE_TEMPLATE/3-add-new-packages.yml. To fix ADB logic: modify src/core/adb.rs (shell command construction and parsing). To change UI/theme: edit src/core/theme.rs and GUI state in src/core/mod.rs (Iced message handlers). To adjust config storage: modify src/core/config.rs (serde structures and dirs crate paths). To update app metadata: use .github/ISSUE_TEMPLATE/5-update-apps-description-or-recommendation.yml workflow.

Platform-specific builds: Windows needs embed-resource crate (build.rs); Unix self-update requires flate2/tar (conditional deps in Cargo.toml). ADB requirement: Application assumes system adb binary is in PATH; no fallback or bundling. Feature flags: self-update and img are optional; building with --no-default-features may break functionality. Config location: Uses dirs crate which returns platform-specific paths (~/.config/uad-ng on Linux, AppData on Windows)—config won't be found if dirs crate returns None. GitHub fetch dependencies: uad_lists.rs and update.rs make external HTTP calls; offline mode untested. Iced version pin: Cargo.toml hardpins Iced to =0.14.0 (not ^0.14.0); Iced 0.15+ may introduce breaking changes but won't auto-update.

• Android Debug Bridge (ADB) — ADB is the communication protocol between the GUI and Android device; understanding adb shell syntax, device state, and package management commands is prerequisite to modifying adb.rs
• Attack Surface Reduction — Core security principle underlying the entire project—removing system packages reduces exposed code and potential vulnerabilities; critical to understanding why certain packages are flagged for removal
• Elm Architecture (in Iced) — Iced uses Elm-inspired message/update/view pattern; understanding this is essential for modifying UI logic, handling user input, and managing application state transitions
• Serde Derive Macros — Config.rs and uad_lists.rs rely heavily on serde's #[derive] macros for TOML/JSON serialization; understanding attribute syntax and error handling is needed for data model changes
• Cargo Feature Flags (Conditional Compilation) — Build configuration uses feature flags (wgpu, self-update, img) to toggle optional functionality; understanding conditional compilation is needed to avoid breaking builds or creating platform-specific regressions
• Cross-Platform Path Resolution — dirs crate abstracts platform-specific config paths; config.rs depends on knowing how Windows AppData, Linux ~/.config, and macOS Preferences differ to avoid broken deployments
• Retry Logic & Exponential Backoff — uad_lists.rs uses the retry crate for network resilience; understanding retry strategies is important for reliability when fetching package lists from GitHub API

• 0x192/universal-android-debloater — Original UAD project that UAD-NG is forked from; provides historical context and may have alternative implementations of debloat logic
• samolego/Canta — Mobile Android debloater that integrates UAD-NG's Universal Debloat List; shows how package data is consumed by downstream tools
• MuntashirAkon/AppManager — Advanced Android app manager that bridges with UAD-NG ecosystem; reference for multi-device app state management patterns
• MuntashirAkon/android-debloat-list — Community-driven debloat list format; competitor/companion to uad_lists.json; useful for understanding package taxonomy decisions
• iced-rs/iced — Upstream GUI framework (v0.14.0); essential for understanding widget state, event routing, and renderer integration (WebGPU)

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Add unit tests for src/core/adb.rs with ADB command mocking

The ADB module (src/core/adb.rs) is critical for device communication but likely lacks unit tests. Adding comprehensive tests with mocked ADB responses would improve reliability, catch regressions in device command execution, and serve as documentation for expected ADB behavior. This is especially valuable given the safety-critical nature of debloating operations.

• [ ] Create src/core/adb/tests.rs or add #[cfg(test)] module to src/core/adb.rs
• [ ] Mock ADB command execution using a trait-based approach or mockall crate
• [ ] Add tests for: device detection, package listing, uninstall operations, and error handling
• [ ] Test edge cases like disconnected devices, malformed ADB responses, and permission errors
• [ ] Run tests in CI via .github/workflows/ci.yml

Add integration tests for src/core/uad_lists.rs with sample JSON fixtures

The uad_lists.rs module parses resources/assets/uad_lists.json which defines all debloatable packages. Currently there appears to be no test coverage for JSON parsing, validation, or handling of malformed data. Integration tests with fixtures would prevent silent parsing failures and ensure schema changes don't break the package database.

• [ ] Create tests/fixtures/ directory with sample uad_lists.json variants (valid, missing fields, duplicates)
• [ ] Add integration tests in tests/uad_lists_integration.rs
• [ ] Test: successful parsing, missing required fields, duplicate package IDs, version compatibility
• [ ] Add a test that validates the actual resources/assets/uad_lists.json against the schema
• [ ] Document the uad_lists.json schema in CONTRIBUTING.md

Add GitHub Actions workflow to validate uad_lists.json and package descriptions on PRs

Issue template .github/ISSUE_TEMPLATE/3-add-new-packages.yml and 5-update-apps-description-or-recommendation.yml exist but there's no automated validation of submitted packages. Contributors could submit malformed JSON or invalid entries. A dedicated CI workflow would catch issues early, reduce maintainer review burden, and enforce consistency.

• [ ] Create .github/workflows/validate_packages.yml
• [ ] Add JSON schema validation for resources/assets/uad_lists.json using ajv-cli or jsonschema tool
• [ ] Validate: required fields present, no duplicate package IDs, version strings are valid semver
• [ ] Add package description length/format checks (prevent excessive whitespace, validate recommendation field)
• [ ] Trigger on PRs that modify uad_lists.json or related package files, post results as PR comment

• Add unit tests for src/core/config.rs serde round-trip (parse TOML → struct → TOML). Helpful because config corruption is a common real-world issue and no test file exists for this critical module.
• Document the JSON schema for resources/assets/uad_lists.json in a new docs/PACKAGE_LIST_FORMAT.md file with examples. Helpful because contributors adding packages currently reverse-engineer the format; a schema would reduce submission friction.
• Implement offline mode fallback in src/core/uad_lists.rs: cache last-fetched package list to disk and load it if GitHub fetch fails. Helpful for users in poor network conditions and teaches error handling + persistent storage patterns.

• Medium · Outdated Edition Specification — Cargo.toml. The Cargo.toml specifies edition = "2024", but Rust's latest stable edition is 2021. Edition 2024 does not exist and will cause compilation failures or unexpected behavior. This is likely a configuration error. Fix: Update edition to "2021" or the latest supported edition that matches your MSRV (Minimum Supported Rust Version).
• Medium · Loose Dependency Version Pinning — Cargo.toml dependencies section. Multiple dependencies use caret (^) version specifications without upper bounds, such as chrono (^0.4), fern (^0), and toml (^0). These allow potentially breaking changes in minor or patch versions. This could introduce security patches but also unexpected behavioral changes. Fix: Consider using more restrictive version specifications (e.g., =X.Y.Z or ~X.Y) for security-critical dependencies. At minimum, review breaking changes in transitive dependencies regularly.
• Medium · Unvalidated External HTTP Requests — Cargo.toml (ureq dependency), likely src/core/update.rs. The dependency 'ureq' is used for HTTP requests (version 3 with json feature). Without visible validation in the file structure, there's risk of SSRF (Server-Side Request Forgery) or handling of untrusted remote data, especially given the self-update functionality that downloads artifacts. Fix: Implement strict URL validation, use HTTPS exclusively, verify TLS certificates, and validate all remote JSON responses. Add timeouts and size limits on downloaded content.
• Medium · Potential Command Injection via ADB — src/core/adb.rs. The application interfaces with ADB (Android Debug Bridge) as a core function. If user input or package names are not properly escaped/sanitized before being passed to ADB commands, this could lead to command injection vulnerabilities. Fix: Use parameterized/argument arrays instead of string concatenation when invoking ADB. Never directly interpolate user input into shell commands. Implement strict input validation and whitelisting for package names.
• Low · Self-Update Feature Security — Cargo.toml (self-update feature), src/core/update.rs. The self-update feature (enabled by default) downloads and executes code from remote sources. While using tar/flate2 for compression is standard, there's limited visibility into signature verification or checksum validation mechanisms. Fix: Implement cryptographic signature verification (using GPG or similar) for downloaded updates. Verify checksums against a signed manifest. Consider using established update frameworks. Document the update security model clearly.
• Low · Insufficient Linting Rules — Cargo.toml clippy lints section. The clippy configuration allows struct_field_names which can hide naming convention violations. Additionally, while disallowed_types and disallowed_methods are set to deny, there's no explicit configuration visible for other security-relevant lints. Fix: Enable additional security-focused lints like unsafe_code analysis, add documentation for why struct_field_names is allowed, and consider enabling more pedantic checks.
• Low · CSV Parsing Without Explicit Validation — Cargo.toml (csv dependency), likely src/core/uad_lists.rs. The 'csv' crate is included (version ^1.3) but without visible input validation, there could be issues with malformed CSV data handling, particularly from the UAD lists JSON which may reference CSV data. Fix: Implement strict schema validation for CSV imports. Use try-catch patterns and provide clear error messages. Sanitize any CSV data before using it in system commands.
• Low · Debug Information in Release Builds — Cargo.toml profile.release section. The release profile uses opt-level = 2 (medium optimization) rather than 3 (maximum), and doesn't explicitly disable debug symbols. This could leak information in release binaries. Fix: Add 'strip = true' and 'debug = false' to the release profile to minimize binary size and remove debug information. Ensure the opt profile is used for production releases.
• Low · No Explicit SPDX License in Resource — undefined. undefined Fix: undefined

LLM-derived; treat as a starting point, not a security audit.

• Open issues — current backlog
• Recent PRs — what's actively shipping
• Source on GitHub

Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.