add: Android share-sheet target — receive files/text from other apps

Register Vector as an ACTION_SEND / ACTION_SEND_MULTIPLE target so other apps
can share files, media, and text into it; the user picks a chat and sends.

Mirrors the deep-link model (a share foregrounds the activity, so it's never
headless): MainActivity forwards the content:// URIs + text to native, which
queues them (PENDING_SHARE) for a cold start and emits `share_received` live.
The frontend polls get_pending_share on init / listens live, drops the user on
the chat list with a "Choose a chat to forward to" toast, and on chat-open
attaches the share — files via the existing file-preview, text into the composer.

- Manifest SEND/SEND_MULTIPLE intent-filters; MainActivity handleSendIntent
  (cold + warm) with API-version-safe EXTRA_STREAM extraction.
- share.rs (PENDING_SHARE + get_pending_share command) + JNI bridge + ACL.
- Only accept content:// URIs — rejects file:// so a crafted share can't coax
  a read of our own private files.

Also fixes the Android content-URI read path these shares exercised:
- Stop percent-decoding URIs before Uri.parse — it corrupted nested-encoded
  provider URIs (e.g. Google Photos' wrapper around an encoded content:// URI).
  The encoded form is what ContentResolver expects; simple SAF picks resolve
  identically (so avatars were unaffected).
- Clear the pending JNI exception after the best-effort
  takePersistableUriPermission (share grants aren't persistable; the stale
  exception poisoned the following query/openInputStream).
- openFilePreview: don't render a video player on Android (generic icon, like
  the in-app attach path); desktop keeps inline players.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: JSKitty

src-tauri/build.rs

@@ -131,6 +131,7 @@ fn main() {
             "sync_all_profiles",
             // Deep link commands
             "get_pending_deep_link",
+            "get_pending_share",
             // Account manager commands
             "get_current_account",
             "list_all_accounts",

src-tauri/capabilities/default.json

@@ -175,6 +175,7 @@
     "allow-refresh-profile-now",
     "allow-sync-all-profiles",
     "allow-get-pending-deep-link",
+    "allow-get-pending-share",
     "allow-get-current-account",
     "allow-list-all-accounts",
     "allow-list-accounts-with-metadata",

src-tauri/gen/android/app/src/main/AndroidManifest.xml

@@ -48,6 +48,26 @@
                 <data android:scheme="vector" />
             </intent-filter>
 
+
+            <!-- Receive shares from other apps (files / media / text). Lets
+                 Vector appear as a target in the system share sheet. -->
+            <intent-filter>
+                <action android:name="android.intent.action.SEND" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="text/plain" />
+                <data android:mimeType="image/*" />
+                <data android:mimeType="video/*" />
+                <data android:mimeType="audio/*" />
+                <data android:mimeType="application/*" />
+                <data android:mimeType="*/*" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="image/*" />
+                <data android:mimeType="video/*" />
+                <data android:mimeType="*/*" />
+            </intent-filter>
             <!-- DEEP LINK PLUGIN. AUTO-GENERATED. DO NOT REMOVE. -->
             <intent-filter android:autoVerify="true" >
                 <action android:name="android.intent.action.VIEW" />

src-tauri/gen/android/app/src/main/java/io/vectorapp/MainActivity.kt

@@ -2,6 +2,7 @@ package io.vectorapp
 
 import android.content.Intent
 import android.content.pm.PackageManager
+import android.net.Uri
 import android.os.Build
 import android.webkit.WebSettings
 import android.webkit.WebView
@@ -26,6 +27,8 @@ class MainActivity : TauriActivity() {
         external fun nativeOnPause()
         @JvmStatic
         external fun nativeOnNotificationTap(chatId: String)
+        @JvmStatic
+        external fun nativeOnShareReceived(uris: Array<String>, text: String)
     }
 
     private var managedWebView: WebView? = null
@@ -51,12 +54,16 @@ class MainActivity : TauriActivity() {
 
         // Handle notification tap that launched the app
         handleNotificationIntent(intent)
+        // Handle a file/text share that launched the app
+        handleSendIntent(intent)
     }
 
     override fun onNewIntent(intent: Intent) {
         super.onNewIntent(intent)
         // Handle notification tap when app is already running
         handleNotificationIntent(intent)
+        // Handle a share that arrived while the app was running
+        handleSendIntent(intent)
     }
 
     override fun onResume() {
@@ -80,6 +87,48 @@ class MainActivity : TauriActivity() {
         }
     }
 
+    /**
+     * Handle another app sharing files/text into Vector via the share sheet.
+     * Extracts content:// URIs (single or multiple) plus any plain text and
+     * hands them to native; the frontend then lets the user pick a chat.
+     */
+    private fun handleSendIntent(intent: Intent?) {
+        if (intent == null) return
+        val action = intent.action ?: return
+        if (action != Intent.ACTION_SEND && action != Intent.ACTION_SEND_MULTIPLE) return
+
+        val uris = ArrayList<String>()
+        var text = ""
+        if (action == Intent.ACTION_SEND) {
+            streamUri(intent)?.let { uris.add(it.toString()) }
+            intent.getStringExtra(Intent.EXTRA_TEXT)?.let { text = it }
+        } else {
+            streamUris(intent)?.forEach { uris.add(it.toString()) }
+        }
+
+        // Consume so a rotation/relaunch doesn't re-share the same payload.
+        intent.action = null
+        intent.removeExtra(Intent.EXTRA_STREAM)
+        intent.removeExtra(Intent.EXTRA_TEXT)
+
+        if (uris.isEmpty() && text.isEmpty()) return
+        try { nativeOnShareReceived(uris.toTypedArray(), text) } catch (_: Throwable) {}
+    }
+
+    @Suppress("DEPRECATION")
+    private fun streamUri(intent: Intent): Uri? =
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU)
+            intent.getParcelableExtra(Intent.EXTRA_STREAM, Uri::class.java)
+        else
+            intent.getParcelableExtra(Intent.EXTRA_STREAM)
+
+    @Suppress("DEPRECATION")
+    private fun streamUris(intent: Intent): ArrayList<Uri>? =
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU)
+            intent.getParcelableArrayListExtra(Intent.EXTRA_STREAM, Uri::class.java)
+        else
+            intent.getParcelableArrayListExtra(Intent.EXTRA_STREAM)
+
     private fun requestNotificationPermission() {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
             if (ContextCompat.checkSelfPermission(

src-tauri/permissions/autogenerated/get_pending_share.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-get-pending-share"
+description = "Enables the get_pending_share command without any pre-configured scope."
+commands.allow = ["get_pending_share"]
+
+[[permission]]
+identifier = "deny-get-pending-share"
+description = "Denies the get_pending_share command without any pre-configured scope."
+commands.deny = ["get_pending_share"]

src-tauri/src/android/background_sync.rs

@@ -9,7 +9,7 @@
 //!   onPause starts standalone sync when the app is backgrounded.
 //!   onResume stops it when the app returns to foreground.
 
-use jni::objects::{GlobalRef, JClass, JObject, JString};
+use jni::objects::{GlobalRef, JClass, JObject, JObjectArray, JString};
 use jni::{JavaVM, JNIEnv};
 use nostr_sdk::prelude::*;
 use std::collections::HashSet;
@@ -149,6 +149,47 @@ pub extern "C" fn Java_io_vectorapp_MainActivity_nativeOnNotificationTap(
     }
 }
 
+/// Called from MainActivity when another app shares files/text *into* Vector
+/// (ACTION_SEND / ACTION_SEND_MULTIPLE). Forwards the content:// URIs and any
+/// text to the share handler, which stores it pending + emits to the frontend.
+#[no_mangle]
+pub extern "C" fn Java_io_vectorapp_MainActivity_nativeOnShareReceived(
+    mut env: JNIEnv,
+    _class: JClass,
+    uris: JObjectArray<'_>,
+    text: JString<'_>,
+) {
+    let mut uri_vec: Vec<String> = Vec::new();
+    if let Ok(len) = env.get_array_length(&uris) {
+        for i in 0..len {
+            if let Ok(obj) = env.get_object_array_element(&uris, i) {
+                let js = JString::from(obj);
+                // Convert into an owned String in a single statement so the
+                // JavaStr/Result temporaries (which borrow `js`) are dropped at
+                // the `;`, before `js` itself drops at the end of the block.
+                let owned: Option<String> = env.get_string(&js).ok().map(|s| s.into());
+                if let Some(s) = owned {
+                    // Only accept content:// URIs. Legitimate cross-app shares
+                    // are always content:// (Android blocks file:// in
+                    // EXTRA_STREAM); rejecting other schemes stops a crafted
+                    // share from coaxing us into reading our own private files
+                    // (e.g. file:///data/data/<pkg>/...) and sending them.
+                    if s.starts_with("content://") {
+                        uri_vec.push(s);
+                    } else if !s.is_empty() {
+                        logcat(&format!("Share: rejected non-content URI scheme: {}",
+                            s.split(':').next().unwrap_or("?")));
+                    }
+                }
+            }
+        }
+    }
+    let text: String = env.get_string(&text).map(|s| s.into()).unwrap_or_default();
+
+    logcat(&format!("Share received: {} file(s), {} text chars", uri_vec.len(), text.len()));
+    crate::share::set_pending_share(uri_vec, text);
+}
+
 /// Called by VectorNotificationService when the foreground service starts.
 /// Stores JNI refs and data_dir for later use. In service-only mode (no Activity),
 /// immediately starts the standalone sync. In full-app mode, standalone sync is

src-tauri/src/android/filesystem.rs

@@ -4,32 +4,6 @@ use jni::objects::{JObject, JValue, JString};
 use crate::message::{AttachmentFile, FileInfo};
 use super::utils::{with_android_context, get_content_resolver, STREAM_BUFFER_SIZE};
 
-/// Simple percent-decoding for URIs (e.g., %3A -> :)
-fn percent_decode(input: &str) -> String {
-    let mut result = String::with_capacity(input.len());
-    let mut chars = input.chars().peekable();
-    
-    while let Some(c) = chars.next() {
-        if c == '%' {
-            // Try to read two hex digits
-            let hex: String = chars.by_ref().take(2).collect();
-            if hex.len() == 2 {
-                if let Ok(byte) = u8::from_str_radix(&hex, 16) {
-                    result.push(byte as char);
-                    continue;
-                }
-            }
-            // If decoding failed, keep the original
-            result.push('%');
-            result.push_str(&hex);
-        } else {
-            result.push(c);
-        }
-    }
-    
-    result
-}
-
 /// Get file info from an Android content URI
 pub fn get_android_uri_info(uri: String) -> Result<FileInfo, String> {
     with_android_context(|env, activity| {
@@ -44,8 +18,10 @@ fn get_android_uri_info_internal(
     content_resolver: &JObject,
     uri: &str,
 ) -> Result<FileInfo, Box<dyn std::error::Error>> {
-    // URL decode the URI in case it's encoded (e.g., %3A -> :)
-    let decoded_uri = percent_decode(uri);
+    // Use the URI as-is. Android delivers canonically-encoded URIs; decoding
+    // here would corrupt nested-encoded URIs (e.g. Google Photos provider URIs
+    // that wrap a percent-encoded content:// MediaStore URI), breaking the read.
+    let decoded_uri = uri.to_string();
 
     // Parse URI
     let uri_string = env.new_string(&decoded_uri)?;
@@ -188,15 +164,20 @@ fn try_take_persistable_permission(
     content_resolver: &JObject,
     uri_object: &JObject,
 ) {
-    // Try to take persistable read permission
-    // This may fail if the URI doesn't support it, which is fine
+    // Try to take persistable read permission. SAF picks (ACTION_OPEN_DOCUMENT)
+    // support this; share grants (ACTION_SEND) do NOT and throw a
+    // SecurityException. We don't care either way — but we MUST clear the
+    // pending JNI exception afterward, or the next JNI call (query /
+    // openInputStream) inherits it and fails, which silently breaks reading
+    // every shared content:// URI.
     let flag_read = 1i32; // Intent.FLAG_GRANT_READ_URI_PERMISSION
     let _ = env.call_method(
         content_resolver,
         "takePersistableUriPermission",
         "(Landroid/net/Uri;I)V",
         &[JValue::Object(uri_object), JValue::Int(flag_read)],
     );
+    let _ = env.exception_clear();
 }
 
 /// Read raw bytes from an Android content URI (for compression)
@@ -213,8 +194,9 @@ fn read_android_uri_bytes_internal(
     content_resolver: &JObject,
     uri: &str,
 ) -> Result<(Vec<u8>, String), Box<dyn std::error::Error>> {
-    // URL decode the URI in case it's encoded
-    let decoded_uri = percent_decode(uri);
+    // Use the URI as-is (see note in get_android_uri_info_internal): decoding
+    // would corrupt nested-encoded URIs like Google Photos provider URIs.
+    let decoded_uri = uri.to_string();
 
     // Parse URI
     let uri_string = env.new_string(&decoded_uri)?;
@@ -339,8 +321,9 @@ fn read_from_android_uri_internal(
     content_resolver: &JObject,
     uri: &str,
 ) -> Result<AttachmentFile, Box<dyn std::error::Error>> {
-    // URL decode the URI in case it's encoded
-    let decoded_uri = percent_decode(uri);
+    // Use the URI as-is (see note in get_android_uri_info_internal): decoding
+    // would corrupt nested-encoded URIs like Google Photos provider URIs.
+    let decoded_uri = uri.to_string();
 
     // Parse URI
     let uri_string = env.new_string(&decoded_uri)?;

src-tauri/src/lib.rs

@@ -62,6 +62,7 @@ pub mod stored_event {
 pub use vector_core::{StoredEvent, StoredEventBuilder};
 
 mod deep_link;
+mod share;
 
 // Mini Apps (WebXDC-compatible) support
 mod miniapps;
@@ -599,6 +600,7 @@ pub fn run() {
             commands::mls::accept_mls_welcome,
             // Deep link commands
             deep_link::get_pending_deep_link,
+            share::get_pending_share,
             // Account manager commands
             account_manager::get_current_account,
             account_manager::list_all_accounts,

src-tauri/src/share.rs

@@ -0,0 +1,47 @@
+//! Inbound share handler.
+//!
+//! When another app shares files or text *into* Vector via the Android share
+//! sheet (ACTION_SEND / ACTION_SEND_MULTIPLE), MainActivity forwards the
+//! payload here. The frontend then lets the user pick a chat and sends it.
+//!
+//! Mirrors the deep-link pattern: store as pending (the frontend may not be
+//! ready on a cold start) AND emit live (if it already is).
+
+use serde::Serialize;
+use std::sync::Mutex;
+
+/// Pending inbound share, received before the frontend was ready.
+static PENDING_SHARE: Mutex<Option<SharePayload>> = Mutex::new(None);
+
+/// A share received from another app.
+#[derive(Debug, Clone, Serialize, Default)]
+pub struct SharePayload {
+    /// `content://` URIs of shared files (may be empty for a text-only share).
+    pub uris: Vec<String>,
+    /// Shared plain text (empty when only files were shared).
+    pub text: String,
+}
+
+/// Store an inbound share and emit it to the frontend if it's running.
+pub fn set_pending_share(uris: Vec<String>, text: String) {
+    if uris.is_empty() && text.is_empty() {
+        return;
+    }
+    let payload = SharePayload { uris, text };
+
+    if let Ok(mut pending) = PENDING_SHARE.lock() {
+        *pending = Some(payload.clone());
+    }
+
+    if let Some(handle) = crate::TAURI_APP.get() {
+        use tauri::Emitter;
+        let _ = handle.emit("share_received", &payload);
+    }
+}
+
+/// Get and clear any pending inbound share. The frontend polls this on init to
+/// catch a cold-start share that arrived before its listener was attached.
+#[tauri::command]
+pub fn get_pending_share() -> Option<SharePayload> {
+    PENDING_SHARE.lock().ok().and_then(|mut p| p.take())
+}

src/js/file-preview.js

@@ -643,12 +643,22 @@ async function openFilePreview(filepath, receiver, replyRef = '') {
             appendSpoilerToggle(imgCont, shouldAutoSpoiler);
         }
     } else if (isVideo) {
-        const videoSrc = mediaUrl(filepath);
-        contentArea.innerHTML = `
-            <div class="file-preview-video-container">
-                <video src="${videoSrc}" class="file-preview-video" controls muted></video>
-            </div>
-        `;
+        if (isAndroid) {
+            // Video preview is unreliable on Android; show a generic film icon
+            // (matches openFilePreviewWithFile, the in-app attach path).
+            contentArea.innerHTML = `
+                <div class="file-preview-icon-container">
+                    <div class="icon icon-film file-preview-icon"></div>
+                </div>
+            `;
+        } else {
+            const videoSrc = mediaUrl(filepath);
+            contentArea.innerHTML = `
+                <div class="file-preview-video-container">
+                    <video src="${videoSrc}" class="file-preview-video" controls muted></video>
+                </div>
+            `;
+        }
     } else {
         // Show file icon
         const iconClass = getFileIcon(filepath);