How to Transform My Android Phone Into a Music Box in Kiosk Mode

adb devices -l | grep "$ANDROID_SERIAL"
adb root
adb shell id

009b02032e6929c5       device usb:1-3.1.3 product:bullhead model:Nexus_5X device:bullhead transport_id:8
restarting adbd as root
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:su:s0

APK=$(ls /tmp/deezer-apk/*.xapk /tmp/deezer-apk/*.apkm /tmp/deezer-apk/*.apk 2>/dev/null | head -1)
clk android adb package install "$APK"

Archive:  a.zip
  inflating: META-INF/MANIFEST.MF
  inflating: META-INF/APKMIRRO.SF
  inflating: META-INF/APKMIRRO.RSA
  inflating: info.json
  inflating: icon.png
  inflating: base.apk
  inflating: split_config.ar.apk
  inflating: split_config.arm64_v8a.apk
  inflating: split_config.de.apk
  inflating: split_config.en.apk
  inflating: split_config.x86.apk
  inflating: split_config.es.apk
  inflating: split_config.xxhdpi.apk
  inflating: split_config.fi.apk
  inflating: split_config.xhdpi.apk
  inflating: split_config.fr.apk
  inflating: split_config.hu.apk
  inflating: split_config.it.apk
  inflating: split_config.ja.apk
  inflating: split_config.nl.apk
  inflating: split_config.pl.apk
  inflating: split_config.pt.apk
  inflating: split_config.tvdpi.apk
  inflating: split_config.ru.apk
  inflating: split_config.sv.apk
  inflating: split_config.tr.apk
  inflating: split_config.uk.apk
  inflating: split_config.armeabi_v7a.apk
  inflating: split_config.xxxhdpi.apk
  inflating: split_config.mdpi.apk
  inflating: split_config.hdpi.apk
  inflating: split_config.ldpi.apk
  inflating: split_config.x86_64.apk
 extracting: APKM_installer.url
Success

echo "--- accounts (must be empty) ---"
adb shell -T dumpsys account </dev/null \
  | grep -E "^Accounts:|Account \{" || echo "(none)"
echo "--- users (must be only user 0) ---"
adb shell -T pm list users </dev/null
echo "--- existing device owner (must be none) ---"
adb shell -T dumpsys device_policy </dev/null \
  | grep -iE "Device Owner" || echo "(none)"

pluginManagement {
    repositories {
        google()
        mavenCentral()
        gradlePluginPortal()
    }
}

dependencyResolutionManagement {
    repositories {
        google()
        mavenCentral()
    }
}

rootProject.name = "deezer-kiosk"
include ':app'

plugins {
    id 'com.android.application' version '8.7.0' apply false
}

android.useAndroidX=true
org.gradle.jvmargs=-Xmx2g -Dfile.encoding=UTF-8

plugins {
    id 'com.android.application'
}

android {
    namespace 'eu.konubinix.deezerkiosk'
    // compileSdk is the compiler's API surface, not what the device runs
    // against — targetSdk below (27) is what controls runtime behaviour.
    // The only hard floor is AGP 8.7, which refuses compileSdk < 33.
    // 34 (rather than 33) just matches the build-tools / platform my
    // android-stack flake already ships, so there's nothing extra to add
    // there — a convenience alignment, not an external constraint.
    compileSdk 34

    defaultConfig {
        applicationId "eu.konubinix.deezerkiosk"
        minSdk 21
        targetSdk 27
        versionCode 1
        versionName "1.0"
    }

    compileOptions {
        sourceCompatibility JavaVersion.VERSION_17
        targetCompatibility JavaVersion.VERSION_17
    }
}

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android">

    <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" />
    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.BLUETOOTH" />

    <application
        android:label="DeezerKiosk"
        android:allowBackup="false"
        android:testOnly="true">

        <!--
          android:theme="@android:style/Theme.Translucent.NoTitleBar.Fullscreen"
          makes MainActivity invisible: when Back from Deezer pops Deezer's
          task and falls through to ours, the user doesn't see a blank
          frame before onResume re-launches Deezer — they see whatever was
          drawn underneath (typically Deezer's last frame still in the
          buffer), which masks the flash.
        -->
        <activity android:name=".MainActivity"
                  android:exported="true"
                  android:theme="@android:style/Theme.Translucent.NoTitleBar.Fullscreen">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.HOME" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>
        </activity>

        <receiver android:name=".KioskAdmin"
                  android:permission="android.permission.BIND_DEVICE_ADMIN"
                  android:exported="true">
            <meta-data android:name="android.app.device_admin"
                       android:resource="@xml/device_admin" />
            <intent-filter>
                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
            </intent-filter>
        </receiver>

        <service android:name=".StatusOverlayService"
                 android:exported="false" />

    </application>
</manifest>

<!--
  android:theme="@android:style/Theme.Translucent.NoTitleBar.Fullscreen"
  makes MainActivity invisible: when Back from Deezer pops Deezer's
  task and falls through to ours, the user doesn't see a blank
  frame before onResume re-launches Deezer — they see whatever was
  drawn underneath (typically Deezer's last frame still in the
  buffer), which masks the flash.
-->
<activity android:name=".MainActivity"
          android:exported="true"
          android:theme="@android:style/Theme.Translucent.NoTitleBar.Fullscreen">
    <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
    </intent-filter>
    <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.HOME" />
        <category android:name="android.intent.category.DEFAULT" />
    </intent-filter>
</activity>

<receiver android:name=".KioskAdmin"
          android:permission="android.permission.BIND_DEVICE_ADMIN"
          android:exported="true">
    <meta-data android:name="android.app.device_admin"
               android:resource="@xml/device_admin" />
    <intent-filter>
        <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
    </intent-filter>
</receiver>

<service android:name=".StatusOverlayService"
         android:exported="false" />

<?xml version="1.0" encoding="utf-8"?>
<device-admin xmlns:android="http://schemas.android.com/apk/res/android">
    <uses-policies>
        <force-lock />
    </uses-policies>
</device-admin>

package eu.konubinix.deezerkiosk;

import android.app.Activity;
import android.app.admin.DevicePolicyManager;
import android.content.ComponentName;
import android.content.Intent;
import android.content.IntentFilter;
import android.content.pm.PackageManager;
import android.content.pm.ResolveInfo;
import android.os.Bundle;

import java.util.List;

public class MainActivity extends Activity {
    private static final String TARGET = "deezer.android.app";
    // Non-persist system property: ADB sets it to "1" to pause the
    // kiosk, sets it back to "" to resume. Wiped on reboot, so a reboot
    // during a pause still re-engages the kiosk on next boot.
    private static final String PAUSED_PROP = "debug.kiosk.paused";
    // Set true by StatusOverlayService when the parent completes the hidden
    // on-device unlock gesture (long-press the corner hotspot + draw the
    // correct pattern). In-memory only, on purpose: a reboot or a process
    // kill clears it, so the kiosk re-engages on the next boot / HOME — no
    // persisted state to wipe. The engage path (--ez engage true) clears it
    // explicitly to re-lock on demand. The app cannot set debug.kiosk.paused
    // itself (that property is shell/root-writable only, not from an
    // untrusted_app process), which is why the gesture uses its own flag.
    static volatile boolean sPausedByGesture = false;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        Intent launchIntent = getIntent();

        // Explicit re-engage clears a prior gesture pause so the lock re-applies
        // below. Two triggers: the engage-kiosk block's --ez engage true, and an
        // explicit launch from the app drawer (CATEGORY_LAUNCHER) — so tapping the
        // DeezerKiosk icon in Trebuchet while paused re-locks on-device, no host
        // needed. The boot/HOME start carries CATEGORY_HOME instead, so it never
        // clears the flag this way (a reboot re-engages anyway via the fresh
        // process, where the static is already false).
        boolean explicitEngage = launchIntent != null
            && (launchIntent.getBooleanExtra("engage", false)
                || (launchIntent.getCategories() != null
                    && launchIntent.getCategories().contains(Intent.CATEGORY_LAUNCHER)));
        if (explicitEngage) {
            sPausedByGesture = false;
        }

        if (isPaused()) {
            enterPausedAndHandoff();
            return;
        }

        DevicePolicyManager dpm =
            (DevicePolicyManager) getSystemService(DEVICE_POLICY_SERVICE);
        ComponentName admin = new ComponentName(this, KioskAdmin.class);
        ComponentName self  = new ComponentName(this, MainActivity.class);

        if (dpm.isDeviceOwnerApp(getPackageName())) {
            // Make ourselves the persistent default HOME activity. The
            // framework will now start us on boot (in place of Trebuchet)
            // before user space is interactive — closing the
            // BOOT_COMPLETED escape window. Idempotent: re-calling on
            // subsequent launches is a no-op once the preference is set.
            IntentFilter homeFilter = new IntentFilter(Intent.ACTION_MAIN);
            homeFilter.addCategory(Intent.CATEGORY_HOME);
            homeFilter.addCategory(Intent.CATEGORY_DEFAULT);
            dpm.addPersistentPreferredActivity(admin, homeFilter, self);

            // No PIN/pattern is set on this device — that's a hard requirement
            // so the kid can wake the screen with the power button and no auth.
            // With no secure credential, the Device Owner may disable the
            // keyguard outright, so power-on returns straight to Deezer.
            // (setKeyguardDisabled is a no-op the moment a secure lock is set,
            // so the recipe keeps screen lock = None — see the config section.)
            dpm.setKeyguardDisabled(admin, true);

            dpm.setLockTaskPackages(admin,
                new String[]{ TARGET, getPackageName() });
            startLockTask();

            // The real status bar (battery, clock, connectivity) is blanked
            // by lock task and there's no API-27 knob to bring it back. Draw
            // our own readout instead. See StatusOverlayService.
            startService(new Intent(this, StatusOverlayService.class));
        }

        launchTarget();
    }

    @Override
    protected void onResume() {
        super.onResume();
        if (isPaused()) {
            enterPausedAndHandoff();
            return;
        }
        launchTarget();
    }

    // Leave the kiosk. stopLockTask() must be called from an Activity (the
    // overlay service can't), so the gesture flow funnels through here by
    // setting sPausedByGesture and starting MainActivity. It's a no-op in the
    // ADB-pause flow (which already ran `am task lock stop`), and it exits lock
    // task in the gesture flow because we're the Device Owner's allowlisted
    // activity. Then hand HOME off to Trebuchet and finish.
    private void enterPausedAndHandoff() {
        try { stopLockTask(); } catch (Exception ignored) {}
        handoffToFallbackHome();
        finish();
    }

    private void launchTarget() {
        Intent intent =
            getPackageManager().getLaunchIntentForPackage(TARGET);
        if (intent != null) {
            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK
                          | Intent.FLAG_ACTIVITY_CLEAR_TASK);
            startActivity(intent);
        }
    }

    private boolean isPaused() {
        return sPausedByGesture || propPaused();
    }

    private boolean propPaused() {
        try {
            Class<?> sp = Class.forName("android.os.SystemProperties");
            String value = (String) sp.getMethod("get",
                String.class, String.class).invoke(null, PAUSED_PROP, "");
            return "1".equals(value);
        } catch (Exception e) {
            return false;
        }
    }

    // While paused we're still the persistent home preference, so HOME
    // would loop back to us. Hand off explicitly to whichever OTHER
    // HOME-capable activity exists (Trebuchet on LineageOS). Setting the
    // component explicitly bypasses our own persistent preference.
    private void handoffToFallbackHome() {
        // Tear down the status overlay while paused — admin uses Trebuchet.
        stopService(new Intent(this, StatusOverlayService.class));
        PackageManager pm = getPackageManager();
        Intent home = new Intent(Intent.ACTION_MAIN)
            .addCategory(Intent.CATEGORY_HOME);
        List<ResolveInfo> homes = pm.queryIntentActivities(home, 0);
        for (ResolveInfo info : homes) {
            if (!getPackageName().equals(info.activityInfo.packageName)) {
                Intent launch = new Intent(Intent.ACTION_MAIN)
                    .addCategory(Intent.CATEGORY_HOME)
                    .setComponent(new ComponentName(
                        info.activityInfo.packageName,
                        info.activityInfo.name))
                    .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
                startActivity(launch);
                return;
            }
        }
    }
}

package eu.konubinix.deezerkiosk;

import android.app.admin.DeviceAdminReceiver;

public class KioskAdmin extends DeviceAdminReceiver {
}

package eu.konubinix.deezerkiosk;

import android.app.Service;
import android.bluetooth.BluetoothAdapter;
import android.bluetooth.BluetoothProfile;
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
import android.content.pm.PackageManager;
import android.content.res.Resources;
import android.graphics.Canvas;
import android.graphics.Color;
import android.graphics.Paint;
import android.graphics.PixelFormat;
import android.graphics.PorterDuff;
import android.graphics.drawable.Drawable;
import android.media.AudioManager;
import android.net.ConnectivityManager;
import android.net.NetworkInfo;
import android.net.wifi.WifiManager;
import android.os.BatteryManager;
import android.os.Handler;
import android.os.IBinder;
import android.os.Looper;
import android.os.SystemClock;
import android.view.Gravity;
import android.view.MotionEvent;
import android.view.View;
import android.view.WindowManager;
import android.widget.ImageView;
import android.widget.LinearLayout;
import android.widget.TextView;

import java.util.ArrayList;
import java.util.List;

public class StatusOverlayService extends Service {
    private static final String SYSUI = "com.android.systemui";

    private WindowManager wm;
    private LinearLayout row;
    private TextView batteryView;
    private ImageView wifiIcon;
    private ImageView btIcon;
    private WifiManager wifi;
    private ConnectivityManager cm;
    private BluetoothAdapter bt;
    private Context sysuiCtx;        // SystemUI's context, for its status icons

    // --- hidden on-device unlock gesture ---------------------------------
    // The parent pauses the kiosk without ADB: long-press an invisible corner
    // hotspot to summon a pattern grid, then draw the secret pattern. We do NOT
    // use a fingerprint: enrolling one forces a PIN -> a secure keyguard the kid
    // would hit on every wake, and Device-Owner setKeyguardDisabled() is a no-op
    // while a PIN is set. An app-level secret needs no system credential, so the
    // device stays lock-free and the kid wakes the screen with no auth.
    private Handler handler;
    private View hotspot;            // small touchable corner window (summon)
    private PatternView patternView; // full-screen pattern grid (confirm), when shown
    // Hold this long on the hotspot to summon the grid. Well above the ~500ms
    // system long-press so a kid's stray tap won't trip it.
    private static final long LONG_PRESS_MS = 2500;
    // Auto-dismiss the grid if abandoned, so a summoned grid never sticks.
    private static final long PATTERN_TIMEOUT_MS = 15000;
    // Pattern grid is GRID x GRID dots. 6x6 gives a much larger secret space
    // than the usual 3x3, so a short pattern is already hard to shoulder-surf.
    private static final int GRID = 6;
    // The secret, as dot indices: index = row*GRID + col, 0 = top-left,
    // GRID*GRID-1 = bottom-right. The literal lives in Secret.java, which is
    // tangled from an :exports none block, so it never appears in the published
    // HTML — while still being in the source tree and the built APK (fine: only
    // the export is sensitive). Edit it in the "the secret pattern" block.
    private static final int[] SECRET = Secret.PATTERN;
    private final Runnable summon  = this::showPattern;
    private final Runnable dismiss = this::hidePattern;
    // Brute-force throttle. Counters live on the service (not the PatternView,
    // which is recreated on every summon), so dismissing and re-summoning the
    // grid does NOT reset them — otherwise a kid would just reopen it to retry
    // freely. lockUntil is an elapsedRealtime() deadline (monotonic, survives
    // re-summon, resets on reboot). Reset on a correct pattern.
    private int failCount = 0;
    private long lockUntil = 0;

    // --- idle auto power-off ---------------------------------------------
    // Power the device off after IDLE_MS with no "activity", where activity =
    // a user touch OR music playing. lastActivity (elapsedRealtime) is bumped
    // by every touch (the hotspot, and ACTION_OUTSIDE from the watcher window
    // for taps anywhere on Deezer) and, on each tick, while AudioManager says
    // music is active. So a playing playlist keeps it awake, and so does
    // browsing without playing; only genuine idle (no touch, no audio) counts.
    private AudioManager audioMgr;
    private long lastActivity;
    private static final long IDLE_MS = 20 * 60 * 1000L;   // 20 minutes
    private static final long IDLE_TICK_MS = 60 * 1000L;   // check every minute
    private final Runnable idleTick = this::checkIdle;

    private final BroadcastReceiver statusReceiver = new BroadcastReceiver() {
        @Override public void onReceive(Context c, Intent i) { render(); }
    };

    @Override
    public void onCreate() {
        super.onCreate();
        Context app = getApplicationContext();
        wm   = (WindowManager) getSystemService(WINDOW_SERVICE);
        wifi = (WifiManager) app.getSystemService(WIFI_SERVICE);
        cm   = (ConnectivityManager) app.getSystemService(CONNECTIVITY_SERVICE);
        bt   = BluetoothAdapter.getDefaultAdapter();
        try {
            sysuiCtx = createPackageContext(SYSUI, 0);
        } catch (PackageManager.NameNotFoundException e) {
            sysuiCtx = null;
        }

        float dp = getResources().getDisplayMetrics().density;
        int sz = (int)(18 * dp);   // icon box
        int sp = (int)(10 * dp);   // gap before each icon

        row = new LinearLayout(this);
        row.setOrientation(LinearLayout.HORIZONTAL);
        row.setGravity(Gravity.CENTER_VERTICAL);
        row.setPadding(16, 6, 16, 6);

        // Battery: plain text label.
        batteryView = new TextView(this);
        batteryView.setTextColor(Color.WHITE);
        batteryView.setTextSize(12);
        row.addView(batteryView);

        wifiIcon = addIcon(sz, sp);
        btIcon   = addIcon(sz, sp);

        WindowManager.LayoutParams lp = new WindowManager.LayoutParams(
            WindowManager.LayoutParams.WRAP_CONTENT,
            WindowManager.LayoutParams.WRAP_CONTENT,
            // TYPE_APPLICATION_OVERLAY: the API-26+ replacement for the
            // deprecated TYPE_SYSTEM_ALERT; draws above the app, fine on 27.
            WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY,
            // Passive overlay over Deezer: never grab focus or touches.
            WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE
              | WindowManager.LayoutParams.FLAG_NOT_TOUCHABLE
              | WindowManager.LayoutParams.FLAG_LAYOUT_IN_SCREEN,
            PixelFormat.TRANSLUCENT);
        lp.gravity = Gravity.TOP | Gravity.END;
        wm.addView(row, lp);

        handler = new Handler(Looper.getMainLooper());
        addHotspot();

        audioMgr = (AudioManager) getSystemService(AUDIO_SERVICE);
        lastActivity = SystemClock.elapsedRealtime();
        handler.postDelayed(idleTick, IDLE_TICK_MS);

        IntentFilter f = new IntentFilter();
        f.addAction(Intent.ACTION_BATTERY_CHANGED);
        f.addAction(WifiManager.RSSI_CHANGED_ACTION);
        f.addAction(WifiManager.NETWORK_STATE_CHANGED_ACTION);
        f.addAction(WifiManager.WIFI_STATE_CHANGED_ACTION);
        f.addAction(BluetoothAdapter.ACTION_STATE_CHANGED);
        f.addAction(BluetoothAdapter.ACTION_CONNECTION_STATE_CHANGED);
        registerReceiver(statusReceiver, f);
        // Wifi/bt broadcasts don't fire on register (only battery's sticky
        // does), so paint once up front for the initial state.
        render();
    }

    private ImageView addIcon(int size, int leftMargin) {
        ImageView v = new ImageView(this);
        LinearLayout.LayoutParams p = new LinearLayout.LayoutParams(size, size);
        p.leftMargin = leftMargin;
        v.setLayoutParams(p);
        // Status icons are white masks; force white so SystemUI's theme tint
        // (which we can't resolve out here) doesn't leave them black.
        v.setColorFilter(Color.WHITE, PorterDuff.Mode.SRC_IN);
        row.addView(v);
        return v;
    }

    // A SystemUI status-bar drawable, by name. getIdentifier is a resource
    // lookup (not a hidden Java API), so it's fine on API 27.
    private Drawable sysui(String name) {
        if (sysuiCtx == null) return null;
        Resources r = sysuiCtx.getResources();
        int id = r.getIdentifier(name, "drawable", SYSUI);
        return id == 0 ? null : r.getDrawable(id, sysuiCtx.getTheme());
    }

    private void render() {
        if (batteryView != null) batteryView.setText(battery());
        if (wifiIcon != null)
            // The stat_sys_wifi_* icons tint via ?attr/singleToneColor, which
            // is transparent outside SystemUI's status-bar theme; the QS wifi
            // glyphs are solid white, so they render standalone.
            wifiIcon.setImageDrawable(sysui(wifiConnected()
                ? "ic_qs_wifi_full_4" : "ic_qs_wifi_no_network"));
        if (btIcon != null)
            btIcon.setImageDrawable(sysui(btConnected()
                ? "stat_sys_data_bluetooth_connected" : "stat_sys_data_bluetooth"));
    }

    private String battery() {
        Intent i = registerReceiver(null,
            new IntentFilter(Intent.ACTION_BATTERY_CHANGED));
        if (i == null) return "";
        int level  = i.getIntExtra(BatteryManager.EXTRA_LEVEL, -1);
        int scale  = i.getIntExtra(BatteryManager.EXTRA_SCALE, 100);
        int status = i.getIntExtra(BatteryManager.EXTRA_STATUS, -1);
        boolean charging = status == BatteryManager.BATTERY_STATUS_CHARGING
                        || status == BatteryManager.BATTERY_STATUS_FULL;
        int pct = scale > 0 ? level * 100 / scale : level;
        return (charging ? "⚡ " : "") + pct + "%";
    }

    private boolean wifiConnected() {
        if (wifi == null || !wifi.isWifiEnabled()) return false;
        NetworkInfo ni = cm != null ? cm.getActiveNetworkInfo() : null;
        return ni != null && ni.isConnected()
            && ni.getType() == ConnectivityManager.TYPE_WIFI;
    }

    private boolean btConnected() {
        return bt != null && bt.isEnabled()
            && bt.getProfileConnectionState(BluetoothProfile.A2DP)
                   == BluetoothProfile.STATE_CONNECTED;
    }

    // Invisible touchable window in the top-left dead corner (Deezer has no
    // controls there). A long-press summons the pattern grid. It's touch-modal
    // within its tiny bounds, so it consumes only corner touches; the rest of
    // the screen still goes to Deezer. (Verified: a touchable overlay receives
    // touches over the lock-task foreground app even when not allowlisted; ours
    // is in the allowlisted Device-Owner app, so it's strictly safer.)
    private void addHotspot() {
        float d = getResources().getDisplayMetrics().density;
        int hs = (int)(56 * d);
        hotspot = new View(this);   // no background: invisible on purpose
        hotspot.setOnTouchListener((v, e) -> {
            switch (e.getActionMasked()) {
                case MotionEvent.ACTION_DOWN:
                    markActivity();
                    handler.postDelayed(summon, LONG_PRESS_MS);
                    return true;
                case MotionEvent.ACTION_UP:
                case MotionEvent.ACTION_CANCEL:
                    handler.removeCallbacks(summon);
                    return true;
                case MotionEvent.ACTION_OUTSIDE:
                    // A touch anywhere outside this corner (i.e. on Deezer). With
                    // FLAG_WATCH_OUTSIDE_TOUCH we get this as a notification while
                    // the touch still reaches Deezer — our window-wide activity
                    // sensor for the idle timer.
                    markActivity();
                    return true;
            }
            return true;
        });
        WindowManager.LayoutParams lp = new WindowManager.LayoutParams(
            hs, hs,
            WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY,
            WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE
              | WindowManager.LayoutParams.FLAG_WATCH_OUTSIDE_TOUCH
              | WindowManager.LayoutParams.FLAG_LAYOUT_IN_SCREEN,
            PixelFormat.TRANSLUCENT);
        lp.gravity = Gravity.TOP | Gravity.START;
        wm.addView(hotspot, lp);
    }

    private void markActivity() {
        lastActivity = SystemClock.elapsedRealtime();
    }

    // Runs every IDLE_TICK_MS. Music playing counts as activity (keeps the box
    // awake mid-playlist); a touch already bumped lastActivity directly. Once
    // neither has happened for IDLE_MS, power the device off via root.
    private void checkIdle() {
        if (audioMgr != null && audioMgr.isMusicActive()) markActivity();
        if (SystemClock.elapsedRealtime() - lastActivity >= IDLE_MS) {
            powerOff();
            return;   // shutting down; no point rescheduling
        }
        handler.postDelayed(idleTick, IDLE_TICK_MS);
    }

    // True power-off (not just screen-off) so an idle box doesn't drain the
    // battery. No app/Device-Owner API exists for shutdown, so we use root
    // (LineageOS su; the kiosk app is granted once at setup). The kid powers
    // back on with the button -> boot -> the kiosk re-engages.
    private void powerOff() {
        try {
            Runtime.getRuntime().exec(new String[]{ "su", "-c", "svc power shutdown" });
        } catch (Exception e) {
            android.util.Log.e("KioskIdle", "shutdown failed", e);
        }
    }

    private void showPattern() {
        if (patternView != null) return;   // already up
        patternView = new PatternView(this);
        patternView.setBackgroundColor(0xC0000000);   // dim the screen
        WindowManager.LayoutParams lp = new WindowManager.LayoutParams(
            WindowManager.LayoutParams.MATCH_PARENT,
            WindowManager.LayoutParams.MATCH_PARENT,
            WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY,
            // Full-screen + touchable: grabs every touch so Deezer gets none
            // while the grid is up. NOT_FOCUSABLE: leave Deezer's focus alone.
            WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE
              | WindowManager.LayoutParams.FLAG_LAYOUT_IN_SCREEN,
            PixelFormat.TRANSLUCENT);
        wm.addView(patternView, lp);
        handler.postDelayed(dismiss, PATTERN_TIMEOUT_MS);
    }

    private void hidePattern() {
        handler.removeCallbacks(dismiss);
        if (patternView != null && wm != null) {
            wm.removeView(patternView);
            patternView = null;
        }
    }

    // Called by PatternView on touch-up with the dots drawn, in order.
    private void onPatternComplete(List<Integer> seq) {
        if (seq.isEmpty()) { hidePattern(); return; }   // tap on empty area = cancel
        if (matches(seq, SECRET)) {
            failCount = 0;
            lockUntil = 0;
            hidePattern();
            triggerPause();
        } else {                                        // wrong: count + throttle
            failCount++;
            long wait = backoffMs(failCount);
            if (wait > 0) lockUntil = SystemClock.elapsedRealtime() + wait;
            if (patternView != null) patternView.reset();   // clears, then shows lockout
        }
    }

    // Escalating cooldown after wrong attempts, to defeat brute force. The first
    // couple are free (parent fat-fingering), then it climbs fast and caps at
    // 5 min — with a 6x6 space, that makes guessing hopeless. Tune to taste.
    private long backoffMs(int fails) {
        switch (fails) {
            case 1: case 2: return 0;
            case 3: return 10_000;
            case 4: return 30_000;
            case 5: return 60_000;
            default: return 300_000;
        }
    }

    private boolean isLocked() { return SystemClock.elapsedRealtime() < lockUntil; }
    private long lockRemainingMs() {
        return Math.max(0, lockUntil - SystemClock.elapsedRealtime());
    }

    private boolean matches(List<Integer> seq, int[] target) {
        if (target.length == 0 || seq.size() != target.length) return false;
        for (int i = 0; i < target.length; i++) {
            if (seq.get(i) != target[i]) return false;
        }
        return true;
    }

    // stopLockTask() is an Activity API, so route the actual unlock through
    // MainActivity: set the flag and start it. MainActivity sees isPaused(),
    // drops lock task, hands HOME to Trebuchet, and stops this service (which
    // tears down all our windows via onDestroy).
    private void triggerPause() {
        MainActivity.sPausedByGesture = true;
        startActivity(new Intent(this, MainActivity.class)
            .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK));
    }

    @Override
    public void onDestroy() {
        super.onDestroy();
        try { unregisterReceiver(statusReceiver); } catch (Exception ignored) {}
        if (handler != null) handler.removeCallbacksAndMessages(null);
        if (row != null && wm != null) { wm.removeView(row); row = null; }
        if (hotspot != null && wm != null) { wm.removeView(hotspot); hotspot = null; }
        if (patternView != null && wm != null) { wm.removeView(patternView); patternView = null; }
    }

    @Override
    public IBinder onBind(Intent intent) { return null; }

    // A minimal GRID x GRID lock-pattern view: drag across dots, they latch in
    // order, touch-up reports the sequence. Discrete dots (not free-form shape
    // matching) so the parent's pattern is recognised exactly, every time.
    private class PatternView extends View {
        private final float[] cx = new float[GRID * GRID];
        private final float[] cy = new float[GRID * GRID];
        private final List<Integer> seq = new ArrayList<>();
        private final Paint dotPaint = new Paint(Paint.ANTI_ALIAS_FLAG);
        private final Paint selPaint = new Paint(Paint.ANTI_ALIAS_FLAG);
        private final Paint linePaint = new Paint(Paint.ANTI_ALIAS_FLAG);
        private final Paint lockPaint = new Paint(Paint.ANTI_ALIAS_FLAG);
        private final Paint textPaint = new Paint(Paint.ANTI_ALIAS_FLAG);
        private float radius;

        PatternView(Context c) {
            super(c);
            dotPaint.setColor(0x66FFFFFF);
            selPaint.setColor(0xFFFFFFFF);
            linePaint.setColor(0xFFFFFFFF);
            linePaint.setStrokeWidth(8);
            lockPaint.setColor(0x55FF5555);            // dim red dots while locked
            textPaint.setColor(0xFFFF8888);
            textPaint.setTextAlign(Paint.Align.CENTER);
            textPaint.setTextSize(64);
        }

        void reset() { seq.clear(); invalidate(); }

        @Override
        protected void onSizeChanged(int w, int h, int ow, int oh) {
            float size = Math.min(w, h) * 0.85f;    // centred square grid
            float left = (w - size) / 2f, top = (h - size) / 2f;
            float step = size / (GRID - 1);
            radius = step * 0.18f;
            for (int i = 0; i < cx.length; i++) {
                cx[i] = left + (i % GRID) * step;
                cy[i] = top  + (i / GRID) * step;
            }
        }

        private int hitDot(float x, float y) {
            for (int i = 0; i < cx.length; i++) {
                if (Math.hypot(x - cx[i], y - cy[i]) <= radius * 2.0) return i;
            }
            return -1;
        }

        @Override
        public boolean onTouchEvent(MotionEvent e) {
            if (isLocked()) return true;   // cooling down: swallow touches, no latching
            switch (e.getActionMasked()) {
                case MotionEvent.ACTION_DOWN:
                case MotionEvent.ACTION_MOVE:
                    int hit = hitDot(e.getX(), e.getY());
                    if (hit >= 0 && !seq.contains(hit)) { seq.add(hit); invalidate(); }
                    return true;
                case MotionEvent.ACTION_UP:
                    onPatternComplete(seq);
                    return true;
            }
            return true;
        }

        @Override
        protected void onDraw(Canvas canvas) {
            boolean locked = isLocked();
            for (int i = 1; i < seq.size(); i++) {
                int a = seq.get(i - 1), b = seq.get(i);
                canvas.drawLine(cx[a], cy[a], cx[b], cy[b], linePaint);
            }
            for (int i = 0; i < cx.length; i++) {
                Paint p = locked ? lockPaint : (seq.contains(i) ? selPaint : dotPaint);
                canvas.drawCircle(cx[i], cy[i], radius, p);
            }
            if (locked) {
                long s = (lockRemainingMs() + 999) / 1000;
                canvas.drawText(s + "s", getWidth() / 2f, getHeight() * 0.93f, textPaint);
                postInvalidateDelayed(500);   // tick the countdown; resumes normal draw at 0
            }
        }
    }
}

cd /var/run/user/1000/musicbox
# --refresh re-resolves the flake's branch HEAD each build, so we track its
# latest instead of serving a stale revision from Nix's tarball cache.
nix develop --impure --refresh github:konubinix/devel?dir=flakes/android \
  -c gradle --no-daemon assembleDebug >&2
ipfa app/build/outputs/apk/debug/app-debug.apk | sed -r 's/\?filename.+//'

https://ipfs.konubinix.eu/p/bafkreidu5watldpn4sb54ymdqjzhurdga3skduewzgejfz5uwgvlljazym

adb install -r -t "$cid"
adb shell -T pm path eu.konubinix.deezerkiosk </dev/null

Performing Streamed Install
Success
package:/data/app/eu.konubinix.deezerkiosk-N4B6m9eaHSvAxpUYBfxvSw==/base.apk

adb shell -T dpm set-device-owner \
  eu.konubinix.deezerkiosk/.KioskAdmin </dev/null
echo "--- confirm ---"
adb shell -T dumpsys device_policy </dev/null \
  | grep -iE "Device Owner" -A2

Success: Device owner set to package ComponentInfo{eu.konubinix.deezerkiosk/eu.konubinix.deezerkiosk.KioskAdmin}
Active admin set to component {eu.konubinix.deezerkiosk/eu.konubinix.deezerkiosk.KioskAdmin}
--- confirm ---
  Device Owner:
    admin=ComponentInfo{eu.konubinix.deezerkiosk/eu.konubinix.deezerkiosk.KioskAdmin}
    name=

adb shell -T appops set eu.konubinix.deezerkiosk \
  SYSTEM_ALERT_WINDOW allow </dev/null
echo "--- confirm (should print: allow) ---"
adb shell -T appops get eu.konubinix.deezerkiosk \
  SYSTEM_ALERT_WINDOW </dev/null

--- confirm (should print: allow) ---
SYSTEM_ALERT_WINDOW: allow

# Clear the paused flag. MainActivity treats anything ≠ "1" as resumed.
adb shell -T setprop debug.kiosk.paused 0 </dev/null
# --ez engage true also clears the in-memory gesture-pause flag, so this
# re-locks even after an on-device pattern unlock (not just an ADB pause).
adb shell -T am start --ez engage true \
  -n eu.konubinix.deezerkiosk/.MainActivity </dev/null
sleep 2
echo "--- lock task state (should show LOCKED, not PINNED) ---"
adb shell -T dumpsys activity activities </dev/null \
  | grep -iE "mLockTaskModeState|mLockTaskModeTasks" | head -3
echo "--- focus ---"
adb shell -T dumpsys window </dev/null \
  | grep -E "mCurrentFocus|mFocusedApp" | head -2

Starting: Intent { cmp=eu.konubinix.deezerkiosk/.MainActivity (has extras) }
--- lock task state (should show LOCKED, not PINNED) ---
  mLockTaskModeState=LOCKED  mLockTaskPackages (userId:packages)=
 mLockTaskModeTasks[TaskRecord{aa7972 #1019 A=eu.konubinix.deezerkiosk U=0 StackId=1 sz=1}]
--- focus ---
    mFocusedApp=Token{74a7ee5 ActivityRecord{8d4eddc u0 deezer.android.app/com.deezer.ui.dynamicpage.DynamicPageRootActivity t1020}}
  mCurrentFocus=Window{ed300d u0 deezer.android.app/com.deezer.ui.dynamicpage.DynamicPageRootActivity}

# 1. Raise the "paused" flag (non-persist system property, wiped on
#    reboot). MainActivity reads this and hands HOME off to Trebuchet
#    instead of re-engaging when the home intent resolves to us.
adb shell -T setprop debug.kiosk.paused 1 </dev/null
# 2. Drop lock task mode (the DPM LOCKED state).
adb shell -T am task lock stop </dev/null
# 3. Force-stop our app so any cached MainActivity instance dies and the
#    fresh one (started by the HOME below) re-reads the property.
adb shell -T am force-stop eu.konubinix.deezerkiosk </dev/null
# 4. HOME → MainActivity → sees paused flag → hands off to Trebuchet.
adb shell -T input keyevent KEYCODE_HOME </dev/null
echo "--- lock task state (should be NONE) ---"
adb shell -T dumpsys activity activities </dev/null \
  | grep -iE "mLockTaskModeState" | head -1
echo "--- paused flag ---"
adb shell -T getprop debug.kiosk.paused </dev/null

Activity manager is not in lockTaskMode
--- lock task state (should be NONE) ---
  mLockTaskModeState=NONE  mLockTaskPackages (userId:packages)=
--- paused flag ---
1

echo "--- lockscreen disabled? (want: true) ---"
adb shell -T locksettings get-disabled </dev/null
echo "--- enrolled fingerprints (want: count 0) ---"
adb shell -T dumpsys fingerprint </dev/null | grep -oE '"count":[0-9]+' | head -1

--- lockscreen disabled? (want: true) ---
true
--- enrolled fingerprints (want: count 0) ---
"count":0

adb shell -T am task lock stop </dev/null || true
adb shell -T dpm remove-active-admin --user 0 \
  eu.konubinix.deezerkiosk/.KioskAdmin </dev/null
adb uninstall eu.konubinix.deezerkiosk

Activity manager is not in lockTaskMode
Success: Admin removed ComponentInfo{eu.konubinix.deezerkiosk/eu.konubinix.deezerkiosk.KioskAdmin}
Success

rm -rf /var/run/user/1000/musicbox