[davidschachterADFA]

ADFA-4930

PR 2 of 4 in the stack from docs/superpowers/plans/2026-10-14-adfa-4930-build-output-off-fuse.md, based on #2149. Merge #2149 first; this PR's diff is two commits.

Why. With "Relocate build output" on (#2149), Quick Build's setup.json and a plugin project's .cgp are no longer under <project>/build, which is where the IDE looked for them. That folder holds either nothing, so Quick Build fails with "variant setup missing" and plugin builds with ".cgp not found", or a stale report from before the relocation, which Quick Build would then read as current.

What it does. Both lookups resolve against the build directory in the synced project model: the module's for setup.json, the root project's for the .cgp. The model and the output agree because, since #2149, builds follow the synced model rather than the live switch.

• QuickBuildTaskPaths.setupJson(buildDir, variant) returns the report under the build directory it is given. The provisioner passes module.buildDir and drops its guess between <module>/build and <project>/build.
• findPluginCgpFile(workspace, variant) looks for the .cgp under workspace.rootProject.buildDir/plugin.
• quickbuild/docs/debugging.md lists the relocated setup.json location.

Verified

• Unit tests: the GradleQuickBuildProvisioner* suites, QuickBuildTaskPathsTest, PluginCgpLookupTest and the BuildViewModel* suites, 68/68. The new GradleQuickBuildProvisionerBuildDirTest fails against the old lookup on both cases: a report only under a relocated build directory (provisioning fails), and a stale report left in the project folder (the stale one is read). PluginCgpLookupTest fails against the old <project>/build/plugin lookup the same two ways.
• On a Galaxy Note20 Ultra (Android 13), debug APK, experiments on, relocation on. Quick Build on a project that still had a setup.json in app/build from an earlier, unrelocated build reached Ready and launched the proxy app. It read the tree's report, written at 16:27, not the project folder's from 15:57.
• Same phone, My Plugin1 (single-module plugin project): the build put myplugin1-debug.cgp under the tree's main/root-<hash>/plugin/, the project had no build/ folder, and the IDE offered "Install Plugin".
• On a Pixel 6 Pro (Android 17), at d29e9c8: Quick Build reached Ready reading the tree's setup.json, not a stale project-folder copy, and a new plugin project's .cgp was found in app storage with no build/ in the project.
• Sites checked: grepping main sources for "build/ paths finds only these two lookups. The Gradle plugin's KDocs still say build/quickbuild/<variant>/setup.json, meaning the project's build directory, and are left as is.

Not in this PR. Deleting output with its project, the orphan sweep and Export APK are PR 3. Turning relocation on by default is PR 4.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VKUthHVokuWKgP3ACLBii7

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[davidschachterADFA]

IMPORTANT

• GradleQuickBuildProvisioner.kt:465 - a failed or cancelled sync leaves the model's build dir disagreeing with the builds' (defect in #2149)

MINOR

• BuildViewModel.kt:158 - the .cgp lookup change has no test pinning it

NITPICK - 2 inline, not listed

Verdict: computed REQUEST_CHANGES (one confirmed IMPORTANT). Posted as COMMENT because GitHub refuses REQUEST_CHANGES on your own PR. REVIEW.md has no approve/request-changes rule (it calls itself a coaching doc), so the pr-review default table applied; CLAUDE.md ties the move to QA to no outstanding critical, high or medium findings.

Stack: layer 2 of 2. #2149 (base stage) <- #2150 (this PR, the tip). Every claim was checked at the tip, d29e9c8. The IMPORTANT's real site is in #2149; it is anchored here because this PR's lookups depend on it.

Earlier rounds: the only prior review is the claude[bot] manual-review notice, with no findings, so there was nothing to re-check.

Evidence

• Ticket (plan, PR 2): setup.json and .cgp lookups from the model, with tests for both. setup.json: done, two new tests (the PR body says both fail against the old lookup; not re-run here). .cgp: done, no test (MINOR inline).
• Section 1, exceptions: no new throw paths. A missing workspace ends in BuildState.Error, not a crash.
• Section 3, threading: the .cgp lookup runs on Dispatchers.IO; the setup.json check runs where the old one did.
• Section 5, coverage: not measured; this review did not build or run tests.
• Section 7, sweep: git grep at the tip finds no other IDE code that builds a <project>/build path. buildDirPath is absolute (tooling-api-impl/.../serial/GradleProjectExts.kt:20).
• Section 13, plugins: no plugin-API surface touched. .cgp format unchanged; PluginBuilder already writes under layout.buildDirectory.
• Sections 8-9: no UI change.

Leads checked and not posted

• A stale setup.json left in the same build dir after a variant stops being debuggable is read as current. Pre-existing: the old lookup also only checked isFile.
• No fallback when the workspace is null. Not reachable in practice (a plugin build starts from the model), and a <project>/build fallback would reintroduce the stale read this PR removes.
• The .cgp error no longer names build/plugin. A judgment call: the path is now app-private.
• docs/PLUGIN_AUTHORING.md still gives my-plugin/build/plugin/*.cgp. Still true: it describes ./gradlew builds from the repo, which do not run the IDE's init script.
• ProxyAppInfo.kt:14 KDoc says build/quickbuild/setup.json. There build/ means the build directory; the PR body already notes these KDocs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 976e2ecd-a901-478b-b497-80366400bde8

📥 Commits

Reviewing files that changed from the base of the PR and between d984d16 and b0648b8.

📒 Files selected for processing: 8

• app/src/main/java/com/itsaky/androidide/quickbuild/GradleQuickBuildProvisioner.kt
• app/src/main/java/com/itsaky/androidide/quickbuild/QuickBuildTaskPaths.kt
• app/src/main/java/com/itsaky/androidide/viewmodel/BuildViewModel.kt
• app/src/test/java/com/itsaky/androidide/quickbuild/GradleQuickBuildProvisionerBuildDirTest.kt
• app/src/test/java/com/itsaky/androidide/quickbuild/GradleQuickBuildProvisionerFakes.kt
• app/src/test/java/com/itsaky/androidide/quickbuild/QuickBuildTaskPathsTest.kt
• app/src/test/java/com/itsaky/androidide/viewmodel/PluginCgpLookupTest.kt
• quickbuild/docs/debugging.md

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📝 Summary

• Quick Build now reads variant-specific setup.json from the module’s build directory in the synced project model. This supports relocated build output and avoids reading a stale report from the project folder.
• Plugin .cgp lookup now uses the root project’s modeled build directory. It selects the newest archive whose -debug suffix matches the variant.
• Updated Quick Build path tests and added coverage for relocated output, stale reports, and plugin archive selection.
• Updated quickbuild/docs/debugging.md to document the setup.json location when build output is relocated.
• Validation reported by the author: 68 of 68 unit tests passed. Device checks were reported on a Galaxy Note20 Ultra (Android 13) and Pixel 6 Pro (Android 17). These results were not independently verified here.
• Risk: If multiple matching .cgp archives are present, lookup chooses the one with the latest modification time. No review severity counts were provided.

Quick-build provisioning now reads variant setup reports from the module’s modeled build directory. Plugin archive lookup now uses the root project’s modeled build directory. Tests and debugging documentation cover relocated build output paths.

Changes: Relocated build output support

Layer / File(s)	Summary
Setup report path and provisioning app/src/main/java/com/itsaky/androidide/quickbuild/QuickBuildTaskPaths.kt, app/src/main/java/com/itsaky/androidide/quickbuild/GradleQuickBuildProvisioner.kt, app/src/test/java/com/itsaky/androidide/quickbuild/*, quickbuild/docs/debugging.md	setupJson returns a variant-scoped File under the supplied build directory. Provisioning reads the report from the module build directory. Tests and debugging documentation cover relocated output paths.
Plugin archive lookup app/src/main/java/com/itsaky/androidide/viewmodel/BuildViewModel.kt, app/src/test/java/com/itsaky/androidide/viewmodel/PluginCgpLookupTest.kt	Plugin lookup searches under the root project’s modeled build directory. Tests cover relocated output, release and debug archive selection, and missing inputs.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: fryanpan, daniel-adfa

Merge Risk: ⚪ Minimal · up to b0648

Quick Build’s relocated-output lookups appear ready to merge after normal checks.

Security architecture risk: 🔵 Low · up to b0648

Artifact discovery now follows the synchronized build configuration instead of potentially stale project-folder output. Existing installation checks remain in place. No introduced security-control bypass was identified, but concurrency and downstream validation were not exhaustively verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — Lookup can now reach model-configured output outside the project source directory. The relevant sensitive outcomes remain proxy APK installation and IDE plugin installation on the user's device. Controlling the Gradle configuration or build output is the relevant attacker capability; the inspected change does not demonstrate additional authority beyond the existing project-build execution path.

Trust Boundaries and Controls

• observed — The selected plugin archive still enters AwaitingPluginInstall, reaches the existing confirmation dialog, and is handed to PluginRepository for validation and installation. The directory change does not introduce a direct lookup-to-plugin-load bypass. Validation depth inside PluginManager was not inspected.

Resilience and Maintainability Implications

• observed — The report-path change preserves distinct busy-slot, build-failure and ready outcomes. Missing or malformed reports fail before installation, cancellation exceptions propagate, and cancellation refuses a user-visible build. Prebuild retries and rebuild installation outcomes remain separate rather than reusing a cached warm-up result.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 20 functions across 7 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: updating Quick Build and plugin output lookup to use the project model. It is concise and specific.
Description check		The description directly explains the build-output relocation issue, the lookup changes, validation results, and out-of-scope work.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 20 functions across 7 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the build-dir trail,
Where setup reports now leave a tale.
The plugin files are gathered there,
With debug and release kept with care.
Hoppy tests confirm each path is fair.}

_{Comment @coderabbitai help to get the list of available commands.}