[tompsota]

Stacked on #243 (feat/unified-api). Removes Pigeon from the plugin.

Why

Pigeon carried only two Android-to-Dart calls (onMalwareDetected, onOngoingCallDetected) and three types. Everything else already used hand-written channels. Because of that split, malware and ongoing call reached Dart on a separate channel from the other threats, with its own registration, and the generated TalsecPigeonApi leaked into the public API as the superclass of ThreatCallback.

What changes

Transport

• Android sends every detection on the existing threat EventChannel (talsec.app/freerasp/events):
  • a plain threat as its int code (unchanged)
  • malware as {type: "malware", suspiciousApps: [...]}
  • ongoing call as {type: "ongoingCall", state: "started" | "ongoing" | "stopped"}
• ThreatDispatcher has a single sink and cache. Malware app details are resolved in PluginThreatHandler when the detection arrives.
• iOS already sends only ints and is unchanged.

Dart

• attachListener uses one subscription and dispatches ints and maps in arrival order.
• An unknown code, unknown payload or malformed payload terminates the app, as an unknown threat code already does.
• onThreatDetected stays Stream<Threat> and skips the payload events.

Types

• PackageInfo, SuspiciousAppInfo and CallState are hand-written under the same names.
• They are immutable, with value equality and toString.
• fromMap is @internal.

Removed

• pigeons/, the generated Dart and Kotlin, and the pigeon dev dependency.

Breaking (in CHANGELOG)

• ThreatCallback no longer extends TalsecPigeonApi, and onMalwareDetected/onOngoingCallDetected are gone. Use the onMalware/onOngoingCall callbacks.
• PackageInfo/SuspiciousAppInfo fields are final and encode/decode are removed.

Verified

• flutter analyze is clean and 91 tests pass, including new tests:
  • ordered delivery of threat, malware and call-state events
  • onThreatDetected filtering out payload events
  • fromMap parsing and its failure on a malformed map
• The example debug APK builds.
• On the Pixel 4 emulator (API 33):
  • the malware sheet lists the suspicious apps with names, reasons and icons
  • threats and execution states are shown
  • the OngoingCall row goes Not detected → Started → Stopped through a real (emulated) call
• The first run hit an ANR while the freshly booted emulator was overloaded (load 34, main thread idle in its message loop). A clean relaunch showed no ANR.
• iOS not run; its code is untouched.

🤖 Generated with Claude Code