Fix WebSocket failure on Android release builds

[alnaggar-dev]

Summary

Release Android builds fail to open the ws:// connection to the Mac while debug builds (Expo Go and expo run:android) connect fine. Root cause: Android 9+ blocks cleartext network traffic by default, and the release manifest had no override.

Root cause

The client connects via cleartext WebSocket:

• src/state/connection.ts:8 — url: 'ws://0.0.0.0:0'
• src/state/connection.ts:112 — client.setUrl(\ws://${active.host}:${active.port}`)`
• src/state/pair.ts:38 — const url = \ws://${host}:${port}``

Cleartext is permitted in debug because the per-variant manifests include the override:

• android/app/src/debug/AndroidManifest.xml — android:usesCleartextTraffic="true"
• android/app/src/debugOptimized/AndroidManifest.xml — same

The release/main manifest (android/app/src/main/AndroidManifest.xml) had no such flag, so Android refused the socket and the user saw a generic WebSocket error.

Fix

Add the expo-build-properties config plugin so prebuild emits android:usesCleartextTraffic="true" on the main manifest:

[
  "expo-build-properties",
  {
    "android": {
      "usesCleartextTraffic": true
    }
  }
]

/android is gitignored, so the plugin in app.json is the source of truth — running npx expo prebuild --platform android (or any flow that triggers prebuild) re-applies the flag on every regeneration.

Files changed

• app.json — registers expo-build-properties plugin with android.usesCleartextTraffic: true
• package.json / package-lock.json — adds expo-build-properties dep (installed via npx expo install)

Security note

This blanket-allows cleartext to any host. For a LAN-only companion app it's acceptable. If a stricter posture is preferred, swap in a network_security_config.xml that allows cleartext only to private ranges (10/8, 172.16/12, 192.168/16, 169.254/16) — happy to follow up with that change.

Test plan

• npm run typecheck passes
• npm run lint passes
• npx expo prebuild --platform android --clean regenerates android/app/src/main/AndroidManifest.xml with android:usesCleartextTraffic="true" on the <application> tag
• Release Android build (APK or AAB) connects to the Muxy desktop server over ws:// on the local network
• Debug build still connects (no regression)
• iOS build unaffected (no Android-only plugin keys touch iOS)