jerboa-webex

Experimental Jerboa CLI and library code for Webex API workflows.

The repository builds a jwebex command, includes Webex modules under src/, and uses Jerboa plus native runtime support for HTTPS and related integrations.

Status

Private/experimental. Do not publish or use with production Webex credentials until the production gates in ../jerboa-production-readiness.md are complete.

Build

make binary
make release-evidence

Test

make test

Android APK

The Android client is generated entirely from Typed Jerboa in support/android/; generated Kotlin under build/ is disposable output. It supports saved Webex profiles, spaces and direct rooms, message history and paging, channel posts, replies to individual messages, avatars, and inline image attachments. Conversation screens keep the post composer visible below the scrolling history, show the newest messages first, and refresh every three seconds while visible so incoming replies appear without reopening the space. Unchanged refreshes preserve any draft being typed. The visible Back button and Android system back gesture both return to the main spaces screen instead of exiting the app. On Android 13 and newer, accept the notification permission prompt to receive an alert for every newly detected incoming message across all spaces. Existing history and messages sent by the active user are not alerted.

export JANDROID_REPO=/path/to/jerboa-android
make android-apk-test

JDK_HOME=$($JANDROID_REPO/scripts/verified-jdk.sh --home)
ANDROID_HOME=$HOME/Library/Android/sdk \
ANDROID_SDK_ROOT=$HOME/Library/Android/sdk \
JAVA_HOME=$JDK_HOME \
  $JANDROID_REPO/scripts/verified-gradle.sh --no-daemon \
  -p build/android-webex assembleDebug

make android-emulator-smoke

The debug APK is written to build/android-webex/app/build/outputs/apk/debug/app-debug.apk. The first launch opens Settings, where a Webex access token can be validated and saved. Bearer credentials are attached only to canonical https://webexapis.com:443 requests; downloads are bounded to 25 MiB and redirects are revalidated before authentication.

Webex query enum values are case-sensitive. The spaces request uses sortBy=lastactivity, and make android-apk-test guards that exact contract.

Security

Webex access tokens, webhook secrets, local store keys, API responses, message exports, and downloaded attachments are production secrets or workspace data. Credential handling and log redaction are documented in docs/credential-handling.md; native dependency provenance is documented in docs/dependency-provenance.md; local release evidence is documented in docs/release-evidence.md; repository support status and release blockers are documented in SECURITY.md.