feat(security): Normal vs Strict, and stop VirusTotal owning the install button

Three problems, one cause: VirusTotal was wired as if everyone wanted it
pushed at them.

**Scan took the primary button from everyone.** ApkInfoContent gave the
primary slot to "Scan with VirusTotal" until a verdict existed. For the
many users with no API key that button could never produce one, so
Install stayed demoted behind a scan that would only ever report a
missing key. Install is primary now unless the user asked otherwise.

**One setting, two levels.** The old STRICT_VIRUSTOTAL_CHECK boolean only
governed the risk gate; the pushy button was unconditional. Replaced with
SecurityLevel:

- Normal (default) — Install is the main button, VirusTotal stays
  available in the details, an unscanned file is not a risk.
- Strict — the previous behaviour, unchanged.

Existing installs keep what they had: SecurityLevel.from() falls back to
the old boolean when the new key has never been written, and the setter
keeps both in step.

**Offered during onboarding.** Strict changes every install afterwards and
is useless without an API key, so the VirusTotal page now asks rather
than defaulting silently. The keys live in :core/SharedPrefsKeys because
onboarding is there while the install flow that reads them is in :app.

Settings replaces the switch with a labelled two-option selector — the
old switch said "strict check" without ever saying what normal was.

Builds clean; not verified on device — USB dropped before I could run it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: nqmgaming

app/src/main/java/app/pwhs/universalinstaller/presentation/install/ApkInfoContent.kt

@@ -141,6 +141,8 @@ internal fun ApkInfoContent(
     onSelectUserId: (Int?) -> Unit = {},
     startCompact: Boolean = true,
     onUnblock: (String) -> Unit = {},
+    /** Strict security level: Scan takes the primary button until a verdict exists. */
+    strictSecurity: Boolean = false,
 ) {
     val context = LocalContext.current
     val currentMappingProfileId = appProfileMapping[apkInfo.packageName]
@@ -397,7 +399,10 @@ internal fun ApkInfoContent(
         if (isExpanded) {
             HorizontalDivider(thickness = 0.5.dp, color = MaterialTheme.colorScheme.outlineVariant)
         }
-        val isScanCompleted = apkInfo.vtResult?.status in setOf(VtStatus.CLEAN, VtStatus.MALICIOUS, VtStatus.SUSPICIOUS)
+        val hasVerdict = apkInfo.vtResult?.status in setOf(VtStatus.CLEAN, VtStatus.MALICIOUS, VtStatus.SUSPICIOUS)
+        // Strict makes Scan the primary action until a verdict exists. Normal never does — the
+        // scan is still reachable from the VirusTotal card in the details.
+        val isScanCompleted = hasVerdict || !strictSecurity
         val isScanning = apkInfo.vtResult?.status in setOf(VtStatus.SCANNING, VtStatus.UPLOADING, VtStatus.QUEUED, VtStatus.ANALYZING)
 
         Column(

app/src/main/java/app/pwhs/universalinstaller/presentation/install/DialogInstallActivity.kt

@@ -70,6 +70,7 @@ import androidx.compose.ui.window.DialogProperties
 import app.pwhs.universalinstaller.IntentHandoff
 import app.pwhs.universalinstaller.R
 import app.pwhs.universalinstaller.presentation.setting.PreferencesKeys
+import app.pwhs.universalinstaller.presentation.setting.SecurityLevel
 import app.pwhs.core.data.local.dataStore
 import app.pwhs.universalinstaller.presentation.install.dialog.DialogFailedContent
 import app.pwhs.universalinstaller.presentation.install.dialog.DialogInstallingContent
@@ -217,7 +218,10 @@ class DialogInstallActivity : ComponentActivity() {
             val prefs by context.dataStore.data.collectAsState(initial = null)
             val autoOpenAfterInstall = prefs?.get(PreferencesKeys.AUTO_OPEN_AFTER_INSTALL) ?: false
             val autoConfirmExternalInstall = prefs?.get(PreferencesKeys.AUTO_CONFIRM_EXTERNAL_INSTALL) ?: false
-            val strictVirusTotalCheck = prefs?.get(PreferencesKeys.STRICT_VIRUSTOTAL_CHECK) ?: false
+            val strictVirusTotalCheck = SecurityLevel.from(
+                stored = prefs?.get(PreferencesKeys.SECURITY_LEVEL),
+                legacyStrict = prefs?.get(PreferencesKeys.STRICT_VIRUSTOTAL_CHECK) ?: false,
+            ) == SecurityLevel.Strict
 
             // Tracks whether we've actually observed the captured session in the repository.
             // The session is added inside controller.install() AFTER createSession() suspends,

app/src/main/java/app/pwhs/universalinstaller/presentation/install/InstallScreen.kt

@@ -4,6 +4,7 @@ import android.content.Intent
 import android.net.Uri
 import android.widget.Toast
 import app.pwhs.universalinstaller.presentation.setting.PreferencesKeys
+import app.pwhs.universalinstaller.presentation.setting.SecurityLevel
 import app.pwhs.core.data.local.dataStore
 import app.pwhs.universalinstaller.util.BiometricGate
 import kotlinx.coroutines.flow.map
@@ -91,9 +92,14 @@ fun InstallScreen(
         }
     }.collectAsState(initial = true)
 
+    // Strict is the only level that treats an unscanned file as a risk and lets the Scan button
+    // take the primary slot; Normal keeps VirusTotal available without pushing it.
     val strictVirusTotalCheck by remember(context) {
         context.dataStore.data.map {
-            it[PreferencesKeys.STRICT_VIRUSTOTAL_CHECK] ?: false
+            SecurityLevel.from(
+                stored = it[PreferencesKeys.SECURITY_LEVEL],
+                legacyStrict = it[PreferencesKeys.STRICT_VIRUSTOTAL_CHECK] ?: false,
+            ) == SecurityLevel.Strict
         }
     }.collectAsState(initial = false)
 
@@ -179,6 +185,7 @@ fun InstallScreen(
         onRetry = viewModel::retrySession,
         onDismissSession = viewModel::dismissSession,
         onUnblock = viewModel::unblockPackage,
+        strictSecurity = strictVirusTotalCheck,
         onClearHistory = viewModel::clearHistory,
         onCheckVirusTotal = { viewModel.scanVirusTotal(context) },
         onStartDeviceScan = { viewModel.startDeviceScan(context) },
@@ -251,6 +258,7 @@ private fun InstallUi(
     onRetry: (java.util.UUID) -> Unit = {},
     onDismissSession: (java.util.UUID) -> Unit = {},
     onUnblock: (String) -> Unit = {},
+    strictSecurity: Boolean = false,
     onClearHistory: () -> Unit = {},
     onCheckVirusTotal: () -> Unit = {},
     onStartDeviceScan: () -> Unit = {},
@@ -493,6 +501,7 @@ private fun InstallUi(
                 onSelectUserId = onSelectUserId,
                 startCompact = true,
                 onUnblock = onUnblock,
+                strictSecurity = strictSecurity,
             )
         }
     }

app/src/main/java/app/pwhs/universalinstaller/presentation/setting/SettingScreen.kt

@@ -101,6 +101,7 @@ fun SettingScreen(
     val dhizukuState by viewModel.dhizukuState.collectAsState()
     val useDhizuku by viewModel.useDhizuku.collectAsState()
     val blacklist by viewModel.blacklist.collectAsState()
+    val securityLevel by viewModel.securityLevel.collectAsState()
     val context = androidx.compose.ui.platform.LocalContext.current
 
     // Dhizuku can be granted or revoked in its own app while we are backgrounded.
@@ -120,7 +121,8 @@ fun SettingScreen(
         uiState = uiState,
         onInstallModeChanged = viewModel::setInstallMode,
         onVirusTotalKeyChanged = viewModel::setVirusTotalApiKey,
-        onStrictVirusTotalCheckChanged = viewModel::setStrictVirusTotalCheck,
+        securityLevel = securityLevel,
+        onSecurityLevelChanged = viewModel::setSecurityLevel,
         onShizukuOptionChanged = viewModel::setShizukuOption,
         dhizukuState = dhizukuState,
         useDhizuku = useDhizuku,
@@ -170,7 +172,8 @@ private fun SettingUi(
     uiState: SettingUiState = SettingUiState(),
     onInstallModeChanged: (InstallMode) -> Unit = {},
     onVirusTotalKeyChanged: (String) -> Unit = {},
-    onStrictVirusTotalCheckChanged: (Boolean) -> Unit = {},
+    securityLevel: SecurityLevel = SecurityLevel.Normal,
+    onSecurityLevelChanged: (SecurityLevel) -> Unit = {},
     onShizukuOptionChanged: (Preferences.Key<Boolean>, Boolean) -> Unit = { _, _ -> },
     onReplayTutorial: () -> Unit = {},
     // Not in SettingUiState: that is built by an index-based combine() and extending it means
@@ -691,11 +694,9 @@ private fun SettingUi(
                             placeholder = { Text(stringResource(R.string.setting_vt_api_key_placeholder)) },
                             singleLine = true,
                         )
-                        SwitchPreference(
-                            title = stringResource(R.string.setting_vt_strict_check_title),
-                            subtitle = stringResource(R.string.setting_vt_strict_check_summary),
-                            checked = uiState.strictVirusTotalCheck,
-                            onCheckedChange = onStrictVirusTotalCheckChanged
+                        SecurityLevelSelector(
+                            current = securityLevel,
+                            onChange = onSecurityLevelChanged,
                         )
                     }
                 }
@@ -994,3 +995,56 @@ private fun InstallModeSelector(
         )
     }
 }
+
+
+/**
+ * Normal vs Strict, as a segmented pair rather than a switch.
+ *
+ * A switch labelled "strict check" said nothing about what normal was, and the pushy Scan button
+ * was on regardless — including for the many users with no API key at all. Two named levels make
+ * the trade explicit and let Normal actually mean "stay out of the way".
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+private fun SecurityLevelSelector(
+    current: SecurityLevel,
+    onChange: (SecurityLevel) -> Unit,
+) {
+    Column(modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp)) {
+        Text(
+            text = stringResource(R.string.setting_security_level_title),
+            style = MaterialTheme.typography.titleSmall,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+            modifier = Modifier.padding(bottom = 8.dp),
+        )
+        SingleChoiceSegmentedButtonRow(modifier = Modifier.fillMaxWidth()) {
+            SecurityLevel.entries.forEachIndexed { index, level ->
+                SegmentedButton(
+                    selected = level == current,
+                    onClick = { if (level != current) onChange(level) },
+                    shape = SegmentedButtonDefaults.itemShape(
+                        index = index,
+                        count = SecurityLevel.entries.size,
+                    ),
+                    label = {
+                        Text(
+                            when (level) {
+                                SecurityLevel.Normal -> stringResource(R.string.setting_security_normal)
+                                SecurityLevel.Strict -> stringResource(R.string.setting_security_strict)
+                            }
+                        )
+                    },
+                )
+            }
+        }
+        Spacer(Modifier.height(8.dp))
+        Text(
+            text = when (current) {
+                SecurityLevel.Normal -> stringResource(R.string.setting_security_normal_sub)
+                SecurityLevel.Strict -> stringResource(R.string.setting_security_strict_sub)
+            },
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+    }
+}

app/src/main/java/app/pwhs/universalinstaller/presentation/setting/SettingViewModel.kt

@@ -61,6 +61,7 @@ object PreferencesKeys {
     val INSTALL_USER_ID = intPreferencesKey("install_user_id")
     val VIRUSTOTAL_API_KEY = stringPreferencesKey("virustotal_api_key")
     val STRICT_VIRUSTOTAL_CHECK = booleanPreferencesKey("strict_virustotal_check")
+    val SECURITY_LEVEL = stringPreferencesKey("security_level")
     val DELETE_APK_AFTER_INSTALL = booleanPreferencesKey("delete_apk_after_install")
 
     /** Open the app automatically after a successful install (with a 3-second cancellable countdown). */
@@ -185,6 +186,30 @@ fun RootOptions.asCommon() = CommonInstallOptions(
     bypassLowTargetSdk, allUsers, setInstallSource, installerPackageName,
 )
 
+/**
+ * How hard the app pushes VirusTotal.
+ *
+ * [Normal] is the default: scanning stays available but never takes over the UI, and installing
+ * an unscanned file is not treated as a risk. [Strict] is the previous behaviour — Scan becomes
+ * the primary action until a verdict exists, and an unscanned file raises the risk dialog.
+ *
+ * Replaces the old STRICT_VIRUSTOTAL_CHECK boolean, which only covered the risk gate and left the
+ * pushy button behaviour on for everyone, including people with no API key.
+ */
+enum class SecurityLevel {
+    Normal, Strict;
+
+    companion object {
+        /**
+         * @param legacyStrict the old STRICT_VIRUSTOTAL_CHECK value, honoured when the new key
+         *   has never been written — someone who opted into strict checking keeps it.
+         */
+        fun from(stored: String?, legacyStrict: Boolean = false): SecurityLevel =
+            entries.firstOrNull { it.name == stored }
+                ?: if (legacyStrict) Strict else Normal
+    }
+}
+
 enum class InstallMode {
     DEFAULT, SHIZUKU, ROOT;
 
@@ -243,7 +268,6 @@ data class SettingUiState(
     val useShizuku: Boolean = false,
     val useRoot: Boolean = false,
     val virusTotalApiKey: String = "",
-    val strictVirusTotalCheck: Boolean = false,
     val deleteApkAfterInstall: Boolean = false,
     val autoOpenAfterInstall: Boolean = false,
     val shizukuState: ShizukuState = ShizukuState.NOT_INSTALLED,
@@ -472,6 +496,30 @@ class SettingViewModel(
         }
     }
 
+    /**
+     * Normal vs Strict. Its own flow rather than a SettingUiState field: that state is assembled
+     * by an index-based combine whose interfaceFlags slot is a List<Boolean>, and this is neither
+     * a boolean nor worth renumbering the block for.
+     */
+    val securityLevel: StateFlow<SecurityLevel> = dataStore.data
+        .map {
+            SecurityLevel.from(
+                stored = it[PreferencesKeys.SECURITY_LEVEL],
+                legacyStrict = it[PreferencesKeys.STRICT_VIRUSTOTAL_CHECK] ?: false,
+            )
+        }
+        .stateIn(viewModelScope, SharingStarted.Eagerly, SecurityLevel.Normal)
+
+    fun setSecurityLevel(level: SecurityLevel) {
+        viewModelScope.launch {
+            dataStore.edit { prefs ->
+                prefs[PreferencesKeys.SECURITY_LEVEL] = level.name
+                // Keep the legacy key in step so anything still reading it agrees.
+                prefs[PreferencesKeys.STRICT_VIRUSTOTAL_CHECK] = level == SecurityLevel.Strict
+            }
+        }
+    }
+
     /** Packages the user has blocked from ever being installed. */
     val blacklist: StateFlow<List<String>> = dataStore.data
         .map { InstallBlacklist.read(it).sorted() }
@@ -982,7 +1030,6 @@ class SettingViewModel(
             useShizuku = useShizuku,
             useRoot = useRoot && (rootState == RootState.READY || rootState == RootState.UNKNOWN),
             virusTotalApiKey = vtKey,
-            strictVirusTotalCheck = strictVirusTotal,
             deleteApkAfterInstall = deleteApk,
             autoOpenAfterInstall = autoOpen,
             shizukuState = shizukuState,

app/src/main/res/values-vi/strings.xml

@@ -728,6 +728,11 @@
     <string name="setting_section_advanced">Nâng cao</string>
     <string name="setting_vt_api_key_title">Khóa API VirusTotal</string>
     <string name="setting_vt_api_key_placeholder">Dán khóa API vào đây…</string>
+    <string name="setting_security_level_title">Mức bảo mật</string>
+    <string name="setting_security_normal">Bình thường</string>
+    <string name="setting_security_strict">Nghiêm ngặt</string>
+    <string name="setting_security_normal_sub">Cài đặt là nút chính. VirusTotal vẫn nằm trong phần chi tiết khi bạn cần.</string>
+    <string name="setting_security_strict_sub">Quét VirusTotal trở thành nút chính cho tới khi file có kết quả, và cài thứ chưa quét sẽ phải xác nhận. Cần API key.</string>
     <string name="setting_vt_strict_check_title">Kiểm tra VirusTotal nghiêm ngặt</string>
     <string name="setting_vt_strict_check_summary">Cảnh báo trước khi cài đặt nếu tệp chưa được quét</string>
     <string name="setting_diagnostics_title">Chẩn đoán</string>

app/src/main/res/values-zh/strings.xml

@@ -769,6 +769,11 @@
     <string name="scan_virustotal_btn">扫描 VirusTotal</string>
     <string name="skip_and_install_btn">跳过并安装</string>
     <string name="scanning_progress">正在扫描…</string>
+    <string name="setting_security_level_title">安全级别</string>
+    <string name="setting_security_normal">普通</string>
+    <string name="setting_security_strict">严格</string>
+    <string name="setting_security_normal_sub">安装是主按钮。需要时仍可在详情中使用 VirusTotal。</string>
+    <string name="setting_security_strict_sub">在文件有扫描结果之前，VirusTotal 扫描会成为主按钮；安装未扫描的文件时会要求确认。需要 API 密钥。</string>
     <string name="setting_vt_strict_check_title">严格的 VirusTotal 检查</string>
     <string name="setting_vt_strict_check_summary">如果文件未扫描，在安装前警告</string>
 </resources>

app/src/main/res/values/strings.xml

@@ -754,6 +754,11 @@
     <string name="setting_section_advanced">Advanced</string>
     <string name="setting_vt_api_key_title">VirusTotal API Key</string>
     <string name="setting_vt_api_key_placeholder">Paste API key here…</string>
+    <string name="setting_security_level_title">Security level</string>
+    <string name="setting_security_normal">Normal</string>
+    <string name="setting_security_strict">Strict</string>
+    <string name="setting_security_normal_sub">Install is the main button. VirusTotal is still there in the details when you want it.</string>
+    <string name="setting_security_strict_sub">Scan with VirusTotal becomes the main button until a file has a verdict, and installing something unscanned asks for confirmation. Needs an API key.</string>
     <string name="setting_vt_strict_check_title">Strict VirusTotal check</string>
     <string name="setting_vt_strict_check_summary">Warn before installing if the file has not been scanned</string>    <string name="setting_diagnostics_title">Diagnostics</string>
     <string name="setting_installer_package_title">Installer Package</string>

core/src/main/java/app/pwhs/core/data/local/SharedDataStore.kt

@@ -4,6 +4,7 @@ import android.content.Context
 import androidx.datastore.core.DataStore
 import androidx.datastore.preferences.core.Preferences
 import androidx.datastore.preferences.core.booleanPreferencesKey
+import androidx.datastore.preferences.core.stringPreferencesKey
 import androidx.datastore.preferences.preferencesDataStore
 
 val Context.dataStore: DataStore<Preferences> by preferencesDataStore(name = "settings")
@@ -13,4 +14,13 @@ object SharedPrefsKeys {
 
     /** TV: when true (default) and root is available, install silently via the root shell. */
     val ROOT_SILENT_INSTALL = booleanPreferencesKey("tv_root_silent_install")
+
+    /**
+     * "Normal" or "Strict". Declared here because onboarding lives in :core but the setting is
+     * read by the phone app's install flow; both sides must agree on the key name.
+     */
+    val SECURITY_LEVEL = stringPreferencesKey("security_level")
+
+    /** Legacy companion to [SECURITY_LEVEL], kept in step so older read sites still agree. */
+    val STRICT_VIRUSTOTAL_CHECK = booleanPreferencesKey("strict_virustotal_check")
 }