fix(release): surface companion build and secure GitWorkshop deps

neode-ui/src/components/CompanionIntroOverlay.vue

@@ -143,6 +143,11 @@ import { ref, onMounted, onUnmounted, watch } from 'vue'
 import * as QRCode from 'qrcode'
 import { IS_DEMO, DEMO_PASSWORD } from '@/composables/useDemoIntro'
 import { companionIntroRequested } from '@/composables/useCompanionIntro'
+import {
+  companionRelease,
+  companionReleaseMarker,
+  loadCompanionRelease,
+} from '@/composables/useCompanionRelease'
 import { isCompanionApp } from '@/utils/openExternal'
 import { useLoginTransitionStore } from '@/stores/loginTransition'
 import { useServerStore } from '@/stores/server'
@@ -163,17 +168,7 @@ const DEFAULT_DOWNLOAD_URL = IS_DEMO
 // metadata (ships in the frontend beside the APK at /packages/), written by
 // publish-companion-apk.sh from the same gradle config that built the APK.
 // Best-effort: no file, no note.
-const companionVersion = ref<{ versionName: string; versionCode: number } | null>(null)
-async function loadCompanionVersion() {
-  try {
-    const res = await fetch('/packages/archipelago-companion.json', { cache: 'no-store' })
-    if (!res.ok) return
-    const meta = await res.json()
-    if (meta && typeof meta.versionName === 'string' && meta.versionName) {
-      companionVersion.value = { versionName: meta.versionName, versionCode: Number(meta.versionCode) || 0 }
-    }
-  } catch { /* metadata is a nicety — the download works without it */ }
-}
+const companionVersion = companionRelease
 
 // Deep-link scheme the companion app registers; carries the server entry the
 // app should create (see docs/companion-pairing-qr.md for the contract).
@@ -213,10 +208,13 @@ let calmTicker: ReturnType<typeof setInterval> | null = null
 // it. Server management for connected companions lives in the NESMenu instead.
 const IN_COMPANION_APP = isCompanionApp()
 
-onMounted(() => {
+onMounted(async () => {
   if (IN_COMPANION_APP) return
+  // The prompt is remembered per APK build, not forever. A browser that saw
+  // 0.5.28 should be told once when this node begins serving 0.5.32.
+  await loadCompanionRelease()
   try {
-    if (localStorage.getItem(STORAGE_KEY) !== '1') {
+    if (localStorage.getItem(STORAGE_KEY) !== companionReleaseMarker(companionVersion.value)) {
       setTimeout(maybeShow, BASE_DELAY_MS)
     }
   } catch {
@@ -267,7 +265,7 @@ watch(companionIntroRequested, (requested) => {
 
 watch(visible, async (isVisible) => {
   if (!isVisible) return
-  if (!companionVersion.value) void loadCompanionVersion()
+  if (!companionVersion.value) void loadCompanionRelease()
   // Generate large and let CSS scale down — at 112px source a ~45-module QR
   // is 2.5px/module, which camera decoders (the companion app included)
   // routinely fail on. 512px keeps every module crisp.
@@ -454,7 +452,7 @@ function dismiss() {
   visible.value = false
   step.value = 'download'
   try {
-    localStorage.setItem(STORAGE_KEY, '1')
+    localStorage.setItem(STORAGE_KEY, companionReleaseMarker(companionVersion.value))
   } catch {
     // ignore
   }

neode-ui/src/composables/__tests__/useCompanionRelease.test.ts

@@ -0,0 +1,42 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import {
+  companionRelease,
+  companionReleaseMarker,
+  loadCompanionRelease,
+} from '../useCompanionRelease'
+
+beforeEach(() => {
+  companionRelease.value = null
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('companion release metadata', () => {
+  it('uses the Android build number as the durable prompt marker', () => {
+    expect(companionReleaseMarker({ versionName: '0.5.32', versionCode: 52 })).toBe('build:52')
+    expect(companionReleaseMarker({ versionName: '0.5.32', versionCode: 0 })).toBe(
+      'version:0.5.32',
+    )
+    expect(companionReleaseMarker(null)).toBe('1')
+  })
+
+  it('loads the same no-cache metadata used by the download prompt', async () => {
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({ versionName: '0.5.32', versionCode: 52 }),
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(loadCompanionRelease()).resolves.toEqual({
+      versionName: '0.5.32',
+      versionCode: 52,
+    })
+    expect(companionRelease.value).toEqual({ versionName: '0.5.32', versionCode: 52 })
+    expect(fetchMock).toHaveBeenCalledWith('/packages/archipelago-companion.json', {
+      cache: 'no-store',
+    })
+  })
+})

neode-ui/src/composables/useCompanionRelease.ts

@@ -0,0 +1,51 @@
+import { ref } from "vue";
+
+export interface CompanionRelease {
+  versionName: string;
+  versionCode: number;
+}
+
+// One shared value keeps the Discover banner and the automatic/manual
+// Companion prompt on exactly the same release metadata.
+export const companionRelease = ref<CompanionRelease | null>(null);
+
+let releaseRequest: Promise<CompanionRelease | null> | null = null;
+
+export function loadCompanionRelease(): Promise<CompanionRelease | null> {
+  if (companionRelease.value) return Promise.resolve(companionRelease.value);
+  if (releaseRequest) return releaseRequest;
+
+  releaseRequest = fetch("/packages/archipelago-companion.json", {
+    cache: "no-store",
+  })
+    .then(async (response) => {
+      if (!response.ok) return null;
+      const metadata = await response.json();
+      if (
+        !metadata ||
+        typeof metadata.versionName !== "string" ||
+        !metadata.versionName
+      )
+        return null;
+
+      companionRelease.value = {
+        versionName: metadata.versionName,
+        versionCode: Number(metadata.versionCode) || 0,
+      };
+      return companionRelease.value;
+    })
+    .catch(() => null)
+    .finally(() => {
+      releaseRequest = null;
+    });
+
+  return releaseRequest;
+}
+
+export function companionReleaseMarker(
+  release: CompanionRelease | null,
+): string {
+  if (release?.versionCode) return `build:${release.versionCode}`;
+  if (release?.versionName) return `version:${release.versionName}`;
+  return "1";
+}

neode-ui/src/views/discover/CompanionBanner.vue

@@ -30,7 +30,9 @@
           @click.stop="openCompanionIntro()"
           class="glass-button rounded-lg px-6 py-2.5 text-sm font-medium"
         >Install</button>
-        <span class="text-white/40 text-sm">Archipelago Companion · Android</span>
+        <span class="text-white/40 text-sm">
+          Archipelago Companion · Android<template v-if="companionRelease"> · v{{ companionRelease.versionName }} (build {{ companionRelease.versionCode }})</template>
+        </span>
       </div>
     </div>
 
@@ -44,11 +46,16 @@
 </template>
 
 <script setup lang="ts">
-import { computed } from 'vue'
+import { computed, onMounted } from 'vue'
 import { isCompanionApp } from '@/utils/openExternal'
 import { openCompanionIntro } from '@/composables/useCompanionIntro'
+import { companionRelease, loadCompanionRelease } from '@/composables/useCompanionRelease'
 
 const showPitch = computed(() => !isCompanionApp())
+
+onMounted(() => {
+  if (showPitch.value) void loadCompanionRelease()
+})
 </script>
 
 <style scoped>