Dex Window Debug

Debugging windows on the DeX desktop display

Everything here talks to openandroiddex-wmd, the shell-uid daemon. It exists because MANAGE_ACTIVITY_TASKS is what lets anything enumerate, move, re-order or inset another app's task, and the launcher (a normal app) can never hold it.

Run commands from PowerShell, not Git Bash

Git Bash rewrites /data/local/tmp/... into a Windows path and the command fails with inaccessible or not found. Every snippet below assumes PowerShell.

Build, push, start the daemon

cmd /c "openandroiddex-wmd\build.cmd push"     # javac + d8 + adb push, no Gradle
adb shell "pkill -f WmDaemon"
adb shell "setsid sh -c 'CLASSPATH=/data/local/tmp/wmd.dex exec app_process /system/bin com.ccrstech.openandroiddex.wmd.WmDaemon > /data/local/tmp/wmd.log 2>&1' &"
adb shell "cat /data/local/tmp/wmd.log"        # expect: wmd listening on 127.0.0.1:7191 uid=2000

setsid is required: a plain background job dies with the adb shell that launched it.

Talk to it

adb shell "printf 'PING`nBYE`n' | toybox nc 127.0.0.1 7191"

Never hard-code the display id — it changes every scrcpy session, and dead sessions leave virtual displays behind that look identical to the live one. Ask the daemon:

adb shell "printf 'DESKTOP com.ccrstech.openandroiddex.launcher`nBYE`n' | toybox nc 127.0.0.1 7191"

Protocol: PING · DESKTOP <pkg> · LIST <display> · STRIP <display> <task> <px> [inset] · UNSTRIP · MOVE <display> <task> <x> <y> · BOUNDS <display> <task> <l> <t> <r> <b> · FRONT · BACK · FOCUSABLE <display> <task> <0|1> · CLOSE <task> · BYE.

LIST returns topmost first, 17 whitespace fields:

TASK ix id display mode actType vis  l t r b   al at ar ab   pkg activity
                                     └ bounds ┘ └ appBounds ┘

appBounds.top > bounds.top means a caption strip is reserved. Field 15 is the package — reading 14 instead renders window titles as a y coordinate.

From the PC instead of the device

adb forward tcp:7191 tcp:7191     # then talk to 127.0.0.1:7191 from Windows
adb forward --remove tcp:7191

Measured RTT over USB: median 2.57 ms, p95 5.30 ms.

One-shot probes without the daemon

adb shell "CLASSPATH=/data/local/tmp/wmd.dex app_process /system/bin com.ccrstech.openandroiddex.wmd.Probe <cmd>"

caps (what is reachable at this uid) · list <display> · move <display> <task> <dx> <dy> <legacy|transition|resize> · strip <display> <task> <px> · stack <display> <low> <high> · focusable · sig <wct|wms|atm|woc|CLASS> [filter] — dump real method signatures, because hidden-API shapes vary by build and OEM. Guessing one throws inside system_server.

Verify chrome actually renders

dumpsys bounds only prove the Configuration changed. To prove pixels, read the layer:

adb shell "dumpsys SurfaceFlinger --list" | Select-String "SurfaceControlViewHost#\d+ parentId"
adb shell "dumpsys SurfaceFlinger" | Select-String "Layer \[<id>\]" -Context 0,3

Read carefully:

• visible reason= buffer=… — real pixels. invisible reason=hidden by parent or layer flag means the surface exists but nothing shows it.
• SF prints bounds={left,top,bottom,right} — not l,t,r,b.
• toDisplayTransform={ tx= ty= } on Task=N is where the window actually is. Use this, not task bounds, to prove a move landed.
• Per task the platform maintains Decor container of Task=N (z=30000, child of the Task) and sometimes Caption of Task=N. Anything parented inside the app window is below those regardless of its own z.

To check our caption covers One UI's exactly, compare buffer size against composited rect — the two columns disagree when a parent surface crops us:

adb shell "dumpsys SurfaceFlinger" | Select-String "705.0    40.0|648.0    40.0"

   src w/h    |  composited l t r b  | layer
  705.0  40.0 |  397  27 1102  67    | Caption of Task=1005   <- One UI's
  705.0  40.0 |  397  27 1102  67    | #5162                  <- ours, exact cover
  705.0  40.0 |  397  27  693  67    | #13970                 <- ours, CROPPED to a pane

A short coveredRegion on the platform's caption layer is the sliver of old title bar still showing.

A layer with no parentId is an attach that silently failed — the surface exists, is never composited, and nothing reports an error:

adb shell "dumpsys SurfaceFlinger --list" | Select-String "SurfaceControlViewHost#"
# good: SurfaceControlViewHost#22611 parentId=22489 z=2147483647
# bad:  SurfaceControlViewHost#22558 z=2147483647          <- orphaned

Usual cause is the wrong InputTransferToken: a display overlay needs a NEW InputTransferToken(), a window overlay needs one belonging to a live window. Caption churn is invisible from the UI — check files/caption.log grows (wc -l) rather than trusting how it looks; a caption being destroyed and rebuilt 30×/sec looks completely normal on screen.