chore(release): v5.53.1

Bundles the v5.53.0 keybox revocation hotfix together with the
v5.53.1 WebUI corrections that follow from real-device testing.

Keybox: revocation becomes informational metadata, not a verdict or
install gate. The badge no longer flashes Revoked on working
keyboxes, keybox fetch no longer rejects revoked keyboxes, the
revocation lookup is leaf-only, and the embedded fallback is
refreshed from the live attestation status endpoint. A new AOSP
pill surfaces when a non-AOSP device loads an AOSP-rooted keybox.

WebUI: window.y now binds correctly so autosave toasts are visible.
TEESimulator-rs is detected on both the Rust webui-init path and
the JS visibility-refresh path that reads daemon nice-name.
Autosave fires on every card tick or untick, including taps on the
card body where the bundle's programmatic checkbox toggle never
dispatched a change event. Toast pill anchors at bottom-inset + 8px
with smaller font and pointer-events:none, so back-to-back ticks
never obstruct the package list.

Install: target.txt seeds com.google.android.gms, .gsf, and
.vending with the ! generate-mode suffix in Automatic mode. Manual
mode preserves any existing target.txt verbatim.

See CHANGELOG.md v5.53.0 and v5.53.1 entries for the full detail.

Author: Enginex0

CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## v5.53.1 (2026-05-01)
+
+### Bug Fixes
+- WebUI engine detector (`_c()` in `webui/assets/index-migrated.min.js`) scans `/data/adb/modules/*/module.prop` for `name=TEESimulator*` before falling back to the daemon nice-name and module.prop lookups. Fixes TEESimulator-rs forks displaying as upstream `TEESimulator` on the badge.
+- Save toast pill anchored at `bottom-inset + 8px` with 11px font and 13px icon. `pointer-events:none` retained in the `.show` state so taps pass through to the package list. Default duration reduced to 1200ms.
+- Card-body taps trigger autosave. Programmatic `md-checkbox.checked` toggles do not dispatch `change`, so a sibling click listener on `.card[data-package]` calls `scheduleFlush()` directly. Coalesced with the existing change-event path via `saveScheduled`.
+
+## v5.53.0 (2026-05-01)
+
+### Bug Fixes
+- Keybox badge no longer reports `Revoked` for working keyboxes. Revocation is now informational metadata. Badge states: `OK`, `Invalid`, `No Keybox`.
+- `keybox fetch` install gate checks structural validity only: chain integrity, validity window, recognized root, leaf-to-private-key match. Stops rejecting revoked keyboxes from public sources.
+- `lookup_revocation` (`rust/src/keybox/validate.rs`) inspects the leaf only. Removes false positives from intermediate-CA entries in unrelated chains of a multi-Key keybox.
+- `rust/src/keybox/roots/status.json` refreshed from `https://android.googleapis.com/attestation/status`. 1660 hex entries replace the prior 517-entry mixed-format snapshot.
+- `window.y` bound to the global so the inline-script autosave, flag-toggle, and reboot-required prompts produce visible toasts. The bundled `y()` is module-scoped and not reachable from `webui/index.html`.
+
+### Features
+- AOSP keybox badge state. Health banner shows a blue `AOSP` pill when an AOSP-rooted keybox (`aosp_ec` or `aosp_rsa`) is loaded on a non-AOSP device. AOSP detection reads `ro.build.tags` from `/system/build.prop`.
+- `detect_engine()` (`rust/src/health/mod.rs`) scans installed modules for `name=TEESimulator*` and returns the exact fork name. The badge now shows `TEESimulator-rs` for the Rust fork and `TEESimulator` for upstream.
+- Automatic-mode `target.txt` seed includes `com.google.android.gms!`, `com.google.android.gsf!`, and `com.android.vending!`. Applied in both `generate_initial_target()` and `generate_minimal_target()` in `install_func.sh`.
+
+### Changed
+- `ValidationReport.ok` aggregates with `any` instead of `all`. A multi-Key keybox installs when at least one Key is structurally valid.
+- `KeyboxInfo` JSON drops the `revoked` field. Revocation metadata remains as `revocation_serial` and `revocation_reason` per Key.
+- `StatusInfo` JSON adds `is_aosp_device: bool`.
+- `health_keybox_aosp` i18n key added to `webui/locales/template.xml` and 24 per-language strings files.
+- Manual install (vol-down) preserves any existing `target.txt` verbatim. Removed the unconditional GMS/GSF/Vending/Oplus/Coloros append loop in `customize.sh`.
+
 ## v5.52.0 (2026-05-01)
 
 ### Features

README.md

@@ -103,7 +103,7 @@ Real-time status directly in your module manager — no need to open anything.
 **WebUI**
 - [x] **Glass morphism design** — AMOLED dark gradient (`#0F0F1A` → `#1A1A2E`), 6 accent color presets with random selection on launch
 - [x] **Health status banner** — live engine state (green/red/orange)
-- [x] **Keybox status pill:** green `OK`, red `Revoked`, amber `Invalid`, gray `No Keybox`, derived live from the keybox validation report with the full error list on hover
+- [x] **Keybox status pill:** green `OK`, blue `AOSP` when an AOSP-rooted keybox is loaded on a non-AOSP device, amber `Invalid` for structural failures, gray `No Keybox` when absent. Hover surfaces the full validation error list. Revocation is exposed as JSON metadata but no longer drives the badge color since TEESimulator routes around Google's attestation status list at runtime
 - [x] **Keybox automation panel** — 6 source cards, interval scheduler with preset chips (1h–7d) and custom input with min/hr/day toggle, manual fetch
 - [x] **Target list auto-refresh** — every 3s, with search and per-app mode control
 - [x] **23 languages** with RTL support

bin/x86/ta-enhanced

@@ -164,11 +164,6 @@ if [ "$AUTOMATION_ENABLED" -eq 1 ]; then
     generate_initial_target
 elif [ "$HAS_TARGET" -eq 1 ]; then
     ui_print "  📋 $(_msg target_preserved)"
-    for _app in com.google.android.gms com.google.android.gsf com.android.vending \
-                 com.oplus.deepthinker com.heytap.speechassist com.coloros.sceneservice; do
-        pm list packages -s 2>/dev/null | grep -q "package:$_app" || continue
-        grep -qxF "$_app" "$TARGET_FILE" 2>/dev/null || echo "$_app" >> "$TARGET_FILE"
-    done
     pm list packages -3 2>/dev/null | sed 's/^package://' | sort > "$AUTOMATION_DIR/known_packages.txt"
 else
     generate_minimal_target

bin/x86_64/ta-enhanced

@@ -101,9 +101,9 @@ com.coloros.sceneservice"
 
 # System-apps-only target.txt for manual mode
 generate_minimal_target() {
-    local system_apps="com.google.android.gms
-com.google.android.gsf
-com.android.vending
+    local system_apps="com.google.android.gms!
+com.google.android.gsf!
+com.android.vending!
 com.facebook.appmanager
 com.facebook.services
 com.facebook.system
@@ -183,9 +183,9 @@ generate_initial_target() {
     local user_packages
     user_packages=$(pm list packages -3 2>/dev/null | sed 's/^package://' | sort)
 
-    local system_apps="com.google.android.gms
-com.google.android.gsf
-com.android.vending
+    local system_apps="com.google.android.gms!
+com.google.android.gsf!
+com.android.vending!
 com.facebook.appmanager
 com.facebook.services
 com.facebook.system

customize.sh

@@ -1,7 +1,7 @@
 id=TA_enhanced
 name=Tricky Addon Enhanced
-version=v5.52.0
-versionCode=50055
+version=v5.53.1
+versionCode=50058
 author=Enginex0
 description=Enhanced TrickyStore addon with dual-source keybox, auto security patch, conflict detection & sleek WebUI
 updateJson=https://raw.githubusercontent.com/Enginex0/tricky-addon-enhanced/main/update.json

install_func.sh

@@ -1,6 +1,6 @@
 [package]
 name = "ta-enhanced"
-version = "5.52.0"
+version = "5.53.1"
 edition = "2021"
 
 [dependencies]

module.prop

@@ -43,6 +43,7 @@ pub struct StatusInfo {
     pub ts_fork_supported: bool,
     pub ts_james_fork: bool,
     pub magisk_available: bool,
+    pub is_aosp_device: bool,
 }
 
 #[derive(Serialize)]
@@ -72,7 +73,6 @@ pub struct ConflictApp {
 #[serde(rename_all = "camelCase")]
 pub struct KeyboxInfo {
     pub valid: bool,
-    pub revoked: bool,
     pub source: String,
     pub root_type: String,
     pub last_fetch: Option<String>,
@@ -129,10 +129,10 @@ fn read_patch_dates() -> (String, String, String) {
     (system, boot, vendor)
 }
 
-fn check_keybox() -> (bool, String, bool, Vec<String>) {
+fn check_keybox() -> (bool, String, Vec<String>) {
     let path = Path::new(KEYBOX_PATH);
     if !path.exists() {
-        return (false, "none".into(), false, vec!["keybox.xml not found".into()]);
+        return (false, "none".into(), vec!["keybox.xml not found".into()]);
     }
     match crate::keybox::validate::validate_file_full(path) {
         Ok(report) => {
@@ -141,19 +141,30 @@ fn check_keybox() -> (bool, String, bool, Vec<String>) {
                 .first()
                 .map(|k| k.root_type.as_snake_case().to_string())
                 .unwrap_or_else(|| "unknown".into());
-            let revoked = report.keys.iter().any(|k| k.revocation_reason.is_some());
             let errors: Vec<String> = report
                 .keys
                 .iter()
                 .filter(|k| !k.ok)
                 .flat_map(|k| k.errors.clone())
                 .collect();
-            (report.ok, root_type, revoked, errors)
+            (report.ok, root_type, errors)
         }
-        Err(e) => (false, "unknown".into(), false, vec![e.to_string()]),
+        Err(e) => (false, "unknown".into(), vec![e.to_string()]),
     }
 }
 
+fn detect_aosp_device() -> bool {
+    let Ok(content) = std::fs::read_to_string("/system/build.prop") else {
+        return false;
+    };
+    let tags = content
+        .lines()
+        .find_map(|l| l.strip_prefix("ro.build.tags="))
+        .map(str::trim)
+        .unwrap_or("");
+    !tags.is_empty() && tags != "release-keys"
+}
+
 fn build_conflicts(cfg: &Config) -> ConflictReport {
     if !cfg.conflict.enabled {
         return ConflictReport { modules: Vec::new(), apps: Vec::new() };
@@ -181,7 +192,8 @@ pub fn handle_webui_init(cfg: &Config) -> anyhow::Result<()> {
     let engine_running = crate::health::is_engine_enabled();
     let total = count_target_entries();
     let (system, boot, vendor) = read_patch_dates();
-    let (kb_valid, kb_root_type, kb_revoked, kb_errors) = check_keybox();
+    let (kb_valid, kb_root_type, kb_errors) = check_keybox();
+    let is_aosp_device = detect_aosp_device();
     let vbhash_active = std::fs::read_to_string(BOOT_HASH_PATH)
         .map(|h| h.trim().len() == 64 && h.trim().chars().all(|c| c.is_ascii_hexdigit()))
         .unwrap_or(false);
@@ -228,11 +240,11 @@ pub fn handle_webui_init(cfg: &Config) -> anyhow::Result<()> {
             ts_fork_supported,
             ts_james_fork,
             magisk_available,
+            is_aosp_device,
         },
         conflicts: build_conflicts(cfg),
         keybox: KeyboxInfo {
             valid: kb_valid,
-            revoked: kb_revoked,
             source: if kb_valid { cfg.keybox.source.clone() } else { "none".into() },
             root_type: kb_root_type,
             last_fetch: None,