Android externalAppV2

[TimoPtr]

Proposed change

Introduce externalAppV2 to support home-assistant/android#6680, we need a new name since the Android API is a bit different and uses the postMessage function. I didn't replicate the iOS API since if we want that we would need another feature available DOCUMENT_START_SCRIPT on the WebView (to create the structure) that might lead to more devices not supporting it.

This PR also introduce EMAndroidInternalMessage that are not listed in EMOutgoingMessageWithoutAnswer so that we cannot use it in fireMessage and that we cannot create messages that would conflict with internal messages that the Android app uses within the internalBus. It is a simple compile time protection the messages are not meant to be used by the frontend.

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New feature (thank you!)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• Link to app pull request: Filter out messages not coming from the frontend external bus android#6680

Checklist

• I understand the code I am submitting and can explain how it works.
• The code change is tested and works locally.
• There is no commented out code in this PR.
• I have followed the development checklist
• I have followed the perfect PR recommendations
• Any generated code has been carefully reviewed for correctness and compliance with project standards.

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated for www.home-assistant.io

To help with the load of incoming pull requests:

• I have reviewed two other open pull requests in this repository.

[Copilot]

Pull request overview

This PR adds support for a new Android WebView bridge (externalAppV2) that communicates via postMessage, enabling compatibility with the updated Home Assistant Android app messaging/auth flow.

Changes:

• Add externalAppV2 support to external auth and external messaging send paths (using postMessage with a typed envelope).
• Introduce EMAndroidInternalMessage to reserve internal Android message types from being used via fireMessage().
• Update blob URL revocation behavior to treat externalAppV2 as Android-external context, and extend tests accordingly.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/external_app/external_auth.ts	Adds externalAppV2 typing and updates auth request/revoke message transport + validation.
src/external_app/external_messaging.ts	Sends outbound external bus messages via externalAppV2.postMessage when available.
src/data/external.ts	Extends external detection for externalAppV2 and adds isExternalAndroid.
src/util/file_download.ts	Uses Android-external detection to delay blob URL revocation.
test/util/file_download.test.ts	Adds coverage for delayed revocation under externalAppV2.

[Copilot]

isExternalAndroid is exported as window.externalApp || window.externalAppV2, which (a) is not a boolean (it can be an object) and (b) is evaluated once at module load, so it won’t reflect window.externalApp* being injected/changed later. Consider exporting a boolean-returning function (or a getter-like helper) that checks window at call time, and update consumers accordingly.

Suggested change

	export const isExternalAndroid = window.externalApp || window.externalAppV2;
	export const isExternalAndroid = (): boolean =>
	Boolean(window.externalApp || window.externalAppV2);

[TimoPtr]

The Android app has to inject this before the frontend even loads.

[bramkragten]

Yeah, so it doesnt make sense, isExternal works the same 🙃

[jpelgrom]

Don't forget to also update documentation mentioning window.externalApp: https://developers.home-assistant.io/docs/frontend/external-authentication, https://developers.home-assistant.io/docs/frontend/external-bus.