feat: add SQLite console and platform-aware version checks

- Implement a custom SQL console feature with domain, presentation, and UI modules, enabling ad-hoc SQLite queries across all platforms.
- Add `ConsoleSurface`, a Compose Multiplatform terminal UI with theme-aware syntax coloring, multi-line input support, and scrollback history.
- Introduce a typed `Platform` enum to replace the `platformName()` function for better type safety and platform-specific logic.
- Update `CheckSqlCipherVersionUseCase` to support `sqlite3mc_version()` checks on Desktop and Web platforms.
- Refactor `AdaptiveFrame` to utilize `WindowSizeClass` breakpoints for improved responsive layouts.
- Replace custom `BackHandler` with `NavigationBackHandler` from `androidx.navigationevent`.
- Enhance the vendored SQLDelight Paging3 extension with async-driver support for `generateAsync = true`.
- Add an Android APK release workflow to GitHub Actions and update installation documentation.
- Update project version to `8.5.4` and bump various dependencies, including Gradle (9.4.1), Kotlin (2.3.20), and KSP (2.3.6).
- Update `.gitignore` to exclude AI-related directories (`.claude/`, `.codex/`).

Author: softartdev

.github/workflows/android.yml

@@ -5,6 +5,10 @@ on:
     tags:
       - android/*
 
+permissions:
+  contents: write
+  packages: read
+
 jobs:
   build_unit_test_publish_job:
     name: Build -> Unit-test -> Publish
@@ -18,7 +22,7 @@ jobs:
           distribution: 'oracle'
           java-version: 17
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
         with:
           cache-read-only: false
           cache-overwrite-existing: true
@@ -29,9 +33,13 @@ jobs:
       - name: Build and Upload to Google Play
         working-directory: ./app/android
         run: fastlane build_bundle_publish
+      - name: Release
+        uses: softprops/action-gh-release@v3
+        with:
+          files: app/android/build/outputs/apk/release/*.apk
       - name: Archive build artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: build-artifacts
           path: |

.github/workflows/desktop.yaml

@@ -5,6 +5,10 @@ on:
     tags:
       - desktop/*
 
+permissions:
+  contents: write
+  packages: read
+
 jobs:
   build_job:
     name: Package
@@ -22,7 +26,7 @@ jobs:
           distribution: 'oracle'
           java-version: 17
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
         with:
           cache-read-only: false
           cache-overwrite-existing: true
@@ -44,7 +48,7 @@ jobs:
         if: matrix.os != 'macos-latest'
         run: ./gradlew packageReleaseDistributionForCurrentOS
       - name: Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             app/desktop/build/compose/binaries/main-release/deb/*.deb

.github/workflows/ios.yml

@@ -1,5 +1,8 @@
 name: iOS CD
 
+permissions:
+  contents: read
+
 on:
   push:
     tags:
@@ -19,7 +22,7 @@ jobs:
           distribution: 'oracle'
           java-version: 17
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
         with:
           cache-read-only: false
           cache-overwrite-existing: true
@@ -46,7 +49,7 @@ jobs:
         run: fastlane appstore_publish_deliver_lane
       - name: Archive build artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: test-artifacts
           path: |

.github/workflows/kmp.yml

@@ -8,6 +8,9 @@ on:
       - '**'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build_job:
     name: Build (Unit-tests & Android-Lint)
@@ -17,14 +20,14 @@ jobs:
       - name: Check out
         uses: actions/checkout@v6
       - name: Gradle Wrapper Validation
-        uses: gradle/actions/wrapper-validation@v5
+        uses: gradle/actions/wrapper-validation@v6
       - name: Set up JDK 17
         uses: actions/setup-java@v5
         with:
           distribution: 'oracle'
           java-version: 17
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
         with:
           cache-read-only: false
           cache-overwrite-existing: true
@@ -42,7 +45,7 @@ jobs:
         run: ./gradlew build
       - name: Archive build-output artifacts
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: output-build-artifacts
           path: |
@@ -70,7 +73,7 @@ jobs:
           distribution: 'oracle'
           java-version: 17
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
         with:
           cache-read-only: false
           cache-overwrite-existing: true
@@ -112,7 +115,7 @@ jobs:
           script: ./gradlew :app:android:connectedCheck
       - name: Archive ui-tests-output artifacts
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: output-ui-tests-artifacts-${{ matrix.api-level }}-${{ matrix.target }}
           path: |

.github/workflows/web.yml

@@ -31,7 +31,7 @@ jobs:
           distribution: 'oracle'
           java-version: 17
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
         with:
           cache-read-only: false
           cache-overwrite-existing: true
@@ -45,7 +45,7 @@ jobs:
         run: gradle app:web:wasmJsBrowserDistribution
       - name: Setup Pages
         if: ${{ steps.build.outcome != 'failure' || steps.dist.outcome != 'failure' }}
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
       - name: Upload artifact
         if: ${{ steps.build.outcome != 'failure' || steps.dist.outcome != 'failure' }}
         uses: actions/upload-pages-artifact@v4
@@ -61,4 +61,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.gitignore

@@ -84,3 +84,7 @@ kotlin-js-store/
 ### desktop
 # Code signing files (macOS)
 /app/desktop/macOS_development.p12
+
+# AI
+.claude/
+.codex/

AGENTS.md

@@ -9,6 +9,7 @@
 
 ### Project Structure & Module Organization
 - Core: `core/domain`, `core/presentation`, `core/data/db-sqldelight` (default), `core/data/db-room` (optional), `core/test`.
+- Features: `feature/backup/{domain,ui}`, `feature/console/{domain,presentation,ui}`, `feature/file-explorer/data`.
 - UI: `ui/shared` (common Compose code and resources), `ui/test` (multiplatform Compose UI tests), `ui/test-jvm` (JVM-specific UI test utilities).
 - Apps: `app/android`, `app/desktop`, `app/web`, `app/ios-kit` (CocoaPods framework), `app/iosApp` (Xcode project).
 - Tooling: `build-logic` (Gradle conventions), `thirdparty` (vendored modules), `gradle/libs.versions.toml` (versions).

CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.5.4] - 2026-04-18
+
+### Features
+- Add SQL console feature for running ad-hoc queries against the app database
+- Support SQLite3MC version checks on Desktop and Web platforms
+
+### Refactoring
+- Rework `AdaptiveFrame` to use `WindowSizeClass` breakpoints for adaptive layouts
+- Replace custom `BackHandler` with `NavigationBackHandler`
+- Replace `platformName()` function with a typed `Platform` enum
+- Refactor `SqlDelightDbHolder` logging
+
+### Documentation
+- Update SQLDelight Paging3 fork documentation and metadata
+
+### Chores
+- Add Android APK release workflow and installation guide
+- Update Gradle Wrapper, KSP, androidSqlCipher, kotlinx-serialization, and other dependencies in `libs.versions.toml`
+- Bump GitHub Actions (`upload-artifact` 5→7, `configure-pages` 5→6, `deploy-pages` 4→5, `gradle/actions` 5→6, `softprops/action-gh-release` 2→3) and iOS `addressable` 2.8.4→2.9.0
+- Update `.gitignore` to exclude AI-related directories
+
 ## [8.5.3] - 2026-03-10
 
 ### Features

SECURITY.md

@@ -0,0 +1,63 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest released version of NoteDelight receives security updates.
+Older releases will not be patched; please upgrade to the latest version
+before reporting a vulnerability.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 8.5.x   | :white_check_mark: |
+| < 8.5   | :x:                |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub
+issues, discussions, or pull requests.**
+
+Instead, report them privately using one of the following channels:
+
+- **GitHub Security Advisories** (preferred): open a private report at
+  https://github.com/softartdev/NoteDelight/security/advisories/new
+- **Email**: send details to artik222012@gmail.com. If you wish to encrypt
+  your report, request a PGP key in your first message.
+
+Please include as much of the following as you can:
+
+- A description of the issue and the affected component (Android, iOS,
+  desktop, or shared module).
+- The version / commit of NoteDelight you tested against.
+- Step-by-step instructions to reproduce the issue.
+- Proof-of-concept code, logs, or screenshots, if available.
+- The potential impact (data disclosure, code execution, bypass of the
+  note password, etc.).
+
+### What to expect
+
+- **Acknowledgement** within 72 hours of your report.
+- **Initial assessment** (accepted / needs more info / declined) within
+  7 days.
+- **Status updates** at least every 14 days while the issue is being
+  worked on.
+- **Fix and disclosure**: once a fix is ready, a new release will be
+  published and the advisory made public. Reporters who wish to be
+  credited will be acknowledged in the advisory and CHANGELOG.
+
+### Scope
+
+In scope:
+
+- The NoteDelight Android, iOS, web, and desktop apps built from this
+  repository.
+- The shared Kotlin Multiplatform modules, including note storage and
+  encryption.
+
+Out of scope:
+
+- Vulnerabilities in third-party dependencies that are already tracked
+  upstream (please report those to the upstream project; you may still
+  notify us so we can bump the dependency).
+- Issues that require a physical, already-unlocked device with the app
+  open.
+- Social-engineering or phishing attacks against users or maintainers.

app/android/build.gradle.kts

@@ -25,8 +25,8 @@ android {
         applicationId = "com.softartdev.noteroom"
         minSdk = libs.versions.minSdk.get().toInt()
         targetSdk = libs.versions.targetSdk.get().toInt()
-        versionCode = 853
-        versionName = "8.5.3"
+        versionCode = 854
+        versionName = "8.5.4"
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         testInstrumentationRunnerArguments["clearPackageData"] = "true"
         vectorDrawables.useSupportLibrary = true