fix: a link tap on a device with no browser shows a toast instead of crashing

[GianniCarlo]

What

Sentry ANDROID-BOOKPLAYER-1P / -1R: tapping a contributor's GitHub link on a Pixel 3 (Android 12) whose browser was disabled crashed the app. Compose's platform UriHandler rethrows startActivity's ActivityNotFoundException as IllegalArgumentException("Can't open …"), and nine call sites used it bare — Tip Jar contributors, Settings → GitHub / Discord, Account → Terms / Privacy, Hardcover.

SafeUriHandler wraps the platform handler and turns exactly that failure into a toast (common_no_link_handler, English only per the localization convention); any other exception still propagates, so a malformed URI built by our own code is not hidden. BookPlayerTheme installs it as LocalUriHandler, so every call site is covered without changing any of them.

Behaviour

Unchanged for any device with a browser: same intent, same chooser. On a device with nothing handling https, the tap shows "No app on this device can open links." instead of killing the app.

Verification

• SafeUriHandlerTest (4 cases) — delegation, bare ActivityNotFoundException, the platform's wrapped form, and that other IllegalArgumentExceptions are rethrown. Three mutations killed (swallow every IAE, drop the bare catch, rethrow the wrapped one).
• ./gradlew assembleDevDebug testDevDebugUnitTest lintDevDebug green.
• Emulator, bp-lowend-31, scripts/chaos/no-browser.sh (recipe in docs/crash-repro.md): before — FATAL EXCEPTION … IllegalArgumentException: Can't open https://github.com/TortugaPower/bookplayer-android … Caused by: ActivityNotFoundException, process gone, from Settings → "View project on GitHub" (a different link from the report, same class); after — process alive, NotificationService logs the toast.

Triage notes (no code)

• -21 (ForegroundServiceStartNotAllowedException from media3's async notification path on 1.1.3+20): media3 1.11.0, already on develop since media3 1.11.0 (fixes the mergePlayerInfo crash, -Q); watch crown volume via AudioManager #101, catches it on both the sync and the bitmap-callback paths and routes it to MediaSessionService.Listener — so the crash is gone in 1.2.0. Without a listener the failure branch is silent; posting a fallback notification would need POST_NOTIFICATIONS on Android 13+, which the app does not request → a product decision, left open.
• Five "16–168 byte allocation with <1% heap free" OOMs (-1T/-1Y/-1Z/-1V/-22) on 128 MB-heap devices are one class (heap exhausted; the crashing frame is whoever allocated last) and need a heap dump, not a patch. Watch whether 1.2.0's bounded reads thin them.

🤖 Generated with Claude Code

[github-actions]

✅ Claude PR Review — PASS

Adds SafeUriHandler, a narrow UriHandler decorator that converts the missing-browser failure (ActivityNotFoundException, bare or wrapped by Compose as IllegalArgumentException("Can't open …")) into a toast plus a scheme-only Sentry breadcrumb, and installs it as LocalUriHandler in BookPlayerTheme so all five LocalUriHandler.current call sites are covered without touching them. I verified BookPlayerTheme wraps both MainActivity.setContent blocks and every link call site, that rememberSafeUriHandler() reads the outer platform handler (no self-referential CompositionLocal) and is properly remembered, that only the cause-chain-matching failure is swallowed, and that the breadcrumb leaks no URL or PII. No :core/:app boundary, Media3, billing or Room impact; the new string is in values/strings.xml and behaviour is unchanged on any device with a browser. Both findings from the earlier push appear addressed: the cause walk is now bounded at depth 8 with a cyclic-chain test, and the chaos script fails loudly when the coordinate fallback lands on the wrong screen. Remaining nits are pre-existing and outside the diff: a few direct startActivity sites (StorageFull.kt:54, SettingsScreen.kt:110) still bypass this wrapper.

Findings: no findings

Previously raised

Finding	Status
app/src/main/java/com/tortugapower/audiobookplayer/ui/SafeUriHandler.kt:48 (info) ⚠︎ moved	✅ verified fixed in bdb89f7
scripts/chaos/no-browser.sh:42 (info) ⚠︎ moved	✅ verified fixed in bdb89f7

Converged: nothing new this round, and every earlier finding is settled.

_{Model claude-opus-5 · run log · 0 new · 0 carried over · 2 verified closed · 0 resolved · advisory (a human should still review). Findings are de-duplicated across pushes; an earlier finding closes only when the verification pass judges it against the current code — fixed, no longer applicable, accepted by a maintainer, or a duplicate of a finding reported on this push.}