<?xml version="1.0" encoding="utf-8"?>
<!--
  The terminal renderer is a page served over plain HTTP on 127.0.0.1 by TerminalDataPlane, and the
  binary protocol under it is a WebSocket on the same origin.

  Android 9 (API 28) — this head's own minimum — turned cleartext HTTP off by default. Without this file
  the WebView refuses to load the renderer and the terminal is simply blank, with the failure appearing as
  a renderer that never attaches rather than as anything naming TLS. That is the same blank-terminal
  symptom the desktop head documents for a missing WebView2 runtime, arrived at from the opposite
  direction, so it is worth knowing which one you are looking at.

  Scoped to loopback and nothing else. Setting cleartextTrafficPermitted at the base config would allow
  plaintext to every host, including the DodoSSH server the sync client talks to — and that connection
  carries bearer tokens. Loopback is exempt from the objection anyway: the bytes never leave the device,
  and the socket is the same process talking to its own WebView.
-->
<network-security-config>
  <domain-config cleartextTrafficPermitted="true">
    <domain includeSubdomains="false">127.0.0.1</domain>
  </domain-config>
</network-security-config>
