SoftwareApp
05a71f12bf
The root screen opened on a list of volumes, so "where are my photos?" began with knowing which folder they were in. It now opens on Libraries - Images, Videos, Audio, Documents, Archives and Recent - each row saying how many files the index knows of that kind, and each opening an ordinary listing with thumbnails, sorting, multi-select, details and the existing viewers, so a tap on a photo opens the image viewer and a tap on a PDF the PDF viewer. Downloads and New files are deliberately absent: one is a folder shortcut and the other a time window, and presenting three different things as one feature is how a listing starts lying about itself. Documents includes .txt, because a user looking for their documents means those too, and DIRECTORY, APK and OTHER belong to no library at all - a test asserts the three omissions so they stay decisions rather than oversights. A library has to ask for "every image" without reading a name, so IndexedFile gained a derived kind beside FileEntry's and the index stores a copy of it to filter on: schema v3, with a migration that rebuilds the files table and deletes the volume stamps with it, because a stamp means "the rows behind this are this current" and a rebuilt table has no rows behind it. Rebuilding rather than backfilling is legitimate only because this index is a cache of a walk that can be repeated; SqliteTrashIndex's rule is the opposite and its own documentation says why. A library then obeys the indexed search's two rules exactly: the answer comes first with the walk behind it, and every row is confirmed against the filesystem before it is shown, with the rows whose file has gone forgotten rather than displayed. On a device that has never been indexed the first tap on Images therefore starts a walk - which the screen admits to, using the progress row the search already had, instead of showing an empty library that reads as an empty device. "Find duplicates" in the overflow compares contents in three passes, cheapest first: size, which the index already knows, so the candidate list is one query and reads nothing at all; the first 64 KB of every candidate, a filter whose only power is to rule files out; and the whole file for whatever survives, which is the pass that decides. The separation is enforced by a test that builds two files sharing their first 64 KB and differing afterwards and asserts both were read in full - it would fail if the cheap pass were ever treated as an answer. The screen shows only what was measured: groups ordered by the space deleting the spare copies would give back, each header stating the copies and what they cost, every row carrying its folder as well as its size, and nothing preselected, because which copy to keep is the one decision the screen exists to hand over. A file whose bytes cannot be read is counted and reported rather than skipped, "nothing found" is never claimed without saying how many files were compared, and deleting closes the scan instead of patching it - its rows came from comparing bytes, and quietly dropping some of them would leave a list that still looks like a scan while its headers claim numbers nobody measured. The thumbnails went from 28 to 48 dp in a list row and 40 to 96 dp in a grid cell, with the grid's minimum column width raised to 144 dp to suit them; ListItem measures its leading slot rather than capping it, so a row grows to fit instead of clipping. That turned out to matter: the commonest complaint in the competitive survey is thumbnails that load only once scrolling stops, which is the failure mode a larger thumbnail invites. Two smaller corrections came out of the same work - a mutation now re-reads whatever is on screen, so a delete from inside a library removes the row instead of doing nothing at all because there was no path to reload, and returning to the app re-reads a library rather than dropping the user back to the roots. docs/COMPETITIVE_ANALYSIS.md records the market leader's features and what its users praise and complain about, with the sources that were blocked and the size of the review sample stated rather than glossed over; it is where both features came from, and the gaps that cost no permission are listed as candidates in the roadmap. 323 JVM tests (34 added across the two features), lint clean. Tested on the real phone - the same M2101K7AG, with the debug build installed past MIUI's two gates. The libraries on a cold index (no counts rather than a row of zeroes, "Indexing 300 files..." on the first tap, then "Index updated" and real thumbnails), the counts afterwards (Images 6238, Recent uncounted), a tap opening the viewer and BACK returning with the scroll position, and a duplicate scan that found four genuine groups in the device's own storage with nothing crashing. The duplicate delete was deliberately not pressed on a device that is not ours to empty, the store screenshots predate the new home screen, and the library views turn the M10 screenshot rule into a privacy question as well as a cosmetic one - all of that is recorded in docs/EDGE_CASE_TESTING.md rather than left implicit.
209 lines
10 KiB
Markdown
209 lines
10 KiB
Markdown
# File Manager
|
||
|
||
An **ad-free**, **one-time-paid** Android file manager. It browses and manages the
|
||
files on your device — locally, with no ads, no account and no analytics.
|
||
|
||
Nothing ever leaves the device: the app declares no network permission and contains
|
||
no advertising or tracking SDKs.
|
||
|
||
> **Working title.** The display name and the store listing are decided before the
|
||
> first Play upload (see [docs/ROADMAP.md](docs/ROADMAP.md), M10). The `applicationId`
|
||
> is already fixed and can never change after the first release.
|
||
|
||
## Status
|
||
|
||
**M12 — duplicate finder: done.** The browser scans for files that hold the same bytes — size first,
|
||
then the head of every candidate, then the survivors in full — and shows what deleting the spare
|
||
copies would give back. Before it: **M11 — library views**, a **Libraries** section on the root
|
||
screen (Images, Videos, Audio, Documents, Archives and Recent) whose rows open ordinary listings of
|
||
those files, each carrying a count from the search index. And **M10 — store assets**: the app is
|
||
named **Plain Files**, the icon and feature graphic come from the app's own vectors, and
|
||
[docs/STORE_LISTING.md](docs/STORE_LISTING.md) holds length-checked listing copy. Screenshots exist
|
||
for 5 phone (1080×2160), 4 on a 7-inch tablet (1200×1920) and 4 on a 10-inch tablet (2560×1600) —
|
||
but they **predate M11**, so the home screen in them is the old volume list and they will need
|
||
re-shooting, which the library views make a privacy question as well as a cosmetic one
|
||
([docs/STORE_LISTING.md](docs/STORE_LISTING.md)).
|
||
|
||
## Tech stack
|
||
|
||
| Area | Choice |
|
||
|---|---|
|
||
| Language | Kotlin 2.4.10 (using AGP 9 *built-in Kotlin*) |
|
||
| UI | Jetpack Compose, BOM 2026.06.01, Material 3 |
|
||
| Build | Gradle 9.3.1, Android Gradle Plugin 9.1.0 |
|
||
| Storage access | `MANAGE_EXTERNAL_STORAGE` ("All files access") with a Storage Access Framework fallback |
|
||
| Archives | Apache Commons Compress + XZ for Java (both pure Java — no NDK) |
|
||
| SDK levels | `compileSdk`/`targetSdk` 36, `minSdk` 26 |
|
||
|
||
`targetSdk` is 36 because Google Play requires new apps and updates to target
|
||
Android 16 (API 36) from 31 August 2026.
|
||
|
||
## Project layout
|
||
|
||
```
|
||
app/src/main/java/de/softwareapp_hb/filemanager/
|
||
├── core/ Pure-Kotlin engine (no Android imports!) — paths, sorting, formatting,
|
||
│ search matching, copy/move planning, conflict policy
|
||
├── data/ Storage backends (all-files access + SAF), volumes, shares coming in
|
||
│ from other apps, the trash index (SQLite), file operations, archives,
|
||
│ deletion
|
||
├── domain/ Browser + operation controllers, models, permission state
|
||
├── service/ Foreground service for long-running file operations
|
||
├── ui/ Compose theme, browser screen, components, ViewModels
|
||
└── text/ Domain enum → string-resource mapping
|
||
app/src/test/java/… JVM unit tests for the core engine
|
||
```
|
||
|
||
`core/` deliberately has **no Android dependencies**, so the trickiest logic is
|
||
covered by fast JVM tests.
|
||
|
||
## Building
|
||
|
||
Prerequisites:
|
||
|
||
- JDK 17+ (JDK 25 verified)
|
||
- Android SDK with `platforms;android-36` and `build-tools;36.0.0`
|
||
|
||
```bash
|
||
# Tell Gradle where the SDK lives (this file is git-ignored)
|
||
echo "sdk.dir=$HOME/Android/Sdk" > local.properties
|
||
|
||
./gradlew :app:assembleDebug # debug APK
|
||
./gradlew :app:testDebugUnitTest # JVM unit tests for the engine
|
||
./gradlew :app:lintDebug # Android Lint
|
||
./gradlew :app:bundleRelease # Play upload bundle (.aab)
|
||
```
|
||
|
||
Release signing is optional and driven by a git-ignored `keystore.properties`
|
||
(see `keystore.properties.example`); without it the release build still runs
|
||
R8/minification but produces an unsigned artefact.
|
||
|
||
## Tracked in git
|
||
|
||
- Source, resources and Gradle build files.
|
||
- `docs/` — roadmap and release documentation.
|
||
- `PRIVACY.md`, `CHANGELOG.md`, and (from M10) `store-assets/`.
|
||
|
||
Not tracked: `local.properties`, `keystore.properties`, `*.jks`, build outputs.
|
||
|
||
## Releasing
|
||
|
||
Release signing is driven by the git-ignored `keystore.properties` (see
|
||
`keystore.properties.example`). Without that file the release build still runs R8 and
|
||
resource shrinking, but produces an unsigned artefact that cannot be uploaded.
|
||
|
||
```bash
|
||
./gradlew :app:bundleRelease # Play upload bundle (.aab)
|
||
./gradlew :app:assembleRelease # APK, for local checks
|
||
|
||
# Audit what is actually shipped — in particular that there is no INTERNET permission:
|
||
$ANDROID_HOME/build-tools/36.0.0/aapt2 dump permissions \
|
||
app/build/outputs/apk/release/app-release.apk
|
||
```
|
||
|
||
Read [docs/PLAY_RELEASE_CHECKLIST.md](docs/PLAY_RELEASE_CHECKLIST.md) before uploading.
|
||
Step 4 is the one that matters most for this app: a file manager must declare **"All files
|
||
access"** through Play's Permissions Declaration Form, and have the core purpose documented
|
||
in its store description. [PRIVACY.md](PRIVACY.md) is written to match the shipped
|
||
permissions.
|
||
|
||
## Localisation
|
||
|
||
All user-visible text lives in `app/src/main/res/values/strings.xml`, with real `<plurals>`
|
||
wherever a count can be one, and the screen and the progress notification resolve their
|
||
labels through `text/TextRes.kt` so the two cannot drift apart. **English is currently the
|
||
only locale.**
|
||
|
||
Adding a language is then a file, not a refactor:
|
||
|
||
```
|
||
app/src/main/res/values-de/strings.xml # same keys, translated values
|
||
```
|
||
|
||
Deliberately **not** localised, and why:
|
||
|
||
- **Byte units** ("KB", "MB") — symbols, not words, and every file manager and the system
|
||
Settings app show them the same way.
|
||
- **The timestamp pattern** (`yyyy-MM-dd HH:mm`) — a fixed, sortable format; the zone is
|
||
passed in explicitly rather than assumed.
|
||
|
||
### Checking that nothing was missed
|
||
|
||
Two things are easy to get wrong: a literal typed into a composable, and showing an enum
|
||
constant directly (`FileKind.name` puts untranslatable English on screen — the details
|
||
sheet used to do exactly that). The mechanical check is the pseudo-locale:
|
||
|
||
```bash
|
||
./gradlew :app:assembleDebug
|
||
# Settings > System > Languages > English (XA), then launch the debug build.
|
||
```
|
||
|
||
The debug build type sets `isPseudoLocalesEnabled = true`, so every string that came from
|
||
`strings.xml` renders accented and bracketed (`[Îmàgé]`). **Anything that looks normal is a
|
||
string that never went through resources.** The release build is unaffected.
|
||
|
||
One caveat: **Google Play's automatic translation translates your store listing, not the app
|
||
UI.** Translated UI text has to be supplied in `values-<locale>/`.
|
||
|
||
## Known limitations
|
||
|
||
- **The trash is a time window, not a bin you manage.** A delete stages the item in a hidden
|
||
`.plainfiles-trash` folder on the same volume and keeps it for 24 hours; the **Trash** entry
|
||
in the overflow menu lists what is still there and puts a whole batch back. There is no
|
||
"empty it now" action — expired batches are swept the next time something is deleted — and a
|
||
name taken again in the meantime is never overwritten, so a restored item can arrive beside
|
||
the new one rather than replacing it.
|
||
- **Where a trashed item came from is remembered in the app's own database**, not on the
|
||
volume. The staged files are the truth and the database is only an index, so the two are
|
||
reconciled in both directions: an entry whose file has gone is not offered back, and a
|
||
batch folder no entry mentions is swept.
|
||
- **Sharing a file *out* only works in the all-files mode.** A SAF path is relative to the
|
||
granted tree rather than a filesystem path, so it cannot be handed to `FileProvider`.
|
||
Receiving a share and being picked from another app's chooser work either way: the first
|
||
needs no filesystem path, and the second falls back to `RESULT_CANCELED` rather than
|
||
returning a URI the caller could not read.
|
||
- **RAR, CAB, ISO and WIM are refused**, not supported — they need native code, which this
|
||
project deliberately does not ship. (The Commons Compress jar contains no RAR classes at
|
||
all.) **7z is different**: Commons Compress reads it in pure Java, so it *is* supported —
|
||
but the format needs a seekable channel rather than a stream, because its header lives at
|
||
the end of the file. All-files access can supply one; the SAF fallback cannot, so 7z
|
||
extraction reports that plainly in folder mode instead of half-working.
|
||
- **7z files can be opened but not created** — writing stays ZIP-only.
|
||
- **Archive extraction does not restore original timestamps or permissions**, and there is
|
||
no archive encryption or password support.
|
||
- **Cancellation happens between entries**, so a single very large file finishes before a
|
||
stop is honoured.
|
||
- **A library is not restored across process death.** The persisted view state holds a path, and a
|
||
library has none, so a restart returns to the root screen rather than to Images or Recent.
|
||
- **Long-press multi-select is awkward to script from the host.** The gesture that opens the
|
||
selection bar (`input swipe x y x y 900`) works on the MIUI test device but has also
|
||
registered as a plain tap, so compress/extract from the UI wants a manual pass (see
|
||
[docs/EDGE_CASE_TESTING.md](docs/EDGE_CASE_TESTING.md)).
|
||
- The display name is still the working title — decided before the first upload (M10).
|
||
|
||
## Monetisation
|
||
|
||
**One-time paid: €4.49 base, with a €2.29 launch price for the first 14 days.** No ads, no
|
||
subscription, no in-app purchases, no free tier.
|
||
|
||
The price lives on the Play listing, not in the build, which is why there is no Billing
|
||
client in the dependencies and no `com.android.vending.BILLING` permission in the APK —
|
||
that is what keeps "no network permission, nothing leaves your device" true of the
|
||
*shipped artefact* rather than just the source. Rationale, market anchors, the rejected
|
||
alternatives and the Console steps: [docs/MONETISATION.md](docs/MONETISATION.md).
|
||
|
||
⚠️ **The price must be set before the first upload** — Play allows paid → free but never
|
||
free → paid.
|
||
|
||
## Competitive context
|
||
|
||
The category leader is **File Manager Plus** (AlphaInventor; 100 M+ installs, 4.7–4.8★, free
|
||
with ads and in-app purchases, and a Data Safety form that shares device IDs with third
|
||
parties). What it offers, what its users praise, what they complain about, and which of those
|
||
complaints this app can answer without asking for a single new permission:
|
||
[docs/COMPETITIVE_ANALYSIS.md](docs/COMPETITIVE_ANALYSIS.md).
|
||
|
||
## Licence
|
||
|
||
Proprietary — all rights reserved.
|