SoftwareApp
cc085b43de
The manifest had nothing but a LAUNCHER filter, so no other app could hand Plain Files anything. It now registers for ACTION_SEND and SEND_MULTIPLE (a bar over the browser: navigate to the folder, then Save here) and for GET_CONTENT and OPEN_DOCUMENT, where tapping a file hands it back through the existing FileProvider. Both reuse the browser instead of a second screen, because both are navigate-to-a-folder with a different verb at the end. data/ gains one port, IncomingSource, to keep a ContentResolver out of the ViewModel the way DeleteRequestFactory keeps one out of the delete path. Shared files are named from the sender OpenableColumns, allocated by the same NameAllocator a paste uses, and deleted again if they cannot be read rather than left as zero-byte stubs. While providing, a tap on a file chooses it but a tap on a folder still navigates, or the user could never reach the file. ACTION_VIEW is deliberately not registered: the app already hands files out through the system chooser, and registering as a viewer would offer Plain Files back to itself. No new permissions - the merged release manifest still declares no INTERNET.
8.6 KiB
8.6 KiB
Roadmap
File Manager is built against a fixed milestone plan (M0–M10). This file is the single source of truth for what is done and what remains.
Legend: ✅ done · 🚧 in progress · ⏳ not started · 💡 candidate (proposed, not scheduled)
Milestones
| # | Milestone | Status | Evidence / notes |
|---|---|---|---|
| M0 | Toolchain & scaffold | ✅ | Gradle 9.3.1 + AGP 9.1.0 wrapper, version catalog, app module, Compose theme, debug APK builds, installs and runs on the phone AVD: package de.softwareapp_hb.filemanager.debug, versionCode 1, minSdk 26/targetSdk 36, no INTERNET permission, lintDebug clean (one expected UnusedResources for the not-yet-used notification icon) |
| M1 | Pure-Kotlin core + JVM tests | ✅ | core/ is Android-free: StoragePath (normalised absolute paths that cannot escape the root), FileEntry + FileKind classification, MimeTypes, NaturalOrder + SortSpec (directories first; file2 before file10), FileSize, NameMatcher (substring + */? glob), NameAllocator ("name (1)") and TransferPlanner (conflict policies, move-into-self). 44 JVM tests across 10 classes, all green |
| M2 | Storage layer | ✅ | StorageSource with two backends — AllFilesSource (java.io.File under all-files access) and SafSource (DocumentsContract over a persisted tree URI), the latter split so the tree↔path mapping (SafDocumentIds) is exhaustively testable; SafGrant for the picker and its persistence; VolumeRepository (StorageManager/StorageVolume + StatFs); StorageAccess + StorageAccessPolicy for the all-files/SAF decision. 76 JVM tests total (32 added here) |
| M3 | Operations engine + service | ✅ | domain/FileOperations composes the backend primitives into copy/move/delete/rename with recursive walking, an honest progress total, cooperative cancellation between entries and per-item failure reporting; conflicts are decided through the M1 TransferPlanner (ASK is surfaced for the UI to resolve). service/FileOpService is a dataSync foreground service mirroring progress into a notification (FileOpNotifications + text/TextRes). 99 JVM tests total (23 added here) |
| M4 | Compose UI | ✅ | BrowserViewModel + BrowserUiState over StorageLocation; browser screen with list/grid, breadcrumbs, in-folder search, a sort/hidden-files/view sheet, multi-select action bar, details sheet, and new-folder/rename/delete/conflict dialogs; a roots view and the "All files access" + SAF-folder prompts; data/MediaStoreDeleter routes a delete through the platform's own dialog where it can and falls back to a direct delete; a FileProvider backs "open with" and share. 115 JVM tests total (16 added here) |
| M5 | Analysis, archives, viewers | ✅ | domain/UsageAnalysis measures recursive folder sizes and finds the largest files, shown by a bar-per-row storage-usage screen; domain/ArchiveEngine creates ZIP and extracts ZIP/TAR/TAR.GZ/GZ/BZ2/XZ/7z using java.util.zip + Commons Compress + XZ for Java (no native code), with every entry name filtered through core/ArchivePath against zip-slip; a Coil-backed image viewer, thumbnails in the list and grid, a text editor, and compress/extract in the selection bar. 141 JVM tests total (26 added here) |
| M6 | Release config & Play readiness | ✅ | Upload keystore generated (4096-bit RSA, CN=Hadrian Burkhardt) and wired through the git-ignored keystore.properties; bundleRelease + assembleRelease verified — 4 682 814-byte .aab (sha256 9014627a…), 2 081 955-byte APK signed by the upload key, R8 mapping kept. PLAY_RELEASE_CHECKLIST (incl. the Permissions Declaration Form for "All files access", the Data safety answers and the shipped-permission audit) and PRIVACY.md written for a restricted-permission app. Shipped permission set audited: no INTERNET |
| M7 | On-device validation & hardening | ✅ | Run on a real Xiaomi M2101K7AG (Android 12 / MIUI V140) — see EDGE_CASE_TESTING. Verified on hardware: the first-run permission prompt, granting "All files access" while the app is alive (picked up on resume), browsing real storage, the text editor's read and write path (independently checked with adb shell cat), the storage-usage screen, landscape layout, and graceful degradation when access is revoked mid-use. Found and fixed two real defects: misleading first-run copy ("Full access was declined" on a device where nothing had been declined), and a usage screen that stayed blank for ~45–60 s on a 55 GB volume — now one listing per directory instead of a stat per node, with rows streamed out as they are measured. 142 JVM tests |
| M8 | Localisation groundwork | ✅ | Every user-visible string is in res/values/strings.xml with real <plurals>, and text/TextRes.kt maps both OperationKind and FileKind onto resources so the screen, the notification and the details sheet cannot drift. The audit found a genuine miss: the details sheet rendered FileKind.name, i.e. untranslatable English — now a resource. isPseudoLocalesEnabled = true on the debug build makes "did every string come from resources?" mechanically checkable; verified en-rXA is present in the debug APK and the flag is debug-only. Byte units and the timestamp pattern are deliberately unlocalised, and the README says why. 142 JVM tests |
| M9 | Monetisation | ✅ | Decided: one-time paid — €4.49 base with a 14-day launch price of €2.29, both set in the Play Console (Products › App pricing), so there is no Billing client, no com.android.vending.BILLING permission and no purchase code. Rationale, market anchors and Console steps: MONETISATION. Verified against the release APK: zero billing and zero INTERNET references. The price must be set before the first upload — Play allows paid → free but never free → paid |
| M10 | Store assets | ✅ | Name decided: Plain Files (one string; applicationId already locked). tools/make-store-assets.sh renders the 512×512 RGBA icon and the 1024×500 RGB feature graphic from the app's own vectors, so the store icon is the launcher icon; tools/make-store-screenshots.sh normalises adb captures to Play's 2:1 cap per form factor (phone crop default 93/130 px, tablets 0). STORE_LISTING carries length-checked copy (name 11/30, short 67/80, full 2192/4000), the permissions paragraph the MANAGE_EXTERNAL_STORAGE declaration requires, and the graphics table. The feature graphic's copy was verified to survive Play's centre-square crop by cropping the rendered PNG. Screenshots captured: 5 phone (1080×2160), 4 on a 7-inch tablet (1200×1920) and 4 on a 10-inch tablet (2560×1600), all 24-bit RGB, inside the 2:1 cap. The tablet sets came from AOSP AVDs. The normaliser refuses a capture whose app area is blank, which is how a pure-background capture was caught before it reached the listing |
Key decisions
| Decision | Choice | Rationale |
|---|---|---|
| Language / UI | Kotlin + Jetpack Compose | Mirrors the sibling app's proven, installed toolchain; no NDK |
| Storage access | MANAGE_EXTERNAL_STORAGE first, SAF fallback |
Google Play explicitly permits "All files access" for file managers; SAF keeps the app usable if the user declines |
| Connectivity | Local-first (no INTERNET in v1) |
Preserves the "nothing leaves the device" claim and keeps the Data Safety form trivial |
| File sharing | Receives SEND/SEND_MULTIPLE, serves GET_CONTENT/OPEN_DOCUMENT, and deliberately does not register ACTION_VIEW |
A file manager should be able to receive a file and to supply one, and neither costs a permission. Registering as a viewer as well would put Plain Files in the "open with" chooser the app itself uses, offering it back to itself |
| Monetisation | One-time paid (€4.49; €2.29 launch price), set in the Console | No Billing client, no BILLING permission, no purchase code — which is what keeps "nothing leaves the device" true in the shipped APK. Free → paid is impossible after the first upload, so the price must be set beforehand. See MONETISATION |
Deliberately deferred (post-1.0)
- Cloud storage (Drive/OneDrive/Dropbox/…); network clients (SMB/FTP/SFTP/WebDAV); FTP/Web
server. All of these need
INTERNET, which is the one permission the app deliberately does not declare — see the connectivity decision above. - App manager (
QUERY_ALL_PACKAGES), APK installation (REQUEST_INSTALL_PACKAGES). - RAR archives (the format needs native code) and 7z creation; root explorer; encryption vault; themes/icon packs.