Release v0.9.4 Beta

Author: Gengar

CHANGELOG.md

@@ -6,6 +6,97 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ---
 
+## [0.9.4] Beta — 2026-02-20
+
+### Added
+- Global search activated (Home screen, Y button) — cross-system search with region flags and tag badges
+- Local-only mode — consoles without a provider show locally scanned ROM files with a banner hint
+- FTP download progress — real-time per-chunk progress reporting instead of staying at 0%
+- Download inactivity watchdog — 60-second stall detection with clear error message
+- Gamepad key fix — intercepts mismatched logical keys on key-up/repeat for certain gamepad drivers (AYN Thor etc.)
+- Provider type badge on version cards (RomM, SMB, FTP, WEB)
+- Download overlay sectioned list (Downloading / Queued / Complete headers) with ID-stable focus and auto-scroll
+- Download overlay auto-close when queue empties
+- SMB domain auth field
+- `ProviderConfig.validate()` and `shortLabel` helpers
+- `showConsoleNotification()` — themed floating SnackBar used app-wide
+- `getUserFriendlyError()` — maps raw exceptions to readable messages
+
+### Improved
+- RomM Config screen reworked — focus-aware glow borders, D-pad navigable fields, connection test as toast, per-console sync status with bulk "Update stale" action
+- Settings screen — RomM Server item re-enabled, concurrent downloads widget with chevrons, Reset App moved to HUD X-button
+- Home view empty-state shows HUD bar with Settings/Exit actions; loading state is a black screen (no flash)
+- Game detail loading shows game name + system-colored spinner
+- Game list header shows target folder path and local-only banner
+- Game grid context-sensitive empty states (search miss, filter miss, local-only empty, connection error)
+- Platform icons compressed (~70% smaller file sizes)
+- All action shortcuts use `includeRepeats: false` (no more repeated fires on button hold; D-pad retains repeats)
+- `OverlayFocusScope` / `DialogFocusScope` — `_hasClaimed` flag prevents double-release of overlay priority
+- RomM cover fallback chain (CDN → small → large → first screenshot)
+- `UnifiedGameService` provider calls wrapped in 30s timeout
+- `RommApiService` / `WebProvider` — connect 15s / receive 30s timeouts
+- README updated with supported systems table and Building from Source section
+
+### Fixed
+- **Zip Slip vulnerability** — Android ZIP extraction validates canonical path before writing
+- **Path traversal** — `_safePath` uses `p.basename()` in both `DownloadService` and `RomManager`
+- **Atomic config write** — `ConfigStorageService.saveConfig` writes to `.tmp` then renames
+- **DB init race condition** — `DatabaseService` uses single `static Future<Database>?` guard
+- **AudioManager BGM reinit loop** — `_hasAttemptedReinit` flag prevents recursive retry
+- **Retry timer leak** — `DownloadQueueManager` tracks `Timer` instances, cancels on dispose
+- **FailedUrlsCache unbounded growth** — replaced `Set<String>` with `Map<String, DateTime>` + 5min TTL
+- **Delete dialog defaults to CANCEL** (selection index 1, not 0)
+- FTP download cancel now disconnects the FTP session
+- `totalBytes` clamping — treats `<= 0` as unknown so progress bar works correctly
+- Global search `providerConfig` propagation — results open with correct provider
+- `RepoManager` Dio connection leak — `dio.close()` in `finally` block
+- `GameDetailController` / `GameListController` — disposed-guard prevents post-dispose `notifyListeners()`
+- Global search Escape/B from text field moves focus to results instead of closing
+- Search overlay left/right arrows no longer leak to grid while editing
+
+### Internal
+- `DownloadItem` fully immutable (all fields `final`), serializes `systemId` + `providerConfig`
+- `DatabaseService` schema v3 (adds `provider_config` column with migration)
+- `gamepad_key_fix.dart` installed at app startup via `main()`
+- Download overlay refactored into `_buildSectionedList` / `_buildCard` / `_buildSectionHeader` helpers
+
+---
+
+## [0.9.3] Beta — 2026-02-19
+
+### Added
+- RomM onboarding wizard — guided first-run setup with connection test, platform auto-discovery, and folder assignment
+- Game list filter overlay (X button) — filter ROMs by region and language with per-console persistence
+- Global search overlay infrastructure (cross-system search, wired but trigger disabled until v0.9.4)
+- Android foreground service — downloads continue in background with a persistent notification
+- Download queue persistence — queued and errored downloads survive app restarts
+- Automatic download retry with exponential backoff (3 attempts, 5s/15s/45s)
+- Configurable concurrent download limit (1–3) in Settings
+- RomM config screen for editing server URL, API key, and credentials
+- Local folder scanner and fuzzy system-ID matcher for onboarding folder assignment
+
+### Improved
+- RomM ROM list fetching is now paginated (pages of 500, no more timeouts on large libraries)
+- RomM platform API accepts both `items` and `results` response keys (multi-version support)
+- Download overlay action button is context-aware (Cancel / Retry / Clear)
+- Filter and search are mutually exclusive in the game list
+- Onboarding console setup no longer requires a provider (target folder only is valid)
+
+### Fixed
+- RomM ROM fetch used a malformed `platform_ids` query parameter
+- Download overlay showed "Retry" for completed items
+- Game grid passed unfiltered variant lists when filters were active
+- Home view carousel index jumped after system list refresh
+
+### Internal
+- Added `flutter_foreground_task` dependency
+- Android manifest: foreground service, notification, and battery optimization permissions
+- `FilterState` / `ActiveFilters` model extracted; `RommSetupState` added to onboarding controller
+- `DownloadQueueManager` now takes `StorageService`; `GameDetailController` takes `DownloadQueueManager`
+- `local_folder_matcher_test.dart` unit tests
+
+---
+
 ## [0.9.2] Beta — 2026-02-18
 
 ### Added

README.md

@@ -7,7 +7,7 @@ A premium console-style game manager for Android — built for handhelds, contro
   <img src="screenshots/console_list.png" width="600" alt="R-Shop Console Overview" />
 </p>
 
-![Version](https://img.shields.io/badge/version-0.9.3_Beta-blue)
+![Version](https://img.shields.io/badge/version-0.9.4_Beta-blue)
 ![License](https://img.shields.io/badge/license-MIT-green)
 ![Platform](https://img.shields.io/badge/platform-Android-brightgreen)
 ![Status](https://img.shields.io/badge/status-Public_Beta-orange)
@@ -20,31 +20,33 @@ R-Shop is a Flutter-based Android app that gives you a **console-like experience
 
 It's built with love for **Android gaming handhelds** (Retroid, Odin, AYN, Anbernic…) but works beautifully on any Android device with touch or controller input.
 
-> **⚠️ Important:** R-Shop is a neutral browser. It does **not** host, distribute, or link to any copyrighted content. Users must provide their own source URLs.
+> **Important:** R-Shop is a neutral browser. It does **not** host, distribute, or link to any copyrighted content. Users must provide their own source URLs.
 
 ---
 
-## ✨ Features
-
-- 🎮 **Built for Controllers** — Full D-pad/analog navigation with auto-scroll, haptic feedback on every interaction, satisfying click sounds. Feels like a real console UI, not a phone app.
-- 🌐 **Multi-Source Providers** — Each console can pull from Web directories, SMB shares, FTP servers, or a RomM instance. Mix and match per system.
-- 🔗 **RomM Integration** — Connect to your RomM server and let R-Shop automatically match platforms via IGDB.
-- 📥 **Smart Download Queue** — Queue up your entire library. Downloads run with live progress and auto-extraction (ZIP/7z).
-- ✅ **Installed Indicator** — Already downloaded? A glowing LED strip on each game card tells you at a glance.
-- 🖼️ **Automatic Box Art** — Every game gets its cover art fetched and cached automatically via [libretro-thumbnails](https://github.com/libretro-thumbnails).
-- ⚡ **Aggressive Caching** — Optimized for huge libraries (5000+ items). After the first load, the app feels instant even without internet.
-- 🔍 **Instant Search** — Find any game across all systems in milliseconds.
-- 🗂️ **27 Systems Supported** — Nintendo (NES to 3DS), Sony (PS1–PSP), SEGA (Master System to Dreamcast), and more.
-- 🔍 **Global Search** — Find any game across all cached systems instantly from the home screen.
-- 🎚️ **Region & Language Filters** — Filter game lists by region or language, with per-system persistence.
-- 📡 **Global RomM Connection** — Configure your RomM server once in settings and auto-fill credentials for every console.
-- ⚙️ **Configurable Downloads** — Adjust max concurrent downloads (1–3) and queue is persisted across app restarts.
-- 📱 **Hybrid Input** — Seamlessly switch between touchscreen and gamepad. Both feel native.
-- 💾 **Config Import/Export** — Save your entire setup as JSON and restore it on any device.
+## Features
+
+**Controller-first UI** — Full D-pad and analog stick navigation with auto-scroll, haptic feedback, and click sounds. Every interaction feels like a real console interface, not a phone app. Touch and gamepad input work side by side; both feel native.
+
+**Multi-source providers** — Each console can pull from Web directories, SMB shares, FTP servers, or a RomM instance. Mix and match per system, configure once globally or per console.
+
+**RomM integration** — Connect to your RomM server and let R-Shop automatically match platforms via IGDB. Configure the connection once in settings and auto-fill credentials for every console.
+
+**Smart download queue** — Queue up your entire library. Downloads run with live progress, auto-extraction (ZIP/7z), and the queue persists across app restarts. Adjust concurrent downloads (1–3) in settings.
+
+**Automatic box art** — Every game gets its cover art fetched and cached automatically via [libretro-thumbnails](https://github.com/libretro-thumbnails). An installed indicator (glowing LED strip) on each game card tells you at a glance what you've already downloaded.
+
+**Aggressive caching** — Optimized for huge libraries (5000+ items). After the first load, the app feels instant even without internet.
+
+**Global search** — Find any game across all cached systems instantly from the home screen.
+
+**Region and language filters** — Filter game lists by region or language, with per-system persistence.
+
+**Config import/export** — Save your entire setup as JSON and restore it on any device.
 
 ---
 
-## 📸 Screenshots
+## Screenshots
 
 <p align="center">
   <img src="screenshots/console_list.png" width="250" alt="Console Overview" />
@@ -54,13 +56,32 @@ It's built with love for **Android gaming handhelds** (Retroid, Odin, AYN, Anber
 
 ---
 
-## 📲 Installation & Updates
+## Supported Systems (27)
+
+| Nintendo | Sony | SEGA | Other |
+|----------|------|------|-------|
+| NES | PlayStation | Master System | Neo Geo Pocket Color |
+| Super Nintendo | PlayStation 2 | Mega Drive | Arcade |
+| Nintendo 64 | PlayStation 3 | Game Gear | Xbox |
+| GameCube | PlayStation 4 | Saturn | Xbox 360 |
+| Wii | PSP | Dreamcast | |
+| Wii U | PS Vita | | |
+| Switch | | | |
+| Game Boy | | | |
+| Game Boy Color | | | |
+| Game Boy Advance | | | |
+| Nintendo DS | | | |
+| Nintendo 3DS | | | |
+
+---
+
+## Installation & Updates
 
 ### Recommended: Obtainium
 The best way to install and keep R-Shop updated is via **[Obtainium](https://github.com/ImranR98/Obtainium)**.
 1. Install Obtainium.
 2. Add this repository URL.
-3. Enjoy automatic updates for every new Beta release!
+3. Enjoy automatic updates for every new Beta release.
 
 ### Manual APK
 1. Go to the [**Releases**](../../releases) page.
@@ -69,44 +90,56 @@ The best way to install and keep R-Shop updated is via **[Obtainium](https://git
 
 ---
 
-## 🕹️ How to Use
+## Getting Started
+
+1. **Launch R-Shop.** On first start, the onboarding wizard walks you through setup.
+2. **Configure your consoles.** For each system you want, pick a source type (Web directory, SMB share, FTP server, or RomM) and enter the connection details.
+3. **Choose a download folder.** Select where games should be stored per console (e.g., your ROMs folder).
+4. **Browse and download.** The app handles the rest — box art, caching, and organization are automatic.
 
-1. **Open the app.**
-2. **Onboarding Wizard:** On first launch, the setup wizard walks you through configuring each console. For every system you want, pick a source type (Web directory, SMB share, FTP server, or RomM) and enter the connection details.
-3. **Pick a Folder:** Choose where games should be stored per console (e.g., your ROMs folder).
-4. **Browse & Download:** The app handles the rest. You can edit your console configuration later in **Settings > Config Editor**.
+You can edit your console configuration at any time in **Settings > Config Editor**.
 
 ---
 
-## 🐛 Known Issues (Beta)
+## Building from Source
 
-* **Initial Cache:** Scrolling through a list of 2000+ games for the very first time might show placeholders briefly while the cache builds up.
+```bash
+git clone https://github.com/AverageConsumer/R-Shop.git
+cd R-Shop
+flutter pub get
+flutter build apk --release
+```
+
+The built APK will be at `build/app/outputs/flutter-apk/app-release.apk`.
 
 ---
 
-## 🤝 Contributing
+## Known Issues (Beta)
+
+* **Initial cache:** Scrolling through a list of 2000+ games for the very first time might show placeholders briefly while the cache builds up.
+
+---
 
-Contributions are welcome and **greatly appreciated**! This project is maintained by a solo dev who honestly can't even code that well — so if you're a Flutter wizard, your help would be legendary. 🧙
+## Contributing
 
-See **[CONTRIBUTING.md](CONTRIBUTING.md)** for details.
+Contributions are welcome! See **[CONTRIBUTING.md](CONTRIBUTING.md)** for details.
 
 ---
 
-## 📜 License
+## License
 
 This project is licensed under the **MIT License** — see the [LICENSE](LICENSE) file for details.
 
 ---
 
-## 🙏 Acknowledgments
+## Acknowledgments
 
-- **[libretro-thumbnails](https://github.com/libretro-thumbnails)** — For the massive database of game covers.
-- **viik4 / iisu** — For the clean platform icons used in the UI.
-- **Flutter** — The framework powering this app.
-- **The SBCGaming Community** — For the inspiration! 🕹️
+- **[libretro-thumbnails](https://github.com/libretro-thumbnails)** — Game cover database
+- **viik4 / iisu** — Platform icons
+- **The SBCGaming Community** — Inspiration
 
 ---
 
-## ⚠️ Disclaimer
+## Disclaimer
 
 R-Shop is a tool for managing your personal game library. It does **not** include, distribute, or endorse piracy of any kind. Users are solely responsible for the content they access. Always respect copyright laws in your jurisdiction.

android/app/src/main/kotlin/com/example/r_shop/MainActivity.kt

@@ -62,7 +62,7 @@ class MainActivity : FlutterActivity() {
             val zis = ZipInputStream(BufferedInputStream(fis))
             var entry = zis.nextEntry
             while (entry != null) {
-                totalBytes += entry.size
+                if (entry.size > 0) totalBytes += entry.size
                 entry = zis.nextEntry
             }
             zis.close()
@@ -73,9 +73,18 @@ class MainActivity : FlutterActivity() {
             val zis = ZipInputStream(BufferedInputStream(fis))
             var entry = zis.nextEntry
 
+            val canonicalTarget = File(targetPath).canonicalPath
+
             while (entry != null) {
                 val file = File(targetPath, entry.name)
 
+                // Zip Slip protection: reject entries that escape the target directory
+                if (!file.canonicalPath.startsWith(canonicalTarget + File.separator) &&
+                    file.canonicalPath != canonicalTarget) {
+                    entry = zis.nextEntry
+                    continue
+                }
+
                 if (entry.isDirectory) {
                     file.mkdirs()
                 } else {