MegaGlass 0.2.4

Alpha release for Android 15 and later (arm64-v8a).

Update: Install this APK over 0.2.3. Your login, settings and offline files stay. After the update, the MEGA SDK gets a new random device ID one time. In Device Centre, the syncs and camera uploads (backups) of this session can show under a new device.

Changed

• A file that is available offline now opens from its offline copy in Drive, Photos and Search. It also opens without a network.
• When the session cannot resume without a network, the loading screen (after 5 s) and the error screen show "Open offline files".
• When you edit and save an offline text file, the new version stays offline. The old copy stays until the new copy is complete. The Offline list marks a copy as old when its file is deleted or has a newer version.
• The app lock does not show again when you come back from a file picker, the camera, a share sheet or "Open with" that MegaGlass opened. This applies to one return in 2 minutes. An exit to Home or Recents still locks the app.
• The app asks for the notification permission at the first transfer or when you turn on camera uploads, not at each start. When notifications are off, Transfer settings show "Notifications are off". This row opens the system notification settings.
• "Move to rubbish bin" in an incoming share and "Remove link" ask you to confirm first. Your own items still go to the rubbish bin at once, with Undo.
• The passcode setup screen and the wrong passcode message now tell you the full rule: after 10 wrong passcodes, MegaGlass logs out and deletes offline files and photos that did not upload.
• Error messages are now clear text. They do not show raw codes such as "Error -17", and they are never empty.
• TalkBack reads the selected items in grid view and in Photos, the names of the colour labels, the number of passcode digits, each wrong passcode, and the file name of a photo without a thumbnail. A TalkBack action shows or hides the video controls.
• The video controls stay on the screen for the time of the system setting "Time to take action", not for a fixed 3.5 s.
• The periodic camera uploads check runs every 6 hours, and not when the battery is low. New photos and "Upload now" still start an upload at once.
• Thumbnails, the photo timeline, folder screens and the transfer list do less work. A thumbnail that scrolls out of view before it loads does not download again. Hidden folder screens do not reload during a large sync.
• The native MEGA library is about 25 MB, not 33 MB (estimate). The release APK is about 33 MB (estimate).
• Build and tests: Gradle 9.8.2, kotlinx-serialization 1.12.0, DataStore 1.3.0 and material3 1.5.0-beta02. The APK does not contain library version files, licence copies and Kotlin metadata files. New unit tests and lint fixes.

Fixed

• When Photos, Search, Shared, Home recents or an album did not load, the screen showed "No photos" or "No results". Now it shows an error with Retry.
• A failed load of a system album stopped the app.
• Search showed fewer results than were available, because it removed the rubbish bin matches after it read the first 500 nodes. Now it shows up to 500 results outside the rubbish bin, and a note when the list is at this limit.
• The new folder dialog showed the wrong message when a folder with the same name was already there.
• The status bar and navigation bar icons were hard to read when the app theme was not the same as the system theme.

Privacy and security

• The MEGA SDK does not send a hash of the Android ID as the device ID. MegaGlass gives the SDK a random ID for each login, and deletes it at logout. MEGA cannot use the device ID to link two accounts on the same phone.
• The MEGA SDK sends no diagnostic events or error reports to MEGA. Some of these events contained file fingerprints and MACs. The SDK also does not add the journey ID from the server to the API requests.
• The user agent does not contain the kernel release or the CPU architecture. It is the same on every device.
• The local stream server for video and audio sends no CORS header. A web page in a browser on the phone cannot read a stream.
• The native library uses curl with HTTP(S) and WebSockets only. The other protocol handlers (for example FTP, SMTP and TELNET) are not in the build.
• All native code has BTI and PAC branch protection. Android enforces BTI for the native library on devices that support it.
• The native library exports only its JNI functions, not about 40,000 symbols (estimate). The linker removes more unused code.
• A copied recovery key or 2FA secret is cleared from the clipboard after 60 s, also when the app process stops before then.
• The keyboard does not learn the key or the password of a public link.
• A new session key uses StrongBox when the phone has it, else the TEE. An existing key stays valid.
• When a public folder link closes, MegaGlass deletes the file list of that link from app storage.
• Decrypted copies for other apps and for link downloads are trimmed during the session, not only at app start.
• Release builds do not write stack traces, console prints or verbose logs to logcat. Before, the SDK image code could write photo and video paths there.
• The README now tells what all-files access gives the app, that the SDK does not check the certificates of the storage servers, and that another app that finds the stream port can read the file that plays.
• Build: the native SDK builds only from a clean tree with the patches, and Gradle checks the versions of all 12 native components. The release signing reads the Keychain passwords only for a signed release.

Verify the APK

File	Description
MegaGlass-0.2.4.apk	Signed release APK, arm64-v8a

• SHA-256: 15a83adfa13dd1619b0c713f9233f8e4252cc9e9242c02bb1e85df93d4f74324
• Signing certificate SHA-256: 84c7ed6935e18d6e6aebc6e3c490e3aa5468974ee856baf1df979bda3c7b5241

On Android, these changes were tested with unit tests, build and lint only, not on a device with a live account.