fix(install): stage APKs before the grant dies, and let the prompt alert

Two faults in the notification install path, both found on device.

The install failed with "Permission Denial: opening provider
ru.zdevs.zarchiver.provider.FileProvider ... that is not exported". The
staging comment claimed parsing leaves cached copies in pendingApkUris — that
is only true for archives, which get extracted. A plain APK keeps the
caller's own URI, whose read grant dies with the activity that received the
intent, so the install read it too late and was denied. Copies are now made
explicitly while the grant is alive, exposed through our own FileProvider so
every install backend can open them, and swept after an hour so an
unanswered prompt does not cost disk forever. A partial copy returns null
rather than installing an incomplete split set.

The prompt also sat silently in the shade instead of arriving. Its channel
was IMPORTANCE_DEFAULT, which only earns a shade row — a notification that
asks a question has to interrupt. Now HIGH, under a new channel id because
Android ignores importance changes to a channel that already exists.

Verified on device: the notification arrives with Install / Cancel, and
Install now reaches the system confirmation with no SecurityException.
Heads-up is still suppressed while Do Not Disturb is on, which is the
device's call to make, not ours.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: nqmgaming

app/src/main/java/app/pwhs/universalinstaller/presentation/install/InstallPromptNotifier.kt

@@ -30,7 +30,7 @@ import java.io.File
  *  - **Cancel** is a broadcast to [InstallActionReceiver], which needs no window at all.
  *
  * The channel is deliberately its own: this is the only install notification that expects an
- * answer, so it takes DEFAULT importance while progress stays quiet on LOW.
+ * answer, so it takes HIGH importance and arrives as a heads-up, while progress stays quiet on LOW.
  */
 class InstallPromptNotifier(
     private val context: Context,
@@ -66,8 +66,12 @@ class InstallPromptNotifier(
             .setContentTitle(title)
             .setContentText(body)
             .setStyle(NotificationCompat.BigTextStyle().bigText(body))
+            // A question needs to arrive, not wait in the shade to be discovered. HIGH + a
+            // full-screen-less heads-up is what makes it pop over the current app; DEFAULT only
+            // added a shade row, which meant swiping down to find it.
             .setCategory(NotificationCompat.CATEGORY_RECOMMENDATION)
-            .setPriority(NotificationCompat.PRIORITY_DEFAULT)
+            .setPriority(NotificationCompat.PRIORITY_HIGH)
+            .setDefaults(NotificationCompat.DEFAULT_ALL)
             .setOnlyAlertOnce(true)
             .setAutoCancel(false)
             // A prompt nobody answers must not linger as a dead button: swiping it away is
@@ -147,7 +151,7 @@ class InstallPromptNotifier(
         val channel = NotificationChannel(
             CHANNEL_ID,
             context.getString(R.string.install_prompt_channel_name),
-            NotificationManager.IMPORTANCE_DEFAULT,
+            NotificationManager.IMPORTANCE_HIGH,
         ).apply {
             description = context.getString(R.string.install_prompt_channel_desc)
             setShowBadge(true)
@@ -157,7 +161,11 @@ class InstallPromptNotifier(
     }
 
     private companion object {
-        const val CHANNEL_ID = "install_prompt"
+        /**
+         * Versioned: Android ignores importance changes to a channel that already exists, so the
+         * v1 channel would stay on DEFAULT for anyone who had already received a prompt.
+         */
+        const val CHANNEL_ID = "install_prompt_v2"
         const val NOTIF_ID_BASE = 43000
     }
 }

app/src/main/java/app/pwhs/universalinstaller/presentation/install/InstallViewModel.kt

@@ -571,8 +571,14 @@ class InstallViewModel(
         if (uris.isNullOrEmpty()) return null
         val fileName = pendingFileName ?: return null
 
+        // Copy now, while the grant is still alive. What the parse leaves in pendingApkUris is
+        // the caller's own URI for a plain APK (only archives get extracted into our cache), and
+        // that URI dies with this activity — installing from it later fails with
+        // "Permission Denial: opening provider <their>.FileProvider ... not exported".
+        val installableUris = copyForLaterInstall(uris) ?: return null
+
         val entry = PendingInstallStore.put(
-            apkUris = uris,
+            apkUris = installableUris,
             originalUri = pendingOriginalUri,
             fileName = fileName,
             packageName = apkInfo.packageName,
@@ -593,6 +599,47 @@ class InstallViewModel(
         return entry
     }
 
+    /**
+     * Duplicate [uris] into our own cache and hand back FileProvider URIs for the copies.
+     *
+     * Needed because a pending install outlives the activity that received the intent, and with
+     * it the one-shot read grant on the source. Copies go through our own provider rather than
+     * `file://` so every install backend sees a URI it can open.
+     *
+     * @return null if any copy fails — a partial split set would install as a broken app.
+     */
+    private suspend fun copyForLaterInstall(uris: List<Uri>): List<Uri>? = withContext(Dispatchers.IO) {
+        runCatching {
+            val dir = File(application.cacheDir, "$PENDING_INSTALL_DIR/${System.currentTimeMillis()}")
+            if (!dir.mkdirs() && !dir.isDirectory) error("Could not create $dir")
+            prunePendingInstallCache()
+            uris.mapIndexed { index, uri ->
+                val target = File(dir, "$index.apk")
+                application.contentResolver.openInputStream(uri)?.use { input ->
+                    target.outputStream().use { output -> input.copyTo(output) }
+                } ?: error("Could not read $uri")
+                FileProvider.getUriForFile(
+                    application,
+                    "${application.packageName}.fileprovider",
+                    target,
+                )
+            }
+        }.onFailure { Timber.e(it, "Could not stage APKs for a pending install") }.getOrNull()
+    }
+
+    /**
+     * Drop staged copies older than [PENDING_INSTALL_TTL_MS]. They are only needed until the
+     * notification is answered, and a prompt nobody answers should not cost disk forever.
+     */
+    private fun prunePendingInstallCache() {
+        val root = File(application.cacheDir, PENDING_INSTALL_DIR)
+        val cutoff = System.currentTimeMillis() - PENDING_INSTALL_TTL_MS
+        root.listFiles()?.forEach { dir ->
+            val stamp = dir.name.toLongOrNull() ?: return@forEach
+            if (stamp < cutoff) dir.deleteRecursively()
+        }
+    }
+
     /**
      * Put a stashed parse back so [confirmInstall] — and the dialog, if it is being shown — see
      * exactly the state that produced the notification. No re-parse, so split selection and OBB
@@ -1258,6 +1305,12 @@ class InstallViewModel(
         /** User-facing folder under /sdcard/Download/ so downloads are easy to browse. */
         const val DOWNLOADS_SUBFOLDER = "UniversalInstaller"
 
+        /** Cache subfolder holding APKs staged for a notification the user has not answered. */
+        private const val PENDING_INSTALL_DIR = "pending_install"
+
+        /** How long a staged copy is kept before being swept. */
+        private const val PENDING_INSTALL_TTL_MS = 60 * 60 * 1000L
+
         private val ABI_TOKENS = setOf(
             "armeabi_v7a", "arm64_v8a", "x86_64", "armeabi", "x86", "mips64", "mips",
         )