sigma file manager

Technical Briefing – sigma-file-manager Clone: https://github.com/moses-y/sigma-file-manager

The Problem

The repository assembles five semi‑independent projects (a Tauri‑based desktop file manager, a Vue UI, a Rust backend, WebDriver e2e tests, and small utility packages) into a single clone. While the codebase is functional, the measured static‑analysis results reveal maintainability risks that affect onboarding, future feature work, and CI safety.

What This Does

sigma-file-manager is a cross‑platform (Windows / Linux) file‑manager UI built with Vue 3 and Tauri 1. The Rust backend (src‑tauri/) handles filesystem operations, extensions, and system integration; the Vue front‑end (src/) provides the navigator, settings, and extensions UI.

Key structural elements (from the WHAT EACH FILE IS RESPONSIBLE FOR block):

File / Folder	Primary responsibilities (function / type count)	Notable exported symbols
`src‑tauri/src/file_operations.rs`	38 functions, 4 types; defines `report_progress_for_item`, `copy_file_resilient`, `copy_symlink`, `maybe_emit_scan_progress`; reads/writes files.	`copy_file_resilient`, `normalize_path`
`src‑tauri/src/dir_reader/commands.rs`	15 functions; defines `read_dir`, `read_dir_with_timeout`, `get_dir_entry_with_timeout`, `resolve_windows_directory_shortcut`, `get_system_drives`.	`read_dir`, `get_system_drives`
`src‑tauri/src/extensions/http.rs`	54 functions, 3 classes; defines `build_http_client`, `into_message`, `fmt`, `from`, `default`.	`build_http_client`
`src‑tauri/src/startup_storage_bootstrap.rs`	18 functions, 3 classes; defines `normalize_path`, `build_app_user_data_dir`, `migrate_legacy_user_storage_filenames`.	`normalize_path`, `get_preloaded`
`src‑tauri/src/extensions/commands.rs`	39 functions, 2 classes; registers extension install cancellation, gets extension dir/path.	`get_extension_dir`, `get_extension_path`
`src‑tauri/src/utils.rs`	17 functions; defines `normalize_path`, `path_is_descendant_of`, `minimize_delete_paths`, `path_extension_lowercase`, `is_hidden_path`.	`normalize_path`, `is_hidden_path`
`src‑tauri/src/app_updater.rs`	32 functions, 3 classes; semver‑aware update logic.	`is_semver_app_release_tag`, `parse_all_entries_from_atom`
`src‑tauri/src/image_thumbnails.rs`	44 functions, 2 classes; thumbnail generation and caching.	`thumbnail_cache_key`, `video_thumbnail_cache_key`
`src‑tauri/src/dir_reader/drives_platform.rs`	14 functions, 2 classes; platform‑specific drive detection.	`is_network_filesystem`, `should_skip_linux_mount`
`src‑tauri/src/archive.rs`	20 functions, 4 classes; archive creation/extraction with cancel support.	`new_archive_job_id`, `is_safe_archive_relative_path`
`src‑tauri/src/extensions/binaries.rs`	24 functions, 4 classes; binary discovery and path resolution.	`resolve_binary_file_path`, `get_shared_binary_dir`
`src‑tauri/src/process_runner.rs`	3 functions, 2 classes; runs external commands (`is_success`, `run_command_blocking`).	`run_command_blocking`, `command_succeeds`

Internal call graph (839 resolved call edges). The most‑connected functions are normalize_path (27 callers), read_dir (24), authorize_extension_caller (16), build_http_client (12), get_extension_dir (10), resolve_binary_file_path (10), from_str (9), canonicalize_path (9), command_exists (9), drop (8), remove_dir_force (8), is_success (7). These hubs mean a change in any of them ripples across many modules.

Measured high‑impact findings (65 total: 14 high, 51 medium, 0 low):

Cognitive load – deep nesting (x29): src‑tauri/src/dir_watcher.rs, src‑tauri/src/extensions/fs_ops.rs, src‑tauri/src/extensions/misc.rs – max indentation depth 9; guard‑clause refactor recommended.
Clarity – duplicated code blocks (797 repeated 6‑line blocks across 262 files): packages/api/index.d.ts, src/modules/extensions/api/create-fs-api.ts, src/modules/extensions/api/create-ui-api.ts, src/modules/extensions/api/create-shell-api.ts; extract shared helpers.
Cognitive load – oversized files (x25): src/modules/extensions/components/extension-detail.vue, src/modules/settings/ui/categories/shortcuts/shortcuts.vue, src‑tauri/src/file_operations.rs – 1848‑line files; split by responsibility.
Cognitive load – high branching density (x5): src/modules/navigator/components/file-browser/utils/file-browser-sort.ts, src‑tauri/src/extensions/archives.rs, src‑tauri/src/global_search/scoring.rs – 17 branch points over ~50 lines; decompose with strategy/dispatch.

How It Is Wired

Execution starts at the Tauri entry points:

Entry point	File	Reaches
`start_lan_share`	`src‑tauri/src/lan_share/server.rs:20`	15 functions (no internal callers)
`run`	`src‑tauri/src/lib.rs:171`	1 function (the Tauri “run” hook)
`get_local_ip`	`src‑tauri/src/lan_share/server.rs:170`	3 functions
`calculate_dir_size`	`src‑tauri/src/global_search/index.rs:51`	17 functions (called from 3 places)
`open_or_create_index`	`src‑tauri/src/global_search/index.rs:139`	4 functions (called from 5 places)
`validate_index`	`src‑tauri/src/global_search/index.rs:106`	3 functions (called from 1 place)

The global‑search module (src‑tauri/src/global_search/) is the only place that touches the file‑system index; calculate_dir_size, open_or_create_index, and validate_index are the primary pathways. normalize_path (defined in src‑tauri/src/utils.rs) is the most‑called utility, feeding every path‑related operation (read_dir, copy_file_resilient, etc.). The extension system (src‑tauri/src/extensions/) plugs into the UI via the composable use-file-browser modules; the most‑connected extension composable is use-file-browser (Ca 0, Ce 16, instability 1).

What the code touches outside itself: 10 functions perform file reads/writes; 4 functions invoke external commands (via process_runner.rs). No Dockerfile is present; the project builds natively on Windows/Linux via Cargo + Tauri.

How To Use It

Setup – The repo uses npm (root package.json, packages/api/package.json) for the Vue UI and Cargo ( src‑tauri/Cargo.toml ) for the Tauri backend. No explicit launch script is documented; the typical Tauri workflow is cargo tauri dev (or npm run dev for the Vite front‑end), but the exact command is not captured in the static analysis.
Configuration – No environment‑variable or secret files are committed; the repo’s .github/workflows/ci.yml installs dependencies without persisting credentials (persist-credentials: false is not set, see hygiene section).
Running it – To get a local development instance, clone the repo and run cargo tauri dev from the root (assuming Rust toolchain and Node are available). The Vue UI will start via Vite under localhost:5173 and the Tauri binary will embed it.

Real‑World Use

A user opens the app and invokes the global search (typing a filename). The flow is:

Vue component sends the query to the Tauri backend (src‑tauri/src/global_search/index.rs:139 → open_or_create_index).
calculate_dir_size walks the filesystem (read_dir from src‑tauri/src/dir_reader/commands.rs).
Results are filtered by the typo‑correction logic and returned to the UI.
The user clicks a result; the app invokes copy_file_resilient (src‑tauri/src/file_operations.rs) to move or copy the file, with progress reported through report_progress_for_item.

The entire path from keystroke to filesystem action traverses ≤ 5 function calls, demonstrating a relatively tight integration between UI and backend.

Code Health & Issues

Findings from the measured audit (6 items, 0 critical):

HIGH – Pin third‑party GitHub Actions to a commit SHA: .github/workflows uses @vN tags for volta-cli/action@v4, dtolnay/rust-toolchain@stable, Swatinem/rust-cache@v2, tauri-apps/tauri-action@v0. Tags can move, risking secret exposure. Fix: replace each @vN with the 40‑character SHA and let Dependabot bump SHAs.
MEDIUM – Enable Dependabot or Renovate: 4 manifest files, no update bot configured. Fix: add .github/dependabot.yml covering npm, Cargo, and GitHub Actions.
MEDIUM – Gate pull‑requests on a dependency vulnerability scan: no dependency scan in CI. Fix: add dependency-review-action on pull_request or osv-scanner on push + schedule.
MEDIUM – Move large binaries to Git LFS or out of the repo: src/assets/media/Starry Sky by Andreas.mp4 (6.1 MB) and Drone Footage… (5.4 MB) are > 5 MB blobs. Fix: track with LFS or fetch from object storage in a setup step.
MEDIUM – Set persist-credentials: false on checkout: checkout retains the token for later steps, risking credential leakage. Fix: add with: persist-credentials: false and pass an explicit token only to the push step.
LOW – Set timeout-minutes on CI workflow jobs: 3 jobs declare no timeout, risking overlap behind a two‑hourly schedule. Fix: add realistic timeout-minutes to each job.

The Bottom Line

The repository delivers a functional, feature‑rich file manager for Windows and Linux, with a modern Vue 3 UI and a Rust‑powered Tauri backend. However, the codebase suffers from deep nesting, massive duplication, and oversized files that increase cognitive load and hinder future changes. The CI hygiene gaps (unpinned Action versions, missing Dependabot, no vulnerability gating, large binaries in Git) pose moderate risk for a production‑grade open‑source project. Teams looking for a quick‑start file‑manager prototype can adopt it now, but should budget refactoring time to flatten nesting, extract shared helpers, and adopt the recommended CI safeguards before scaling.