DriveTrace

Find what is new, what is large, where it lives, and what the available evidence says about who changed it.

DriveTrace is a native SwiftUI desktop application for browsing and investigating Google Drive metadata. It combines the Google Drive API for files, folders, permissions, and change tracking with the Google Drive Activity API for the actor/action evidence Google makes available.

Use it to find recent additions, inspect the largest known files, combine metadata filters, review sharing details, or follow a folder's changes. A local SQLite index makes repeated searches and recorded-history review possible without requesting every file again. Real synchronization contacts Google; demo mode uses a separate synthetic workspace.

The app runs directly on macOS with system frameworks. It has no Python service, embedded browser UI, hosted backend, analytics SDK, or third-party runtime packages. Authentication opens your default browser. Metadata and activity remain the default connection. An optional management connection enables on-demand native previews and confirmed Move to Trash. There is no permanent-delete or empty-trash action.

Detailed evidence and limits are in Verification and the native migration matrix. “Implemented” does not mean every real-account scenario has passed.

These are direct captures from the native macOS app using synthetic files and example.test identities. They contain no connected Google account or private Drive inventory.

Start with the isolated demo or configure your own Desktop OAuth client.

Compare known file size and quota usage while keeping owner, creation time, modification time, and local discovery separate.

Combine filters and save useful searches. Local metadata filtering supports fields that Google does not offer as server-side query operators.

Review source-labelled records and inspect raw evidence. Unknown actors and incomplete coverage remain visible.

Browse retained snapshots with their observation times, original metadata, and explicit uncertainty about existence and access.

Group known storage by type, direct parent, or Drive. Click a chart bar or category row to open its indexed, nontrashed files, largest first. Search, sort, inspect and save the category as a local search; Back to Storage overview returns to the same grouping. Clear search removes the category. Same-named folders and drives remain separate by ID. “Chemical” means Google reported a chemical/* MIME type; it is metadata, not a content analysis. Missing sizes stay Unknown; Workspace documents are not silently counted as zero-byte files. A light appearance capture is also available.

Use macOS 14 or later and a Swift 6 toolchain with the macOS SDK. Development was verified on Apple silicon with Swift 6.4 and the macOS 27 SDK; older OS/toolchain and Intel compatibility have not been run.

git clone https://github.com/hideouts-io/DriveTrace.git
cd DriveTrace
./script/test.sh
./script/build_and_run.sh

The second command builds Release, packages the original blue Dock icon, creates and ad-hoc signs the native bundle, then launches it. dist/DriveTrace.app is a local symbolic link to the verified bundle in the build cache; dist/DriveTrace.zip is the portable archive. The Codex Run action uses the same script. The generated app and build intermediates go to ~/Library/Caches/DriveExplorerBuild because this machine's Documents file provider attaches metadata that can invalidate strict signature checks on application and test bundles. Only generated application-bundle extended attributes are cleared before signing.

The .app is for local use. It is not notarized or signed with a Developer ID; do not present it as a distributable release. The build does not install the app or modify Google Drive.

Choose Explore demo to use synthetic data without credentials or startup Keychain access. In a demo item’s inspector, Try a synthetic preview sample opens clearly labelled local sample text in Quick Look. Demo is a separate SQLite workspace; its files do not open in Google Drive. The app remembers demo mode, saved searches, watch rules, notification preference and appearance.

The preview still runs locally without a Developer ID. A prepared script/notarize.sh workflow signs a separate copy, uploads that copy to Apple, waits for acceptance, staples the ticket, and verifies the final extracted ZIP. It never publishes a GitHub release or changes the running preview. Its preflight and local ad-hoc signing checks pass; Developer ID signing, Apple submission and end-user Gatekeeper launch remain unverified.

1. Install your Developer ID Application certificate and its private key locally using Xcode or Keychain Access. Find its certificate SHA-1 with security find-identity -v -p codesigning. This host currently has no such identity.
2. In your own Terminal, run xcrun notarytool store-credentials "DriveTrace-notary" and complete Apple's secure prompts. Keep the credentials in Keychain; never paste them into chat, command arguments or Git.
3. Quit the app, run ./script/test.sh and ./script/build.sh, and review the generated app before uploading it.
4. Explicitly run ./script/notarize.sh "YOUR_40_CHARACTER_CERTIFICATE_SHA1" "DriveTrace-notary". This is the step that uploads the signed app to Apple. Output and private diagnostics stay under ~/Library/Caches/DriveExplorerBuild/notarization.*.
5. Only a successful run reports the final DriveTrace.zip and SHA256SUMS. A timeout may leave a submission processing at Apple; inspect its local submission.json and use notarytool info/log before resubmitting. Test the final archive on a separate Gatekeeper-enabled Mac, including supported older macOS/Intel machines, before distribution.

Follow Apple's notarization workflow and Developer ID requirements. Notarization does not validate Google consent, API coverage or accessibility.

Open DriveTrace → Settings (⌘,) → Connect Google Drive…, or use the welcome-screen button. The native guide stays open beside your browser and separates configuration saved, sign-in saved, and a completed sync in the current session. Advancing a page does not claim the Cloud project was verified. Instructions were checked against official Google documentation on 2026-09-29.

1. Project and APIs: in Google Cloud Console, select or create a project. Under APIs & Services → Library, enable Google Drive API and Google Drive Activity API in that same project. See Google's Drive quickstart and Activity quickstart.
2. Consent: open Google Auth platform → Branding → Get Started. Supply an app name, support/contact email and audience; review Google's policy yourself. Personal Gmail uses External. In Testing, add your sign-in account under Audience → Test users. Eligible Workspace projects can use Internal, subject to organization policy. Under Data Access → Add or Remove Scopes, declare https://www.googleapis.com/auth/drive.metadata.readonly and https://www.googleapis.com/auth/drive.activity.readonly, then save. For the optional file viewing and Trash features, use https://www.googleapis.com/auth/drive instead of drive.metadata.readonly, keeping drive.activity.readonly. Official consent guide.
3. Desktop JSON: under Google Auth platform → Clients → Create Client, choose Desktop app, name it, create it and download its JSON. Import that file using step 3 in the native guide. Web clients, service-account keys, malformed files and token files are rejected before replacing the existing configuration. Keep the JSON local; never put it in chat or Git. Desktop client instructions.
4. Sign in: choose Metadata and activity only or View files and Move to Trash in step 4, then Sign in with Google. Your default browser handles consent. Check the project identity and select the two permissions for your chosen connection, then return to the app. The app checks the returned scopes before saving a replacement token; incomplete grants identify the missing permission and preserve the previous saved sign-in. State and S256 PKCE protect the temporary 127.0.0.1 callback; no public server or manual web redirect is needed. Sign-in times out after three minutes. A saved sign-in alone does not verify both APIs.
5. First sync: choose Run synchronization in step 5. Wait for the metadata baseline and Activity seed. Inspect any reported gaps, then compare a few known files and activity entries with Google Drive. The app only reports session verification after both collection stages finish without reported gaps. This is bounded collection coverage, not a full organizational audit. The live validation checklist covers refresh, revocation, persistence, watches and account separation.

The app reads metadata/activity, not file contents, and cannot rename, share, upload or delete Drive files. Google server-side name contains semantics differ from local substring search. MIME and owner-email queries on Google are exact; size, extension and local discovery filters require the local index.

Access/refresh tokens and imported configuration are stored in macOS Keychain under service local.driveexplorer.oauth. An installed application's configuration is not a confidential server secret. Disconnect deletes stored tokens; it does not revoke Google's grant or delete cached metadata. Manage Google's grant separately in your account security settings.

The guide includes these remedies beside the actions; OAuth failures retain the HTTP status/error code and add next steps. See Google's native-app error reference.

Available now: one native guide, local JSON validation, retained Keychain configuration, system-browser consent, automatic token refresh, and a direct first-sync check. An existing eligible organization project can reuse its Desktop client configuration; importing a client never grants access without user consent.

Requires a distribution project: bundling a maintainer-owned Desktop OAuth client could remove each user's Cloud setup. It is not included. Both requested scopes are classified as restricted. Public distribution needs the applicable Google verification process, audience/policy preparation and operational quota ownership; restricted data stored or transmitted through servers can also require a security assessment. Local-only operation is not a blanket exemption. Google's scope and verification guidance.

A Picker/drive.file design limits access to selected/app-used files and includes write capabilities; it cannot substitute for whole-drive read-only inventory and activity. API keys and service-account keys do not provide a shortcut to an individual's Drive consent. Changing to Production is not proof of verification or administrator approval.

• ⌘1 All files, ⌘2 Newest items, ⌘3 Largest files, ⌘4 Activity, ⌘5 Storage, ⌘6 Sharing, ⌘7 My Drive, ⌘8 Watches, ⌘9 Observed history.
• ⌘F opens/focuses file search. ⌘⇧F toggles the advanced filter builder. Filters combine with AND. Dates use complete RFC3339 timestamps, for example 2026-09-01T00:00:00Z. Invalid date/size ranges show an error and block search saving; Clear search resets all inputs. Superseded local searches are cancelled. Saved searches store filters; sort order is chosen independently.
• Table headers or the sort picker choose ordering. Missing sizes stay last in either direction. Equal values use name and then file ID as stable secondary keys.
• File tables show 500 matches per page to keep large native tables responsive. Previous/Next changes the displayed page; search, sorting and exports still use all matching records. A new result set returns to the first page.
• Double-click folders to browse them; click any known ancestor in the breadcrumb trail to navigate back. Shared Drive roots keep their own identity, and missing parents or cycles remain labelled. The sidebar expands known folder children. File context menus open Google Drive, show activity, or watch a folder. Shortcuts expose their target ID in the inspector; inaccessible or unindexed targets are labelled.
• The inspector separates owner, creation, modification, first discovery, quota usage and action evidence. Snapshot details reconstruct paths using only ancestor snapshots observed by that cutoff, with explicit coverage limits. An owner is never assumed to be an uploader. Activity actors can be a people/... resource, “Me,” or unavailable; the app does not request additional People scopes just to resolve names.
• Observed history (⌘9) loads the newest recorded snapshot for each item at or before your RFC3339 cutoff. Browse a folder by double-clicking it or selecting Browse observed folder, return with the breadcrumbs or All observed items, and search names or exact IDs within the displayed level. The inspector shows the observation timestamp and original metadata. The toolbar export is disabled here; historical results are not substituted with current file exports. Old observations can remain after removal or access loss, so this view does not prove the item still existed or was accessible at the cutoff.
• Activity searches the latest 10,000 cached source records; the visible label states that limit. Metadata search covers the loaded whole local index. A Google search follows all returned pages, checks incompleteSearch, and does not insert search-only results into the durable baseline.
• Export the displayed file results or filtered Activity records using CSV, JSON, or JSONL. CSV protects formula-leading cells. Exports may contain file names, account identifiers, sharing details and raw evidence; review before sharing.
• Watches match a folder's indexed descendants and recorded move parents. Notifications batch new source records, accumulate during cooldown, and require both macOS notification permission and the app to remain running. Polling is every 60 seconds when enabled; it is not a background daemon or a transfer queue.

DriveCore contains value models, pure search/event/export transformations, a SQLite actor, the Google HTTP actor, and the collector. The native executable owns UI state, Keychain/OAuth, loopback callbacks, panels and notifications. Files are split by responsibility. Foundation, SwiftUI, Charts, Security, CryptoKit, Network, UserNotifications, AppKit and system SQLite are the only runtime dependencies.

SQLite schema version 2 stores files, scope membership, staged baselines, cursors, snapshots, events and preferences. Baselines are promoted transactionally only after all pages succeed; the pre-scan start token closes the scan/change gap. Each Changes page commits records and its cursor together. Interrupted baselines restart; committed change pages resume. Activity checkpoints advance only after the scope's complete pagination, with a five-minute overlap and source deduplication. Transient requests retry with warnings; persistent errors remain visible. HTTP 410 requires an explicit index rebuild.

Caches are under ~/Library/Application Support/DriveExplorer, split between Demo and an account directory keyed by a hash of the authenticated Drive root ID. Tokens never go into SQLite. Metadata databases are not encrypted by the app; FileVault protects the disk. Clear history deletes events/snapshots in the current workspace. Rebuild local index clears cached files, cursors and evidence and preserves saved searches/watch rules; in demo it restores the synthetic dataset. These controls never mutate Google Drive.

The native project was developed alongside a separate Python/React reference; that application and its database are not required to build or run this repository. Source hashes and the verification report document preservation. Research and license notes describe the repositories and official API documentation used.

In Connect Google Drive → Sign in, select View files and Move to Trash, then sign in again and approve the broader Google permission yourself. The app requests drive plus drive.activity.readonly; it does not request every overlapping or unrelated scope. drive is broad enough to edit and permanently delete files even though this app exposes only downloads, previews and confirmed trashing. Existing metadata-only tokens cannot use these actions. Declaring scopes in Cloud Console alone does not update a saved token. To revoke a broader grant, use your Google Account's third-party access controls; choosing a narrower option is not proof that a prior Google grant was revoked. Google scope definitions.

• Download Selected… / Download Folder…: Modifier-click selection is currently broken (see the open-bug warning below). Keyboard Shift+Down selected adjacent rows in a controlled check; review the selected count and names before using the toolbar, inspector or right-click menu. Selection clears on page, search, sort or navigation changes. Choose a destination directory; each run creates a new DriveTrace Download <unique ID> folder containing Files/ and a private download-report.json. Live, paginated discovery preserves nested and empty folders. Duplicate names receive numeric suffixes, including case/Unicode-normalization collisions; existing local files are never merged or overwritten. The destination is checked for exclusive-rename support before discovery and transfer; unsupported or unknown volume support is reported immediately. Shortcuts, inaccessible items, unsupported exports, repeated items and incomplete listings are reported explicitly. Progress counts discovered and processed items, not bytes. Cancel keeps completed downloads and lists the paths of unattempted items in the results and private report; discovery cancellation starts no transfer. This is a copy of accessible items observed during the requests, not an atomic snapshot or a guarantee of access to every descendant.
• Download…: use the selected file’s inspector or context menu, choose a location in the native save dialog, then select Download. Regular files retain their original format; Docs export as Word (.docx), Sheets as Excel (.xlsx), Slides as PowerPoint (.pptx), and Drawings as PDF. The dialog explains document conversions. Transfers stream to disk and have no app-imposed preview size cap; Google’s document export endpoint still limits exports to 10 MB. Downloads recheck account identity and file capability, offer Cancel during transfer, and replace an existing destination only after a complete response. Binary downloads must match Google’s refreshed byte size and SHA-256 checksum when supplied. Mismatches fail before saving; checksum reads use bounded chunks with cancellation checks. Missing checksums do not establish content integrity, and converted exports are excluded. For folders, use Download Folder or Download Selected. Shortcuts require selecting their actual target; unsupported Google types require opening Google Drive. Saved downloads remain at your chosen location. Google export formats.
• Preview file: select a file and use the inspector or context menu. The app checks current account identity and Google's download capability, then downloads at most 20 MiB on demand. Docs, Sheets, Slides and Drawings export as PDF; Google's export API imposes a separate 10 MB limit. Folders, shortcuts, unsupported Google types and files without a usable extension receive explicit guidance to browse their target or open Google Drive. Quick Look support depends on the file type and macOS. Download/export requirements.
• Move Selected to Trash…: Modifier-click selection is currently broken. Review the selected count and full list of names before using the toolbar, inspector or right-click menu. Review the full list of names and IDs before confirming. Current account identity and every selected item's Trash capability are checked first; no item changes during review. Each request rechecks the target's name, location and capability, records confirmed results locally, and reports failures individually. Stop prevents further requests but cannot undo a request already sent. An interrupted or failed request is unconfirmed and requires refresh before retrying. Folders affect unselected descendants too; selecting a folder and its children can make later requests already trashed. The report counts requested items, not all affected descendants. Polling waits while items are selected or a review is open. No permanent deletion is included.
• Move to Trash: select an item, review its name and ID in the confirmation sheet, then confirm. Folders affect their contents too. The app rechecks current capability, name and location before sending files.update with trashed:true. The confirmation stays open while the request runs and shows any error in place; background polling waits until the confirmation closes. The response updates local metadata observations; it does not manufacture Activity evidence or advance the Changes cursor. Restore items through Google Drive; Google normally permanently removes trashed items after 30 days. No real item is trashed merely by opening the confirmation. Google trash behavior.

Preview content is temporarily stored under the app's user-scoped macOS temporary directory with private directory/file permissions and random filenames. The app removes its copy on sheet dismissal and clears leftover preview files at next startup. This is ordinary file removal, not secure erasure; Quick Look may keep system-managed caches. Credentials remain in Keychain. Downloaded content, account caches and exports must never be committed.

The optional actions have automated local/synthetic coverage. Live management consent, native rendering of real Drive content, and real trash/restore operations still need user-controlled validation. The current account has not been granted broader access by this implementation work.

Shared Drives are discovered from driveId values in indexed file metadata; previously observed drives remain listed. Empty or never-observed drives may be absent. This is not an organization-wide membership directory. Google’s drives.list endpoint requires drive.readonly or drive, so the app uses metadata-compatible file endpoints and keeps its narrower permissions. Root lookup and per-drive failures remain explicit coverage gaps; absence does not retire cached evidence.

The initial Activity seed is seven days under My Drive and each observed Shared Drive ancestor, with a five-minute overlap on later polls. Shared-with-me activity outside those roots may be absent. The Activity screen loads the latest 10,000 cached source records and displays that limit. These are coverage boundaries, not a complete audit log of an organization.

• Credentials: Desktop client configuration and tokens are stored in macOS Keychain, not the repository or SQLite database. There is no shared OAuth client bundled with the project.
• Network: Live mode contacts Google's OAuth, Drive, and Drive Activity endpoints. Choosing Open in Google Drive opens a validated Google Drive/docs URL in your browser. There is no project telemetry service.
• Cache: Metadata, actor identifiers, permissions, raw activity, and snapshots can be sensitive. The local database is not encrypted by this app; its disk protection depends on macOS and your FileVault configuration.
• Exports: CSV formula-leading cells are protected, but exports are not anonymized. Review filenames, email addresses, file IDs, permissions and raw evidence before sharing.
• Notifications: Folder alerts can expose information on the desktop. Manage their visibility in macOS notification settings.
• Disconnect: Removes the stored token, not the cached metadata, imported client configuration, or Google-side authorization grant. Clear controls and Google account permissions are separate operations.
• Removal: Quit the app and remove the generated bundle/archive to remove the executable. To remove stored data too, separately remove ~/Library/Application Support/DriveExplorer, ~/Library/Caches/DriveExplorerBuild, and the local.driveexplorer.oauth entries in Keychain Access. This removes local history; it does not delete Google Drive files or revoke the Google-side grant.

This is the working roadmap. Unchecked items are not done yet and have no promised delivery date.

• Done: Guided connection: native project/API, consent, Desktop import, browser sign-in and first-sync instructions with contextual troubleshooting. Cloud configuration and live access still require validation.
• Not done: Optional file actions — partial: controlled live recursive and two-file context-menu downloads passed size/SHA-256 comparison; two explicitly authorized disposable files were successfully moved to Trash through the bulk context menu. Reports, no-overwrite destinations and cancellation are implemented. User-performed restoration was reflected in refreshed metadata. Modifier-click mouse gestures have a user-confirmed failure and are deferred for repair. Live Google document exports, interruption/restriction handling and external volumes remain unverified. Native sample preview and temporary cleanup are checked; consent lifecycle remains partial.
• Not done: Real-account validation — partial: saved connection accepted, user-corpus baseline/Changes completed and preserved across app rebuild; Shared Drive baseline and Activity completion remain pending; remaining checks include consent/refresh/revocation, reconnect, account isolation, tenant/Shared Drive coverage, restricted permissions, quotas and failures. See the live verification record.
• Not done: Notification validation — partial: cooldown accumulation, duplicate record IDs, moved-out items, atomic acknowledgement across SQLite reopen and authorization gating are tested. Settings shows permission status and offers a Google-free test; foreground presentation is implemented. Visible OS delivery, permission changes during delivery, crash between OS acceptance and database acknowledgement, and long-running live polling remain unverified.
• Done: Observed hierarchy browser: navigate retained metadata at a chosen cutoff, with missing-ancestor labels, per-item observation times, search, and raw inspection. Historical existence/access remains unknown; dedicated historical exports are not implemented.
• Done: Bounded scale profiling: 100,000-file core benchmark and 25,000-item native UI check completed, including memory and in-flight sort cancellation. Date sorting improved from 57.16 s to 0.18 s on this host. Deep hierarchies, huge histories and live API throughput remain outside this measured workload. See measurements and limits.
• Done: Ancestor navigation: clickable breadcrumbs with shared-root, unknown-parent, and cycle handling.
• Not done: Accessibility audit — partial: keyboard navigation, Cmd-F focus, invalid-input recovery, named search fields and directional sort/watch labels checked in the native app. Full VoiceOver spoken-output review remains unverified.
• Not done: Compatibility — partial: universal arm64/x86_64 release compilation and archive verification pass. Native runtime is checked on this Apple silicon host only; older macOS and Intel hardware runs remain unverified.
• Not done: Distribution — partial: build-only packaging, fresh bundle staging, universal architecture/resource/signature checks and extracted-ZIP verification are automated. A separate signing/notarization script is prepared with tested fail-closed preflight and ad-hoc signing smoke checks. Developer ID signing, Apple submission and a distributed release remain unverified/blocked; this host has no Developer ID Application identity.
• Done: Optional Workspace Events assessment: reviewed current Google requirements; retain foreground polling for this preview. The optional adapter is deferred pending a project/infrastructure decision and live access; see below. No adapter or always-on agent exists.

Reviewed 2026-09-29, as part of the existing roadmap. Google's creation guide labels Drive targets Developer Preview and requires an enabled Cloud project, Pub/Sub delivery topic/subscription and publisher IAM for drive-api-event-push@system.gserviceaccount.com. This adds cloud configuration and operational ownership rather than simplifying desktop onboarding. Official subscription setup.

Metadata read-only is listed among supported authorization scopes, but each chosen event type still needs a supported scope and target access. An adapter must verify its event/scope combinations without silently expanding the app's permissions. Scopes, create reference.

Subscription lifetimes require renewal: generally up to seven days without resource payloads, four hours with them (a delegation-specific exception is irrelevant to this personal desktop setup). Delivery/renewal interruptions need explicit coverage gaps and reconciliation against Changes; CloudEvents must remain a separate evidence source. Subscription lifetime reference.

Decision: defer the optional adapter. It may suit managed deployments with approved infrastructure, but requires live target eligibility, Pub/Sub access, renewal ownership and a privacy/billing review. No cloud resources or IAM grants were created. This API feasibility check is separate from the requested competitor comparison, which remains on hold until the implementation plan is complete.

Additional ideas remain exploratory: explicit Python-cache import, an account switcher, optional People-name resolution, and encrypted local metadata. They are not available today. General editing, permanent deletion, emptying Trash, and Google Drive for desktop transfer-queue monitoring are outside the current implementation. The requested Empty Trash API and confirmation proposal is ready for review; no permanent deletion is implemented. Optional previews and confirmed Move to Trash are described above.

Run ./script/test.sh for the Swift Testing suite. With the app closed, ./script/build.sh produces and verifies a universal preview archive without launching it; ./script/build_and_run.sh rebuilds and launches the app. ./script/verify_bundle.sh /absolute/path/DriveTrace.app checks a generated or extracted bundle. dist/SHA256SUMS records the ZIP hash. These are repeatable local build steps, not a claim of bit-for-bit reproducibility across toolchain versions. The current verified suite has 60 passing tests, including real SQLite and loopback integrations plus synthetic Google responses. A passing test suite does not validate a live Google account.

Verification is the detailed record of checks, screenshots, and remaining gaps. Research lists API documentation and projects that informed the design. Parity compares native behavior with the separate development reference.

Package.swift                         SwiftPM products and system SQLite dependency
Sources/DriveCore/                    Models, indexing, Google APIs, search and exports
Sources/DriveTrace/App/               App entry point and keyboard commands
Sources/DriveTrace/Stores/            UI session and cancellable operations
Sources/DriveTrace/Services/          Keychain, OAuth and loopback callback
Sources/DriveTrace/Views/             Native screens, inspectors and settings
Sources/DriveTrace/Resources/         Canonical DriveTrace logo
Sources/CSQLite/                      System SQLite module bridge
Tests/DriveCoreTests/                 Core and integration verification
script/                              Tests, icon conversion, packaging and launch
assets/                              Logo generation provenance
docs/                               Verification, research, parity and demo screenshots

DriveTrace is the canonical product name. The README, welcome screen, About panel, Dock, Finder and social preview use the original blue drive icon. The PNG is extracted from assets/drivetrace.icns; packaging preserves the icon and verifies it in both the app and ZIP. The bundle identifier local.driveexplorer, Keychain service local.driveexplorer.oauth, Application Support directory and build-cache directory retain their existing internal names for compatibility with saved credentials, preferences and indexed history. Release titles should use DriveTrace <version>; downloadable bundles and archives are DriveTrace.app and DriveTrace.zip.

This project is in active development. Use issues for reproducible bugs or focused feature proposals and pull requests for reviewable changes. Describe what was tested with synthetic data versus a real Google account. Run the existing tests, inspect relevant native UI, and keep the permission, mutation-confirmation and evidence-coverage boundaries explicit.

Never attach OAuth JSON, tokens, real Drive caches, private exports, or unredacted account screenshots. If a report involves credentials, revoke them through Google and share only a sanitized reproduction. Use example.test identities and synthetic file IDs in fixtures.

Released under the MIT License, copyright © 2026 hideouts-io. This repository includes the app source, documentation, and project artwork under that license. The social preview uses the existing blue icon; its generation prompt is included.

Google Drive and related names belong to their respective owners. This is an independent project and is not affiliated with or endorsed by Google or Apple. Apple system frameworks and Google services remain subject to their own terms; references and their licenses are documented in Research.