// the find
maotoumao/MusicFree
插件化、定制化、无广告的免费音乐播放器
MusicFree is a plugin-based Android music player built with React Native where the app itself ships zero music sources — all streaming comes from user-installed CommonJS plugins. It's aimed at Chinese users who want to consolidate playback across multiple streaming platforms without ads or accounts. A desktop sibling (MusicFreeDesktop) exists in a separate repo.
- The plugin architecture is the right call: core player is fully decoupled from sources, so when a streaming API changes only the plugin breaks, not the app. The plugin contract (CommonJS with defined search/play/lyric functions, pagination/caching handled by the host) is simple enough that a working plugin is maybe 100 lines.
- Genuinely local-first: no accounts, no cloud, all data on device. Given the target use case (Chinese music platforms that would otherwise be surveilling your listening history), this is a feature, not a limitation.
- TypeScript codebase is well-organized — core/, components/, constants/ separation is clean, i18n is actually implemented with three locales, and there's a real component library rather than inline everything.
- Lyric association is a thoughtful edge case solved correctly: link song A's lyrics to song B, and both display B's lyrics. Handles the common situation where the same track has multiple catalog entries with mismatched metadata.
- Plugin security is a genuine hole: plugins are arbitrary CommonJS executed in the app with no sandboxing, no permission model, no code signing. The README's advice to 'check for weird network requests' is not a security model. A malicious plugin has full access to whatever the app can touch.
- iOS directory exists (full Xcode project, Podfile, AppDelegate) but iOS is explicitly unsupported. This is confusing for contributors and suggests abandoned iOS work — no explanation in the README for why it's there.
- The plugin ecosystem is fragile by design: there's no built-in registry or discovery, the official plugin repo is described as 'not very complete,' and plugins depend on undocumented third-party APIs that change without notice. The developer estimates ~30 min/day for maintenance, which is not enough to keep plugins working as streaming services update their frontends.
- Build artifacts are in the repo (android/app/debug.keystore committed), and the release/version.json pattern suggests the release process is manual. No CI build for the main branch — only a beta workflow exists.