amigo-labs
Krake

Release notes

0.1.0

View on GitHub

⚠ BREAKING CHANGES

  • the workspace package names and the SDK's CLI name changed.
  • the database, config, temp and container paths are renamed (migrated automatically on start, except custom bind mounts onto /etc/amigo/plugins, which must now target /etc/krake/plugins).
  • the build-time keys are read only as KRAKE_REGISTRY_PUBKEY_HEX and KRAKE_UPDATE_PUBKEY_HEX, and the signing script only takes KRAKE_UPDATE_SIGNING_KEY. The workflows map them from the unchanged AMIGO_* repository variables and secret.
  • the crates and their library paths are renamed.
  • name the desktop executable Krake
  • the desktop app has a new bundle identifier.
  • the container image has a new name.
  • the binaries and release archives have new names.

Features

  • /spec-verify updates spec status and acceptance criteria (3e7c924)
  • 10 UX features — tab badge, relative time, sort, delete confirm, system theme, compact view, bandwidth limit, context menu, notifications, progress ring (a347048)
  • add /spec-fix skill + update CLAUDE.md with all 5 skills (97c13c6)
  • add automated release management with release-please (fcbe87f)
  • add automated release management with release-please (ce29bd6)
  • add captcha UI, webhook settings, and notification frontend (8fa6a38)
  • add chunk persistence and resumable chunked downloads (8ef2ca5)
  • add crypto, captcha manager, notifications, and webhook system (ee40ee1)
  • add Docker support with container management script and update docker-compose configuration (ecc0a58)
  • add integration tests and wire Extractor crate as URL resolver (b92e40b)
  • add ProtocolBackend trait and activate HLS/DASH backends (4f42a39)
  • add retry config UI in Settings page (7567d85)
  • add skip() to test harness for network-dependent tests (67b3148)
  • add spec-driven development skills (/spec, /verify, /feature) (78aa88d)
  • add spec-driven development skills (/spec, /verify, /feature) (6c84cc7)
  • add title and duration fields to DownloadInfo (fb236c1)
  • add URL resolver middleware for plugins and extractors (66b3987)
  • add Usenet UI — server management + NZB downloads pages (0916355)
  • add YouTube integration tests and fix plugin test runner (55e7739)
  • add YouTube integration tests and fix plugin test runner (ea6ea43)
  • cache bandwidth limit and add config validation (2732062)
  • cli: amigo-dl login / remote subcommands for device pairing (82aaa56)
  • complete visual redesign of amigo-downloader web-ui with Cyberpunk Arcade theme and integrated audit fixes (63824eb)
  • confirm plugin network access on install and update (2563fad)
  • convert all plugins to TypeScript, smart generic-http link finder (80233fc)
  • core/config: extend ServerConfig for setup-wizard flow (037c32c)
  • core/storage: sessions, api_tokens, pairing_requests tables (5bdf810)
  • cut initial v0.1.0 release (4ac4bdb)
  • cut initial v0.1.0 release (236c2a0)
  • cyberpunk arcade redesign with 60:30:10 neon balance (83dc68c)
  • docker, docs: opt-in Docker defaults + reverse-proxy / Tailscale guide (659f47f)
  • ETA, copy URL, keyboard nav, search, batch ops, speed graph (8a3a684)
  • extend plugin Host API + activate post-processing pipeline (1c2a927)
  • feature toggles for RSS feeds and server stats (261ccdb)
  • file icons, connection status, collapsible sidebar, i18n, DnD, favicon badge, aria-live, retry (ecd607b)
  • harden Docker deployment (docker-security spec) (0e0bfa2)
  • i18n system with JSON locale files and auto language detection (906bcd8)
  • implement real light mode theme (e69e7aa)
  • implement Usenet feature with server management and UI updates (4e160a2)
  • implement Usenet feature with server management and UI updates (b7c442e)
  • integrate bandwidth limiting and extract retry utility (d2675f9)
  • integrate Tauri into workspace (tauri-workspace-integration spec) (07f89da)
  • library-based extraction, selective PAR2, NZB metadata wiring (5c55ade)
  • local index cache, category folders, plugin suggestion API (0e6f96d)
  • make /spec skill collaborative and interactive (4fe55ca)
  • make retry options configurable via config.toml (a34e02b)
  • nightly CI pipeline — CLI binaries, Docker multi-arch, Tauri installers (35923a2)
  • nightly versioning with date-stamped tags and releases (fc1bd84)
  • NZBGet API credentials + fix 6 more bugs (6aa486b)
  • NZBGet-compatible JSON-RPC API for Sonarr/Radarr integration (5b01cbd)
  • PAR2/unrar config toggles, RSS background poller, NZB watch folder (52b94cd)
  • plugin spec test runner with test/assert/assertEqual/assertNotNull (5cac74c)
  • plugin strategy foundation — generic extractor, multi-hoster priority, protocol hints (ff71b5f)
  • plugin strategy foundation — generic extractor, multi-hoster priority, protocol hints (78d57da)
  • plugin-runtime: Ed25519-signed plugin registry index (audit #31) (300cfd5)
  • plugin-runtime: expose the plugin host API as krake (302ed27)
  • plugin-runtime: QuickJS as a WebAssembly guest module (AC-01) (48ce491)
  • plugin-runtime: run every plugin in a Wasm instance (AC-01 to AC-06, AC-08) (eea66fe)
  • plugin-runtime: run every plugin in a WebAssembly instance; #99 leftovers (4c9de86)
  • plugin-runtime: run plugin JavaScript in an out-of-process host (331b413)
  • plugin-runtime: run plugin JavaScript in an out-of-process host (0bd109c)
  • plugin-runtime: SSRF blocklist on plugin HTTP calls (2e7acf9)
  • plugin-runtime: Wasm executor for plugin JavaScript (AC-02 to AC-13, AC-15 to AC-17) (82955de)
  • plugin-sdk/account: AccountConfig, Session, AccountStatus plumbed through definePlugin (d9b2e54)
  • plugin-sdk/browser: Browser with redirects, cookies, referer, clone (d6bb96a)
  • plugin-sdk/browser: case-insensitive Headers (f043f0a)
  • plugin-sdk/browser: CookieJar with RFC-6265-style domain matching (dc39b4b)
  • plugin-sdk/captcha: captcha namespace with auto-detection and host bridge (51f9637)
  • plugin-sdk/cli: amigo-plugin CLI with new/validate/test subcommands (4048ee4)
  • plugin-sdk/container: RSDF, CCF, DLC parsers + detect() (16fadc8)
  • plugin-sdk/errors: PluginError, ErrorCode, factories with never-return typing (652aa55)
  • plugin-sdk/extraction: regex, json, encoding, html helpers (76f4dbe)
  • plugin-sdk/form: Form extraction + Page.getForm + Browser.submitForm (413ebab)
  • plugin-sdk/host: define host-api request/response types (b831ccb)
  • plugin-sdk/host: HostApi interface + injection hooks (16e52fe)
  • plugin-sdk/host: MockHostApi with request recording and error injection (1e30a5b)
  • plugin-sdk/host: Phase 1 tests + drop node-only deps from mock (17b15fc)
  • plugin-sdk/javascript: run/unpack wrappers with permission gate (a9b8e9d)
  • plugin-sdk/media: HLS master+media, DASH, variant selection helpers (829f0dc)
  • plugin-sdk/plugin: shared types, PluginContext, definePlugin, defineDecrypter (65220e8)
  • plugin-sdk/utility: parseSize, parseDuration, parseDate, formatFilename (629b5dd)
  • plugin-sdk: introduce @amigo/plugin-sdk (plan + implementation) (12fb9fc)
  • plugins test always enables verbose/debug logging (4713026)
  • plugins: declare apiVersion and permissions.domains (5b2489f)
  • rename CLI binary to amigo-dl and enhance direct download functionality (74a8088)
  • resolve() returns DownloadPackage with grouped downloads (d8e257e)
  • server statistics UI behind feature toggle (ca53033)
  • server/auth: cookie + api-token auth, setup-guard, proxy-aware IP (d2db4d4)
  • server: add bulk download endpoints and fix the retry action (c4cb317)
  • server: add POST /api/v1/downloads/container for DLC import (b7c4c7d)
  • server: background plugin auto-update task (opt-in) (2f0fa57)
  • server: bind to loopback by default, add bearer-token auth, tighten CORS (a09d19c)
  • server: bind to loopback by default, add bearer-token auth, tighten CORS (e8ded1c)
  • server: device-pairing endpoints + headless setup from env vars (05e427b)
  • server: live setup_complete + end-to-end auth flow tests (fc37062)
  • server: name the session cookie krake_session (e3d6980)
  • server: send X-Krake-* webhook headers (8e578ce)
  • server: setup wizard + login/logout/me endpoints (ef137fa)
  • site: add marketing site skeleton + pnpm workspace refactor (b60f139)
  • stream progress over WebSocket and add URL-based routing (f4a8199)
  • suggest plugin installation when URL matches registry (f116473)
  • tauri: register the krake:// deep-link scheme (18bb697)
  • tauri: use the Kr pixel monogram as the app icon (ad0a94d)
  • TUI output modes, multi-hoster plugins, XFS plugin, host-API extensions (4cdc898)
  • ui: add accessible primitives to @amigo/ui (ee41e07)
  • ui: one accent, the brand lime, instead of six palettes (519a2a4)
  • ui: split accent tokens by role and self-host Inter (4d7d8c8)
  • ui: use the Kr pixel monogram as favicon, PWA and in-app logo (0547a9e)
  • Usenet protocol dispatch, categories, duplicates, queue reorder (d106dc2)
  • VS Code dark mode, unified side panel, plus button in header (361e4b8)
  • VS Code dark mode, unified side panel, plus button in header (6f3871b)
  • web-ui: "Command Deck" UI/UX redesign — palette, mobile nav, motion, i18n & a11y (d46b593)
  • web-ui: bring the off-system screens into the design system (5ec52bf)
  • web-ui: command palette, mobile nav, header status bar, motion system (9579b07)
  • web-ui: download rows lay out by their own width, denser phone list (b5a0ab7)
  • web-ui: drop the colour palette setting (41e284f)
  • web-ui: i18n completion, focus traps, undo, settings a11y (148f82a)
  • web-ui: make the history page usable (4df456d)
  • web-ui: offline empty state, plugin enable/disable toggle (46fbea3)
  • web-ui: setup wizard, login page, pairing modal, auth gate (271b9ed)
  • web-ui: show a download's host instead of its full URL (4ea25aa)
  • web-ui: unify the download list and make it keyboard-operable (ea86852)
  • web-ui: wire up the plugin marketplace (39924fd)
  • wire captcha, webhook, and notification endpoints end-to-end (3008952)

Bug Fixes

  • /spec-fix updates affected specs when fix changes spec'd behavior (c8374a9)
  • adapt to rand 0.10 API changes (232fc7a)
  • add libclang-dev to Docker build for rquickjs bindgen (396ba06)
  • add protobuf-compiler and Cargo.lock for CI builds (fd22ab0)
  • add protobuf-compiler and Cargo.lock for CI builds (b3f3104)
  • address all Copilot review comments on PR #15 (655ef30)
  • address Copilot review — bound login RL map, persist full reorder set (11080c8)
  • address Copilot review comments on PR #14 (46a2342)
  • address Copilot review comments on PR #19 (a0d2095)
  • address Copilot review comments on PR #19 (250e874)
  • address Copilot review comments on PR #21 (af1016f)
  • address HIGH-severity security tickets (#29, #30, #32) (65da865)
  • address PR #72 review — .sig asset, owner cache bound, blank secret (d84fa17)
  • bugs, dead code, misleading stubs, and UX gaps across backend and web-ui (db7525f)
  • bugs, dead code, misleading stubs, and UX gaps across backend and web-ui (c3215d6)
  • change default port from 8080 to 1516 to avoid servarr conflicts (c82a140)
  • CI failures — suppress lib dead_code warnings, fix Docker image tags (4785154)
  • CI pipeline failures from Tauri workspace integration (2428a39)
  • ci: build cleanly on the current stable toolchain; clarify signer naming (66af253)
  • ci: bump versions without release-please's rust strategy (3bf9f35)
  • ci: bump versions without release-please's rust strategy (0ea62c7)
  • ci: grant packages:write to release-please caller workflow (b8288e6)
  • ci: grant packages:write to release-please caller workflow (0939968)
  • ci: green main again: rustix 1.1.6 for cargo audit, release PR auto-merge without squash (cb5d890)
  • ci: migrate web-ui, plugin-sdk, and docker build to pnpm (b2402e9)
  • cli: drop unused cancel sender in direct download path (528fb44)
  • cli: satisfy clippy::manual_checked_ops for download progress (0568acc)
  • code review audit — bugs, dead code, and missing integrations (0c51df1)
  • code review audit — bugs, dead code, and missing integrations (b879ce0)
  • code-review cleanup — security, download-engine correctness, plugins, web-ui (29fbb1c)
  • copy web-ui dist to correct path in Docker build (b82c2eb)
  • core,plugin-runtime: address PR review on segment streaming & cache (02ee1a8)
  • core/chunk: kill the underflow in ChunkPlan::split (6618743)
  • core/coordinator: bigger event buffer, share progress channel across retries (9e36ef8)
  • core/http: fsync downloaded files before declaring success (928e9cf)
  • core/nntp: hostname validation, IO timeouts, explicit TLS verify (f5c792b)
  • core/postprocess: block ZIP-Slip via symlink entries (aee87db)
  • core: a paused download keeps the progress it had reached (e4cf217)
  • core: address Copilot review on #58 (481149a)
  • core: allow cancellation during retry and harden speed calc (1aa2de1)
  • core: bound WAL growth with autocheckpoint (4e81121), closes #38
  • core: cancel the in-flight task before retrying a download (a47edfd)
  • core: close TOCTOU race in add_download_with_options (#53) (470f921)
  • core: close TOCTOU race in add_download_with_options (#53) (eb75821)
  • core: enforce retry base_delay floor to prevent hot-loop (2da7773), closes #37
  • core: log completed downloads in the history (0d1e692)
  • core: mark a download as retrying during the backoff, not during the retry (0ff59bf)
  • core: migrate rand usage to the 0.9 API (6fc5363)
  • core: record filename and size of plain HTTP downloads, fail fast on 4xx (4b08fd9)
  • core: repair Usenet binary path, bandwidth hang, chunk corruption, pause (fbb5c2b)
  • core: require checksum for self-update, guard 7z/RAR/tar against zip-slip (f82fbd8)
  • core: robustness fixes across NZB, DASH, config, chunking, NNTP, coordinator (402d46d)
  • core: tear down progress reporter and sibling chunk tasks on chunk failure (ca3df34)
  • core: upgrade rusqlite to 0.41 for the libsqlite3-sys advisory (f273800)
  • core: verify reassembled chunk size before rename (b2fe9fb), closes #34
  • correct addToast argument order across all pages (ad8b015)
  • critical security and logic bugs across codebase (9af9e16)
  • critical security and logic bugs across codebase (a8a0185)
  • deps: make rand 0.10 bump compile (openssl/tar cargo group update) (43c62ee)
  • deps: make tauri 2.11.1 + rand 0.9 bump (PR #61) build green (a1d14b1)
  • deps: override fast-uri to >=3.1.2 to clear pnpm audit (f949c25)
  • deps: override svelte/ws/devalue to clear pnpm audit (01b410f)
  • deps: pin vulnerable transitive npm deps via pnpm overrides (1645049)
  • deps: replace sevenz-rust with sevenz-rust2 and bump vulnerable crates (292bcda)
  • deps: resolve cargo and pnpm audit advisories (7270e69)
  • deps: resolve cargo and pnpm audit advisories (5ddf08a)
  • deps: resolve cargo-audit advisories (anyhow bump + quick-xml ignores) (fa990a8)
  • deps: update hyper and the Tauri updater for open advisories (f5c586c)
  • docker: add entrypoint with PUID/PGID and volume checks (3088a0d), closes #42
  • don't check off acceptance criteria in spec files (6d6b526)
  • extractors/youtube: TTL + LRU on player-JS cache, deadline on QuickJS (ee69510)
  • harden coordinator, resume, extraction, plugin updates, JSON parsing (2ec8b78)
  • make webhook signing mandatory (#29) (40844ff)
  • multiple bugs across core, plugins, web-ui, and docker (ae75e59)
  • multiple bugs across core, plugins, web-ui, and docker (f451bf9)
  • multiple bugs across core, plugins, web-ui, and docker (689eae8)
  • multiple bugs across core, plugins, web-ui, and docker (9d110d8)
  • nightly build missing server binary and broken artifact upload (51d09b5)
  • nightly build missing server binary and broken artifact upload (d6c920a)
  • path-traversal, resume corruption, zip-bomb, plugin updates, JSON parsing (88964a6)
  • plugin sandbox hardening (#78, #80–#85) + green dependency audits (supersedes #86) (351f9d8)
  • plugin-runtime: address review findings on the plugin host (f9ed787)
  • plugin-runtime: cap regex / HTML / base64 inputs (d8c0982)
  • plugin-runtime: collapse redirect match arm (clippy 1.96 collapsible_match) (f75868b)
  • plugin-runtime: enforce per-plugin storage quota (a9d6db8)
  • plugin-runtime: enforce resolve/postProcess timeouts via interrupt handler (f0bc0bb)
  • plugin-runtime: harden the plugin sandbox boundary (b528714)
  • plugin-runtime: inject registry Ed25519 pubkey at compile time (e2a2d48)
  • plugin-runtime: isolate plugin storage by declared id, harden HTTP (7157bcd)
  • plugin-runtime: per-plugin cookie jars (4aff9a2)
  • plugin-runtime: settle a Promise returned by resolve() (b329343)
  • plugin-runtime: show a thrown non-Error value as its string form (60f6e46)
  • plugin-runtime: validate registry candidates before they reach disk (10ffee3)
  • plugin-runtime: Wasm executor reports a missing return value like the native engine (AC-06, AC-07) (808d29c)
  • plugin-sdk: address Copilot review comments (b12dd32)
  • plugins: correct link pairing, honor XFS wait, validate keys before store (14d010e)
  • plugins: strip anchor tags to a fixed point (CodeQL: incomplete sanitization) (c38d71f)
  • prevent panic on malformed NZB with missing </file> closing tag (f6f62f2)
  • queue stall, non-atomic history, regex perf, test masking (e019ebe)
  • re-enable Click'n'Load in Tauri via amigo-server crate (d305615)
  • re-sync agent skills (acceptance-criteria headings in any case) (0801589)
  • re-sync agent skills (commit gate, spec-build completion) (634c469)
  • resolve all CI clippy warnings and unused import errors (e8d2026)
  • resolve all CI pipeline failures (clippy, svelte-check, warnings) (196c98f)
  • resolve clippy redundant_closure warning in ZIP extraction (53e8cbb)
  • resolve clippy redundant_closure warning in ZIP extraction (5037c1c)
  • resolve nightly build errors — missing icons, clippy warnings, and release-build stub (beb08a0)
  • resolve nightly build failures across all platforms (53e4461)
  • resolve nightly build failures across all platforms (804810a)
  • resolve nightly build failures across macOS, aarch64-linux, and … (93be711)
  • resolve nightly build failures across macOS, aarch64-linux, and Tauri installers (8be1cda)
  • resolve pre-existing clippy warnings in server crate (a4eb6b3)
  • restore libclang-dev in Docker for rquickjs (plugin-runtime) (f852009)
  • scope WebSocket download events per owner (#32) (d28e98b)
  • sdk,core: correct container detection ordering and DLC docs (F1/P4) (5eda1ea)
  • server: apply baseline security headers to every response (f2e6b5d)
  • server: avoid Instant underflow in feedback rate limiter (6179539)
  • server: cap upload body size for /downloads/nzb and /downloads/container (050481c)
  • server: close NZBGet JSON-RPC auth bypass (868d3c7)
  • server: mark session cookies Secure over HTTPS, clear both on logout (2fff42f)
  • server: mark session cookies Secure over HTTPS, clear both on logout (f213cfb)
  • server: no duplicate NZBGet history entries, history delete removes the archive entry (1d16e73)
  • server: persist webhooks to config and keep the dispatcher in sync (SV3) (c62ec08)
  • server: redact secrets in GET /api/v1/config (dc8113d)
  • server: report live progress of running downloads over REST (0d826e4)
  • server: scrub secrets from feedback before submitting (dfb6a5d), closes #36
  • server: SSRF guard for webhook + RSS outbound URLs (517f40d)
  • server: SSRF-guard download paths, rate-limit login, close IP-block gaps (2699954)
  • server: URL allowlist + body cap on Click'n'Load endpoints (96d5ac5)
  • site: make npx wrangler deploy work from workspace root (1ea6512)
  • site: make npx wrangler deploy work from workspace root (a72ec46)
  • site: move wrangler.jsonc into site/ for Workers Builds (bcad54d)
  • tests: address Copilot review on PR #60 (1623015)
  • UI polish — hover states, focus styling, empty states, dead code cleanup (3ace985)
  • ui: full-height pause icon, muted knob on a switched-off toggle (f4be71a)
  • updater: install release archives and sign them for self-update (8852168)
  • updater: install release archives and sign them for self-update (72bdffd)
  • URL decoding corruption, XML parser panics, timer leaks, DnD bug (c734193)
  • use cross tool for aarch64 in release-build + add Tauri signing pubkey (ed9a95a)
  • verify Ed25519 signature on core self-update (#30) (94be21f)
  • web-ui: add a layer manager and fix the broken drag and captcha trap (1fce7cd)
  • web-ui: address Copilot review on #65 (cc0d961)
  • web-ui: cleanup popstate listener via onMount lifecycle (9088dc7)
  • web-ui: correct byte formatting units and clamp magnitude index (d718b59)
  • web-ui: guard shortcuts in inputs, wire reorder + report, i18n, ws proxy (93ff487)
  • web-ui: keyboard-operable context menu (5e2efd8)
  • web-ui: name the saved file in the completion notification (115febb)
  • web-ui: read WebSocket events from the flat server payload (45d554a)
  • web-ui: readable download rows: file name, failure reason, phone layout (065d5a7)
  • web-ui: safe context-menu delete, in-flight action guards, i18n coverage (95a005d)
  • web-ui: shortcut hints as key caps, no doubled stats, dependent toggles (ea5497f)
  • web-ui: show download progress, names and failure reasons; one accent; denser Downloads screen (6b6a4fb)
  • wrap env var mutations in unsafe blocks for Rust 2024 edition (3463281)
  • Zip Slip path traversal + tar absolute path extraction (7f7c112)

Performance Improvements

  • build: add tuned release profile (fat LTO, codegen-units=1, strip) (ef5e3f3)
  • build: set panic = "abort" for the release profile (f71fb82)
  • core,server: buffer download writes and stream chunk reassembly (203bb3a)
  • core: stream HLS/DASH segments to disk instead of buffering in RAM (27e32e5)
  • core: tune SQLite pragmas, cache statements, batch chunk inserts (74446d7)
  • deps: trim tokio feature set and drop it from extractors (12291c5)
  • extractors,server: hoist hot-path regexes to LazyLock statics (5efda97)
  • extractors: store cached player JS as Arc<str> (f39f8d9)
  • plugin-runtime: cache compiled regexes; harden base64 and JS interop (3279558)
  • plugin-runtime: cache SWC transpilation and registry URL regexes (cc91feb)
  • web-ui: code-split pages and isolate the Svelte vendor chunk (ad02aad)
  • whole-repo performance optimization (build, core, extractors, plugins, web-ui) (bc95f03)

Code Refactoring

  • move amigo-named data paths to krake (1f67687)
  • name the desktop executable Krake (3f68392)
  • rename the AMIGO_* environment variables to KRAKE_* (98c4d19)
  • rename the app to Krake (5a7f26c)
  • rename the binaries to krake, krake-server and krake-plugin-host (b2d1b7b)
  • rename the workspace crates to krake-* (1aa1559)

Build System

  • move the npm workspace packages to the @amigo-labs scope (57646c3)
  • publish the container image as ghcr.io/amigo-labs/krake (3929364)