release: ship v2.0.23 queue and account reliability fixes

Normalize RapidGator aliases, stabilize active queue ordering, preserve user-controlled package expansion, and align compact queue status presentation.

Separate Mega-Debrid API and Web credential pools, migrate legacy credentials and disabled states safely, refresh live account availability without restart, honor disabled credential persistence, and invalidate Web sessions without allowing stale in-flight, retry, or queued logins to restore old cookies.

Expand regression coverage for account isolation, legacy migration, session races, live scheduler refresh, update notes, and responsive queue behavior.

CHANGELOG.md

@@ -2,6 +2,41 @@
 
 All notable changes to Multi-Debrid Downloader are documented in this file.
 
+## [2.0.23] - 2026-08-11
+
+### Update experience
+
+- Changed the available-update header action to a dedicated light-blue treatment with dark high-contrast text.
+- Added cumulative release notes for every stable version newer than the installed application, ordered from newest to oldest.
+- Excluded draft releases, prereleases, the installed version, and older versions from cumulative update notes.
+- Added a bounded vertical scroll area so long multi-version changelogs remain usable without overflowing the update dialog.
+
+### Download queue
+
+- Unified RapidGator main and short-link domains under one host identity for icons, host counts, routing, limits, and cooldowns.
+- Centered service and status values beneath their corresponding column headings.
+- Removed archive filenames from visible password-cracking progress while retaining full technical details in the status tooltip.
+- Kept active packages in their activation order and appended newly active packages behind downloads that were already running.
+- Removed status-driven automatic package expansion so collapse state changes only through explicit user actions.
+
+### Account handling
+
+- Separated Mega-Debrid API and Web Login credential pools so adding, editing, disabling, or removing one mode no longer changes the other mode.
+- Migrated legacy shared Mega-Debrid credentials and disabled-account states into the explicitly enabled access mode, falling back to the preferred mode only for ambiguous legacy configurations.
+- Kept mode-specific account availability and provider selection synchronized with live settings changes.
+- Applied added, edited, disabled, and re-enabled Mega-Debrid accounts to the active scheduler without requiring an application restart.
+- Invalidated cached Mega-Debrid Web Login sessions immediately when Web credentials change, prevented older in-flight, retried, and queued requests from restoring invalidated cookies, and left API-only changes isolated.
+- Released only Mega-Debrid reset-parked queue items when a usable account pool becomes available while preserving unrelated retry delays.
+- Prevented new Mega-Debrid account forms from exposing stored credentials in an unrelated token field.
+- Removed both mode-specific Mega-Debrid credential pools from persisted settings when credential storage is disabled.
+- Synchronized item and package status immediately when a provider retry is queued.
+
+### Reliability and testing
+
+- Kept the latest release notes as a fallback when the release history cannot be loaded.
+- Added regression coverage for cumulative version filtering, ordering, update colors, changelog scrolling, RapidGator aliases, centered queue cells, compact password progress, independent Mega-Debrid API and Web Login pools, credential persistence, legacy migration, live session invalidation, live account-pool refresh, stable active ordering, and user-controlled package expansion.
+- Verified the update dialog with twelve version sections at a 1120 by 760 pixel viewport.
+
 ## [2.0.22] - 2026-08-11
 
 ### History management

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "real-debrid-downloader",
-  "version": "2.0.22",
+  "version": "2.0.23",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "real-debrid-downloader",
-      "version": "2.0.22",
+      "version": "2.0.23",
       "license": "MIT",
       "dependencies": {
         "adm-zip": "0.6.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "real-debrid-downloader",
-  "version": "2.0.22",
+  "version": "2.0.23",
   "description": "Desktop downloader",
   "main": "build/main/main/main.js",
   "author": "Sucukdeluxe",

src/main/constants.ts

@@ -49,6 +49,8 @@ export function defaultSettings(): AppSettings {
     megaLogin: "",
     megaPassword: "",
     megaCredentials: "",
+    megaDebridApiCredentials: "",
+    megaDebridWebCredentials: "",
     megaDebridApiEnabled: false,
     megaDebridWebEnabled: false,
     megaDebridPreferApi: true,
@@ -134,6 +136,8 @@ export function defaultSettings(): AppSettings {
     debridLinkApiKeyDailyUsageBytes: {},
     debridLinkApiKeyTotalUsageBytes: {},
     megaDebridDisabledAccountIds: [],
+    megaDebridApiDisabledAccountIds: [],
+    megaDebridWebDisabledAccountIds: [],
     megaDebridAccountDailyLimitBytes: {},
     megaDebridAccountDailyUsageBytes: {},
     megaDebridAccountTotalUsageBytes: {},

src/main/debrid.ts

@@ -1,5 +1,6 @@
 import { parseDebridLinkApiKeys } from "../shared/debrid-link-keys";
-import { parseMegaDebridAccounts, type MegaDebridAccountEntry } from "../shared/mega-debrid-accounts";
+import { getMegaDebridAccountsForMode, mergeMegaDebridCredentialPools, parseMegaDebridAccounts, type MegaDebridAccountEntry, type MegaDebridAccountMode } from "../shared/mega-debrid-accounts";
+import { extractHosterFromUrl } from "../shared/hoster";
 import { AllDebridHostInfo, AppSettings, DebridFallbackProvider, DebridLinkHostLimitInfo, DebridProvider } from "../shared/types";
 import { isDebridLinkApiKeyDailyLimitReached, isMegaDebridAccountDisabled, isMegaDebridAccountDailyLimitReached, isProviderDailyLimitReached } from "../shared/provider-daily-limits";
 import { isMegaDebridResolveFailure, germanMegaDebridResolveReason } from "../shared/mega-debrid-errors";
@@ -557,16 +558,6 @@ const PROVIDER_LABELS: Record<DebridProvider, string> = {
   linksnappy: "LinkSnappy"
 };
 
-function extractHosterFromUrl(url: string): string {
-  try {
-    const host = new URL(url).hostname.replace(/^www\./, "").toLowerCase();
-    const parts = host.split(".");
-    return parts.length >= 2 ? parts[parts.length - 2] : host;
-  } catch {
-    return "";
-  }
-}
-
 interface ProviderUnrestrictedLink extends UnrestrictedLink {
   provider: DebridProvider;
   providerLabel: string;
@@ -596,6 +587,8 @@ function cloneSettings(settings: AppSettings): AppSettings {
     debridLinkApiKeyDailyUsageBytes: { ...(settings.debridLinkApiKeyDailyUsageBytes || {}) },
     debridLinkApiKeyTotalUsageBytes: { ...(settings.debridLinkApiKeyTotalUsageBytes || {}) },
     megaDebridDisabledAccountIds: [...(settings.megaDebridDisabledAccountIds || [])],
+    megaDebridApiDisabledAccountIds: [...(settings.megaDebridApiDisabledAccountIds || [])],
+    megaDebridWebDisabledAccountIds: [...(settings.megaDebridWebDisabledAccountIds || [])],
     megaDebridAccountDailyLimitBytes: { ...(settings.megaDebridAccountDailyLimitBytes || {}) },
     megaDebridAccountDailyUsageBytes: { ...(settings.megaDebridAccountDailyUsageBytes || {}) },
     megaDebridAccountTotalUsageBytes: { ...(settings.megaDebridAccountTotalUsageBytes || {}) }
@@ -612,25 +605,26 @@ export function getAvailableDebridLinkApiKeys(settings: AppSettings, epochMs = D
   );
 }
 
-export function getAvailableMegaDebridAccounts(settings: AppSettings, epochMs = Date.now()): MegaDebridAccountEntry[] {
-  return getMegaDebridAccountList(settings).filter(
-    (entry) => !isMegaDebridAccountDisabled(settings, entry.id) && !isMegaDebridAccountDailyLimitReached(settings, entry.id, epochMs)
+export function getAvailableMegaDebridAccounts(settings: AppSettings, mode: MegaDebridAccountMode, epochMs = Date.now()): MegaDebridAccountEntry[] {
+  return getMegaDebridAccountList(settings, mode).filter(
+    (entry) => !isMegaDebridAccountDisabled(settings, entry.id, mode) && !isMegaDebridAccountDailyLimitReached(settings, entry.id, epochMs)
   );
 }
 
-function getMegaDebridAccountList(settings: AppSettings): MegaDebridAccountEntry[] {
-  const multiAccounts = parseMegaDebridAccounts(settings.megaCredentials || "");
+function getMegaDebridAccountList(settings: AppSettings, mode: MegaDebridAccountMode): MegaDebridAccountEntry[] {
+  const multiAccounts = getMegaDebridAccountsForMode(settings, mode);
   if (multiAccounts.length > 0) {
     return multiAccounts;
   }
-  if (settings.megaLogin?.trim() && settings.megaPassword?.trim()) {
+  const hasDedicatedPools = typeof settings.megaDebridApiCredentials === "string" || typeof settings.megaDebridWebCredentials === "string";
+  if (!hasDedicatedPools && settings.megaLogin?.trim() && settings.megaPassword?.trim()) {
     return parseMegaDebridAccounts(settings.megaLogin.trim(), settings.megaPassword.trim());
   }
   return [];
 }
 
 function hasMegaDebridCredentials(settings: AppSettings): boolean {
-  return getMegaDebridAccountList(settings).length > 0;
+  return parseMegaDebridAccounts(mergeMegaDebridCredentialPools(settings.megaDebridApiCredentials || "", settings.megaDebridWebCredentials || "") || settings.megaCredentials || "").length > 0;
 }
 
 function isMegaDebridModeEnabled(settings: AppSettings, mode: "api" | "web"): boolean {
@@ -2039,12 +2033,12 @@ class MegaDebridClient {
     megaWebUnrestrict: MegaWebUnrestrictor | undefined,
     signal?: AbortSignal
   ): Promise<UnrestrictedLink> {
-    const accounts = getMegaDebridAccountList(settings);
+    const accounts = getMegaDebridAccountList(settings, mode);
     if (accounts.length === 0) {
       throw new Error("Mega-Debrid: Kein Account konfiguriert");
     }
 
-    if (getAvailableMegaDebridAccounts(settings).length === 0) {
+    if (getAvailableMegaDebridAccounts(settings, mode).length === 0) {
       throw new Error("Mega-Debrid: Kein aktiver Account verfuegbar (deaktiviert oder am Tageslimit)");
     }
 
@@ -2087,7 +2081,7 @@ class MegaDebridClient {
       const accountLabel = ` (${account.label}/${totalAccounts}, ${account.maskedLogin})`;
       const rotationLabel = `${account.label}/${totalAccounts} (${account.maskedLogin})`;
 
-      if (isMegaDebridAccountDisabled(settings, account.id)) {
+      if (isMegaDebridAccountDisabled(settings, account.id, mode)) {
         logger.info(`Mega-Debrid${accountLabel}: uebersprungen (manuell deaktiviert), pruefe naechsten Account`);
         logAccountRotation("INFO", providerName, rotationLabel, "SKIP_DISABLED", { reason: "manually disabled" });
         continue;
@@ -2172,7 +2166,7 @@ class MegaDebridClient {
             if (candidate.account.id === account.id) {
               return count;
             }
-            if (isMegaDebridAccountDisabled(settings, candidate.account.id)) {
+            if (isMegaDebridAccountDisabled(settings, candidate.account.id, mode)) {
               return count;
             }
             if (isMegaDebridAccountDailyLimitReached(settings, candidate.account.id)) {
@@ -2254,7 +2248,7 @@ class MegaDebridClient {
         let nextLabel = "ENDE";
         for (let nextPos = orderPos + 1; nextPos < orderedEntries.length; nextPos += 1) {
           const nextAcc = orderedEntries[nextPos].account;
-          if (!isMegaDebridAccountDisabled(settings, nextAcc.id) && !isMegaDebridAccountDailyLimitReached(settings, nextAcc.id) && !getMegaDebridAccountCooldownState(`${nextAcc.id}:${mode}`)) {
+          if (!isMegaDebridAccountDisabled(settings, nextAcc.id, mode) && !isMegaDebridAccountDailyLimitReached(settings, nextAcc.id) && !getMegaDebridAccountCooldownState(`${nextAcc.id}:${mode}`)) {
             nextLabel = `${nextAcc.label}/${totalAccounts} (${nextAcc.maskedLogin})`;
             break;
           }
@@ -3825,8 +3819,9 @@ export class DebridService {
       }
     }
     if (effectiveProvider === "megadebrid-api" || effectiveProvider === "megadebrid-web") {
-      const configuredAccounts = getMegaDebridAccountList(settings);
-      if (configuredAccounts.length > 0 && getAvailableMegaDebridAccounts(settings).length === 0) {
+      const mode = effectiveProvider === "megadebrid-web" ? "web" : "api";
+      const configuredAccounts = getMegaDebridAccountList(settings, mode);
+      if (configuredAccounts.length > 0 && getAvailableMegaDebridAccounts(settings, mode).length === 0) {
         return true;
       }
     }
@@ -3842,9 +3837,12 @@ export class DebridService {
     if (effectiveProvider === "debridlink" && parseDebridLinkApiKeys(settings.debridLinkApiKeys).length > 0 && getAvailableDebridLinkApiKeys(settings).length === 0) {
       return "Debrid-Link nicht verfuegbar (alle aktiven API-Keys deaktiviert oder ausgeschopft)";
     }
-    if ((effectiveProvider === "megadebrid-api" || effectiveProvider === "megadebrid-web") && getMegaDebridAccountList(settings).length > 0 && getAvailableMegaDebridAccounts(settings).length === 0) {
+    if (effectiveProvider === "megadebrid-api" || effectiveProvider === "megadebrid-web") {
+      const mode = effectiveProvider === "megadebrid-web" ? "web" : "api";
+      if (getMegaDebridAccountList(settings, mode).length > 0 && getAvailableMegaDebridAccounts(settings, mode).length === 0) {
         return "Mega-Debrid nicht verfuegbar (alle aktiven Accounts deaktiviert oder ausgeschopft)";
       }
+    }
     return `${PROVIDER_LABELS[effectiveProvider]} Tageslimit erreicht`;
   }
 

src/main/download-manager.ts

@@ -22,7 +22,9 @@ import {
   StartConflictResolutionResult,
   UiSnapshot, DebridAccountStatus } from "../shared/types";
 import { parseDebridLinkApiKeys } from "../shared/debrid-link-keys";
+import { extractHosterFromUrl } from "../shared/hoster";
 import { isMegaDebridTransientResolveFailure, germanMegaDebridResolveReason } from "../shared/mega-debrid-errors";
+import { getMegaDebridAccountsForMode } from "../shared/mega-debrid-accounts";
 import {
   addDebridLinkApiKeyDailyUsageBytes,
   addDebridLinkApiKeyTotalUsageBytes,
@@ -471,13 +473,7 @@ function isArchiveLikePath(filePath: string): boolean {
 }
 
 function extractHosterKey(link: string): string {
-  try {
-    const host = new URL(link).hostname.replace(/^www\./, "").toLowerCase();
-    const parts = host.split(".");
-    return parts.length >= 2 ? parts[parts.length - 2] : host;
-  } catch {
-    return "";
-  }
+  return extractHosterFromUrl(link);
 }
 
 function isLargeBinaryLikePath(filePath: string): boolean {
@@ -2176,6 +2172,25 @@ export class DownloadManager extends EventEmitter {
 
   public setSettings(next: AppSettings, opts?: { suppressRetroactiveCleanup?: boolean; settingsOnlyImport?: boolean }): void {
     const previous = this.settings;
+    const previousMegaPool = (["api", "web"] as const)
+      .flatMap((mode) => getAvailableMegaDebridAccounts(previous, mode).map((account) => `${mode}:${account.id}:${account.password}`))
+      .sort()
+      .join("\n");
+    const nextMegaAccounts = (["api", "web"] as const)
+      .flatMap((mode) => getAvailableMegaDebridAccounts(next, mode));
+    const nextMegaPool = (["api", "web"] as const)
+      .flatMap((mode) => getAvailableMegaDebridAccounts(next, mode).map((account) => `${mode}:${account.id}:${account.password}`))
+      .sort()
+      .join("\n");
+    const previousMegaWebCredentials = getMegaDebridAccountsForMode(previous, "web")
+      .map((account) => `${account.id}:${account.password}`)
+      .sort()
+      .join("\n");
+    const nextMegaWebCredentials = getMegaDebridAccountsForMode(next, "web")
+      .map((account) => `${account.id}:${account.password}`)
+      .sort()
+      .join("\n");
+    const megaPoolChanged = previousMegaPool !== nextMegaPool && nextMegaAccounts.length > 0;
     next.totalDownloadedAllTime = Math.max(next.totalDownloadedAllTime || 0, this.settings.totalDownloadedAllTime || 0);
     next.totalCompletedFilesAllTime = Math.max(next.totalCompletedFilesAllTime || 0, this.settings.totalCompletedFilesAllTime || 0);
     const now = nowMs();
@@ -2185,6 +2200,9 @@ export class DownloadManager extends EventEmitter {
     this.runtimePersistedTotalMs = this.settings.totalRuntimeAllTimeMs || 0;
     this.runtimePersistedAt = now;
     this.ensureProviderDailyUsageFresh(nowMs());
+    if (previousMegaWebCredentials !== nextMegaWebCredentials) {
+      this.invalidateMegaSessionFn?.();
+    }
     this.debridService.setSettings(next);
     this.allDebridHostInfoCache.clear();
 
@@ -2218,7 +2236,11 @@ export class DownloadManager extends EventEmitter {
       { prev: previous.debridLinkApiKeys || "", next: next.debridLinkApiKeys || "", providers: ["debridlink"] },
       { prev: previous.linkSnappyLogin + "|" + previous.linkSnappyPassword, next: next.linkSnappyLogin + "|" + next.linkSnappyPassword, providers: ["linksnappy"] },
       { prev: previous.ddownloadLogin + "|" + previous.ddownloadPassword, next: next.ddownloadLogin + "|" + next.ddownloadPassword, providers: ["ddownload"] },
-      { prev: previous.megaCredentials + "|" + previous.megaPassword, next: next.megaCredentials + "|" + next.megaPassword, providers: ["megadebrid", "megadebrid-api", "megadebrid-web"] }
+      {
+        prev: `${previous.megaDebridApiCredentials}|${previous.megaDebridWebCredentials}|${previous.megaDebridApiEnabled}|${previous.megaDebridWebEnabled}`,
+        next: `${next.megaDebridApiCredentials}|${next.megaDebridWebCredentials}|${next.megaDebridApiEnabled}|${next.megaDebridWebEnabled}`,
+        providers: ["megadebrid", "megadebrid-api", "megadebrid-web"]
+      }
     ];
     let clearedProviderFailures = 0;
     for (const change of credChanges) {
@@ -2236,6 +2258,10 @@ export class DownloadManager extends EventEmitter {
       logger.info(`Settings-Update: ${clearedProviderFailures} Provider-Failure(s) gecleart wegen geaenderter Credentials`);
     }
 
+    if (!opts?.settingsOnlyImport && megaPoolChanged) {
+      this.releaseMegaDebridResetParks();
+    }
+
     if (!opts?.settingsOnlyImport) {
       this.resolveExistingQueuedOpaqueFilenames();
       void this.cleanupExistingExtractedArchives().catch((err) => logger.warn(`cleanupExistingExtractedArchives Fehler (setSettings): ${compactErrorText(err)}`));
@@ -2246,6 +2272,41 @@ export class DownloadManager extends EventEmitter {
     this.emitState();
   }
 
+  private releaseMegaDebridResetParks(): number {
+    const activeItemIds = new Set([...this.activeTasks.values()].map((task) => task.itemId));
+    const affectedPackageIds = new Set<string>();
+    let released = 0;
+    for (const item of Object.values(this.session.items)) {
+      if (activeItemIds.has(item.id)) continue;
+      if (item.status !== "queued" && item.status !== "reconnect_wait") continue;
+      if (!/Mega-Debrid bis Tagesreset gesperrt/i.test(item.fullStatus || "")) continue;
+      this.retryAfterByItem.delete(item.id);
+      this.retryStateByItem.delete(item.id);
+      item.status = "queued";
+      item.fullStatus = "Wartet";
+      item.lastError = "";
+      item.provider = null;
+      item.providerLabel = undefined;
+      item.providerAccountId = undefined;
+      item.providerAccountLabel = undefined;
+      item.updatedAt = nowMs();
+      affectedPackageIds.add(item.packageId);
+      released += 1;
+    }
+    for (const packageId of affectedPackageIds) {
+      const pkg = this.session.packages[packageId];
+      if (pkg) this.refreshPackageStatus(pkg);
+    }
+    if (released > 0) {
+      logger.info(`Settings-Update: ${released} Mega-Debrid-Tagesreset-Warteitem(s) wegen geaendertem Account-Pool freigegeben`);
+      this.persistSoon();
+      if (this.session.running) {
+        void this.ensureScheduler().catch((error) => logger.error(`Scheduler nach Account-Update fehlgeschlagen: ${compactErrorText(error)}`));
+      }
+    }
+    return released;
+  }
+
   public getSettings(): AppSettings {
     return this.settings;
   }
@@ -8020,11 +8081,11 @@ export class DownloadManager extends EventEmitter {
       return Boolean(this.settings.realDebridUseWebLogin || this.settings.token.trim());
     }
     if (effectiveProvider === "megadebrid-api") {
-      const hasMegaCreds = Boolean(this.settings.megaCredentials.trim() || (this.settings.megaLogin.trim() && this.settings.megaPassword.trim()));
+      const hasMegaCreds = getMegaDebridAccountsForMode(this.settings, "api").length > 0;
       return Boolean(hasMegaCreds && (resolveMegaDebridProvider(this.settings, "megadebrid") === "megadebrid-api" || this.settings.megaDebridApiEnabled));
     }
     if (effectiveProvider === "megadebrid-web") {
-      const hasMegaCreds = Boolean(this.settings.megaCredentials.trim() || (this.settings.megaLogin.trim() && this.settings.megaPassword.trim()));
+      const hasMegaCreds = getMegaDebridAccountsForMode(this.settings, "web").length > 0;
       return Boolean(hasMegaCreds && (resolveMegaDebridProvider(this.settings, "megadebrid") === "megadebrid-web" || this.settings.megaDebridWebEnabled));
     }
     if (effectiveProvider === "bestdebrid") {
@@ -8209,7 +8270,7 @@ export class DownloadManager extends EventEmitter {
   private getSerializedValidatingLimit(provider: DebridProvider | null): number {
     if (provider === "megadebrid-web" || provider === "megadebrid-api") {
       const mode = provider === "megadebrid-web" ? "web" : "api";
-      const usableAccounts = getAvailableMegaDebridAccounts(this.settings)
+      const usableAccounts = getAvailableMegaDebridAccounts(this.settings, mode)
         .filter((account) => !getMegaDebridAccountCooldownState(`${account.id}:${mode}`))
         .length;
       return Math.max(1, usableAccounts);
@@ -8795,6 +8856,8 @@ export class DownloadManager extends EventEmitter {
       resumeHardResetUsed: Boolean(active.resumeHardResetUsed)
     });
     this.retryAfterByItem.set(item.id, nowMs() + waitMs);
+    const pkg = this.session.packages[item.packageId];
+    if (pkg) this.refreshPackageStatus(pkg);
   }
 
   private scheduleHttp416Retry(

src/main/mega-web-fallback.ts

@@ -228,6 +228,8 @@ export class MegaWebFallback {
 
   private sessions = new Map<string, { cookie: string; setAt: number }>();
 
+  private sessionGeneration = 0;
+
   public constructor(getCredentials: () => MegaCredentials) {
     this.getCredentials = getCredentials;
   }
@@ -245,14 +247,15 @@ export class MegaWebFallback {
       return null;
     }
     const key = creds.login.trim().toLowerCase();
+    const sessionGeneration = this.sessionGeneration;
     return this.runExclusive(async () => {
       throwIfAborted(overallSignal);
-      let cookie = await this.ensureSession(key, creds.login, creds.password, overallSignal);
+      let cookie = await this.ensureSession(key, creds.login, creds.password, overallSignal, sessionGeneration);
 
       let generated = await this.generate(link, cookie, overallSignal);
       if (!generated) {
         this.sessions.delete(key);
-        cookie = await this.ensureSession(key, creds.login, creds.password, overallSignal);
+        cookie = await this.ensureSession(key, creds.login, creds.password, overallSignal, sessionGeneration);
         generated = await this.generate(link, cookie, overallSignal);
         if (!generated) {
           return null;
@@ -267,17 +270,26 @@ export class MegaWebFallback {
     }, key, overallSignal);
   }
 
-  private async ensureSession(key: string, login: string, password: string, signal?: AbortSignal): Promise<string> {
+  private async ensureSession(
+    key: string,
+    login: string,
+    password: string,
+    signal?: AbortSignal,
+    generation = this.sessionGeneration
+  ): Promise<string> {
     const existing = this.sessions.get(key);
     if (existing && existing.cookie && Date.now() - existing.setAt <= 20 * 60 * 1000) {
       return existing.cookie;
     }
     const cookie = await this.login(login, password, signal);
+    if (generation === this.sessionGeneration) {
       this.sessions.set(key, { cookie, setAt: Date.now() });
+    }
     return cookie;
   }
 
   public invalidateSession(): void {
+    this.sessionGeneration += 1;
     this.sessions.clear();
   }
 

src/main/settings-live-overlay.ts

@@ -1,10 +1,10 @@
 import { getDebridLinkApiKeyIds } from "../shared/debrid-link-keys";
-import { getMegaDebridAccountIds } from "../shared/mega-debrid-accounts";
+import { getMegaDebridAccountIds, mergeMegaDebridCredentialPools } from "../shared/mega-debrid-accounts";
 import type { AppSettings } from "../shared/types";
 
 export function overlayLiveUsageCounters(target: AppSettings, liveSettings: AppSettings, liveTotalRuntimeMs: number): void {
   const debridLinkKeyIds = new Set(getDebridLinkApiKeyIds(target.debridLinkApiKeys));
-  const megaAccountIds = new Set(getMegaDebridAccountIds(target.megaCredentials || "", target.megaPassword || ""));
+  const megaAccountIds = new Set(getMegaDebridAccountIds(mergeMegaDebridCredentialPools(target.megaDebridApiCredentials || "", target.megaDebridWebCredentials || "") || target.megaCredentials || "", target.megaPassword || ""));
   const validAccountIds = new Set([...debridLinkKeyIds, ...megaAccountIds]);
   target.totalDownloadedAllTime = Math.max(target.totalDownloadedAllTime || 0, liveSettings.totalDownloadedAllTime || 0);
   target.totalCompletedFilesAllTime = Math.max(target.totalCompletedFilesAllTime || 0, liveSettings.totalCompletedFilesAllTime || 0);

src/main/storage.ts

@@ -3,7 +3,7 @@ import fsp from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { getDebridLinkApiKeyIds } from "../shared/debrid-link-keys";
-import { getMegaDebridAccountIds } from "../shared/mega-debrid-accounts";
+import { getMegaDebridAccountIds, mergeMegaDebridCredentialPools, parseMegaDebridAccounts } from "../shared/mega-debrid-accounts";
 import { AppSettings, AudioStripSummary, BandwidthScheduleEntry, DebridAccountStatus, DebridFallbackProvider, DebridProvider, DownloadItem, DownloadStatus, HistoryEntry, HistoryRetentionMode, PackageEntry, PackagePriority, SessionState } from "../shared/types";
 import { getProviderUsageDayKey } from "../shared/provider-daily-limits";
 import { defaultSettings } from "./constants";
@@ -381,21 +381,49 @@ export function normalizeSettings(settings: AppSettings): AppSettings {
   const defaults = defaultSettings();
   const directorySettings = migrateLegacyDefaultDirectories(settings, defaults);
   const currentUsageDay = getProviderUsageDayKey();
-  const megaLogin = asText(settings.megaLogin);
-  const megaPassword = asText(settings.megaPassword);
-  let megaCredentials = String(settings.megaCredentials ?? "").replace(/\r\n|\r/g, "\n").trim();
-  if (!megaCredentials && megaLogin && megaPassword) {
-    megaCredentials = `${megaLogin}:${megaPassword}`;
+  const legacyMegaLogin = asText(settings.megaLogin);
+  const legacyMegaPassword = asText(settings.megaPassword);
+  let legacyMegaCredentials = String(settings.megaCredentials ?? "").replace(/\r\n|\r/g, "\n").trim();
+  if (!legacyMegaCredentials && legacyMegaLogin && legacyMegaPassword) {
+    legacyMegaCredentials = `${legacyMegaLogin}:${legacyMegaPassword}`;
   }
-  const megaDebridAccountIds = getMegaDebridAccountIds(megaCredentials);
   const megaDebridPreferApi = settings.megaDebridPreferApi !== undefined ? Boolean(settings.megaDebridPreferApi) : true;
-  const hasMegaCreds = Boolean(megaLogin && megaPassword);
-  const megaDebridApiEnabled = settings.megaDebridApiEnabled !== undefined
+  const hasLegacyMegaCredentials = getMegaDebridAccountIds(legacyMegaCredentials).length > 0;
+  const requestedMegaDebridApiEnabled = settings.megaDebridApiEnabled !== undefined
     ? Boolean(settings.megaDebridApiEnabled)
-    : (hasMegaCreds ? megaDebridPreferApi : defaults.megaDebridApiEnabled);
-  const megaDebridWebEnabled = settings.megaDebridWebEnabled !== undefined
+    : (hasLegacyMegaCredentials ? megaDebridPreferApi : defaults.megaDebridApiEnabled);
+  const requestedMegaDebridWebEnabled = settings.megaDebridWebEnabled !== undefined
     ? Boolean(settings.megaDebridWebEnabled)
-    : (hasMegaCreds ? !megaDebridPreferApi : defaults.megaDebridWebEnabled);
+    : (hasLegacyMegaCredentials ? !megaDebridPreferApi : defaults.megaDebridWebEnabled);
+  const legacyMegaMode = requestedMegaDebridApiEnabled !== requestedMegaDebridWebEnabled
+    ? requestedMegaDebridApiEnabled ? "api" : "web"
+    : megaDebridPreferApi ? "api" : "web";
+  const rawMegaDebridApiCredentials = String(settings.megaDebridApiCredentials || "").replace(/\r\n|\r/g, "\n").trim();
+  const rawMegaDebridWebCredentials = String(settings.megaDebridWebCredentials || "").replace(/\r\n|\r/g, "\n").trim();
+  const hasDedicatedMegaPools = Boolean(rawMegaDebridApiCredentials || rawMegaDebridWebCredentials) || !legacyMegaCredentials;
+  const megaDebridApiCredentials = hasDedicatedMegaPools
+    ? rawMegaDebridApiCredentials
+    : legacyMegaMode === "api" ? legacyMegaCredentials : "";
+  const megaDebridWebCredentials = hasDedicatedMegaPools
+    ? rawMegaDebridWebCredentials
+    : legacyMegaMode === "web" ? legacyMegaCredentials : "";
+  const megaDebridApiAccountIds = getMegaDebridAccountIds(megaDebridApiCredentials);
+  const megaDebridWebAccountIds = getMegaDebridAccountIds(megaDebridWebCredentials);
+  const megaCredentials = mergeMegaDebridCredentialPools(megaDebridApiCredentials, megaDebridWebCredentials);
+  const megaDebridAccountIds = getMegaDebridAccountIds(megaCredentials);
+  const primaryMegaAccount = parseMegaDebridAccounts(megaCredentials)[0];
+  const megaLogin = primaryMegaAccount?.login || "";
+  const megaPassword = primaryMegaAccount?.password || "";
+  const megaDebridApiEnabled = requestedMegaDebridApiEnabled && megaDebridApiAccountIds.length > 0;
+  const megaDebridWebEnabled = requestedMegaDebridWebEnabled && megaDebridWebAccountIds.length > 0;
+  const legacyMegaDisabledAccountIds = normalizeStringList(settings.megaDebridDisabledAccountIds, megaDebridAccountIds);
+  const megaDebridApiDisabledAccountIds = Array.isArray(settings.megaDebridApiDisabledAccountIds)
+    ? normalizeStringList(settings.megaDebridApiDisabledAccountIds, megaDebridApiAccountIds)
+    : legacyMegaDisabledAccountIds.filter((id) => megaDebridApiAccountIds.includes(id));
+  const megaDebridWebDisabledAccountIds = Array.isArray(settings.megaDebridWebDisabledAccountIds)
+    ? normalizeStringList(settings.megaDebridWebDisabledAccountIds, megaDebridWebAccountIds)
+    : legacyMegaDisabledAccountIds.filter((id) => megaDebridWebAccountIds.includes(id));
+  const megaDebridDisabledAccountIds = [...new Set([...megaDebridApiDisabledAccountIds, ...megaDebridWebDisabledAccountIds])];
   const providerDailyUsageDayRaw = asText(settings.providerDailyUsageDay);
   const providerDailyUsageDay = /^\d{4}-\d{2}-\d{2}$/.test(providerDailyUsageDayRaw)
     ? providerDailyUsageDayRaw
@@ -431,6 +459,8 @@ export function normalizeSettings(settings: AppSettings): AppSettings {
     megaLogin,
     megaPassword,
     megaCredentials,
+    megaDebridApiCredentials,
+    megaDebridWebCredentials,
     megaDebridApiEnabled,
     megaDebridWebEnabled,
     megaDebridPreferApi,
@@ -527,7 +557,9 @@ export function normalizeSettings(settings: AppSettings): AppSettings {
     debridLinkApiKeyDailyLimitBytes,
     debridLinkApiKeyDailyUsageBytes: providerDailyUsageDay === currentUsageDay ? debridLinkApiKeyDailyUsageBytes : {},
     debridLinkApiKeyTotalUsageBytes,
-    megaDebridDisabledAccountIds: normalizeStringList(settings.megaDebridDisabledAccountIds, megaDebridAccountIds),
+    megaDebridDisabledAccountIds,
+    megaDebridApiDisabledAccountIds,
+    megaDebridWebDisabledAccountIds,
     megaDebridAccountDailyLimitBytes: normalizeNamedByteMap(settings.megaDebridAccountDailyLimitBytes, megaDebridAccountIds),
     megaDebridAccountDailyUsageBytes: providerDailyUsageDay === currentUsageDay
       ? normalizeNamedByteMap(settings.megaDebridAccountDailyUsageBytes, megaDebridAccountIds)
@@ -583,6 +615,8 @@ function sanitizeCredentialPersistence(settings: AppSettings): AppSettings {
     megaLogin: "",
     megaPassword: "",
     megaCredentials: "",
+    megaDebridApiCredentials: "",
+    megaDebridWebCredentials: "",
     bestToken: "",
     bestDebridUseWebLogin: settings.bestDebridUseWebLogin,
     allDebridToken: "",
@@ -672,7 +706,10 @@ function migrateLegacyMegaEnableFlags(parsed: AppSettings): AppSettings {
   if (parsed.megaDebridApiEnabled !== undefined || parsed.megaDebridWebEnabled !== undefined) {
     return parsed;
   }
-  const hasMegaCreds = Boolean(asText(parsed.megaLogin) && asText(parsed.megaPassword));
+  const hasMegaCreds = Boolean(
+    getMegaDebridAccountIds(asText(parsed.megaCredentials), asText(parsed.megaPassword)).length
+    || (asText(parsed.megaLogin) && asText(parsed.megaPassword))
+  );
   if (!hasMegaCreds) {
     return parsed;
   }
@@ -684,12 +721,20 @@ function readSettingsFile(filePath: string): AppSettings | null {
   try {
     const parsed = JSON.parse(fs.readFileSync(filePath, "utf8")) as AppSettings;
     const migratedLanguage = (parsed as Partial<AppSettings>).language === undefined ? "de" : parsed.language;
-    const merged = normalizeSettings({
+    const migrated = migrateLegacyMegaEnableFlags(parsed);
+    const mergedInput = {
       ...defaultSettings(),
-      ...migrateLegacyMegaEnableFlags(parsed),
+      ...migrated,
       language: migratedLanguage,
       columnOrderVersion: parsed.columnOrderVersion
-    });
+    } as AppSettings;
+    if (!Object.prototype.hasOwnProperty.call(parsed, "megaDebridApiDisabledAccountIds")) {
+      delete (mergedInput as Partial<AppSettings>).megaDebridApiDisabledAccountIds;
+    }
+    if (!Object.prototype.hasOwnProperty.call(parsed, "megaDebridWebDisabledAccountIds")) {
+      delete (mergedInput as Partial<AppSettings>).megaDebridWebDisabledAccountIds;
+    }
+    const merged = normalizeSettings(mergedInput);
     return sanitizeCredentialPersistence(merged);
   } catch (error) {
     const code = (error as NodeJS.ErrnoException)?.code || "";

src/main/update.ts

@@ -126,7 +126,7 @@ function combineSignals(primary: AbortSignal, secondary?: AbortSignal): AbortSig
   return AbortSignal.any([primary, secondary]);
 }
 
-async function readJsonBody(response: Response, timeoutMs: number): Promise<Record<string, unknown> | null> {
+async function readJsonValue(response: Response, timeoutMs: number): Promise<unknown> {
   let timer: NodeJS.Timeout | null = null;
   const timeoutPromise = new Promise<never>((_resolve, reject) => {
     timer = setTimeout(() => {
@@ -136,17 +136,27 @@ async function readJsonBody(response: Response, timeoutMs: number): Promise<Reco
   });
 
   try {
-    const data = await Promise.race([
+    return await Promise.race([
       response.json().catch(() => null) as Promise<unknown>,
       timeoutPromise,
     ]);
-    if (!data || typeof data !== "object" || Array.isArray(data)) return null;
-    return data as Record<string, unknown>;
   } finally {
     if (timer) clearTimeout(timer);
   }
 }
 
+async function readJsonBody(response: Response, timeoutMs: number): Promise<Record<string, unknown> | null> {
+  const data = await readJsonValue(response, timeoutMs);
+  if (!data || typeof data !== "object" || Array.isArray(data)) return null;
+  return data as Record<string, unknown>;
+}
+
+async function readJsonArray(response: Response, timeoutMs: number): Promise<Array<Record<string, unknown>> | null> {
+  const data = await readJsonValue(response, timeoutMs);
+  if (!Array.isArray(data)) return null;
+  return data.filter((entry): entry is Record<string, unknown> => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry));
+}
+
 async function readTextBody(response: Response, timeoutMs: number): Promise<string> {
   let timer: NodeJS.Timeout | null = null;
   const timeoutPromise = new Promise<never>((_resolve, reject) => {
@@ -375,6 +385,24 @@ async function fetchRelease(repo: string, endpoint: string): Promise<{
   }
 }
 
+async function fetchReleasePage(repo: string, page: number): Promise<{
+  ok: boolean;
+  status: number;
+  payload: Array<Record<string, unknown>> | null;
+}> {
+  const tc = timeoutController(RELEASE_FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetch(`${API_BASE}/repos/${repo}/releases?per_page=100&page=${page}`, {
+      headers: { Accept: "application/vnd.github+json", "User-Agent": USER_AGENT },
+      signal: tc.signal,
+    });
+    const payload = await readJsonArray(response, RELEASE_FETCH_TIMEOUT_MS);
+    return { ok: response.ok, status: response.status, payload };
+  } finally {
+    tc.clear();
+  }
+}
+
 function readAssets(payload: Record<string, unknown>): ReleaseAsset[] {
   const raw = Array.isArray(payload.assets) ? (payload.assets as Array<Record<string, unknown>>) : [];
   return raw
@@ -428,6 +456,71 @@ function parseReleasePayload(payload: Record<string, unknown>, fallbackUrl: stri
   };
 }
 
+function combineReleaseNotes(
+  payloads: Array<Record<string, unknown>>,
+  currentVersion: string,
+  latestVersion: string,
+): string {
+  const seen = new Set<string>();
+  const releases = payloads
+    .filter((payload) => !isDraftOrPrerelease(payload))
+    .map((payload) => {
+      const tag = String(payload.tag_name || "").trim();
+      return {
+        tag,
+        version: tag.replace(/^v/i, ""),
+        body: typeof payload.body === "string" ? payload.body.trim() : "",
+      };
+    })
+    .filter((release) => (
+      release.tag
+      && release.body
+      && isRemoteNewer(currentVersion, release.version)
+      && !isRemoteNewer(latestVersion, release.version)
+    ))
+    .sort((first, second) => {
+      if (isRemoteNewer(first.version, second.version)) return 1;
+      if (isRemoteNewer(second.version, first.version)) return -1;
+      return 0;
+    });
+
+  return releases
+    .filter((release) => {
+      const key = release.version.toLowerCase();
+      if (seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    })
+    .map((release) => `${release.tag}\n${release.body}`)
+    .join("\n\n");
+}
+
+async function resolveMissingReleaseNotes(
+  repo: string,
+  latestPayload: Record<string, unknown>,
+  latestVersion: string,
+): Promise<string> {
+  const fallbackBody = typeof latestPayload.body === "string" ? latestPayload.body.trim() : "";
+  const payloads: Array<Record<string, unknown>> = [latestPayload];
+
+  try {
+    for (let page = 1; page <= 10; page += 1) {
+      const result = await fetchReleasePage(repo, page);
+      if (!result.ok || !result.payload) break;
+      payloads.push(...result.payload);
+      const reachedInstalledVersion = result.payload.some((payload) => {
+        const version = String(payload.tag_name || "").trim().replace(/^v/i, "");
+        return version && !isRemoteNewer(APP_VERSION, version);
+      });
+      if (result.payload.length < 100 || reachedInstalledVersion) break;
+    }
+  } catch {
+    return fallbackBody;
+  }
+
+  return combineReleaseNotes(payloads, APP_VERSION, latestVersion) || fallbackBody;
+}
+
 function uniqueStrings(values: string[]): string[] {
   const seen = new Set<string>();
   const out: string[] = [];
@@ -821,7 +914,12 @@ export async function checkGitHubUpdate(repo: string): Promise<UpdateCheckResult
       const reason = String((payload?.message as string) || `HTTP ${status}`);
       return { ...fallback, error: reason };
     }
-    return parseReleasePayload(payload, fallbackUrl);
+    const result = parseReleasePayload(payload, fallbackUrl);
+    if (!result.updateAvailable) return result;
+    return {
+      ...result,
+      releaseNotes: await resolveMissingReleaseNotes(safeRepo, payload, result.latestVersion),
+    };
   } catch (error) {
     return { ...fallback, error: compactErrorText(error) };
   }

src/renderer/App.tsx

@@ -1,7 +1,7 @@
 import { DragEvent, ReactElement, memo, useCallback, useDeferredValue, useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
 import { flushSync } from "react-dom";
 import { parseDebridLinkApiKeys } from "../shared/debrid-link-keys";
-import { getMegaDebridAccountId, parseMegaDebridAccounts, serializeMegaDebridAccounts, maskMegaDebridLogin } from "../shared/mega-debrid-accounts";
+import { getMegaDebridAccountId, getMegaDebridAccountsForMode, getMegaDebridCredentialsForMode, getMegaDebridDisabledAccountIdsForMode, mergeMegaDebridCredentialPools, parseMegaDebridAccounts, serializeMegaDebridAccounts, type MegaDebridAccountMode } from "../shared/mega-debrid-accounts";
 import type {
   AllDebridHostInfo,
   AppSettings,
@@ -447,8 +447,7 @@ const ACCOUNT_OPTIONS: AccountOption[] = [
     serviceLabel: "Mega-Debrid",
     title: "Mega-Debrid API",
     modeLabel: "API",
-    pickerDescription: "Login:Passwort-Paare für Mega-Debrid (API). Mehrere Accounts zeilenweise für Multi-Account.",
-    needsToken: true
+    pickerDescription: "Login:Passwort-Paare für Mega-Debrid (API). Mehrere Accounts zeilenweise für Multi-Account."
   },
   {
     kind: "megadebrid-web",
@@ -456,8 +455,7 @@ const ACCOUNT_OPTIONS: AccountOption[] = [
     serviceLabel: "Mega-Debrid",
     title: "Mega-Debrid Web-Login",
     modeLabel: "Web-Login",
-    pickerDescription: "Login:Passwort-Paare für Mega-Debrid (Web). Mehrere Accounts zeilenweise für Multi-Account.",
-    needsToken: true
+    pickerDescription: "Login:Passwort-Paare für Mega-Debrid (Web). Mehrere Accounts zeilenweise für Multi-Account."
   },
   {
     kind: "bestdebrid-api",
@@ -621,9 +619,11 @@ function getAccountCredentialLabel(kind: AccountKind): string {
   }
 }
 
-function hasMegaDebridCredentials(settings: AppSettings): boolean {
-  if (parseMegaDebridAccounts(settings.megaCredentials || "").length > 0) return true;
-  return Boolean(settings.megaLogin.trim() && settings.megaPassword.trim());
+function hasMegaDebridCredentials(settings: AppSettings, mode?: MegaDebridAccountMode): boolean {
+  if (mode) {
+    return getMegaDebridAccountsForMode(settings, mode).length > 0;
+  }
+  return getMegaDebridAccountsForMode(settings, "api").length > 0 || getMegaDebridAccountsForMode(settings, "web").length > 0;
 }
 
 function getConfiguredProvidersFromSettings(settings: AppSettings): DebridProvider[] {
@@ -631,10 +631,10 @@ function getConfiguredProvidersFromSettings(settings: AppSettings): DebridProvid
   if (settings.token.trim() || settings.realDebridUseWebLogin) {
     list.push("realdebrid");
   }
-  if (hasMegaDebridCredentials(settings) && settings.megaDebridApiEnabled) {
+  if (hasMegaDebridCredentials(settings, "api") && settings.megaDebridApiEnabled) {
     list.push("megadebrid-api");
   }
-  if (hasMegaDebridCredentials(settings) && settings.megaDebridWebEnabled) {
+  if (hasMegaDebridCredentials(settings, "web") && settings.megaDebridWebEnabled) {
     list.push("megadebrid-web");
   }
   if (settings.bestDebridUseWebLogin || settings.bestToken.trim()) {
@@ -682,9 +682,9 @@ function getConfiguredAccountKind(settings: AppSettings, service: AccountService
       if (settings.realDebridUseWebLogin) return "realdebrid-web";
       return settings.token.trim() ? "realdebrid-api" : null;
     case "megadebrid-api":
-      return hasMegaDebridCredentials(settings) && settings.megaDebridApiEnabled ? "megadebrid-api" : null;
+      return hasMegaDebridCredentials(settings, "api") && settings.megaDebridApiEnabled ? "megadebrid-api" : null;
     case "megadebrid-web":
-      return hasMegaDebridCredentials(settings) && settings.megaDebridWebEnabled ? "megadebrid-web" : null;
+      return hasMegaDebridCredentials(settings, "web") && settings.megaDebridWebEnabled ? "megadebrid-web" : null;
     case "bestdebrid":
       if (settings.bestDebridUseWebLogin) return "bestdebrid-web";
       return settings.bestToken.trim() ? "bestdebrid-api" : null;
@@ -721,7 +721,8 @@ function summarizeAccount(kind: AccountKind, settings: AppSettings): string {
       return "Browser-Login";
     case "megadebrid-api":
     case "megadebrid-web": {
-      const megaAccounts = parseMegaDebridAccounts(settings.megaCredentials || "", settings.megaPassword);
+      const mode = kind === "megadebrid-web" ? "web" : "api";
+      const megaAccounts = getMegaDebridAccountsForMode(settings, mode);
       if (megaAccounts.length > 1) return `${megaAccounts.length} Accounts`;
       if (megaAccounts.length === 1) return megaAccounts[0].maskedLogin;
       return settings.megaLogin.trim() ? maskValue(settings.megaLogin.trim(), 2, 6) : "Nicht hinterlegt";
@@ -758,7 +759,7 @@ function summarizeAccountLines(kind: AccountKind, settings: AppSettings): string
     }
   }
   if (kind === "megadebrid-api" || kind === "megadebrid-web") {
-    const accounts = parseMegaDebridAccounts(settings.megaCredentials || "", settings.megaPassword);
+    const accounts = getMegaDebridAccountsForMode(settings, kind === "megadebrid-web" ? "web" : "api");
     if (accounts.length > 1) {
       return accounts.map((entry) => `${entry.label}: ${entry.maskedLogin}`);
     }
@@ -782,7 +783,7 @@ function getStoredAccountUsername(kind: AccountKind, settings: AppSettings): str
   }
 }
 
-function createAccountDialogState(mode: "create" | "edit", kind: AccountKind | null, settings: AppSettings): AccountDialogState {
+export function createAccountDialogState(mode: "create" | "edit", kind: AccountKind | null, settings: AppSettings): AccountDialogState {
   const baseMega: Pick<AccountDialogState, "megaAccounts" | "megaNewLogin" | "megaNewPassword" | "megaDisabledIds"> = { megaAccounts: [], megaNewLogin: "", megaNewPassword: "", megaDisabledIds: [] };
   if (!kind) {
     return {
@@ -807,15 +808,12 @@ function createAccountDialogState(mode: "create" | "edit", kind: AccountKind | n
       return { mode, kind, service, token: "", login: "", password: "", dailyLimitGb, keyDailyLimitGbById: {}, ...baseMega };
     case "megadebrid-api":
     case "megadebrid-web": {
-      let megaToken = (settings.megaCredentials || "").trim();
-      if (!megaToken && settings.megaLogin.trim() && settings.megaPassword.trim()) {
-        megaToken = `${settings.megaLogin.trim()}:${settings.megaPassword.trim()}`;
-      }
-      const parsed = parseMegaDebridAccounts(megaToken);
+      const megaMode = kind === "megadebrid-web" ? "web" : "api";
+      const parsed = getMegaDebridAccountsForMode(settings, megaMode);
       const megaAccounts = parsed.map((a) => ({ login: a.login, password: a.password }));
       const loadedIds = new Set(parsed.map((a) => a.id));
-      const megaDisabledIds = (settings.megaDebridDisabledAccountIds || []).filter((id) => loadedIds.has(id));
-      return { mode, kind, service, token: megaToken, login: "", password: "", dailyLimitGb, keyDailyLimitGbById: {}, megaAccounts, megaNewLogin: "", megaNewPassword: "", megaDisabledIds };
+      const megaDisabledIds = getMegaDebridDisabledAccountIdsForMode(settings, megaMode).filter((id) => loadedIds.has(id));
+      return { mode, kind, service, token: "", login: "", password: "", dailyLimitGb, keyDailyLimitGbById: {}, megaAccounts, megaNewLogin: "", megaNewPassword: "", megaDisabledIds };
     }
     case "bestdebrid-api":
       return { mode, kind, service, token: settings.bestToken, login: "", password: "", dailyLimitGb, keyDailyLimitGbById: {}, ...baseMega };
@@ -848,6 +846,83 @@ function createAccountDialogState(mode: "create" | "edit", kind: AccountKind | n
   }
 }
 
+export function buildAccountAddFields(dialog: AccountDialogState | null): AccountDialogField[] {
+  if (!dialog?.kind) {
+    return [];
+  }
+  const option = findAccountOption(dialog.kind);
+  return [
+    ...((dialog.kind === "megadebrid-api" || dialog.kind === "megadebrid-web") ? [
+      { id: "megaNewLogin", label: "Login / E-Mail", type: "text" as const, value: dialog.megaNewLogin },
+      { id: "megaNewPassword", label: "Passwort", type: "password" as const, value: dialog.megaNewPassword }
+    ] : option.needsCredentials ? [
+      { id: "login", label: "Login / E-Mail", type: "text" as const, value: dialog.login },
+      { id: "password", label: "Passwort", type: "password" as const, value: dialog.password }
+    ] : []),
+    ...(option.needsToken ? [
+      { id: "token", label: dialog.kind === "debridlink-api" ? "API-Key" : "Token / API-Key", type: "password" as const, value: dialog.token }
+    ] : []),
+    {
+      id: "dailyLimitGb",
+      label: "Tageslimit (GB, optional)",
+      type: "number" as const,
+      value: dialog.dailyLimitGb,
+      placeholder: "Kein Limit",
+      help: "Der Zähler wird täglich um 00:00 Uhr zurückgesetzt."
+    }
+  ];
+}
+
+function applyMegaDebridDialogToSettings(settings: AppSettings, dialog: AccountDialogState, mode: MegaDebridAccountMode, providerDailyLimitBytes: AppSettings["providerDailyLimitBytes"]): AppSettings {
+  const selectedCredentials = serializeMegaDebridAccounts(dialog.megaAccounts);
+  const apiCredentials = mode === "api" ? selectedCredentials : getMegaDebridCredentialsForMode(settings, "api");
+  const webCredentials = mode === "web" ? selectedCredentials : getMegaDebridCredentialsForMode(settings, "web");
+  const mergedCredentials = mergeMegaDebridCredentialPools(apiCredentials, webCredentials);
+  const first = parseMegaDebridAccounts(mergedCredentials)[0];
+  const selectedIds = new Set(parseMegaDebridAccounts(selectedCredentials).map((account) => account.id));
+  const selectedDisabledIds = (dialog.megaDisabledIds || []).filter((id) => selectedIds.has(id));
+  const apiDisabledIds = mode === "api" ? selectedDisabledIds : getMegaDebridDisabledAccountIdsForMode(settings, "api");
+  const webDisabledIds = mode === "web" ? selectedDisabledIds : getMegaDebridDisabledAccountIdsForMode(settings, "web");
+  return {
+    ...settings,
+    megaCredentials: mergedCredentials,
+    megaLogin: first?.login || "",
+    megaPassword: first?.password || "",
+    megaDebridApiCredentials: apiCredentials,
+    megaDebridWebCredentials: webCredentials,
+    megaDebridApiEnabled: mode === "api" ? selectedIds.size > 0 : settings.megaDebridApiEnabled && parseMegaDebridAccounts(apiCredentials).length > 0,
+    megaDebridWebEnabled: mode === "web" ? selectedIds.size > 0 : settings.megaDebridWebEnabled && parseMegaDebridAccounts(webCredentials).length > 0,
+    megaDebridDisabledAccountIds: [...new Set([...apiDisabledIds, ...webDisabledIds])],
+    megaDebridApiDisabledAccountIds: apiDisabledIds,
+    megaDebridWebDisabledAccountIds: webDisabledIds,
+    providerDailyLimitBytes
+  };
+}
+
+function clearMegaDebridModeFromSettings(settings: AppSettings, mode: MegaDebridAccountMode, providerDailyLimitBytes: AppSettings["providerDailyLimitBytes"], providerDailyUsageBytes: AppSettings["providerDailyUsageBytes"]): AppSettings {
+  const apiCredentials = mode === "api" ? "" : getMegaDebridCredentialsForMode(settings, "api");
+  const webCredentials = mode === "web" ? "" : getMegaDebridCredentialsForMode(settings, "web");
+  const mergedCredentials = mergeMegaDebridCredentialPools(apiCredentials, webCredentials);
+  const first = parseMegaDebridAccounts(mergedCredentials)[0];
+  const apiDisabledIds = mode === "api" ? [] : getMegaDebridDisabledAccountIdsForMode(settings, "api");
+  const webDisabledIds = mode === "web" ? [] : getMegaDebridDisabledAccountIdsForMode(settings, "web");
+  return {
+    ...settings,
+    megaCredentials: mergedCredentials,
+    megaLogin: first?.login || "",
+    megaPassword: first?.password || "",
+    megaDebridApiCredentials: apiCredentials,
+    megaDebridWebCredentials: webCredentials,
+    megaDebridApiEnabled: mode === "api" ? false : settings.megaDebridApiEnabled && parseMegaDebridAccounts(apiCredentials).length > 0,
+    megaDebridWebEnabled: mode === "web" ? false : settings.megaDebridWebEnabled && parseMegaDebridAccounts(webCredentials).length > 0,
+    megaDebridDisabledAccountIds: [...new Set([...apiDisabledIds, ...webDisabledIds])],
+    megaDebridApiDisabledAccountIds: apiDisabledIds,
+    megaDebridWebDisabledAccountIds: webDisabledIds,
+    providerDailyLimitBytes,
+    providerDailyUsageBytes
+  };
+}
+
 export function applyAccountDialogToSettings(settings: AppSettings, dialog: AccountDialogState): AppSettings {
   if (!dialog.kind) {
     return settings;
@@ -877,22 +952,10 @@ export function applyAccountDialogToSettings(settings: AppSettings, dialog: Acco
     case "realdebrid-web":
       return { ...settings, token: "", realDebridUseWebLogin: true, providerDailyLimitBytes: nextProviderDailyLimitBytes };
     case "megadebrid-api": {
-      const megaSerialized = serializeMegaDebridAccounts(dialog.megaAccounts);
-      const megaParsed = parseMegaDebridAccounts(megaSerialized);
-      const firstLogin = megaParsed.length > 0 ? megaParsed[0].login : "";
-      const firstPassword = megaParsed.length > 0 ? megaParsed[0].password : "";
-      const validIds = new Set(megaParsed.map((a) => a.id));
-      const megaDebridDisabledAccountIds = (dialog.megaDisabledIds || []).filter((id) => validIds.has(id));
-      return { ...settings, megaCredentials: megaSerialized, megaLogin: firstLogin, megaPassword: firstPassword, megaDebridApiEnabled: true, megaDebridDisabledAccountIds, providerDailyLimitBytes: nextProviderDailyLimitBytes };
+      return applyMegaDebridDialogToSettings(settings, dialog, "api", nextProviderDailyLimitBytes);
     }
     case "megadebrid-web": {
-      const megaSerialized = serializeMegaDebridAccounts(dialog.megaAccounts);
-      const megaParsed = parseMegaDebridAccounts(megaSerialized);
-      const firstLogin = megaParsed.length > 0 ? megaParsed[0].login : "";
-      const firstPassword = megaParsed.length > 0 ? megaParsed[0].password : "";
-      const validIds = new Set(megaParsed.map((a) => a.id));
-      const megaDebridDisabledAccountIds = (dialog.megaDisabledIds || []).filter((id) => validIds.has(id));
-      return { ...settings, megaCredentials: megaSerialized, megaLogin: firstLogin, megaPassword: firstPassword, megaDebridWebEnabled: true, megaDebridDisabledAccountIds, providerDailyLimitBytes: nextProviderDailyLimitBytes };
+      return applyMegaDebridDialogToSettings(settings, dialog, "web", nextProviderDailyLimitBytes);
     }
     case "bestdebrid-api":
       return { ...settings, bestToken: token, bestDebridUseWebLogin: false, providerDailyLimitBytes: nextProviderDailyLimitBytes };
@@ -938,13 +1001,9 @@ function clearAccountServiceFromSettings(settings: AppSettings, service: Account
     case "realdebrid":
       return { ...settings, token: "", realDebridUseWebLogin: false, providerDailyLimitBytes: nextProviderDailyLimitBytes, providerDailyUsageBytes: nextProviderDailyUsageBytes };
     case "megadebrid-api":
-      return settings.megaDebridWebEnabled
-        ? { ...settings, megaDebridApiEnabled: false, providerDailyLimitBytes: nextProviderDailyLimitBytes, providerDailyUsageBytes: nextProviderDailyUsageBytes }
-        : { ...settings, megaCredentials: "", megaLogin: "", megaPassword: "", megaDebridApiEnabled: false, providerDailyLimitBytes: nextProviderDailyLimitBytes, providerDailyUsageBytes: nextProviderDailyUsageBytes };
+      return clearMegaDebridModeFromSettings(settings, "api", nextProviderDailyLimitBytes, nextProviderDailyUsageBytes);
     case "megadebrid-web":
-      return settings.megaDebridApiEnabled
-        ? { ...settings, megaDebridWebEnabled: false, providerDailyLimitBytes: nextProviderDailyLimitBytes, providerDailyUsageBytes: nextProviderDailyUsageBytes }
-        : { ...settings, megaCredentials: "", megaLogin: "", megaPassword: "", megaDebridWebEnabled: false, providerDailyLimitBytes: nextProviderDailyLimitBytes, providerDailyUsageBytes: nextProviderDailyUsageBytes };
+      return clearMegaDebridModeFromSettings(settings, "web", nextProviderDailyLimitBytes, nextProviderDailyUsageBytes);
     case "bestdebrid":
       return { ...settings, bestToken: "", bestDebridUseWebLogin: false, providerDailyLimitBytes: nextProviderDailyLimitBytes, providerDailyUsageBytes: nextProviderDailyUsageBytes };
     case "alldebrid":
@@ -1029,7 +1088,7 @@ const emptyStats = (): DownloadStats => ({
 
 const emptySnapshot = (): UiSnapshot => ({
   settings: {
-    language: "en", token: "", realDebridUseWebLogin: false, megaLogin: "", megaPassword: "", megaCredentials: "", megaDebridApiEnabled: false, megaDebridWebEnabled: false, megaDebridPreferApi: true, bestToken: "", bestDebridUseWebLogin: false, allDebridToken: "", allDebridUseWebLogin: false, ddownloadLogin: "", ddownloadPassword: "", oneFichierApiKey: "", debridLinkApiKeys: "", linkSnappyLogin: "", linkSnappyPassword: "",
+    language: "en", token: "", realDebridUseWebLogin: false, megaLogin: "", megaPassword: "", megaCredentials: "", megaDebridApiCredentials: "", megaDebridWebCredentials: "", megaDebridApiEnabled: false, megaDebridWebEnabled: false, megaDebridPreferApi: true, bestToken: "", bestDebridUseWebLogin: false, allDebridToken: "", allDebridUseWebLogin: false, ddownloadLogin: "", ddownloadPassword: "", oneFichierApiKey: "", debridLinkApiKeys: "", linkSnappyLogin: "", linkSnappyPassword: "",
     debridLinkDisabledKeyIds: [],
     archivePasswordList: "",
     rememberToken: true, providerOrder: [], providerPrimary: "realdebrid", providerSecondary: "none",
@@ -1057,6 +1116,8 @@ const emptySnapshot = (): UiSnapshot => ({
     debridLinkApiKeyDailyUsageBytes: {},
     debridLinkApiKeyTotalUsageBytes: {},
     megaDebridDisabledAccountIds: [],
+    megaDebridApiDisabledAccountIds: [],
+    megaDebridWebDisabledAccountIds: [],
     megaDebridAccountDailyLimitBytes: {},
     megaDebridAccountDailyUsageBytes: {},
     megaDebridAccountTotalUsageBytes: {},
@@ -1753,8 +1814,6 @@ export function App(): ReactElement {
   const snapshotRef = useRef(snapshot);
   snapshotRef.current = snapshot;
   const tabRef = useRef(tab);
-  const autoExpandedPkgsRef = useRef(new Set<string>());
-  const manualCollapsedPkgsRef = useRef(new Set<string>());
   tabRef.current = tab;
   const stateFlushTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
   const toastTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
@@ -2270,11 +2329,6 @@ export function App(): ReactElement {
           changed = true;
         }
       }
-      for (const packageId of Array.from(manualCollapsedPkgsRef.current)) {
-        if (!snapshot.session.packages[packageId]) {
-          manualCollapsedPkgsRef.current.delete(packageId);
-        }
-      }
       return changed ? next : prev;
     });
   }, [downloadsTabActive, packageOrderKey, snapshot.session.packageOrder, snapshot.session.packages, totalPackageCount]);
@@ -2338,36 +2392,6 @@ export function App(): ReactElement {
     void loadAllDebridHostInfo(true);
   }, [settingsSubTab, hasSavedAllDebridAccount, snapshot.settings.allDebridToken, snapshot.settings.allDebridUseWebLogin, loadAllDebridHostInfo]);
 
-  useEffect(() => {
-    const extractingPkgIds: string[] = [];
-    const currentlyExtracting = new Set<string>();
-    for (const pkg of packages) {
-      const items = (pkg.itemIds ?? []).map((id) => snapshot.session.items[id]).filter(Boolean);
-      const isExtracting = items.some((item) => item.fullStatus?.startsWith("Entpacken -") && !item.fullStatus?.includes("Done"));
-      if (isExtracting) {
-        currentlyExtracting.add(pkg.id);
-        if (collapsedPackages[pkg.id]
-          && !manualCollapsedPkgsRef.current.has(pkg.id)
-          && !autoExpandedPkgsRef.current.has(pkg.id)) {
-          extractingPkgIds.push(pkg.id);
-          autoExpandedPkgsRef.current.add(pkg.id);
-        }
-      }
-    }
-    for (const id of autoExpandedPkgsRef.current) {
-      if (!currentlyExtracting.has(id)) {
-        autoExpandedPkgsRef.current.delete(id);
-      }
-    }
-    if (extractingPkgIds.length > 0) {
-      setCollapsedPackages((prev) => {
-        const next = { ...prev };
-        for (const id of extractingPkgIds) next[id] = false;
-        return next;
-      });
-    }
-  }, [packages, snapshot.session.items, collapsedPackages]);
-
   const allPackagesCollapsed = useMemo(() => (
     packages.length > 0 && packages.every((pkg) => collapsedPackages[pkg.id])
   ), [packages, collapsedPackages]);
@@ -2454,11 +2478,11 @@ export function App(): ReactElement {
       let statusLabel = "Aktiviert";
       let note = "";
       if (kind === "megadebrid-api") {
-        const megaAccountCount = parseMegaDebridAccounts(settingsDraft.megaCredentials || "", settingsDraft.megaPassword).length;
+        const megaAccountCount = getMegaDebridAccountsForMode(settingsDraft, "api").length;
         statusLabel = megaAccountCount > 1 ? `${megaAccountCount} Accounts` : "Aktiviert";
         note = "Nur API aktiv. Kein Web-Fallback.";
       } else if (kind === "megadebrid-web") {
-        const megaAccountCount = parseMegaDebridAccounts(settingsDraft.megaCredentials || "", settingsDraft.megaPassword).length;
+        const megaAccountCount = getMegaDebridAccountsForMode(settingsDraft, "web").length;
         statusLabel = megaAccountCount > 1 ? `${megaAccountCount} Accounts` : "Aktiviert";
         note = "Nur Web aktiv. Kein API-Fallback.";
       } else if (kind === "realdebrid-web") {
@@ -2570,7 +2594,9 @@ export function App(): ReactElement {
     const rows: AccountTableRow[] = [];
     for (const entry of configuredAccounts) {
       if (entry.kind === "megadebrid-api" || entry.kind === "megadebrid-web") {
-        const accounts = parseMegaDebridAccounts(settingsDraft.megaCredentials || "", settingsDraft.megaPassword || "");
+        const mode = entry.kind === "megadebrid-web" ? "web" : "api";
+        const accounts = getMegaDebridAccountsForMode(settingsDraft, mode);
+        const disabledAccountIds = getMegaDebridDisabledAccountIdsForMode(settingsDraft, mode);
         for (const acc of accounts) {
           const used = getMegaDebridAccountDailyUsageBytes(snapshot.settings, acc.id);
           const limit = getMegaDebridAccountDailyLimitBytes(settingsDraft, acc.id);
@@ -2583,7 +2609,7 @@ export function App(): ReactElement {
             credentialLabel: "••••••",
             accountId: acc.id,
             checkable: true,
-            disabled: (settingsDraft.megaDebridDisabledAccountIds || []).includes(acc.id),
+            disabled: disabledAccountIds.includes(acc.id),
             dailyUsedBytes: used,
             dailyLimitBytes: limit,
             dailyRemainingBytes: limit > 0 ? Math.max(0, limit - used) : 0,
@@ -3095,9 +3121,23 @@ export function App(): ReactElement {
               megaCredentials: serializeMegaDebridAccounts([newMegaCredentials]),
               megaLogin: newMegaCredentials.login,
               megaPassword: newMegaCredentials.password,
+              megaDebridApiCredentials: selectedOption?.service === "megadebrid-web" ? "" : serializeMegaDebridAccounts([newMegaCredentials]),
+              megaDebridWebCredentials: selectedOption?.service === "megadebrid-web" ? serializeMegaDebridAccounts([newMegaCredentials]) : "",
+              megaDebridApiEnabled: selectedOption?.service !== "megadebrid-web",
+              megaDebridWebEnabled: selectedOption?.service === "megadebrid-web",
               debridLinkApiKeys: ""
             }
-          : { ...nextDraft, megaCredentials: "", megaLogin: "", megaPassword: "", debridLinkApiKeys: newDebridLinkToken };
+          : {
+              ...nextDraft,
+              megaCredentials: "",
+              megaLogin: "",
+              megaPassword: "",
+              megaDebridApiCredentials: "",
+              megaDebridWebCredentials: "",
+              megaDebridApiEnabled: false,
+              megaDebridWebEnabled: false,
+              debridLinkApiKeys: newDebridLinkToken
+            };
         const statuses = await window.rd.checkDebridAccounts(checkSettings, true, targetedCheck.expectedStatusId);
         const status = statuses.length === 1 && statuses[0].accountId === targetedCheck.expectedStatusId ? statuses[0] : null;
         if (!status || !status.valid) {
@@ -3193,30 +3233,26 @@ export function App(): ReactElement {
     });
   };
 
-  const onToggleMegaAccountEnabled = async (login: string, currentlyDisabled: boolean): Promise<void> => {
+  const onToggleMegaAccountEnabled = async (kind: "megadebrid-api" | "megadebrid-web", login: string, currentlyDisabled: boolean): Promise<void> => {
     const accId = getMegaDebridAccountId(login.trim());
     await performQuickAction(async () => {
-      const current = settingsDraft.megaDebridDisabledAccountIds || [];
+      const mode = kind === "megadebrid-web" ? "web" : "api";
+      const current = getMegaDebridDisabledAccountIdsForMode(settingsDraft, mode);
       const next = currentlyDisabled ? current.filter((id) => id !== accId) : [...current, accId];
-      await persistSpecificSettings({ ...settingsDraft, megaDebridDisabledAccountIds: next });
+      const apiDisabledIds = mode === "api" ? next : getMegaDebridDisabledAccountIdsForMode(settingsDraft, "api");
+      const webDisabledIds = mode === "web" ? next : getMegaDebridDisabledAccountIdsForMode(settingsDraft, "web");
+      await persistSpecificSettings({
+        ...settingsDraft,
+        megaDebridDisabledAccountIds: [...new Set([...apiDisabledIds, ...webDisabledIds])],
+        megaDebridApiDisabledAccountIds: apiDisabledIds,
+        megaDebridWebDisabledAccountIds: webDisabledIds
+      });
       showToast(currentlyDisabled ? "Account aktiviert" : "Account deaktiviert", 2000);
     }, (error) => {
       showToast(`Umschalten fehlgeschlagen: ${String(error)}`, 3200);
     });
   };
 
-  const onRemoveMegaAccount = async (login: string): Promise<void> => {
-    const confirmed = await askConfirmPrompt({ title: "Account entfernen", message: `Soll der Mega-Debrid-Account ${maskMegaDebridLogin(login)} wirklich entfernt werden?`, confirmLabel: "Entfernen", danger: true });
-    if (!confirmed) return;
-    await performQuickAction(async () => {
-      const remaining = parseMegaDebridAccounts(settingsDraft.megaCredentials || "", settingsDraft.megaPassword || "")
-        .filter((a) => a.login.trim().toLowerCase() !== login.trim().toLowerCase());
-      const nextCreds = serializeMegaDebridAccounts(remaining.map((a) => ({ login: a.login, password: a.password })));
-      await persistSpecificSettings({ ...settingsDraft, megaCredentials: nextCreds, megaLogin: remaining[0]?.login ?? "", megaPassword: remaining[0]?.password ?? "" });
-      showToast("Account entfernt", 2000);
-    }, (error) => { showToast(`Entfernen fehlgeschlagen: ${String(error)}`, 3200); });
-  };
-
   const onRemoveDebridLinkKey = async (key: DebridLinkAccountKeyEntry): Promise<void> => {
     const confirmed = await askConfirmPrompt({ title: "Key entfernen", message: `Soll der Debrid-Link-Key ${key.masked} wirklich entfernt werden?`, confirmLabel: "Entfernen", danger: true });
     if (!confirmed) return;
@@ -3253,7 +3289,7 @@ export function App(): ReactElement {
   const toggleAccountTableRow = (row: AccountTableRow): void => {
     setAccountContextMenu(null);
     if (row.toggleKind === "mega" && row.megaLogin) {
-      void onToggleMegaAccountEnabled(row.megaLogin, row.disabled);
+      void onToggleMegaAccountEnabled(row.entry.kind as "megadebrid-api" | "megadebrid-web", row.megaLogin, row.disabled);
     } else if (row.toggleKind === "dl" && row.dlKey) {
       void onToggleDebridLinkApiKeyEnabled(row.entry, row.dlKey);
     } else {
@@ -3273,7 +3309,9 @@ export function App(): ReactElement {
       );
       const nextDraft: AppSettings = {
         ...settingsDraft,
-        ...nextEnabledState
+        ...nextEnabledState,
+        megaDebridApiDisabledAccountIds: enabled ? [] : accountRows.filter((row) => row.entry.kind === "megadebrid-api" && row.accountId).map((row) => row.accountId as string),
+        megaDebridWebDisabledAccountIds: enabled ? [] : accountRows.filter((row) => row.entry.kind === "megadebrid-web" && row.accountId).map((row) => row.accountId as string)
       };
       await persistSpecificSettings(nextDraft);
       showToast(enabled ? "Accounts aktiviert" : "Accounts deaktiviert", 2200);
@@ -3310,7 +3348,7 @@ export function App(): ReactElement {
   const checkAccountTableRow = (row: AccountTableRow): void => {
     setAccountContextMenu(null);
     if (row.toggleKind === "mega" && row.megaLogin) {
-      const account = parseMegaDebridAccounts(settingsDraft.megaCredentials || "", settingsDraft.megaPassword || "")
+      const account = getMegaDebridAccountsForMode(settingsDraft, row.entry.kind === "megadebrid-web" ? "web" : "api")
         .find((entry) => entry.id === row.accountId);
       if (account) {
         void runMegaAccountCheck(account.login, account.password);
@@ -4032,12 +4070,6 @@ export function App(): ReactElement {
   const onPackageToggleCollapse = useCallback((packageId: string): void => {
     setCollapsedPackages((prev) => {
       const nextCollapsed = !(prev[packageId] ?? false);
-      if (nextCollapsed) {
-        manualCollapsedPkgsRef.current.add(packageId);
-      } else {
-        manualCollapsedPkgsRef.current.delete(packageId);
-        autoExpandedPkgsRef.current.delete(packageId);
-      }
       return { ...prev, [packageId]: nextCollapsed };
     });
   }, []);
@@ -5014,11 +5046,6 @@ export function App(): ReactElement {
         const next = { ...current };
         for (const entry of packages) {
           next[entry.id] = targetState;
-          if (targetState) manualCollapsedPkgsRef.current.add(entry.id);
-          else {
-            manualCollapsedPkgsRef.current.delete(entry.id);
-            autoExpandedPkgsRef.current.delete(entry.id);
-          }
         }
         return next;
       });
@@ -5480,26 +5507,7 @@ export function App(): ReactElement {
     multi: option.kind === "megadebrid-api" || option.kind === "megadebrid-web" || option.kind === "debridlink-api",
     icon: ACCOUNT_SERVICE_ICONS[option.service]
   }));
-  const accountAddFields: AccountDialogField[] = accountDialog && accountDialogOption ? [
-    ...((accountDialog.kind === "megadebrid-api" || accountDialog.kind === "megadebrid-web") ? [
-      { id: "megaNewLogin", label: "Login / E-Mail", type: "text" as const, value: accountDialog.megaNewLogin },
-      { id: "megaNewPassword", label: "Passwort", type: "password" as const, value: accountDialog.megaNewPassword }
-    ] : accountDialogOption.needsCredentials ? [
-      { id: "login", label: "Login / E-Mail", type: "text" as const, value: accountDialog.login },
-      { id: "password", label: "Passwort", type: "password" as const, value: accountDialog.password }
-    ] : []),
-    ...(accountDialogOption.needsToken ? [
-      { id: "token", label: accountDialog.kind === "debridlink-api" ? "API-Key" : "Token / API-Key", type: "password" as const, value: accountDialog.token }
-    ] : []),
-    {
-      id: "dailyLimitGb",
-      label: "Tageslimit (GB, optional)",
-      type: "number" as const,
-      value: accountDialog.dailyLimitGb,
-      placeholder: "Kein Limit",
-      help: "Der Zähler wird täglich um 00:00 Uhr zurückgesetzt."
-    }
-  ] : [];
+  const accountAddFields = buildAccountAddFields(accountDialog);
   const accountAddDialog = (
     <AccountAddDialog
       actions={{

src/renderer/account-edit.ts

@@ -1,5 +1,5 @@
 import { parseDebridLinkApiKeys, getDebridLinkApiKeyId } from "../shared/debrid-link-keys";
-import { getMegaDebridAccountId, parseMegaDebridAccounts, serializeMegaDebridAccounts } from "../shared/mega-debrid-accounts";
+import { getMegaDebridAccountId, getMegaDebridAccountsForMode, getMegaDebridCredentialsForMode, getMegaDebridDisabledAccountIdsForMode, mergeMegaDebridCredentialPools, parseMegaDebridAccounts, serializeMegaDebridAccounts, type MegaDebridAccountMode } from "../shared/mega-debrid-accounts";
 import type { AppSettings, DebridAccountStatus, DebridProvider } from "../shared/types";
 
 export type AccountService = "realdebrid" | "megadebrid-api" | "megadebrid-web" | "bestdebrid" | "alldebrid" | "ddownload" | "onefichier" | "debridlink" | "linksnappy";
@@ -54,6 +54,10 @@ export interface AccountEditState {
 
 const BYTES_PER_GIB = 1024 * 1024 * 1024;
 
+function getMegaTargetMode(target: Extract<AccountEditTarget, { type: "mega" }>): MegaDebridAccountMode {
+  return target.kind === "megadebrid-web" ? "web" : "api";
+}
+
 function formatDailyLimit(limitBytes: number): string {
   if (!Number.isFinite(limitBytes) || limitBytes <= 0) {
     return "";
@@ -146,7 +150,7 @@ export function createAccountEditState(target: AccountEditTarget, settings: AppS
     return createSingleEditState(target, settings);
   }
   if (target.type === "mega") {
-    const account = parseMegaDebridAccounts(settings.megaCredentials || "", settings.megaPassword || "")
+    const account = getMegaDebridAccountsForMode(settings, getMegaTargetMode(target))
       .find((entry) => entry.id === target.accountId);
     if (!account) {
       throw new Error("Der ausgewählte Mega-Debrid-Account wurde nicht gefunden.");
@@ -200,7 +204,7 @@ export function validateAccountEdit(state: AccountEditState, settings: AppSettin
     if (/[\r\n]/.test(state.password)) {
       return "Das Passwort darf keinen Zeilenumbruch enthalten.";
     }
-    const accounts = parseMegaDebridAccounts(settings.megaCredentials || "", settings.megaPassword || "");
+    const accounts = getMegaDebridAccountsForMode(settings, getMegaTargetMode(target));
     if (!accounts.some((entry) => entry.id === target.accountId)) {
       return "Der ausgewählte Mega-Debrid-Account wurde nicht gefunden.";
     }
@@ -265,7 +269,9 @@ function applySingleEdit(settings: AppSettings, state: AccountEditState & { targ
 }
 
 function applyMegaEdit(settings: AppSettings, state: AccountEditState & { target: Extract<AccountEditTarget, { type: "mega" }> }): AppSettings {
-  const accounts = parseMegaDebridAccounts(settings.megaCredentials || "", settings.megaPassword || "");
+  const mode = getMegaTargetMode(state.target);
+  const otherMode: MegaDebridAccountMode = mode === "api" ? "web" : "api";
+  const accounts = getMegaDebridAccountsForMode(settings, mode);
   const index = accounts.findIndex((entry) => entry.id === state.target.accountId);
   if (index < 0) {
     throw new Error("Der ausgewählte Mega-Debrid-Account wurde nicht gefunden.");
@@ -277,25 +283,41 @@ function applyMegaEdit(settings: AppSettings, state: AccountEditState & { target
     ? { login, password: state.password }
     : { login: entry.login, password: entry.password });
   const idChanged = oldId !== newId;
-  const first = nextAccounts[0] || { login: "", password: "" };
+  const selectedCredentials = serializeMegaDebridAccounts(nextAccounts);
+  const apiCredentials = mode === "api" ? selectedCredentials : getMegaDebridCredentialsForMode(settings, "api");
+  const webCredentials = mode === "web" ? selectedCredentials : getMegaDebridCredentialsForMode(settings, "web");
+  const mergedCredentials = mergeMegaDebridCredentialPools(apiCredentials, webCredentials);
+  const first = parseMegaDebridAccounts(mergedCredentials)[0];
+  const oldIdStillUsed = idChanged && getMegaDebridAccountsForMode(settings, otherMode).some((entry) => entry.id === oldId);
+  const selectedDisabledIds = idChanged
+    ? migrateDisabledId(getMegaDebridDisabledAccountIdsForMode(settings, mode), oldId, newId)
+    : getMegaDebridDisabledAccountIdsForMode(settings, mode);
+  const otherDisabledIds = getMegaDebridDisabledAccountIdsForMode(settings, otherMode);
+  const apiDisabledIds = mode === "api" ? selectedDisabledIds : otherDisabledIds;
+  const webDisabledIds = mode === "web" ? selectedDisabledIds : otherDisabledIds;
+  const nextDailyLimits = updateTargetLimit(settings.megaDebridAccountDailyLimitBytes || {}, oldId, newId, state.dailyLimitGb, state.originalDailyLimitBytes);
+  if (oldIdStillUsed && settings.megaDebridAccountDailyLimitBytes?.[oldId]) {
+    nextDailyLimits[oldId] = settings.megaDebridAccountDailyLimitBytes[oldId];
+  }
+  const retainOldMetadata = <T,>(record: Record<string, T>): Record<string, T> => idChanged
+    ? oldIdStillUsed ? withoutRecordKeys(record, newId) : withoutRecordKeys(record, oldId, newId)
+    : { ...record };
   return {
     ...settings,
-    megaCredentials: serializeMegaDebridAccounts(nextAccounts),
-    megaLogin: first.login,
-    megaPassword: first.password,
-    megaDebridDisabledAccountIds: idChanged
-      ? migrateDisabledId(settings.megaDebridDisabledAccountIds || [], oldId, newId)
-      : [...(settings.megaDebridDisabledAccountIds || [])],
-    megaDebridAccountDailyLimitBytes: updateTargetLimit(settings.megaDebridAccountDailyLimitBytes || {}, oldId, newId, state.dailyLimitGb, state.originalDailyLimitBytes),
-    megaDebridAccountDailyUsageBytes: idChanged
-      ? withoutRecordKeys(settings.megaDebridAccountDailyUsageBytes || {}, oldId, newId)
-      : { ...(settings.megaDebridAccountDailyUsageBytes || {}) },
-    megaDebridAccountTotalUsageBytes: idChanged
-      ? withoutRecordKeys(settings.megaDebridAccountTotalUsageBytes || {}, oldId, newId)
-      : { ...(settings.megaDebridAccountTotalUsageBytes || {}) },
-    debridAccountStatuses: idChanged
-      ? withoutRecordKeys(settings.debridAccountStatuses || {}, oldId, newId)
-      : { ...(settings.debridAccountStatuses || {}) }
+    megaCredentials: mergedCredentials,
+    megaLogin: first?.login || "",
+    megaPassword: first?.password || "",
+    megaDebridApiCredentials: apiCredentials,
+    megaDebridWebCredentials: webCredentials,
+    megaDebridApiEnabled: settings.megaDebridApiEnabled && parseMegaDebridAccounts(apiCredentials).length > 0,
+    megaDebridWebEnabled: settings.megaDebridWebEnabled && parseMegaDebridAccounts(webCredentials).length > 0,
+    megaDebridDisabledAccountIds: [...new Set([...apiDisabledIds, ...webDisabledIds])],
+    megaDebridApiDisabledAccountIds: apiDisabledIds,
+    megaDebridWebDisabledAccountIds: webDisabledIds,
+    megaDebridAccountDailyLimitBytes: nextDailyLimits,
+    megaDebridAccountDailyUsageBytes: retainOldMetadata(settings.megaDebridAccountDailyUsageBytes || {}),
+    megaDebridAccountTotalUsageBytes: retainOldMetadata(settings.megaDebridAccountTotalUsageBytes || {}),
+    debridAccountStatuses: retainOldMetadata(settings.debridAccountStatuses || {})
   };
 }
 
@@ -370,22 +392,35 @@ export function removeAccountTarget(settings: AppSettings, target: AccountEditTa
     return clearSingleAccount(settings, target);
   }
   if (target.type === "mega") {
-    const accounts = parseMegaDebridAccounts(settings.megaCredentials || "", settings.megaPassword || "")
+    const mode = getMegaTargetMode(target);
+    const selectedAccounts = getMegaDebridAccountsForMode(settings, mode)
       .filter((entry) => entry.id !== target.accountId)
       .map((entry) => ({ login: entry.login, password: entry.password }));
-    const first = accounts[0] || { login: "", password: "" };
+    const selectedCredentials = serializeMegaDebridAccounts(selectedAccounts);
+    const apiCredentials = mode === "api" ? selectedCredentials : getMegaDebridCredentialsForMode(settings, "api");
+    const webCredentials = mode === "web" ? selectedCredentials : getMegaDebridCredentialsForMode(settings, "web");
+    const mergedCredentials = mergeMegaDebridCredentialPools(apiCredentials, webCredentials);
+    const first = parseMegaDebridAccounts(mergedCredentials)[0];
+    const accountStillUsed = parseMegaDebridAccounts(mode === "api" ? webCredentials : apiCredentials).some((entry) => entry.id === target.accountId);
+    const apiDisabledIds = (mode === "api" ? getMegaDebridDisabledAccountIdsForMode(settings, "api").filter((id) => id !== target.accountId) : getMegaDebridDisabledAccountIdsForMode(settings, "api"));
+    const webDisabledIds = (mode === "web" ? getMegaDebridDisabledAccountIdsForMode(settings, "web").filter((id) => id !== target.accountId) : getMegaDebridDisabledAccountIdsForMode(settings, "web"));
+    const keepOrRemoveMetadata = <T,>(record: Record<string, T>): Record<string, T> => accountStillUsed ? { ...record } : withoutRecordKeys(record, target.accountId);
     return {
       ...settings,
-      megaCredentials: serializeMegaDebridAccounts(accounts),
-      megaLogin: first.login,
-      megaPassword: first.password,
-      megaDebridApiEnabled: accounts.length > 0 && settings.megaDebridApiEnabled,
-      megaDebridWebEnabled: accounts.length > 0 && settings.megaDebridWebEnabled,
-      megaDebridDisabledAccountIds: (settings.megaDebridDisabledAccountIds || []).filter((id) => id !== target.accountId),
-      megaDebridAccountDailyLimitBytes: withoutRecordKeys(settings.megaDebridAccountDailyLimitBytes || {}, target.accountId),
-      megaDebridAccountDailyUsageBytes: withoutRecordKeys(settings.megaDebridAccountDailyUsageBytes || {}, target.accountId),
-      megaDebridAccountTotalUsageBytes: withoutRecordKeys(settings.megaDebridAccountTotalUsageBytes || {}, target.accountId),
-      debridAccountStatuses: withoutRecordKeys(settings.debridAccountStatuses || {}, target.accountId)
+      megaCredentials: mergedCredentials,
+      megaLogin: first?.login || "",
+      megaPassword: first?.password || "",
+      megaDebridApiCredentials: apiCredentials,
+      megaDebridWebCredentials: webCredentials,
+      megaDebridApiEnabled: parseMegaDebridAccounts(apiCredentials).length > 0 && settings.megaDebridApiEnabled,
+      megaDebridWebEnabled: parseMegaDebridAccounts(webCredentials).length > 0 && settings.megaDebridWebEnabled,
+      megaDebridDisabledAccountIds: [...new Set([...apiDisabledIds, ...webDisabledIds])],
+      megaDebridApiDisabledAccountIds: apiDisabledIds,
+      megaDebridWebDisabledAccountIds: webDisabledIds,
+      megaDebridAccountDailyLimitBytes: keepOrRemoveMetadata(settings.megaDebridAccountDailyLimitBytes || {}),
+      megaDebridAccountDailyUsageBytes: keepOrRemoveMetadata(settings.megaDebridAccountDailyUsageBytes || {}),
+      megaDebridAccountTotalUsageBytes: keepOrRemoveMetadata(settings.megaDebridAccountTotalUsageBytes || {}),
+      debridAccountStatuses: keepOrRemoveMetadata(settings.debridAccountStatuses || {})
     };
   }
   const keys = parseDebridLinkApiKeys(settings.debridLinkApiKeys || "").filter((entry) => entry.id !== target.keyId);
@@ -403,11 +438,19 @@ export function removeAccountTarget(settings: AppSettings, target: AccountEditTa
 export function buildAccountEditCheckSettings(settings: AppSettings, state: AccountEditState): AppSettings {
   if (state.target.type === "mega") {
     const login = state.login.trim();
+    const credentials = serializeMegaDebridAccounts([{ login, password: state.password }]);
+    const mode = getMegaTargetMode(state.target);
     return {
       ...settings,
-      megaCredentials: serializeMegaDebridAccounts([{ login, password: state.password }]),
+      megaCredentials: credentials,
       megaLogin: login,
       megaPassword: state.password,
+      megaDebridApiCredentials: mode === "api" ? credentials : "",
+      megaDebridWebCredentials: mode === "web" ? credentials : "",
+      megaDebridApiEnabled: mode === "api",
+      megaDebridWebEnabled: mode === "web",
+      megaDebridApiDisabledAccountIds: [],
+      megaDebridWebDisabledAccountIds: [],
       debridLinkApiKeys: ""
     };
   }
@@ -417,6 +460,8 @@ export function buildAccountEditCheckSettings(settings: AppSettings, state: Acco
       megaCredentials: "",
       megaLogin: "",
       megaPassword: "",
+      megaDebridApiCredentials: "",
+      megaDebridWebCredentials: "",
       debridLinkApiKeys: state.token.trim()
     };
   }
@@ -425,6 +470,8 @@ export function buildAccountEditCheckSettings(settings: AppSettings, state: Acco
     megaCredentials: "",
     megaLogin: "",
     megaPassword: "",
+    megaDebridApiCredentials: "",
+    megaDebridWebCredentials: "",
     debridLinkApiKeys: ""
   };
 }

src/renderer/download-format.ts

@@ -1,4 +1,5 @@
 import type { AudioStripSummary, DebridProvider } from "../shared/types";
+import { extractHosterFromUrl } from "../shared/hoster";
 import { hosterIconSources } from "./hoster-icons";
 
 export const providerLabels: Record<DebridProvider, string> = {
@@ -48,13 +49,7 @@ export function formatDateTime(timestamp: number): string {
 }
 
 export function extractHoster(url: string): string {
-  try {
-    const host = new URL(url).hostname.replace(/^www\./, "");
-    const parts = host.split(".");
-    return parts.length >= 2 ? parts[parts.length - 2] : host;
-  } catch {
-    return "";
-  }
+  return extractHosterFromUrl(url);
 }
 
 export function formatHosterLabel(hoster: string): { compact: string; title: string; iconSrc?: string } {

src/renderer/package-order.ts

@@ -2,6 +2,13 @@ import type { DownloadItem, DownloadStatus, PackageEntry } from "../shared/types
 
 const ACTIVE_PACKAGE_STATUSES = new Set<DownloadStatus>(["downloading", "validating", "integrity_check", "extracting"]);
 
+function isPackageActive(pkg: PackageEntry, itemsById: Record<string, DownloadItem>): boolean {
+  return pkg.itemIds.some((id) => {
+    const item = itemsById[id];
+    return item != null && ACTIVE_PACKAGE_STATUSES.has(item.status);
+  });
+}
+
 export function reorderPackageOrderByDrop(order: string[], draggedPackageId: string, targetPackageId: string): string[] {
   const fromIndex = order.indexOf(draggedPackageId);
   const toIndex = order.indexOf(targetPackageId);
@@ -36,24 +43,24 @@ export function sortPackagesForDisplay(
     return packages;
   }
 
-  const active: PackageEntry[] = [];
-  const rest: PackageEntry[] = [];
-
-  // Float packages that have an active item to the top, but keep BOTH groups in
-  // their original (queue) order. Earlier this sorted the active group by live
-  // completedRatio/downloadedBytes — which change on every progress tick (every
-  // 150-700ms), so active packages visibly reshuffled the whole time. A package
-  // entering/leaving the active bucket is a real, discrete event (start/finish);
-  // ranking *within* the bucket by live bytes was pure jitter nobody needs.
-  for (const pkg of packages) {
-    const hasActive = pkg.itemIds.some((id) => {
-      const item = itemsById[id];
-      return item != null && ACTIVE_PACKAGE_STATUSES.has(item.status);
-    });
-    (hasActive ? active : rest).push(pkg);
+  const active = packages
+    .map((pkg, index) => ({ pkg, index }))
+    .filter(({ pkg }) => isPackageActive(pkg, itemsById))
+    .sort((left, right) => {
+      const leftStartedAt = left.pkg.downloadStartedAt || 0;
+      const rightStartedAt = right.pkg.downloadStartedAt || 0;
+      if (leftStartedAt > 0 && rightStartedAt > 0 && leftStartedAt !== rightStartedAt) {
+        return leftStartedAt - rightStartedAt;
       }
+      if (leftStartedAt > 0 && rightStartedAt <= 0) return -1;
+      if (leftStartedAt <= 0 && rightStartedAt > 0) return 1;
+      return left.index - right.index;
+    })
+    .map(({ pkg }) => pkg);
+  const activeSet = new Set(active.map((pkg) => pkg.id));
+  const rest = packages.filter((pkg) => !activeSet.has(pkg.id));
 
-  if (active.length === 0 || active.length === packages.length) {
+  if (active.length === 0) {
     return packages;
   }
 

src/renderer/shell/shell.css

@@ -164,8 +164,8 @@
   justify-content: center;
   border: 0;
   border-radius: 6px;
-  background: var(--ui-primary);
-  color: var(--ui-primary-text);
+  background: var(--ui-update);
+  color: var(--ui-update-text);
   cursor: pointer;
   font-size: 14px;
   font-weight: 600;
@@ -174,7 +174,7 @@
 }
 
 .md-update-trigger:hover {
-  background: var(--ui-primary-hover);
+  background: var(--ui-update-hover);
 }
 
 .md-update-trigger:focus-visible,
@@ -310,9 +310,14 @@
 
 .md-update-release-notes pre {
   margin: 10px 0 0;
+  max-height: min(360px, 45vh);
+  overflow-y: auto;
+  padding-right: 8px;
   color: var(--ui-text-secondary);
   font: inherit;
   line-height: 20px;
+  overscroll-behavior: contain;
+  scrollbar-gutter: stable;
   white-space: pre-wrap;
 }
 

src/renderer/theme.css

@@ -15,6 +15,9 @@
   --ui-primary: #D6D6D6;
   --ui-primary-hover: #E6E6E6;
   --ui-primary-text: #181A1F;
+  --ui-update: #BAD0FC;
+  --ui-update-hover: #8AA5DC;
+  --ui-update-text: #181A1F;
   --ui-accent: #4A4A4A;
   --ui-focus: #9AB8E8;
   --ui-speed-accent: #4ADE80;
@@ -48,6 +51,9 @@
   --ui-primary: #3A3A3A;
   --ui-primary-hover: #202020;
   --ui-primary-text: #FFFFFF;
+  --ui-update: #BAD0FC;
+  --ui-update-hover: #8AA5DC;
+  --ui-update-text: #181A1F;
   --ui-accent: #5E5E5E;
   --ui-focus: #24558D;
   --ui-speed-accent: #1E9E55;

src/renderer/views/downloads/DownloadsTable.tsx

@@ -139,6 +139,10 @@ export function compactDownloadStatus(value: string): string {
   if (/Download running\b/i.test(status)) return "Download running";
   if (/^Passwort gefunden\b/i.test(status)) return "Passwort gefunden";
   if (/^Password found\b/i.test(status)) return "Password found";
+  const passwordCracking = status.match(/^(Passwort knacken|Cracking password):?\s*(\d+)%\s*(?:\((\d+\/\d+)\))?/i);
+  if (passwordCracking) {
+    return `${passwordCracking[1]}: ${passwordCracking[2]}%${passwordCracking[3] ? ` (${passwordCracking[3]})` : ""}`;
+  }
   if (/^Entpack-Fehler\b/i.test(status)) return "Entpack-Fehler";
   if (/^Extraction error\b/i.test(status)) return "Extraction error";
   const extractionPending = status.match(/^(Entpacken|Extracting)\s*-\s*(Ausstehend|Pending|Warten auf Parts|Waiting for parts)/i);

src/renderer/views/downloads/downloads.css

@@ -420,8 +420,8 @@
 }
 
 .downloads-cell-slot > :is(.downloads-status-cell, .downloads-service-cell) {
-  justify-content: flex-start;
-  text-align: left;
+  justify-content: center;
+  text-align: center;
 }
 
 .downloads-cell,

src/shared/hoster.ts

@@ -0,0 +1,24 @@
+const DOMAIN_ALIASES: Readonly<Record<string, string>> = Object.freeze({
+  "rapidgator.net": "rapidgator",
+  "rapidgator.asia": "rapidgator",
+  "rg.to": "rapidgator"
+});
+
+export function normalizeHosterHostname(hostname: string): string {
+  const normalized = hostname.trim().toLowerCase().replace(/^www\./, "").replace(/\.$/, "");
+  for (const [domain, hoster] of Object.entries(DOMAIN_ALIASES)) {
+    if (normalized === domain || normalized.endsWith(`.${domain}`)) {
+      return hoster;
+    }
+  }
+  const parts = normalized.split(".").filter(Boolean);
+  return parts.length >= 2 ? parts[parts.length - 2] : normalized;
+}
+
+export function extractHosterFromUrl(url: string): string {
+  try {
+    return normalizeHosterHostname(new URL(url).hostname);
+  } catch {
+    return "";
+  }
+}

src/shared/mega-debrid-accounts.ts

@@ -7,6 +7,21 @@ export interface MegaDebridAccountEntry {
   maskedLogin: string;
 }
 
+export type MegaDebridAccountMode = "api" | "web";
+
+type MegaDebridModeSettings = {
+  megaCredentials?: string;
+  megaPassword?: string;
+  megaDebridApiCredentials?: string;
+  megaDebridWebCredentials?: string;
+  megaDebridApiEnabled?: boolean;
+  megaDebridWebEnabled?: boolean;
+  megaDebridPreferApi?: boolean;
+  megaDebridDisabledAccountIds?: string[];
+  megaDebridApiDisabledAccountIds?: string[];
+  megaDebridWebDisabledAccountIds?: string[];
+};
+
 const FNV64_OFFSET_BASIS = 0xcbf29ce484222325n;
 const FNV64_PRIME = 0x100000001b3n;
 const FNV64_MASK = 0xffffffffffffffffn;
@@ -88,3 +103,49 @@ export function serializeMegaDebridAccounts(accounts: { login: string; password:
 export function getMegaDebridAccountIds(raw: string, legacyPassword = ""): string[] {
   return parseMegaDebridAccounts(raw, legacyPassword).map((entry) => entry.id);
 }
+
+export function getMegaDebridCredentialsForMode(settings: MegaDebridModeSettings, mode: MegaDebridAccountMode): string {
+  const dedicated = mode === "api" ? settings.megaDebridApiCredentials : settings.megaDebridWebCredentials;
+  const otherDedicated = mode === "api" ? settings.megaDebridWebCredentials : settings.megaDebridApiCredentials;
+  if (String(dedicated || "").trim() || String(otherDedicated || "").trim()) {
+    return String(dedicated || "").trim();
+  }
+  const legacy = String(settings.megaCredentials || "").trim();
+  if (!legacy) {
+    return "";
+  }
+  const apiEnabled = Boolean(settings.megaDebridApiEnabled);
+  const webEnabled = Boolean(settings.megaDebridWebEnabled);
+  const preferredMode: MegaDebridAccountMode = settings.megaDebridPreferApi === false ? "web" : "api";
+  if (apiEnabled !== webEnabled) {
+    return mode === (apiEnabled ? "api" : "web") ? legacy : "";
+  }
+  return mode === preferredMode ? legacy : "";
+}
+
+export function getMegaDebridAccountsForMode(settings: MegaDebridModeSettings, mode: MegaDebridAccountMode): MegaDebridAccountEntry[] {
+  return parseMegaDebridAccounts(getMegaDebridCredentialsForMode(settings, mode), settings.megaPassword || "");
+}
+
+export function getMegaDebridDisabledAccountIdsForMode(settings: MegaDebridModeSettings, mode: MegaDebridAccountMode): string[] {
+  const dedicated = mode === "api" ? settings.megaDebridApiDisabledAccountIds : settings.megaDebridWebDisabledAccountIds;
+  const hasDedicatedCredentials = Boolean(
+    String(settings.megaDebridApiCredentials || "").trim()
+    || String(settings.megaDebridWebCredentials || "").trim()
+  );
+  if ((hasDedicatedCredentials || !getMegaDebridCredentialsForMode(settings, mode)) && Array.isArray(dedicated)) {
+    return [...dedicated];
+  }
+  return Array.isArray(settings.megaDebridDisabledAccountIds) ? [...settings.megaDebridDisabledAccountIds] : [];
+}
+
+export function mergeMegaDebridCredentialPools(apiCredentials: string, webCredentials: string): string {
+  const merged = new Map<string, { login: string; password: string }>();
+  for (const entry of [...parseMegaDebridAccounts(apiCredentials), ...parseMegaDebridAccounts(webCredentials)]) {
+    const key = entry.login.trim().toLowerCase();
+    if (!merged.has(key)) {
+      merged.set(key, { login: entry.login, password: entry.password });
+    }
+  }
+  return serializeMegaDebridAccounts([...merged.values()]);
+}

src/shared/provider-daily-limits.ts

@@ -1,4 +1,5 @@
 import type { AppSettings, DebridProvider } from "./types";
+import { getMegaDebridDisabledAccountIdsForMode, type MegaDebridAccountMode } from "./mega-debrid-accounts";
 
 export type ProviderByteMap = Partial<Record<DebridProvider, number>>;
 export type DebridLinkKeyByteMap = Record<string, number>;
@@ -6,7 +7,7 @@ export type DebridLinkKeyByteMap = Record<string, number>;
 type ProviderDailySettings =
   Pick<AppSettings, "providerDailyLimitBytes" | "providerDailyUsageBytes" | "providerDailyUsageDay">
   & Partial<Pick<AppSettings, "debridLinkApiKeyDailyLimitBytes" | "debridLinkApiKeyDailyUsageBytes">>
-  & Partial<Pick<AppSettings, "megaDebridDisabledAccountIds" | "megaDebridAccountDailyLimitBytes" | "megaDebridAccountDailyUsageBytes">>;
+  & Partial<Pick<AppSettings, "megaDebridDisabledAccountIds" | "megaDebridApiDisabledAccountIds" | "megaDebridWebDisabledAccountIds" | "megaDebridAccountDailyLimitBytes" | "megaDebridAccountDailyUsageBytes">>;
 
 type ProviderUsageSettings =
   ProviderDailySettings
@@ -250,7 +251,10 @@ export function addDebridLinkApiKeyTotalUsageBytes(
   };
 }
 
-export function isMegaDebridAccountDisabled(settings: ProviderDailySettings, accountId: string): boolean {
+export function isMegaDebridAccountDisabled(settings: ProviderDailySettings, accountId: string, mode?: MegaDebridAccountMode): boolean {
+  if (mode) {
+    return getMegaDebridDisabledAccountIdsForMode(settings, mode).includes(accountId);
+  }
   return Array.isArray(settings.megaDebridDisabledAccountIds) && settings.megaDebridDisabledAccountIds.includes(accountId);
 }
 

src/shared/types.ts

@@ -74,6 +74,8 @@ export interface AppSettings {
   megaLogin: string;
   megaPassword: string;
   megaCredentials: string;
+  megaDebridApiCredentials: string;
+  megaDebridWebCredentials: string;
   megaDebridApiEnabled: boolean;
   megaDebridWebEnabled: boolean;
   megaDebridPreferApi: boolean;
@@ -159,6 +161,8 @@ export interface AppSettings {
   debridLinkApiKeyDailyUsageBytes: Record<string, number>;
   debridLinkApiKeyTotalUsageBytes: Record<string, number>;
   megaDebridDisabledAccountIds: string[];
+  megaDebridApiDisabledAccountIds: string[];
+  megaDebridWebDisabledAccountIds: string[];
   megaDebridAccountDailyLimitBytes: Record<string, number>;
   megaDebridAccountDailyUsageBytes: Record<string, number>;
   megaDebridAccountTotalUsageBytes: Record<string, number>;

tests/account-dialog-prefer-api.test.ts

@@ -1,6 +1,8 @@
 import { describe, expect, it } from "vitest";
-import { applyAccountDialogToSettings, AccountDialogState } from "../src/renderer/App";
+import { applyAccountDialogToSettings, createAccountDialogState, AccountDialogState } from "../src/renderer/App";
 import { defaultSettings } from "../src/main/constants";
+import { getMegaDebridAccountId } from "../src/shared/mega-debrid-accounts";
+import { isMegaDebridAccountDisabled } from "../src/shared/provider-daily-limits";
 
 function megaDialog(kind: "megadebrid-api" | "megadebrid-web"): AccountDialogState {
   return {
@@ -33,4 +35,47 @@ describe("applyAccountDialogToSettings — keeps the user's Mega preferApi choic
     expect(next.megaDebridWebEnabled).toBe(true);
     expect(next.megaDebridPreferApi).toBe(true);
   });
+
+  it("adds a Web account without copying it into the API account pool", () => {
+    const settings = {
+      ...defaultSettings(),
+      megaCredentials: "api@example.test:api-pass",
+      megaDebridApiCredentials: "api@example.test:api-pass",
+      megaDebridWebCredentials: "",
+      megaDebridApiEnabled: true,
+      megaDebridWebEnabled: false
+    };
+    const dialog = createAccountDialogState("create", "megadebrid-web", settings);
+
+    expect(dialog.megaAccounts).toEqual([]);
+
+    const next = applyAccountDialogToSettings(settings, {
+      ...dialog,
+      megaAccounts: [{ login: "web@example.test", password: "web-pass" }]
+    });
+
+    expect(next.megaDebridApiCredentials).toBe("api@example.test:api-pass");
+    expect(next.megaDebridWebCredentials).toBe("web@example.test:web-pass");
+    expect(next.megaDebridApiEnabled).toBe(true);
+    expect(next.megaDebridWebEnabled).toBe(true);
+  });
+
+  it("disables an API account without disabling the matching Web account", () => {
+    const accountId = getMegaDebridAccountId("shared@example.test");
+    const settings = {
+      ...defaultSettings(),
+      megaCredentials: "shared@example.test:api-pass",
+      megaDebridApiCredentials: "shared@example.test:api-pass",
+      megaDebridWebCredentials: "shared@example.test:web-pass",
+      megaDebridApiEnabled: true,
+      megaDebridWebEnabled: true
+    };
+    const next = applyAccountDialogToSettings(settings, {
+      ...createAccountDialogState("edit", "megadebrid-api", settings),
+      megaDisabledIds: [accountId]
+    });
+
+    expect(isMegaDebridAccountDisabled(next, accountId, "api")).toBe(true);
+    expect(isMegaDebridAccountDisabled(next, accountId, "web")).toBe(false);
+  });
 });

tests/account-edit.test.ts

@@ -39,15 +39,20 @@ describe("account-specific editing", () => {
     const oldId = getMegaDebridAccountId("second@example.com");
     const newId = getMegaDebridAccountId("renamed@example.com");
     const firstId = getMegaDebridAccountId("first@example.com");
+    const webId = getMegaDebridAccountId("web@example.com");
     const settings = {
       ...defaultSettings(),
-      megaCredentials: "first@example.com:first-pass\nsecond@example.com:second-pass\nthird@example.com:third-pass",
+      megaCredentials: "first@example.com:first-pass\nsecond@example.com:second-pass\nthird@example.com:third-pass\nweb@example.com:web-pass",
+      megaDebridApiCredentials: "first@example.com:first-pass\nsecond@example.com:second-pass\nthird@example.com:third-pass",
+      megaDebridWebCredentials: "web@example.com:web-pass",
       megaLogin: "first@example.com",
       megaPassword: "first-pass",
       megaDebridApiEnabled: true,
       megaDebridWebEnabled: true,
       megaDebridPreferApi: false,
-      megaDebridDisabledAccountIds: [oldId, firstId],
+      megaDebridDisabledAccountIds: [oldId, firstId, webId],
+      megaDebridApiDisabledAccountIds: [oldId, firstId],
+      megaDebridWebDisabledAccountIds: [webId],
       megaDebridAccountDailyLimitBytes: { [oldId]: 15 * GIB, [firstId]: 9 * GIB },
       megaDebridAccountDailyUsageBytes: { [oldId]: 4 * GIB, [firstId]: 2 * GIB },
       megaDebridAccountTotalUsageBytes: { [oldId]: 40 * GIB, [firstId]: 20 * GIB },
@@ -66,13 +71,15 @@ describe("account-specific editing", () => {
     expect(validateAccountEdit(state, settings)).toBeNull();
     const next = applyAccountEdit(settings, state);
 
-    expect(next.megaCredentials).toBe("first@example.com:first-pass\nrenamed@example.com:new-pass\nthird@example.com:third-pass");
+    expect(next.megaCredentials).toBe("first@example.com:first-pass\nrenamed@example.com:new-pass\nthird@example.com:third-pass\nweb@example.com:web-pass");
+    expect(next.megaDebridApiCredentials).toBe("first@example.com:first-pass\nrenamed@example.com:new-pass\nthird@example.com:third-pass");
+    expect(next.megaDebridWebCredentials).toBe("web@example.com:web-pass");
     expect(next.megaLogin).toBe("first@example.com");
     expect(next.megaPassword).toBe("first-pass");
     expect(next.megaDebridApiEnabled).toBe(true);
     expect(next.megaDebridWebEnabled).toBe(true);
     expect(next.megaDebridPreferApi).toBe(false);
-    expect(next.megaDebridDisabledAccountIds).toEqual([firstId, newId]);
+    expect(next.megaDebridDisabledAccountIds).toEqual([firstId, newId, webId]);
     expect(next.megaDebridAccountDailyLimitBytes).toEqual({ [firstId]: 9 * GIB, [newId]: Math.floor(25.5 * GIB) });
     expect(next.megaDebridAccountDailyUsageBytes).toEqual({ [firstId]: 2 * GIB });
     expect(next.megaDebridAccountTotalUsageBytes).toEqual({ [firstId]: 20 * GIB });

tests/debrid.test.ts

@@ -1630,6 +1630,8 @@ describe("debrid service", () => {
       megaLogin: "user",
       megaPassword: "pass",
       megaCredentials: "user:pass",
+      megaDebridApiCredentials: "user:pass",
+      megaDebridWebCredentials: "user:pass",
       megaDebridApiEnabled: true,
       megaDebridWebEnabled: true,
       providerOrder: [] as const,

tests/debug-server.test.ts

@@ -430,7 +430,7 @@ describe("debug-server", () => {
     const fixture = await createFixture();
     const response = await fetch(`${fixture.baseUrl}/health?token=${fixture.token}`, {
       headers: {
-        "X-Forwarded-For": "159.195.63.46"
+        "X-Forwarded-For": "203.0.113.46"
       }
     });
     expect(response.ok).toBe(true);
@@ -439,7 +439,7 @@ describe("debug-server", () => {
     const traceLogPath = getTraceLogPath();
     expect(traceLogPath).toBeTruthy();
     const traceText = fs.readFileSync(traceLogPath!, "utf8");
-    expect(traceText).toContain("clientIp=159.195.63.46");
+    expect(traceText).toContain("clientIp=203.0.113.46");
   });
 
   it("serves package details and package log by package query", async () => {

tests/download-manager.test.ts

@@ -252,6 +252,187 @@ describe("download manager", () => {
     expect(failures.has("realdebrid")).toBe(true);
   });
 
+  it("invalidates only the Mega-Debrid Web session when Web credentials change", () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "rd-mega-web-session-refresh-"));
+    tempDirs.push(root);
+    const settings = {
+      ...defaultSettings(),
+      megaCredentials: "api-user:api-pass\nweb-user:web-pass",
+      megaDebridApiCredentials: "api-user:api-pass",
+      megaDebridWebCredentials: "web-user:web-pass",
+      megaDebridApiEnabled: true,
+      megaDebridWebEnabled: true
+    };
+    const invalidateMegaSession = vi.fn();
+    const manager = new DownloadManager(settings, emptySession(), createStoragePaths(path.join(root, "state")), { invalidateMegaSession });
+
+    manager.setSettings({ ...settings, megaDebridApiCredentials: "api-user:new-api-pass" });
+    expect(invalidateMegaSession).not.toHaveBeenCalled();
+
+    manager.setSettings({ ...settings, megaDebridApiCredentials: "api-user:new-api-pass", megaDebridWebCredentials: "web-user:new-web-pass" });
+    expect(invalidateMegaSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("releases only Mega-Debrid reset parks when a newly usable account appears", () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "rd-mega-account-refresh-"));
+    tempDirs.push(root);
+    const storagePaths = createStoragePaths(path.join(root, "state"));
+    const previousSettings = {
+      ...defaultSettings(),
+      megaCredentials: "old@example.test:old-secret",
+      megaDebridApiEnabled: true
+    };
+    const session = emptySession();
+    const megaPackageId = "mega-refresh-package";
+    const otherPackageId = "other-refresh-package";
+    const megaItemId = "mega-refresh-item";
+    const otherItemId = "other-refresh-item";
+    const createdAt = Date.now();
+    session.packageOrder = [megaPackageId, otherPackageId];
+    session.packages[megaPackageId] = {
+      id: megaPackageId,
+      name: "Mega refresh",
+      status: "downloading",
+      itemIds: [megaItemId],
+      cancelled: false,
+      enabled: true,
+      createdAt,
+      updatedAt: createdAt
+    } as any;
+    session.packages[otherPackageId] = {
+      id: otherPackageId,
+      name: "Other refresh",
+      status: "queued",
+      itemIds: [otherItemId],
+      cancelled: false,
+      enabled: true,
+      createdAt,
+      updatedAt: createdAt
+    } as any;
+    session.items[megaItemId] = {
+      id: megaItemId,
+      packageId: megaPackageId,
+      url: "https://rapidgator.net/file/mega-refresh",
+      provider: "megadebrid-api",
+      status: "queued",
+      retries: 1,
+      speedBps: 0,
+      downloadedBytes: 0,
+      totalBytes: null,
+      progressPercent: 0,
+      fileName: "mega-refresh.rar",
+      targetPath: "",
+      resumable: true,
+      attempts: 0,
+      lastError: "limit",
+      fullStatus: "Mega-Debrid bis Tagesreset gesperrt, Pause 3600s",
+      createdAt,
+      updatedAt: createdAt
+    } as any;
+    session.items[otherItemId] = {
+      ...session.items[megaItemId],
+      id: otherItemId,
+      packageId: otherPackageId,
+      url: "https://ddownload.com/file/other-refresh",
+      provider: "realdebrid",
+      fileName: "other-refresh.rar",
+      fullStatus: "Netzwerk-Retry in 60s"
+    } as any;
+    session.running = true;
+    const manager = new DownloadManager(previousSettings, session, storagePaths);
+    session.running = true;
+    session.packages[megaPackageId].status = "downloading";
+    session.items[megaItemId].status = "queued";
+    session.items[megaItemId].fullStatus = "Mega-Debrid bis Tagesreset gesperrt, Pause 3600s";
+    session.items[megaItemId].provider = "megadebrid-api";
+    session.items[otherItemId].status = "queued";
+    session.items[otherItemId].fullStatus = "Netzwerk-Retry in 60s";
+    session.items[otherItemId].provider = "realdebrid";
+    const retryAfter = (manager as any).retryAfterByItem as Map<string, number>;
+    const retryState = (manager as any).retryStateByItem as Map<string, unknown>;
+    retryAfter.set(megaItemId, Date.now() + 3_600_000);
+    retryAfter.set(otherItemId, Date.now() + 60_000);
+    retryState.set(megaItemId, { unrestrictRetries: 1 });
+    retryState.set(otherItemId, { genericErrorRetries: 1 });
+    const scheduler = vi.spyOn(manager as any, "ensureScheduler").mockResolvedValue(undefined);
+    vi.spyOn(manager as any, "cleanupExistingExtractedArchives").mockResolvedValue(0);
+
+    manager.setSettings({
+      ...previousSettings,
+      megaCredentials: "old@example.test:old-secret\nnew@example.test:new-secret",
+      megaDebridDisabledAccountIds: [getMegaDebridAccountId("old@example.test")]
+    });
+
+    expect(retryAfter.has(megaItemId)).toBe(false);
+    expect(retryState.has(megaItemId)).toBe(false);
+    expect(session.items[megaItemId].fullStatus).toBe("Wartet");
+    expect(session.packages[megaPackageId].status).toBe("queued");
+    expect(retryAfter.has(otherItemId)).toBe(true);
+    expect(retryState.has(otherItemId)).toBe(true);
+    expect(session.items[otherItemId].fullStatus).toBe("Netzwerk-Retry in 60s");
+    expect(scheduler).toHaveBeenCalledTimes(1);
+  });
+
+  it("updates the package status atomically when an active item is queued for retry", () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "rd-retry-package-status-"));
+    tempDirs.push(root);
+    const storagePaths = createStoragePaths(path.join(root, "state"));
+    initPackageLogs(storagePaths.baseDir);
+    initItemLogs(storagePaths.baseDir);
+    const session = emptySession();
+    const packageId = "retry-status-package";
+    const itemId = "retry-status-item";
+    const createdAt = Date.now();
+    session.packageOrder = [packageId];
+    session.packages[packageId] = {
+      id: packageId,
+      name: "Retry status",
+      status: "downloading",
+      itemIds: [itemId],
+      cancelled: false,
+      enabled: true,
+      createdAt,
+      updatedAt: createdAt
+    } as any;
+    session.items[itemId] = {
+      id: itemId,
+      packageId,
+      url: "https://rapidgator.net/file/retry-status",
+      provider: "megadebrid-api",
+      status: "downloading",
+      retries: 1,
+      speedBps: 0,
+      downloadedBytes: 0,
+      totalBytes: null,
+      progressPercent: 0,
+      fileName: "retry-status.rar",
+      targetPath: "",
+      resumable: true,
+      attempts: 1,
+      lastError: "",
+      fullStatus: "Download läuft",
+      createdAt,
+      updatedAt: createdAt
+    } as any;
+    const manager = new DownloadManager(defaultSettings(), session, storagePaths);
+    session.packages[packageId].status = "downloading";
+    const active = {
+      itemId,
+      packageId,
+      abortController: new AbortController(),
+      abortReason: "none",
+      resumable: true,
+      nonResumableCounted: false,
+      blockedOnDiskWrite: false,
+      blockedOnDiskSince: 0
+    };
+
+    (manager as any).queueRetry(session.items[itemId], active, 60_000, "Mega-Debrid bis Tagesreset gesperrt, Pause 60s");
+
+    expect(session.items[itemId].status).toBe("queued");
+    expect(session.packages[packageId].status).toBe("queued");
+  });
+
   it("records history duration from the first actual package start", () => {
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "rd-history-"));
     tempDirs.push(root);

tests/downloads-view.test.tsx

@@ -36,7 +36,12 @@ import {
   getPackageProgress,
   getPackageSizeProgress
 } from "../src/renderer/views/downloads/DownloadsTable";
-import { compactDownloadServiceLabel, normalizeDownloadServiceLabel } from "../src/renderer/download-format";
+import {
+  compactDownloadServiceLabel,
+  extractHoster,
+  formatHosterLabel,
+  normalizeDownloadServiceLabel
+} from "../src/renderer/download-format";
 import { getRollingMetricDirection } from "../src/renderer/ui/RollingMetricValue";
 
 const now = new Date(2026, 7, 10, 12, 0, 0, 0).getTime();
@@ -71,6 +76,13 @@ describe("Downloadtabellen-Spalten", () => {
     expect(css).not.toMatch(/\.downloads-table\.is-column-drag-active \[data-column-dragging="true"\]\s*\{[^}]*background:/s);
     expect(css).toMatch(/@media \(prefers-reduced-motion: reduce\)[\s\S]*\.downloads-table\.is-column-drag-active \[data-download-column\][^{]*\{[^}]*transition-duration:\s*220ms !important;/s);
   });
+
+  it("changes package collapse state only through user actions", () => {
+    const source = fs.readFileSync(path.join(process.cwd(), "src/renderer/App.tsx"), "utf8");
+
+    expect(source).not.toContain("autoExpandedPkgsRef");
+    expect(source).not.toMatch(/isExtracting[\s\S]{0,800}setCollapsedPackages/);
+  });
 });
 
 describe("rollende Downloadkennzahlen", () => {
@@ -175,12 +187,26 @@ describe("responsive Downloadstatus und Servicebezeichnungen", () => {
     expect(compactDownloadStatus("Entpacken 1% (1/1) · Tonspur: Deutsch")).toBe("Entpacken - 1%");
     expect(compactDownloadStatus("0/11 · Entpacken 53% (1/1) · scn2-httpv7-S01E102.rar")).toBe("Entpacken - 53%");
     expect(compactDownloadStatus("Extracting 53% (1/1) · archive.rar")).toBe("Extracting - 53%");
+    expect(compactDownloadStatus("Passwort knacken: 75% (3/4) · sau-geheim.part1.rar")).toBe("Passwort knacken: 75% (3/4)");
     expect(compactDownloadStatus("Passwort gefunden · archive.part1.rar")).toBe("Passwort gefunden");
     expect(compactDownloadStatus("Entpacken - Ausstehend · archive.part1.rar")).toBe("Entpacken - Ausstehend");
     expect(compactDownloadStatus("Entpack-Fehler [archive.part1.rar]: Unerwartetes Dateiende")).toBe("Entpack-Fehler");
     expect(compactDownloadStatus("Extraction error [archive.part1.rar]: Unexpected end of file")).toBe("Extraction error");
   });
 
+  it("normalizes every supported RapidGator domain to one hoster identity", () => {
+    const hosters = [
+      extractHoster("https://rapidgator.net/file/one"),
+      extractHoster("https://rg.to/file/two"),
+      extractHoster("https://cdn.rg.to/file/three"),
+      extractHoster("https://rapidgator.asia/file/four")
+    ];
+
+    expect(hosters).toEqual(["rapidgator", "rapidgator", "rapidgator", "rapidgator"]);
+    expect(new Set(hosters).size).toBe(1);
+    expect(formatHosterLabel(hosters[1])).toEqual(expect.objectContaining({ compact: "RG", title: "RapidGator", iconSrc: expect.any(String) }));
+  });
+
   it("removes duplicated access-mode wording from service labels", () => {
     expect(normalizeDownloadServiceLabel("Mega-Debrid Web (Web Account)")).toBe("Mega-Debrid (Web)");
     expect(normalizeDownloadServiceLabel("Mega-Debrid API (API Account)")).toBe("Mega-Debrid (API)");
@@ -690,7 +716,7 @@ describe("downloads view", () => {
     expect(css).toMatch(/\.downloads-link-state\.online\s*\{[^}]*background:\s*var\(--ui-success\);/s);
     expect(css).toMatch(/\.downloads-status-cell\s*\{[^}]*container-type:\s*inline-size;/s);
     expect(css).toMatch(/\.downloads-service-cell\s*\{[^}]*container-type:\s*inline-size;/s);
-    expect(css).toMatch(/\.downloads-cell-slot\s*>\s*:is\(\.downloads-status-cell, \.downloads-service-cell\)\s*\{[^}]*justify-content:\s*flex-start;[^}]*text-align:\s*left;/s);
+    expect(css).toMatch(/\.downloads-cell-slot\s*>\s*:is\(\.downloads-status-cell, \.downloads-service-cell\)\s*\{[^}]*justify-content:\s*center;[^}]*text-align:\s*center;/s);
     expect(css).toMatch(/:is\(\.downloads-status-full, \.downloads-status-compact, \.downloads-service-full, \.downloads-service-compact\)\s*\{[^}]*min-width:\s*0;[^}]*overflow:\s*hidden;[^}]*text-overflow:\s*ellipsis;[^}]*white-space:\s*nowrap;/s);
     expect(css).toMatch(/@container\s*\(max-width:\s*150px\)[\s\S]*\.downloads-status-full[^{]*\{[^}]*display:\s*none;[\s\S]*\.downloads-status-compact[^{]*\{[^}]*display:\s*block;/s);
     expect(css).toMatch(/@container\s*\(max-width:\s*150px\)[\s\S]*\.downloads-service-full[^{]*\{[^}]*display:\s*none;[\s\S]*\.downloads-service-compact[^{]*\{[^}]*display:\s*block;/s);

tests/mega-web-fallback.test.ts

@@ -16,6 +16,88 @@ describe("mega-web-fallback", () => {
       expect(result).toBeNull();
     });
 
+    it("does not restore an invalidated session when an older login finishes later", async () => {
+      let finishLogin: (cookie: string) => void = () => {};
+      const loginResult = new Promise<string>((resolve) => {
+        finishLogin = resolve;
+      });
+      const fallback = new MegaWebFallback(() => ({ login: "old-user", password: "old-pass" }));
+      const internals = fallback as unknown as {
+        ensureSession: (key: string, login: string, password: string) => Promise<string>;
+        login: (login: string, password: string) => Promise<string>;
+        sessions: Map<string, { cookie: string; setAt: number }>;
+      };
+      vi.spyOn(internals, "login").mockReturnValue(loginResult);
+
+      const pending = internals.ensureSession("old-user", "old-user", "old-pass");
+      await Promise.resolve();
+      fallback.invalidateSession();
+      finishLogin("stale-old-cookie");
+
+      await expect(pending).resolves.toBe("stale-old-cookie");
+      expect(internals.sessions.size).toBe(0);
+    });
+
+    it("does not cache an old session when an invalidated request retries login", async () => {
+      const fallback = new MegaWebFallback(() => ({ login: "old-user", password: "old-pass" }));
+      const internals = fallback as unknown as {
+        login: (login: string, password: string) => Promise<string>;
+        generate: (link: string, cookie: string) => Promise<{ directUrl: string; fileName: string } | null>;
+        sessions: Map<string, { cookie: string; setAt: number }>;
+      };
+      vi.spyOn(internals, "login")
+        .mockResolvedValueOnce("first-stale-cookie")
+        .mockResolvedValueOnce("second-stale-cookie");
+      vi.spyOn(internals, "generate")
+        .mockImplementationOnce(async () => {
+          fallback.invalidateSession();
+          return null;
+        })
+        .mockResolvedValueOnce({ directUrl: "https://mega.direct/retry", fileName: "retry.bin" });
+
+      const result = await fallback.unrestrict("https://mega.debrid/retry", undefined, { login: "old-user", password: "old-pass" });
+
+      expect(result?.directUrl).toBe("https://mega.direct/retry");
+      expect(internals.sessions.size).toBe(0);
+    });
+
+    it("does not cache old credentials from a queued request after invalidation", async () => {
+      let releaseFirstLogin: () => void = () => {};
+      let markFirstLoginStarted: () => void = () => {};
+      const firstLoginGate = new Promise<void>((resolve) => {
+        releaseFirstLogin = resolve;
+      });
+      const firstLoginStarted = new Promise<void>((resolve) => {
+        markFirstLoginStarted = resolve;
+      });
+      const fallback = new MegaWebFallback(() => ({ login: "old-user", password: "old-pass" }));
+      const internals = fallback as unknown as {
+        login: (login: string, password: string) => Promise<string>;
+        generate: (link: string, cookie: string) => Promise<{ directUrl: string; fileName: string }>;
+        sessions: Map<string, { cookie: string; setAt: number }>;
+      };
+      let loginCount = 0;
+      vi.spyOn(internals, "login").mockImplementation(async () => {
+        loginCount += 1;
+        if (loginCount === 1) {
+          markFirstLoginStarted();
+          await firstLoginGate;
+        }
+        return `old-cookie-${loginCount}`;
+      });
+      vi.spyOn(internals, "generate").mockResolvedValue({ directUrl: "https://mega.direct/queued", fileName: "queued.bin" });
+
+      const first = fallback.unrestrict("https://mega.debrid/first", undefined, { login: "old-user", password: "old-pass" });
+      await firstLoginStarted;
+      const queued = fallback.unrestrict("https://mega.debrid/queued", undefined, { login: "old-user", password: "old-pass" });
+      fallback.invalidateSession();
+      releaseFirstLogin();
+
+      await expect(Promise.all([first, queued])).resolves.toHaveLength(2);
+      expect(loginCount).toBe(2);
+      expect(internals.sessions.size).toBe(0);
+    });
+
     it("logs in, fetches HTML, parses code, and polls AJAX for direct url", async () => {
       let fetchCallCount = 0;
       globalThis.fetch = vi.fn(async (url: string | URL | Request) => {

tests/package-order.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import type { DownloadItem, PackageEntry } from "../src/shared/types";
 import { sortPackagesForDisplay } from "../src/renderer/package-order";
 
-function createPackage(id: string, itemIds: string[]): PackageEntry {
+function createPackage(id: string, itemIds: string[], downloadStartedAt = 0): PackageEntry {
   const now = Date.now();
   return {
     id,
@@ -15,7 +15,8 @@ function createPackage(id: string, itemIds: string[]): PackageEntry {
     enabled: true,
     priority: "normal",
     createdAt: now,
-    updatedAt: now
+    updatedAt: now,
+    downloadStartedAt
   };
 }
 
@@ -106,4 +107,33 @@ describe("sortPackagesForDisplay", () => {
 
     expect(sorted.map((pkg) => pkg.id)).toEqual(["pkg-a", "pkg-b", "pkg-c"]);
   });
+
+  it("keeps every active package in activation order when a new package starts", () => {
+    const packages = [
+      createPackage("pkg-new", ["new-item"], 200),
+      createPackage("pkg-existing", ["existing-item"], 100)
+    ];
+    const items: Record<string, DownloadItem> = {
+      "new-item": createItem("new-item", "pkg-new", "downloading", 100),
+      "existing-item": createItem("existing-item", "pkg-existing", "downloading", 200)
+    };
+    const sorted = sortPackagesForDisplay(packages, items, true, true);
+
+    expect(sorted.map((pkg) => pkg.id)).toEqual(["pkg-existing", "pkg-new"]);
+  });
+
+  it("keeps queue order for active packages without a recorded start time", () => {
+    const packages = [
+      createPackage("pkg-a", ["a1"]),
+      createPackage("pkg-b", ["b1"]),
+      createPackage("pkg-c", ["c1"])
+    ];
+    const items: Record<string, DownloadItem> = {
+      a1: createItem("a1", "pkg-a", "completed", 500),
+      b1: createItem("b1", "pkg-b", "downloading", 200),
+      c1: createItem("c1", "pkg-c", "downloading", 100)
+    };
+
+    expect(sortPackagesForDisplay(packages, items, true, true).map((pkg) => pkg.id)).toEqual(["pkg-b", "pkg-c", "pkg-a"]);
+  });
 });

tests/settings-view.test.tsx

@@ -3,6 +3,7 @@ import { isValidElement, type ReactElement, type ReactNode } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it } from "vitest";
 import { defaultSettings } from "../src/main/constants";
+import { buildAccountAddFields, createAccountDialogState } from "../src/renderer/App";
 import {
   applyAccountEdit,
   createAccountEditState,
@@ -905,6 +906,24 @@ describe("account workspace", () => {
 });
 
 describe("settings App integration", () => {
+  it("keeps new Mega-Debrid credentials empty and never exposes stored accounts as an API key", () => {
+    const settings = {
+      ...defaultSettings(),
+      megaCredentials: "first@example.test:first-secret\nsecond@example.test:second-secret",
+      debridLinkApiKeys: "existing-debrid-link-key"
+    };
+    const megaDialog = createAccountDialogState("create", "megadebrid-api", settings);
+    const megaFields = buildAccountAddFields(megaDialog);
+    const debridLinkFields = buildAccountAddFields(createAccountDialogState("create", "debridlink-api", settings));
+
+    expect(megaDialog.megaNewLogin).toBe("");
+    expect(megaDialog.megaNewPassword).toBe("");
+    expect(megaDialog.token).toBe("");
+    expect(megaFields.map((field) => field.id)).toEqual(["megaNewLogin", "megaNewPassword", "dailyLimitGb"]);
+    expect(megaFields.map((field) => field.label)).not.toContain("Token / API-Key");
+    expect(debridLinkFields.find((field) => field.id === "token")).toEqual(expect.objectContaining({ value: "" }));
+  });
+
   it("keeps specific persistence revision-safe when the draft changes in flight", () => {
     const block = sourceBlock(appSource, "const persistSpecificSettings", "const runAccountQuickAction");
     expect(block).toContain("revisionAtStart");

tests/statistics-view.test.tsx

@@ -438,7 +438,7 @@ describe("bandwidth chart palette", () => {
     const collector = readFileSync(new URL("../src/renderer/views/collector/collector.css", import.meta.url), "utf8");
 
     expect(theme).toMatch(/:focus-visible\s*\{[^}]*outline:\s*2px solid var\(--ui-focus\);/s);
-    expect(shell).toContain("color: var(--ui-primary-text);");
+    expect(shell).toContain("color: var(--ui-update-text);");
     expect(collector.match(/color:\s*var\(--ui-primary-text\);/g)).toHaveLength(3);
   });
 

tests/storage.test.ts

@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
 import { parseDebridLinkApiKeys } from "../src/shared/debrid-link-keys";
+import { getMegaDebridAccountId } from "../src/shared/mega-debrid-accounts";
 import { getProviderUsageDayKey } from "../src/shared/provider-daily-limits";
 import { AppSettings } from "../src/shared/types";
 import { defaultSettings } from "../src/main/constants";
@@ -50,6 +51,27 @@ describe("settings storage", () => {
     expect(normalizeSettings({ ...defaultSettings(), language: "fr" as "en" }).language).toBe("en");
   });
 
+  it("migrates a legacy shared Mega-Debrid pool into only the preferred mode", () => {
+    const legacy = { ...defaultSettings() } as Partial<AppSettings>;
+    legacy.megaCredentials = "legacy@example.test:legacy-pass";
+    legacy.megaLogin = "legacy@example.test";
+    legacy.megaPassword = "legacy-pass";
+    legacy.megaDebridApiEnabled = true;
+    legacy.megaDebridWebEnabled = true;
+    legacy.megaDebridPreferApi = true;
+    delete legacy.megaDebridApiCredentials;
+    delete legacy.megaDebridWebCredentials;
+    delete legacy.megaDebridApiDisabledAccountIds;
+    delete legacy.megaDebridWebDisabledAccountIds;
+
+    const normalized = normalizeSettings(legacy as AppSettings);
+
+    expect(normalized.megaDebridApiCredentials).toBe("legacy@example.test:legacy-pass");
+    expect(normalized.megaDebridWebCredentials).toBe("");
+    expect(normalized.megaDebridApiEnabled).toBe(true);
+    expect(normalized.megaDebridWebEnabled).toBe(false);
+  });
+
   it("keeps German for existing settings files created before language selection existed", () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-store-"));
     tempDirs.push(dir);
@@ -112,6 +134,9 @@ describe("settings storage", () => {
       token: "rd-token",
       megaLogin: "mega-user",
       megaPassword: "mega-pass",
+      megaCredentials: "mega-user:mega-pass",
+      megaDebridApiCredentials: "mega-user:mega-pass",
+      megaDebridWebCredentials: "web-user:web-pass",
       bestToken: "best-token",
       allDebridToken: "all-token"
     });
@@ -120,6 +145,9 @@ describe("settings storage", () => {
     expect(raw.token).toBe("");
     expect(raw.megaLogin).toBe("");
     expect(raw.megaPassword).toBe("");
+    expect(raw.megaCredentials).toBe("");
+    expect(raw.megaDebridApiCredentials).toBe("");
+    expect(raw.megaDebridWebCredentials).toBe("");
     expect(raw.bestToken).toBe("");
     expect(raw.allDebridToken).toBe("");
 
@@ -128,6 +156,9 @@ describe("settings storage", () => {
     expect(loaded.token).toBe("");
     expect(loaded.megaLogin).toBe("");
     expect(loaded.megaPassword).toBe("");
+    expect(loaded.megaCredentials).toBe("");
+    expect(loaded.megaDebridApiCredentials).toBe("");
+    expect(loaded.megaDebridWebCredentials).toBe("");
     expect(loaded.bestToken).toBe("");
     expect(loaded.allDebridToken).toBe("");
   });
@@ -307,6 +338,68 @@ describe("settings storage", () => {
     expect(loadedWeb.megaDebridWebEnabled).toBe(true);
   });
 
+  it("migrates an explicitly Web-only legacy account even when API remains preferred", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-store-"));
+    tempDirs.push(dir);
+    const paths = createStoragePaths(dir);
+    fs.writeFileSync(paths.configFile, JSON.stringify({
+      rememberToken: true,
+      megaCredentials: "web-user:web-pass",
+      megaDebridPreferApi: true,
+      megaDebridApiEnabled: false,
+      megaDebridWebEnabled: true
+    }), "utf8");
+
+    const loaded = loadSettings(paths);
+
+    expect(loaded.megaDebridApiCredentials).toBe("");
+    expect(loaded.megaDebridWebCredentials).toBe("web-user:web-pass");
+    expect(loaded.megaDebridApiEnabled).toBe(false);
+    expect(loaded.megaDebridWebEnabled).toBe(true);
+  });
+
+  it("migrates legacy disabled Mega-Debrid accounts into the selected mode", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-store-"));
+    tempDirs.push(dir);
+    const paths = createStoragePaths(dir);
+    const accountId = getMegaDebridAccountId("disabled-user");
+    fs.writeFileSync(paths.configFile, JSON.stringify({
+      rememberToken: true,
+      megaCredentials: "disabled-user:disabled-pass",
+      megaDebridPreferApi: true,
+      megaDebridApiEnabled: true,
+      megaDebridWebEnabled: false,
+      megaDebridDisabledAccountIds: [accountId]
+    }), "utf8");
+
+    const loaded = loadSettings(paths);
+
+    expect(loaded.megaDebridApiDisabledAccountIds).toEqual([accountId]);
+    expect(loaded.megaDebridWebDisabledAccountIds).toEqual([]);
+  });
+
+  it("preserves explicit mode-specific disabled Mega-Debrid accounts", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-store-"));
+    tempDirs.push(dir);
+    const paths = createStoragePaths(dir);
+    const accountId = getMegaDebridAccountId("shared-user");
+    fs.writeFileSync(paths.configFile, JSON.stringify({
+      rememberToken: true,
+      megaDebridApiCredentials: "shared-user:api-pass",
+      megaDebridWebCredentials: "shared-user:web-pass",
+      megaDebridApiEnabled: true,
+      megaDebridWebEnabled: true,
+      megaDebridDisabledAccountIds: [accountId],
+      megaDebridApiDisabledAccountIds: [],
+      megaDebridWebDisabledAccountIds: [accountId]
+    }), "utf8");
+
+    const loaded = loadSettings(paths);
+
+    expect(loaded.megaDebridApiDisabledAccountIds).toEqual([]);
+    expect(loaded.megaDebridWebDisabledAccountIds).toEqual([accountId]);
+  });
+
   it("re-aktiviert KEINE bewusst deaktivierten Mega-Flags und migriert nicht ohne Mega-Creds", () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-store-"));
     tempDirs.push(dir);

tests/update-experience.test.tsx

@@ -146,6 +146,18 @@ describe("update experience", () => {
     expect(css).toMatch(/\.md-update-dialog\s*\{[^}]*box-shadow:\s*0 12px 40px rgb\(0 0 0 \/ 45%\)/s);
   });
 
+  it("uses a light-blue update affordance and a bounded scrollable changelog", () => {
+    const css = readFileSync(new URL("../src/renderer/shell/shell.css", import.meta.url), "utf8");
+    const theme = readFileSync(new URL("../src/renderer/theme.css", import.meta.url), "utf8");
+
+    expect(theme).toMatch(/--ui-update:\s*#BAD0FC;/);
+    expect(theme).toMatch(/--ui-update-hover:\s*#8AA5DC;/);
+    expect(theme).toMatch(/--ui-update-text:\s*#181A1F;/);
+    expect(css).toMatch(/\.md-update-trigger\s*\{[^}]*background:\s*var\(--ui-update\);[^}]*color:\s*var\(--ui-update-text\);/s);
+    expect(css).toMatch(/\.md-update-trigger:hover\s*\{[^}]*background:\s*var\(--ui-update-hover\);/s);
+    expect(css).toMatch(/\.md-update-release-notes pre\s*\{[^}]*max-height:\s*min\(360px, 45vh\);[^}]*overflow-y:\s*auto;/s);
+  });
+
   it("keeps forward and reverse tabbing inside the update dialog", () => {
     expect(getUpdateDialogFocusTarget(false, -1, 4)).toBe(0);
     expect(getUpdateDialogFocusTarget(true, -1, 4)).toBe(3);

tests/update.test.ts

@@ -108,6 +108,52 @@ describe("update", () => {
     expect(result.setupAssetName).toBe("Real-Debrid-Downloader-Setup-9.9.9.exe");
   });
 
+  it("combines every stable release note newer than the installed version", async () => {
+    const [major = 2, minor = 0, patch = 0] = parseVersionParts(APP_VERSION);
+    const version = (offset: number): string => `${major}.${minor}.${patch + offset}`;
+    const requestedUrls: string[] = [];
+
+    globalThis.fetch = (async (input: RequestInfo | URL): Promise<Response> => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      requestedUrls.push(url);
+      if (url.endsWith("/releases/latest")) {
+        return new Response(JSON.stringify({
+          tag_name: `v${version(3)}`,
+          html_url: `https://github.com/owner/repo/releases/tag/v${version(3)}`,
+          body: "Latest changes",
+          assets: []
+        }), { status: 200, headers: { "Content-Type": "application/json" } });
+      }
+
+      return new Response(JSON.stringify([
+        { tag_name: `v${version(3)}`, body: "Latest changes", draft: false, prerelease: false },
+        { tag_name: `v${version(2)}`, body: "Middle changes", draft: false, prerelease: false },
+        { tag_name: `v${version(1)}`, body: "First missed changes", draft: false, prerelease: false },
+        { tag_name: `v${version(4)}`, body: "Draft changes", draft: true, prerelease: false },
+        { tag_name: `v${version(5)}`, body: "Prerelease changes", draft: false, prerelease: true },
+        { tag_name: `v${version(0)}`, body: "Installed changes", draft: false, prerelease: false },
+        { tag_name: `v${version(-1)}`, body: "Older changes", draft: false, prerelease: false }
+      ]), { status: 200, headers: { "Content-Type": "application/json" } });
+    }) as typeof fetch;
+
+    const result = await checkGitHubUpdate("owner/repo");
+
+    expect(requestedUrls).toEqual([
+      "https://api.github.com/repos/owner/repo/releases/latest",
+      "https://api.github.com/repos/owner/repo/releases?per_page=100&page=1"
+    ]);
+    expect(result.releaseNotes).toBe([
+      `v${version(3)}`,
+      "Latest changes",
+      "",
+      `v${version(2)}`,
+      "Middle changes",
+      "",
+      `v${version(1)}`,
+      "First missed changes"
+    ].join("\n"));
+  });
+
   it("uses silent NSIS install flags with auto-run after update", () => {
     expect(buildInstallerLaunchArgs()).toEqual(["/S", "--updated", "--force-run"]);
   });

tests/visual/fixtures.ts

@@ -60,6 +60,8 @@ function createSettings(): AppSettings {
     megaPassword: "visual-password",
     language: "de",
     megaCredentials: `${megaLogin}:visual-password`,
+    megaDebridApiCredentials: `${megaLogin}:visual-password`,
+    megaDebridWebCredentials: "",
     megaDebridApiEnabled: true,
     megaDebridWebEnabled: true,
     megaDebridPreferApi: true,
@@ -174,6 +176,8 @@ function createSettings(): AppSettings {
       [debridLinkKeys[1].id]: 549755813888
     },
     megaDebridDisabledAccountIds: [],
+    megaDebridApiDisabledAccountIds: [],
+    megaDebridWebDisabledAccountIds: [],
     megaDebridAccountDailyLimitBytes: {
       [megaAccountId]: 322122547200
     },