assertPathInside compared managed-tool paths with path.resolve only, so
on runners whose temporary directory surfaces as a Windows 8.3 short
path (RUNNER~1) the canonical long executable paths appeared to live
outside the owned root and the cutter matrix provisioning contract
failed. Resolve both sides through fs.realpathSync.native, walking up
through not-yet-existing segments so planned directories keep working,
and cover the contract with a real ShortPath regression test plus
mixed-existence canonicalization cases.
Document the tool availability fallback, the mid-transfer download
failure handling, the managed tools status hint and the unified
auto-install error messages in the 1.0.18 changelog, move the release
date to 2026-08-14 and add the new src/tools.test.ts suite to the public
release file inventory.
ensureStreamlinkInstalled and ensureFfmpegInstalled forced a managed
reinstall whenever a bundled tool directory existed without passing
manifest verification. When that reinstall failed (offline, blocked
download, locked executable), both functions returned false without ever
probing the tool that was already present and runnable, so every
download path aborted with an auto-install error while the System Check
kept reporting the same tool as available. Both functions now fall back
to the same executability probe the System Check uses after a failed
managed repair, cache the verified command on success, and only report
failure when nothing runnable remains. The repair attempt itself is
preserved and retried on the next call.
The tool archive download also registered no error handler on the HTTP
response stream. A stream that failed mid-transfer settled neither the
writer finish nor the writer error path, leaving the install promise
pending forever and the download start hanging indefinitely. The
response stream now rejects the download on error and destroys the
writer.
Merge group downloads reported the bare "Streamlink is missing." text
while the VOD and live paths already explained the failed auto-install.
All three gates now share streamlinkAutoInstallFailed, ffmpeg gained the
matching ffmpegAutoInstallFailed message, and the now unused
streamlinkMissing and ffmpegMissing keys were removed.
The Managed tools panel showed "Missing / Unverified" with no hint that
downloads still work through a system-provided installation, which reads
like a hard failure on machines that never installed the managed copies.
getManagedToolStatuses now reports per tool whether a runnable
installation answers the version probe, and the panel appends a
localized "Downloads still available" note whenever an unverified state
is covered by a working tool.
Canonicalize shortcut targets across Windows short and long path forms while preserving exact target validation. Keep Gitea 1.22 push verification parser-compatible and harden CI contracts against skipped or weakened live gates.
Harden update, system-check, queue, cutter, streamer and shutdown state transitions.
Add multi-user installer recovery, secret-safe config migration, provider fallback handling, managed-tool validation and real media export coverage.
Refresh the English public documentation, release notes and 1.0.18 product screenshot.
Use clearly synthetic streamer fixtures in the workspace Electron smoke so the public source release contains no real account handles while preserving display-case and navigation-motion coverage.
Keep the loaded cutter layout stable across supported window sizes, preserve recovered encoder choices during capability discovery, and reject unsupported video selections without changing the active project.
Honor the Windows system theme, fully localize runtime metrics, invalidate imported System Check state safely, and bound child-process shutdown waits when close events never arrive.
Extend focused and Electron smoke coverage and prepare the v1.0.17 public release metadata.
Keep download progress inside the updater popover, slow changelog transitions, and improve dark-theme checkbox contrast. Expand diagnostics, prevent cleanup option clipping, improve navigation readability, and cover the affected states in Electron regression tests. Prepare version 1.0.15 release metadata.
Retry Electron binary provisioning before Windows smoke tests and retain bounded retries for package and installer builds. Bump release contracts to 1.0.14.
Retry the directory package once when Electron download transport is interrupted, keeping the Windows CI step bounded. Bump the release contracts to 1.0.12.
Mock Electron in the Node-only secure-storage unit test so its expected unavailable-path assertion never triggers Electron's binary bootstrap. Bump the patch release contracts to 1.0.11 after the 1.0.10 tag CI failure.
Ignore malformed update notifications that do not carry a version, preventing unusable release prompts in installed builds.
Keep the loaded cutter workspace free of the source selector and give cutter export selects an explicit non-repeating indicator after workspace styling.
Add regression coverage, bump the patch release to 1.0.10, and update public installation documentation.
Delay managed-tool installation promotion until checksum read streams have emitted close, preventing intermittent Windows rename failures caused by open file handles.
Add a deterministic end-before-close regression test and prepare the 1.0.9 patch release across package metadata, UI version text, README, changelog, and release contracts.
Stabilize Start menu and desktop shortcut migration with persistent versioned icon resources, stale-registration recovery, and explicit Windows shell notifications. Keep development, packaged, and shortcut identities aligned, and add regression coverage for orphaned per-user installs, reduced-motion changelog transitions, and update-popover pointer transit.
Provide a pure persisted policy contract for optional app-side throughput limits and local download windows. Cover overnight timing, local Date DST behavior, invalid values, and manual window overrides without creating Streamlink arguments.
Keep chat and event viewer focus on a listbox with an active descendant instead of creating row tab stops. Provide a full-text detail dialog for keyboard users with Escape focus restoration and production-path coverage for scrolling and selection.
Exercise delegated queue and VOD context menus plus chat and event viewer cancellation through compiled renderer code. Make truncated virtual rows keyboard-focusable with complete accessible labels and visible focus feedback.
Use cancellable, generation-aware reads and removable virtual scrolling for chat and event viewers. Constrain virtual rows to fixed single-line heights, clean busy state, stop Escape propagation, and cover dialog, menu, palette, and virtual list interactions.
Stream capability-authorized chat reads with cancellation, virtualize viewer rendering, centralize modal focus management, and add keyboard-accessible queue and VOD menus. Expose command palette combobox state and keep the document language synchronized with the selected locale.
Promote a verified staged first installation after interruption and clear stale first-install journals. Stream archive and managed executable hashes, make status recovery non-blocking, and await the propagated tool and IPC status contracts.
Persist atomic promotion state beside each managed tool, restore usable backups after interrupted renames, and retain precise recovery failures. Verify installed executable hashes from the staged manifest record and make cleanup diagnostics unable to strand repair single-flight state.
Pin Streamlink and FFmpeg archives to verified manifests, stage replacements before promotion, and expose managed tool status with repair and reset controls. Keep updater checks exclusive until their underlying operation settles and restore default electron-builder certificate environment support.
Track settings input generations so an older asynchronous secret save cannot mark a newer value durable. Commit queue snapshots before cancellation, cleanup, or pause effects so SQLite failures leave runtime processes and files unchanged.
Keep SQLite authoritative after completed migration even when legacy JSON is later invalid, reject non-object config documents before any migration state is written, and guard async secret masking by input generation. Persist renderer-facing config and queue mutations before updating memory so SQLite errors reject IPC calls and retain the last durable queue snapshot.
Store Twitch and Discord secrets as versioned safeStorage ciphertext behind explicit trusted IPC. Migrate legacy JSON transactionally into authoritative SQLite config and ordered queue repositories with rollback-safe markers and sanitized backups. Redact config exports and update renderer and release-harness contracts for secret-free config responses.
Reject renderer-owned queue internals before persistence and bind privileged handlers to trusted renderer events. Extend cutter session capabilities without weakening owner, purpose, path identity, or expiry checks. Migrate release harness contracts to opaque capabilities and add an invisible Node gate.
Start process-exit waits only when pause or cancellation begins, escalate stubborn children without resolving before close, latch pause across late registrations and fast resume, and retry concat only after a complete resume. Add real child-process and filesystem integration coverage for pause, shutdown cleanup, and persistence order.
Track Streamlink and FFmpeg resources by queue item so parallel jobs can pause, resume, cancel, retry, and clean up independently. Gate queue scheduling during shutdown, await the active queue owner, retain retry artifacts on ordinary failures, remove partial outputs on cancellation, and flush queue state once after active work settles.
Sucukdeluxe