The installer smoke asserted a clean registry and shortcut surface
immediately after the silent uninstall returned and the installation
directory disappeared. NSIS uninstallers run detached through a
temporary copy, so shortcut and registry removal completes after the
invoked process exits, and on current runner images the immediate check
raced that cleanup and failed with leftover HKCU keys and shortcuts.
The smoke now polls the exact same surface assertions until a bounded
deadline, keeping a genuinely dirty uninstall failing, with contract
coverage for the tolerated asynchronous cleanup and the persistent
failure case.
The live managed-tool smoke and the real installer smoke gated on
RUNNER_OS being exactly Windows. The Gitea act runner reports the value
as lowercase windows, so both gates rejected the approved self-hosted
git.24-music.de runner and the corresponding verify steps could never
run there. The gates now compare RUNNER_OS case-insensitively while
keeping every other identity requirement unchanged, with contract
coverage for the lowercase Gitea identity.
The installer staged downloaded tool archives as archiveName.uuid, so
the temporary file no longer ended in .zip. The Expand-Archive cmdlet
shipped with stock Windows PowerShell (Microsoft.PowerShell.Archive
1.0.1.0) rejects any archive whose extension is not .zip, which made
every managed streamlink and ffmpeg installation fail with
extract-failed on systems without an updated Archive module - including
plain end-user machines and the self-hosted CI runner. The unique
download path now uses the UUID as a prefix and keeps the manifest
archive name with its .zip extension intact.
assertLockedTargetFailure compared the rename paths from the product
publish-lock diagnostic against the expected output file with
path.resolve only. On runners whose temporary directory surfaces as a
Windows 8.3 short path the smoke passes a short-path output file while
the product logs canonical long paths, so a correct atomic publish lock
diagnostic was rejected and the cutter media matrix failed. sameResolvedPath
now canonicalizes both sides through the existing resolveCanonicalPath
helper with a resolve fallback, covered by a ShortPath contract test.
recoverInterruptedMergeArtifacts resolved the artifact root through
fs.realpathSync.native but compared candidate artifact paths with
path.resolve only. On systems whose temporary or download directories
surface as Windows 8.3 short paths the queue-persisted artifact paths
never matched the canonical long root, so crash artifacts were treated
as outside the owned directory, nothing was removed and interrupted
merge items were incorrectly blocked. isInside now canonicalizes both
sides through the deepest existing path segment, keeping planned but
not yet created paths comparable, and a Windows ShortPath regression
test covers the recovery flow end to end.
assertPathInside compared managed-tool paths with path.resolve only, so
on runners whose temporary directory surfaces as a Windows 8.3 short
path (RUNNER~1) the canonical long executable paths appeared to live
outside the owned root and the cutter matrix provisioning contract
failed. Resolve both sides through fs.realpathSync.native, walking up
through not-yet-existing segments so planned directories keep working,
and cover the contract with a real ShortPath regression test plus
mixed-existence canonicalization cases.
Document the tool availability fallback, the mid-transfer download
failure handling, the managed tools status hint and the unified
auto-install error messages in the 1.0.18 changelog, move the release
date to 2026-08-14 and add the new src/tools.test.ts suite to the public
release file inventory.
ensureStreamlinkInstalled and ensureFfmpegInstalled forced a managed
reinstall whenever a bundled tool directory existed without passing
manifest verification. When that reinstall failed (offline, blocked
download, locked executable), both functions returned false without ever
probing the tool that was already present and runnable, so every
download path aborted with an auto-install error while the System Check
kept reporting the same tool as available. Both functions now fall back
to the same executability probe the System Check uses after a failed
managed repair, cache the verified command on success, and only report
failure when nothing runnable remains. The repair attempt itself is
preserved and retried on the next call.
The tool archive download also registered no error handler on the HTTP
response stream. A stream that failed mid-transfer settled neither the
writer finish nor the writer error path, leaving the install promise
pending forever and the download start hanging indefinitely. The
response stream now rejects the download on error and destroys the
writer.
Merge group downloads reported the bare "Streamlink is missing." text
while the VOD and live paths already explained the failed auto-install.
All three gates now share streamlinkAutoInstallFailed, ffmpeg gained the
matching ffmpegAutoInstallFailed message, and the now unused
streamlinkMissing and ffmpegMissing keys were removed.
The Managed tools panel showed "Missing / Unverified" with no hint that
downloads still work through a system-provided installation, which reads
like a hard failure on machines that never installed the managed copies.
getManagedToolStatuses now reports per tool whether a runnable
installation answers the version probe, and the panel appends a
localized "Downloads still available" note whenever an unverified state
is covered by a working tool.
Canonicalize shortcut targets across Windows short and long path forms while preserving exact target validation. Keep Gitea 1.22 push verification parser-compatible and harden CI contracts against skipped or weakened live gates.
Harden update, system-check, queue, cutter, streamer and shutdown state transitions.
Add multi-user installer recovery, secret-safe config migration, provider fallback handling, managed-tool validation and real media export coverage.
Refresh the English public documentation, release notes and 1.0.18 product screenshot.
Use clearly synthetic streamer fixtures in the workspace Electron smoke so the public source release contains no real account handles while preserving display-case and navigation-motion coverage.
Keep the loaded cutter layout stable across supported window sizes, preserve recovered encoder choices during capability discovery, and reject unsupported video selections without changing the active project.
Honor the Windows system theme, fully localize runtime metrics, invalidate imported System Check state safely, and bound child-process shutdown waits when close events never arrive.
Extend focused and Electron smoke coverage and prepare the v1.0.17 public release metadata.
Keep download progress inside the updater popover, slow changelog transitions, and improve dark-theme checkbox contrast. Expand diagnostics, prevent cleanup option clipping, improve navigation readability, and cover the affected states in Electron regression tests. Prepare version 1.0.15 release metadata.
Retry Electron binary provisioning before Windows smoke tests and retain bounded retries for package and installer builds. Bump release contracts to 1.0.14.
Retry the directory package once when Electron download transport is interrupted, keeping the Windows CI step bounded. Bump the release contracts to 1.0.12.
Mock Electron in the Node-only secure-storage unit test so its expected unavailable-path assertion never triggers Electron's binary bootstrap. Bump the patch release contracts to 1.0.11 after the 1.0.10 tag CI failure.
Ignore malformed update notifications that do not carry a version, preventing unusable release prompts in installed builds.
Keep the loaded cutter workspace free of the source selector and give cutter export selects an explicit non-repeating indicator after workspace styling.
Add regression coverage, bump the patch release to 1.0.10, and update public installation documentation.
Delay managed-tool installation promotion until checksum read streams have emitted close, preventing intermittent Windows rename failures caused by open file handles.
Add a deterministic end-before-close regression test and prepare the 1.0.9 patch release across package metadata, UI version text, README, changelog, and release contracts.
Stabilize Start menu and desktop shortcut migration with persistent versioned icon resources, stale-registration recovery, and explicit Windows shell notifications. Keep development, packaged, and shortcut identities aligned, and add regression coverage for orphaned per-user installs, reduced-motion changelog transitions, and update-popover pointer transit.
Provide a pure persisted policy contract for optional app-side throughput limits and local download windows. Cover overnight timing, local Date DST behavior, invalid values, and manual window overrides without creating Streamlink arguments.
Keep chat and event viewer focus on a listbox with an active descendant instead of creating row tab stops. Provide a full-text detail dialog for keyboard users with Escape focus restoration and production-path coverage for scrolling and selection.
Exercise delegated queue and VOD context menus plus chat and event viewer cancellation through compiled renderer code. Make truncated virtual rows keyboard-focusable with complete accessible labels and visible focus feedback.
Use cancellable, generation-aware reads and removable virtual scrolling for chat and event viewers. Constrain virtual rows to fixed single-line heights, clean busy state, stop Escape propagation, and cover dialog, menu, palette, and virtual list interactions.
Stream capability-authorized chat reads with cancellation, virtualize viewer rendering, centralize modal focus management, and add keyboard-accessible queue and VOD menus. Expose command palette combobox state and keep the document language synchronized with the selected locale.
Promote a verified staged first installation after interruption and clear stale first-install journals. Stream archive and managed executable hashes, make status recovery non-blocking, and await the propagated tool and IPC status contracts.
Persist atomic promotion state beside each managed tool, restore usable backups after interrupted renames, and retain precise recovery failures. Verify installed executable hashes from the staged manifest record and make cleanup diagnostics unable to strand repair single-flight state.
Pin Streamlink and FFmpeg archives to verified manifests, stage replacements before promotion, and expose managed tool status with repair and reset controls. Keep updater checks exclusive until their underlying operation settles and restore default electron-builder certificate environment support.
Track settings input generations so an older asynchronous secret save cannot mark a newer value durable. Commit queue snapshots before cancellation, cleanup, or pause effects so SQLite failures leave runtime processes and files unchanged.
Keep SQLite authoritative after completed migration even when legacy JSON is later invalid, reject non-object config documents before any migration state is written, and guard async secret masking by input generation. Persist renderer-facing config and queue mutations before updating memory so SQLite errors reject IPC calls and retain the last durable queue snapshot.
Sucukdeluxe