Backup redesign (JDownloader 2 style):
- AES-256-GCM encrypted .mdd format with fixed app key
- All credentials exported (no more ***-masking), works on any PC
- Includes settings, session AND history in backup
- Backward-compatible: auto-detects legacy JSON backups
- Normalize history entries on import
- Added debridLinkApiKeys, linkSnappy credentials to sensitive keys
Hide extracted items:
- New setting: hide completed/extracted items from package item list
- Items still count in progress stats (done/total), only hidden in UI
- Default: enabled
- Toggle in settings: "Entpackte Items in Paketliste ausblenden"
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace plaintext JSON export with encrypted binary format (JDownloader 2 style)
- Fixed app-internal key, works on any machine without password
- Export now includes ALL credentials (no more ***-masking), session AND history
- Add debridLinkApiKeys, linkSnappy credentials to sensitive keys list
- Backward-compatible import: auto-detects legacy JSON backups
- File extension changed from .json to .mdd
- MDD1 magic bytes + random IV + GCM auth tag for integrity
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Daily traffic limits:
- Per-provider daily download limit (configurable in GB per provider)
- Per Debrid-Link API key daily limit (individual limits per key)
- Usage tracking with automatic daily reset at midnight
- Provider is skipped when daily limit reached, falls back to next provider
- Reset button per provider and per Debrid-Link key in account settings
- Hoster routing skips daily-limited providers gracefully
Debrid-Link multi-key improvements:
- Keys now display with labels (#1, #2...) and masked tokens in account list
- Option to show detailed per-key view with individual usage stats
- Keys that hit their daily limit are automatically skipped
- providerAccountId/providerAccountLabel stored per download item
Auto-sort packages by progress:
- Active packages automatically sorted to top during downloads
- Sorted by completion ratio, then downloaded bytes
- Toggle in settings (autoSortPackagesByProgress)
UI polish:
- Package column headers: flatter, more transparent design
- LinkSnappy mode label: "Login" renamed to "Web"
- Account list: new toggle for detailed Debrid-Link key display
- Account usage stats section with warning styling
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace BrowserWindow-based login flow with Netscape cookie file import
for BestDebrid authentication. Cloudflare Turnstile captcha cannot be
solved in Electron's embedded browser, so users export cookies from
their real browser and import them here.
- Rewrite bestdebrid-web.ts: remove BrowserWindow/CDP code, add
parseNetscapeCookieFile() and importCookiesFromFile()
- Add file picker dialog for .txt cookie files in main IPC handler
- Update IPC channel from OPEN_BESTDEBRID_LOGIN to IMPORT_BESTDEBRID_COOKIES
- Update preload bridge and renderer UI with cookie import button
- Fix pLabel scope in downloadToFile (pass as parameter from processItem)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use PackagePriority type instead of string/any in preload and app-controller
- Add .catch() to start(), extractNow(), setPackagePriority(), updateSettings(columnOrder), openLog(), openSessionLog()
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.
- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- DDownload (ddownload.com/ddl.to) as new hoster with web login
- Post-processing labels: Entpacken/Renaming/Aufräumen/MKVs
- Release notes shown in update confirmation dialog
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Migrate deprecated updateRepo value (Sucukdeluxe/) to new default (Administrator/)
- Mask sensitive fields (tokens, passwords) in backup export with ***
- Preserve current credentials when importing backup with masked values
- Remove 22 obsolete release_v*.mjs scripts, release_codeberg.mjs, set_version_node.mjs
- Remove release:codeberg script from package.json
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Restore all source files from v1.5.49 (proven stable on both servers)
- Add startPackages() IPC method that starts only specified packages
- Fix context menu "Ausgewählte Downloads starten" to use startPackages()
instead of start() which was starting ALL enabled packages
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Account Manager: table UI with add/remove/check for all 4 providers
(Real-Debrid, Mega-Debrid, BestDebrid, AllDebrid)
- Backend: checkRealDebridAccount, checkAllDebridAccount, checkBestDebridAccount
- Hybrid-Extract fix: check item.fileName for queued items without targetPath,
disable disk-fallback for multi-part archives, extend disk-fallback to catch
active downloads by fileName match (prevents CRC errors on incomplete files)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Scrapes the Mega-Debrid profile page to display username, premium status,
remaining days, and loyalty points. New "Account prüfen" button in Settings > Accounts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Encrypt sensitive credentials (tokens, passwords) in backup exports
using AES-256-GCM with PBKDF2 key derivation from OS username
- Backup format v2 with backwards-compatible v1 import
- Show dialog to create non-existent directories when changing
outputDir, extractDir, or mkvLibraryDir settings
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- New "Jetzt entpacken" right-click option: triggers extraction for
completed packages regardless of paused/stopped state
- Fix 5-10s freeze when pressing Start after Pause: recoverRetryableItems
was calling fs.stat on every item (474+); now only checks failed/completed
- Full IPC pipeline: extractNow in manager, controller, preload, renderer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Right-click packages with extraction errors shows "Extraktion
wiederholen" option to manually retry
- Increase WinRAR error text from 240 to 500 chars for better
diagnostics in logs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Save settings every 30s during active downloads (not just session)
- Force settings save on shutdown and run finish
- Preserve live totalDownloadedAllTime when user saves settings
(app-controller's stale copy no longer overwrites the counter)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Provider circuit breaker: track consecutive failures per provider with
escalating cooldowns (30s/60s/120s/300s), auto-invalidate Mega-Debrid
session on cooldown
- Escalating backoff: retry delays now scale up to 120s (was 30s max),
unrestrict backoff exponential instead of linear 15s cap
- Shelve logic: after 15 consecutive failures, item pauses 5 min with
counter halving for gradual recovery
- Periodic soft-reset: every 10 min, reset stale retry counters (>10 min
queued) and old provider failures (>15 min), acts like mini-restart
- Mega-Debrid queue timeout: 90s wait limit in runExclusive to prevent
cascade blocking behind stuck calls
- Provider-cooldown-aware retry delays: items wait for provider cooldown
instead of retrying against broken service
- Fix: reconnect/package_toggle now persist retry counters (previously
lost on interruption, defeating shelve logic)
- Mega-Debrid generate: tighter timeouts, progressive reload backoff,
hoster retry limit (5x max)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Starts an HTTP server on port 9868 (configurable via debug_port.txt)
when debug_token.txt exists in the app runtime directory. Provides
/health, /log, /status, and /items endpoints for live monitoring.
Token-based auth required.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Convert all sync FS ops (existsSync, readdirSync, statSync, writeFileSync,
rmSync, renameSync) to async equivalents across download-manager, extractor,
cleanup, storage, and logger to prevent UI freezes
- Replace linear retry delays with exponential backoff + jitter to prevent
retry storms with many parallel downloads
- Deduplicate resolveArchiveItems into single shared function
- Replace Array.shift() O(N) in bandwidth chart with slice-based trimming
- Make logger rotation async in the async flush path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Parse <filename> tags from DLC XML for proper file names instead of
deriving from opaque URLs (fixes download.bin display)
- Optimistic UI removal for package/item delete (instant feedback)
- Show app version in header ("Multi Debrid Downloader vX.X.X")
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
