- Add LinkSnappy provider with cookie-based session auth and /api/linkgen
- Upgrade LinkSnappy download URLs from http to https (fix 425 errors)
- Add account deactivation toggle (disabledProviders in settings)
- Show account type (API/Web/Login) in provider dropdowns
- Show API key count for Debrid-Link in status label
- Fix all missing German umlauts throughout the UI
- Wider modal for textarea, compact action buttons in one row
- Debrid-Link: log which API key (#1/#2) is used for unrestrict
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- New DebridLinkClient with automatic API key rotation on quota errors
(maxLink, maxLinkHost, maxData, maxDataHost, maxAttempts, maxTransfer)
- Multi-account support: comma or newline-separated API keys
- Full UI integration: account settings, provider dropdowns, summary display
- Safe fallback for undefined debridLinkApiKeys on settings upgrade
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Pass cdn: 0 to 1Fichier get_token API to force direct server
downloads instead of CDN, avoiding unnecessary CDN credit usage.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Real-Debrid, AllDebrid, and Mega-Debrid now show their active
mode in logs and UI (e.g. "Real-Debrid (API)" or "Real-Debrid (Web)").
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Multiple parallel downloads calling connectUser simultaneously caused
token invalidation races. Only one connectUser request now runs at a
time; all parallel callers share the same result.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add Mega-Debrid API support (connectUser + getLink endpoints)
- API mode preferred by default, with automatic web fallback on failure
- User toggle "Mega-Debrid bevorzugt über API" in settings UI
- Provider labels now show source: "Mega-Debrid (API)" or "Mega-Debrid (Web)"
- sourceLabel propagated through all provider result paths
- API session token cached for 20 minutes with auto-invalidation
- Remove megaWebUnrestrict requirement for Mega-Debrid provider config
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.
- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
DDownload's storage servers (dstorage.org) use certificates that fail
Node.js TLS verification. Add skipTlsVerify flag to UnrestrictedLink
and temporarily disable TLS verification for the download fetch when
the flag is set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
DDownload is a direct file hoster, not a debrid service. DDownload URLs
are now automatically handled by the DDownload provider when configured,
before trying any debrid providers. Remove DDownload from the
primary/secondary/tertiary provider dropdowns since it only handles its
own URLs and doesn't belong in the debrid fallback chain.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- DDownload (ddownload.com/ddl.to) as new hoster with web login
- Post-processing labels: Entpacken/Renaming/Aufräumen/MKVs
- Release notes shown in update confirmation dialog
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dead link detection:
- Mega-Web: parse hoster error messages (hosterNotAvailable, etc.) from HTML
and throw specific error instead of returning null
- MegaDebridClient: stop retrying on permanent hoster errors
- download-manager: isPermanentLinkError() immediately fails items with dead
links instead of retrying forever
Extraction race condition:
- package_done cleanup policy checked if all items were "completed" (downloaded)
but not if they were "extracted" — removing the package before the last
episode could be extracted
- Both applyCompletedCleanupPolicy and applyPackageDoneCleanup now guard
against premature removal when autoExtract is enabled
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- AllDebrid: add HTML response detection to unrestrictLink
- Cleanup: skip symlinks/junctions in all directory traversals
- Blob URL: increase revoke delay from 0ms to 60s
- Extractor: per-package progress file to prevent collision
- ADD_CONTAINERS: reject path traversal and relative paths
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add 30s fetch timeouts to ALL API calls (Real-Debrid, BestDebrid, AllDebrid, Mega-Web)
- Fix race condition in concurrent worker indexing (runWithConcurrency)
- Guard JSON.parse in RealDebrid response with try-catch
- Add try-catch to fs.mkdirSync in download pipeline (handles permission denied)
- Convert MD5/SHA1 hashing to streaming (prevents OOM on large files)
- Add error handling for hash manifest file reading
- Prevent infinite hangs on unresponsive API endpoints
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
