Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.
- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
DDownload's storage servers (dstorage.org) use certificates that fail
Node.js TLS verification. Add skipTlsVerify flag to UnrestrictedLink
and temporarily disable TLS verification for the download fetch when
the flag is set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
DDownload is a direct file hoster, not a debrid service. DDownload URLs
are now automatically handled by the DDownload provider when configured,
before trying any debrid providers. Remove DDownload from the
primary/secondary/tertiary provider dropdowns since it only handles its
own URLs and doesn't belong in the debrid fallback chain.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- DDownload (ddownload.com/ddl.to) as new hoster with web login
- Post-processing labels: Entpacken/Renaming/Aufräumen/MKVs
- Release notes shown in update confirmation dialog
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dead link detection:
- Mega-Web: parse hoster error messages (hosterNotAvailable, etc.) from HTML
and throw specific error instead of returning null
- MegaDebridClient: stop retrying on permanent hoster errors
- download-manager: isPermanentLinkError() immediately fails items with dead
links instead of retrying forever
Extraction race condition:
- package_done cleanup policy checked if all items were "completed" (downloaded)
but not if they were "extracted" — removing the package before the last
episode could be extracted
- Both applyCompletedCleanupPolicy and applyPackageDoneCleanup now guard
against premature removal when autoExtract is enabled
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- AllDebrid: add HTML response detection to unrestrictLink
- Cleanup: skip symlinks/junctions in all directory traversals
- Blob URL: increase revoke delay from 0ms to 60s
- Extractor: per-package progress file to prevent collision
- ADD_CONTAINERS: reject path traversal and relative paths
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add 30s fetch timeouts to ALL API calls (Real-Debrid, BestDebrid, AllDebrid, Mega-Web)
- Fix race condition in concurrent worker indexing (runWithConcurrency)
- Guard JSON.parse in RealDebrid response with try-catch
- Add try-catch to fs.mkdirSync in download pipeline (handles permission denied)
- Convert MD5/SHA1 hashing to streaming (prevents OOM on large files)
- Add error handling for hash manifest file reading
- Prevent infinite hangs on unresponsive API endpoints
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
