nudl v0.1.1

Correctness release. Two of these were live bugs in v0.1.0, and one of them could lose data.

Download nudl-0.1.1-win64.zip, unzip it anywhere, run nudl.exe. No installer.

SHA-256 of the zip:
483022d53020774517532fff2cdad4e34bd3564487cf57b36ba71bf61ef9cf5a

VirusTotal: 1/64 — one heuristic engine, which is the going rate for an unsigned PyInstaller binary. The hash above is the file that was scanned; check it before you trust it.

Fixed

Undo could overwrite what you had just copied. Undo read the clipboard, decided its cleaned link was still there, and only then wrote the original back. Anything you copied in that gap was destroyed. The write now compares the clipboard's sequence number inside the clipboard lock, so it is refused rather than clobbering you.

Undo threw away your original if the clipboard was busy. You would be told "could not undo" and then be unable to ever try again — the original gone. The failure branch of undo was losing the one thing undo exists to protect.

The clipboard was not thread-safe, and Windows will not make it so. OpenClipboard locks out other processes, but not other threads of the same process — a second thread can open the clipboard mid-session and its close then ends the first thread's session. nudl touches the clipboard from three threads (the message pump, the tray, the toast), so right-clicking the tray while a link was being cleaned could silently drop the clean. Measured at 147 failures in 180 sessions; now zero.

The own-write guard's sequence signal never worked. It read the clipboard's sequence number while the clipboard was still open, and Windows keeps counting through the close — so the guard armed itself with a number that could never match. The "dual-signal" guard has been running on one signal since auto-watch shipped.

OAuth codes and session keys were written to the audit log. nudl deliberately does not strip ?code= from your link (that would break the link), but it was logging it verbatim to a file that lives forever. Values are now masked; the parameter names stay, so the log is still readable.

Assorted: a hotkey of ß crashed with a TypeError instead of a clean error; a dead UI thread could hang nudl on first run before it ever reached the tray; clean() swallowed its own tracebacks, disguising engine bugs as "nothing to clean"; a failed clipboard listener registration left auto-watch dead with a healthy-looking tray icon.

Added

Undo in the tray menu. The toast lasts seconds and the hotkey window is shorter. Miss both and your original was gone, even though nudl still had it. The entry greys out the moment undoing would no longer be safe.

More rules. 26 global tracker keys and 85 provider-specific keys across 16 sites, plus 9 redirect wrappers. See docs/RULES.md for the full list, including what is deliberately absent and why.

Tests

201, up from 153. Thirty of them drive the real Windows clipboard — a real message pump, a real listener, no test doubles. They found two of the bugs above on their first run, after five review passes had read straight past them. A FakeClipboard does what you think Windows does, which is exactly why it never caught either one.

nudl v0.1.0

nudl strips the tracking junk off any link you copy — in Slack, Discord, a terminal, a doc, your browser — and hands back the same real link, trimmed.

ClearURLs only works inside a browser. nudl works everywhere else.

Install

Download nudl-0.1.0-win64.zip below, unzip it anywhere, run nudl.exe.

It's an unsigned build, so SmartScreen will show "Windows protected your PC." Click More info → Run anyway. I'd rather tell you that up front than have you discover it. See Is it safe? below.

What it does

• Strips tracking parameters: utm_*, fbclid, gclid, msclkid, igshid, Amazon's tag / ref_, and friends.
• Unwraps redirect wrappers: l.facebook.com/l.php, google.com/url, out.reddit.com, and others — you get the destination they were hiding, not the wrapper.
• Two modes: press Ctrl+Alt+V, or turn on automatic mode and every link is cleaned the instant you copy it, in any app.
• Undo on every change: click the toast, or press the hotkey again within three seconds.

It is not a URL shortener. No alias, no server, no redirect — the output is the real destination, just shorter. The link can't rot, because it was never replaced.

The promise: it never silently breaks a link you needed

This is the whole product. Anyone can delete query parameters; the hard part is knowing what to leave alone.

• Signed URLs are never touched. Anything carrying sig, hmac, token, expires, or an X-Amz-* key is left completely alone — signed URLs sign the whole query, so removing any parameter turns the link into a 403.
• Only known trackers are stripped. nudl works from a small allowlist and never guesses, which is why YouTube's ?v= and ?t=, Spotify's ?si=, ?page= and ?q= all survive by default.
• Values are never rewritten. Only the key of each parameter is inspected, so a parameter whose value merely looks like a tracker (?redirect=utm_source_page) can't be mangled, and %20 never quietly becomes +.
• A no-op is silent. If nudl didn't change your link, you'll never know it ran.

The test suite is 110 tests, including a corpus of 50 hand-vetted before/after URLs — a quarter of them "looks like tracking but isn't" tripwires, the cases where a careless cleaner breaks a working link.

nudl never sends your URLs anywhere

Zero network calls. No account, no telemetry, nothing leaves your machine. That's not a policy, it's a property of the code — the test suite replays every URL in the corpus with the socket layer patched to throw on any connection attempt.

There's a local audit log at %AppData%\nudl\clean.log recording every change nudl has ever made, so you can check its work rather than trust it.

Is it safe?

It's a small unsigned tool that reads your clipboard. Being suspicious is the correct reaction.

• It uses RegisterHotKey, which asks Windows to deliver one specific chord and nothing else. It does not install a low-level keyboard hook — that's the keylogger technique. nudl never sees any keystroke but its own shortcut.
• The whole cleaning engine is one file you can read in ten minutes: src/clean.py. The rule set is one readable JSON file: src/rules.json.

The VirusTotal score, stated plainly

1 of ~70 engines flags the download — that link scans nudl-0.1.0-win64.zip itself, the exact file attached below. I'd rather you hear it from me than find it yourself.

That detection is an ML heuristic reacting to PyInstaller, not to nudl: bundling a Python interpreter into a self-extracting executable looks structurally like a packer, and aggressive engines flag tools built that way regardless of what they do. It's a known false-positive pattern, not a finding about this code.

Microsoft Defender scans it clean — current signatures, real-time protection on — and Defender is what actually decides whether nudl runs on your machine. Every major engine reads clean.

For completeness: the bootloader nudl.exe scanned alone draws 3 flags. That file is a stub containing none of nudl's logic — it can't even start without the _internal folder beside it. The zip is the honest scan, and it's what you download.

Not good enough for you? Fair. Run it from source — no packed binary, every line readable.

Verify the download

Get-FileHash nudl-0.1.0-win64.zip -Algorithm SHA256
# 96d640071927403ae992e2647d106238621f23e526b5b554df1006028b3c4261

SmartScreen's warning means it doesn't recognise the publisher — not that it found anything. Code signing is on the roadmap.

Known limits

• Windows only (11; 10 best-effort).
• No network un-shortening of bit.ly / t.co — that would leak your link and can burn one-time URLs. They're returned unchanged.
• Redirect wrappers that carry their own ?token= (some out.reddit.com links) are left alone rather than half-rewritten. Safe, but they won't unwrap.

Requirements

Windows 11. No Python needed — everything is bundled.