v2.0.0

2.0.0 (2026-10-27)

⚠ BREAKING CHANGES

• host-link: require ephemeral pairing and physical approval
• highboy: the integrated P4 uses the legacy High Boy partition map, not stock dev offsets. C5 requires IDF 6.0.1 and protocol v8; P4 uses IDF 5.5.3. Generic flashing and automatic full-firmware release remain gated pending a reviewed migration package.
• spi: P4 and C5 must use matching protocol v8 firmware. This is part of the integrated High Boy series; intermediate commits are not standalone releases.

Features

• app-abi: BLE subsystem (tos_api_ble), companion RES_BLE reservation, and resource_lost() notification (fefc50f) - @anarchyysm
• app-abi: curated typed WiFi subsystem (api->wifi) and ABI-extension pattern (8dc8d06) - @anarchyysm
• app-abi: reserve typed radio ABI contracts (subghz/ir/nfc/rfid/lora) (14e3224) - @anarchyysm
• app-runtime: configure production app-signing public key (1fa0778) - @anarchyysm
• app-runtime: publish decoded infrared in the native and script ABI (405a62f) - @anarchyysm
• app-runtime: publish native NFC and RFID discovery through the shared ABI (555742e) - @anarchyysm
• app-sdk: add a native RF discovery example (568c97b) - @anarchyysm
• app-sdk: PC tooling to build, sign and package .hb apps (41ee0d1) - @anarchyysm
• app: .hb icon and title metadata plus ELF loader updates (202f380) - @lthiagovs
• app: on-device UI, image widget and read-only fs subsystems (fd58864) - @lthiagovs
• apps: expose bounded Sub-GHz capture and raw transmission in ABI 1.13 (aee29a1) - @anarchyysm
• apps: expose bounded Sub-GHz spectrum capture in ABI 1.15 (ee6d4be) - @anarchyysm
• apps: expose queued native LoRa text through ABI 1.14 (363ad02) - @anarchyysm
• apps: native signed-app platform (ELF loader, tos_api ABI, capabilities, lifecycle, Apps UI, host_link ops) (65fb625) - @anarchyysm
• apps: publish bounded native Sub-GHz and LoRa observations (91d06d7) - @anarchyysm
• audio: WAV recorder with dedicated screen and levels (5e2272b) - @lthiagovs
• badusb: route DuckyScript over Bluetooth HID with a target selector (2dc9e02) - @lthiagovs
• battery: decode real bq25896 adc telemetry and add battery diag (1f5a962) - @lthiagovs
• bluetooth: expose bounded remote GATT discovery and reads on C5 (81ab683) - @anarchyysm
• c5: add an SPI reboot helper and wire the console (47a5941) - @lthiagovs
• companion: add X25519 pairing and authenticated response checks (a18fbe7) - @anarchyysm
• console: add 'c5 reboot' and rename the P4 'restart' command to 'reboot' (9541c0d) - @anarchyysm
• console: add subghz, audio and led console commands (7e0923e) - @anarchyysm
• fatfs: vendor fatfs with exFAT enabled and a force-exFAT format (87fff07) - @anarchyysm
• games: retain Game Boy controls, covers and local 3D scene (108e77a) - @vinibit-high
• gpio: add gpio_header driver for the external header (d5eacf9) - @lthiagovs
• gpio: rebuild the GPIO screen as a live pin inspector (10834b3) - @lthiagovs
• host_link: add p4-local badusb, lora, config and theme handlers with a larger file-read chunk (e4ed20f) - @lthiagovs
• host_link: expose P4-native IR, Sub-GHz, audio and LED over the companion link (0bd641a) - @anarchyysm
• host-link: add bounded native NFC and RFID capture commands (5927bba) - @anarchyysm
• host-link: require ephemeral pairing and physical approval (e822208) - @anarchyysm
• ir: add library browsing and validated file playback (a9cfb80) - @vinibit-high
• ir: brand-aware AC state-frame remote and cleaner tv/sound layouts (6eda4f3) - @lthiagovs
• ir: browse bundled remote codes alongside the SD library (50da130) - @anarchyysm
• ir: bundle universal tv/audio/ac db (ea94477) - @lthiagovs
• ir: decode captured AC frames on receive and show the state (3131a23) - @lthiagovs
• ir: expose bounded raw file and AC operations through the shared ABI (9b3bbd2) - @anarchyysm
• ir: parse IR files into PSRAM to fit large universal libraries (0b2488b) - @lthiagovs
• lora: add owned raw and mesh sessions with acknowledged radio teardown (5c4fd20) - @anarchyysm
• lora: expose copied mesh nodes through the shared app and script ABI (6d3ce5e) - @anarchyysm
• lora: integrate Meshtastic MQTT publication and subscribed chat (0132fb5) - @anarchyysm
• lora: retain radio laboratory and controller fixes (d6ec048) - @vinibit-high
• mqtt: add a bounded C5 client and paired SPI transport (bb0ec8a) - @anarchyysm
• muse: integrate pairing, physical PTT and repeatable voice-note sessions (9312be6) - @vinibit-high
• nfc: add owned app emulation and retain antenna ownership through teardown (595035e) - @anarchyysm
• nfc: preserve APDU tools, tag operations and ST25 hardware integration (3c1a389) - @vinibit-high
• nfc: replace read screen mock with real st25r3916 capture (a92cb1c) - @lthiagovs
• nfc: share verified Classic block access across apps scripts and companion (c907147) - @anarchyysm
• ota: export verified paired SD candidates with build evidence (9bf1220) - @anarchyysm
• radios: arbitrate WiFi/SubGHz/IR/BadUSB and reclaim app radios via resource_mgr (f7faeda) - @anarchyysm
• recovery: prepare private paired restore review bundles offline (53788e9) - @anarchyysm
• resource-mgr: add exclusive-radio arbitration layer and resources console command (4b475af) - @anarchyysm
• resource-mgr: bounded-wait acquire and mid-start preemption guard (cdd8997) - @anarchyysm
• resource: add a display resource for app screen leases (69c2d14) - @lthiagovs
• rfid: retain native LF front end and diagnostic controls (4791cda) - @vinibit-high
• rfid: wire read view to the rfid_manager read pipeline (1a5fb9e) - @lthiagovs
• scripts-ui: approve ABI permissions and preserve display ownership (c8be177) - @anarchyysm
• scripts: add bounded JavaScript and Lua execution engines (308a479) - @anarchyysm
• scripts: bind bounded Sub-GHz receive and raw transmission (2229f22) - @anarchyysm
• scripts: bind bounded Sub-GHz spectrum capture (7d12860) - @anarchyysm
• scripts: bind native Sub-GHz captures and LoRa chat history (e10ba68) - @anarchyysm
• scripts: bind queued LoRa mesh text with TX approval (91b6e18) - @anarchyysm
• scripts: expose NFC emulation and LoRa session lifecycle in JS and Lua (9fbbd97) - @anarchyysm
• scripts: expose owned Sub-GHz session lifecycle in JavaScript and Lua (a3c00ce) - @anarchyysm
• scripts: share native firmware ABI with JavaScript and Lua (8909953) - @anarchyysm
• sdcard: real format, measured health speeds, and sd console command (b435ebe) - @anarchyysm
• security: verify external factory signatures and test real image encryption (ab804ef) - @anarchyysm
• spi_bridge: hash-gated P4-to-C5 config cache (push-on-change at boot) (1977e4d) - @anarchyysm
• spi_bridge: wire the remaining Bluetooth commands on the C5 (84b9607) - @anarchyysm
• spi_bridge: wire WiFi port scan, MAC and IP handlers on the C5 (521e3f5) - @anarchyysm
• spi: add badusb, lora, config, theme and detailed-scan ids for the companion (88aadd1) - @lthiagovs
• subghz: add GateTX and Holtek_HT12X fixed-code protocols, document TODO tail (59ee80b) - @anarchyysm
• subghz: add owned RX and spectrum sessions with automatic teardown (d5198ee) - @anarchyysm
• subghz: expose complete bounded raw captures through the shared ABI (a22dce1) - @anarchyysm
• subghz: fixed-code TX for 7 protocols with shared encode framework and selftest (f8c151e) - @anarchyysm
• subghz: KeeLoq UNKNOWN + SECURE decode and AERF variants (110/116 keys) (4e2dd56) - @anarchyysm
• subghz: KeeLoq/HCS301 rolling-code module, mfcodes asset, and selftest (1f3dfd3) - @anarchyysm
• subghz: port Momentum KeeLoq vendor key-derivation schemes (103/116 keys) (c319b0f) - @anarchyysm
• subghz: replay validated capture files through the shared RF worker (ff4574c) - @anarchyysm
• subghz: wire KeeLoq into the capture/decode/replay pipeline with rolling-code TX (0007b9c) - @anarchyysm
• theme: apply the selected theme by rebooting (4c9303c) - @lthiagovs
• tools: add guarded app-only updates for P4 and C5 (645b217) - @anarchyysm
• tools: add unified host-link command tester (cli.py) (0870ac1) - @anarchyysm
• ui: app launcher rendering the embedded icon and title (7b27b88) - @lthiagovs
• ui: C5 status actions and the live C5 console viewer (f8ae5fd) - @lthiagovs
• ui: connect the GATT explorer to real C5 discovery and reads (7aaae6b) - @anarchyysm
• ui: list sd custom themes in the theme selector (fc419fb) - @lthiagovs
• ui: make back the only key to go back, drop left-as-back (be6a046) - @lthiagovs
• ui: override theme assets per theme from the sd card (33e9946) - @lthiagovs
• ui: refine launcher, settings and offline Grok animation (402194c) - @vinibit-high
• ui: register the app and C5 console screens (d72ee85) - @lthiagovs
• ui: run JavaScript and Lua from a dedicated Scripts screen (daf7e01) - @anarchyysm
• wifi: --common-ports scan sourced from SD or flash common_ports.txt with a built-in fallback (c6ab90c) - @anarchyysm
• wifi: add a detailed ap scan for the companion link (118c5a3) - @lthiagovs
• wifi: add bounded quick scan capture over paired SPI (91f63bf) - @anarchyysm
• wifi: add ESP scan screen with OUI and RSSI ranking (bac1451) - @anarchyysm
• wifi: evil portal captive detection (DHCP opt114 + DNS/HTTP funnelling, WiFi/LWIP buffers to PSRAM) (ea5f841) - @anarchyysm
• wifi: retain live dual-band scans and packet analysis (1d95c03) - @vinibit-high

Bug Fixes

• app-runtime: bind shared ABI contexts safely for script callers (dfca89c) - @anarchyysm
• app-runtime: quiesce the SPI bridge before force-killing an app to avoid mutex corruption (158a0f2) - @anarchyysm
• app-sdk: report bundle sizes portably on macOS and Linux (a32787d) - @anarchyysm
• app-sdk: retain license notices in generated trust headers (a30f03e) - @anarchyysm
• apps: clean suspended app ownership before releasing task identities (5dda671) - @anarchyysm
• apps: replace simulated scripts with the native app launcher (b7386f9) - @anarchyysm
• audio: bound boot MP3 work and serialize I2S playback cleanup (b37af0d) - @anarchyysm
• battery: remove routine background telemetry logs (17f283c) - @anarchyysm
• ble: read HID SPI responses via the status return, not resp_buf[0] (731a4d4) - @lthiagovs
• bluetooth: preserve HID mouse controls and service ownership (c3fcf60) - @vinibit-high
• bluetooth: remove synthetic GATT readings and document native services (cee87c2) - @anarchyysm
• bt: bring the BLE host up before HID init so BadBLE does not crash on a torn-down stack (0a07548) - @anarchyysm
• c5: keep the log vprintf hook stack-light so wifi connect does not overflow the event task (b06cad3) - @anarchyysm
• ci: trust the checked-out workspace in IDF build containers (3ddcf2a) - @anarchyysm
• console: preserve editing keys during rapid UART input (49f02b7) - @anarchyysm
• core: integrate resource ownership and device console controls (1f74481) - @vinibit-high
• doom: render with reusable internal DMA strip buffer (b81f21b) - @anarchyysm
• headers: add include guards and C++ linkage to public interfaces (a41e70e) - @unknown
• hle: implement ESP ROM CRC compatibility with golden frame tests (2b7614d) - @vinibit-high
• host_link: drain the cdc rx fifo so config writes are not dropped (d51492e) - @lthiagovs
• host_link: remove directories via rmdir in the file delete op (6ec26ec) - @lthiagovs
• host-link: retain authorization and streaming safeguards (6123d68) - @vinibit-high
• integration: refresh reviewed node database correction seal (777d2ce) - @anarchyysm
• ir: correct NEC-ext, Sony bit-length, RCA carrier and Kaseikyo encoding (45e2a2c) - @lthiagovs
• ir: reserve app operations on the persistent worker and retain failed cleanup (f6f84c1) - @anarchyysm
• lora: compare protobuf byte bounds with unsigned types (778e3b8) - @anarchyysm
• lora: enforce shared airtime pacing before radio transmission (d27f93b) - @anarchyysm
• lora: queue copied chat text on native mesh poll tasks (238d325) - @anarchyysm
• lora: stop reporting simulated MQTT connections (956b149) - @anarchyysm
• lora: synchronize node snapshots and bound mesh receive parsing (db5f6e1) - @anarchyysm
• monitor: preserve panic diagnostics and require healthy boot progress (f09f5f5) - @anarchyysm
• muse: validate RPC inputs and recover worker allocation failures (80b6e41) - @unknown
• muse: validate text bounds and compile strict host tests with GCC (e2e52de) - @vinibit-high
• nfc: enable mbedtls DES so the Ultralight C auth links (01ed115) - @munzzyy
• nfc: retain RF reservations after failed field shutdown (1a227ac) - @unknown
• nfc: route legacy emulation to hardware and stop screen workers (9d470b0) - @anarchyysm
• ota: serialize P4 writes and propagate paired confirmation failures (27e1684) - @anarchyysm
• power: guard PM initialization and serialize USB and client wake holds (0d8d0b1) - @anarchyysm
• power: preserve charger policy and display brightness controls (ebe8f6d) - @vinibit-high
• recovery: preserve NVS and gate boot and reset completion on checked results (e60793d) - @anarchyysm
• recovery: retain boot-loop decisions and handle diagnostic storage failures (f4662b3) - @anarchyysm
• release: publish verifiable app-only candidates atomically (22a3e7a) - @anarchyysm
• rf_frontend: serialize shared antenna ownership claims (bb87cb2) - @unknown
• rfid: synchronize reader cancellation and result publication (4b47ddf) - @unknown
• rf: reserve the shared antenna for the owning task (86f147d) - @anarchyysm
• rnode: reject legacy UART transport on the P4 board (5addee7) - @anarchyysm
• scripts: honor Lua allocator guarantees under memory pressure (cfc01f5) - @anarchyysm
• scripts: preserve upstream Lua Makefile in clean checkouts (f7d1095) - @anarchyysm
• spi: add session validation and supervised DMA recovery (3c4a407) - @anarchyysm
• spi: echo stream command ID in C5 responses (7d1f5a3) - @anarchyysm
• spi: mirror P4-local app ops into the C5 spi_protocol copy to keep them in sync (6c402f2) - @anarchyysm
• spi: recover displaced Wi-Fi scan responses with CRC checks (8458b28) - @anarchyysm
• spi: retain paired protocol v8 and DMA transaction safeguards (2de98cb) - @vinibit-high
• storage_vfs: prevent MSC auto-remount and reduce DMA buffer usage (8230672) - @anarchyysm
• storage: preserve exFAT and safely drain USB MSC writes (a55591b) - @vinibit-high
• storage: reject oversized console, theme and BadUSB paths (dab196c) - @anarchyysm
• subghz: correct KeeLoq framing (8-bit disc + LSB-first reversal), validated against real captures (d6c9cbc) - @anarchyysm
• subghz: preserve signed pulse durations in host regressions (6b45290) - @anarchyysm
• subghz: reject truncated and malformed raw capture files (70ba266) - @anarchyysm
• subghz: retain native workers and reserve scoped CC1101 ownership (7ec91dd) - @anarchyysm
• subghz: retain RX ownership until RMT and DMA cleanup completes (ade5ad6) - @anarchyysm
• subghz: validate replay bounds and retain radio diagnostics (d179fee) - @vinibit-high
• sx1262: avoid invalid shifts for disconnected optional pins (8411983) - @anarchyysm
• ui: drop the about octobit ring and lift the content (a9e5803) - @lthiagovs
• ui: preload sd theme assets to psram and drop only changed assets from cache (236e8c1) - @lthiagovs
• ui: replace simulated P4 updates with native SD OTA (4cf7d45) - @anarchyysm
• ui: show actual SD filesystem and formatting activity (06c667f) - @anarchyysm
• wifi: parallel non-blocking port scan with live partial results, real banners and progress logs (e334002) - @anarchyysm
• wifi: start the radio before an app scan (61d682e) - @lthiagovs

Performance Improvements

• assets: warm SD asset overrides to avoid render-path SD reads (fe00a70) - @lthiagovs
• build: recover P4 crypto space while preserving opaque utility calls (c833ed9) - @anarchyysm
• doom: use bounded internal DMA display strips (c75a51d) - @vinibit-high
• games: size the Game Boy DMA strip to free internal RAM (ed8b783) - @lthiagovs
• mem: set SPIRAM always-internal threshold to 1024 (010cee5) - @lthiagovs
• spi-bridge: move the stream task stack to PSRAM and keep it persistent to avoid internal-RAM starvation (b14b8bb) - @anarchyysm

Build System

• highboy: wire portable dual-IDF prototype profile and CI (ac6327d) - @vinibit-high