Skip to content

ljaspNotch v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Oct 19:00
· 22 commits to main since this release
v1.0.0
afce246
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Update check against GitHub Releases at launch and once a day, with an optional pre-release channel and a menu bar item when a newer version exists.
  • Copy Diagnostics in Settings > General for bug reports, without tokens, paths or personal data.
  • Optional haptic tap when the panel opens.
  • Manual test checklist in docs/manual-tests.md.

Changed

  • Panel polish: content materializes from a slight blur, a hairline edge, hover and press feedback on every control, animated tab and pin symbols, and an album-art glow on the media card.
  • Artwork is decoded once per track off the main thread.
  • README rewritten for the first stable release.

Security

Fixes from an independent security review:

  • Claude Code hooks now reach the app through a Unix socket in a folder only your account can open, using command hooks with curl, instead of HTTP on a TCP port. Another user or a sandboxed app could otherwise have taken the port while the app was closed and approved commands. Update the hooks in Settings > Claude Code.
  • The permission card shows the full request, makes control, direction and zero-width characters and long space runs visible, offers no Allow button for suspicious requests, and arms its buttons only after a short delay.
  • The extension socket accepts only the ljaspNotch extension (fixed extension ID) and closes on anything but a valid hello; the extension keeps the token away from content scripts.
  • Both local servers restart after a failure.
  • The hook installer recognizes only its own entries, resolves symlinks, refuses to touch a settings file it can't read, keeps backups private and masks the token in the diff.
  • The token is copied as concealed and cleared from the clipboard after a minute.
  • Artwork is fetched only from Spotify and YouTube image hosts, streamed with a size cap.
  • Release builds run without write access; only the publish step can write. FlyingFox and all actions are pinned to commits; checkout without persisted credentials; Dependabot for actions.

Installing

The app is ad-hoc signed and not notarized, so macOS warns on first launch.
Move it to Applications, then either allow it in System Settings > Privacy & Security > Open Anyway, or run:

xattr -dr com.apple.quarantine /Applications/ljaspNotch.app

SHA-256

57669682a9750a223f715a2892272227535710c7fc2e70d255ee93f182541569  ljaspNotch-chrome-extension-v1.0.0.zip
6510f594571fba1c0f00551c0450b9a4ec1404269acc7ff868f822d5c3f9e52b  ljaspNotch-v1.0.0.zip
Assets 5
Loading