v0.5.5

v0.5.5

Released 15 August 2026

Steam Decks now update themselves. Until this release the Linux agent was the one machine in the
fleet that could never be current without someone SSHing into it — which, on a device you use by
picking it up and pressing play, meant it usually wasn't.

Also in this release: games that Steam Cloud does not actually back up stop being hidden from
Add games. There were more of them than anyone thought.

Nothing about how saves sync has changed, and no save data is touched by upgrading.

Before you upgrade

• The agents carry this release. Update them first.
• This is the last time you update a Steam Deck by hand. Download the newer tarball and re-run
  install.sh once more; from then on the agent keeps itself current.
• Windows agents update themselves once the installer is uploaded in Config → Agent updates.
• No database changes. Downgrading the container is a clean rollback.

Steam Deck: the agent keeps itself up to date

The server now hosts a package per platform — the Windows .exe and the Linux .tar.gz side by
side. Config → Agent updates has a row for each, and each can be uploaded or pulled from GitHub
independently. An older server keeps serving Windows agents exactly as before; nothing about an
existing setup changes until you put a Linux tarball in the new row.

A Deck checks every few hours. When a newer version is hosted it downloads it, verifies it against
the checksum the server published, unpacks it, and runs it once to confirm it starts and reports
the version it should be. Only then does it keep it — and it installs it the next time the agent
starts, not while you are using the device.

So: nothing changes underneath a running session, no game is ever interrupted, and you are not asked
a question the Deck has no way to show you. If you would rather not wait for a restart:

savelocker update

If an update goes wrong, the Deck fixes itself. The previous version is kept until the new one
has started successfully. A build that installs and then fails to start is rolled back automatically
and reported to this console — a Deck does not strand itself somewhere you would need a keyboard to
rescue it from.

You will see these under a machine's health:

• update.staged — a newer version is ready and goes in at the next start.
• update.failed — a package could not be used. Nothing was replaced; the machine still works,
  but it has quietly stopped updating, which is the sort of thing you would never otherwise notice.
• update.rolled_back — a version was installed here, did not start, and the previous one was
  restored. Do not roll that version out further until you know why.

To turn automatic installing off, set "AutoUpdate": false in the agent's config.json. It keeps
checking, so this console still tells you when a machine is behind.

Games Steam Cloud does not actually cover are no longer hidden

Add games hides titles Steam Cloud already backs up, which is the right default — there is no
point syncing what Valve syncs for you. The problem was how "already backed up" was decided: anything
installed through Steam was assumed to have Cloud.

Most Steam games do not. Of the 48,908 Steam titles in the save-location database, 14,340 have
Steam Cloud. The rest were being hidden from you as though something was looking after them.

SaveLocker now reads the per-game Cloud flag from the database instead of assuming it. Expect games
to appear in Add games that were not there before — those are games nothing was backing up.

Where the database has no entry for a title at all, the old assumption is kept, so this only ever
reveals games; it never hides one that used to be listed.

Release integrity

Every release now publishes SHA256SUMS-windows.txt and SHA256SUMS-linux.txt, and the Linux
tarball carries a build attestation tying it to the workflow run that produced it:

sha256sum -c SHA256SUMS-linux.txt
gh attestation verify savelocker-0.5.5-linux-x64.tar.gz --repo SkorcherX/SaveLocker

The agents' own update channel does not depend on either — the server computes its own checksum over
the bytes it stored, and an agent refuses anything that does not match. These are for the human doing
a manual install.

Also

• The Deck's systemd unit is hardened (NoNewPrivileges, PrivateTmp, ProtectSystem=full,
  a restricted set of address families, and a 0077 umask). install.sh installs the new unit.
• savelocker version prints the running version and nothing else.
• savelocker doctor reports whether an update is available.
• The agent window has an Updates section, and Game Mode says when an update is waiting.

Known issues

• The Game Mode update notice and the agent window's Updates section have not been exercised on real
  Deck hardware. Everything behind them has been, in the Linux test suite — what is unverified is how
  they look, not whether they are telling the truth.