v0.4.0

Added

• RABBIT can now install REAPER language packs, so REAPER itself speaks
  your language rather than only RABBIT's wizard. Two are available to
  start with, both of which also translate the SWS extension: Spanish,
  maintained by Javier Robledo for the Spanish REAPER community, and
  German, maintained by MrData in the REAPER Stash. The pack matching the
  language RABBIT is running in is suggested and ticked for you (a Mexican
  Spanish system gets the Spanish pack); packs for other languages are
  listed but left unticked, and nothing is offered in English because
  REAPER is already English. By default RABBIT also sets the pack as
  REAPER's language, so you don't have to find it under Options,
  Preferences, General — untick that step if you only want the file. Only
  one language pack can be active, so installing one removes the previous
  one RABBIT installed; a pack you put in the LangPack folder yourself is
  never touched. They appear under their own Language packs heading in
  the package list. Language packs are published without version numbers,
  so RABBIT identifies them by what the server reports about the file (its
  ETag, or last-modified date and size, falling back to the file's
  contents) and offers an update when the translator publishes a new one —
  no RABBIT release needed. Spanish additionally offers a choice of OSARA
  translation — REAPER Accesible español (the default) or Team PMA —
  which OSARA picks up from the pack's file name. Choose it from the
  Spanish OSARA translation dropdown on the packages page (or
  --package-variant langpack-es=pma on the command line); your choice is
  remembered, so a later update keeps the translation you picked instead of
  reverting to the default, and switching cleans up the old file. Suggested
  by Carlos Esteban Martínez (#19).
• RABBIT now speaks Spanish. The translation was contributed by Carlos
  Esteban Martínez (#19) and is picked automatically on Spanish systems —
  including regional variants, so an es-MX machine gets the Spanish UI —
  or from the language picker at any time.
• Windows: the wizard now adds a Microsoft Defender exclusion for RABBIT's
  own download cache folder (%TEMP%\rabbit-cache) so freshly built,
  low-prevalence — but code-signed — installers, chiefly OSARA's
  development snapshots, aren't quarantined as false positives mid-install.
  It's scoped to that one folder (never all of %TEMP%), added once under a
  single administrator prompt, and skipped without prompting on later runs
  once present. RABBIT never turns real-time protection off, and if the
  prompt is declined or blocked by policy/Tamper Protection the install
  proceeds anyway (a real block still shows the "allow it in Protection
  history" guidance). The command-line tool is left untouched so it stays
  non-interactive for unattended/CI use.
• The packages page's details pane now answers "what's new?": REAPER and
  SWS show the newest section of their official changelogs, ReaPack shows
  its release notes, and OSARA shows the latest snapshots' list of changes
  — the feed OSARA's own updater reads, lightly cleaned for listening
  rather than reading: developer-facing "dev:" commits are skipped,
  repeated chore lines are collapsed, and trailing GitHub issue/PR
  references are stripped. The notes are fetched together with the online
  version check under a localized heading; packages whose feeds carry no
  real notes (rolling snapshot releases) don't declare a notes source, and
  if notes can't be fetched the pane simply keeps its usual contents. (#4)

Changed

• The check for the latest versions now runs several packages at once
  instead of one after another, so it finishes in roughly the time of the
  slowest single check rather than the sum of all of them. The status line
  reports "Checking versions… (3 of 11)" as they complete, so it keeps
  moving even while a slow check is still running — previously a language
  pack, whose check has to look at the file itself, could leave the
  progress bar sitting still for several seconds.
• A single package failing no longer aborts the whole install. RABBIT now
  records the failure, keeps installing every other selected package, and
  reports what succeeded and what failed at the end (the wizard's result
  page shows "Finished with errors"; the CLI still exits non-zero). The one
  exception is dependencies: packages install into REAPER, so if REAPER
  itself fails, its extensions (OSARA, SWS, ReaPack, ReaKontrol, the JAWS
  scripts, FFmpeg) are skipped with a "REAPER didn't install" note rather
  than being installed into a broken or absent REAPER. Standalone extras
  (Surge XT, app2clap) are unaffected by a REAPER failure. Dependencies are
  declared per package in the manifest (depends_on), and a dependency
  that isn't part of the current run (installing an extension into an
  already-present REAPER) never gates anything.
• macOS self-updates now replace the whole RABBIT.app bundle with the
  release's notarized bundle, instead of swapping just the executable inside
  it. The app keeps its original Apple-verified (Developer ID + notarized)
  signature across updates, so Gatekeeper stays satisfied without any
  workarounds and macOS permission grants (such as Full Disk Access, which
  are tied to the app's signature) survive updates instead of needing to be
  granted again. The previous bundle is kept next to the app as
  RABBIT.app.rabbit-old for manual rollback, and a renamed app keeps its
  name. Requires an updater that already has this change, so the first
  bundle-swap update is the one after this release; installs outside an
  .app bundle and Windows keep the existing binary swap.

Fixed

• Windows: when antivirus software blocks a package, RABBIT now says so and
  explains how to continue, instead of failing with a raw
  "I/O error … (os error 225)". Microsoft Defender occasionally flags a
  legitimately code-signed third-party installer it hasn't seen widely yet —
  OSARA's development snapshots, rebuilt on every change, are the usual case —
  and quarantines it mid-install. The new message states that this is
  typically a false positive, that the installer is signed and RABBIT had
  already verified the download against the publisher's checksum, and walks
  through allowing the
  item under Windows Security → Virus & threat protection → Protection
  history (or excluding RABBIT's download folder, or installing that one
  package by hand). The steps also appear in your own language on the
  wizard's result page, and the README gained a matching section. RABBIT
  does not, and will not, switch your virus protection off.
• macOS: Cmd+Q (and the application menu's Quit item) now quits RABBIT.
  The wizard installed no menu bar at all, so macOS had no functional
  Quit item to offer and Cmd+Q was a dead key. RABBIT now installs a
  minimal menu bar on macOS whose stock Quit item lands in the
  application menu as usual; quitting this way behaves exactly like the
  window's close button.
• macOS: RABBIT no longer refuses to launch after a self-update. Updating
  replaces the binary inside RABBIT.app and re-signs the bundle with a
  local (ad-hoc) signature — but the bundle still carried the quarantine
  marker from its original download, so on the next launch from Finder or
  the Dock, Gatekeeper re-checked it, no longer found the notarized
  signature it had originally approved, and blocked the app with "RABBIT
  could not be opened" (the relaunch right after updating worked because it
  bypasses that check). The self-update now clears the quarantine marker
  from the whole bundle after re-signing, so subsequent launches work
  normally. Anyone already affected can fix their copy by running
  xattr -dr com.apple.quarantine /path/to/RABBIT.app in Terminal once (or
  re-downloading the release).
• Pressing Enter on the wizard's final Done page now activates Close.
  Enter already triggered each step's primary button, but the Done page left
  the disabled Next button as the default, so Enter did nothing there.
  Close is now the default button on that page, and Enter is additionally
  re-routed from the read-only summary and details text boxes — which
  otherwise swallow the key — so it works from the control the screen reader
  is parked on when the page opens. Enter still does nothing while an install
  is running.