Volt v0.4.0

[MikeRoss27]

Volt v0.4.0

[0.4.0] - 2026-07-19

Bug Fixes

• security: Backend hardening — IPC surface, rate limits, CSP, devtools
• security: Sync — re-validate every remote row + premium gate via JWT claim
• ci: Vitest @ alias + drop runtime-version targets from sync-version
• ci: Rustfmt + clippy compliance + e2e tests aligned to v0.1.2 UI
• rust: Gate UWP regex behind target_os = "windows"
• capabilities: Grant settings window index/scan permissions
• onboarding: Hide main window at cold start until ready
• types: Drop unreachable File branch in ResultItem icon fallback
• rust: Full security, correctness, and performance audit
• rust: Fix C1 blocking sleep + H1 missing AbortHandle (audit follow-up)
• rust: M1/M3/M5 — blocking I/O in async, polling loop, HMAC domain separation
• window: Eliminate transparent-window flash on hot-toggle and cold-start
• review: Add ignoreRestSiblings + first-session Rust fallback
• clippy: Collapse nested if-let in invalidate_index
• auth: Strip stale legacy-implicit rustdoc from handle_auth_deep_link
• search: Gate setShowSnowEffect inside stale-id guard in isAppBrowseQuery path
• lifecycle: Cleanup indexing listener on settings-changed effect unmount
• security: Block LOLBIN via quicklink command type + regression test
• security: Replace string-prefix SSRF check with parsed Ipv4/Ipv6 enum check
• category: Align AppCategory Rust→TS — lowercase strings, extended enum, cross-validate test
• indexer: RAII IndexingGuard prevents is_indexing stuck on abort
• system-monitor: Offload blocking sysinfo calls to spawn_blocking
• launch: Unify all launch paths with as_admin support and history recording
• doctest: Add missing use import to fuzzy_match doctest
• extensions: Follow HTTP redirects when downloading
• extensions: Create parent dirs before unpacking tar entries
• extensions: Increase Worker match() timeout to 8s for network extensions
• sandbox: Use defineProperty to block getter-only Worker globals
• security: Harden extension sandbox — H2 OAuth token isolation, M1 prototype freeze, M3/M9 importScripts lockdown
• rust: Clippy 1.95 errors + cargo fmt drift + download timeout
• notes: FTS5 triggers skip 'delete' for already-trashed rows
• react: Drop eslint-disable suppressions, fix hook deps and render purity
• capabilities: Drop debug-only allow-embeddings-test, wire extension prefs/secrets/oauth in settings window
• ui: Wire note + extension icons into default suggestions and settings nav
• settings: Use emojis_icon.svg for Emoji & Symbols sidebar entry
• custom-emojis: Use /v1/predictions for community model (Replicate 404)
• ui: Column-of-words bug in empty states (recurrent pattern)
• css: Move legacy --spacing-* tokens out of @theme to restore Tailwind max-w-* scale
• custom-emojis: Repair generation chain, clipboard copy + image display
• security: SSRF redirect, archive bombs, path traversal, token leaks
• safety: Icon GDI guards, steam W-API, system_monitor sleep, paste race
• quicklinks: Gate test-module super import to Windows
• ci: MacOS clippy + Windows vitest CRLF regressions
• appearance: Restore Mica/Acrylic CSS dropped during commit split
• Misc small fixes and test updates
• security: Patch linkify-it ReDoS and enforce overrides via workspace
• Resolve merge conflicts with main + fix clippy warnings
• Update release dependencies and restore CI
• Preserve Linux launcher error contracts
• Keep generated bindings reproducible

CI

• Bump Node to 22 for pnpm 11.7 toolchain

Documentation

• Lint guardrails in CLAUDE.md, README polish, updater key custody, audit notes
• Mark C1 and H1 as fixed in audit doc
• Sync audit statuses for all fixes from 792b1c3
• Mark M1/M3/M5 as fixed in audit doc
• security: Mark P1, P3, P4, P9 as fixed in audit doc (39fc26e)
• security: Document A1-A6 second audit findings
• Agent memory snapshots, dev portal architecture, release checklist
• security: Document glib 0.18.5 as accepted risk
• Refresh top-level docs to reflect v0.2.0 codebase
• refonte: Mark Vague 3.2 catch-up done; record 80%-already-built finding
• Reorganize — archive historical material, group active refonte
• Replace bun commands with pnpm in living docs
• Add TODO for Volt 2026 refonte with detailed task tracking and milestones

Features

• security: Split capabilities per-window + register IPC commands with ACL
• extensions: 100% secure token architecture — token never leaves Rust
• notes: Tiptap-based notes app with SQLite/FTS5 backend
• ai: AI chat, profile, quick actions, custom emojis, local embeddings
• extensions: Developer portal, extension storage/OAuth/system APIs
• ui: Wire note icons + create extension management icons
• ui: Redesign extension icons + fix SignInRequired layout
• vague2: Add IPC codegen+timings (F1/F2) + blueprints & scaffolds for Piliers C/D (#118)
• indexer: Land unprivileged USN reader + enumeration bench (D3 NO-GO on data)
• indexer: Offline catch-up reconcile for stale file index (Vague 3.2)
• search: Searching-state indicator + named icon fallbacks
• appearance: Native window materials — Mica/Acrylic transparency
• Global snippet expansion engine (Pilier E1)
• indexer: Offline catch-up follow-up (Vague 3.2 continued)
• AI chat overhaul — multi-turn, tools, structured outputs, reasoning, local models
• calculator: Add quick-action shortcuts
• Native notifications for indexing, app dedup, shortcut icons in settings
• Ship pnpm toolchain, AI chat, snippets and indexer follow-ups (#123)
• Expand search and extension runtime

Other

• tooling: Strict ESLint config + Vite manual-chunks anchored matches
• lint: Clean src/app + src/pages scope (40 warnings → 0)
• lint: Clean src/features scope + ship update v2 enhancements (155 warnings → 0)
• lint: Clean components + shared + stores + test scope (40 warnings → 0)
• merge: Merge main into dev — resolve conflicts for PR chore(release): v0.1.7 #92
• cleanup: History spawn_blocking, delete dead hooks/safeInvoke, console→logger
• core: Wire Notes/AI/developer features into app shell
• merge: Resolve origin/main into release/v0.2.0
• merge: Resolve origin/main into release/v0.2.0
• Update NSIS installer banner
• Finalize release follow-ups
• Update workflows, docs, and package config

Performance

• Eliminate hot-path allocations (P1, P3, P4, P9)
• Hot-path scanner, matcher buf reuse, top-K BinaryHeap, regex Lazy

Refactoring

• frontend: Lint compliance + extension i18n bridge + typed IPC
• Sprint 1 quick-wins + refonte vague 1 (frecency, clipboard, IPC codegen, typed events) (#117)
• plugins: Manifest-driven single-source-of-truth activation

Styling

• rust: Apply cargo fmt to fix CI format check
• Cargo fmt drift in indexer/usn and related modules
• Format keyboard e2e test

Testing

• types: Add Rust↔TS contract tests for FileInfo/FileSearchResult/PluginResultData
• Expect refresh_index_if_stale in useAppLifecycle invoke sequence
• Align search e2e fixtures with current settings
• Make page navigation assertion result-aware

Security

• Strip tokens from IPC boundary (A1) + fail-closed containment (A2)
• Fix A3-A6 (import cap, oauth validation, dev-state fail-closed, token zeroize)

[0.1.2] - 2026-05-03

Bug Fixes

• launch: Tighten UWP regex, apply LOLBIN check before split
• launcher: Refuse executable types in open_path
• launcher: Reject UNC and .lnk in open_file_with_dialog
• snippets: Cap import JSON size and snippet count
• indexer: Cap windows_search query length
• oauth: Demote state log to debug, host check on deep-link
• extensions: Clear pending map on worker timeout
• extensions: Reject numeric IPv4/IPv6-mapped hosts in isUrlSafe
• extensions: Block redirect SSRF in worker fetch proxy
• extensions: Fail-closed on signature mismatch + permission allowlist
• shell: Harden execution surface (H6, H7, M5, M6, M7)
• auth: Bind volt://auth/callback to state nonce, validate JWT claims
• credentials: HMAC integrity tag on keyring entries (M10)
• deeplink: Rate-limit + log forensic trail on single-instance forwards (H9)
• clippy: Clear -D warnings on launcher/windows_search/lib
• oauth: Point GitHub/Notion init at new /start route on the website
• auth: Accept both PKCE and legacy implicit callbacks

Features

• credentials: Add test_credential Rust command (token never in renderer)
• auth: Verify Supabase JWT signature against project JWKS (ES256)
• auth: PKCE code exchange replaces token-in-URL deep link
• V0.1.2 — Cloud Sync preview, onboarding, system monitor, UI migration

---

Installation

Platform	Download
Windows	volt_*_x64-setup.exe (recommended) or .msi
macOS Intel	volt_*_x64.dmg
macOS Apple Silicon	volt_*_aarch64.dmg
Linux	.deb, .AppImage or .rpm

Full changelog: CHANGELOG.md

Auto-updates are enabled for existing installs.

---

This discussion was created from the release Volt v0.4.0.