MOKU v1.0.11

Changelog

All notable changes are documented here. The project follows Semantic Versioning.

[1.0.11] - 2026-07-26

Added

• Add exact pid: artwork lookup and uid: creator lookup while retaining exact-name author: search, with ASCII and full-width colon support.
• Add an explicit search cancel action backed by bounded request tracking and cancellation propagation through session waits, network reads, and result commits.

Changed

• Apply work type, AI, fuzzy, and safety filters only after the user submits the search form; filter changes no longer start large searches automatically.
• Bound Pixiv search traffic to four process-wide workers, cap fuzzy source expansion to the retained cache budget, and keep cancelled connection attempts from accumulating unbounded work.
• Reuse valid page-image capabilities for downloads even when an unused thumbnail capability was evicted, avoiding unnecessary artwork-detail refreshes.

Fixed

• Reject mismatched upstream artwork IDs, preserve cursor state across cancelled creator searches, and rebuild evicted deep-page sessions instead of returning empty pages.
• Preserve loaded detail pages and current previews across result, viewer, and basket transitions; update basket selections in place and resume failed download chunks without repeating completed batches.
• Keep mobile basket titles ellipsized inside their cards, and show the fixed pagination dock only while it overlaps the gallery without losing it on short result pages or return scrolling.

[1.0.10] - 2026-07-25

Security

• Linearize account connect, disconnect, and replacement so stale login work cannot restore a cleared session; bind R-18 image capabilities to the active authorization generation and return protected responses with no-store.
• Keep direct and TUN requests fail-closed by disabling implicit environment and Windows proxy bypasses, while accepting only explicitly selected loopback proxies.
• Stage downloads transactionally, recheck authorization before publication, and roll back every file and directory created by a failed or revoked task.

Changed

• Use the project-provided artwork as a multi-resolution Windows executable icon and bind both its source PNG and generated ICO into the release fingerprint.
• Limit active download tasks to two, reject saturation with HTTP 429, cap one-artwork downloads at 200 pages, and cache bounded author resolution results in a 64-entry five-minute LRU.
• Window large detail, continuous-viewer, and collection-basket renders to reduce DOM, image, and layout pressure while preserving current selections.
• Make the synthetic fixture gallery drive the complete interface for repeatable desktop and responsive-layout verification.

Fixed

• Recover expired preview capabilities once per failed URL with deduplicated refreshes and cooldown, without reusing stale tokens after logout or cache eviction.
• Prevent stale search, detail, logout, selection, and multi-request download state from overwriting the latest page or task context.
• Keep long remote labels, navigation, pagination, detail views, and basket controls usable down to 320-pixel-wide layouts.

[1.0.9] - 2026-07-22

Changed

• Replace the integrated batch panel with a consistent three-level collection basket: summary, artwork selection, and per-image selection.
• Allow any number of artworks within the existing 1,000-image basket limit and split large single artworks into bounded 200-image requests.
• Use compact artwork and image pickers, report search/basket cache state, and replace the bright ribbon treatment with restrained Saturn rings around the dark moon.

Fixed

• Build download payloads only from authoritative selected-page sets, so deselected preview images are never submitted.
• Freeze both basket selections and all download options for the lifetime of a multi-request task, including dynamically rebuilt controls.
• Return budget-limited partial search pages instead of hiding valid sparse results, and bound large-creator filtering to resumable request/time budgets.
• Abort stale detail requests and clear every basket view class on back, clear, normal-detail, and replacement transitions.

[1.0.8] - 2026-07-21

Fixed

• Restore the one-step batch workflow: opening batch download now selects the current page and shows the integrated artwork picker immediately.
• Preserve per-page selections and original search contexts while keeping result-card and batch-card state synchronized, including stale-detail response protection.

[1.0.7] - 2026-07-20

Fixed

• Reject junctions and other reparse points before canonicalization or publication, including those nested below the selected root, and remove every directory created by a failed publish.

[1.0.6] - 2026-07-20

Fixed

• Canonicalize user-selected download roots and final publication paths before containment checks, so equivalent Windows path aliases cannot produce false 502 responses or bypass the save-root boundary.
• Isolate threaded download-integrity test network seams and stabilize the publish-identity test path on hosted Windows runners.

[1.0.5] - 2026-07-18

Added

• Strict multi-tag AND search using ; or ； separators; spaces remain part of one tag.
• Optional bounded anime-oriented tag aliases, disabled by default.
• A collection basket for any number of artworks within a 1,000-image selection limit, with windowed page selection for large works.
• One-click select/clear controls for all artworks and images on the current result page.
• Image-first adaptive download chunks and optional artwork grouping.

Changed

• Save one search batch into a shared tag, author, or artwork context folder instead of creating one folder per artwork.
• Apply the same context-folder rule to single-artwork downloads.
• Restyle the interface with a restrained black-and-white lunar theme, a highlighted moon edge, and one clean orbital ring while preserving the existing workflow and startup budget.
• Keep result pagination docked to the viewport bottom while the gallery scrolls.
• Defer the collection retention decision until forward navigation would actually evict selected result pages.

Fixed

• Keep exact and alias-expanded search sessions in separate cache namespaces.
• Validate every multi-tag result against all requested tag groups after Pixiv response normalization.

[1.0.4] - 2026-07-17

Fixed

• Use Pixiv's current JSON /ajax/search/users?nick=... response for exact author: resolution, including both list and keyed user payloads.
• Do not expose the loopback request capability to headerless health probes; same-origin desktop/browser readiness checks now identify themselves explicitly.
• Return download paths relative to the selected save directory instead of leaking local absolute paths through the HTTP API.
• Reject malformed or negative remote Content-Length values before reading a Pixiv response.

[1.0.3] - 2026-07-17

Fixed

• Resolve exact author: queries through Pixiv's current /search/users page instead of the removed AJAX user-search route.
• Parse the bounded __NEXT_DATA__ user result set and keep exact creator-name and user-ID filtering.

[1.0.2] - 2026-07-17

Added

• Exact Pixiv creator search with pid: / pid： and author: / author： queries.

Fixed

• Parse Pixiv's nested userPreviews[].user response before exact author-name matching.
• Reject works whose userId does not match the resolved creator.
• Replace overlapping absolute-positioned deck cards with a non-overlapping flex row.
• Reduce pointer preview travel and keep every other card stationary while one card is locked.

[1.0.1] - 2026-07-16

Fixed

• Restored Windows PowerShell module discovery in -NoProfile CI subprocesses while preserving fail-closed Python Authenticode verification.
• Preserved the vendored proxy-tools license byte hash across Windows and CI checkouts with explicit LF normalization.
• Updated pinned GitHub Actions to Node.js 24-compatible major versions.

[1.0.0] - 2026-07-16

Added

• Windows pywebview/WebView2 desktop host with a second official Pixiv login window.
• Public, R-18, and combined search scopes with multi-tag OR aggregation.
• Bounded historical search, paging prefetch, sliding cache eviction, and selective batch download.
• Native folder selection, offline usage guide, and anonymous parallel network diagnosis.
• Portable PyInstaller build, release ZIP generation, SHA-256 manifests, and Windows CI.
• A fail-closed build manifest binding source/build inputs to every portable-package file.

Security

• Loopback host, Sec-Fetch-Site, and same-origin checks for every API GET.
• Per-process request tokens for every non-health API request; image URLs use separate high-entropy capabilities.
• Strict Content Security Policy and same-origin resource headers on local HTTP responses.
• Bounded JSON-object parsing for mutating requests.
• Explicit Pixiv/API/image host allowlists and loopback-only proxy selection.
• Query parameters, cookies, request bodies, and image tokens excluded from HTTP logs.
• Content-derived backend generation IDs prevent a new client from reusing stale code.
• Test-only synthetic gallery routes disabled by default.
• Release generation rejects stale source, changed licenses, modified support files, linked or undeclared files/directories, non-Windows-x64 product artifacts, missing pywebview loader runtimes, unlocked top-level package metadata, and archives that fail round-trip verification.
• Runtime and build dependencies are locked to verified artifact SHA-256 values; the legacy proxy-tools source is reproduced as an audited deterministic local wheel.
• Build and release validation use a signed CPython 3.12 executable, a shared exclusive mutex, source rechecks, and schema 3 full file/directory manifests.

Changed

• Replaced the legacy external Edge --app host with pywebview/WebView2....

MOKU v1.0.10

Changelog

All notable changes are documented here. The project follows Semantic Versioning.

[1.0.10] - 2026-07-25

Security

• Linearize account connect, disconnect, and replacement so stale login work cannot restore a cleared session; bind R-18 image capabilities to the active authorization generation and return protected responses with no-store.
• Keep direct and TUN requests fail-closed by disabling implicit environment and Windows proxy bypasses, while accepting only explicitly selected loopback proxies.
• Stage downloads transactionally, recheck authorization before publication, and roll back every file and directory created by a failed or revoked task.

Changed

• Use the project-provided artwork as a multi-resolution Windows executable icon and bind both its source PNG and generated ICO into the release fingerprint.
• Limit active download tasks to two, reject saturation with HTTP 429, cap one-artwork downloads at 200 pages, and cache bounded author resolution results in a 64-entry five-minute LRU.
• Window large detail, continuous-viewer, and collection-basket renders to reduce DOM, image, and layout pressure while preserving current selections.
• Make the synthetic fixture gallery drive the complete interface for repeatable desktop and responsive-layout verification.

Fixed

• Recover expired preview capabilities once per failed URL with deduplicated refreshes and cooldown, without reusing stale tokens after logout or cache eviction.
• Prevent stale search, detail, logout, selection, and multi-request download state from overwriting the latest page or task context.
• Keep long remote labels, navigation, pagination, detail views, and basket controls usable down to 320-pixel-wide layouts.

[1.0.9] - 2026-07-22

Changed

• Replace the integrated batch panel with a consistent three-level collection basket: summary, artwork selection, and per-image selection.
• Allow any number of artworks within the existing 1,000-image basket limit and split large single artworks into bounded 200-image requests.
• Use compact artwork and image pickers, report search/basket cache state, and replace the bright ribbon treatment with restrained Saturn rings around the dark moon.

Fixed

• Build download payloads only from authoritative selected-page sets, so deselected preview images are never submitted.
• Freeze both basket selections and all download options for the lifetime of a multi-request task, including dynamically rebuilt controls.
• Return budget-limited partial search pages instead of hiding valid sparse results, and bound large-creator filtering to resumable request/time budgets.
• Abort stale detail requests and clear every basket view class on back, clear, normal-detail, and replacement transitions.

[1.0.8] - 2026-07-21

Fixed

• Restore the one-step batch workflow: opening batch download now selects the current page and shows the integrated artwork picker immediately.
• Preserve per-page selections and original search contexts while keeping result-card and batch-card state synchronized, including stale-detail response protection.

[1.0.7] - 2026-07-20

Fixed

• Reject junctions and other reparse points before canonicalization or publication, including those nested below the selected root, and remove every directory created by a failed publish.

[1.0.6] - 2026-07-20

Fixed

• Canonicalize user-selected download roots and final publication paths before containment checks, so equivalent Windows path aliases cannot produce false 502 responses or bypass the save-root boundary.
• Isolate threaded download-integrity test network seams and stabilize the publish-identity test path on hosted Windows runners.

[1.0.5] - 2026-07-18

Added

• Strict multi-tag AND search using ; or ； separators; spaces remain part of one tag.
• Optional bounded anime-oriented tag aliases, disabled by default.
• A collection basket for any number of artworks within a 1,000-image selection limit, with windowed page selection for large works.
• One-click select/clear controls for all artworks and images on the current result page.
• Image-first adaptive download chunks and optional artwork grouping.

Changed

• Save one search batch into a shared tag, author, or artwork context folder instead of creating one folder per artwork.
• Apply the same context-folder rule to single-artwork downloads.
• Restyle the interface with a restrained black-and-white lunar theme, a highlighted moon edge, and one clean orbital ring while preserving the existing workflow and startup budget.
• Keep result pagination docked to the viewport bottom while the gallery scrolls.
• Defer the collection retention decision until forward navigation would actually evict selected result pages.

Fixed

• Keep exact and alias-expanded search sessions in separate cache namespaces.
• Validate every multi-tag result against all requested tag groups after Pixiv response normalization.

[1.0.4] - 2026-07-17

Fixed

• Use Pixiv's current JSON /ajax/search/users?nick=... response for exact author: resolution, including both list and keyed user payloads.
• Do not expose the loopback request capability to headerless health probes; same-origin desktop/browser readiness checks now identify themselves explicitly.
• Return download paths relative to the selected save directory instead of leaking local absolute paths through the HTTP API.
• Reject malformed or negative remote Content-Length values before reading a Pixiv response.

[1.0.3] - 2026-07-17

Fixed

• Resolve exact author: queries through Pixiv's current /search/users page instead of the removed AJAX user-search route.
• Parse the bounded __NEXT_DATA__ user result set and keep exact creator-name and user-ID filtering.

[1.0.2] - 2026-07-17

Added

• Exact Pixiv creator search with pid: / pid： and author: / author： queries.

Fixed

• Parse Pixiv's nested userPreviews[].user response before exact author-name matching.
• Reject works whose userId does not match the resolved creator.
• Replace overlapping absolute-positioned deck cards with a non-overlapping flex row.
• Reduce pointer preview travel and keep every other card stationary while one card is locked.

[1.0.1] - 2026-07-16

Fixed

• Restored Windows PowerShell module discovery in -NoProfile CI subprocesses while preserving fail-closed Python Authenticode verification.
• Preserved the vendored proxy-tools license byte hash across Windows and CI checkouts with explicit LF normalization.
• Updated pinned GitHub Actions to Node.js 24-compatible major versions.

[1.0.0] - 2026-07-16

Added

• Windows pywebview/WebView2 desktop host with a second official Pixiv login window.
• Public, R-18, and combined search scopes with multi-tag OR aggregation.
• Bounded historical search, paging prefetch, sliding cache eviction, and selective batch download.
• Native folder selection, offline usage guide, and anonymous parallel network diagnosis.
• Portable PyInstaller build, release ZIP generation, SHA-256 manifests, and Windows CI.
• A fail-closed build manifest binding source/build inputs to every portable-package file.

Security

• Loopback host, Sec-Fetch-Site, and same-origin checks for every API GET.
• Per-process request tokens for every non-health API request; image URLs use separate high-entropy capabilities.
• Strict Content Security Policy and same-origin resource headers on local HTTP responses.
• Bounded JSON-object parsing for mutating requests.
• Explicit Pixiv/API/image host allowlists and loopback-only proxy selection.
• Query parameters, cookies, request bodies, and image tokens excluded from HTTP logs.
• Content-derived backend generation IDs prevent a new client from reusing stale code.
• Test-only synthetic gallery routes disabled by default.
• Release generation rejects stale source, changed licenses, modified support files, linked or undeclared files/directories, non-Windows-x64 product artifacts, missing pywebview loader runtimes, unlocked top-level package metadata, and archives that fail round-trip verification.
• Runtime and build dependencies are locked to verified artifact SHA-256 values; the legacy proxy-tools source is reproduced as an audited deterministic local wheel.
• Build and release validation use a signed CPython 3.12 executable, a shared exclusive mutex, source rechecks, and schema 3 full file/directory manifests.

Changed

• Replaced the legacy external Edge --app host with pywebview/WebView2.
• Replaced sequential port probing with Windows-assigned ephemeral loopback ports.
• Extracted synthetic test fixtures from the production HTTP module.
• Added bounded LRU artwork caching and safe refresh of expired image authorization.
• Synchronized artwork/image-capability state and revalidate in-flight R-18 image/download authorization after network reads.
• Complete staging cleanup before returning download success or failure responses, so the HTTP result matches the final filesystem state.
• Replaced unbounded logs with 5 MiB rotation and removed temporary WebView2 paths from cleanup warnings.
• Removed Android, non-Windows UI backends, unnecessary x86/ARM64 product components, and debug symbols from the Windows x64 frozen closure while retaining the small pywebview loader runtimes required during import.

MOKU 1.0.9

MOKU 1.0.9

MOKU 1.0.9 stabilizes author search paging and the multi-request collection download workflow.

Fixes

• Author searches now expose a final partial page. For example, 53 loaded works are shown as 36 items on page 1 and 17 on page 2, rather than hiding the remaining works.
• Budget-limited sparse and author searches keep a usable next-page action while more source data remains.
• Multi-request downloads freeze selections, quality, save path, folder creation, and artwork grouping for the full task.

Verification

• 281 automated tests passed; 1 environment-dependent directory-symlink test was skipped.
• Clean Windows portable build and schema 3 manifest verification passed.
• Packaged WebView2 visual/interaction, search, cache, folder-selection, file-write, security, and ZIP round-trip probes passed.

The executable is not Authenticode-signed. Verify the ZIP against SHA256SUMS.txt before running it.

MOKU 1.0.8 Collection Basket Test 2

Collection basket test build

This prerelease contains the updated collection basket workflow for hands-on testing.

Changes

• Uses one consistent three-level flow for single- and multi-artwork baskets: summary → artwork picker → image picker.
• Keeps the summary page image-free and loads artwork detail only when the image picker is opened.
• Allows any number of artworks within a 1,000-image selection limit, with an overflow dialog at image 1,001.
• Builds download requests only from the exact selected-page sets; deselected preview images are excluded.
• Locks selection, search, and pagination controls while a multi-batch download is running so the submitted snapshot cannot diverge from the UI.
• Adds compact artwork/image grids, cache-state reporting, stale-response guards, and complete basket-mode cleanup.
• Replaces the white light ribbons with a restrained Saturn-ring treatment while preserving the dark-moon visual direction.

Verification

• 276 source tests passed; 1 platform-dependent symlink test was skipped.
• Regression coverage includes a 1,000-page single artwork split into five 200-page requests without missing or duplicated pages.
• Download-time locking now covers dynamically rebuilt page controls and the underlying selection-clear helpers.
• JavaScript syntax check passed.
• Windows x64 portable build and startup smoke test passed.
• Packaged visual/interaction probe returned ok: true.
• The ZIP was extracted and its build manifest was verified.

This is a test build, not a replacement for the stable v1.0.8 release. Verify the downloaded ZIP with the accompanying SHA-256 file before running it.

MOKU 1.0.8

Fixed

• Restored the one-step batch workflow: opening batch download now selects the current page and shows the integrated artwork picker immediately.
• Preserved per-page selections and original search contexts across result cards, batch cards, navigation, and delayed detail responses.

Verification

• 269 source tests passed (1 platform-dependent symlink test skipped).
• JavaScript and PowerShell checks passed.
• Windows x64 portable build, packaged UI/search/cache probes, schema 3 manifest verification, and archive round-trip verification passed.

Verify the downloaded ZIP with SHA256SUMS.txt before running it. The SHA-256 values are one-way file fingerprints; they do not contain file contents or identity data.

MOKU 1.0.7

Changelog

All notable changes are documented here. The project follows Semantic Versioning.

[1.0.7] - 2026-07-20

Fixed

• Reject junctions and other reparse points before canonicalization or publication, including those nested below the selected root, and remove every directory created by a failed publish.

[1.0.6] - 2026-07-20

Fixed

• Canonicalize user-selected download roots and final publication paths before containment checks, so equivalent Windows path aliases cannot produce false 502 responses or bypass the save-root boundary.
• Isolate threaded download-integrity test network seams and stabilize the publish-identity test path on hosted Windows runners.

[1.0.5] - 2026-07-18

Added

• Strict multi-tag AND search using ; or ； separators; spaces remain part of one tag.
• Optional bounded anime-oriented tag aliases, disabled by default.
• A collection basket for up to 100 artworks and 1,000 selected images, with windowed page selection for large works.
• One-click select/clear controls for all artworks and images on the current result page.
• Image-first adaptive download chunks and optional artwork grouping.

Changed

• Save one search batch into a shared tag, author, or artwork context folder instead of creating one folder per artwork.
• Apply the same context-folder rule to single-artwork downloads.
• Restyle the interface with a restrained black-and-white lunar theme, a highlighted moon edge, and one clean orbital ring while preserving the existing workflow and startup budget.
• Keep result pagination docked to the viewport bottom while the gallery scrolls.
• Defer the collection retention decision until forward navigation would actually evict selected result pages.

Fixed

• Keep exact and alias-expanded search sessions in separate cache namespaces.
• Validate every multi-tag result against all requested tag groups after Pixiv response normalization.

[1.0.4] - 2026-07-17

Fixed

• Use Pixiv's current JSON /ajax/search/users?nick=... response for exact author: resolution, including both list and keyed user payloads.
• Do not expose the loopback request capability to headerless health probes; same-origin desktop/browser readiness checks now identify themselves explicitly.
• Return download paths relative to the selected save directory instead of leaking local absolute paths through the HTTP API.
• Reject malformed or negative remote Content-Length values before reading a Pixiv response.

[1.0.3] - 2026-07-17

Fixed

• Resolve exact author: queries through Pixiv's current /search/users page instead of the removed AJAX user-search route.
• Parse the bounded __NEXT_DATA__ user result set and keep exact creator-name and user-ID filtering.

[1.0.2] - 2026-07-17

Added

• Exact Pixiv creator search with pid: / pid： and author: / author： queries.

Fixed

• Parse Pixiv's nested userPreviews[].user response before exact author-name matching.
• Reject works whose userId does not match the resolved creator.
• Replace overlapping absolute-positioned deck cards with a non-overlapping flex row.
• Reduce pointer preview travel and keep every other card stationary while one card is locked.

[1.0.1] - 2026-07-16

Fixed

• Restored Windows PowerShell module discovery in -NoProfile CI subprocesses while preserving fail-closed Python Authenticode verification.
• Preserved the vendored proxy-tools license byte hash across Windows and CI checkouts with explicit LF normalization.
• Updated pinned GitHub Actions to Node.js 24-compatible major versions.

[1.0.0] - 2026-07-16

Added

• Windows pywebview/WebView2 desktop host with a second official Pixiv login window.
• Public, R-18, and combined search scopes with multi-tag OR aggregation.
• Bounded historical search, paging prefetch, sliding cache eviction, and selective batch download.
• Native folder selection, offline usage guide, and anonymous parallel network diagnosis.
• Portable PyInstaller build, release ZIP generation, SHA-256 manifests, and Windows CI.
• A fail-closed build manifest binding source/build inputs to every portable-package file.

Security

• Loopback host, Sec-Fetch-Site, and same-origin checks for every API GET.
• Per-process request tokens for every non-health API request; image URLs use separate high-entropy capabilities.
• Strict Content Security Policy and same-origin resource headers on local HTTP responses.
• Bounded JSON-object parsing for mutating requests.
• Explicit Pixiv/API/image host allowlists and loopback-only proxy selection.
• Query parameters, cookies, request bodies, and image tokens excluded from HTTP logs.
• Content-derived backend generation IDs prevent a new client from reusing stale code.
• Test-only synthetic gallery routes disabled by default.
• Release generation rejects stale source, changed licenses, modified support files, linked or undeclared files/directories, non-Windows-x64 product artifacts, missing pywebview loader runtimes, unlocked top-level package metadata, and archives that fail round-trip verification.
• Runtime and build dependencies are locked to verified artifact SHA-256 values; the legacy proxy-tools source is reproduced as an audited deterministic local wheel.
• Build and release validation use a signed CPython 3.12 executable, a shared exclusive mutex, source rechecks, and schema 3 full file/directory manifests.

Changed

• Replaced the legacy external Edge --app host with pywebview/WebView2.
• Replaced sequential port probing with Windows-assigned ephemeral loopback ports.
• Extracted synthetic test fixtures from the production HTTP module.
• Added bounded LRU artwork caching and safe refresh of expired image authorization.
• Synchronized artwork/image-capability state and revalidate in-flight R-18 image/download authorization after network reads.
• Complete staging cleanup before returning download success or failure responses, so the HTTP result matches the final filesystem state.
• Replaced unbounded logs with 5 MiB rotation and removed temporary WebView2 paths from cleanup warnings.
• Removed Android, non-Windows UI backends, unnecessary x86/ARM64 product components, and debug symbols from the Windows x64 frozen closure while retaining the small pywebview loader runtimes required during import.

MOKU 1.0.5

Changelog

All notable changes are documented here. The project follows Semantic Versioning.

[1.0.5] - 2026-07-18

Added

• Strict multi-tag AND search using ; or ； separators; spaces remain part of one tag.
• Optional bounded anime-oriented tag aliases, disabled by default.
• A collection basket for up to 100 artworks and 1,000 selected images, with windowed page selection for large works.
• One-click select/clear controls for all artworks and images on the current result page.
• Image-first adaptive download chunks and optional artwork grouping.

Changed

• Save one search batch into a shared tag, author, or artwork context folder instead of creating one folder per artwork.
• Apply the same context-folder rule to single-artwork downloads.
• Restyle the interface with a restrained black-and-white lunar theme, a highlighted moon edge, and one clean orbital ring while preserving the existing workflow and startup budget.
• Keep result pagination docked to the viewport bottom while the gallery scrolls.
• Defer the collection retention decision until forward navigation would actually evict selected result pages.

Fixed

• Keep exact and alias-expanded search sessions in separate cache namespaces.
• Validate every multi-tag result against all requested tag groups after Pixiv response normalization.

[1.0.4] - 2026-07-17

Fixed

• Use Pixiv's current JSON /ajax/search/users?nick=... response for exact author: resolution, including both list and keyed user payloads.
• Do not expose the loopback request capability to headerless health probes; same-origin desktop/browser readiness checks now identify themselves explicitly.
• Return download paths relative to the selected save directory instead of leaking local absolute paths through the HTTP API.
• Reject malformed or negative remote Content-Length values before reading a Pixiv response.

[1.0.3] - 2026-07-17

Fixed

• Resolve exact author: queries through Pixiv's current /search/users page instead of the removed AJAX user-search route.
• Parse the bounded __NEXT_DATA__ user result set and keep exact creator-name and user-ID filtering.

[1.0.2] - 2026-07-17

Added

• Exact Pixiv creator search with pid: / pid： and author: / author： queries.

Fixed

• Parse Pixiv's nested userPreviews[].user response before exact author-name matching.
• Reject works whose userId does not match the resolved creator.
• Replace overlapping absolute-positioned deck cards with a non-overlapping flex row.
• Reduce pointer preview travel and keep every other card stationary while one card is locked.

[1.0.1] - 2026-07-16

Fixed

• Restored Windows PowerShell module discovery in -NoProfile CI subprocesses while preserving fail-closed Python Authenticode verification.
• Preserved the vendored proxy-tools license byte hash across Windows and CI checkouts with explicit LF normalization.
• Updated pinned GitHub Actions to Node.js 24-compatible major versions.

[1.0.0] - 2026-07-16

Added

• Windows pywebview/WebView2 desktop host with a second official Pixiv login window.
• Public, R-18, and combined search scopes with multi-tag OR aggregation.
• Bounded historical search, paging prefetch, sliding cache eviction, and selective batch download.
• Native folder selection, offline usage guide, and anonymous parallel network diagnosis.
• Portable PyInstaller build, release ZIP generation, SHA-256 manifests, and Windows CI.
• A fail-closed build manifest binding source/build inputs to every portable-package file.

Security

• Loopback host, Sec-Fetch-Site, and same-origin checks for every API GET.
• Per-process request tokens for every non-health API request; image URLs use separate high-entropy capabilities.
• Strict Content Security Policy and same-origin resource headers on local HTTP responses.
• Bounded JSON-object parsing for mutating requests.
• Explicit Pixiv/API/image host allowlists and loopback-only proxy selection.
• Query parameters, cookies, request bodies, and image tokens excluded from HTTP logs.
• Content-derived backend generation IDs prevent a new client from reusing stale code.
• Test-only synthetic gallery routes disabled by default.
• Release generation rejects stale source, changed licenses, modified support files, linked or undeclared files/directories, non-Windows-x64 product artifacts, missing pywebview loader runtimes, unlocked top-level package metadata, and archives that fail round-trip verification.
• Runtime and build dependencies are locked to verified artifact SHA-256 values; the legacy proxy-tools source is reproduced as an audited deterministic local wheel.
• Build and release validation use a signed CPython 3.12 executable, a shared exclusive mutex, source rechecks, and schema 3 full file/directory manifests.

Changed

• Replaced the legacy external Edge --app host with pywebview/WebView2.
• Replaced sequential port probing with Windows-assigned ephemeral loopback ports.
• Extracted synthetic test fixtures from the production HTTP module.
• Added bounded LRU artwork caching and safe refresh of expired image authorization.
• Synchronized artwork/image-capability state and revalidate in-flight R-18 image/download authorization after network reads.
• Complete staging cleanup before returning download success or failure responses, so the HTTP result matches the final filesystem state.
• Replaced unbounded logs with 5 MiB rotation and removed temporary WebView2 paths from cleanup warnings.
• Removed Android, non-Windows UI backends, unnecessary x86/ARM64 product components, and debug symbols from the Windows x64 frozen closure while retaining the small pywebview loader runtimes required during import.

MOKU 1.0.4

MOKU 1.0.4

MOKU 1.0.4 is a portable Windows x64 release.

Highlights

• Fixed exact author: searches using Pixiv's current user-search JSON response.
• Prevented headerless health probes from receiving the loopback request capability.
• Stopped download APIs from exposing local absolute paths.
• Rejected malformed and negative upstream Content-Length values.
• Removed obsolete one-off browser and retired pywebview probes from the source test directory.

Download and verify

1. Download MOKU-v1.0.4-windows-x64.zip.
2. Verify its SHA-256 against SHA256SUMS.txt.
3. Extract the complete archive and run MOKU\\MOKU.exe.

The application is local-only and binds its HTTP service to 127.0.0.1. It does not expose a LAN or Internet service. Microsoft Edge WebView2 Runtime is required on the target Windows machine.

The executable is not Authenticode-signed, so Windows SmartScreen may show an unknown-publisher warning.

Verification

• Python test suite: 191 tests passed.
• JavaScript and PowerShell syntax checks passed.
• Frozen distribution manifest: verified.
• Expanded ZIP executable hash matched the release manifest.
• EXE SHA-256: E7588925CB41A5344D8FB22F649B69A1C7B1D085A9D096F6423FA2E74B721D34.
• ZIP SHA-256: AF25E314DAEABA3373950E05DFF569C0768E0CB250660BD93F8E7504E7FF8F34.

See the repository README, SECURITY.md, and PRIVACY.md for operating boundaries and security details.

MOKU 1.0.1

Changelog

All notable changes are documented here. The project follows Semantic Versioning.

[1.0.1] - 2026-07-16

Fixed

• Restored Windows PowerShell module discovery in -NoProfile CI subprocesses while preserving fail-closed Python Authenticode verification.
• Preserved the vendored proxy-tools license byte hash across Windows and CI checkouts with explicit LF normalization.
• Updated pinned GitHub Actions to Node.js 24-compatible major versions.

[1.0.0] - 2026-07-16

Added

• Windows pywebview/WebView2 desktop host with a second official Pixiv login window.
• Public, R-18, and combined search scopes with multi-tag OR aggregation.
• Bounded historical search, paging prefetch, sliding cache eviction, and selective batch download.
• Native folder selection, offline usage guide, and anonymous parallel network diagnosis.
• Portable PyInstaller build, release ZIP generation, SHA-256 manifests, and Windows CI.
• A fail-closed build manifest binding source/build inputs to every portable-package file.

Security

• Loopback host, Sec-Fetch-Site, and same-origin checks for every API GET.
• Per-process request tokens for every non-health API request; image URLs use separate high-entropy capabilities.
• Strict Content Security Policy and same-origin resource headers on local HTTP responses.
• Bounded JSON-object parsing for mutating requests.
• Explicit Pixiv/API/image host allowlists and loopback-only proxy selection.
• Query parameters, cookies, request bodies, and image tokens excluded from HTTP logs.
• Content-derived backend generation IDs prevent a new client from reusing stale code.
• Test-only synthetic gallery routes disabled by default.
• Release generation rejects stale source, changed licenses, modified support files, linked or undeclared files/directories, non-Windows-x64 product artifacts, missing pywebview loader runtimes, unlocked top-level package metadata, and archives that fail round-trip verification.
• Runtime and build dependencies are locked to verified artifact SHA-256 values; the legacy proxy-tools source is reproduced as an audited deterministic local wheel.
• Build and release validation use a signed CPython 3.12 executable, a shared exclusive mutex, source rechecks, and schema 3 full file/directory manifests.

Changed

• Replaced the legacy external Edge --app host with pywebview/WebView2.
• Replaced sequential port probing with Windows-assigned ephemeral loopback ports.
• Extracted synthetic test fixtures from the production HTTP module.
• Added bounded LRU artwork caching and safe refresh of expired image authorization.
• Synchronized artwork/image-capability state and revalidate in-flight R-18 image/download authorization after network reads.
• Complete staging cleanup before returning download success or failure responses, so the HTTP result matches the final filesystem state.
• Replaced unbounded logs with 5 MiB rotation and removed temporary WebView2 paths from cleanup warnings.
• Removed Android, non-Windows UI backends, unnecessary x86/ARM64 product components, and debug symbols from the Windows x64 frozen closure while retaining the small pywebview loader runtimes required during import.