release: streamnet-cli v1.0.0 — full stream pipeline, subtitles, download#10
Merged
Conversation
Portable three-layer knowledge graph integration: SessionStart/PostToolUse/ UserPromptSubmit/Stop/PreToolUse hooks, graphify graph (auto-updates on commit), decisions + bugs ADRs committed, runtime artifacts gitignored. No-ops gracefully without local CKIS vault — external contributors unaffected. Registered in Dev Brain (~/Documents/Dev Brain/); graph-report auto-synced to CKIS 02-projects/<slug>/graph-report.md on each commit. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Add .npmrc: ignore-scripts=true, registry pin, save-exact=true - Patch GHSA-5xrq-8626-4rwp: vitest → ^4.1.8 (critical — arbitrary file read/exec) - Pin all GitHub Actions to commit SHAs (not mutable tags) - Add --ignore-scripts to all npm ci / pnpm install steps in CI - Add explicit native module whitelist with npm_config_ignore_scripts=false rebuild - Add npm audit --audit-level=high gate to all CI and release workflows - Add permissions: {} (deny-all default) with per-job minimum grants - Add persist-credentials: false to all checkout steps - Add weekly security-audit.yml workflow (runs every Monday 09:00 UTC) - Add SECURITY.md with supply chain security policy and vulnerability disclosure Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…-credentials: false Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Implements the OpenSubtitles/VLSub subtitle pipeline and full-download mode
toward v1.0.0, and fixes a pre-existing flag-parsing bug surfaced during the audit.
Added
- core/subtitles/hash.ts: OpenSubtitles "moviehash" (size + first/last 64 KiB
checksum), reading only the two windows (cheap on multi-GB files).
- core/subtitles/opensubtitles.ts: REST v1 client — hash + text search with
ranked results (hash match > language preference > download count) and
download-link resolution. Api-Key from config, never hardcoded.
- core/subtitles/fetch.ts: orchestrates hash -> search -> download -> write
`<name>.<lang>.srt` beside the video, with a title-query fallback.
- commands/subs.ts: `streamnet subs <file>` (--lang, --query).
- commands/download.ts + engine.downloadTorrent(): full download to the
configured dir with progress, auto subtitle fetch for non-MKV files.
- stream/play: non-MKV streams best-effort fetch subtitles by title and pass
--sub-file to VLC; never fail the stream on a subtitle error.
- doctor: download-dir write check + warn-only OpenSubtitles key check
(warnings don't flip allOk/exit code).
Fixed
- Flag arity (P0): optional/default-wrapped Zod flags were classified as
boolean, so `--container`, `--quality`, `--indexer`, `--sub-lang`, `--query`,
`--out` swallowed no value ("too many arguments") and numeric coercion was
skipped on optional numbers. build.ts now unwraps Optional/Default/Nullable
to the underlying type. Regression test in test/flag-arity.test.ts.
Tests: 49 passing (was 38). tsc/lint/build green. Subtitle and download paths
fully mocked — no live network or torrents in tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bump package.json 0.1.0 -> 1.0.0 and align docs for the first stable release: promote CHANGELOG [Unreleased] -> [1.0.0], reframe README roadmap (1.0.0 shipped; MCP/resolvers/binaries moved to post-1.0). Harden the two agent-mode subprocess tests with an explicit 15s timeout so Node startup under parallel load no longer trips the 5s default (was failing the release gate). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The "Rebuild native WebTorrent dependencies" step uses `2>/dev/null`, which on windows-latest runs under pwsh and is parsed as Out-File to `D:\dev\null`, failing the step (the `|| true` can't rescue a parse-time error). Pin the step to `shell: bash` (Git Bash is preinstalled on Windows runners) in both ci.yml and release.yml so it behaves identically across all three OSes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
aedneth
added a commit
that referenced
this pull request
Jun 4, 2026
release: streamnet-cli v1.0.0 — full stream pipeline, subtitles, download
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v1.0.0 — first stable release
Takes streamnet-cli from scaffolded v0.1.0 to a working, published v1.0.0: the terminal replacement for the broken Stremio → VLC → VLSub pipeline.
What's in this release
moviehash(size + first/last 64 KiB), REST v1 client (hash + text search, ranked download), and a standalonesubs <file>command writing<name>.<lang>.srtbeside the video.download <source>— full torrent download to the configured directory with progress + automatic subtitle fetch for non-MKV files.stream/play— non-MKV streams best-effort fetch subtitles by title and pass--sub-fileto VLC (never fails the stream on a subtitle error).doctor— download-dir write check + advisory OpenSubtitles key check (warn-only, doesn't flip exit code).Fixes
z.string().optional()) were misclassified as boolean, so--container/--quality/--indexer/--query/--outsilently swallowed no value ("too many arguments"). Registry now unwraps Optional/Default/Nullable for both arity and numeric coercion. Regression guard added.Release mechanics
package.jsonbumped0.1.0→1.0.0; CHANGELOG[Unreleased]→[1.0.0]; README roadmap reframed (1.0.0 shipped; MCP/resolvers/binaries → post-1.0).v1.0.0triggers.github/workflows/release.yml(typecheck + test + build → GitHub Release →npm publish --provenance).Gates (local)
npm run build✅ ·npx tsc --noEmit✅ (0 errors) ·npm test✅ (49/49) ·npm audit --audit-level=critical✅ (0 critical) ·npm publish --dry-run✅🤖 Generated with Claude Code