626 Mod Launcher v0.10.0

v0.10.0 — 626 opens on your library now

The launcher gets a home: a Game Library landing page with real cover art, every game's mod state at a glance, and one-click Play — and games modded by loose files in the game root (Death Stranding 2 and friends) go from "No mods" to detected, categorized, and reversibly toggleable without moving a single file.

What's new

• 626 now opens on a Game Library home. Every registered game as a rich row — cover, store badge, last played, mod state (N mods · M on), engine tier, ban-risk flag, detected-loader chips — with one-click Play and Manage. A Jump back in strip of big covers up top orders by real recency: 626's own launches plus Steam's last-played, best-available-wins. Unknown shows as unknown — never a faked timestamp.
• Real cover art, no icon blur. Covers are shape-aware — portrait art picked over stretched icons — and games Steam hasn't cached locally get fetched from Steam's public CDN, with a second store-API tier for brand-new titles. That's how Death Stranding 2 gets a real portrait on day one.
• A discovery lane for games you haven't added yet. Installed-but-unadded games from your store scan sit at the bottom of the library, one click to add. Search covers the whole wall.
• The title bar got out of the way. The game dropdown is retired — the library is the switcher now — and the Settings gear is always visible.
• Loose-root mods are managed now. Games modded by loose files dropped straight into the game root — Death Stranding 2 and other Decima titles: ASI plugins, ReShade addons, proxy loaders — are detected by nature, categorized (Plugins / Shaders / Loaders), and toggleable in place. Files never move while a mod is enabled; disabling moves them to a holding folder, re-enabling restores them byte-for-byte.
• Loose intake, with guardrails. Drop an .asi / .addon64 / archive and it installs into the root through the same validate-then-extract discipline as everything else. Disabling a proxy loader warns you it takes every ASI plugin down with it — warn-and-proceed, never a hard block. Vanilla launch steps loose mods aside and puts them back. Game files, standalone configs, and generic DLLs are never claimed.
• Identify loose mods on Nexus — review-first. One action proposes Nexus matches by name for your loose-root rows; you check the ones that are right, and only what you approve attaches — then endorsement hearts and update checks light up on those rows. GitHub build only: it needs the updated Nexus plugin (releasing alongside this cut), and the Store SKU doesn't ship the plugin surface.

Already live (no update needed)

• The game-definition feed grew to 150 supported games — including MECCHA CHAMELEON, and Death Stranding 2 re-curated onto the new decima engine. Feed-delivered, so it's already reached existing installs; no app update required.
• The feed repo now has a public supported-games page — a human-readable list, a machine-readable supported-games.json, and a live count badge, regenerated by CI in the same commit as the signed manifest so they can never drift.

Under the hood

• Game Library home (#168). GameLibraryBuilder + RecencyLadder are pure Core (TDD'd); the recency readers (626's own launch log, Steam appmanifest.LastPlayed) are App-side adapters behind ILastPlayedSource, the same pattern as IStoreLibrary — so Phase 2 (GOG DB + the UserAssist fallback that lights up Epic/Xbox) drops in with no rework. GameEntry gains storeSource + lastLaunchedUtc; launches append to an atomic camelCase launch log. Review caught a lying home "Play vanilla" item that silently launched modded — dropped; home Play launches current state, and vanilla stays the game-view mode toggle where its effect is visible. Spec: docs/superpowers/specs/2026-07-01-game-library-home-design.md · Plan: docs/superpowers/plans/2026-07-01-game-library-home-phase1.md.
• Covers. SteamArt (Core) picks shape-aware portrait art from the local library cache; SteamCdn (Core, tested) builds the two public-CDN URL tiers — library_600x900 first, the hashed store-item-assets path for titles too new to have it; CoverCache (App) fetches and caches to disk.
• Loose-root mods (#169). LooseModScan is a pure-Core, by-nature detector — ASI plugins grouped with same-stem configs, each ReShade addon its own mod, exact-name proxy loaders only — tested against a fixture of the real DS2 game root. The feature widens DirectInject rather than inventing a new mechanism: the proven detect / toggle-to-holding / sidecar / intake plumbing is reused wholesale. New decima engine preset + Form="loose-root" mod location; Vortex/MO2-owned roots stay read-only until takeover. Spec: docs/superpowers/specs/2026-07-01-loose-root-mods-design.md · Plan: docs/superpowers/plans/2026-07-01-loose-root-mods-phase1.md.
• Nexus loose identify (#171). New optional IModTextSearch capability in the plugin Abstractions — a separate interface, not an IModSource extension, so already-installed plugins keep loading unchanged (no ABI break). LooseIdentify (pure Core) selects candidates (loaders, manual matches, and already-identified rows excluded), cleans stems via NameMatch, and gates proposals on the established Jaccard threshold; approved hits attach with sourceConfidence: "nameSearch" through the existing WriteManyMeta path, so a manual match is never clobbered by a later identify run. Companion plugin PR: 626-mod-plugins #1. Spec: docs/superpowers/specs/2026-07-01-nexus-loose-identify-design.md · Plan: docs/superpowers/plans/2026-07-01-nexus-loose-identify.md.
• Supported-games surface (#172, #173). Spec + plan live here; the generator + CI wiring landed in the feed repo — stdlib-only Python with a self-test gate that fails the build before anything publishes. Spec: docs/superpowers/specs/2026-07-03-supported-games-surface-design.md.
• Gate: Core suite 1381/0; FULL + STORE builds clean; STORE seal holds; CorePurity green. #174 bumps the Store package to 0.10.0.0.

Not yet

• Recency for GOG / Epic / Xbox — Phase 2. The readers slot in behind ILastPlayedSource; until then those games rank by 626's own launches.
• Active-profile display on library rows — deferred until a persisted active-profile concept exists (documented, not invented).
• Vanilla-diff loose detection — the Phase 2 seam is already in the signal list. Ambiguous root DLLs (e.g. DeathStranding2Core.dll) stay deliberately untouched until then.

---

626 Mod Launcher v0.9.0

v0.9.0 — the ban-risk warning now points at the safe way in

The anti-cheat warning stops being a dead end. It names the game's anti-cheat-safe loaders and hands you a one-click way to launch them — and when 626 can't read a game's engine, you can ask for it in one click instead of guessing.

What's new

• The ban-risk warning now shows you the safe path. Hit the anti-cheat acknowledgment on a game like Elden Ring and it now lists that game's anti-cheat-safe loaders — Mod Engine 2, Seamless Co-op — with Launch if the loader's installed or Get it here if it isn't. The warn-and-acknowledge gate is unchanged; nothing enables itself. The warning just stopped being a shrug.
• Detected mod loaders show up as one-click buttons in the bar. If a loader's installed in the game folder, 626 surfaces a Launch via Mod Engine 2 / Launch via Seamless Co-op button. 626 stays the hub and manages your files and saves; the loader does the loading. Saves snapshot first where a launch touches them.
• Anti-cheat-safe guidance works on the Microsoft Store build too — and there it's the primary safe path, since the Store SKU ships without the EAC offline toggle. Same warning, same safe loaders, surfaced the same way.
• "Request this game" for undetected engines. Add a game whose engine 626 can't read and you get a Request this game link that opens a prefilled GitHub issue against the game-definition feed repo — name and Steam id already filled in. The link retires itself the moment you pick an engine by hand. No form to hunt down, no typing the same fields twice.

Loaders surfaced this release — never bundled, detection + a Get-it-here link only:

• Mod Engine 2 — thanks to soulsmods.
• Seamless Co-op — thanks to LukeYui.

Under the hood

• Ban-safe loaders + loaders-in-the-bar (#160). New KnownLoader catalog (Core) carries Mod Engine 2 + Seamless Co-op, each flagged BanSafe, with launcher-exe detection hints and a GetUrl — the four existing catalogs are untouched. LoaderScan (Core, TDD'd) detects a loader's launcher exe in the play folder and resolves a game's ban-safe loaders. The bar reuses the existing ToolLauncher process-start path; the ban-risk dialog pulls the game's BanSafe entries into the warning. The warn-and-acknowledge gate is byte-for-byte intact — this is purely additive guidance, no silent anti-cheat disabling, no bundled binaries (NOTICE updated). Both flavors, no #if FULL; on the Store SKU the loader guidance is the primary safe path because the offline toggle is stripped there. Spec: docs/superpowers/specs/2026-06-26-ban-safe-loaders-design.md. Plan: docs/superpowers/plans/2026-06-26-ban-safe-loaders.md.
• Request a game (#161). Pure Core URL builder GameRequestUrl.Build constructs the prefilled issues/new?template=game-request.yml URL — title, name, Steam id, notes, all escaped via Uri.EscapeDataString. The feed repo's engine dropdown is a required field with fixed options, so the builder maps our engine key to the exact option string (default Not sure), verified char-for-char against the live template down to the em-dash codepoint — drift fails a test. The App surfaces a HyperlinkButton in AddGameDialog, shown only when the engine isn't resolved, opening the URL via Windows.System.Launcher.LaunchUriAsync (mirrors FrameworkUnrecognizedNudgeDialog). Both flavors, no new constructor param. Plan: docs/superpowers/plans/2026-06-26-request-a-game.md.
• Manifest feed: Core suite at 1328/0 on combined master; FULL + STORE build clean; STORE seal holds; CorePurity green (#162 bumps the MSIX package to 0.9.0.0).

Already live (no update needed)

• The game-definition feed grew to ~95 games with a featured / quick-pick pass. This is feed-delivered — it's already reached existing installs at runtime, no app update required. New game coverage keeps landing the same way: a data PR to the feed repo, not a launcher release. (And now "Request this game" is how you start that PR.)

626 Mod Launcher v0.8.1

What's Changed

• fix(plugins): 0.8.1 — plugin delivery UX (startup fetch, hot-load re-identify, manual button) by @estevanhernandez-stack-ed in #150
• fix(plugins): honest feed status (no false "up to date") by @estevanhernandez-stack-ed in #151

Full Changelog: v0.8.0...v0.8.1

626 Mod Launcher v0.8.0

Merge pull request #149 from estevanhernandez-stack-ed/feat/plugin-ho…

626 Mod Launcher v0.6.1

v0.6.1 — two feed fixes you'd have noticed

A small patch on top of the feed go-live. Both fixes are things the feed shook loose the moment real game data started flowing — picking a popular game half-worked, and the live feed quietly dropped a curated game from the picker. Both fixed.

Fixed

• Fixed picking a game from "Popular games" in Add Game — it now fills Name, Engine, and Mod folder, not just the name. The dialog no longer looks dead after you pick.
• Fixed the feed silently dropping Stardew Valley from the Popular games picker — a feed update to a built-in game can no longer blank out or downgrade what's curated. Stardew is back.

Under the hood

• Add Game popular-pick (#134). Selecting the engine combo from inside the dropdown's own SelectionChanged is re-entrant mutation WinUI throws on, and with no app-level exception sink the throw got swallowed — aborting the handler before the mod-folder / app-id fills. Fix: fill name / mod-folder / app-id first and unconditionally, defer the engine select off the event tick, and log any residual throw instead of eating it.
• Feed merge no-downgrade (#135). The merge replaced a built-in entry whole on id collision, so the feed's auto-mined Stardew (no engine, no popular-games tag) overwrote the curated built-in. Fix: field-level merge — a feed non-null value wins, but a feed null can never blank a built-in field; provenance tags union so the popular-games tag survives; curated status is never downgraded.

626 Mod Launcher v0.6.0

v0.6.0 — the remote game-definition feed

The launcher now keeps its game support current without an app release — it fetches a signed game-definition manifest at startup and merges it over the games baked into the binary. New games on engines the launcher already knows become data PRs to a separate feed repo, not a new build.

What's new

• Added the remote game-definition feed — the launcher fetches signed game definitions from the public 626-game-manifest repo and layers them over its embedded game set.
• Game definitions now refresh without an app update — a new game on a known engine ships as a data PR to the feed, not a release.
• Added an "auto-update definitions" setting (default on) that gates the feed; turn it off and you stay on the games shipped in the binary.
• A bad or missing feed never breaks a working install — offline, bad signature, or a too-new schema all fall back silently to the embedded games. No scary dialog for a network blip.

Day-one coverage — honest

This is the feed turning on, not a flood of games. Day one it carries a small hand-curated set with verified engine + mod path (Skyrim, Oblivion, Fallout New Vegas) plus ~35 Nexus-domain entries, layered on top of the games already in the binary. Engines come from curation only — a wrong engine is worse than none, so mined-but-unverified engines don't ship. Coverage grows by data PRs to 626-game-manifest from here, no app release per game.

Under the hood

• One source of truth. Collapsed KnownEngines / NexusDomains / PopularGames into a single embedded games-manifest.json, with those classes becoming thin facades over it — zero behavior change, facade parity tests untouched.
• Trust core. Pure-Core verify/gate/merge: ECDSA P-256 + SHA-256 detached-signature verify, schemaVersion + minBinaryVersion gating, modPath re-validated through the same forbidden-paths gate as user archives, then merge-over-embedded by id. Public key pinned in the binary; the private key lives only in feed-repo CI. (Ed25519 isn't first-class in System.Security.Cryptography until .NET 11, so P-256 is the dependency-free target — sign and verify pin the same format so they can't drift.)
• App fetch glue. RemoteManifestCache (atomic write + verify-on-read) in Core; RemoteManifestSource in the shell — apply-cached runs before any facade reads, the background refresh fires on a 24h debounce mirroring the app updater.
• The miner. In-repo tools/ManifestMiner builds the feed from mined facts — Ludusavi save/Steam data for the backbone, Mod Organizer 2 mod paths merged by Steam id, then hand-curated overrides/ that win every conflict. Facts-only (uncopyrightable under Feist v. Rural); courtesy NOTICE for Ludusavi, Vortex, MO2, PCGamingWiki. No binaries or code ever bundled.
• Signer + publish filter. The signer signs the exact published bytes with the launcher's own verify format; the publish step tags each entry by the fields it earns and drops skeletal entries — the feed is ~25 KB, not 26 MB.
• Pure-core / thin-shell and reversibility laws held throughout. The manifest is descriptive only — it never describes how to enable or disable a mod; that stays code.

Not yet

• No in-app settings toggle UI for "auto-update definitions" — the field defaults on and persists, but there's no switch in the dialog yet.
• No "your game list is N days stale" nudge.
• No GOG / Epic / Game Pass probing — the schema is store-agnostic so they slot in later, but discovery is Steam-only.
• Mined-but-unverified engines don't ship until curated — breadth grows by data PR.

626 Mod Launcher v0.5.1

Mod managers for games that don't use a mod loader.

Some Unreal games — Witchfire is the one that prompted this — have no UE4SS or script loader. Their mods are content paks that you drop straight into Content/Paks, right next to the game's own files. The launcher didn't know how to manage those, and adding such a game turned up no mods at all.

What's new in v0.5.1

• Loader-less Unreal-pak games are first-class now. Add a game like Witchfire and the launcher manages the mods that live directly in Content/Paks — listing your mods and never the base game. The 4GB game paks are recognized as the game (by name and size) and can never be listed as a mod or moved by a toggle, so you can't accidentally disable the game itself.
• Metadata fetches for more games. Witchfire's mods now pull their real title, author, and links from Nexus on install. (A game needs to be in the launcher's Nexus-domain map for this; Witchfire's now is.)
• Honest dependency chips. A plain content pak no longer claims it "needs UE4SS" — that warning now shows only on the mods that actually need it (Lua scripts and Blueprint LogicMods paks). If your game's mods are content paks, you'll see no false framework warning.

Reversibility holds throughout: the base game is protected on both the disable and uninstall paths, and nothing here changes how your existing games are managed.

Updating from 0.5.0 is a small delta — the launcher pulls it on its next check, or grab the Setup.exe below.

626 Mod Launcher v0.5.0

Two things this release fixes that the launcher used to get wrong on your files.

Break free from Vortex

Moving off Vortex used to leave you stuck. Vortex drops ownership markers in the folders it deployed into, and the launcher — playing it safe — treated those folders as read-only, hands-off. So mods the launcher installed itself could end up unmanageable, with the uninstall button hidden, just because Vortex's old marker was still sitting there.

Now you can take a folder over. When the launcher sees a Vortex-managed folder, it offers to take it over: a banner above your mods, and a prompt the moment you try to manage one. Take it over and the launcher archives Vortex's marker out of the way (moved, never deleted — fully reversible) and manages the folder normally from then on. If Vortex later re-deploys into a folder you took over, the launcher notices and says so instead of silently fighting it. Game-scoped, consent-gated, never touches a game the launcher doesn't support.

Play vanilla actually means vanilla

"Play vanilla" used to be a label that lied. On games where mods load by file presence — pak mods, UE4SS — a plain launch runs with your mods, so the button was telling you something that wasn't true.

Now it's a real two-mode launch:

• Play vanilla steps every active loader aside — your pak mods, the UE4SS loader, direct-inject DLLs — so the game runs genuinely clean. They stay aside until you switch back; nothing's guessed from when the game closes.
• Play modded puts back exactly what you had — if you had eight of twelve mods on, you get those eight back, not all twelve.

The button tells you which mode you're in and how it launches (Play vanilla (Steam) / Play modded (Steam)). Everything moves to a holding folder and comes back on demand — a failed step-aside never strands your mods.

---

Updating from 0.4.4 is a small delta — the launcher pulls it on its next check, or grab the Setup.exe below.

626 Mod Launcher v0.4.4

Installed frameworks now tell you how to use them.

Install a framework like UE4SS and it shows up in a FRAMEWORKS row above your mods. Click its name and the launcher reads your actual settings off disk and tells you what you need — the real hot-reload key, whether the debug console is on, and where your mods folder lives. There's no separate program to run; UE4SS loads with the game.

Edit framework settings without leaving the launcher.

A pencil next to the framework opens its settings INI right here — flip on the UE4SS console, save, done. Same laws as everywhere else: it snapshots the original first, so Restore Previous always gets you back.

Updating from 0.4.3 is a small delta — the launcher pulls it on its next check, or grab the Setup.exe below.

626 Mod Launcher v0.4.3

Merge pull request #109 from estevanhernandez-stack-ed/feat/ue4ss-ins…