v2.0.0

KnightLoader 2.0 has a new look built on GlimStone. The overview, the lists, the accounts, the instances and the settings are rebuilt, many things are drawn as pictures, the speed graphs show seeding, and the Android app follows suit.

Before you update: the import from debrid accounts is gone. Finish or remove the downloads it brought in first; one still waiting after the update is marked failed with a hint to add its link again. All sizes and speeds are shown in decimal units (kB, MB/s, GB), so a limit you set as 10 MiB/s now reads 10.49 MB/s for the same number of bytes. In the API, torrent.uploadLimitKiBs is now torrent.uploadLimit in bytes per second; settings files and exports from an older version are converted when they are read, but a script that sets the limit needs the new name. The size cap of a live recording and the size of the log file count 1,000,000 bytes per MB. Update the Android app and the browser extension together with the server.

✨ Added

• The Overview opens with what is going on. A line at the top says what is loading and how long it will take, "Needs you" collects what only you can settle, such as a captcha or a failed download, and Customize moves and hides the cards.
• From hoster to disk. A card on the Overview shows where the running downloads come from, what carries them (direct, a proxy or a debrid account) and the folder they land in. Packets run along each line at the speed of the downloads, and a folder's fill level sloshes when one lands.
• Seeding in the speed graphs. The graphs in the web interface and in the Android app draw what your torrents upload as a second graph, and a seeding torrent shows its upload rate in the Speed column. Settings, Appearance, Colours sets the colour of both graphs.
• Pictures on the settings pages. Rules show which rule catches a sample link, Network draws the routes out of the instance with a test that turns each line green or red, and the link collector shows every way a link comes in. The week's schedule and today's speed against it, a reconnect, a torrent's seeding goal, what goes into a video file, the steps after a download and the self-test are drawn too, and every picture holds still when animation is off.
• The pieces of a file. The detail panel shows a download as a band of pieces: the written ranges of an HTTP download with a marker for each connection, the articles of a Usenet file and the blocks a par2 check found damaged.
• After an update, dots mark what changed. A dot stands at each change and on every link that leads there, a click hides it, one button marks everything as seen or shows it all again, and what you have seen follows you between browsers. The release notes open once after an update and stay on the Version card.
• The theme has a third choice, System, which follows the device, in the web interface and in the Android app.
• yt-dlp can keep a video's streams apart. Switch off "Merge into one file" under Settings, Resolvers to keep video, audio and subtitles as separate files. Audio converted without a set bitrate gets the encoder's best quality.
• The Updates card lists every part KnightLoader brings with its version. KnightLoader, yt-dlp and the JDownloader backend each get a card with their updates, so JDownloader, which still updates itself, can also be checked and updated by hand. ffmpeg, ffprobe and the built-in libraries show where they come from, and an info bubble beside each part says what it does.
• Health says why a part has a fault and opens its lines in the log.

🎨 Design

• A new look built on GlimStone 3.5.1. Glyphs, type, cards and colours follow the shared GlimStone design, and only the main action of a view carries the accent colour. Pages, settings included, use the full width of the window.
• The main action of a page floats at its lower right: Customize on the Overview, Start all in the link collector, Add an account on Accounts and Pairing on Instances. Add links sits in the link collector beside the box you paste into.
• Lists have Filter, Sort and Search above them. A click or tap picks a row, Ctrl adds more and Shift picks a range, and a row shows its buttons while you point at it. The link collector's filters by host, file type and package are in the Filter window.
• Play and Pause in the head bar show the queue's state. The filled one is what the queue is doing.
• Accounts are added from one window. "Add an account" shows a large tile for each kind of account, and debrid, captcha and hoster services are picked from tiles with their logos, over 400 of which come with KnightLoader. A click on an account opens it and a right click opens its menu.
• Priority pictures on the Accounts page. "Download priority order" and "Captcha priority order" draw every connected account in the order it is asked; drag a name or use the arrow keys to move it. An account whose check failed keeps its place, dimmed, with the reason. Free downloads stand above both.
• The Instances page shows the group. Every device is a compact card with its state and kind beside its name, under a picture of the group where a parcel travels when links are handed over. A device that waits for approval appears once you approve it.
• The Pairing tab explains itself. Three pictures show how pairing works, a card lists every device of the group and how it is reached, and the address the instance found on its network is listed. Serving as a relay is called "Instance as relay".
• Settings are reorganised. Dropdowns and fields stand beside their names, rows such as rules or categories open in a window, and a test button shows its answer on itself in green or red. Appearance holds the Display card, the sidebar and, in the desktop app, the window, the tray icon and keep awake; the debrid drive has a page of its own, and the captcha order is on Accounts.
• Info closes the settings with Version, Help and About, and the help chapters are in the manual. The settings search appears on a second push upwards at the top of a page, or with the / key.
• On a phone the bottom bar keeps four places and opens the rest from More, and a dialog in a narrow window stands on the bottom edge.
• The Android app draws its speed graph like the web interface, seeding included. The theme choices carry glyphs and the language entry is a button.
• A speed limit is a mark at the right edge of the speed graphs, neutral and with a limit glyph, in place of a red line across the plot. The live figures take the colour of their graph, and a limit above the scale sits at the top edge with an arrow.

⚡ Improved

• Sizes and speeds count in thousands in the web interface, the Android app, the browser extension and the server's messages: kB, MB and GB in place of KiB, MiB and GiB. A limit typed as 30 MB/s is 30 million bytes a second.
• Every captcha account with a key is tried, in the stored order first. Each account has its own switch on the Accounts page, and one you had switched off stays off.
• Downloads are counted the same way everywhere. The Overview, the sidebar badge and the tray window agree: a paused download or a coming retry counts as waiting, and Failed counts only what will not be tried again.
• A Usenet job on your own servers starts at once instead of at the next round.
• The properties panel names what is selected and renames a package or each of its files.
• The desktop card on the Apps page names its release and offers that release's files.

🐛 Fixed

• A torrent removed while its first tracker announce was still out tells the tracker it has left, where the tracker kept counting KnightLoader as a peer.
• The files yt-dlp keeps beside a finished download, such as further subtitle languages, move out of the working folder with it, and KnightLoader only keeps track of files inside that download's folder.
• The Network settings page no longer crashes when its picture redraws after a route test.
• A debrid or TorBox download that is paused or removed stops, also after its account was changed or its host list refreshed, where it went on downloading out of sight until a restart and took part of the speed limit from the downloads after it.
• The browser extension clears its "waiting for approval" note once the browser is approved, where Refresh kept it above an instance that was already connected.
• A JDownloader that restarted to install an update stops with KnightLoader, where the container killed it without letting it save and the desktop app left it running after KnightLoader quit.

🌐 Translations

• Every new text is in all 42 languages of the web interface and the Android app.
• The link collector has one name throughout the German and English interface.

v1.9.0

A security release: reset a forgotten password from the log, every device in a group gets its own key and a new one waits for approval, an app key seals your secrets, and many routes, paths and sign-in checks are tightened.

Before you update: update every instance of a pairing group together, along with the Android app, the browser extension and any relay you run yourself (knightloader-relay, which needs its public address in KL_RELAY_PUBLIC_URL or its names in KL_RELAY_DOMAIN). Every phone, browser and instance then pairs again with the twelve words and waits for approval once; an older app or extension is asked to update. A password shorter than 12 characters still signs you in, but the next change needs 12.

✨ Added

• Forgot password? on the sign-in page. KnightLoader writes a code where only someone with access to the machine can read it: the container log (on Unraid: Docker tab, KnightLoader icon, Logs), the terminal or service output, or password-reset-code.txt in the desktop app's data folder. The code is valid for 10 minutes. The reset switches two-factor authentication off, removes every passkey and API token, signs out every other browser and replaces the session key.
• A reset also takes the instance out of its pairing group. It gets twelve new words, a relay key entered by hand is removed, and every device pairs again. For 30 days a phone or browser with the old words is told over the relay to pair again; the old words themselves are not kept.
• Trusted proxies under Settings, Security. Behind a reverse proxy, the sign-in limit counts each visitor by the address the proxy reports, so one person guessing does not lock everybody out. The field appears once requests come through a proxy. An entry may cover at most 16 addresses (a /28 for IPv4, a /124 for IPv6); a wider one is kept but not used. The standalone relay reads KL_RELAY_TRUSTED_PROXIES.
• Usenet downloads are checked and repaired with par2. A release with missing articles is rebuilt from its recovery files instead of going to a debrid account, shows Verifying or Repairing everywhere, and is only unpacked once it passes. A file posted under a random name gets its real name. A release beyond repair goes to your next account or fails early, and only the recovery files the repair needs are fetched.
• KnightLoader opens .dlc files itself, whether uploaded, dropped into a watched folder or sent by Click'n'Load, and stages their links like those of an RSDF or CCF.
• The extension is on Firefox Add-ons, linked from the README, Settings, Apps and the manual.

⚡ Improved

• Five failed sign-ins a minute per address (eight before, with half the wait). IPv6 addresses also share a limit per /48, and at most two password checks run at once.
• A browser whose session ended returns to the sign-in page after a reset, a changed password or a sign-out everywhere, instead of showing load errors.
• The two-factor info says that a password reset switches it off.

🐛 Fixed

• Usenet: a release whose files finished very quickly could stay in Verifying for good; an .nzb with missing articles finished with a hole and was reported as done; progress after a restart was wrong above about 3 GB; and a forged article or an endless reply could make KnightLoader reserve far too much memory.
• A download removed or paused just as it starts stays stopped, and no longer keeps writing in the background or into the temp folder.
• Restarting or undoing no longer breaks another download: a restart leaves another download's file alone, Undo keeps an unpacking download finished and lets you paste its link again, and a failed one gets the retry it shows.
• A paused download in a renamed package carries on after a restart instead of starting over.
• On Windows, pausing or removing a live yt-dlp recording stops ffmpeg too.
• Several sources for one file respect each debrid account's connection limit, and a restart no longer waits for a player paused on the debrid drive.
• The extension keeps one ID in its group, so it no longer fills the Instances page with Browser cards.
• The JDownloader import is more careful with packagizer folders that only exist on JDownloader's machine and with links its filters rejected.
• The drop folder only renames what it set aside itself.
• Feed entries and crawled pages can no longer point into the local network; such links are left out and logged.
• Android: the battery and notification question comes once, a captcha notification disappears with its connection, the QR scanner notices a camera permission granted in settings, and a connection whose token was revoked says to pair again instead of "unauthorized".
• Connect after scanning a pairing code uses the relay from the code.
• An instance that reconnected to its relay quickly could not be reached until it reconnected again, when no other device of its group was online.
• The sign-in page says to wait after too many attempts instead of "Wrong password.", also for passkeys.
• A new password needs at least 12 characters, counted as characters, not bytes; one over 72 bytes gets its own message.
• The extension uses each language's plural forms ("1 file", not "1 files").

🔒 Security

• An app key makes a copied data folder useless. Set KL_APP_KEY (for example openssl rand -hex 32) and the password hash is peppered with it, while the session key, second factor, recovery codes, account keys, stored passwords and tokens are sealed with it. Existing files are sealed at the next start and the unsealed copies deleted after seven days. Backups are encrypted with it too, so keep the key. Without it everything works as before; the desktop apps make their own.
• Every member of a group signs its calls with its own key, and its id is made from that key, so nobody can act in another device's name or pass as an instance. Unsigned calls are refused, answers come back signed by the instance that gave them, and calls in a group no longer carry a token.
• A new device waits for approval on the Pairing card, showing its kind and key fingerprint; each device shows its own key so you can compare. A new instance and the existing ones approve each other. Removing or refusing a device takes back its key for good, reaches every instance, and only an approved instance can do it.
• One member cannot crowd out the others: waiting calls, used request ids and new devices per hour are counted per key, and a waiting device is never pushed out.
• Group members reach only the routes on a list and see no secrets: archive and download passwords, credentials in links and tracker passkeys are hidden, also from API tokens without Admin. A member picks folders only inside your download folders and cannot erase downloaded files.
• Other websites can no longer act through your browser: changing calls must be JSON, and requests your browser marks as cross-site are refused. Scripts posting with curl -d need -H 'Content-Type: application/json'.
• Without a password, backups, password exports and file deletion are locked. The desktop app's own window still allows them.
• KnightLoader no longer learns domains from sign-ins; the group gets only the addresses you typed under Known domains.
• Nothing is written into the data folder, and a download folder that contains it is refused. The built-in downloads folder still works.
• Logs no longer carry credentials from links, feed and indexer addresses or webhook paths.
• A damaged auth.json or group file stops the start instead of loading as empty.
• Clean up removes only what its preview showed. POST /api/cleanup/{class} takes the preview's digest in a JSON body.
• An older KnightLoader refuses a database written by a newer one, and a restored backup brings no passkeys or database code along.
• Removing a download with its files leaves another download's file alone even when it is reached through a symlink, junction, bind mount or another spelling.
• Sessions end cleanly: signing out ends every copy of the cookie, play links end with their token, an authenticator code works once, and a password change, sign-out everywhere or reset closes every open page's live updates.
• Behind an https proxy the session cookie is marked Secure, and the relay an instance serves trusts X-Forwarded-For only from trusted proxies.
• The server limits what it reads into memory, and the bookmarklet page cannot be framed by another website.

🌐 Translations

• The motion setting is called Animation in the web interface and the Android app.
• All new sign-in, pairing, approval and refusal messages are in your language in the web interface, the Android app and the browser extension.

v1.8.0

KnightLoader downloads from your own Usenet servers, plays a file while it arrives, splits a file across several sources and notifies you on Android, also with the app closed. Every change is listed in CHANGELOG.md.

✨ Added

• Usenet from your own servers. Add your provider under Accounts, Usenet servers, and an .nzb from Sonarr, Radarr, the upload button or the watched folder downloads straight from it over all connections. Fill servers are asked in turn, and articles none of them has go on to TorBox or Premiumize.me. Repair with par2 is not there yet.
• Play while downloading. Play in the download list, and a Play button in the Android app, open a video or song that is still arriving. KnightLoader fetches the part being played first, for torrents and direct downloads alike.
• One file from several sources. Switched on under Settings, Downloads, a file is split across a second debrid account and the spare mirrors the list keeps. A source joins only after it sends the same bytes at sample points.
• Debrid accounts as a drive. TorBox, Real-Debrid, AllDebrid, Premiumize.me and Debrid-Link appear as a read-only WebDAV share, so Plex or Jellyfin stream through rclone without downloading first. Off until you switch it on under Settings, Accounts.
• Torrents on one network interface. Pick an interface such as wg0 under Settings, Torrents, and the built-in client sends nothing while it is down, like qBittorrent's kill switch.
• Notifications on Android, also with the app closed. Captchas, finished and failed downloads show up as notifications. This needs no Google services, so one app serves phones with and without them.
• The extension takes over downloads. Downloads that match your rules go to your instance with the site's cookies, so downloads behind a login work. The popup also lists the video and audio a page plays, HLS and DASH included.
• Clipboard watch in the extension and in the background of the desktop app. Copied links go to your instance, and only the links leave the device. If another device in your group already watches, KnightLoader names it and offers to switch it off there.

⚡ Improved

• The clipboard watches pick up FTP, SFTP and WebDAV links too.

🐛 Fixed

• Trackers stopped getting announces for the other torrents once one was removed. A torrent added again right after its removal now announces as new, and HTTP trackers hear when KnightLoader shuts down.
• A magnet removed while it waited for its file list stayed in the torrent client.
• A restarted download gets a new finish time, so the list and the history count from the second download.
• A long file name, from a rename, a rule or a crawljob, is cut between characters and keeps its extension.
• The desktop app keeps its instance id across restarts, so it is no longer listed twice.
• A download that is running when KnightLoader restarts carries on from the bytes on disk. One paused before the restart starts again at once instead of after ten seconds.
• A server that can't be reached is reported as such instead of as HTTP 502, and a retry that carries on keeps showing the bytes already loaded.
• Importing a settings export from a box without archive passwords no longer says they are missing.
• Removing a download that finished empty, with its files, deletes the empty file too.
• Removing a download with its files leaves a file that a newer download wrote to the same place after the first one was deleted by hand.
• Setting an account's label through the API no longer switches the account off.
• Hoster icons also show up at the end of a long list in the Add account dialog, and the browser console shows fewer failed icon loads.

🌐 Translations

• Every new text is in all 42 languages.

v1.7.0

KnightLoader opens RSDF and CCF containers itself, moves your setup over from JDownloader, talks to every debrid service directly and has been through a security pass over the whole code. Every change is listed in CHANGELOG.md.

✨ Added

• RSDF and CCF without JDownloader. KnightLoader opens these containers itself. A .dlc still goes to JDownloader, because its key is only handed to registered clients.
• Move over from JDownloader. A card under Settings, General takes over accounts, Packagizer and filter rules, archive passwords and the open download list from a JDownloader cfg folder. A preview shows every item before anything is written.
• Share links to the Android app. KnightLoader shows up in Android's share sheet and puts the links in the collector of the instance you tap. A .txt shared from a file manager is read for its links.
• Your own servers on the Accounts page. The Own servers card takes the hostname, username and password of an FTP, SFTP or WebDAV server. A link pasted into the hostname field is cut down to the hostname.
• A test captcha. Settings, Captcha sends a captcha KnightLoader draws itself, so you can see how it reaches the window, the phone and your event targets.
• Torrents through Linksnappy. Linksnappy fetches magnet links and .torrent files like the other debrid services. Rank it above the built-in torrent client on the Accounts page and it takes them. (#61)
• MyDebrid. KnightLoader talks to MyDebrid directly, with the username and password of your MyDebrid account. The Accounts page shows the plan and when it runs out. MyDebrid does not take torrents.
• ParleyPort on the Apps page. The "On a server" card offers ParleyPort, the relay you can run yourself, next to Unraid, Docker and the source code.

🎨 Design

• The README shows each way to run KnightLoader in a picture of its own: desktop, server, Android and the browser extension.
• New pictures for Google Play and F-Droid: five dark screenshots of the app in a drawn phone, each under a short caption, and a new feature graphic, in German and English.
• The Apps page follows the README's order: the server or desktop app first, then the phone app and the browser extension, with the bookmarklet last.
• The README's in-development notice is a picture in the style of the Android testers call, linked to the bug report form, with room before the text below it.
• The README's download buttons stand in groups, the server first, with more room between groups than between rows. Each mark sits nearer the left edge, and ParleyPort's logo is white like the others. The comparison with other download managers has a section of its own after the screenshots, and the screenshots show the container first.
• The README is shorter: screenshots first, then what KnightLoader does, the comparison and how to start. The details are in the manual.

⚡ Improved

• The duplicate check knows the download history. A link you already downloaded goes to the rejected links with the name and date of that download. Restore adds it anyway, and a switch under Settings, Link collector turns the check off.
• Every debrid service is KnightLoader's own. Multihosters reached through JDownloader are gone from the debrid card and the hoster login picker. LeechAll has no public API and asks for a captcha at sign-in, so it is not supported.
• The relay is ParleyPort. Instances, the phone app and the browser extension reach the project relay at parleyport.halleluja.design. The old address keeps answering for a while.
• The phone app follows an instance's own relay when it scans the QR code, and only over wss://. It sends nothing unencrypted: a connection saved before 1.5.0 that points at an http:// address asks to be added again with the twelve words.
• An instance without a password answers only on names it knows, so a web page can no longer reach it through DNS rebinding. If you open a passwordless instance through your own domain, add that domain under Settings > Remote access.
• Sign-in is harder to guess through. Changing the password signs out every other browser, the attempt limit holds against parallel tries, request bodies have a size limit and idle connections are dropped.
• Crawls and feeds stay inside the network of the address you entered, and the relay and the pairing trust only sealed announcements. The app takes a relay peer's name only from its seal.
• Passwords of hosters and debrid services stay out of logs, task errors and the diagnostics bundle. A damaged settings.json, accounts.json or key file is kept as a copy instead of being replaced.
• FTP, SFTP and WebDAV links are found in the paste box, uploaded link lists and Click'n'Load.
• Servers that turn download programs away. When a server hangs up on the browser agent, KnightLoader asks again as itself. If that fails too, the error says the server closed the connection. The link check also finds the size of links whose server hangs up on a HEAD request.
• A paused download carries on after a restart from the bytes already on disk, as long as the server sends the file in parts.
• Long lines of links read fast. 8,000 links on one line took close to a minute and now take a fraction of a second.
• The Android app names none of Google's classes, so F-Droid can build it. It asks for the camera itself, and the store texts and pictures sit in fastlane/, where F-Droid looks. Every store lists the app as just KnightLoader.
• Captcha solvers are called captcha accounts, in every language and in the phone app. Buy Me a Coffee opens in the phone's browser, and the store description names who runs the default relay and what answering a captcha loads.

🐛 Fixed

• Linksnappy takes links under a hoster's other domains, such as mega.nz, k2s.cc, ddownload.com or rg.to. Every debrid service now recognises a hoster by all of its known domains. (#68)
• Removing a yt-dlp download with its files deletes the video, its partial files and the thumbnail, subtitle and info files, also after a restart, and stops a running ffmpeg without leaving a zombie process in the container. Pause and remove work again after an account change, and subtitles from a site that only has WebVTT are saved as .srt.
• FTP and SFTP downloads delete only their own files, keep their own part file across a restart, resume after an Undo, and can still be paused and removed after an account change. FTPS works with vsftpd, ProFTPD and FileZilla Server, and a password in a link is never saved.
• Removing or restarting a renamed or moved download no longer deletes another download's file at the old place, and a finished download of unknown size is deleted with its files after a restart.
• Pausing or removing a download while its link resolves holds, and a download running when KnightLoader stops comes back queued. A link's size survives a restart.
• A torrent the built-in client has partly fetched keeps its progress after a restart instead of going to a debrid service.
• The end-of-queue action waits for files that are still being checked or moved and for pending retries. Schedules catch up after the computer has slept.
• A package named .. cannot put files outside the download folder, and unpacking leaves archives that were already in a folder alone.
• Adding a link you already downloaded leaves the finished copy in its package.
• Links in a .txt in the watched folder lose the full stop or bracket around them, and control characters in a link no longer end up in a file name.
• The Accounts page loads at once, and captcha accounts show their services' logos, in the dark theme too.
• A failed TorBox web download ends instead of being asked about forever, and a changed hoster login reaches JDownloader.
• The quick-add page waits for Add instead of queuing the links as soon as it opens.
• The browser extension keeps the phrase out of reach of web pages, and several extension sessions no longer push each other out.
• The Windows desktop app writes its log again, and releases reach the Chrome Web Store.
• The Android app's Add links says why a send failed.

🌐 Translations

• Every new text is in all 42 languages.

v1.6.0

Pairing works like it does in BombVault, on a Pairing page of its own, and a group can be managed in one list. The Android app reads QR codes with free software, takes a name of its own and follows a default instance, and it is ready for F-Droid. Every change is listed in CHANGELOG.md.

Instances of this version refuse a relay call that is not stamped against being sent again, so update the app and the browser extension together with your instances. The Android app is knightloader.halleluja.design, a new package: Android installs it next to an older copy, which you remove once you have paired the new one.

✨ Added

• A Pairing page under Settings. Generate a phrase or enter one in a window, with the twelve words checked against the word list as you type, a Paste button and the QR code for the app. Pairing works without a login password; the page says what that means when none is set.
• One list for the whole group. The Pairing page lists this instance, the other instances, instances added by address, and every phone and browser extension, each with Connected or Not connected and a Remove button. A removed phone or extension drops its connections and joins again when the phrase is entered there again; a removed instance leaves the group and forgets the phrase.
• Instances of a group on one network talk directly, without going through the relay.
• The browser extension has a card on the Instances page, like the phone, and every card shows its kind in a badge beside its state: the Docker whale, a screen, a phone or a browser.
• The addresses of every instance on the Instances page.
• A name for the phone. Settings > This device in the app sets the name the phone goes by on every instance.
• A default instance in the app, marked with a star. The app opens on it and takes its look from it, and tapping the star on another instance makes that one the default.
• Four more captcha solvers: CapMonster Cloud, CapSolver, 9kw.eu and DeathByCaptcha. Every key is checked against the service before it is saved, and the keys live on the Accounts page.
• A Torrents card on the Overview with the speeds, what came in and went out today and in all, the ratio and the three torrents uploading fastest. A torrent still downloading reads Leeching and has a filter of its own.
• -version on the server and the relay prints the version and exits.
• The browser extension installs from the Chrome Web Store and Edge Add-ons, linked from the README and the Apps page.

🎨 Design

• Lists as dense as JDownloader's. A row in Downloads and the link collector is 28 pixels tall instead of 48, and Row height under Appearance goes back to Medium or Comfortable.
• The label setting is four: buttons, sidebar, tabs and the bottom bar each choose their own.
• Page tabs stay on one row and drop to their glyphs when the names do not fit.
• The Settings tiles take the sidebar's colours, and the Settings pages come in a new order.
• In the app the star and the state badge sit at the end of each card, the phrase field and the word slots are larger, the phrase page scrolls as a whole, the look options are dimmed while the app follows its default instance, and Problems sits above About.

⚡ Improved

• The QR scanner in the app is free software. It reads the camera's live frames with ZXing instead of Google's ML Kit, which sent usage diagnostics to Google, and measures focus and exposure on the middle of the frame, so a code on a bright screen is found in about a second.
• The Android app is smaller: the release build runs R8.
• The Android app can be built by F-Droid from source, without any of Google's libraries.
• A relay cannot deliver a call again. Every sealed call carries its id and the time it was sealed, and an instance runs it once and only within two minutes of its own clock.
• The relay reads at most 4 KiB from a connection until it has said hello.

🐛 Fixed

• Cancel leaves the QR scanner with the first tap.
• A phone that has gone away no longer keeps a card nobody can remove.

🌐 Translations

• The new texts in all 42 languages, in the web interface and the app.

v1.5.0

Torrents a debrid service fetched can be seeded in the built-in client or in your own qBittorrent, the desktop app keeps JDownloader out of sight and opens its window at once, and releases go to the browser and app stores on their own. Every change is listed in CHANGELOG.md.

✨ Added

• Seeding what a debrid service fetched, in the built-in client or in qBittorrent. "Seed what the debrid service fetched" under Settings > Torrents seeds a torrent once all its files are here, without downloading anything. Every file is checked first, and for a .torrent file every piece. "Seed in" picks the built-in torrent client or an external qBittorrent, where cross-seed or qui find it. qBittorrent has to reach the files at the same path; "Download folder in qBittorrent" maps it when two containers mount the folder differently. (#59)
• Only cached torrents to a debrid service, if you like. With "Send only cached torrents to the debrid service" on, a torrent the service has not cached goes on to the next service or the built-in torrent client. TorBox and Premiumize.me are asked directly. Real-Debrid, AllDebrid and Debrid-Link get the torrent added, and KnightLoader deletes it there again unless it is ready within a few seconds. (#59)
• A debrid service that stands still hands the torrent on. After 10 minutes without progress, which you can change or turn off under Settings > Torrents, the torrent is deleted on the service and goes to the next service or the built-in torrent client. Downloads imported from the account and torrents pinned to a service are left alone. (#59)
• Releases go to the stores on their own. Once a release is out, the browser extension goes to the Chrome Web Store, Edge Add-ons and Firefox Add-ons, and the Android app to Google Play. Each goes only when it changed since the previous release.
• An app bundle for Google Play, knightloader-v1.5.0-android.aab, next to the APK and signed with the same key.
• The other versions in the Android app. Its settings have the Apps cards of the web interface: the desktop app for Windows, macOS and Linux, Docker with a button that copies the docker run command, the source code, and the browser extension.
• Unraid in the Android app and the README, dimmed until KnightLoader is listed in Community Applications.
• The privacy policy in the Android app, linked from the About card.

⚡ Improved

• Buy Me a Coffee in the app opens a window with the appeal and the donation page, as the web interface does. PayPal still opens in the browser.
• The tray icon is called the icon in the notification area, in the module, its two switches and the hints that mention it.
• A torrent taken up again to seed never downloads. A finished torrent with a file missing or cut short stops seeding and says why on its row.

🐛 Fixed

• Edge Add-ons accepts the browser extension. The release carries two extension zips: knightloader-extension.zip for Chrome, Edge and the other Chromium browsers, and knightloader-extension-firefox.zip for Firefox.
• The desktop app's JDownloader stays out of sight. It opened its own window and update dialogs because it was not started headless. (#58)
• The desktop app's window opens at once. JDownloader starts in the background and joins when it is ready, instead of holding the window back for minutes on the first start. (#58)
• No console windows on Windows from Java, yt-dlp, ffmpeg or the programs set to run on events.
• Closing the desktop app stops its JDownloader.
• A torrent starts even with a single seeder. The torrent library could stay at 0 bytes next to a connected seeder; it is updated to the version that fixes this.
• A torrent added to a debrid service at shutdown is still cleaned up. Its job on the service was not saved and stayed on the account.
• In the Android app: a single file is "1 file", one instance found offers "Add this instance", an instance that comes back reads Connected again, and the About text says that the QR scanner from Google sends Google usage diagnostics.

🌐 Translations

• The new and renamed texts in all 42 languages, in the web interface and the app.

v1.4.0

One version for everything: this release carries the server, the desktop apps, the Android app and the browser extension together. The desktop app moves to Wails 3 with a window at the tray icon, the browser extension asks for website access only for Click'n'Load, and yt-dlp keeps itself current. Every change is listed in CHANGELOG.md.

✨ Added

• A small window at the tray icon. A click on KnightLoader's icon in the notification area or the menu bar opens it: total speed, active, queued, done and failed downloads, captchas waiting, what is downloading right now and the latest downloads, with buttons to stop or start the queue and to open the main window. Drag its edges to resize it; it remembers the size.
• The tray menu stops and starts the queue, in the language of the interface.
• yt-dlp keeps itself up to date. Once a day KnightLoader fetches a newer yt-dlp, checks it against the release's checksum and makes sure it runs before switching to it. If anything fails, the one you have stays. The switch is on the Tools card under Settings, Resolvers, and it is on from the start.
• More spans for the downloaded volume, and one of your own: 7 days, 30 days, 90 days, 12 months, all time, or any number of days or months. The card remembers what you picked.
• The container image is on Docker Hub too, as junkerderprovinz/knightloader.

🎨 Design

• The desktop app's icon has no dark square behind the logo, and in the taskbar and the notification area the logo is as tall as the icons beside it.
• The Overview's Instances card shows name and state, with the badge at the right edge.
• The downloaded volume's selectors sit under the chart.
• The browser extension's instance cards say Connected and Not connected, like the web interface and the app.

⚡ Improved

• One version number for everything. The server, the desktop apps, the Android app and the browser extension are released together, and each release carries the APK and the extension zip next to the desktop downloads.
• The browser extension asks for access to all websites only for Click'n'Load. Installing it asks for no website access. Switching Click'n'Load on asks, you can say no, and switching it off gives the access back. Sending a page, link, image or selection reads the tab only when you click the extension's button or one of its right-click entries.
• The browser extension's instance cards drop their start and stop buttons. The extension catches and sends links; the queue runs from the web interface, the app or the desktop tray.
• The desktop app runs on Wails 3 and its own tray. On macOS the tray and the window no longer compete for the main thread, which could end a start in a crash.
• The README's badges show the lint run, the Docker Hub pulls and size, the desktop app, the three download engines, the manual and the release downloads.

🐛 Fixed

• Downloads no longer race inside the download library. Starting, pausing and showing progress at the same moment could read and change a download's state without a lock.

🌐 Translations

• Every new text in all 42 languages, in the web interface, the desktop tray and the browser extension.

📋 Notes

• Once after the update on macOS and Linux, the desktop window forgets the language and look you chose and starts from your system's, because it loads the interface from a new address.
• After the update, Click'n'Load may ask once more for website access. Chrome and Edge keep it.
• The browser extension needs Firefox 140, or 142 on Android.
• The Android app updates the installed 1.3.0.

v1.3.0

Finished and Torrents cards, seeding you can stop and start, an upload limit that works, unpacking on the progress bar, and a Windows installer that keeps the desktop app up to date. Every change is listed in CHANGELOG.md.

✨ Added

• Finished and Torrents cards on the Downloads page. A package that has downloaded and unpacked moves into Finished, a finished torrent into Torrents, where the Status column says whether it still seeds. Each card sorts, selects and folds on its own, and both can be switched off under Settings, Downloads.
• Stop and start seeding by hand, from the right-click menu or with the two buttons on the Torrents card's edge. A stopped torrent stays stopped after a restart. A started one seeds to the targets again, counted from the moment you start it. Scripts use POST /api/tasks/seeding/stop and /start.
• The progress bar shows unpacking. While an archive unpacks, the bars of its parts and its package fill with the unpacking, striped so it does not look like a download, and a failed unpacking stays red where it stopped. Another instance's list shows it too.
• A torrent's files show under its row, each with its size, progress and a switch. Switching files while the torrent downloads changes what it fetches and keeps what is already here.
• A Windows installer beside each zip. It installs for everyone under Program Files and leaves your settings, accounts and JDownloader in %APPDATA%\KnightLoader alone, also when uninstalling.
• The desktop app updates itself. It downloads a new release in the background, checks it against checksums.txt and starts it the next time you open KnightLoader. The installed copy is updated by a scheduled task called KnightLoader Update. The switch is on the General page of Settings.
• Captchas over the phrase. The phone app answers reCAPTCHA, hCaptcha and Cloudflare Turnstile when it is connected with the phrase. It shows them under the address of the hoster's page, so they run as they would in a browser on that site.

🎨 Design

• GlimStone 3.0.0 in the web interface, the phone app and the browser extension.
• The remote access card is one row: the phrase buttons and the badges side by side, the password warning under them.
• Each browser gets its own install steps for the extension, with its extensions page and where its Developer mode switch is.
• Apps is the new name of the App tab, and the bookmarklet is a button like the others there.

⚡ Improved

• The torrent upload limit works, for all torrents together, while they download and while they seed, and a change reaches running torrents at once. It is also in the quick settings.
• The DHT and PEX switches reach ordinary torrents, and a new port no longer needs a restart. All three take effect once no torrent is downloading, paused, or seeding, or after a restart.
• Finished torrents seed again after a restart, carrying over their upload, ratio and seeding time.
• Premium only is called Allow free downloads, and your setting keeps its meaning.
• Every release carries the browser extension it serves as knightloader-extension.zip.

🐛 Fixed

• KnightLoader no longer crashes when it is stopped right after a torrent starts.
• Downloads can be moved and deleted over an Unraid share. The container takes UMASK like linuxserver.io images.
• The desktop window shows live updates, and the desktop app knows which release it is.
• The fold buttons on the Finished and Torrents cards are no longer cut off.
• The German installer pages show their umlauts, and the installer's entry shows the right version.

🌐 Translations

• Every new and reworded text in all 42 languages, in the web interface and the app.

📋 Notes

• Torrents run on a fork of gopeed that adds the upload limit, the DHT and PEX switches and the crash fix. KnightLoader goes back to gopeed itself once it has them.

v1.2.0

Usenet, torrents through debrid services, a door for Sonarr and Radarr, tokens with rights, a container image, a manual, and errors that say what to do. Every change is listed in CHANGELOG.md.

✨ Added

• Sonarr, Radarr and Prowlarr can hand work over through qBittorrent's and SABnzbd's APIs at /api/qbittorrent and /api/sabnzbd, with an API token as the password. Each grab gets a folder of its own, so an import never deletes other downloads.
• Usenet through TorBox or Premiumize.me. An .nzb is fetched by the service and downloaded like any other link.
• Torrents through a debrid service, with import from the debrid account, file rules and extra or banned trackers for the built-in torrent client.
• Twelve more debrid services, spoken to directly, and each connected hoster login as its own row on the priority card. A download's backend can be chosen in its properties.
• API tokens carry rights (read, add, control, admin), and KnightLoader runs under a path behind a reverse proxy.
• Programs on events, with the process group ended cleanly when a program stops.
• Captchas in the Android app, hCaptcha solving, and reCAPTCHA Enterprise and v3.
• playmate.to videos and pasted stream playlists download. .m3u8, .m3u and .mpd links, and playlists behind other names, go to yt-dlp.
• Renaming a package moves its files, running downloads included.
• A manual at junkerderprovinz.github.io/knightloader.
• A container image of KnightLoader itself, ghcr.io/junkerderprovinz/knightloader, for amd64 and arm64. Every release publishes it beside the relay image.
• The desktop app for ARM64 on Windows and Linux.
• Download buttons at the top of the README for the desktop apps, the container, the Android app and the browser extension. Each one leads to the newest build: the desktop zips also come under a name without the version, and the app has a standing release, mobile/latest.

🎨 Design

• Noto Sans in the web interface, the phone app and the browser extension, and GlimStone 2.13's motion, glyphs and buttons.
• The Downloads and Collector toolbars stay on one line, folding step by step when room runs short. The right-click menu is as tall as its entries, and rows carry marks for "stop after this one" and disabled links.
• The settings have 21 tiles instead of 24, grouped by task, with explanations behind (i) bubbles across the app.
• The web interface fits a phone.
• The crest on the About card is gone, and with it the only place the build's revision was drawn. /api/health still answers with the revision.

⚡ Improved

• Errors say what went wrong and what to do, in your language, in the web interface and the app. A package whose link failed to download or unpack shows that too.
• Disable is the one way to park a link. Hold is gone, held links become disabled on upgrade, and single links can be disabled in the app too.
• One name for each thing across the interface, the docs and the app.
• A row shows one status, without JDownloader's own state word beside it.
• "Start now" replaces "Force to the front", and pausing a selection pauses its waiting links too.
• Buy Me a Coffee and PayPal open in a window inside the app. The PayPal window asks how often and how much, and takes a card without a PayPal account.
• A release goes public only with its downloads and images built, so the download buttons and the in-app update check never find a release with nothing on it. "Latest", on the release and on the images, goes only to the newest published version.
• The browser extension's send button says what it sends: the page, a link, an image, a selection, or the links a Click'n'Load button handed over. It reads the tab's address only when you press send and no longer asks for the activeTab permission. On Firefox it needs version 140 or later and declares at install which data it sends.

🐛 Fixed

• Sonarr and Radarr no longer delete other downloads after an import.
• API keys no longer appear in AllDebrid and TorBox errors.
• Torrents: two with the same name no longer share a folder, removal after seeding works, and a magnet can no longer land in a foreign folder.
• Unpacking: errors name the part they failed in, RAR sets with encrypted contents try the saved passwords, and a failed unpacking cleans up its folder.
• Downloads: a removed download stays removed, a download with part of its file missing is no longer marked finished, debrid downloads land in the folder the list shows, and the speed limit takes hold within seconds.
• A page whose player nothing supports fails with a reason instead of JDownloader saving its scripts and images.
• A captcha that failed to load and then loads takes back its failure mark.
• A database upgrade cut short no longer keeps KnightLoader from starting.
• The Linux and macOS zips hold a program that starts. They are zipped on the machine that builds them, so the execute bit survives.
• The crypto window has a visible way out, a close button in its footer. Escape and a click beside the window were the only ones before.
• Browser extension: a send from the toolbar popup no longer gets lost, switching Click'n'Load off also stops the jdcheck.js answer, and leaving the group deletes the browser's random member ID.
• The relay no longer logs client IP addresses, and deletes a failed address's rate-limit record within 61 minutes of its last attempt. Its backoff for failed handshakes keeps growing to 50 minutes for a caller that tries one connection at a time.

🌐 Translations

• Every new and reworded text in all 42 languages, in the web interface and the app. The app now keeps a translation ledger like the web interface, so no English text slips in unnoticed. Danish and Swedish call a text selection "markering".

📋 Notes

• /api/controls is gone. POST /api/tasks/hold stays as the older name of /api/tasks/enabled.

v1.1.0

Twelve finished features that nobody could reach now have controls, the download list can be worked from the keyboard, and the instance can say what it is doing and why it is not doing something else. The full entry-by-entry record is in CHANGELOG.md; this is what it means for somebody using it.

✨ Added

• Twelve features were built, tested and wired to nothing. A volume cap with no card to set it on, a retry counter with no denominator on screen, an event list behind a bell that led nowhere, a disk report no page drew, plain-language failure advice with no dialogue to show it in. They are reachable now, and that is the largest single piece of this release.
• The download list can be walked, selected and opened from the keyboard. Arrows move a cursor, Shift extends from the same anchor a Shift-click uses, Space picks a row out the way Ctrl-click does, left and right close and open a folder, Enter opens the properties panel and moves focus there. It is a real tree with one tab stop rather than one per row, so Tab lands on the list and not on the four hundredth badge inside it.
• The list is a table you can arrange, with a drag grip for the priority order and the rows moving under the pointer rather than on release.
• A Kategorien page, and a category is a folder, a queue position, an unpacking switch and a collision rule that are all read and written now. A Packagizer rule can file links into one, and a category can tell a media library to rescan when it finishes.
• Your own servers as a source: FTP, FTPS, SFTP and WebDAV. A seedbox, a NAS, a rented box.
• Sonarr and Radarr can use KnightLoader as their download client.
• A playlist arrives as one row per video instead of one task for the lot.
• Events can be sent outward, to operator-defined targets over plain HTTP, and in-app notifications can be switched per event.
• The instance can answer for itself. A start report at boot, a self test on demand, a health readout per subsystem, and a database that can be checked, compacted and analysed from the interface.
• A readable log. The last 500 lines on screen, searchable, filtered by source rather than by severity, and kept on disk if you want it. Every download also carries its own log lines in its detail panel.
• A search across every settings page, over 22 pages whose set and order come from the pages themselves rather than from a list somebody keeps in step.
• Search, filters and facets survive leaving the page, and can be saved.
• Free space per target folder, a volume curve and a monthly cap, aggregated per host and per backend.
• Your own request headers for one site, and your own sign-in cookies.
• Four more hosters and debrid services (Linksnappy, Offcloud, Debrid-Link, Premiumize.me), each login with its own on/off switch, multihosters marked as such in the picker, and a remaining-allowance bar that also reads the services that meter in a percentage.
• The login can take a second factor, a passkey, or both.
• yt-dlp can be kept current from the Resolvers page, which says which version is in use.

🎨 Design

• Hoster logos, a "do not ask again" switch on every confirmation, and a Linkeingang card that collects what used to be scattered across three places.
• The labelling setting reaches the whole app, not just the sidebar and the settings rail: the head card's buttons, both list toolbars and the collector's own buttons follow it too.
• Every dropdown is a design-language control, the status column says what it means in each list, a selected row looks selected, and the quick settings read as sentences.

⚡ Improved

• One speed limit instead of three. The configured value used to be handed on in three places that could disagree.
• A queued download says why it is not running. The dispatcher always knew; now so does the list.
• The speed curve survives a reload, because the instance records it itself rather than the browser holding it.
• yt-dlp downloads in parallel fragments and chunked ranges, and a media site goes to yt-dlp even when a debrid service also covers it.
• All forty-two languages carry every new string, and placeholders and dashes are guarded per language: a dropped {n} renders a sentence with no number in it for ever in that one language while the compiler stays happy.

🔒 Security

• An event target's headers no longer follow a redirect to somebody else. A target that answers with a redirect was being handed the same headers, credentials included, at whatever address it named.

🐛 Fixed

• A category you added and had not named yet vanished on save.
• A queue held back by the free-space floor said "all slots busy", which sent people looking in the wrong place.
• yt-dlp's own explanation was being thrown away before anything could read it, so its failures arrived as a bare error.
• A refused folder named the wrong field, the command palette could not reach three settings pages, a help link pointed at a page that never existed, and a debrid service with www. in its catalogue link was offered twice.
• The schedule could undo a hard stop.
• Dragging a folder onto a row of a different priority now moves it there, and a link can be dragged into another package.