v2.10.2

Für Mitglieder

• Große Blueprint-Abgleiche laufen zuverlässiger. „Blueprints synchronisieren" trägt neue
  Blueprints jetzt in kleineren Paketen von höchstens 100 ein. Bisher konnte ein Abgleich mit sehr
  vielen neuen Blueprints bei hoher Last mit „Das Basetool ist gerade nicht erreichbar …" abbrechen.
• Sonst ändert sich nichts: keine neue Anmeldung, deine Einstellungen bleiben erhalten.
• Versionen vor 2.10.0 können nicht mehr senden — bitte auf diese Version aktualisieren.

Security check

The MSI was scanned on VirusTotal automatically, straight after the CI build: 0 of 49 engines flag it.

• Report: VirusTotal
• SHA-256: 6205e1d251ba3961766173ca1519f429bef45722626a09b734df72fd35781d7d

The hash belongs to exactly the MSI attached to this release - check it locally with Get-FileHash <your-file>.msi.

Build provenance

This MSI ships with a signed build provenance attestation
(SLSA, Sigstore) tying it to the commit and workflow that built it. Verify the
file you downloaded with the GitHub CLI:

gh attestation verify <your-file>.msi --repo krt-profit/basetool-sc-extractor

What's Changed

• fix(sync): send change sets of at most 100 ops by @greluc in #79
• docs(release): the member note for v2.10.2 by @greluc in #80

Full Changelog: v2.10.1...v2.10.2

v2.10.1

Für Mitglieder

• Code kopieren statt abtippen. Den Code im Fenster „Im Browser bestätigen" kannst du jetzt
  markieren oder mit „Code kopieren" in die Zwischenablage legen und auf der Anmeldeseite im
  Browser einfügen. Gib dort weiterhin nur Codes ein, die dir deine eigene App gerade anzeigt.
• „Offline tokens not allowed" beim ersten Senden mit 2.10.0? Das lag an einer Einstellung im
  Basetool und ist behoben. Einfach erneut senden und die Anmeldung im Browser bestätigen.
• Versionen vor 2.10.0 können nicht mehr senden und zeigen auch keinen Hinweis mehr dazu — bitte
  auf diese Version aktualisieren.

Security check

The MSI was scanned on VirusTotal automatically, straight after the CI build: 0 of 51 engines flag it.

• Report: VirusTotal
• SHA-256: 37c513b64a6b282f54d2dfa8adb0aa063338ced87147552a32befc8f86010853

The hash belongs to exactly the MSI attached to this release - check it locally with Get-FileHash <your-file>.msi.

Build provenance

This MSI ships with a signed build provenance attestation
(SLSA, Sigstore) tying it to the commit and workflow that built it. Verify the
file you downloaded with the GitHub CLI:

gh attestation verify <your-file>.msi --repo krt-profit/basetool-sc-extractor

What's Changed

• feat(auth): the device code can be selected and copied by @greluc in #78

Full Changelog: v2.10.0...v2.10.1

v2.10.0

Für Mitglieder: bitte aktualisieren

Mit 2.10.0 sendet der SC Extractor über die neue Schnittstelle des Basetools. Ältere Versionen
(2.9.1 und davor) können nach der Umstellung nicht mehr senden — sie zeigen dann einen Hinweis zum
Aktualisieren.

Einmal neu anmelden. Beim ersten Senden nach dem Update meldest du dich einmal neu an:

1. Die App zeigt einen Code und öffnet die Anmeldeseite im Browser.
2. Tippe den Code aus der App ein. Gib dort nur Codes ein, die du selbst in deiner App siehst.
3. Danach fragt eine Zustimmungsseite, welche Berechtigungen der Extractor bekommt — bestätigen.

Benenne deine Installation. Beim ersten Senden fragt die App nach einem Namen für diesen Rechner
(z. B. „Spiele-PC"). Unter diesem Namen siehst du ihn im Basetool unter „Verbundene Anwendungen", wo
du ihn auch wieder trennen kannst.

Außerdem neu:

• Nur dein eigenes Spielkonto wird exportiert und gesendet — Logs eines zweiten Kontos auf
  demselben PC bleiben auf deinem Rechner.
• „Blueprints synchronisieren" (freiwillig, einmal einschalten): trägt die Blueprints direkt in
  „Meine Blueprints" ein. Der Abgleich fügt nur hinzu, entfernt nie etwas, und fragt vorher, ob das
  Spielkonto deins ist.
• Fehlermeldungen sagen, was zu tun ist, und enden mit einer Referenz — gib sie an, wenn du einen
  Fehler meldest.
• Senden braucht einen Rechner, auf dem Windows den Anmeldeschlüssel dauerhaft und nicht exportierbar
  ablegen kann (TPM oder Windows-Schlüsselspeicher). Geht das nicht, speichere die Daten als JSON und
  importiere sie im Basetool.

Erscheint beim Senden „Noch nicht möglich: Die Anmeldung für diese Version ist im Basetool noch
nicht freigeschaltet", läuft die Umstellung gerade noch — bitte etwas später erneut versuchen.

Summary (English)

2.10.0 is the extractor's move to the Basetool's exchange API v1 (/exchange/v1) and its first
release as the approved first-party client. Members update, sign in once more (type the code on the
bare device page, then a consent page) and name the installation. Only the member's own game account
is exported; the blueprint file and draft are the v1 envelope (basetool.blueprints 1.0) with no
handle, folder or file name. New opt-in direct blueprint sync (add-only, account check first). Every
call is DPoP-bound to a non-exportable Windows CNG key, reads the service document first, follows
the exchange's binding back-off, and shows a reference id on errors. The legacy /v1/* routes are
gone from this client and are switched off server-side at the go-live.

Security check

The MSI was scanned on VirusTotal automatically, straight after the CI build: 0 of 49 engines flag it.

• Report: VirusTotal
• SHA-256: ff339346f5c7921be2a5abed9edb17ef15963618f1ea0dc38e80dc507e4d8957

The hash belongs to exactly the MSI attached to this release - check it locally with Get-FileHash <your-file>.msi.

Build provenance

This MSI ships with a signed build provenance attestation
(SLSA, Sigstore) tying it to the commit and workflow that built it. Verify the
file you downloaded with the GitHub CLI:

gh attestation verify <your-file>.msi --repo krt-profit/basetool-sc-extractor

What's Changed

• docs: correct stale facts in README, CLAUDE.md and the upload steps by @greluc in #57
• Audit 2026-09: SHA-pinned least-privilege release, fail-closed updater, non-exportable DPoP key by @greluc in #58
• fix(update, auth): follow-ups to #58 (red CI on the helper hash, stored login kept) by @greluc in #59
• fix(packaging): pin the bootstrapped WiX package to its SHA-512 by @greluc in #60
• fix(packaging): no unverified WiX anywhere in the MSI build by @greluc in #61
• refactor: no comments besides KDoc (basetool ADR-0214) by @greluc in #62
• chore(deps): Bump org.jetbrains.compose from 1.12.0 to 1.12.1 by @dependabot[bot] in #63
• chore(deps): Bump org.jetbrains.compose.components:components-resources from 1.12.0 to 1.12.1 by @dependabot[bot] in #64
• feat(refinery): move the OCR cross-reader to PP-OCRv6 small by @greluc in #65
• chore(deps): Gradle 9.8.0 with a checksum-pinned distribution, Python 3.14 in CI by @greluc in #66
• feat: blueprint and refinery improvements from the VerseKit comparison by @greluc in #67
• feat(blueprints): export only the member's own game account by @greluc in #68
• feat(exchange): sync blueprints directly, opt-in, after an account check by @greluc in #70
• feat(exchange): bring the drafts client and the blueprint sync to main (#69, #70) by @greluc in #71
• test(corpus): split the 31-event fixture into its real twelve files by @greluc in #72
• fix(auth): open the bare verification page, the member types the code by @greluc in #73
• fix(exchange): follow the contract as it stands on basetool main by @greluc in #74
• fix(exchange): the binding back-off and the codes of basetool #2241/#2242 by @greluc in #75
• fix(auth): say "not switched on yet" when Keycloak does not offer the exchange by @greluc in #76
• ci(release): put a committed member note in front of the release notes by @greluc in #77

New Contributors

• @dependabot[bot] made their first contribution in #63

Full Changelog: v2.9.1...v2.10.0

v2.9.1

Security check

The MSI was scanned on VirusTotal automatically, straight after the CI build: 0 of 47 engines flag it.

• Report: VirusTotal
• SHA-256: d7152d9f8ee230bd6e1132b37be6c3a8ae11a4b995740e752885aa8172c64e55

The hash belongs to exactly the MSI attached to this release - check it locally with Get-FileHash <your-file>.msi.

Build provenance

This MSI ships with a signed build provenance attestation
(SLSA, Sigstore) tying it to the commit and workflow that built it. Verify the
file you downloaded with the GitHub CLI:

gh attestation verify <your-file>.msi --repo krt-profit/basetool-sc-extractor

What's Changed

• chore(deps): bump Kotlin to 2.4.20 to catch up with the Gradle wrapper by @greluc in #54
• fix(auth): follow the identity move onto the app origin, and bump onnxruntime by @greluc in #56

Full Changelog: v2.9.0...v2.9.1

v2.9.0

Security check

The MSI was scanned on VirusTotal automatically, straight after the CI build: 0 of 50 engines flag it.

• Report: VirusTotal
• SHA-256: 3cebf8f6bddca59e408b6bd4e90b3247f9c38802a7d778f76ee449c65acf5095

The hash belongs to exactly the MSI attached to this release - check it locally with Get-FileHash <your-file>.msi.

Build provenance

This MSI ships with a signed build provenance attestation
(SLSA, Sigstore) tying it to the commit and workflow that built it. Verify the
file you downloaded with the GitHub CLI:

gh attestation verify <your-file>.msi --repo krt-profit/basetool-sc-extractor

What's Changed

• chore(deps): bump onnxruntime to 1.29.0 and Gradle wrapper to 9.7.1 by @greluc in #48
• ci: attest build provenance for the MSI, add CODEOWNERS by @greluc in #49
• docs(claude): make the knowledge base binding before and after every task by @greluc in #50
• chore(deps): bump Compose plugin + components-resources to 1.12.0, setup-java to v6 by @greluc in #51
• docs: correct the stale facts in the README by @greluc in #52
• fix(refinery): locate the work-order panel on the new C47 terminal skin by @greluc in #53

Full Changelog: v2.8.2...v2.9.0

v2.8.2

Security check

The MSI was scanned on VirusTotal automatically, straight after the CI build: 0 of 50 engines flag it.

• Report: VirusTotal
• SHA-256: af1de679eda87c7d5cd65205992575415abb861038dfbc33dbe81b10b2df288e

The hash belongs to exactly the MSI attached to this release - check it locally with Get-FileHash <your-file>.msi.

What's Changed

• docs: put everything GitHub-facing into English by @greluc in #47

Full Changelog: v2.8.1...v2.8.2

v2.8.1

Security check

The MSI was scanned on VirusTotal automatically, straight after the CI build: 0 of 50 engines flag it.

• Report: VirusTotal
• SHA-256: 5359f43c94d3df6aa4cfa19b89fbecc07abb77ce9f4d773efe9948a64df63849

The hash belongs to exactly the MSI attached to this release - check it locally with Get-FileHash <your-file>.msi.

What's Changed

• docs: correct the ingest client doc that contradicts its own code by @greluc in #43
• ci: scan every release on VirusTotal and link the report by @greluc in #45
• fix(ci): upload to VirusTotal with curl, and stop swallowing the error by @greluc in #46

Full Changelog: v2.8.0...v2.8.1

v2.8.1-rc1

What's Changed

• docs: correct the ingest client doc that contradicts its own code by @greluc in #43
• ci: scan every release on VirusTotal and link the report by @greluc in #45

Full Changelog: v2.8.0...v2.8.1-rc1

v2.8.0

What's Changed

• build: Dependency-Audit — Gradle 9.7.0 und den deprecated Compose-Resources-Accessor ablösen by @greluc in #42
• feat(ui): wear the Extractor variant of the Basetool app mark by @greluc in #44

Full Changelog: v2.7.2...v2.8.0

v2.7.2

What's Changed

• fix(ingest): present the bound token under DPoP with a proof the gateway validates by @greluc in #41

Full Changelog: v2.7.1...v2.7.2