Wandful 0.1.0

Wandful can start with you. One checkbox in Settings, off until you tick it. That is the whole release.

What it does. Summon the wand (tray or menu-bar icon, or Ctrl+Shift+M / ⌘⇧M), hold a mouse button and draw a rune, release: the shortcut bound to it is typed into the app you were in, or the app you chose opens. Draw something no spell knows and the wand offers to make it a spell right there. Spells live in a plain spellbook.json. No account, no cloud, no telemetry.

New

• Start at login. Settings → Start at login adds a login item, and unticking it removes one. It is plain and unprivileged: a ~/Library/LaunchAgents/Wandful.plist on macOS, a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run on Windows. No daemon, no extra arguments — it starts the same bundle you already have, with the wand sheathed. Spellbooks written by earlier versions read back with it off, and the setting survives an update because the app reconciles the login item with what the spellbook says at every start: the plist outlives the process and can be removed behind its back by a move, a reinstall, or a trip through System Settings.

  The box never claims a login item that was not written. If the OS refuses, the failure shows in the sheet and the checkbox stays where it was.

Fixed

• Windows: the icon reader used chunks_exact_mut with a constant size, which stable clippy has since learned to reject, and CI had been red on Windows since. Same bytes out, green build back.

Install

• macOS: brew install --cask ostapondo/tap/wandful, or open the .dmg and drag Wandful to Applications. macOS asks once for Accessibility (System Settings → Privacy & Security → Accessibility). The build is unsigned and not notarised, so the first launch needs right-click → Open.
• Windows: the .exe or .msi. Nothing to grant — the low-level keyboard hook needs no permission. SmartScreen will warn about an unknown publisher; the build is unsigned.

Not yet observed on hardware

The tick-to-plist round trip has been exercised, but nobody has watched the app come back after an actual logout and login, on either platform. If it does not, that is worth an issue.

The three Windows features that shipped unverified in 0.0.2 are still unverified: the five System spells, the elevated-window check, and the overlay's shortcut recorder.

What it writes

SECURITY.md used to say "no login item" under What it does not do. It writes one now, when you ask for it, and the page says where the file lives, that unticking removes it, and that it is one more thing left behind after an uninstall.

Verify

Built from 221eda7 by this run; each file carries a provenance attestation:

gh attestation verify <file> -R ostapondo/wandful

Full list of changes: CHANGELOG.md.

Wandful 0.0.2

Windows, for real this time. 0.0.1 shipped for macOS because nobody had run the Windows build on a real machine. Somebody has now, and this release is what that turned up — .exe and .msi installers are back, and windows-latest is back in CI.

What it does. Summon the wand (tray or menu-bar icon, or Ctrl+Shift+M / ⌘⇧M), hold a mouse button and draw a rune, release: the shortcut bound to it is typed into the app you were in, or the app you chose opens. Draw something no spell knows and the wand offers to make it a spell right there. Spells live in a plain spellbook.json. No account, no cloud, no telemetry.

New

• Shortcuts are built, not captured. Clicking the shortcut field opens a panel: click the keys, or press the combination, and each one becomes a chip you can remove. Nothing listens globally there, so combinations the OS would swallow can be entered like any other — and one that could never be delivered is refused with the reason instead of saved as a spell that does nothing.
• System spells (Windows): lock the screen, Task Manager, switch user, sign out, sleep. Ctrl+Alt+Del cannot be recorded or sent by any application, so these call the APIs behind its menu items instead.
• One title bar (Windows): the native frame is gone and the app's own bar carries minimize, maximize and close, the way the macOS window already overlays its traffic lights.
• A cast aimed at a window running as administrator says so instead of failing silently.

Fixed

The Windows keyboard hook never received a single key — vendored rdev pumped one message instead of looping, so the thread that owned the hook ended and Windows unhooked it, silently. Punctuation keys were typed as text with their modifiers dropped. A System spell could not be saved. Ctrl+Alt+Del while recording left Ctrl and Alt stuck on every chord afterwards. Switch user pointed at a path with a literal tab in it. Sleep never asked for the privilege it needs. The shortcut panel can now be used from the keyboard, and the log no longer records which keys you pressed.

Install

• macOS: brew install --cask ostapondo/tap/wandful, or open the .dmg and drag Wandful to Applications. macOS asks once for Accessibility (System Settings → Privacy & Security → Accessibility). The build is unsigned and not notarised, so the first launch needs right-click → Open.
• Windows: the .exe or .msi. Nothing to grant — the low-level keyboard hook needs no permission. SmartScreen will warn about an unknown publisher; the build is unsigned.

Still unverified

Windows runs, but three things ship without ever having been observed working on hardware, and each has an issue with a recipe: the five System spells, the elevated-window check, and the overlay's shortcut recorder. A report is worth more than a patch.

Verify

Built from b6924aa by this run; each file carries a provenance attestation:

gh attestation verify <file> -R ostapondo/wandful

Full list of changes: CHANGELOG.md.

Wandful 0.0.1

The first tagged build. macOS only for now (Apple silicon and Intel); Windows compiles but is untested on real hardware — see ROADMAP.md.

What it does. Summon the wand (menu-bar icon or ⌘⇧M), hold a mouse button and draw a rune, release: the shortcut bound to it is typed into the app you were in, or the app you chose opens. Draw something no spell knows and the wand offers to make it a spell right there. Spells live in a plain spellbook.json. No account, no cloud, no telemetry.

Install. brew install --cask ostapondo/tap/wandful, or open the .dmg and drag Wandful to Applications. macOS asks once for Accessibility (System Settings → Privacy & Security → Accessibility). The build is unsigned and not notarised, so the first launch needs right-click → Open.

Verify. Built from 4e6bd08 by this run; each file carries a provenance attestation:

gh attestation verify <file> -R ostapondo/wandful

Full list of changes: CHANGELOG.md.