HackDigest 0.4.0

Added

• Secure BYOK key storage (issue #2 secret-custody slice): the key moves out of plain settings.json into the system keyring — macOS Keychain (SecItem), Windows Credential Manager (CredWriteW/CredReadW), Linux Secret Service (libsecret) — behind a product-side FFI (backend/secure-store.rkt). Startup migration moves an existing plaintext key into the keyring, or stamps an explicit apiKeyStorage: "plaintext-optout" marker when no keyring is available (never silently). Settings gains a status row (keyring / plaintext opt-out) with move/opt-out actions over the new POST /api/settings/key-storage route, plus a clear-saved-key button; hosted license keys are exempt (visible by design). Red-green artifact-scan tests: a canary key is written, migrated, and every file under the data dir scanned — green proves zero plaintext residue with resolution still working, red proves the scan catches the pre-migration leak. CI exercises the logic against an in-memory store; the real keyring FFIs are validated on the family VMs per platform.

• Commit the real backend Glaze schema baseline and project manifest, with a CI compatibility check that imports the API without opening a window or database. Document the current delivery priorities and bounded hosted-usage policy.

• HACKDIGEST_SELFTEST=1 self-terminating launch assertion: the packaged app must open its WebView, render the served page from the controlled origin, and composite pixels (title poll + capture) before exiting 0; any failure or timeout exits non-zero with no browser fallback. Release CI runs it on every platform against the packaged artifact (app bundle, dist tree, MSI exe, AppImage), then re-probes the HTTP adapter (HACKDIGEST_TRANSPORT=http) over loopback.

Changed

• Remove the superseded hosted config surface (issue #2 free-product gate check): the "HackDigest Pro（托管）" provider preset, license-key activation, device-bound 7-day trial, and the trial/lifetime/pro quota panel are gone while hosted remains not on sale, per the 2026-10-v2 pricing decision and the 2026-10-auth-1 authorization decision (account-bound entitlements, no desktop activation lease, no per-device trials). Legacy settings with providerId: "hosted" remap on load to a working custom endpoint (same base URL / key / model; cached hostedStatus dropped), and the auto-translate toggles that were stranded inside the hosted-only settings branch are now visible for every provider. raco backend untouched: the settings mask exception for legacy hosted keys stays until secure-storage migration.
• Native transport is the default on all three platforms — the packaged-native switch of the Glaze 1.0-plan G4 cycle closes the consumer transport gap (#2). HACKDIGEST_TRANSPORT=http remains the explicit development adapter; GLAZE_API_TOKEN applies to that adapter only. CI and release installs now pin Glaze at the main head that carries the G4 native-host conformance matrix (flip to the next tagged release when it exists).

Fixed

• The key-storage route returned migrated: null for both no-op and refusal, so the settings page could show a fake success on machines with a locked or missing keyring; it now raises a user error the page can render.
• Every page-initiated non-streaming chat failed with an llm-contract internal error: the page always sent maxTokens: null, which arrived as the 'null symbol and violated the contract; chat-opts-from-jsexpr now centralizes null-safe option parsing for both chat routes.

Release infrastructure

• The CI packaged-native matrix now mirrors the shipped macOS flavors natively (arm64 on macos-latest, x64 on macos-15-intel) instead of selftesting an x86_64 build under Rosetta — the per-commit gate now exercises the flavors users actually receive.
• The Windows HTTP-adapter smoke runs on a fresh runner: the selftest instance can wedge mid-exit on GitHub runners (GPU-less teardown hang, filed upstream as glaze#124) and keep the single-instance mutex alive for minutes, which no cleanup script can reliably beat. The mutex-gated cleanup (taskkill /F /T + Mutex.OpenExisting probes) stays in the smoke's retry loop as defense.
• Transient-failure retries for the DMG hdiutil attach verification and the appimagetool digest fetch.