- Upgrade zustand from 5.0.0-rc.2 to ^5.0.0 (resolved 5.0.12)
- Fix player:dev and player:build scripts that referenced non-existent
@mediago/player-build, now correctly point to @mediago/core-build
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Previously the frontend hashed passwords with MD5 + a hardcoded salt
before sending to the backend. This exposed the salt in client-side JS
and used an insecure hash algorithm.
Backend changes:
- Setup: accepts plain password, bcrypt hashes it, generates UUID apiKey
- Signin: accepts plain password, bcrypt verifies, returns stored apiKey
- Status: checks passwordHash instead of apiKey
- AppStore: new passwordHash field
- Middleware: add X-API-Key header support (was only reading Authorization)
- CORS: allow X-API-Key header
Frontend changes:
- Signin page: send plain password, receive apiKey from response
- Remove md5/crypto-js dependency and APIKEY_SALT_KEY constant
- api/download-task: auto-inject localPath/deleteSegments from store
(was lost during go-adapter migration, caused EOF errors)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Phase 4-6 of monorepo merge:
- Create scripts/download-deps.ts for downloading third-party tools
from GitHub Releases (ffmpeg, N_m3u8DL-RE, BBDown, gopeed)
- Add scripts/deps-versions.json for version-locked tool definitions
- Update pnpm-workspace.yaml for new monorepo structure
- Change @mediago/core-sdk references from file:// to workspace:*
- Remove @mediago/core, @mediago/deps, @mediago/player npm deps
from electron package.json
- Rewrite binaryResolver.ts to use monorepo paths (dev) and
extraResources (production) instead of npm platform packages
- Simplify apps/core/scripts/config.ts (remove npm config, use .deps/)
- Add Go project scripts to root package.json
- Update turbo.json build outputs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove old Koa/Socket.IO server, replace with minimal ServiceRunner launcher
- UI now connects directly to Go Core via SDK (HTTP + SSE), no middleware
- Add GoEventBridge for SSE events and progress polling
- Add Dockerfile and docker-compose for single-container deployment
- Fix web mode adapter Proxy ownKeys for proper method enumeration
- Fix auth flow: setupAuth now sets apiKey, App.tsx passes stored apiKey
- Add error handling in download-form for getVideoFolders
- Remove conversion.controller import (file was deleted)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace @typescript/native-preview with standard typescript package
and remove tsgo-specific dts config from tsdown configurations.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
caorushizi