zerx-lab/FluxDown v0.5.0

on GitHub

docker pull ghcr.io/zerx-lab/fluxdown-server:0.5.0
docker run -d -p 17800:17800 -v fluxdown-data:/data \
  ghcr.io/zerx-lab/fluxdown-server:0.5.0

fluxdown ping                         # 探活（需 FluxDown App / server 运行中）
fluxdown add https://example.com/f.zip
fluxdown ls

0.5.0 - 2026-09-30

⚠️ 注意事项

• 桌面端现在发布全新的 GPUI 客户端：Windows 安装器沿用原 AppId 覆盖升级 Flutter 版，并把 .torrent 关联与 fluxdown/ed2k/magnet 协议改指向新客户端；Windows 安装包改为仅每用户安装，检测到旧的「所有用户」安装时会提权一次运行其卸载器；Windows 产物暂不签名
• 局域网配对协议升级为 v2，与旧版对端不兼容，需两端同时升级
• 站点保存的凭据现在按 scheme://host[:port] 区分，升级后已保存的站点凭据需重新输入一次
• 开启局域网或 CORS 且启用接管/aria2 接口时会自动生成访问密钥，局域网内的 aria2 客户端需配置一次该密钥；headless 服务器首次设置完成前不再对外开放接口
• 浏览器扩展的原生消息中继需与本版 agent 一同升级，否则扩展可能显示「未连接」
• 浏览器扩展的远程验证状态与地址、密钥绑定，修改后需重新验证
• 已安装 deb 预发布（-rc）版本的用户，需用 dpkg -i 覆盖安装一次

🚀 新功能

• 桌面客户端改为 GPUI：新增全局命令面板（⌘K / Ctrl+K）、设置面板与队列管理器、各窗口位置与尺寸记忆、单实例启动与静默捕获、单任务进度窗口、文件类型图标与稳定行序、任务行双击/拖拽/文件丢失跟踪、队列位置标签、拖拽排序的分类列表
• 任务详情新增「来源构成」与「速度」页，可查看 CDN / 代理 / 网卡加速路径占比，并可一键复制错误信息
• 新增多网卡聚合下载；自动代理模式改为多路径并行调度
• 多设备协同：可把任务下发到云设备或已配对设备，支持设备管理、局域网直连配对与同步范围设置
• Headless 服务器（fluxdown-agent --server）托管全新重写的 Web 控制台，与桌面客户端对齐；支持 FLUXDOWN_TOKEN_FORCE 强制覆盖访问密钥
• Web 控制台支持更换任务链接、文件已存在时跳过、空闲扫盘与组件镜像设置；REST API 新增 PUT /api/v1/tasks/{id}/url
• RSS 订阅支持批量选择并下载条目，订阅页支持可拖拽分栏与保存目录选择，未读订阅显示绿点
• 插件页新增插件市场，支持开发期热重载插件；插件与市场错误提示更具体
• Webhook 迁移为独立页面，投递日志重启后保留，预览支持选中复制
• 桌面端与 agent 接入统一诊断日志文件；日志导出与诊断包自动脱敏
• macOS 托盘驻留时隐藏 Dock 图标；开机自启尊重系统级禁用设置
• 主题系统重构为声明式 token 格式
• Linux 提供 tar.gz / AppImage / deb / Arch 包；macOS 提供签名并公证的 DMG

🐛 问题修复

• 修复 HTTP 续传校验、超时与代理路由等一批问题：缺 Content-Range 的 206 响应、响应头无超时、临时文件被不同任务覆盖、Content-Disposition 大小写解析等
• 修复 HLS / DASH：独立音轨被忽略导致下载后无声、直播流被当作点播完成、续传换画质、超时卡死与跨源请求头泄露
• 修复 FTP 续传空洞、控制连接无超时、@ 路径误解析与命令注入
• 修复 ED2K 大文件（>4GB）、同名覆盖、服务器断线不重连与暂停延迟
• 修复 BT 暂停竞态、文件句柄耗尽与「删除任务并删除文件」只删首个文件；磁力解析在 Android 上因 HTTPS tracker 崩溃的问题
• 修复任务状态竞态与队列调度：完成后被改写为暂停、Boost 期间「全部暂停」反而恢复任务、跨午夜定时队列不触发、「启动时继续未完成的下载」无效
• 修复「完成后关机」在自动重试间隙误触发
• 修复 RSS 种子抓取失败无痕重试、PT/Jackett 链接被当普通文件、换订阅地址后灌入历史条目
• 修复 Webhook 对 429/408 不重试、跟随重定向泄露签名
• 修复设置页输入错位写错键、写入失败不回滚、设置与主题偏好写入后界面回弹
• 修复对话框内容超出窗口无法滚动、多窗口与次实例链接转发、最大化状态记忆
• 修复 Windows 便携版数据未写入 portable_data 的问题
• 修复 Web 控制台访问密钥轮换后被强制登出、批量操作请求过多被拒、错误提示未本地化，并新增退出登录入口
• 修复浏览器扩展：旧版 Chromium 消息丢失、下载回退被吞、Firefox 图标失效、远程投递假成功、批量下载 Cookie 串站、排除域名不一致
• 修复用户脚本：回退下载失效、Cookie 跨站泄露、误拦代码页、劫持 FluxDown 自身 Web UI
• 修复 Windows 下 Firefox 关闭会连带结束 FluxDown，并为 Zen 等 Firefox 分支注册原生消息清单，新增 Thorium / Neo 支持
• 加固安全：aria2 / 兼容接口增加来源与 Host 校验、插件 yt-dlp / ffmpeg 参数与路径限制、受管组件下载校验、云端下发目录约束、诊断打开目录与导出日志限制
• 修复 Android：保存目录竞态，并补齐单击菜单、证书开关与静默下载
• 群晖 DSM 7 套件可选择共享文件夹作为保存目录
• 发布产物现在正确上报版本号，不再永远提示有新版本；服务器 / NAS / CLI 的 x86_64 产物回退到基线指令集，修复旧 CPU 上崩溃（SIGILL）

⚡ 性能优化

• 空闲时不再唤醒 NAS 休眠硬盘（idle_file_scan 默认关闭）
• 大批量任务下界面明显更流畅：批量操作改用批量请求，下载页排序与计数不再每帧全量重算
• 冷启动更快，界面等待时间缩短
• 加速 BT 数据传输并减少日志噪音

0.5.0 - 2026-09-30

⚠️ Notes

• The desktop release is now the new GPUI client. On Windows the installer upgrades the Flutter version in place (same AppId) and repoints the .torrent association and the fluxdown/ed2k/magnet protocols to the new client. The Windows installer is now per-user only; if an old all-users install is found, its uninstaller is run once with elevation. Windows builds are unsigned for now
• The LAN pairing protocol is now v2 and incompatible with older peers; upgrade both sides together
• Saved site credentials are now keyed by scheme://host[:port]; re-enter your saved site credentials once after upgrading
• An access key is generated automatically when LAN access or CORS is enabled together with the takeover/aria2 interface; LAN aria2 clients need to be configured with that key once. The headless server no longer exposes these interfaces before first-time setup is complete
• The browser extension's native messaging relay must be upgraded together with this agent, otherwise the extension may show "Not connected"
• The extension's remote verification state is now bound to the address and key; re-verify after changing either
• Users who installed a deb pre-release (-rc) build need to overwrite it once with dpkg -i

🚀 Features

• The desktop client is now GPUI: a global command palette (⌘K / Ctrl+K), settings panel and queue manager, remembered window position and size, single-instance launch and silent capture, a standalone progress window for single tasks, file-type icons with stable row order, row double-click / drag / missing-file tracking, queue position labels, and a drag-to-reorder category list
• Task details gain a "Source composition" section and a "Speed" page showing CDN / proxy / NIC acceleration shares, plus a one-click copy for error messages
• Added multi-NIC aggregated downloading; Auto proxy mode now schedules multiple paths in parallel
• Multi-device collaboration: send tasks to cloud or paired devices, with device management, direct LAN pairing and sync scope settings
• The headless server (fluxdown-agent --server) hosts a fully rewritten Web console aligned with the desktop client, and supports FLUXDOWN_TOKEN_FORCE to override the access key
• The Web console can change a task's URL, skip files that already exist, and configure idle scanning and component mirrors; the REST API adds PUT /api/v1/tasks/{id}/url
• RSS: batch-select and download feed items, a draggable split layout, a save-directory picker, and a green dot for unread subscriptions
• The Extensions page adds a plugin marketplace and supports hot-reloading plugins during development; plugin and marketplace errors are more specific
• Webhooks moved to their own page, delivery logs now persist across restarts, and the preview supports selecting and copying
• Desktop and agent now write a unified diagnostic log file; exported logs and diagnostic bundles are sanitized
• On macOS the Dock icon is hidden while running in the tray; autostart respects system-level disable settings
• The theme system was rebuilt on a declarative token format
• Linux packages: tar.gz / AppImage / deb / Arch; macOS: signed and notarized DMG

🐛 Bug Fixes

• Fixed a batch of HTTP issues around resume validation, timeouts and proxy routing: 206 responses without Content-Range, no response-header timeout, temp files overwritten by other tasks, case-sensitive Content-Disposition parsing, and more
• Fixed HLS / DASH: separate audio tracks ignored (silent output), live streams completed as VOD, variant changes on resume, hangs without timeouts, and cross-origin header leaks
• Fixed FTP resume holes, missing control-connection timeouts, mis-parsed @ in paths, and command injection
• Fixed ED2K large files (>4GB), same-name overwrites, no reconnect after server disconnects, and slow pause
• Fixed BT pause races, file-handle exhaustion, "delete task and files" removing only the first file, and magnet parsing crashes on Android caused by HTTPS trackers
• Fixed task state races and queue scheduling: completed tasks rewritten as paused, "Pause all" during Boost resuming tasks instead, overnight scheduled queues not firing, and "Resume unfinished downloads on startup" having no effect
• Fixed "Shut down after completion" firing in the gaps between automatic retries
• Fixed RSS torrent fetch failures retrying silently, PT/Jackett links treated as plain files, and history being flooded in after changing a feed URL
• Fixed Webhooks not retrying on 429/408 and leaking signatures through redirects
• Fixed settings inputs writing to the wrong key, failed writes not rolling back, and the UI snapping back after saving settings and theme preferences
• Fixed dialogs that could not scroll when taller than the window, link forwarding between instances and windows, and maximized-state memory
• Fixed Windows portable builds not writing data to portable_data
• Fixed the Web console logging out after access-key rotation, batch operations being rejected under load, and untranslated error messages; added a logout entry
• Fixed the browser extension: lost messages on older Chromium, swallowed download fallbacks, broken Firefox icons, false-success remote delivery, cross-site cookies in batch downloads, and inconsistent excluded domains
• Fixed the userscript: broken fallback downloads, cross-site cookie leaks, false interception of code pages, and hijacking FluxDown's own Web UI
• Fixed closing Firefox on Windows taking FluxDown down with it; native messaging manifests are now registered for Firefox forks such as Zen, and Thorium / Neo are supported
• Security hardening: origin and Host checks for aria2 / compatibility APIs, argument and path limits for yt-dlp / ffmpeg plugins, verification of managed component downloads, constraints on cloud-dispatched save directories, and restricted diagnostic open-folder and log export targets
• Android: fixed a save-directory race and added tap menu, certificate toggle and silent download
• The Synology DSM 7 package can now pick a shared folder as the save directory
• Release builds now report the correct version and no longer always prompt for an update; x86_64 server / NAS / CLI builds fall back to the baseline instruction set, fixing crashes (SIGILL) on older CPUs

⚡ Performance

• Idle no longer wakes sleeping NAS hard drives (idle_file_scan is off by default)
• Much smoother UI with many tasks: batch actions use batch requests, and the downloads page no longer re-sorts and recounts everything on every frame
• Faster cold start with shorter waits for the UI
• Faster BT data transfer with less log noise