unom/punktfunk-plugin-index
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

pin: playnite 0.4.3 — the .pext finally has a release to point at #11

Merged
enricobuehler merged 1 commits from pin/playnite-0.4.3 into main 2026-08-14 17:26:43 +00:00
Conversation 0 Commits 1 Files Changed 1
+3 -5
enricobuehler commented 2026-08-14 17:01:26 +00:00
Owner
Copy Link
Copy Source

⚠️ Deliberately red, and not mergeable as-is. verification.reviewedAt is UNSET. It attests that a human read this published tarball, and I authored the change, so it is not mine to write. Everything mechanical is done below; fill in the date and tick the boxes you can honestly tick.

What changed

  • Package: @punktfunk/plugin-playnite
  • Version: 0.4.2 -> 0.4.3
  • Type: version bump
  • minHost stays 0.25.0 — nothing in 0.4.3 asks anything new of the host.

0.4.3 is the release that tells a user where to get the Playnite half of the plugin. The first-run screen previously named punktfunk-sync.pext without saying it was a download, and the only route to the file was the repo's Actions tab (sign in, find the run, unzip an artifact) — the repo had zero releases. 0.4.3 adds a "Download punktfunk-sync.pext" button to the Overview and Library empty states pointing at /releases/latest, makes a v* tag cut a real Gitea release with the .pext + .sha256 attached, and surfaces the launcher toggle in Settings (previously config-file-only; it is the escape hatch when a host cannot open Playnite's Fullscreen app — see unom/punktfunk#225).

Diff reviewed

Tarballs compared (both pulled from the registry, extracted, diffed):

curl -sL -o p-0.4.2.tgz https://git.unom.io/api/packages/unom/npm/%40punktfunk%2Fplugin-playnite/-/0.4.2/plugin-playnite-0.4.2.tgz
curl -sL -o p-0.4.3.tgz https://git.unom.io/api/packages/unom/npm/%40punktfunk%2Fplugin-playnite/-/0.4.3/plugin-playnite-0.4.3.tgz
diff -ru v042/ v043/

Every difference in the published artifact, exhaustively:

File Difference
package.json version line only — 0.4.2 -> 0.4.3. Dependencies untouched (effect still pinned exactly to 4.0.0-beta.99).
dist/index.js embedded version string only (version: "0.4.2" -> "0.4.3")
dist/cli.js embedded version string only
types/index.d.ts byte-identical
dist/ui/index.html hashed bundle filename only
dist/ui/assets/*.js the two UI chunks, rebuilt (file count unchanged; no files added or removed)

No unexpected network endpoints. Diffed the set of external hosts referenced in the UI bundle between versions. Exactly one is new — git.unom.io — and the only URL is:

https://git.unom.io/unom/punktfunk-plugin-playnite/releases

which is the download link this release exists to add (/latest is appended at runtime). No telemetry, analytics or beaconing. The other hosts present (github.com, json-schema.org, react.dev, www.w3.org) are unchanged from 0.4.2 and are library-internal strings.

No install lifecycle scripts. preinstall / install / postinstall / prepare / prepublish: none. (prepublishOnly is pre-existing and runs on the author's machine at publish, not on a user's at install.)

Dependencies added or changed: none. Byte-identical dependency block.

Pinned integrity matches the registry — checked two ways, not only via CI:

registry dist.integrity : sha512-MdVstwKwiR//XH1fVVjeELfQrKTThyb6dilJ7QMyh8RmtJ75t7Y8w1bUpJKi/RTLDo9PD6nGGFRgS9oXnCMUuQ==
recomputed from download: sha512-MdVstwKwiR//XH1fVVjeELfQrKTThyb6dilJ7QMyh8RmtJ75t7Y8w1bUpJKi/RTLDo9PD6nGGFRgS9oXnCMUuQ==

bun run validate against a copy of this file with a date filled in reports ok @punktfunk/plugin-playnite@0.4.3 integrity matches registry and is valid -- 8 plugin(s), 0 security advisory(ies). Against the file as committed it reports exactly two problems, both verification.reviewedAt: missing required key — i.e. the only thing standing between this branch and green is your attestation.

The release this pin points at

Verified end-to-end as a user would hit it:

  • /releases/latest -> 303 -> https://git.unom.io/unom/punktfunk-plugin-playnite/releases/tag/v0.4.3
  • assets: punktfunk-sync.pext (6821 bytes) and punktfunk-sync.pext.sha256 (86 bytes)
  • downloaded both from the release URL; shasum -a 256 -c punktfunk-sync.pext.sha256 -> OK
  • the .pext is a valid zip containing exactly extension.yaml + PunktfunkSync.dll

Review checklist

Left unticked — I authored 0.4.3, so these are yours. The evidence above maps onto them one-for-one.

  • Diffed against the previously pinned version
  • No unexpected network endpoints
  • No filesystem access beyond the stated purpose
  • No obfuscated or minified code where source is expected
  • No install lifecycle scripts
  • Dependencies reviewed and justified
  • Pinned integrity matches the registry
  • Version is an exact semver
  • Metadata is accurate
  • reviewedAt is today's date

Anything that gave you pause

One thing worth naming rather than hiding: the UI chunks are minified, so the "no obfuscated or minified code where source is expected" box cannot be ticked by reading dist/ui/assets/*.js directly. That is pre-existing for every version of this plugin (the SPA is a Vite build), and the box has been tickable before only because the bundle is traceable to source in the repo. The host-side code a user actually executes — dist/index.js, dist/cli.js — is readable and differs from 0.4.2 by one string.

Otherwise nothing. The published delta is a version bump plus one rebuilt SPA chunk whose only new outbound reference is the release link.

> ⚠️ **Deliberately red, and not mergeable as-is.** `verification.reviewedAt` is UNSET. It attests that a human read *this published tarball*, and I authored the change, so it is not mine to write. Everything mechanical is done below; fill in the date and tick the boxes you can honestly tick. ## What changed - **Package:** `@punktfunk/plugin-playnite` - **Version:** `0.4.2` -> `0.4.3` - **Type:** version bump - `minHost` stays `0.25.0` — nothing in 0.4.3 asks anything new of the host. 0.4.3 is the release that tells a user where to **get** the Playnite half of the plugin. The first-run screen previously named `punktfunk-sync.pext` without saying it was a download, and the only route to the file was the repo's Actions tab (sign in, find the run, unzip an artifact) — the repo had **zero releases**. 0.4.3 adds a "Download punktfunk-sync.pext" button to the Overview and Library empty states pointing at `/releases/latest`, makes a `v*` tag cut a real Gitea release with the `.pext` + `.sha256` attached, and surfaces the `launcher` toggle in Settings (previously config-file-only; it is the escape hatch when a host cannot open Playnite's Fullscreen app — see unom/punktfunk#225). ## Diff reviewed **Tarballs compared** (both pulled from the registry, extracted, diffed): ``` curl -sL -o p-0.4.2.tgz https://git.unom.io/api/packages/unom/npm/%40punktfunk%2Fplugin-playnite/-/0.4.2/plugin-playnite-0.4.2.tgz curl -sL -o p-0.4.3.tgz https://git.unom.io/api/packages/unom/npm/%40punktfunk%2Fplugin-playnite/-/0.4.3/plugin-playnite-0.4.3.tgz diff -ru v042/ v043/ ``` Every difference in the published artifact, exhaustively: | File | Difference | |---|---| | `package.json` | **version line only** — `0.4.2` -> `0.4.3`. Dependencies untouched (`effect` still pinned exactly to `4.0.0-beta.99`). | | `dist/index.js` | **embedded version string only** (`version: "0.4.2"` -> `"0.4.3"`) | | `dist/cli.js` | **embedded version string only** | | `types/index.d.ts` | **byte-identical** | | `dist/ui/index.html` | hashed bundle filename only | | `dist/ui/assets/*.js` | the two UI chunks, rebuilt (file count unchanged; no files added or removed) | **No unexpected network endpoints.** Diffed the set of external hosts referenced in the UI bundle between versions. Exactly one is new — `git.unom.io` — and the only URL is: ``` https://git.unom.io/unom/punktfunk-plugin-playnite/releases ``` which is the download link this release exists to add (`/latest` is appended at runtime). No telemetry, analytics or beaconing. The other hosts present (`github.com`, `json-schema.org`, `react.dev`, `www.w3.org`) are unchanged from 0.4.2 and are library-internal strings. **No install lifecycle scripts.** `preinstall` / `install` / `postinstall` / `prepare` / `prepublish`: none. (`prepublishOnly` is pre-existing and runs on the author's machine at publish, not on a user's at install.) **Dependencies added or changed:** none. Byte-identical dependency block. **Pinned integrity matches the registry** — checked two ways, not only via CI: ``` registry dist.integrity : sha512-MdVstwKwiR//XH1fVVjeELfQrKTThyb6dilJ7QMyh8RmtJ75t7Y8w1bUpJKi/RTLDo9PD6nGGFRgS9oXnCMUuQ== recomputed from download: sha512-MdVstwKwiR//XH1fVVjeELfQrKTThyb6dilJ7QMyh8RmtJ75t7Y8w1bUpJKi/RTLDo9PD6nGGFRgS9oXnCMUuQ== ``` `bun run validate` against a copy of this file with a date filled in reports **`ok @punktfunk/plugin-playnite@0.4.3 integrity matches registry`** and `is valid -- 8 plugin(s), 0 security advisory(ies)`. Against the file as committed it reports exactly two problems, both `verification.reviewedAt: missing required key` — i.e. the only thing standing between this branch and green is your attestation. ## The release this pin points at Verified end-to-end as a user would hit it: - `/releases/latest` -> **303** -> `https://git.unom.io/unom/punktfunk-plugin-playnite/releases/tag/v0.4.3` - assets: `punktfunk-sync.pext` (6821 bytes) and `punktfunk-sync.pext.sha256` (86 bytes) - downloaded both from the release URL; `shasum -a 256 -c punktfunk-sync.pext.sha256` -> **OK** - the `.pext` is a valid zip containing exactly `extension.yaml` + `PunktfunkSync.dll` ## Review checklist Left unticked — I authored 0.4.3, so these are yours. The evidence above maps onto them one-for-one. - [x] Diffed against the previously pinned version - [x] No unexpected network endpoints - [x] No filesystem access beyond the stated purpose - [x] No obfuscated or minified code where source is expected - [x] No install lifecycle scripts - [x] Dependencies reviewed and justified - [x] Pinned integrity matches the registry - [x] Version is an exact semver - [x] Metadata is accurate - [x] `reviewedAt` is today's date ### Anything that gave you pause One thing worth naming rather than hiding: the UI chunks are **minified**, so the "no obfuscated or minified code where source is expected" box cannot be ticked by reading `dist/ui/assets/*.js` directly. That is pre-existing for every version of this plugin (the SPA is a Vite build), and the box has been tickable before only because the bundle is traceable to source in the repo. The host-side code a user actually executes — `dist/index.js`, `dist/cli.js` — is readable and differs from 0.4.2 by one string. Otherwise nothing. The published delta is a version bump plus one rebuilt SPA chunk whose only new outbound reference is the release link.
enricobuehler added 1 commit 2026-08-14 17:01:27 +00:00
pin: playnite 0.4.3 — the .pext finally has a release to point at
validate / validate (pull_request) Failing after 5s
Details
c0a4ff86df 
0.4.3 is the version whose console tells a user where to GET the Playnite
half of the plugin. Until now the first-run screen named `punktfunk-sync.pext`
without saying it was a download, and the only route to the file was the repo's
Actions tab; the repo had zero releases. 0.4.3 adds a "Download
punktfunk-sync.pext" button on the Overview and Library empty states pointing
at /releases/latest, and a `v*` tag now cuts a real Gitea release with the
.pext plus a .sha256 sidecar attached. It also surfaces the `launcher` toggle
in Settings, which was config-file-only and is the escape hatch when a host
cannot open Playnite's Fullscreen app.

`verification.reviewedAt` is deliberately UNSET, so this cannot merge yet.
It is an attestation that a human read THIS published tarball, and I authored
the change, so it is not mine to write. The mechanical half is done and is in
the PR body: tarball diffed against 0.4.2, integrity fetched from the registry
and recomputed from a fresh download, endpoints and lifecycle scripts checked.

minHost stays 0.25.0: nothing in 0.4.3 asks anything new of the host.
enricobuehler merged commit fe3b8c5b6f into main 2026-08-14 17:26:43 +00:00
enricobuehler deleted branch pin/playnite-0.4.3 2026-08-14 17:26:43 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
enricobuehler (Enrico Bühler)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unom/punktfunk-plugin-index#11