Rueckbau des Inline-Workarounds. Der Runner konnte den reusable workflow
nicht mehr laden, weil git fetch gegen die Forge crashte. Ursache war kein
Bug, sondern eine Kompromittierung ueber CVE-2026-59774: ein injizierter
packObjectsHook ersetzte git pack-objects durch einen Malware-Dropper.
Gitea laeuft jetzt auf 1.27.2, der Hook ist entfernt, fetch funktioniert
wieder. Die Scan-Definition liegt damit wieder an einer Stelle statt in
sieben Dateien. Details: Obsidian "Projekte/Hellion Forge/Forge
Security-Incident 2026-08-15.md".
act_runner laedt reusable workflows per git-clone ueber HTTPS. Dieser Pfad
ist auf der Forge seit 2026-08-12 defekt (git upload-pack --stateless-rpc
bricht mit BUG "packfile_uris requires sideband-all" ab). Die Scans liefen
bisher nur ueber eine im Juni gecachte Kopie im Runner.
Der Scan steht jetzt vollstaendig in dieser Datei, der Quellstand kommt als
tar-Archiv statt ueber actions/checkout. Zurueckbauen, sobald git fetch
ueber HTTPS wieder funktioniert.
- gate keybind pill-sync on IsChannelOrExistingLinkshell so an empty
linkshell slot no longer desyncs the pill from the real send channel
- close manually-popped pop-out windows on logout via an IsOpen filter
instead of the PopOut flag (which manual pops never set)
- read the router's tell-tab lookup through a lock-wrapped accessor so the
framework thread cannot enumerate Config.Tabs mid worker-thread mutation
- add a "switch on every tell" toggle (default on) and make the auto-open
mode pick the matching layout, so Sidebar vs Top-tab are distinct
- comment corrections (stale/contradictory text, TEST-MIRROR path depth)
The eye/hide button now hides the HellionChat window (runtime-only, via a new
DrawConditions gate) instead of toggling native-chat suppression, matching 1.5.6.
The chat-activation keybind (Enter / "/"), whose dispatch was a dead stub in the
KeybindManager since the v1.6.0 rewrite, is re-wired to MainWindow.ActivateChat:
it un-hides, opens if closed, brings the window to front and focuses the input --
so the chat reacts to Enter again from any state. /hellion is a reliable one-press
recovery (Toggle now clears the hide), and the window always shows on login
(start state no longer read from the persisted flag). Adds HideRestoreSelfTestStep.
Re-wires four 1.5.6 settings that survived the v1.6.0 rewrite as dormant config
fields but lost their UI + consumers:
- ShowTitleBar / ShowPopOutTitleBar: gate ImGuiWindowFlags.NoTitleBar on the main
window (ResolveFlags) and pop-out windows (new PreDraw). Inverted logic matches
1.5.6 (flag set only when the toggle is off).
- ShowHideButton: gate the input-bar hide button on the toggle.
- Use24HourClock: add the toggle (MessageList already consumes the field).
New 'Window style' section in WindowTab; Use24HourClock in ChatTab display modes.
MainWindowFlagsStep extended with the NoTitleBar fresh-base contract.
Brings back the 1.5.4 quick-picker lost in the v1.6.0 rewrite: a palette button
in the input-bar button row (left of the cog) opens a popup that switches the
theme (built-in + custom, active row checked) and jumps between chat tabs without
opening settings. Theme switch mirrors the settings ThemePicker; the tab jump
routes through a new MainWindow.ActivateTab that replays the click path
(previous -> set -> OnTabActivated) so tell/unread handling is unchanged. Main
window only -- pop-out InputBars get a null picker. Adds QuickPickerSelfTestStep.
Brings back the 1.5.6 per-channel colour editor lost in the v1.6.0 rewrite:
presets (incl. brand styling), per-ChatType reset/import-from-game/colour-edit
over Config.ChatColours, the colour-selected-input-channel toggle, and the
theme adopt-banner. The colour-edit drag recolours live but defers SaveConfig
to release (IsItemDeactivatedAfterEdit) to avoid a per-frame full-config write.
JonKazama-Hellion