* feat: move FTP server to third_party and keep Docker
* docs: add ftpsrv to project credits
* feat: add FTP, Docker, and Remote Play support
* docs: document FTP and Remote Play
* feat: improve dependency scripts and add ShadowMountPlus
* docs: update ShadowMountPlus credits
* docs: add ShadowMountPlus config example
* i18n: normalize locale terminology and validation
* fix: launch ShadowMountPlus from memory
Replace the git clone/fetch pipeline with a curl + miniz HTTPS
ZIP download. The engine streams one archive, extracts only the
catalog roots, and reuses flatten to install flat files, so the
libgit2 submodule and its build integration are gone.
Drop the pre-download reachability probe and the commit-SHA
parser; reachability is implied by the download itself and the
SHA only fed the old git flow. Mirror selection stays in
CheatMirrorFactory (auto: cnb.cool for zh-Hans, GitHub otherwise;
explicit github/cnb skips fallback).
curl verifies peer+host against the embedded CA bundle and now
distinguishes certificate time-skew from other verification
failures, surfacing a dedicated clock notification. Revert the
util CMake target back to "util" now that libgit2 no longer
claims that name.
Expose catalog download on the Game Tools page and put the
mirror picker in Preferences. Probe gstatic/miui generate_204
before clone so auto can pick GitHub or cnb.cool by reachability.
Also fix the CNB slug, rename the util CMake target so it no
longer clashes with libgit2, and keep last-error text off the
download button.
Drop the pairing page and the OnActivated / OnDeactivating
lifecycle hooks. Keep the Toolbox entry for offline account
activation, with a localized save-loss warning before writing
an account ID.
Ed25519 signing no longer adds useful friction. Drop
libonion_integrity, tools/elf_sign, and the XOR integrity toasts
so builds no longer sign daemon.elf.
Notifications look up notify.* keys instead of English source
strings. Toolbox interpolations go through toolbox_i18n::format so
zh/en word order lives in the JSON catalogs.
Read the Toolbox toggle from config.ini (default true) instead of the
no_kstuff sentinel so a fresh install loads kstuff. USB no_kstuff still
skips launch.
Leave NPXS40008's icon_setting.png and bundle icon id untouched.
Redirect the URI at CxmlUri so Debug Settings reverts to the Sony
icon when OnionHEN is not loaded.
Keep redistribution and integrity notices out of ELF .rodata by storing
XOR+position-math blobs and decoding at runtime, so casual string search
cannot locate and patch them. Covers toolbox XML banner, bootstrapper
debug toasts, and the shared integrity failure path in daemon.
Add libonion_integrity (Ed25519 self-check + signed-image verify) and
host sign/verify tools. Bootstrapper now verifies the embedded daemon
and runs the beta trial gate before launching private elfldr, util, or
daemon. Stop writing OnionHEN.bin under /data/OnionHEN; link kernel_sys
from bootstrapper for device serial used by trial.
There were seven ways to log, each invented where the previous one was not
reachable:
OnionHEN_log libonion_platform, the only one with a file sink
shellui_log libonion_ipc, klog only — because it did not depend on
libonion_platform
game_log same body as shellui_log
onion_ipc_log same body again
logf libonion_ipc's IPC server, with a sink the host had to
register
log_msg onion_elfldr_server
crash_log util's fault handler, plus a second copy in common/
boot_log bootstrapper's fault handler
klog_printf / klog_puts / printf / puts, called directly
A message's destination therefore depended on which module happened to emit
it: ShellUI's ~300 records went to volatile klog and never reached a log file,
while the daemon's went to klog, stdout and disk.
Everything now goes through the LOG_* macros. All seven legacy entry points
are gone, and klog_printf survives only as a sink inside log.c.
The bare -nostdlib libraries deliberately did not get their own backend. Those
flags only affect the static library's own link step; each is linked into a
host with full libc and pthread, which is why they already called vsnprintf.
A second backend would have recreated the split this removes.
Levels were inferred from message text rather than applied uniformly — the old
entry points carried no severity, so a blanket mapping would either bury real
failures at debug or promote routine chatter to error. Result: 291 error, 63
warn, 140 info, 309 debug.
Consequences worth noting:
* ShellUI records now reach the log file, so a user report finally contains
what the injected process did. In release builds most of them are debug
and compile out, so this costs nothing on a retail unit.
* The IPC server's log-sink injection is gone; both servers registered the
same forwarder.
* common/backtrace.cpp and backtrace.hpp are deleted. That was a third copy
of the frame walking plus its own crash_log, and every caller of
printBacktrace/printBacktraceForCrash had already been commented out.
* Fault handlers use onion_log_emergency, so crash records go to the same
file as everything else instead of a separate crash log.
The shared entry point carries a printf format attribute, which the old
shellui_log explicitly avoided. That attribute found seven real format
defects: %p given typed pointers, %lx given a MonoObject*, %p given a
uint64_t, and %u given an unsigned long. Four of them only compile in debug
builds, so they had gone unnoticed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A --release build defined both DEBUG and NDEBUG, and SHELL_DEBUG was
hardcoded to 1 in defs.h. Every debug branch therefore shipped: the extra
checks in libhijacker's containers, and ~50 verbose diagnostic blocks in the
ShellUI hooks — the chattiest logging in the project, running inside an
injected system process on every boot.
DEBUG is now defined only for non-Release configurations, and SHELL_DEBUG
follows NDEBUG (override with -DSHELL_DEBUG=1 to keep the verbose blocks in a
release build while chasing a report). The symbols that exist only to serve
those blocks are guarded alongside them.
Also drop the hardcoded -O0. Release only got -O3 because it was appended
after it; reordering the flag strings would have silently produced an
unoptimised release build. Optimisation now comes from the build type alone.
Release shellui.elf is 24% smaller than the Debug one, and smaller than
before this change despite the added logging code.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
icon_xml_credits and icon_xml_language were added when SVG rasterization was
automated but never referenced by the toolbox, and were never listed in
daemon.c or main.cpp either, so they had never been embedded or deployed.
Generating the icon table from the asset directory would have started
shipping them; remove the sources instead.
The generated manifest again matches the 26 icons the hand-written table
carried.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
source/include mixed libhijacker's private implementation headers (util.hpp
with its hand-rolled UniquePtr/String/Vector, plus kernel/, elf/, dbg/,
hijacker/) with genuinely cross-module contracts, and the whole directory was
pulled in as -isystem, so any module could reach libhijacker internals and
every warning in those headers was suppressed.
Move the libhijacker-private headers to source/libhijacker/include and expose
it as a PUBLIC include directory, so the two modules that actually use it —
util for hijacker.hpp, shellui for SHA-1 — now declare that dependency.
Split sha1.hpp: the public-domain SHA-1 goes to third_party/sha1, while
NID_KEY, Sha1 and genSha1 (which needed libhijacker's StringView) move into
the nid.hpp that uses them. shellui only ever wanted the plain digest.
Drop source/include's SYSTEM marker now that it holds only first-party
contracts. That surfaced problems -isystem had been hiding:
* 68 format-string mismatches in dbg.hpp, printing uintptr_t with %llx
* freebsd-helper.h redefining PROT_* and TRACEBUF over the SDK's
* ini.h's header-only helpers declared static rather than static inline
The GNU extensions that TYPE_BEGIN/TYPE_FIELD rely on are now silenced per
header instead of by the blanket -isystem.
Also drop three redundant util.hpp includes (bootstrapper, shellui) that
referenced none of its symbols, and fix backtrace.hpp being included through
relative ../include paths.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
util and bootstrapper each carried their own copy of the frame-pointer
walking primitives and backtrace printer, so a fix to either had to be made
twice.
Move them to onion/fault_frame.h. They stay header-inline rather than
becoming library functions because onion_current_frame() returns the frame of
its caller and a fault handler uses that to overwrite its own return address:
putting it behind a call would insert a frame and shift which one gets
rewritten. Signal registration, cleanup policy and the setjmp site differ
between the two handlers and stay where they are.
The backtrace addresses are now assembled into one line and sent through the
sink. util previously printed the frames with raw printf() while the markers
around them went through crash_log(), so the crash log recorded
"backtrace start/end" with no addresses between them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adding a toolbox icon meant editing three hand-maintained places: a 12-line
.incbin block in daemon.c, an extern pair in main.cpp and a write_blob_file()
call. None of them fail the build when missed, while the CMake side was
already driven by a glob over assets/icons.
Generate the .incbin blocks and an X-macro manifest from that same glob, and
walk the manifest at runtime instead of listing every icon by hand.
This surfaced two icons, icon_xml_credits and icon_xml_language, that have
been in assets/icons since SVG rasterization was automated but were never
added to daemon.c or main.cpp, so they were neither embedded nor written to
disk. They are now deployed like the rest. Nothing references them yet, so
they should either be wired into the toolbox or removed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
All 17 module CMakeLists repeated the same prologue: language standards, the
PS5 SDK header paths, a clang check, the cross-compile triple, the output
directory layout and an objcopy strip step. The triple appeared 17 times and
the strip block 6 times, each needing manual sync.
Add source/cmake/OnionTarget.cmake with onion_module_prologue,
onion_output_dirs and onion_strip_debug. Language standards stay opt-in
arguments because the loader-side C modules are C17 while the rest are C11,
and a shared default would silently downgrade them. Per-module compiler flags
are left alone since the modules genuinely differ.
Drop IS_SUBPROJECT and IS_CLANG, which were assigned in 11 and 6 modules
respectively and never read anywhere.
Add CONFIGURE_DEPENDS to the seven source-listing globs that lacked it, so a
newly added source file triggers a re-configure instead of being silently
omitted from the build.
Hoist -DDEBUG onto the shared C flags in the five modules that only passed it
to C++, so both languages in a target see the same macros. No .c file keys
off DEBUG today, so this changes no behaviour.
Compile and link flags were captured from build.ninja before and after: all
132 compile edges and 17 link edges are unchanged except for the intended
-DDEBUG addition.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Require user payloads to launch through :9020 with an exact PID response, removing the :9021 fallback and process-snapshot PID inference.
Supervise the private loader from daemon, recover it through :9021 before restarting util through :9020, and protect synchronous launches with a bounded busy marker.
Add strict loader tests, update runtime documentation, and remove obsolete elfldr and process-snapshot compatibility APIs.
Cache the PS5 system language once per process and share the resolved locale across Toolbox, plain notifications, and rich notifications. Keep ShellUI queries behind the registered trampoline, localize the daemon welcome toast, and cover cache refresh and localized payload generation in host tests.
Share the Toolbox language setting across bootstrapper, daemon, util, and ShellUI notifications. Localize both plain and icon-rich toast text with system-language fallback, and add host coverage for language resolution and rich payload formatting.
Embed the 0xP0CO avatar in bootstrapper assets, show it as a presentation-only button above the existing donation text, and safely consume button presses.
Move bootstrapper SVG sources into a dedicated icons directory, rasterize them into the build tree, and embed the generated PNGs with proper incremental dependencies.
aydencharles