Add files via upload

Author: TheHolyOneZ

CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [1.2.0] — 2026-03-21
+
+### Added
+
+- **Game-already-running detection** — launching while another session is active shows a confirm dialog with "Stop & Launch" to switch games instantly
+- **Live "Playing" indicator** — play button shows a pulsing green "Playing" state while a game session is active
+- **Stop & Launch** — terminates the running game process (`TerminateProcess`) before launching the new one; all launch entry-points consolidated into a shared `useLaunchGame` hook
+
+### Fixed
+
+- **ZipSlip path traversal** — `install_bepinex` and `install_melonloader` now validate each ZIP entry path component, rejecting any `..` or rooted segments; `canonicalize` double-check against base directory
+- **Scan button broken** — `GameGrid` now calls `useScan()` at component level; the "Scan Steam / Epic / GOG" empty-state card correctly triggers the scan hook instead of a dead dynamic import
+- **Dual game state divergence** — `game-session-ended` listener in `AppBehavior` now calls `qc.invalidateQueries` rather than manually replacing store state; TanStack Query is the single source of truth
+- **Soft-delete UNIQUE constraint** — `steam_app_id` and `epic_app_name` UNIQUE column constraints replaced with partial unique indexes (`WHERE deleted_at IS NULL`); live migration rebuilds existing installs automatically
+- **IGDB token waste** — `fetch_igdb_metadata` now caches the OAuth access token in `IgdbTokenState` with a 60-second expiry buffer; subsequent lookups reuse the cached token instead of requesting a new one per call
+- **Unrestricted filesystem write** — `save_file` command validates the resolved canonical target path against an allowlist of safe directories (APPDATA, LOCALAPPDATA, Documents, Desktop, Downloads, OneDrive); writes outside these directories are rejected
+- **Missing transactions** — `reorder_games` and `batch_update_games` now wrap their multi-statement loops in a single SQLite transaction for atomicity and a ~10× throughput improvement
+- **Game tracking fallback** — tracking state no longer resets instantly when a Steam/Epic game has no install directory or exe path; fallback tracker keeps the session active until manually stopped
+
+---
+
 ## [1.0.0] — 2026-03-20
 
 ### Added
@@ -69,22 +90,6 @@
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
 ---
 
 ## [0.9.0] — 2026-03-20
@@ -250,10 +255,6 @@
 
 
 
-
-
-
-
 ---
 
 ## [0.6.0] — 2026-03-17

README.md

@@ -10,46 +10,48 @@ Track, organize, rate and launch every game you own — Steam, Epic, GOG, and cu
 <p>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-7c3aed?style=flat-square" alt="MIT License"/></a>
   <img src="https://img.shields.io/badge/Platform-Windows%2010%2F11-0078D4?style=flat-square&logo=windows" alt="Windows"/>
-  <img src="https://img.shields.io/badge/Version-1.0.0-22c55e?style=flat-square" alt="v1.0.0"/>
+  <img src="https://img.shields.io/badge/Version-1.2.0-22c55e?style=flat-square" alt="v1.2.0"/>
   <a href="https://tauri.app"><img src="https://img.shields.io/badge/Built%20with-Tauri%202-FFC131?style=flat-square" alt="Tauri 2"/></a>
   <img src="https://img.shields.io/badge/React-18-61DAFB?style=flat-square&logo=react" alt="React 18"/>
   <img src="https://img.shields.io/badge/Rust-backend-CE422B?style=flat-square&logo=rust" alt="Rust"/>
 </p>
 
 <p>
   <a href="https://zsync.eu/zgamelib/"><strong>🌐 Website</strong></a> &nbsp;·&nbsp;
-  <a href="https://zsync.eu/zgamelib/app/ZGameLib_1.0.0_x64_en-US.msi"><strong>⬇ Download MSI</strong></a> &nbsp;·&nbsp;
-  <a href="https://zsync.eu/zgamelib/app/ZGameLib_1.0.0_x64-setup.exe"><strong>⬇ Download EXE</strong></a> &nbsp;·&nbsp;
+  <a href="https://zsync.eu/zgamelib/app/ZGameLib_1.2.0_x64_en-US.msi"><strong>⬇ Download MSI</strong></a> &nbsp;·&nbsp;
+  <a href="https://zsync.eu/zgamelib/app/ZGameLib_1.2.0_x64-setup.exe"><strong>⬇ Download EXE</strong></a> &nbsp;·&nbsp;
   <a href="https://github.com/TheHolyOneZ/ZGameLib"><strong>GitHub</strong></a>
 </p>
 
 </div>
 
 ---
 
-## What's New in v1.0.0
+## What's New in v1.2.0
 
-The milestone release. v1.0.0 is focused on **Polish & Discovery** — making ZGameLib feel like a finished, welcoming product from the very first launch.
+v1.2.0 brings **game session management**, **security hardening**, and **8 targeted bug fixes**.
 
 | Feature | Description |
 |---------|-------------|
-| **Interactive Onboarding Tour** | Three-mode cinematic tour (Quick / Standard / Deep Dive) with animated spotlight overlay, live UI demonstrations, and a custom ending animation |
-| **Year in Review** | Annual gaming recap at `/wrapped` — total hours, most played, top rated, busiest month, platform split, 9 animated stat cards |
-| **Smart Play Recommendations** | "Play Next" strip on the library page — surfaces your best backlog picks using tag and genre matching against your highest-rated games |
-| **What's New Modal** | In-app release notes shown automatically on first launch after an update |
-| **Contextual Empty State** | Three action cards (Scan, Add, Browse Steam) replace the blank state once onboarding completes |
-| **New Keyboard Shortcuts** | `S` scan, `W` wrapped, `H` toggle hidden, `1`–`9`/`0` quick-rate, documented `Ctrl+Z` undo deletion |
-| **Default 6-Column Grid** | Out-of-the-box grid now shows 6 columns instead of 4 |
+| **Game-Already-Running Detection** | Launching while another session is active shows a confirm dialog with "Stop & Launch" to switch games instantly |
+| **Live "Playing" Indicator** | Play button shows a pulsing green "Playing" state while a game session is active |
+| **Stop & Launch** | Terminates the running game process (`TerminateProcess`) before launching the new one |
+| **ZipSlip Patch** | Path traversal vulnerability patched in BepInEx/MelonLoader installer |
+| **Filesystem Hardening** | `save_file` restricted to safe directories (AppData, Documents, Desktop) |
+| **IGDB Token Cache** | OAuth tokens cached with 60s expiry buffer — no redundant round-trips |
+| **Soft-Delete Fix** | Partial UNIQUE indexes prevent duplicate blocking on soft-deleted records |
+| **Transaction Safety** | `reorder_games` and `batch_update_games` wrapped in SQLite transactions |
+| **Game Tracking Fallback** | Steam/Epic games without install directory stay tracked instead of resetting instantly |
 
 ---
 
 ## Preview
 
-> Recorded on v0.7.0. v1.0.0 includes onboarding tour, Year in Review, smart recommendations, and many more improvements.
+> Recorded on v0.3.0. Latest version includes game session management, onboarding tour, Year in Review, smart recommendations, and many more improvements.
 
 <div align="center">
 
-[![ZGameLib Preview](https://img.youtube.com/vi/4L1U4SOJrQg/maxresdefault.jpg)](https://www.youtube.com/watch?v=4L1U4SOJrQg)
+[![ZGameLib Preview](https://img.youtube.com/vi/rlqUUqAPOxU/maxresdefault.jpg)](https://www.youtube.com/watch?v=rlqUUqAPOxU)
 
 </div>
 
@@ -59,16 +61,16 @@ The milestone release. v1.0.0 is focused on **Polish & Discovery** — making ZG
 
 | Installer | Format | Notes |
 |-----------|--------|-------|
-| [ZGameLib_1.0.0_x64_en-US.msi](https://zsync.eu/zgamelib/app/ZGameLib_1.0.0_x64_en-US.msi) | `.msi` | **Recommended** — Windows Installer |
-| [ZGameLib_1.0.0_x64-setup.exe](https://zsync.eu/zgamelib/app/ZGameLib_1.0.0_x64-setup.exe) | `.exe` | NSIS alternative installer |
+| [ZGameLib_1.2.0_x64_en-US.msi](https://zsync.eu/zgamelib/app/ZGameLib_1.2.0_x64_en-US.msi) | `.msi` | **Recommended** — Windows Installer |
+| [ZGameLib_1.2.0_x64-setup.exe](https://zsync.eu/zgamelib/app/ZGameLib_1.2.0_x64-setup.exe) | `.exe` | NSIS alternative installer |
 
 > **Windows SmartScreen:** On first launch you may see *"Windows protected your PC"* — click **More info → Run anyway**. This is expected for unsigned indie apps.
 
 ---
 
 ## Table of Contents
 
-- [What's New in v1.0.0](#whats-new-in-v100)
+- [What's New in v1.2.0](#whats-new-in-v120)
 - [Features](#features)
   - [Onboarding Tour](#-interactive-onboarding-tour)
   - [Library & Scanning](#-library--scanning)
@@ -264,7 +266,9 @@ The signature 1.0 feature. On first launch, users pick a tour mode — ZGameLib
 - Multi-process games (launcher stub → real exe) are handled with an adaptive grace window: 300 s for the initial launcher handoff, then 30 s once the real game is confirmed running
 - Records elapsed minutes and saves a session row when the game exits; fires a `game-session-ended` event to the frontend so playtime updates instantly without a manual refresh
 - Updates `last_played` timestamp on launch
-- Falls back to single-PID tracking when no install directory is resolvable
+- Falls back to timeout-based tracking when no install directory is resolvable — session stays active until manually stopped
+- **Game-already-running detection** — if you try to launch a game while another is tracked, an in-app confirm dialog offers "Stop & Launch" to kill the running game (`TerminateProcess`) and start the new one
+- **Live "Playing" indicator** — the play button shows a pulsing green "Playing" state while a game session is active
 - **Idle detection** — polls `GetForegroundWindow` every 30 s; if the game window loses focus for 5+ consecutive minutes, that idle period is excluded from the session total; brief alt-tabs are ignored; can be toggled off in Settings → Behavior
 - **Steam Playtime Sync** — enter your Steam API Key and SteamID64 in Settings → Integrations; sync only increases local values, never decreases
 - **Minimize on launch** — ZGameLib hides to tray with a 400 ms delay (for window focus handoff), then auto-restores when the game exits
@@ -1070,6 +1074,17 @@ npx tauri dev
 
 Rust source changes trigger a full backend recompile. Frontend changes hot-reload instantly.
 
+### Production Build
+
+```powershell
+.\build-release.ps1
+```
+
+Outputs installers to `src-tauri/target/release/bundle/`:
+- `msi/ZGameLib_1.2.0_x64_en-US.msi`
+- `nsis/ZGameLib_1.2.0_x64-setup.exe`
+
+---
 
 ## License
 

src/components/game/GameDetail.tsx

@@ -8,6 +8,7 @@ import { useGames } from "@/hooks/useGames";
 import { useCover, setCoverCache, clearCoverCache } from "@/hooks/useCover";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { api } from "@/lib/tauri";
+import { useLaunchGame } from "@/lib/useLaunchGame";
 import { cn, formatPlaytime, formatDate, COVER_PLACEHOLDER } from "@/lib/utils";
 import StarRating from "@/components/ui/StarRating";
 import GameNotes from "./GameNotes";
@@ -153,6 +154,8 @@ export default function GameDetail() {
   const { update, remove, toggleFavorite } = useGames();
   const openConfirm = useUIStore((s) => s.openConfirm);
   const addToast = useUIStore((s) => s.addToast);
+  const activeGameId = useUIStore((s) => s.activeGameId);
+  const { launch } = useLaunchGame();
 
   const [editingName, setEditingName] = useState(false);
   const [nameVal, setNameVal] = useState("");
@@ -272,14 +275,11 @@ export default function GameDetail() {
     }
   };
 
-  const handlePlay = async () => {
-    try {
-      if (game.platform === "steam" && game.steam_app_id) await api.launchSteamGame(game.steam_app_id, game.id);
-      else if (game.platform === "epic" && game.epic_app_name) await api.launchEpicGame(game.epic_app_name, game.id);
-      else await api.launchGame(game.id);
+  const handlePlay = () => {
+    launch(game, () => {
       setGameStarted(true);
       setTimeout(() => setGameStarted(false), 3000);
-    } catch (e) { addToast(String(e), "error"); }
+    });
   };
 
   const loadSessions = async () => {
@@ -786,14 +786,23 @@ export default function GameDetail() {
               <div className="flex gap-2">
                 <motion.button
                   data-tour="play-btn"
-                  whileHover={{ scale: 1.02 }}
-                  whileTap={{ scale: 0.98 }}
-                  onClick={handlePlay}
-                  className={cn("btn-primary flex-1 justify-center py-3 transition-all", gameStarted && "bg-green-600 hover:bg-green-500")}
-                  style={{ boxShadow: gameStarted ? "0 0 25px rgba(34,197,94,0.3)" : "0 0 25px rgb(var(--accent-500) /0.2)" }}
+                  whileHover={{ scale: activeGameId === game.id ? 1 : 1.02 }}
+                  whileTap={{ scale: activeGameId === game.id ? 1 : 0.98 }}
+                  onClick={activeGameId === game.id ? undefined : handlePlay}
+                  className={cn(
+                    "btn-primary flex-1 justify-center py-3 transition-all",
+                    activeGameId === game.id && "bg-green-600 hover:bg-green-600 cursor-default",
+                    gameStarted && activeGameId !== game.id && "bg-green-600 hover:bg-green-500",
+                  )}
+                  style={{ boxShadow: activeGameId === game.id ? "0 0 25px rgba(34,197,94,0.3)" : gameStarted ? "0 0 25px rgba(34,197,94,0.3)" : "0 0 25px rgb(var(--accent-500) /0.2)" }}
                 >
                   <AnimatePresence mode="wait" initial={false}>
-                    {gameStarted ? (
+                    {activeGameId === game.id ? (
+                      <motion.span key="playing" initial={{ opacity: 0, y: 4 }} animate={{ opacity: 1, y: 0 }} exit={{ opacity: 0, y: -4 }} className="flex items-center gap-1.5">
+                        <span className="relative flex h-2.5 w-2.5"><span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-green-300 opacity-75" /><span className="relative inline-flex rounded-full h-2.5 w-2.5 bg-green-400" /></span>
+                        Playing
+                      </motion.span>
+                    ) : gameStarted ? (
                       <motion.span key="started" initial={{ opacity: 0, y: 4 }} animate={{ opacity: 1, y: 0 }} exit={{ opacity: 0, y: -4 }} className="flex items-center gap-1.5">
                         <CheckIcon size={14} />
                         Game Started

src/components/layout/Layout.tsx

@@ -1,6 +1,6 @@
 import { Outlet, useNavigate } from "react-router-dom";
 import { useEffect, useRef, useState } from "react";
-import { useQuery } from "@tanstack/react-query";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { motion, AnimatePresence } from "framer-motion";
 import { listen } from "@tauri-apps/api/event";
 import { api } from "@/lib/tauri";
@@ -183,6 +183,7 @@ function AppBehavior() {
     queryFn: () => api.getSettings(),
     staleTime: 5 * 60 * 1000,
   });
+  const qc = useQueryClient();
   const { scan } = useScan();
   const { pullUninstalled } = usePullUninstalled();
   const hasAutoScanned = useRef(false);
@@ -212,12 +213,12 @@ function AppBehavior() {
   }, []);
 
   useEffect(() => {
-    const promise = listen<string>("game-session-ended", async () => {
-      const games = await api.getAllGames();
-      if (games) useGameStore.getState().setGames(games);
+    const promise = listen<string>("game-session-ended", () => {
+      qc.invalidateQueries({ queryKey: ["games"] });
+      useUIStore.getState().setActiveGameId(null);
     });
     return () => { promise.then((f) => f()); };
-  }, []);
+  }, [qc]);
 
   useEffect(() => {
     const promise = listen<string>("playtime-reminder", (event) => {

src/components/library/GameCard.tsx

@@ -8,6 +8,7 @@ import { useUIStore } from "@/store/useUIStore";
 import { useGames } from "@/hooks/useGames";
 import { useCover } from "@/hooks/useCover";
 import { api } from "@/lib/tauri";
+import { useLaunchGame } from "@/lib/useLaunchGame";
 import GameContextMenu from "@/components/ui/GameContextMenu";
 import PlatformBadge from "@/components/ui/PlatformBadge";
 import { HeartIcon, PlayIcon, FolderIcon, StarIcon, FireIcon, SettingsIcon, AlertIcon, CheckIcon } from "@/components/ui/Icons";
@@ -17,6 +18,7 @@ function GameCard({ game }: { game: Game }) {
   const setDetailOpen = useUIStore((s) => s.setDetailOpen);
   const addToast = useUIStore((s) => s.addToast);
   const { toggleFavorite, update } = useGames();
+  const { launch } = useLaunchGame();
   const coverUrl = useCover(game);
   const [imgFailed, setImgFailed] = useState(false);
   const [hovered, setHovered] = useState(false);
@@ -34,19 +36,9 @@ function GameCard({ game }: { game: Game }) {
     toggleFavorite(game.id);
   };
 
-  const handlePlay = async (e: React.MouseEvent) => {
+  const handlePlay = (e: React.MouseEvent) => {
     e.stopPropagation();
-    try {
-      if (game.platform === "steam" && game.steam_app_id) {
-        await api.launchSteamGame(game.steam_app_id, game.id);
-      } else if (game.platform === "epic" && game.epic_app_name) {
-        await api.launchEpicGame(game.epic_app_name, game.id);
-      } else {
-        await api.launchGame(game.id);
-      }
-    } catch (err) {
-      addToast(String(err), "error");
-    }
+    launch(game);
   };
 
   const handleFolder = async (e: React.MouseEvent) => {

src/components/library/GameGrid.tsx

@@ -2,7 +2,7 @@ import { AnimatePresence, motion, Reorder } from "framer-motion";
 import { useQuery } from "@tanstack/react-query";
 import { useState, useEffect } from "react";
 import { useGameStore } from "@/store/useGameStore";
-import { useFilteredGames } from "@/hooks/useGames";
+import { useFilteredGames, useScan } from "@/hooks/useGames";
 import { api } from "@/lib/tauri";
 import GameCard from "./GameCard";
 import GameListRow from "./GameListRow";
@@ -101,6 +101,7 @@ function Pagination({ page, totalPages, onPage }: { page: number; totalPages: nu
 
 export default function GameGrid({ isLoading = false }: { isLoading?: boolean }) {
   const games = useFilteredGames();
+  const { scan } = useScan();
   const allGamesRaw = useGameStore((s) => s.games);
   const viewMode = useGameStore((s) => s.viewMode);
   const sortKey = useGameStore((s) => s.sortKey);
@@ -184,7 +185,7 @@ export default function GameGrid({ isLoading = false }: { isLoading?: boolean })
           </div>
           <div className="grid grid-cols-3 gap-3 w-full max-w-md">
             {[
-              { label: "Scan Steam / Epic / GOG", desc: "Auto-detect installed games", onClick: () => import("@/hooks/useGames").then(m => m.useScan) },
+              { label: "Scan Steam / Epic / GOG", desc: "Auto-detect installed games", onClick: () => scan() },
               { label: "Add a game manually", desc: "Pick an exe or folder", onClick: () => setAddGameOpen(true) },
               { label: "Browse Steam library", desc: "Import owned games", onClick: () => setAddGameOpen(true) },
             ].map((card, i) => (

src/components/library/GameListRow.tsx

@@ -6,6 +6,7 @@ import type { Game } from "@/lib/types";
 import { useGameStore } from "@/store/useGameStore";
 import { useGames } from "@/hooks/useGames";
 import { api } from "@/lib/tauri";
+import { useLaunchGame } from "@/lib/useLaunchGame";
 import Badge from "@/components/ui/Badge";
 import PlatformBadge from "@/components/ui/PlatformBadge";
 import GameContextMenu from "@/components/ui/GameContextMenu";
@@ -17,6 +18,7 @@ export default function GameListRow({ game }: { game: Game }) {
   const addToast = useUIStore((s) => s.addToast);
   const customStatuses = useUIStore((s) => s.customStatuses);
   const { toggleFavorite } = useGames();
+  const { launch } = useLaunchGame();
   const coverUrl = useCover(game);
   const selectedIds = useGameStore((s) => s.selectedIds);
   const toggleSelected = useGameStore((s) => s.toggleSelected);
@@ -113,13 +115,7 @@ export default function GameListRow({ game }: { game: Game }) {
         </motion.button>
         <motion.button
           whileTap={{ scale: 0.85 }}
-          onClick={async (e) => {
-            e.stopPropagation();
-            try {
-              if (game.platform === "steam" && game.steam_app_id) await api.launchSteamGame(game.steam_app_id, game.id);
-              else await api.launchGame(game.id);
-            } catch (e: any) { addToast(e?.message ?? "Failed to launch game", "error"); }
-          }}
+          onClick={(e) => { e.stopPropagation(); launch(game); }}
           className="btn-icon w-7 h-7 hover:text-cyan-400"
         >
           <PlayIcon size={11} />