Changelog
A full record of every update shipped to Frag.
New Platforms
- Linux is now a first-class target. Download the standalone
Frag-Linux.AppImage from the landing page — single file, no installer, no package manager. Just chmod +x and run. Works on any glibc-based distro from the last decade: Ubuntu, Fedora, Arch, Debian, Mint, openSUSE, Pop!_OS, etc.
- Earlier Flatpak attempt was retired: electron-forge's
maker-flatpak silently drops its config keys (id, runtime version, icon, finish-args) due to a class-instance vs nested-options bug in the runtime spread. AppImage works correctly via the community-maintained @reforged/maker-appimage.
Bug Fixes
- Settings modal escape fix — JS and CSS were using different mobile breakpoints (650px vs 768px). Inside the wrapped Android APK the WebView ended up in a state where JS thought "desktop" (auto-selecting Profile, hiding the Back button) while CSS thought "mobile" (hiding the desktop ✕ close). Both close affordances disappeared; the only way out was to kill the app. Unified to a single 768px breakpoint and deferred the first-page auto-select to the next animation frame so the viewport meta tag has time to apply.
- Android hardware back button now closes modals → walks history → exits the app, matching native expectations. Done via Capacitor's
@capacitor/app plugin wired up in Interface.tsx
Features
- First public Android Beta APK ships at /downloads/Frag-Android-Beta.apk. Built via Capacitor wrapping the live web bundle. Sideload via "Install unknown apps" on any Android 5.0+ device. Auto-updater + Play Store distribution will come later.
- Landing-page download buttons now show inline-SVG OS icons (Windows, Android, Web) instead of plain text. Android button carries a "BETA" pill.
Bug Fixes
- Mobile message streaming reliability — WebSocket "zombie" detection: when the mobile OS freezes JavaScript while the PWA is backgrounded, the socket can stay
readyState=OPEN with no data flowing. The client now tracks how long it was hidden and forces a reconnect if foregrounded after >15s, instead of trusting readyState alone
- iOS Safari bfcache restore (back/forward navigation) now forces a fresh WebSocket connection
- Android Chrome "online" event handler added — kicks an immediate reconnect retry when network returns
- Splash screen restored on the web client — when the user has a cached session but the server is unreachable, the animated grenade splash with rotating messages now shows instead of a tiny progress spinner
- Desktop app no longer renders the raw Cloudflare 502 / nginx error page when the server is down — a bundled local splash with auto-retry takes over (and resumes the app once the server is back)
Bug Fixes
- Desktop camera now works — Electron permission handler grants camera and microphone access for the bundled app origin (previously the camera button silently failed because
getUserMedia was denied by default)
- Windows Start Menu / taskbar / installer icon is no longer blurry — bundled
icon.ico rebuilt with multi-resolution sizes (16, 32, 64, 128, 256) so Windows picks the right one for every surface
- System tray icon now renders crisply at both 1x and 2x DPI by combining the 16px and 32px hicolor PNGs
- Preferred audio-output device setting was returning the audio-input value; getter now reads the correct field
Features
- Camera picker added under Settings → Voice & Video — choose which webcam to use, persisted per account
- Flip-camera button on mobile now actually cycles through available cameras using LiveKit's
switchActiveDevice
- Enhanced noise suppression (RNNoise) is the new default for fresh installs; the desktop build hides the browser-level suppression option entirely
Features
- Voice Connected card — when connected to a voice channel the entry in the channel list expands inline with an animated pulse dot, VOICE CONNECTED label, and mic / deafen / camera / screenshare / disconnect controls
- Client version check — settings page now fetches the latest release from hexios.top and shows an update link when a newer version is available
Bug Fixes
- Two-tone channel list background removed — category sections no longer render a distinct background block that clashed with the sidebar surface
- Own messages no longer trigger false unread events — ack now checks both focus state and document visibility so the channel is correctly marked read when the window is foregrounded
- Member sidebar receives glass styling on all platforms — semi-transparent blur backdrop applied consistently across web, PWA, and desktop
Infrastructure
- Source reorganized into frag/main/ (production web + desktop) and frag/dev/ (development branch) — build scripts updated to match
Bug Fixes & Improvements
- Mobile/PWA: server icon strip is now properly fixed to the left edge — content no longer overlaps behind it
- Mobile/PWA: gap between the icon strip and content area closed — rounded corner removed where it caused a visible seam
- Mobile/PWA: glass effect restored on the icon strip without causing layout issues
- Mobile/PWA: swipe right on the icon column now opens the channel panel
Bug Fixes
- Mobile/PWA: sidebar panel no longer takes up screen space when closed — it is removed from the DOM entirely instead of hidden with CSS
- Mobile/PWA: server channel list now reliably collapses when you tap a channel, restoring full-width message view
- iOS PWA: app now reloads automatically when a new version is available — no need to clear cache or re-add to home screen
Bug Fixes
- PWA now updates automatically — no more stale version stuck in cache after a new release
- New service worker activates immediately and takes over all open tabs without requiring a manual reload
Bug Fixes & Improvements
- Mobile/PWA: channel and DM panels now slide in as an overlay instead of pushing messages off-screen
- Mobile/PWA: panel collapses automatically when you open a channel or DM
- Mobile/PWA: swipe right from the left edge to reveal the panel; swipe left to dismiss it
- Tap the semi-transparent backdrop to close the panel on mobile
- Server icons are draggable again — regression introduced in v2.0.1 is fixed
Bug Fixes
- Friends/DMs sidebar now collapses correctly when you open a DM or navigate to a server
Bug Fixes
- Server icons now navigate on click — no longer accidentally drag instead of opening
- Home button indicator no longer stays highlighted while viewing DMs or channels
Bug Fixes
- Fixed white screen on first load caused by lingui translation catalogs being compiled in CommonJS format — browser ESM rejects
module.exports at runtime; all catalogs now compiled as proper ES modules
Security
- Brute-force protection added to the login endpoint — repeated failed attempts from the same IP are blocked for 15 minutes
- Login service now fails closed if the database is unreachable — disabled accounts can no longer slip through during a database blip
- Internal account ID no longer included in the response body when a login is rejected for a disabled account
- Oversized login payloads now rejected before parsing — protects against memory-exhaustion via crafted requests
- Service logs downgraded from debug to info — sensitive request data no longer emitted in production logs
- SMTP credentials moved out of the main config file into the secrets store
- Security headers added across all routes: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS
- TURN credential lifetime capped at 24 hours — stolen credentials now expire within the day
Bug Fixes
- Read receipts now appear immediately when your DM partner reads your messages — no longer requires them to send a reply first
- Read receipt eye now shows on the last message in a burst instead of incorrectly appearing on the first
- Chat no longer jumps to the bottom when a new message arrives while you are scrolled up reading history
- Home page action cards no longer bleed edge-to-edge on mobile — now wrap and pad correctly on narrow screens
New Features
- Terms of Service page added at hexios.top/frag/terms.html — linked across all platforms and footers
- Live server status indicator on the Frag and Hexios landing pages — shows online/offline in real time
- Hexios home page completely remodelled — Frag is now front and centre, with a dedicated Services page for infrastructure tools
- Read receipt tick now correctly anchors to the top of a message group (next to the timestamp) instead of the bottom tail
Bug Fixes
- Fixed bottom nav links in the login screen overflowing and colliding on narrow screens — links now wrap cleanly
- Fixed desktop app login screen still linking to stoat.chat GitHub and Bluesky — now correctly links to Frag accounts
- Fixed all auth pages pointing to dead frag.chat/terms and stoat.chat/terms links — now link to the real Terms of Service page
- Fixed read receipt tick appearing on every sent message — now only shows on the last message sent in a conversation
- Fixed home page cards going edge-to-edge on mobile — content is now capped and centred
New Features
- Read receipts in DMs — a ✓ tick appears next to your sent messages, and an 👁 eye icon lights up when the partner has read them
- Read receipt privacy toggle in Settings → Notifications — disable to hide whether you've read a partner's messages (they still see the sent ✓)
- PWA and mobile layout polish — channel content no longer bleeds past the screen edges; padding is tightened on all views
- Frag landing page now stacks properly on small phones — invite form, CTA buttons, and nav all reflow to fit narrow viewports
- What's New banner on the home page — shown once after each update and dismissible
Bug Fixes
- Fixed sounds on mobile — all notification and voice sounds now use the Web Audio API and unlock on first user interaction, working around browser autoplay restrictions
- Fixed the home page surface bleeding off the right edge on mobile PWA
- Fixed sent ✓ tick appearing on messages in server channels — ticks are now shown only in DMs
New Features
- Long-press on messages and conversations in the PWA now opens the context menu — same as right-click on desktop
- Ghost/deleted user DM entries are now hidden from the conversations sidebar instead of showing as broken entries
Bug Fixes
- Fixed dead space at the top of the home page on mobile — content now aligns to the top instead of centering vertically
- Fixed settings showing version 1.6.0 on web — now correctly reads the client package version
- Fixed settings version label showing "Frag for Desktop" on web browser — now shows "Frag" (or "Frag Mobile" on phones)
- Removed hardcoded "Frag Desktop shell" label from settings; shell/runtime versions are now shown only in the desktop app
- Added "More" heading to the Source Code / Advanced / Donate / Log Out settings group to fix the unnamed visual gap
Bug Fixes
- Fixed the hamburger menu button overlapping the home/server icon in the sidebar on mobile — button is now hidden while the sidebar is open; tap the backdrop to close
- Fixed editing a message and pressing Enter sometimes triggering the delete confirmation — Enter keydown and beforeinput events no longer double-fire
- Fixed voice call join/leave sounds playing for DM calls the local user is not in — sounds now only fire when the user is an active participant in that channel
- Fixed user status text showing raw presence values like "Offline" beneath usernames in the member list — API inconsistency is now filtered out client-side
- Fixed the frag-bot spamming the changelog and moderation alerts when multiple instances started simultaneously — added single-instance PID lock and event deduplication
Bug Fixes
- Fixed "Send on Enter (Mobile)" toggle in settings not taking effect — the Enter keymap now respects the setting on touch-capable devices
- Moved "Send on Enter (Mobile)" toggle from Notifications to Advanced settings
- Fixed "0 Pending Friend Requests" tooltip appearing on the home button when there are no pending requests
- Fixed app stretching horizontally on mobile — added overflow clipping to the root container to prevent layout bleed
- Fixed hamburger menu button not updating to show a ← close arrow while the sidebar is open; it now toggles between ☰ and ← and can be tapped to close
- Added magnifying glass search icon to the channel header — search input now only expands when tapped (narrower on mobile for better fit)
- Fixed context menus from triple-dot button appearing behind profile cards by separating z-index layers (cards at 800, menus at 1000)
- Fixed profile card "Message" button not navigating to the DM — now navigates before dismissing the card
- Fixed "Stoat" branding visible in profile card Joined section and badge tooltips — replaced with Frag throughout
- Fixed DM member sidebar showing empty — now correctly lists both participants
Features
- Added "Send on Enter (Mobile)" toggle in Notifications settings — lets you choose whether pressing Enter on a mobile keyboard sends the message or inserts a new line
- Upgraded notification sound to a louder, clearer alert contributed by community member Spookz
- Added ban reason and timestamp storage — admins can now record a reason when disabling accounts via frag-admin
- Added "List Banned" option to frag-admin showing all disabled accounts with reason and date
- Enhanced user info display in frag-admin to show ban status, reason, and date
Bug Fixes
- Fixed friends sidebar overlapping home page content on mobile
- Fixed channel list not rendering on desktop after the app had previously been used on a mobile device — sidebar layout state persisting as closed caused server/channel navigation to silently do nothing
- Fixed disabled accounts now showing a clear error message on login instead of a silent failure
- Fixed leftover "Stoat" branding strings visible to users in the Desktop settings page
- Fixed error state during login and reconnection no longer silently discarding the failure reason
- Removed broken "Browse" and "Test" custom notification sound buttons from Desktop settings
- Removed MFA (Two-Factor Auth) toggle from Account settings — the backend does not implement it and enabling it permanently locks users out
- Replaced alert() popups in the Discover page with silent console warnings
Infrastructure
- Upgraded Stoat backend services from v0.12.0 to v0.12.1 (API, events, file server, proxy, gifbox, crond, pushd, voice ingress)
- Added auth-guard service: a lightweight Node.js proxy that intercepts login requests and returns a proper "Disabled" response for banned accounts before they reach the API
- Updated Caddy configuration to route /api through auth-guard
- Fixed controller state machine to properly store permanent failure errors in both the LoggingIn and Reconnecting states
- Enabled on-the-fly response compression in Caddy (zstd preferred, gzip fallback) for all responses over 1 KB — significantly reduces transfer size for HTML, JS, and CSS
- Added long-term immutable cache headers for all content-hashed assets in /assets/ (1-year TTL) — returning visitors load the app entirely from browser cache
- Added no-store cache policy for the HTML entry point, PWA manifest, and service worker so updates are always picked up immediately
- Disabled production sourcemap exposure — map files are generated but no longer served to browsers, removing an unnecessary network request on first load
- Split heavy third-party libraries (CodeMirror, LiveKit, KaTeX, highlight.js, SolidJS) into separate cached chunks — after the first visit these bundles are served from cache even when the app updates
Bug Fixes
- Fixed emoji picker displaying question marks instead of emoji images on all platforms
- Fixed voice call card overlapping the channel list on mobile when viewing a voice channel
- Fixed mobile keyboard Enter key not sending messages while editing an existing message
- Fixed the "Message" button in user profile cards not redirecting to the DM conversation
- Fixed profile card remaining visible on screen after clicking to open a user's roles
- Fixed DM list entries not showing user status or "Offline" label on mobile
Features
- Launched Frag as an invite-only platform with unlock code system on the landing page
- Native Windows desktop installer built with NSIS
- System tray support — minimize to tray, click to toggle window
- Desktop notifications for messages and calls
- Discord Rich Presence integration showing current activity
- Auto-launch on Windows login support
- Ko-fi donation link added to home screen and settings
Features
- Full Electron desktop app replacing the previous Nativefier wrapper
- Custom server URL hardcoded to frag.hexios.top
- Windows installer via NSIS with uninstaller support
- Frag branding applied throughout the desktop app
Bug Fixes
- Fixed NSIS Squirrel installer failures — switched to standalone NSIS build
- Fixed double comma syntax error in env.ts causing web frontend build failures
- Fixed Devzat process conflict on port 8080 blocking backend startup
Features
- Email verification and password reset via Resend SMTP
- Invite-only registration mode enabled on the backend
- Admin tooling: ban, unban, force-logout, and delete users via MongoDB CLI
- frag-admin.sh management script for common server tasks
Infrastructure
- Caddy reverse proxy configured on ports 80 and 443
- Nginx Proxy Manager handling external traffic routing
- Cloudflare DNS proxying for frag.hexios.top
- Pi-hole DNS filtering and WireGuard VPN integrated into the stack
Features
- Custom Frag red branding applied across the entire web frontend
- Replaced all Stoat references with Frag throughout the UI and i18n catalogs
- LiveKit voice and video integrated into the backend stack
- Role colour picker and member profile improvements
Infrastructure
- Web frontend containerised and deployed as frag-web Docker image
- Hot-rebuild pipeline: edit source → docker build → compose up --no-deps web
Infrastructure
- Self-hosted Stoat fork set up as the Frag backend on Windows 11 via Docker
- Full 15-container stack: API, WebSocket events, MongoDB, Redis, RabbitMQ, Autumn media server, January link proxy, and more
- Domain frag.hexios.top registered and pointed at the server
- Docker health checks and log access configured for all services
Features
- Servers, channels, roles, and permissions — fully functional
- Direct messages and group DMs
- Voice and video calls via LiveKit
- File and media uploads via Autumn
- User registration, login, and email verification