// reference

Versions

Every release, and what each one brought.

1.5.6 — Modular builds & the HD Audio fix latest release

The audio driver leaves the codec in a clean state now — no more static noise after the boot sound while booting Windows or Linux — and corrupt UEFI boot entries are found and fixed instead of ignored. The big one: Visor is now modular. Every optional feature is a named build-time option in a single registry, so you compile exactly the Visor you want, from a tiny text-only menu to everything.

• Modular build — 28 named features in the features/ registry (GUI, fade, blur, clock, pointer, editor, accent, screensaver, animations, capture, file browse, audio, and every boot/security/self-heal piece). Six ready-made profiles: minimal, standard, hardened, ricer, full, custom. Go a la carte with make PROFILE=… FEATURES=-blur,+capture (add/remove flags with dependency checking — you can't cut something another feature relies on), or pick a profile at install/update time. Feature-off builds compile no-op stubs in place of whatever you dropped and still link cleanly.
• HDA audio fix — after the boot sound, the codec was left powered/unsynced and you'd hear a static/hiss during Windows/Linux boot. Teardown now leaves the codec quiet. The driver also adopts a firmware-brought-up controller as-is instead of force-resetting it (guarding inherited codec state), and probing uses a lean 2 ms timeout budget so absent codecs are skipped fast.
• Corrupt boot entry detection — malformed (non-4-digit Boot####) Visor entries are now separate from valid ones; a corrupt entry triggers a fresh valid re-create, visor status reports present (corrupted — run visor update --boot-entry to fix), and visor update --boot-entry is the one-command fix.
• Boot order sanity — self-heal default changed from first to ensure (recreate a missing entry; append it back to BootOrder if removed), and BootOrder rewrites are rate-limited by an ESP stamp file (.selfheal) instead of NVRAM, so firmware/OS reorder wars stop wearing out the store.
• Source tree — src/ is clustered by domain (arch/, audio/, boot/, browse/, capture/, config/, core/, decoders/, gpt/, gui/, security/, text/) with per-feature stubs and 9 internal-only headers; make check-features validates the registry.
• Config & docs — boot.conf.schema.json regenerated with per-key x-feature tags; boot.conf.example updated for boot_order=ensure/selfheal_order=ensure; version bumped to 1.5.6; donations now accepted via Ko-fi.

1.5.5 — HDA audio driver & boot sound 2026-09-08

The built-in Intel HD Audio driver and the menu_sound= boot sound — jack-detecting output selection, a single-plays-and-drains stream, synced with the menu fade-in — plus fixes to animation timing, a stronger VBG encoder, and Visor Studio editing your real, installed config.

• Built-in HDA audio driver — self-contained Intel HD Audio driver (src/audio/hda.c) plays a short sound before ExitBootServices on x86_64 (AArch64 builds get no-op stubs); headphone priority (a plugged-in headphone pin beats the built-in speakers; speakers are the fallback), output pins sharing a converter are muted for the duration, plays once with silence-padded prepared stream that drains to the audible end.
• Boot sound — new menu_sound= key: a 16-bit PCM .wav (max ~4 s, truncated beyond that, resampled to 48 kHz) played once at startup while the menu initialises; on by default but only plays when a path is set; off/0/n/f = silent. Starts at the same instant the menu fade-in begins (sound_start/sound_poll hooks) so picture and audio arrive together.
• Animation timing — a late frame no longer shoves every later frame out: the animation deadline advances by whole frame steps (dropping backlog) instead of re-phasing, so animated wallpapers no longer lurch on slow redraws.
• VBG encoder — stronger default temporal denoiser, and the auto dead-zone is capped so slow, low-contrast motion is no longer frozen out.
• Visor Studio local mode — Studio now hands the editor the actual installed boot.conf (resolved from VISOR_DIR or the ESP via --esp PATH), plus a --native flag to force the local python3+npm runtime when Docker is present (mutually exclusive with --docker).
• Config & docs — menu_sound added to the schema and example config; selfheal_order shown in the example. Feature by @Versedcamel153 for Stream local mode (#31).

1.5.4 — Visor Studio companion & tooling fixes 2026-09-04

Visor Studio — the visual boot.conf configurator — becomes a first-class companion: visor studio runs it locally, install.sh pre-fetches it, and the installer/CLI stop mis-detecting over-mounted ESPs.

• Visor Studio — the official visual boot.conf configurator (Visor Studio) is now a first-class companion. New visor studio command clones, updates (--update), and launches the configurator on http://127.0.0.1:8000 (--port PORT), using Docker when available (single visor-studio container) or a python3 venv + Vite frontend otherwise; --docker forces the Docker path, --detach runs it in the background.
• Offline install — install.sh pre-fetches Visor Studio during install so it runs offline: a --studio/--no-studio flag (or an interactive prompt) clones the companion into the host cache (~/.cache/visor-studio), resolving the real user's home under sudo and handing ownership back.
• Over-mount fix — install.sh and the visor CLI no longer mis-detect over-mounted ESPs: findmnt -U (unique) ignores bind/over-mounts, so the EFI System Partition, its device, and the boot-filesystem type resolve correctly (fix by Tom Hale, #27).
• visor status on unreadable ESPs — reports cleanly when the ESP isn't readable (no sudo): prints unreadable for the installed binary, config and boot log, unknown for the UEFI entry and sha256, and hints to re-run with sudo.
• visor clean --all — also removes the cached ~/.cache/visor source checkout (and the legacy ~/.cache/visor-src path) with per-directory confirmation.
• Credits — Tom Hale for the findmnt -U over-mount fix (#27); Visor Studio built by Farid (BSD-2-Clause).

1.5.3 — GPT repair, self-heal, BLS support 2026-09-02

Fast boots from slow disks and a boot manager that looks after itself: GPT corruption is caught and repaired before it bites, OS updates can no longer silently walk off with the boot entry, and BLS deployments gained proper support.

• GPT corruption detection and repair — at menu startup Visor scans whole-disk block devices for GPT damage; a disk with a valid backup header but a damaged primary gets a warning modal before the menu with confirm (type YES). Rebuilds the primary GPT from the verified backup only when safe; scan runs once per boot instead of on every hotplug poll. Text-mode equivalents: gpt, gpt N, gpt repair N. New boot.conf options: selfheal, boot_order, restore_fallback.
• Boot self-heal — every startup can repair boot-manager damage left by OS updates (Windows and others): missing or reordered NVRAM Boot#### entry and BootOrder (boot_order=first|ensure|off), and a \EFI\BOOT\BOOTx64.EFI fallback path that another OS overwrote (restore_fallback=1). Nothing written when nothing to fix; removable media never touched.
• BLS deployment support — efi/uki efistub and UKI entries are accepted and chainloaded; architecture skips entries for another arch; sort-key groups by ostree index then sort-key; repeated initrd and options lines accumulate in order.
• Booting from slow filesystems — the entry's volume is held open and reused across all reads instead of reopening it four times per boot (#22); the redundant existence re-check is removed. efi_volume_open_count() is logged at handoff; big-file reads (≥ 16 MB) log progress and MB/s.
• Screenshots — F6 saves a PNG screenshot to \EFI\visor\shots; F10 records a GIF/MJPEG animation.
• Config parsing — #RRGGBB colour values are no longer eaten as inline comments: a # inside a value only starts a comment when preceded by whitespace (fix by moeKiwiSAMA).
• Tooling fixes — MP4/MJPEG box parsing validates the full 64-bit-size extension; visor_encrypt.py rejects weak PBKDF2 parameters; visor-snapshot-sync handles comma-containing snapshot descriptions.

1.5.2 — Hardening, interlaced PNG & snapshot watchdog 2026-08-26

A hardening and resilience pass: constant-time crypto on the password path, a watchdog-guarded snapshot scanner that can't freeze on a broken volume, Adam7 interlaced PNG support, and quiet internal cleanup.

• Constant-time password checks — the confirmation field now compares with a constant-time equality function (mem_equal(), now public for any module) so a timing side-channel can't leak against the confirmation buffer.
• Secrets don't linger — the SHA-256 context is zeroed after finalizing so key material isn't left on the stack, and PBKDF2 iteration counts below 100,000 are rejected on decrypt, closing off weak derivation parameters.
• Snapshot scanner won't freeze — auto-detection enforces a per-volume budget of 8 seconds; the watchdog kicks so a hang is attributable to a single volume (#21). The scanner logs each volume as it's scanned and explicitly reports when a volume holds no snapshot instead of silently moving on.
• Interlaced PNG support — the decoder gains full Adam7 support, so images saved by most editors now load correctly as backgrounds and icons instead of falling back to defaults or failing silently.
• Cleanup — efi_strlen16() is one shared implementation instead of three local copies, and efi_fread() drops a redundant clamp that UEFI's Read() semantics made pointless.
• First outside contributor — @Apple-QAQ lands the build fix from 1.5.1, the first contribution from a non-maintainer.

1.5.1 — Build fix 2026-08-24

A one-line patch release: a stale include of a nonexistent version.h in src/include/loader_iface.h broke the build. Removed (767254b, merging #19). Also our first outside contributor ever — @Apple-QAQ — and, on the maintainer's behalf, they'd like you to know they are aware. T_T

1.5 — Clock, screensaver, TPM & Loader Interface 2026-08-24

Polished, measurable and OS-aware: a live clock that ticks for free, an idle screensaver, TPM2 measured boot and full systemd Boot Loader Interface interop — plus VBG wallpapers.

• Live clock — firmware-RTC overlay outside the scene cache (1 Hz band, or every second with clock_seconds=1). Position clock_position (topright … center, hyphen/space tolerant, header-aware), format clock_format (24h/12h), clock_date/clock_date_format (long/iso/dmy/mdy), size, frost (clock_blur) and shadow (clock_shadow), palette role clock via accent_clock/clock_color. See Configuration → Clock.
• Screensaver — two-stage idle: dim to background + clock after screensaver_delay (60 s) then blank to black after screensaver_blank (600 s); any key/pointer wakes and restarts the countdown. Animated wallpapers play while dimmed and idle while blanked. Configure with screensaver (or screensaver=60 shorthand) and screensaver_clock.
• TPM2 measured boot — EFI_TCG2_PROTOCOL HashLogExtendEvent for boot.conf (PCR 5, EV_EVENT_TAG 0xf5bc582a) and the exact cmdline (PCR 12, NUL-inclusive, systemd-compatible), plus LoaderTpm2ActivePcrBanks publishing. Keys tpm/measure, tpm_pcr_config/tpm_pcr_cmdline (0–23).
• Boot Loader Interface — full systemd Boot Loader Interface (GUID 4a67b082-0a4c-41cf-…): publishes LoaderInfo/DevicePartUUID/Entries/EntrySelected/FirmwareInfo/Type/TimeInitUSec/MenuUSec/ExecUSec/Features and honors LoaderConfigTimeout[OneShot] / LoaderEntryDefault/OneShot (OneShot consumed, remember_last defers). Toggle loader_vars/loader_interface.
• VBG animated wallpapers — background= now also MP4/MOV (MJPEG) and compact VBG (tiled-quantized delta + motion compensation, ~10–20× smaller, cheaper to decode). Accent palette still from frame 0; frost blur reused while animating. New host tool tools/vbg_encode.py and visor convert --vbg (also packaged to /usr/share/visor/tools).

1.4 — Animated backgrounds & file browser 2026-08-16

Animated wallpapers, a file browser in both interfaces, and an installer that finally works straight out of an AUR package — plus a round of audit-driven hardening.

• Animated GIF backgrounds — background= accepts GIF as well as PNG and BMP; animated GIFs play full-screen in a loop. A self-contained GIF89a decoder (LZW, frame disposal, loop handling) runs inside the boot manager with bounded memory, the accent palette is taken from frame one, and the frosted-glass panels reuse their blur while the animation plays so the menu stays fast.
• File browser — press B in the graphics menu or run browse in the recovery shell to list every readable volume (boot volume first, labelled by partition UUID) with sizes, directories first, sorted with a merge sort. Enter boots what you pick: a kernel (auto-paired with a sibling initrd*), an initrd, or a .efi chainload — pinned to the volume it was picked from (GUID and volume handle, so MBR sticks behave too).
• Packaged installs — visor install and visor doctor work right after an AUR install, where no source tree exists: install runs from the packaged files (/usr/lib/visor + /usr/share/visor) and doctor understands packaged state. Non-root runs re-exec through sudo with the correct user's home resolved.
• Honest clock — timing now comes from the architecture clock (calibrated TSC on x86, generic counter on ARM) instead of the firmware's periodic timer, which some firmwares never fire; countdowns and animations stay accurate everywhere, QEMU under TCG included.
• Hardening — the PNG decoder validates the zlib header length before allocating against it; the browser no longer force-connects every block controller mid-menu (a real-hardware freeze source), its directory reads are bounded, and the centre-info panel no longer collides with the browser panel.

1.3.3 — Text rendering & packaging 2026-08-06

A rendering and packaging release: menu text is resampled properly at every size, and the installer knows which architecture it is installing for.

• Area-average glyph scaling — glyphs are baked from a 128px master and downscaled by integrating the source coverage each destination pixel actually covers, instead of point-sampling one value per pixel. Thin stems keep their weight rather than dropping out.
• Subpixel positioning — advances are carried in 1/64 px and glyphs render at one of four horizontal phases, so a run of text no longer accumulates rounding error and letter spacing stays even.
• Glyph cache — rasterised glyphs are memoised per (codepoint, size, phase) in a 512-slot table, so the extra filtering happens once per distinct glyph instead of once per draw.
• Installer architecture detection — install.sh derives the target from uname -m (overridable with --arch) and uses it for the build, the binary name, the boot entry and the EfiFs driver suffix. Previously it always installed visor_x64.efi while the driver suffix followed the host, so an ARM64 machine got an x86_64 loader and a mismatched driver.
• Installer output — one scheme for step/OK/warn/error lines, colour only on a TTY (honouring NO_COLOR and TERM=dumb), ASCII fallback outside a UTF-8 locale, and a failed step reports the line and exit status. New flags: --arch, --color, --no-color.
• Arch package tracks releases — the PKGBUILD builds from the tagged release tarball with a real checksum instead of fetching the repository URL as a plain download with verification disabled, and now builds for aarch64 as well as x86_64.
• Config schema — docs/boot.conf.schema.json describes every key the parser accepts (types, defaults, enums, aliases, grouping) as JSON Schema draft 2020-12, generated from src/config.c, as one source of truth for editors, validation and the wiki.
• Void dependency — get.sh and the install page install gnu-efi-libs, the name that actually exists in the Void repository.

1.3.2 — Security & config fixes 2026-08-03

A maintenance release on top of 1.3.1: a scan-scope option, Arch packaging, and hardening fixes across the boot and config paths.

• scan=deep|quick — auto-detection scope: deep opens every exposed filesystem (default), quick only the boot volume, ESPs and XBOOTLDR partitions, falling back to a deep scan rather than an empty menu.
• Arch package — Visor is packaged for the AUR with a proper PKGBUILD/.SRCINFO/visor.install.
• LUKS keyfile alignment fixed — the cpio builder padded to a miscomputed boundary, so a keyfile could sit one byte off the offset the kernel's newc parser expects and silently hand a corrupt passphrase to the initramfs; padding is now computed once and exactly.
• sha256= pins really pin — the pin is verified on the buffer and a pinned entry boots that buffer directly, instead of the firmware re-reading the file by device path (possibly from a different volume).
• PNG decoder stricter — interlaced (Adam7) images and non-standard compression/filter methods are rejected with a clear error.
• Config parser — entry { } blocks tolerate blank lines and comments; duplicate keys keep the last value without leaking; auto-detection no longer overrides an explicit show_names=/center_info=; title_color=#7AA2F7 is no longer read as a comment.
• Per-entry colors — color= accepts an accent role (tertiary, ...) as well as #RRGGBB.
• Unified accent grammar — every color/accent key takes 0/1, a role name, or #RRGGBB; a per-element key beats its group, which beats accent=.
• Hotplug teardown — unplugging media frees the entry's LUKS fields and wipes any typed passphrase from memory.
• Docs — boot.conf.example regrouped into labelled sections with a syntax header; the wiki's configuration page regrouped to match.

1.3.1 — Bug fixes from v1.3 2026-07-30

Targeted fixes for issues found in the field and during testing.

• Snapshot file naming — Visor now falls back to \EFI\visor\snapshot.conf (singular) when snapshots.conf is missing, and logs which name it found so users don't get confused when the V panel has nothing to show.
• Pre-connected USB detection — hotplug now scans volumes that are already present when the menu arms, not just future plugs. Combined with scan_existing, pre-plugged USB sticks appear in the menu without needing to unplug and reinsert.
• Log escape hatch — log=0 is honored before any ESP write, so firmware with a broken ESP write path can still reach the menu and be diagnosed (the boot.log is never created or modified).
• Log rotation — boot.log now preserves prior sessions (keeps the last 3, caps at 128 KiB) instead of deleting and recreating each boot, so early-hang diagnostics survive across reboots.
• Wrong passphrase handling — luks_confirm=1 asks for the passphrase twice and reprompts on mismatch instead of silently booting. luks_verbose=1 removes quiet splash so the initramfs retry prompt is visible when verification fails.
• Password prompt visibility — F2 at the passphrase prompt toggles showing what you typed, so you can verify your keyboard layout before submitting.
• Rescue console from the menu — Esc at the boot menu now opens the options / rescue console (same console as after a failed boot), even when no entry has failed. Esc there returns to the menu.
• Icon auto-detection — auto-detected raw kernels now derive icons from their name (restored v1.2.1 behavior), so entries like vmlinuz-linux show the Linux icon instead of unknown.
• Volume-pinned loading — entries detected on a volume now load their kernel and initrd from that volume's handle, fixing multi-disk setups where the ESP's fallback loader would be found instead of the correct one on the target volume.
• cmdline defaulting — the global cmdline= now only applies to entries that accept a default cmdline (raw kernels). Chainloads and foreign volumes no longer inherit it, so Ventoy-style stick booting works correctly without unwanted root= parameters.
• Secure Boot driver connect — firmware block devices that already expose a filesystem are skipped in the driver connect pass, reducing the delay when Secure Boot is enabled and the unsigned EfiFs driver is refused.
• Menu logo — logo=, logo_mode= (title/only/above/none), logo_size= and logo_gap= draw the bundled \EFI\visor\logo.png (or your own) in the menu header; accent_logo= tints it with the wallpaper palette.

1.3 — Cross-platform, snapshots, hotplug 2026-07-26

The big one: ARM64, wallpaper accent colors, snapshot booting, live USB hotplug, and a pile of real-hardware fixes.

• AArch64 build — make ARCH=aarch64, architecture-neutral GUI core, arch layer for clock and framebuffer write-combining.
• Accent colors — Material You palettes extracted from the wallpaper in fixed-point math, with 7 variants.
• Btrfs snapshot booting — snapper/Timeshift/plain layouts, manifest or direct detection, one-shot boot from the menu.
• Live USB hotplug — sticks appear in the menu with a pop-in animation while it is open, and leave when unplugged.
• Filesystem drivers — EfiFs download/install integrated (pinned + hash-verified), started lazily so the menu stays fast.
• Smarter detection — raw kernels are found alongside UKIs, and detected kernels get an automatic, accurate cmdline (UKI .cmdline → fstab → GPT root partition type).
• Simplified encryption — visor encrypt kernel initrd: one password, ESP install, generated entry with LUKS auto-detection.
• Diagnosable failures — LoadImage status codes logged, Secure Boot rejections named, device-path quirk fallback.
• Hardening — firmware file-size-0 workaround, no config size limits, partition pinning, decode budgets, long-filename handling.

1.2.1 — Firmware fixes 2026-07-18

A field-report release: fixes driven by real machines.

• Raw kernels no longer rejected with "file size is zero or implausibly large" on firmware with broken seek-based size probing (Acer and others) — sizes come from GetInfo() with the seek probe as fallback (#3, #5).
• Auto-detect falls back to chainloading distro loaders (shimx64.efi/grubx64.efi) from \EFI\<vendor>\ when no UKI, BLS entry, or raw kernel is found — fixes Ubuntu-style installs (#6).
• "Visor loading…" prints before log rotation, to help diagnose early-init freezes (#8).
• Size warnings log the value the firmware actually reported; README gained the "Booting from non-FAT filesystems" section (#7).

1.2 — Requested Features 2026-07-03

The community-requests release.

• Encrypted kernel/UKI/initrd support (VISORENC) with tools/visor_encrypt.py.
• LUKS password prompt and initrd keyfile handoff.
• Boot-failure recovery console with log viewer and retry/menu options.
• OSTree/BLS deployment detection, version browsing, and boot-count rollback support.
• autoboot, animation, and fade_speed config options.
• Safety work: boot handoff, file reads, config parsing, PNG/BMP bounds checks.

1.1 — A lot of fixes 2026-06-27

No new features — a hardening release from a full security and stability review.

• Malformed/oversized PNGs rejected cleanly; sane decode limits.
• Filesystem drivers verified under Secure Boot like kernels are.
• NVRAM preferences writable only from Visor at boot, not by a running OS.
• Graceful failure on malformed config and low-memory paths; corrupt kernel handoff headers refused.
• Performance: boot log opened once per boot, faster image assembly, quicker scans.

1.0 — Stable Release 2026-06-24

Rebuilt, cleaned up, and tested across distros.

• Mouse, trackpad, and touchscreen support with click-to-boot.
• Theme rotation (random/cycle) and remember-last.
• Recovery: one-shot cmdline editing with e and auto (recovery) entries.
• Secure Boot awareness (verification before starting images).
• Unified entry { } blocks with automatic boot-method detection; config comments.
• Reliability: shim/GRUB chainloading fixes, firmware compatibility fixes, safer installer.

Where the details live