Releases · krim404/cdc-badge-os

The big change in this release is a WAMR-based plugin system: third-party
plugins now run sandboxed in WebAssembly instead of being statically
linked into the firmware. grove_led and mod_homeassistant were removed
from the firmware tree and reimplemented as plugins in cdc-badge-plugins.

WebAssembly highlights

WAMR fast interpreter with AOT-loader fallback, custom PSRAM allocator
80+ host APIs under module cdc: NVS, i18n with per-plugin lang overlay, event bus, HTTP (mbedtls on PSRAM, TLS handshake stable), WiFi, GPIO/ADC/I2C/SAO, addressable pixel strip, BLE read, SecureElement (name-based R-Mem allocator + ECC), crypto (SHA / HMAC / AES-GCM / Base32 / Base64 / Hex), lockscreen quick-action slot, wink visual ID
UI host views exposed to plugins: list, confirm, T9 text, PIN, slider, date, time, context menu, canvas (inline slider / text / button widgets), global RGB color picker (barycentric triangle with Bayer-dithered preview and closest-name lookup)
Foreground + background plugin lifecycle: background plugins tick every 50 ms and receive event-bus events; promotion to foreground without reload; active plugin auto-stopped before its wasm is overwritten; background wasm re-loaded after a successful upload (no reboot)
Plugin loading toast is owned by PluginManager and only hidden when it is still the top modal, so a plugin that pushes its own toast in plugin_on_enter no longer has it stripped one frame later
Plugin storage on a 2 MB FAT partition, chunked CRC32 upload protocol over USB-CDC, manifest with strict capability enforcement (GPIO whitelist, per-pin lock, NVS namespace, rmem slot names, ui_exclusive)
WAMR patch (patches/wamr_espidf_self_thread.patch, applied via CMake) fixes os_self_thread() for non-pthread FreeRTOS tasks

Also in this release

New string-key i18n API with rodata English fallback + JSON overlay; 217 callsites migrated, all native modules ported, legacy StringId / Language enums removed; plugins ship their own <id>.lang.json overlay
Shared RAII wrappers in cdc::core (FilePtr / NvsScope / MutexGuard / PsramUniquePtr / CStdUniquePtr) replace open-coded close calls
UI infrastructure cleanup: Slider / T9 / Date / Time pop themselves before firing save callbacks; Confirm and ContextMenu use showModal; ListView falls back to a bullet point when an item has no icon; icon palette expanded to the full CP437 glyph range with semantic aliases
GUI bootloader entry; serial WIFI_* / PIN_CHANGE / BOOTLOADER / LANG UPLOAD / PLUGIN UPLOAD commands; local + GitHub-hosted web flasher with separate manifests for VFAT preservation and first-time factory reset
Sandbox: NVS namespace must start with plg_ or plugin_; enforced in CapabilityChecker and runtime
Doxygen annotation pass on host_api.h (179 functions, 20 \defgroup sections)

Post-tag follow-ups bundled in

WebAuthn race condition fix: prompt state is serialised by a mutex, the wait-loop honours ctap2_is_cancelled() so CTAPHID_CANCEL releases the UI prompt immediately, and handle_cancel calls fido2_ui_abort_prompt()
Plugin list rendering: WAMR wrapper no longer truncates lists to 32 items (psramAlloc instead of a fixed stack array); ListView::MAX_ITEMS raised to 2048 so large HA Browse views show every entity
New host_str_to_display(in, out, cap, target) API decodes HTML entities and UTF-8 into either CP437 (builtin glcdfont) or Latin-1 (FreeMonoBold 8b fonts); shared with native code via cdc::ui::render::decodeWebText; HA and news_feed plugins call it on every web payload before pushing
InfoView now word-wraps to 44 cols so the news_feed detail view shows full summaries instead of clipping
ColorPickerView: redundant header text removed
8b fonts (FreeMonoBold9pt8b / 12pt8b) moved from cdc_os_ui to cdc_views and exposed via a shared cdc_views/Fonts module so any view can pick them