This feature release primarily contains updates for butlerd, the part of butler that services the itchio app. CLI updates below.

butlerd (daemon)

New Features

• Stdio transport mode (--transport stdio) — reads JSON-RPC from stdin, writes to stdout, logs to stderr. No authentication required (inherently secure via parent process pipe). Supports single connection only.
• Install.GetUploads — fast endpoint returning available uploads for a game (~100ms, no file I/O). Returns game object and filtered upload list.
• Install.PlanUpload — cancelable planning for a specific upload. Accepts optional id parameter for cancellation via Install.Cancel. Performs network I/O and file inspection.
• Caves.GetSettings / Caves.SetSettings — per-cave configuration stored as JSON in the database. Settings include sandbox overrides (Sandbox, SandboxType, SandboxNoNetwork, SandboxAllowEnv) and extra launch arguments (ExtraArgs).
• SandboxOptions in Launch — fine-grained sandbox configuration per launch: Type (auto/bubblewrap/firejail/flatpak/fuji), NoNetwork, AllowEnv.
• CaveSettings.ExtraArgs — per-cave extra command-line arguments appended after manifest args at launch.

Improvements

• Hard limits on lazy fetches to prevent excessive resource consumption: collection games capped at 2000 items, owned keys at 5000 items. Warns when limits are reached.
• Fix quadratic operation for collection and library sync, which could cause butlerd to lock up when synchronizing larger collections
• Structured logging (slog) for database queries, HTTP requests, and DB migrations. New slogHandler converts slog records to comm's JSON message format. Enable HTTP debug logging with BUTLER_HTTP_DEBUG=1.
• butlerd.json spec now includes result types, precise enum values (int, bool, string), and @deprecated tags on endpoints and types.
• Thread-safe cancellation with new MakeCancelable helper on RequestContext. Mutex protection on cancel funcs map.
• Prefer system-installed firejail over prereqs version when available.

Deprecations

• Install.Plan — use Install.GetUploads + Install.PlanUpload for cancellation support. Install.Plan still works but internally delegates to the new endpoints.

Bug Fixes

• Fixed install plan not actually being cancelable (was using wrong context).
• Prevented non-JSON logging from being sent to stdout when in stdio mode (redirected to stderr).

butler CLI

Improvements

• Fixed context/goroutine leaks in push, fetch, login, status commands (DefaultCtx now returns a cancel func that must be called).
• Pointer semantics for CompressionSettings in diff and sign commands.

Bug Fixes

• Fixed variable shadowing bug in push finalize that could report the wrong error.

Dependency Updates

smaug (sandboxing)

• New: Bubblewrap Linux sandbox backend with persistent per-game home directory ({InstallFolder}/.itch/home), GPU/audio/display support, PID/UTS namespace isolation, and controller input device access.
• New: Flatpak-spawn sandbox for running inside Flatpak containers. Auto-detected via /.flatpak-info. Uses flatpak-spawn --sandbox with optional network isolation.
• New: Centralized SandboxConfig struct with type selector replacing scattered per-platform parameters. Auto-selection priority on Linux: Flatpak-spawn → Bubblewrap → Firejail.
• New: macOS sandbox policy modes — balanced (strict, default) restricts /dev access; legacy allows broader compatibility for problematic games.
• New: Rosetta 2 support — x86 games can now run sandboxed on Apple Silicon Macs.
• Improved: Cryptographically secure Windows sandbox account passwords using crypto/rand.
• Improved: Unified network control (NoNetwork) across all sandbox backends (bubblewrap: --unshare-net, flatpak-spawn: --no-network, firejail: --net=none, macOS: conditional policy rules).
• Improved: Centralized environment variable allowlists per platform prevent accidental info leaks.
• Fixed: Windows fuji sandbox "access denied" error on first launch — ACL permission propagation may not be immediate, so process start now retries on ErrPermission (up to 7 attempts with 1s delay).

screw (file operations)

• Fixed: macOS memory leak in TrueBaseName — C string from GetCanonicalPath was not being freed.
• Improved: Rollback error handling now reports both the rollback error and original error together via errors.Join.

wharf (patching)

• Updated: Regenerated protobuf definitions with modern protobuf toolchain.

hades (database ORM)

• Breaking: Query logging migrated from headway Consumer to slog.Logger. Context struct now uses Logger *slog.Logger instead of Consumer *state.Consumer.
• NewContext no longer requires a Consumer argument.

boar (archive extraction)

• Updated to libc7zip 1.9.0.
• Added Windows ARM64 (windows-arm64) builds, removed 32-bit Linux (linux-386).

go-itchio (API client)

• Added slog.Logger support for structured HTTP request logging, used by butler's BUTLER_HTTP_DEBUG flag.

httpkit (HTTP file transport)

• Made debug logging more granular.

ox (Windows process launching)

• Fixed Windows game launching (fuji sandbox and simple runner) broken by Go 1.24 os.Process internals change. Replaced unsafe reflection hack with os.FindProcess.
• Fixed thread handle leak in process launching when SysProcAttr is nil.

lake (protocol buffers)

• Migrated from github.com/golang/protobuf to google.golang.org/protobuf. Regenerated .pb.go files with modern protoc toolchain. Replaced copystructure deep-clone with proto.Clone.