d99cb5c6f9
- OAuth: generate and validate a state param across the Trakt/MAL/Simkl deep-link flow to close a login-CSRF gap (code was exchanged with no check that it came from a flow this app actually started). - Add net_guard: resolves the host of any addon-supplied URL and refuses to fetch loopback/private/link-local/CGNAT addresses, applied to http_fetch_text, artwork prefetch, and offline downloads. Drop the now-unused localhost/ws CSP allowances. - Encrypt storage_read/storage_write at rest (AES-256-GCM, key in a 0600-permissioned file) instead of plaintext JSON, with transparent fallback for existing unencrypted files so upgrading doesn't lose data. - Replace get_nuvio_config (handed the Supabase anon key straight to JS) with a nuvio_request proxy command -- Rust attaches the key and makes the call itself, so it never exists in webview-reachable memory. |
||
|---|---|---|
| .github/workflows | ||
| public | ||
| src | ||
| src-tauri | ||
| .env.example | ||
| .gitignore | ||
| index.html | ||
| package-lock.json | ||
| package.json | ||
| README.md | ||
| tsconfig.json | ||
| vite.config.ts | ||
Fluxa Desktop
A fast, native media client for Windows, macOS, and Linux.
Browse catalogs, track what you watch, and play anything the Stremio addon ecosystem exposes.
What it does
Fluxa connects to any Stremio-compatible addon and turns it into a proper desktop app: a home feed with genre and category browsing, a calendar of upcoming episodes, a library with continue-watching and resume positions, and two-way watch tracking with Trakt, MyAnimeList, and Simkl. Playback runs through libmpv with platform-native rendering, including direct torrent/magnet support — no separate addon server, no browser round-trip for OAuth, no telemetry.
Features
- Catalogs & discovery — home feed, genre/category grids, search across every installed addon, and a calendar of upcoming episodes for what you're following
- Library — watchlist, continue watching with resume position, and custom collections, with import support for existing lists
- Watch tracking — two-way sync with Trakt, MyAnimeList, and Simkl; OAuth is handled locally via deep link (
fluxa://oauth/...), no hosted redirect server - Playback — native
libmpvrendering with a custom render surface per platform (X11 on Linux, native views on macOS/Windows), subtitle and audio track selection, intro/outro skip, and direct torrent/magnet playback - Profiles — multiple local profiles on one install, each with its own library, addons, and sync accounts
- Addons — install and manage Stremio-compatible addons directly from the app
- Auto-update — in-app update checks and installation via Tauri's updater
Download
Grab the latest build from Releases.
| Platform | Package |
|---|---|
| Windows 10+ | .exe — NSIS installer |
| macOS 11+ | .dmg — Universal (Intel + Apple Silicon) |
| Linux (Debian / Ubuntu) | .deb |
| Linux (Fedora / RHEL) | .rpm |
| Linux (portable) | .AppImage |
Building from source
git clone https://github.com/KhooLy/fluxa-desktop.git
cd fluxa-desktop
npm install
npm run tauri dev
Prerequisites
- Node.js 22+
- Rust stable
libmpv— either install it system-wide, or run./src-tauri/fetch-libmpv.shto pull the prebuilt gpu-next fork used for release builds- Linux:
sudo apt install libmpv-devorsudo pacman -S mpv - macOS:
brew install mpv - Windows: handled by the fetch script
- Linux:
npm run build # production frontend build
npm run check # typecheck + cargo check
Stack
Tauri 2 · React 18 · TypeScript · Vite · Rust · mpv · librqbit
Legal — Fluxa Desktop is a client-side interface for user-installed Stremio addons. It does not host, serve, or distribute any media content. All streams come from third-party addons chosen by the user. Fluxa is not affiliated with any addon developer, repository, or content provider. Users are responsible for ensuring they have the right to access what they stream.
Related projects
- Fluxa for Android — the Android counterpart to this app
- fluxa-core — the shared Rust library powering both