All versions

Changed

• •Trimmed the empty-preview explanation to one fact, one reason and the fix. The first version said all the same things at three times the length, which is the wrong shape for a message someone reads while staring at a blank panel.

Fixed

• •A wrangle can no longer run against a folder that is still being copied into. Dragging a half-copied card in was genuinely dangerous: files that arrived after the scan were left stranded, and folders the copier had created but not yet filled were recorded as empty and removed out from under it — aborting the copy while the app reported a clean finish. A user who then formatted the camera card lost whatever never made it across. Before moving anything, Wrangler now re-counts each included card and compares it against the scan, and a card touched in the last minute is watched briefly to confirm it has stopped changing. If it hasn't, the wrangle stops with nothing moved and asks for a re-scan. Verified against a real copy in flight: previously 35 of 40 clips were lost and the copy died with an error; now the copy finishes untouched.
• •App libraries are refused instead of dismantled. A Photos, Aperture, Final Cut, or iMovie library is a folder as far as macOS is concerned, so one could be dragged in — or promoted to a "card" from inside a selected folder — and read as an ordinary photo card, auto-included with no warning. Wrangling it flattened its originals, strayed its database, and removed its internal folders, leaving a library that no longer opens. Libraries and packages are now recognized as documents at every entry point and left strictly alone. Recognition no longer depends on which apps the customer has installed: a Mac without Final Cut previously saw .fcpbundle as an ordinary folder. AVCHD cards — which macOS also reports as packages, and which hold the .MTS footage the app exists to move — are unaffected.

• •Empty-folder removal can no longer take a hidden file with it. The rule that makes losing a file impossible is that folders are removed with POSIX rmdir, which refuses anything non-empty. Measured on current macOS, that has one exception: a folder whose only remaining entry is an AppleDouble ._name file is removed successfully, taking the file along — and Wrangler's own scan cannot see those files either, so the folder looked empty. On FAT32 and exFAT cards and shuttle drives, those files are where macOS stores Finder tags, comments, and resource forks. Emptiness is now confirmed through POSIX readdir, which does see them. rmdir still performs every removal.
• •Junk is never permanently deleted. When the Trash was unavailable — a volume with a blocked .Trashes, some network shares, some FAT volumes — cleanup files were permanently unlinked while the confirmation sheet, the preview, and the report all said "Trash". Junk that cannot go to the Trash is now simply left alone.
• •A card Wrangler cannot fully read now says so. macOS returns "no files" rather than an error when it blocks a folder, so a card the app had been denied access to scanned as an ordinary card with nothing in it — and its unreadable folders were listed as empty and queued for removal. Blocked folders are now detected, the card is flagged, and the warning explains how to grant access.
• •Quitting mid-wrangle is refused. Cmd-Q, or an update prompt arriving at the wrong moment, could end the process between two files with no rollback, no report, and nothing on next launch to say a wrangle had been interrupted. Wrangler now declines to quit while it is moving files and points at Cancel, which stops safely and puts everything back.
• •Tidy Up stays opt-in on drives that are not your Mac's own. Tidy Up includes itself by default, and trashing junk is the one thing Undo cannot reverse. That default was only held back from external drives by the removable-media warning, which never appears on USB and Thunderbolt SSD enclosures — the shuttle drives editors keep working folders on. Any non-internal drive now keeps Tidy Up opt-in.

• •A receipt can tell whether the files in front of it are the ones it moved. Receipts match files by path, and paths repeat — cameras restart clip numbering on every card, so a folder reused for a second offload holds byte-identical filenames. Picking the wrong receipt would silently rearrange the *new* card's footage into the old card's layout and report success. Each move now records the file's size, and Restore from Receipt says plainly when what it finds is not what it left.
• •Receipts survive the version that wrote them. Adding a single field to the receipt format would have made every receipt already in customers' hands unreadable — at exactly the moment they needed it. Frozen receipts from 0.13.0 are now part of the test suite, so that breakage cannot ship unnoticed, and unrecognized fields are ignored rather than fatal.
• •A genuine receipt this version cannot read no longer reads as "not a receipt". The old message sent people looking for a lost file that was never lost. It now says the receipt is real, that nothing has been lost, and what to do about it.

• •The permission prompt now explains itself. macOS asks before an app reads a removable drive, Desktop, Documents, Downloads, or a network volume. Wrangler supplied no reason, so the dialog was a bare "wants to access" from an app the customer had just installed and was about to point at their footage — and denying it made a card scan as empty.

• •Names the disk considers identical are now treated as identical. Almost every Mac drive is case-insensitive, and an accented character can arrive spelled two ways that look the same on screen and are the same file on disk. Wrangler compared raw text, so two clips could be planned onto one destination; nothing was ever overwritten, but the wrangle stopped partway through and rolled back instead of catching it before starting. Collisions are now judged the way the drive judges them, at both planning and preflight.
• •A wrangle stays on one disk. Moving a file to another drive is a copy followed by a delete, and an interruption partway through can leave a half-written file that looks like finished footage. Selecting cards from two different drives at once is now flagged at scan time and refused before anything moves.
• •A folder inside a card still in the reader is refused. Selecting the card itself was already blocked; selecting a folder one level inside it was not, which is the same original footage. Wrangler now recognizes it and says to copy the card first.

• •Shortcuts are named instead of silently skipped. A symbolic link is neither a folder nor an ordinary file, so it fell through every check: a linked clip was left out of the plan with nothing to say so, and a folder containing only a link was listed as "empty, will be removed" even though it never was. Shortcuts are now reported in a caution and left exactly where they are, along with the folder holding them. Wrangler deliberately does not follow them, since a shortcut can point anywhere on the disk.
• •A card chosen through a shortcut now scans properly instead of reporting no supported media.
• •Renamed files can no longer exceed what the disk will store. Filenames are limited to 255 bytes, and an accented character costs two, so a name well under 255 characters can still be too long. With the rename option on, a long folder-name prefix could overflow that limit and fail partway through the wrangle. Prefixes are now shortened to fit, cutting whole characters, and an impossible name is refused before anything moves.

Changed (release tooling — no effect on the app itself)

• •The published update entry now takes its minimum macOS version from the built app instead of a hardcoded copy, so raising the floor can never offer an update to Macs that cannot launch it.
• •Publishing refuses a major version the update feed does not serve. A licence covers one major version, so shipping 2.x through the 1.x feed would auto-update every customer into a build their licence does not cover; that rule was previously written down but not enforced.
• •Publishing refuses a build number that does not beat the newest published one, which would otherwise produce a release that looks published and is never offered to anyone.
• •The Sparkle update archive is now created with Sparkle's documented arguments. Verified by round-trip: framework symlinks and the code signature survive extraction.

Added

• •Expanded format recognition. New video formats are recognized as media instead of landing in strays: AVCHD's .m2ts spelling, Nikon N-RAW (.nev), Phantom Cine (.cine), Kinefinity RAW (.krw), Insta360 (.insv), GoPro MAX (.360), plus a quiet set of legacy formats for old footage (.avi, .m2t, .ts, .mpg, .mpeg, .mod, .tod, .dv, .3gp, .3g2). .ts is content-verified (it must carry a real MPEG transport-stream signature) so TypeScript source code in a backup folder can never be mistaken for video.
• •Metadata sidecars travel with their clip. A .moi (JVC/Panasonic recording date + widescreen flag — the only copy of that metadata) or .thm (old digicam EXIF thumbnail) with the same name as a clip now moves WITH the clip instead of going to strays.
• •Multi-file recordings are kept whole. Insta360 lens pairs, GoPro chapter chains, and Nikon N-RAW clips with their MP4 proxy are never renamed, and if any member of a set can't move cleanly the whole set stays put together — one recording is never split across folders.
• •New format cautions. Insta360 multi-file recordings and split recordings (GoPro chapters, ~4 GB memory-card size-limit segments) are now called out before a wrangle; the AVCHD caution now recommends the complete PRIVATE/AVCHD/BDMV structure and covers .m2ts/.ts streams.

• •Professional RAW structures are recognized and protected. ARRIRAW (.ari/.arx), Canon Cinema RAW (.rmf), and frame-sequence footage (CinemaDNG, DPX, and TIFF stacks — detected by their numbered-frame shape, with the clip's audio and metadata alongside) depend on their exact folder structure, so Wrangler now recognizes the card, explains why in a format caution, and deliberately leaves the entire card untouched — nothing moved, nothing renamed, nothing cleaned up. Stills are never caught by this: DCIM cards, bursts, timelapses, and sequentially named exports all stay ordinary photo media.

• •Review tones: yellow is now scarce and earned. Review flags carry a presentation register — green for "all good" (an already-organized folder now shows a green check in the list and a green line in the review panel, not a warning triangle), brand-copper notes for calm information (Tidy Up folders, folders with no supported media), and yellow only for genuine confirm-or-fix moments (removable media, strays that will move, locked files, protected RAW structures). When nothing is yellow the panel retitles itself "Folder Notes", the header, badge, and stat tile read Ready, and both the Markdown and PDF reports split "Warnings" from "Notes" — with the same rule everywhere: a batch of organized or Tidy Up folders never sees the word Review.

• •Version-scoped licensing (app side). Licenses cover one major version (a v1 license is good for every 1.x release). The app now sends its version on validate so the server can enforce the scope, understands the server's "version not covered" answer as an *upgrade* story — the license sheet says "your license covers version 1," never "invalid license" — and keeps its own client-side gate from the cached license state, the only gate that can protect builds that predate this one. The gate follows the same safety doctrine as the file handling: it only ever fires when the app *positively* knows it is newer than the license covers — missing, unparseable, or pre-scoping cached data always passes, and same-or-older always passes.

Fixed

• •Photos on a DCIM-structured card always count as media now, no matter how much video sits beside them — recognizing the new video formats can never demote a card's photos to strays.
• •A CinemaDNG card no longer classifies as a "Photo card": before sequence detection existed, its frames read as RAW stills and would have been flattened with cross-clip name collisions.
• •Tidy Up. A folder whose media already sits at the top level but which still holds junk files or empty folders can now be wrangled as a Tidy Up: the media stays exactly where it is, junk goes to the Trash, and empty folders are removed. Tidy Up folders are included by default — the sidebar reads "Media in place · Tidy Up", and the review panel shows an "Included as a Tidy Up" note with an inline checkbox ("Uncheck to leave this folder untouched"), so a whole batch resolves right where you read it. (A Tidy Up folder with any real safety flag, like living on removable media, still starts opted out.)
• •JVC Everio / Panasonic SD camcorder cards are recognized by their SD_VIDEO folder now — dragging one in reads as a card backup with its own name, not a "Loose media folder" named SD_VIDEO.
• •RED cards are recognized by their .RDC clip folders now. A card holding a single clip used to expand into the clip folder, read as a "Loose media folder", and sit excluded — hiding the RED caution from the ready screen. It now reads as a card backup with the caution front and center.

Added

• •Automatic updates. Media Card Wrangler now keeps itself up to date. New versions are offered right in the app and install with a single click, each one cryptographically signed and verified before it's applied. This is the last version you'll need to install by hand — from here on, updates come to you.

Changed

• •Every release is now backed by an automated safety suite. Alongside targeted regression tests for card recognition, undo, and rollback, a fuzz suite runs each build against many randomized card layouts and proves the core promise on every one: no file is ever lost, altered, or duplicated, and undo restores every card exactly. It is the strongest guarantee yet behind "the worst case is it puts everything back."

Signed and notarized. Requires macOS 13 (Ventura) or newer. Universal — Apple Silicon and Intel.

Added

• •View modes: Full Rundown and Quick Draw. Full Rundown is the familiar info-rich experience — every screen explains what will happen and why it's safe. Quick Draw hides the reassurance prose and collapses per-card detail for trusting power users, leaving counts, warnings, and the button. Quick Draw never hides a warning — duplicate collisions, locked metadata, format cautions, needs-review flags, and the demo meter show in both modes. Switch live from the segmented control on the review screen, the View menu, or ⌘D. Settings holds a three-way default (always Full Rundown, always Quick Draw, or remember last choice).

Signed and notarized. Requires macOS 13 (Ventura) or newer. Universal — Apple Silicon and Intel.

Added

• •License wall with a 10-wrangle free demo. Unlicensed users get 10 free wrangles; the wall gates *only* wrangle execution — open, add, scan, preview, reports, undo, and Restore from Receipt all keep working in demo. Licensed wrangles never consume the allowance.
• •License management UI. A License sheet handles key activation (with seat-limit and rejection messaging), refresh, deactivate-this-Mac, and lost-key recovery. A status pill shows standing at a glance.
• •Resilient license standing. Activation is per-Mac via a salted hash of the platform UUID (raw serials never leave the machine); the key is stored in the Keychain. An unreachable server keeps cached licensed state alive for a 7-day grace window — a network blip can never lock out a paying customer.
• •On-set recorder recognition. Atomos-style recorders (Ninja, Shogun, Shinobi, Sumo) are now recognized as already-organized instead of reading as a suspicious loose-media folder.

Changed

• •Loose-image folders are no longer silently wrangled. Photo-card confidence now rests solely on real card structure (DCIM/NNN) or RAW stills — never on file count. An unconfident folder is flagged "not a recognized camera card" and excluded by default.

Fixed

• •Undo no longer silently drops a card's empty folders. In clean-in-place mode, a restored card now round-trips exactly — empty folders included. Forward wrangle, preflight, rollback, and write-ordering are untouched.

Signed and notarized. Requires macOS 13 (Ventura) or newer. Universal — Apple Silicon and Intel.

Fixed

• •Mixed-camera offloads expand correctly. A parent folder holding several cards — e.g. two video cards, a RAW stills card, and an audio recorder — now expands into one card each. A single RAW photo no longer makes the planner read the whole parent as one photo card.
• •Real AVCHD cards are now scanned correctly. A genuine AVCHD card (PRIVATE/AVCHD/BDMV) is reported by macOS as a package, so the scan used to skip all the .MTS footage inside. The scan now descends into extensionless camera bundles like AVCHD while still skipping genuine app packages (.app, .fcpbundle, .photoslibrary).
• •ARRI caution no longer fires on a lone `.bin` file. It now requires the .ale (Avid Log Exchange) marker, so an unrelated .bin (e.g. a Zoom recorder's settings file) is no longer mistaken for an ARRI/Avid card.