feat(bangumi-progress): add plugin

[Mirei124]

Plugin

• Id: mirei124/bangumi-progress

• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Adds Bangumi Progress, a Noctalia plugin for tracking anime from bgm.tv.

It provides:

• A desktop widget showing currently watching titles, cover art, watched progress, aired episodes, and total episodes.
• A bar widget showing newly available unwatched episodes.
• A panel for browsing collection statuses and updating episode progress.
• Automatic collection and episode refreshes with persistent caching and a concurrency limit of two requests.

External dependencies

• xdg-open — opens Bangumi subject and user profile pages in the default browser.
• Network access to api.bgm.tv for collection and episode data.
• Network access to lain.bgm.tv for cover images.
• A Bangumi personal access token is optional for read-only public collections, but required to update progress or access private entries.
• Writes collection, episode, and badge cache data, as well as downloaded cover images, to Noctalia’s plugin data directory.

Testing

Verified that the bar widget, desktop widget, panel, and Bangumi API integration work correctly.

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor: Wayfire
• Noctalia version tested against: git commit 037804f86a3d2b75a7d741e6b6a965e8cba8e5b0
• Plugin API level: 15

Screenshots / Videos

Checklist

Ready-for-review requirement: Every box in this section must be checked. If any statement is not true, keep the
pull request as Draft. An explanation does not replace a required check.

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:
Ready-for-review requirement: Every attestation below must be checked.

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[ItsLemmy]

1. blocking - bangumi-progress/service.luau:664
   Token-mode persistent cache is accepted without binding it to the configured access token or verifying the current identity. If the access token changes while the cache is younger than refresh_minutes, init() restores the previous viewer and collections, then returns at bangumi-progress/service.luau:1039-1049 without calling /v0/me. This can expose the previous account's private collection to the new account and allow stale actions to be attempted against it. Invalidate token-scoped cache on credential changes or validate the identity before restoring cached data.

[Mirei124]

The caching issue has been fixed; now, the cache is reset in the init function if the token and username change.