fix(startup): enforce keychain consent before credential access

Keep credential-store operations behind a per-process consent gate, prevent duplicate native grant requests, and defer legacy token migration until explicit consent. Harden the RTL/sidebar, custom window controls, bidi copy, and queue editor fixes.

Refs #17

src-tauri/src/db.rs

@@ -45,18 +45,17 @@ struct LegacyData {
 }
 
 pub fn init(storage_layout: &crate::storage::StorageLayout) -> Result<DbState, String> {
-    init_at_path_internal(storage_layout.data_dir(), storage_layout.is_portable(), false)
+    init_at_path_internal(storage_layout.data_dir(), storage_layout.is_portable())
 }
 
 #[cfg(test)]
 fn init_at_path(app_data_dir: &Path) -> Result<DbState, String> {
-    init_at_path_internal(app_data_dir, false, false)
+    init_at_path_internal(app_data_dir, false)
 }
 
 fn init_at_path_internal(
     app_data_dir: &Path,
     portable: bool,
-    migrate_legacy_keychain: bool,
 ) -> Result<DbState, String> {
     fs::create_dir_all(app_data_dir)
         .map_err(|error| format!("failed to create app data directory: {error}"))?;
@@ -78,12 +77,7 @@ fn init_at_path_internal(
     }
     migrate_schema(&mut connection, version)?;
 
-    import_legacy_data(
+    import_legacy_data(&mut connection, app_data_dir, portable)?;
-        &mut connection,
-        app_data_dir,
-        portable,
-        migrate_legacy_keychain,
-    )?;
     if portable {
         sanitize_persisted_downloads(&mut connection)?;
     }
@@ -188,7 +182,6 @@ fn import_legacy_data(
     connection: &mut Connection,
     app_data_dir: &Path,
     portable: bool,
-    migrate_keychain: bool,
 ) -> Result<(), String> {
     let legacy_app_dir = app_data_dir
         .parent()
@@ -226,31 +219,10 @@ fn import_legacy_data(
         let mut pending_pairing_token = None;
         if !portable {
             if let Some(token) = legacy.pairing_token.take() {
-                let migrated = if migrate_keychain {
+                // Legacy migration is deliberately deferred until the
-                    let keychain_has_token = get_keychain_password(PAIRING_TOKEN_KEYCHAIN_ID)
+                // explicit frontend consent action. Database initialization
-                        .ok()
+                // must never touch the OS credential store.
-                        .is_some_and(|value| !value.trim().is_empty());
+                pending_pairing_token = Some(token);
-                    if !keychain_has_token {
-                        if let Err(error) =
-                            set_keychain_password(PAIRING_TOKEN_KEYCHAIN_ID, &token)
-                        {
-                            log::warn!(
-                                "Legacy pairing token could not be migrated to the credential store; it will remain pending in the current database: {}",
-                                error
-                            );
-                            false
-                        } else {
-                            true
-                        }
-                    } else {
-                        true
-                    }
-                } else {
-                    false
-                };
-                if !migrated {
-                    pending_pairing_token = Some(token);
-                }
             }
         }
         if portable {
@@ -1738,7 +1710,7 @@ mod tests {
             .unwrap();
         drop(connection);
 
-        let state = init_at_path_internal(temp.path(), true, true).unwrap();
+        let state = init_at_path_internal(temp.path(), true).unwrap();
         let connection = state.lock().unwrap();
         let saved: Value = serde_json::from_str(&load_downloads(&connection).unwrap()[0]).unwrap();
         assert!(saved.get("password").is_none());
@@ -1828,7 +1800,7 @@ mod tests {
         });
         fs::write(&store_path, serde_json::to_vec(&store).unwrap()).unwrap();
 
-        let state = init_at_path_internal(&current, true, true).unwrap();
+        let state = init_at_path_internal(&current, true).unwrap();
         let connection = state.lock().unwrap();
         let saved: Value = serde_json::from_str(&load_downloads(&connection).unwrap()[0]).unwrap();
         assert!(saved.get("password").is_none());
@@ -2104,7 +2076,7 @@ mod tests {
         drop(connection);
         drop(state);
 
-        let state = init_at_path_internal(temp.path(), true, true).unwrap();
+        let state = init_at_path_internal(temp.path(), true).unwrap();
         let connection = state.lock().unwrap();
         let saved: Value = serde_json::from_str(&load_downloads(&connection).unwrap()[0]).unwrap();
         assert!(saved.get("password").is_none());

src-tauri/src/lib.rs

@@ -2859,6 +2859,12 @@ pub enum TaskHandle {
 pub struct AppState {
     pub download_coordinator: download::DownloadCoordinator,
     pub storage_layout: crate::storage::StorageLayout,
+    /// Credential-store access is denied until the frontend has completed the
+    /// startup consent decision for this process. This is intentionally
+    /// process-local: a new binary must pass through the consent barrier
+    /// again before any stale or early IPC caller can reach the OS store.
+    pub keychain_access_authorized: Arc<AtomicBool>,
+    pub keychain_grant_in_progress: Arc<AtomicBool>,
     pub extension_pairing_token: extension_server::SharedExtensionToken,
     pub extension_frontend_ready: extension_server::SharedFrontendReady,
     pub extension_acks: extension_server::SharedExtensionAcks,
@@ -2872,6 +2878,38 @@ pub struct AppState {
     pub queue_manager: Arc<queue::QueueManager>,
 }
 
+const KEYCHAIN_CONSENT_REQUIRED_ERROR: &str =
+    "Credential-store access requires explicit user consent";
+const KEYCHAIN_GRANT_IN_PROGRESS_ERROR: &str =
+    "Credential-store access is already being requested";
+
+fn require_keychain_access(state: &AppState) -> Result<(), String> {
+    if state
+        .keychain_access_authorized
+        .load(Ordering::Acquire)
+    {
+        Ok(())
+    } else {
+        Err(KEYCHAIN_CONSENT_REQUIRED_ERROR.to_string())
+    }
+}
+
+struct KeychainGrantGuard(Arc<AtomicBool>);
+
+impl Drop for KeychainGrantGuard {
+    fn drop(&mut self) {
+        self.0.store(false, Ordering::Release);
+    }
+}
+
+fn begin_keychain_grant(state: &AppState) -> Result<KeychainGrantGuard, String> {
+    state
+        .keychain_grant_in_progress
+        .compare_exchange(false, true, Ordering::Acquire, Ordering::Relaxed)
+        .map(|_| KeychainGrantGuard(Arc::clone(&state.keychain_grant_in_progress)))
+        .map_err(|_| KEYCHAIN_GRANT_IN_PROGRESS_ERROR.to_string())
+}
+
 #[derive(Clone, Serialize, TS)]
 #[ts(export, export_to = "../../src/bindings/")]
 pub struct DownloadProgressEvent {
@@ -5676,6 +5714,7 @@ fn set_keychain_password(
         crate::db::save_pairing_token_to_settings(&connection, &password, true)?;
         return Ok(());
     }
+    require_keychain_access(&state)?;
     crate::db::set_keychain_password(&id, &password)
 }
 
@@ -5689,6 +5728,7 @@ fn get_keychain_password(
     {
         return Err("portable pairing token is stored in portable settings".to_string());
     }
+    require_keychain_access(&state)?;
     crate::db::get_keychain_password(&id)
 }
 
@@ -5702,17 +5742,20 @@ fn delete_keychain_password(
     {
         return Ok(());
     }
+    require_keychain_access(&state)?;
     crate::db::delete_keychain_password(&id)
 }
 
 #[tauri::command]
 fn save_site_login(
     database: tauri::State<'_, crate::db::DbState>,
+    state: tauri::State<'_, AppState>,
     id: String,
     url_pattern: String,
     username: String,
     password: String,
 ) -> Result<(), String> {
+    require_keychain_access(&state)?;
     let connection = database.lock()?;
     crate::db::save_site_login(&connection, &id, &url_pattern, &username, &password)
 }
@@ -5720,12 +5763,28 @@ fn save_site_login(
 #[tauri::command]
 fn delete_site_login(
     database: tauri::State<'_, crate::db::DbState>,
+    state: tauri::State<'_, AppState>,
     id: String,
 ) -> Result<(), String> {
+    require_keychain_access(&state)?;
     let connection = database.lock()?;
     crate::db::delete_site_login(&connection, &id)
 }
 
+/// Arm credential-store access after the frontend has completed its startup
+/// decision. The process-local gate prevents any stale or early IPC caller
+/// from producing a native OS prompt before the explanation is visible.
+#[tauri::command]
+fn authorize_keychain_access(state: tauri::State<'_, AppState>) -> Result<(), String> {
+    if state.storage_layout.is_portable() {
+        return Ok(());
+    }
+    state
+        .keychain_access_authorized
+        .store(true, Ordering::Release);
+    Ok(())
+}
+
 #[derive(Serialize, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export, export_to = "../../src/bindings/")]
@@ -5761,6 +5820,7 @@ fn hydrate_extension_pairing_token(
         });
     }
 
+    require_keychain_access(&app_state)?;
     let migration_error = crate::db::migrate_legacy_pairing_token(&connection).err();
     let keychain_token = crate::db::get_keychain_password(crate::db::PAIRING_TOKEN_KEYCHAIN_ID)
         .ok()
@@ -5821,6 +5881,7 @@ fn regenerate_pairing_token(
     if app_state.storage_layout.is_portable() {
         crate::db::save_pairing_token_to_settings(&connection, &generated, true)?;
     } else {
+        require_keychain_access(&app_state)?;
         if let Err(error) = crate::db::migrate_legacy_pairing_token(&connection) {
             let token = app_state
                 .extension_pairing_token
@@ -5868,6 +5929,7 @@ fn grant_keychain_access(
     database: tauri::State<'_, crate::db::DbState>,
     app_state: tauri::State<'_, AppState>,
 ) -> Result<PairingTokenHydration, String> {
+    let _grant_guard = begin_keychain_grant(&app_state)?;
     let connection = database.lock()?;
 
     if app_state.storage_layout.is_portable() {
@@ -5882,6 +5944,9 @@ fn grant_keychain_access(
         if let Ok(mut pairing_token) = app_state.extension_pairing_token.write() {
             *pairing_token = token.clone();
         }
+        app_state
+            .keychain_access_authorized
+            .store(true, Ordering::Release);
         return Ok(PairingTokenHydration {
             token,
             token_changed: false,
@@ -5933,6 +5998,9 @@ fn grant_keychain_access(
             *pairing_token = token.clone();
         }
     }
+    app_state
+        .keychain_access_authorized
+        .store(true, Ordering::Release);
     Ok(PairingTokenHydration {
         token,
         token_changed: false,
@@ -8442,6 +8510,8 @@ pub fn run() {
             app.manage(AppState {
                 download_coordinator: download::DownloadCoordinator::spawn(app.handle().clone()),
                 storage_layout,
+                keychain_access_authorized: Arc::new(AtomicBool::new(false)),
+                keychain_grant_in_progress: Arc::new(AtomicBool::new(false)),
                 extension_pairing_token,
                 extension_frontend_ready,
                 extension_acks,
@@ -8971,6 +9041,7 @@ pub fn run() {
             set_keychain_password, get_keychain_password, delete_keychain_password,
             save_site_login, delete_site_login,
             hydrate_extension_pairing_token, get_session_pairing_token, regenerate_pairing_token, grant_keychain_access,
+            authorize_keychain_access,
             acknowledge_pairing_token_change,
             check_file_exists, toggle_tray_icon, set_extension_pairing_token,
             get_extension_server_port, set_extension_frontend_ready, ack_extension_download, set_concurrent_limit, set_global_speed_limit, remove_download,

src-tauri/tauri.macos.conf.json

@@ -8,17 +8,9 @@
         "height": 760,
         "minWidth": 960,
         "minHeight": 640,
-        "titleBarStyle": "Overlay",
-        "trafficLightPosition": {
-          "x": 17,
-          "y": 28
-        },
-        "hiddenTitle": true,
         "transparent": true,
-        "windowEffects": {
+        "decorations": false,
-          "effects": ["sidebar"],
+        "shadow": false
-          "state": "active"
-        }
       }
     ]
   },

src-tauri/tauri.windows.conf.json

@@ -10,10 +10,7 @@
         "minHeight": 640,
         "transparent": true,
         "decorations": false,
-        "windowEffects": {
+        "shadow": false
-          "effects": ["mica"],
-          "state": "active"
-        }
       }
     ]
   },

src/App.tsx

@@ -450,6 +450,12 @@ function App() {
             settings.setShowKeychainModal(true);
           }
         } else {
+          // The backend keeps credential-store access disabled for every new
+          // process. Arm it only after the persisted startup decision has
+          // confirmed that this build was already approved; the hydrate call
+          // below is then the first operation allowed to touch the OS store.
+          await invoke('authorize_keychain_access');
+          if (!active) return;
           changed = await settings.hydratePairingToken(isStartupActive);
           if (!active) return;
           const currentSettings = useSettingsStore.getState();

src/components/AddDownloadsModal.tsx

@@ -25,7 +25,7 @@ import { getPlatformInfo } from '../utils/platform';
 import { isTransferLocked } from '../utils/downloadActions';
 import { useToast } from '../contexts/ToastContext';
 import { useTranslation } from 'react-i18next';
-import { localePluralVariant } from '../i18n/locales';
+import { localeDirection, localePluralVariant, resolveAppLocale } from '../i18n/locales';
 import {
   canSubmitMetadataRows,
   appendRequestUrlsAfterVersion,
@@ -116,6 +116,7 @@ const extensionHeaders = (context: PendingAddRequestContext | undefined) => [
 
 export const AddDownloadsModal = () => {
   const { t, i18n } = useTranslation();
+  const isRtl = localeDirection(resolveAppLocale(i18n.language)) === 'rtl';
   const { addToast } = useToast();
   const {
     isAddModalOpen,
@@ -1247,7 +1248,9 @@ export const AddDownloadsModal = () => {
                   </div>
                 </div>
                 <textarea
-                  className="add-download-control add-download-links-input w-full h-32 p-3 text-[13px] resize-none"
+                  className={`add-download-control add-download-links-input w-full h-32 p-3 text-[13px] resize-none ${
+                    isRtl ? 'add-download-links-input--rtl' : ''
+                  }`}
                   placeholder={t($ => $.addDownloads.pastePlaceholder)}
                   value={urls}
                   onChange={(e) => setUrls(e.target.value)}

src/components/KeychainPermissionModal.tsx

@@ -1,4 +1,4 @@
-import React, { useEffect, useState } from 'react';
+import React, { useEffect, useRef, useState } from 'react';
 import { useSettingsStore } from '../store/useSettingsStore';
 import { invokeCommand as invoke } from '../ipc';
 import { KeyRound, ShieldAlert } from 'lucide-react';
@@ -20,16 +20,23 @@ export const KeychainPermissionModal: React.FC<KeychainPermissionModalProps> = (
   const dismissKeychainPrompt = useSettingsStore(state => state.dismissKeychainPrompt);
   const platform = usePlatformInfo();
   const [isGranting, setIsGranting] = useState(false);
+  const [grantRequestPending, setGrantRequestPending] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  const grantRequestRef = useRef<Promise<PairingTokenHydration> | null>(null);
 
   useEffect(() => {
-    if (!showKeychainModal || isGranting) return;
+    if (!showKeychainModal || isGranting || grantRequestPending) return;
     const handleEscape = (event: KeyboardEvent) => {
-        if (event.key === 'Escape') dismissKeychainPrompt(consentVersion);
+        if (event.key !== 'Escape') return;
+        if (consentVersion.trim()) {
+          dismissKeychainPrompt(consentVersion);
+        } else {
+          useSettingsStore.getState().setShowKeychainModal(false);
+        }
     };
     window.addEventListener('keydown', handleEscape);
     return () => window.removeEventListener('keydown', handleEscape);
-  }, [consentVersion, dismissKeychainPrompt, isGranting, showKeychainModal]);
+  }, [consentVersion, dismissKeychainPrompt, grantRequestPending, isGranting, showKeychainModal]);
 
   if (!showKeychainModal) {
     return null;
@@ -56,6 +63,10 @@ export const KeychainPermissionModal: React.FC<KeychainPermissionModalProps> = (
       : t($ => $.keychain.grantLabelDefault);
 
   const handleGrant = async () => {
+    // A native credential-store call cannot be cancelled from the webview.
+    // Keep the request identity until it settles so a UI timeout cannot
+    // launch a second OS prompt while the first one is still outstanding.
+    if (grantRequestRef.current) return;
     setIsGranting(true);
     setError(null);
 
@@ -79,9 +90,21 @@ export const KeychainPermissionModal: React.FC<KeychainPermissionModalProps> = (
       return true;
     };
     const grantRequest = invoke('grant_keychain_access');
+    grantRequestRef.current = grantRequest;
+    setGrantRequestPending(true);
+    void grantRequest.then(
+      () => {
+        if (grantRequestRef.current === grantRequest) grantRequestRef.current = null;
+        setGrantRequestPending(false);
+      },
+      () => {
+        if (grantRequestRef.current === grantRequest) grantRequestRef.current = null;
+        setGrantRequestPending(false);
+      }
+    );
     // A native credential-store call cannot be cancelled by the webview. Keep
     // a late successful result useful even if the UI timeout has already
-    // restored the Later/retry controls.
+    // returned control to the explanation.
     grantRequest.then(applyPersistentGrant).catch(() => undefined);
 
     try {
@@ -106,14 +129,22 @@ export const KeychainPermissionModal: React.FC<KeychainPermissionModalProps> = (
   };
 
   const handleLater = () => {
-    dismissKeychainPrompt(consentVersion);
+    if (consentVersion.trim()) {
+      dismissKeychainPrompt(consentVersion);
+    } else {
+      // A modal opened by an early user action can render before the async
+      // app-version lookup completes. Do not persist a dismissal for an
+      // unknown build; startup must make the final consent decision once the
+      // identity is known.
+      useSettingsStore.getState().setShowKeychainModal(false);
+    }
   };
 
   return (
     <div
       className="app-modal-backdrop fixed inset-0 z-50 flex items-center justify-center bg-black/40"
       onClick={(event) => {
-        if (event.target === event.currentTarget && !isGranting) handleLater();
+        if (event.target === event.currentTarget && !isGranting && !grantRequestPending) handleLater();
       }}
       role="dialog"
       aria-modal="true"
@@ -168,17 +199,17 @@ export const KeychainPermissionModal: React.FC<KeychainPermissionModalProps> = (
         <div className="px-5 py-4 border-t border-border-modal flex justify-end gap-3 bg-bg-modal-accent">
           <button
             onClick={handleLater}
-            disabled={isGranting}
+            disabled={isGranting || grantRequestPending}
             className="px-4 py-2 rounded-lg text-sm font-medium transition-colors text-text-secondary hover:bg-item-hover hover:text-text-primary disabled:opacity-50"
           >
             {t($ => $.keychain.later)}
           </button>
           <button
             onClick={handleGrant}
-            disabled={isGranting}
+            disabled={isGranting || grantRequestPending}
             className="px-4 py-2 rounded-lg text-sm font-medium transition-colors bg-accent text-white hover:bg-accent/90 disabled:opacity-50"
           >
-            {isGranting ? t($ => $.keychain.enabling) : grantLabel}
+            {isGranting || grantRequestPending ? t($ => $.keychain.enabling) : grantLabel}
           </button>
         </div>
       </div>

src/components/SettingsView.tsx

@@ -33,6 +33,7 @@ import { usePlatformInfo } from '../utils/platform';
 import { isTrustedFirelinkReleaseUrl } from '../utils/releaseUrls';
 import { normalizeCustomProxy } from '../store/useDownloadStore';
 import { useTranslation } from 'react-i18next';
+import { localeDirection, resolveAppLocale } from '../i18n';
 
 const settingsTabs: { type: SettingsTab; icon: typeof Download }[] = [
   { type: 'downloads', icon: Download },
@@ -252,9 +253,12 @@ const CategoryFolderInput = ({
 };
 
 export default function SettingsView() {
-  const { t } = useTranslation();
+  const { i18n, t } = useTranslation();
   const settings = useSettingsStore();
   const activeTab = settings.activeSettingsTab;
+  const isRtl = localeDirection(resolveAppLocale(i18n.language)) === 'rtl';
+  const isSidebarOnRight = settings.sidebarPosition === 'right'
+    || (settings.sidebarPosition === 'auto' && isRtl);
   const platform = usePlatformInfo();
   const platformName =
     platform.os === 'macos'
@@ -680,7 +684,9 @@ runEngineChecks(false);
 
         {/* SwiftUI SettingsPaneContainer-style horizontal tab strip */}
         <div className="settings-toolbar">
-          <div className="settings-tab-strip flex items-stretch gap-1">
+          <div className={`settings-tab-strip flex items-stretch gap-1 ${
+            isSidebarOnRight ? 'settings-tab-strip--sidebar-right' : ''
+          }`}>
             {settingsTabs.map(tab => (
               <TabButton key={tab.type} {...tab} label={tabLabels[tab.type]} />
             ))}

src/components/Sidebar.tsx

@@ -46,6 +46,8 @@ export const Sidebar: React.FC<SidebarProps> = (props) => {
   const renameQueueCancelRef = useRef<string | null>(null);
   const renamingQueueIdRef = useRef<string | null>(null);
   const editingQueueNameRef = useRef('');
+  const rejectedAddQueueNameRef = useRef<string | null>(null);
+  const rejectedRenameRef = useRef<{ queueId: string; name: string } | null>(null);
 
   useEffect(() => {
     const handleCloseMenu = () => setContextMenu(null);
@@ -174,9 +176,17 @@ export const Sidebar: React.FC<SidebarProps> = (props) => {
       return;
     }
     if (!addQueue(normalizedName)) {
+      if (trigger === 'blur' && rejectedAddQueueNameRef.current === normalizedName) {
+        rejectedAddQueueNameRef.current = null;
+        setNewQueueName('');
+        setIsAddingQueue(false);
+        return;
+      }
+      rejectedAddQueueNameRef.current = normalizedName;
       addToast({ message: t($ => $.sidebar.queueNameExists), variant: 'error', isActionable: true });
       return;
     }
+    rejectedAddQueueNameRef.current = null;
     addQueueSubmitRef.current = true;
     setNewQueueName('');
     setIsAddingQueue(false);
@@ -202,9 +212,23 @@ export const Sidebar: React.FC<SidebarProps> = (props) => {
       return;
     }
     if (!renameQueue(queueId, normalizedName)) {
+      if (
+        trigger === 'blur'
+        && rejectedRenameRef.current?.queueId === queueId
+        && rejectedRenameRef.current.name === normalizedName
+      ) {
+        rejectedRenameRef.current = null;
+        renamingQueueIdRef.current = null;
+        editingQueueNameRef.current = '';
+        setEditingQueueName('');
+        setRenamingQueueId(null);
+        return;
+      }
+      rejectedRenameRef.current = { queueId, name: normalizedName };
       addToast({ message: t($ => $.sidebar.queueNameExists), variant: 'error', isActionable: true });
       return;
     }
+    rejectedRenameRef.current = null;
     renameQueueSubmitRef.current = true;
     renamingQueueIdRef.current = null;
     setRenamingQueueId(null);
@@ -226,6 +250,7 @@ export const Sidebar: React.FC<SidebarProps> = (props) => {
             value={editingQueueName}
             onChange={e => {
               editingQueueNameRef.current = e.target.value;
+              rejectedRenameRef.current = null;
               setEditingQueueName(e.target.value);
             }}
             onKeyDown={e => {
@@ -352,7 +377,10 @@ export const Sidebar: React.FC<SidebarProps> = (props) => {
                 placeholder={t($ => $.actions.queueName)}
                 className="flex-1 bg-transparent border border-accent rounded px-1 text-[13px] text-text-primary outline-none min-w-0"
                 value={newQueueName}
-                onChange={e => setNewQueueName(e.target.value)}
+                onChange={e => {
+                  rejectedAddQueueNameRef.current = null;
+                  setNewQueueName(e.target.value);
+                }}
                 onKeyDown={e => {
                   if (e.key === 'Enter') handleAddQueueSubmit();
                   if (e.key === 'Escape') {
@@ -371,6 +399,7 @@ export const Sidebar: React.FC<SidebarProps> = (props) => {
               onClick={() => {
                 addQueueSubmitRef.current = false;
                 addQueueCancelRef.current = false;
+                rejectedAddQueueNameRef.current = null;
                 setIsAddingQueue(true);
                 setNewQueueName('');
               }}
@@ -454,6 +483,7 @@ export const Sidebar: React.FC<SidebarProps> = (props) => {
               if (q) {
                 renameQueueSubmitRef.current = false;
                 renameQueueCancelRef.current = null;
+                rejectedRenameRef.current = null;
                 renamingQueueIdRef.current = q.id;
                 editingQueueNameRef.current = q.name;
                 setEditingQueueName(q.name);

src/components/WindowControls.tsx

@@ -1,5 +1,5 @@
 import { getCurrentWindow } from '@tauri-apps/api/window';
-import { Minus, Square, X } from 'lucide-react';
+import { Maximize2, Minus, X } from 'lucide-react';
 import type { PointerEvent } from 'react';
 import { useTranslation } from 'react-i18next';
 
@@ -58,7 +58,7 @@ export function WindowControls({ side }: WindowControlsProps) {
           void appWindow.toggleMaximize();
         }}
       >
-        <Square size={8} strokeWidth={3} />
+        <Maximize2 size={9} strokeWidth={3} />
       </button>
     </div>
   );

src/i18n/catalogs/fa.ts

@@ -401,7 +401,7 @@ const fa = {
     pauseBeforeReplace: 'قبل از جایگزینی {{file}}، آن را متوقف کنید.',
     cannotReplace: 'نمی‌توان {{file}} را جایگزین کرد: فایل متعلق به یک دانلود Firelink نیست.',
     downloadLinks: 'پیوندهای دانلود',
-    pastePlaceholder: 'URLهای HTTP، HTTPS، FTP یا SFTP را در اینجا جای‌گذاری کنید...\n\nبرای دانلود رسانه، پیوندهایی از YouTube، X، TikTok، Instagram، Reddit و غیره جای‌گذاری کنید.',
+    pastePlaceholder: '\u2066URL\u2069های \u2066HTTP\u2069، \u2066HTTPS\u2069، \u2066FTP\u2069 یا \u2066SFTP\u2069 را در اینجا جای‌گذاری کنید...\n\nبرای دانلود رسانه، پیوندهایی از \u2066YouTube\u2069، \u2066X\u2069، \u2066TikTok\u2069، \u2066Instagram\u2069، \u2066Reddit\u2069 و غیره جای‌گذاری کنید.',
     playlistSummary: 'لیست پخش "{{title}}": {{loaded}}{{total}} ورودی بارگیری شد{{truncated}}{{skipped}}',
     safeEntryLimit: ' (به حد نصاب ایمن ورودی‌ها رسیدیم)',
     selectedSummary: '{{ready}} انتخاب‌شده آماده، {{fallback}} بازگشتی، {{mediaRetry}} تلاش مجدد رسانه، {{blocked}} مسدودشده',
@@ -704,7 +704,7 @@ const fa = {
       firelinkIcon: 'آیکون Firelink',
       unknown: 'نامشخص',
       version: 'نسخه {{version}}',
-      description: 'مدیریت دانلود بین پلتفرمی برای macOS، Windows و Linux.',
+      description: 'مدیریت دانلود چند پلتفرمی برای macOS، Windows و Linux.',
       sourceCode: 'کد منبع',
       source: 'منبع',
       upToDate: 'Firelink {{version}} به‌روز است.',

src/i18n/catalogs/he.ts

@@ -401,7 +401,7 @@ const he = {
     pauseBeforeReplace: 'השהה את {{file}} לפני החלפתו.',
     cannotReplace: 'לא ניתן להחליף את {{file}}: הקובץ אינו שייך להורדת Firelink.',
     downloadLinks: 'קישורי הורדה',
-    pastePlaceholder: 'הדבק כתובות HTTP, HTTPS, FTP או SFTP כאן...\n\nעבור הורדות מדיה, הדבק קישורים מ-YouTube, X, TikTok, Instagram, Reddit וכו\'.',
+    pastePlaceholder: 'הדבק כתובות \u2066HTTP\u2069, \u2066HTTPS\u2069, \u2066FTP\u2069 או \u2066SFTP\u2069 כאן...\n\nעבור הורדות מדיה, הדבק קישורים מ-\u2066YouTube\u2069, \u2066X\u2069, \u2066TikTok\u2069, \u2066Instagram\u2069, \u2066Reddit\u2069 וכו\'.',
     playlistSummary: 'פלייליסט "{{title}}": {{loaded}} מתוך {{total}} רשומות נטענו{{truncated}}{{skipped}}',
     safeEntryLimit: ' (הגיע למגבלת רשומות בטוחה)',
     selectedSummary: '{{ready}} נבחרו ומוכנים, {{fallback}} לגיבוי, {{mediaRetry}} מדיה לניסיון חוזר, {{blocked}} חסומים',

src/index.css

@@ -621,7 +621,12 @@ html[data-list-density="relaxed"] {
     border-radius: 10px;
     line-height: 1.55;
     direction: ltr;
-    text-align: start;
+    text-align: left;
+  }
+
+  .add-download-links-input--rtl:placeholder-shown {
+    direction: rtl;
+    text-align: right;
   }
 
   .add-download-link-button {
@@ -1004,6 +1009,9 @@ html[data-list-density="relaxed"] {
   .app-shell {
     direction: ltr;
     background: hsl(var(--main-bg));
+    border: 1px solid hsl(var(--border-color));
+    border-radius: 14px;
+    overflow: hidden;
   }
 
   .app-sidebar-shell {
@@ -1332,6 +1340,10 @@ html[data-list-density="relaxed"] {
     direction: ltr;
   }
 
+  .settings-tab-strip--sidebar-right {
+    flex-direction: row-reverse;
+  }
+
   .settings-tab-button {
     min-height: 64px;
     border-radius: 8px;
@@ -1630,13 +1642,18 @@ html[data-list-density="relaxed"] {
   .mac-switch:checked::after {
     transform: translateX(16px);
   }
+
+  /* Switch thumbs use physical LTR transforms in every interface direction. */
+  button[role="switch"] {
+    direction: ltr;
+  }
 .downloads-view {
   background: hsl(var(--main-bg));
 }
 
 .window-controls {
   position: fixed;
-  top: 15px;
+  top: 20px;
   left: 22px;
   right: auto;
   z-index: 60;
@@ -1693,6 +1710,10 @@ html[data-list-density="relaxed"] {
   filter: saturate(1.14) brightness(1.05);
 }
 
+.window-controls:hover .window-control {
+  color: hsl(0 0% 8% / 0.68);
+}
+
 .window-control:active {
   transform: scale(0.92);
   filter: brightness(0.9);

src/ipc.ts

@@ -66,6 +66,7 @@ type CommandMap = {
   get_extension_server_port: { args: undefined; result: number | null };
   hydrate_extension_pairing_token: { args: undefined; result: PairingTokenHydration };
   get_session_pairing_token: { args: undefined; result: PairingTokenHydration };
+  authorize_keychain_access: { args: undefined; result: void };
   regenerate_pairing_token: { args: undefined; result: PairingTokenHydration };
   grant_keychain_access: { args: undefined; result: PairingTokenHydration };
   acknowledge_pairing_token_change: { args: undefined; result: void };

src/utils/platform.test.ts

@@ -7,14 +7,16 @@ describe('shouldUseCustomWindowControls', () => {
     expect(shouldUseCustomWindowControls('unknown', 'Mozilla/5.0 (X11; Linux x86_64)')).toBe(true);
   });
 
-  it('does not render custom controls for macOS', () => {
+  it('keeps custom controls present for macOS while platform detection is unresolved', () => {
-    expect(shouldUseCustomWindowControls('unknown', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)')).toBe(false);
+    expect(shouldUseCustomWindowControls('unknown', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)')).toBe(true);
-    expect(shouldUseCustomWindowControls('macos', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)')).toBe(false);
+    expect(shouldUseCustomWindowControls('macos', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)')).toBe(true);
   });
 
   it('only opts into the supported desktop platforms', () => {
     expect(shouldUseCustomWindowControls('windows', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)')).toBe(true);
     expect(shouldUseCustomWindowControls('linux', 'Mozilla/5.0 (X11; Linux x86_64)')).toBe(true);
+    expect(shouldUseCustomWindowControls('macos', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)')).toBe(true);
     expect(shouldUseCustomWindowControls('android', 'Mozilla/5.0 (Linux; Android 14)')).toBe(false);
+    expect(shouldUseCustomWindowControls('unknown', 'Mozilla/5.0 (Linux; Android 14; Mobile)')).toBe(false);
   });
 });

src/utils/platform.ts

@@ -9,8 +9,15 @@ const fallback: PlatformInfo = {
   portable: false
 };
 
-export const shouldUseCustomWindowControls = (os: string, userAgent: string): boolean =>
+export const shouldUseCustomWindowControls = (os: string, userAgent: string): boolean => {
-  !userAgent.includes('Mac') && (os === 'windows' || os === 'linux' || os === 'unknown');
+  if (os === 'windows' || os === 'linux' || os === 'macos') return true;
+  if (os !== 'unknown') return false;
+
+  // Keep the custom titlebar visible while the native platform query is
+  // resolving. Mobile user agents are the only unknown targets that must not
+  // receive desktop window controls.
+  return !/Android|iPhone|iPad|iPod|Mobile/i.test(userAgent);
+};
 
 let cached: PlatformInfo | null = null;
 let pending: Promise<PlatformInfo> | null = null;

vite.config.ts

@@ -26,6 +26,9 @@ const buildId = (() => {
     'src-tauri/Cargo.lock',
     'src-tauri/build.rs',
     'src-tauri/tauri.conf.json',
+    'src-tauri/tauri.linux.conf.json',
+    'src-tauri/tauri.macos.conf.json',
+    'src-tauri/tauri.windows.conf.json',
     'index.html',
     'package.json',
     'package-lock.json',