Configure Tauri to ad-hoc sign macOS app and DMG builds without Apple Developer credentials.
Add a macOS signing verifier that checks the built app, the DMG payload, Mach-O signatures, quarantine xattrs, and expected Gatekeeper behavior.
Tighten README copy while keeping the platform install pills and accurate non-notarized macOS guidance.
Update npm lockfile packages, compatible Rust lockfile entries, and GitHub Actions release workflow actions.
Bundle the macOS aria2 OpenSSL legacy provider and set OPENSSL_MODULES for aria2 version checks and daemon startup so packaged builds do not depend on Homebrew OpenSSL provider paths.
Keep the Rust Tauri crate family on the previously verified patch line and hold time at 0.3.49 because newer compatible lockfile candidates failed local cargo verification.
- update npm dependencies, including Vite 8.1.0 and TypeScript 6.0.3
- update bundled Deno engine locks and macOS arm64 binary to 2.8.3
- add npm run check:updates for npm and engine freshness checks
- ignore local agent/planning notes and remove tracked internal docs
Bundle the self-contained yt-dlp onedir runtime to avoid per-request extraction latency, explicitly use bundled Deno, and guard the packaging layout. Also fix Add window menu/reset behavior and harden diagnostics and toast lifecycle handling.
- Replace tokio::process with tauri_plugin_shell sidecar API for native cross-compilation bundle execution.
- Implement non-blocking stdout/stderr multiplexing in yt-dlp spawn to prevent OS pipe buffer deadlocks.
- Refactor capabilities to restrict execution explicitly to sidecars instead of wildcards.
- Rename local binaries to strictly adhere to target-triple architecture suffixes.
- Drop manual get_binary_name path resolutions in favor of Tauri's externalBin bundler.
NimBold