Gatekeeper enforces Library Validation and prevents `dlopen` of quarantined ad-hoc signed dynamic libraries on ARM64. Because the `_internal` folder was shipped inside the DMG, the user's system flagged it with the com.apple.quarantine attribute, causing the Python shared library to fail to load inside `yt-dlp`.
By reverting back to the single-file PyInstaller binary (which is now properly code-signable without corruption on macOS), PyInstaller extracts the `_internal` folder at runtime to `/var/folders/...`. These extracted files do not inherit the quarantine flag, allowing AMFI to successfully load them and completely bypassing the dlopen system policy rejection.
The latest yt-dlp release (2026.06.09) requires heavy JavaScript execution to solve YouTube's PoW challenges. This takes ~35s on most machines, which exceeded the hardcoded 30s timeout, causing 'Failed to load options'. Increased the timeout to 120s and improved the UI to show actual errors instead of hardcoding 'Failed to load options'.
This fixes an issue where node child processes spawned by yt-dlp would keep standard output pipes open, preventing the EOF event from firing and causing the application to hang until a 30s timeout occurred.
- core: remove DispatchGroup from MediaExtractionEngine to fix hanging on yt-dlp launch failure
- core: clear readabilityHandlers in Aria2DownloadEngine if process fails to launch
- core: fix TOCTOU type warning for findFreePort
- build: fix inverted logic in Mach-O validation script
- ci: fix hardcoded macOS SDK version check in release workflow
- ci: prevent workflow_dispatch from failing on verify-tag
- proxy: Prevent SOCKS5 proxy type from being silently converted to HTTP.
- core: Remove DispatchGroup from MediaDownloadEngine to fix a hang caused by unclosed output pipes when child processes inherit file descriptors.
- settings: Fix keychain primer logic to prevent wiping extension credentials on debug builds.
- ui: Resolve a batch rename collision in AddDownloadsView by properly checking new filenames against the current batch sequence.
- fix(engine): resolve aria2 port TOCTOU race and secure conf file
- fix(server): eliminate main queue deadlock risk in local extension server
- fix(controller): ensure synchronous state save on app termination
- fix(ui): fix table skipping new items by diffing identity instead of count
- fix(scheduler): use 2-letter abbreviations to resolve day name collisions
- fix(settings): purge keychain orphans when primer access is denied
- fix(metadata): prevent synchronous DNS resolution from blocking async pool
- refactor: clean up dead code and unused variables
- Flattened playback controls in context menu
- Added 'Copy File Path' context action for completed downloads
- Reorganized context menu to prioritize Open/Finder actions and pin Properties to bottom
- Removed ControlGroup and explicit placements in toolbar for clean borderless style
- Renamed Start/Stop toolbar items to Resume/Pause with proper SF Symbols
- Added informative tooltips to toolbar actions
- Reintroduce Speed and ETA columns with dedicated rendering
- Restructure Status column to align progress bar natively
- Enhance typography with rounded fonts and monospaced digits
- Move Settings shortcut back into sidebar for faster access
- Optimize download list sorting performance by removing dynamic sortedItems
This commit overhauls the UI of the Scheduler and Speed Limiter tools using modern GroupBox designs. It also adds a highly-requested Stop Time feature to the scheduler to pause queues, and introduces a dynamic unit selection (KB/s, MB/s) to the Speed Limiter.
Includes the executable's modification date in the version hash to ensure ad-hoc and local recompilations correctly trigger the keychain primer UI, preventing unexpected system prompts on boot.
Defers fetching site login passwords until they are strictly needed (when a download starts or when viewing properties) to prevent the OS from showing the keychain prompt before the in-app primer UI.
- Refactor Site Logins pane to use a data Table with search and a dedicated editor sheet
- Add 'Reveal in Finder' buttons for bundled engines in Engine pane
- Fix alignment of 'Bundled' labels and 'Browser Cookies' picker in Engine pane
- Remove build number from the version display in About pane
- Overhauled Downloads, Look & Feel, and Network settings panes to match modern UI guidelines.
- Implemented global User-Agent spoofing for all download engines to bypass restrictions.
- Added new configuration options: dock badge toggle, notification controls, completion sound, auto-retries, and "ask where to save" prompt.
- Integrated NSApp.dockTile.badgeLabel for tracking active downloads in the macOS Dock.
- Ensured newly added options correctly persist through AppSettings.
- Add '--extractor-args youtube:player_client=ios,web' to bypass heavy JS challenge solving
- Add '--compat-options no-youtube-unavailable-videos' to skip blocked videos
- Fix missing proxy configuration in MediaExtractionEngine that caused timeouts
- Add '--live-from-start' for yt-dlp to handle live streams correctly
- Add timeout to LocalExtensionServer to mitigate Slowloris
- Optimize media output resolution by checking explicit extensions
- Throttle progress updates to 4Hz
- Debounce download completion notifications
- Use native ProgressView in DownloadTable
- Group DownloadTable context menu items
- Fix drag & drop overwriting issue
- Fix focus rings on hidden keyboard shortcuts
- Allow GET method in LocalExtensionServer CORS preflight response
- Migrate pairing token storage from UserDefaults to KeychainCredentialStore
- Upgrade token generation to use SecRandomCopyBytes
- Update IntegrationSettingsPane UI to be browser-agnostic with a Regenerate token action
- Generate random pairing token in AppSettings
- Update LocalExtensionServer to strict check token on non-OPTIONS endpoints
- Add GET /ping endpoint for extension connection verification
- Redesign Integration settings pane with modern step-by-step UI and Toast notifications
- Harden media extraction and aria2 engine paths
- Update IP resolution with getaddrinfo
- Used DispatchGroup to fix stdout/stderr truncation race condition
- Added --force-ipv4 to prevent metadata fetching hang
- Removed hardcoded youtube:player_client to fix throttling issues
- Combined --js-runtimes flags as a comma-separated list
- Fix keyboard shortcut collision causing main window to intercept Enter/Escape keys when duplicate resolution sheet is open
- Fix UI freeze when checking release notes for an update by parsing HTML asynchronously
- Improve Sparkle changelog formatting by converting HTML tags to clean Markdown
- Change internal Process ID status message to Starting... when queueing downloads
- Fix EXC_BREAKPOINT crash on app launch by prioritizing Bundle.main over Bundle.module
- Update CHANGELOG.md for 0.6.2 release
NimBold