chore(release): prepare Firelink 1.0.0

Add aria2 control epochs so delayed resume workers cannot unpause a transfer after a newer pause, remove, or reconfigure command wins.

Thread captured cookies into yt-dlp media runs, sanitize yt-dlp config values, reject malformed media headers, and preserve resumable media artifacts across transient retry backoff.

Cover the new queue epoch and media helper behavior with focused regression tests.

.github/workflows/ci.yml

@@ -0,0 +1,80 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  frontend:
+    name: Frontend checks
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: node --test scripts/*.node-test.js
+      - run: npm test -- --run
+      - run: npm run build
+
+  desktop:
+    name: Desktop checks (${{ matrix.target }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+          - os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - name: Install Linux dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            libdbus-1-dev \
+            pkg-config
+      - run: npm ci
+      - name: Test Rust backend
+        if: runner.os != 'Windows'
+        working-directory: src-tauri
+        run: cargo test --all-targets --target ${{ matrix.target }}
+      - name: Test Rust backend
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: |
+          cargo test --tests --target ${{ matrix.target }}
+          cargo test --lib --no-run --target ${{ matrix.target }}
+      - name: Provision locked engines
+        if: runner.os != 'macOS'
+        run: node scripts/provision-engines.js --target ${{ matrix.target }}
+      - name: Stage and verify engines
+        run: |
+          node scripts/stage-engines.js --target ${{ matrix.target }}
+          node scripts/verify-binaries.js --staged --target ${{ matrix.target }}

.github/workflows/release.yml

@@ -2,76 +2,160 @@ name: Release
 
 on:
   push:
-    tags:
-      - "v*"
+    tags: ['v*']
   workflow_dispatch:
     inputs:
-      version:
-        description: "Release version, for example 0.1.0"
-        required: true
-        default: "0.1.0"
+      publish_release:
+        description: 'Publish the GitHub release after all platform QA is certified'
+        type: boolean
+        default: false
+      certified_cross_platform:
+        description: 'Confirm Windows, Linux, and macOS clean-machine QA passed'
+        type: boolean
+        default: false
 
 permissions:
   contents: write
 
 jobs:
-  macos-arm64-dmg:
-    name: Build macOS ARM64 DMG
-    runs-on: macos-15
-
+  build:
+    name: Build ${{ matrix.label }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: macOS-arm64
+            os: macos-26
+            target: aarch64-apple-darwin
+            bundles: app,dmg
+            artifact: src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/*.dmg
+          - label: Windows-x64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+            bundles: nsis
+            artifact: src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
+          - label: Linux-x64-AppImage
+            os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            bundles: appimage
+            artifact: src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage
+    runs-on: ${{ matrix.os }}
     steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - name: Install Linux dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            appstream \
+            curl \
+            patchelf \
+            libdbus-1-dev \
+            pkg-config \
+            xvfb \
+            libtinfo5
+      - run: npm ci
+      - name: Provision locked engines
+        if: runner.os != 'macOS'
+        run: node scripts/provision-engines.js --target ${{ matrix.target }}
+      - name: Build package
+        run: npm run tauri build -- -vv --target ${{ matrix.target }} --bundles ${{ matrix.bundles }}
+        env:
+          APPIMAGE_EXTRACT_AND_RUN: 1
+          FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE: ${{ runner.os == 'Linux' && '1' || '' }}
+      - name: Install pinned appimagetool (Linux only)
+        if: runner.os == 'Linux'
+        env:
+          APPIMAGETOOL_URL: https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
+          APPIMAGETOOL_SHA256: a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0
+        run: |
+          curl -fsSL "$APPIMAGETOOL_URL" -o "$RUNNER_TEMP/appimagetool"
+          echo "$APPIMAGETOOL_SHA256  $RUNNER_TEMP/appimagetool" | sha256sum -c -
+          chmod +x "$RUNNER_TEMP/appimagetool"
+      - name: Repack AppImage with engines (Linux only)
+        if: runner.os == 'Linux'
+        run: node scripts/repack-linux-appimage-engines.js --target ${{ matrix.target }} --appimagetool "$RUNNER_TEMP/appimagetool"
+      - name: Verify macOS packaged engines and launch
+        if: runner.os == 'macOS'
+        run: |
+          APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app"
+          node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }}
+          node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
+      - name: Verify Windows installer payload and launch
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $installer = Get-ChildItem "src-tauri/target/${{ matrix.target }}/release/bundle/nsis/*.exe" | Select-Object -First 1
+          if (-not $installer) { throw "Windows NSIS installer artifact was not produced." }
+          $extractRoot = "$env:RUNNER_TEMP/firelink-installer"
+          Remove-Item -Recurse -Force $extractRoot -ErrorAction SilentlyContinue
+          7z x $installer.FullName "-o$extractRoot" -y
+          node scripts/verify-binaries.js --search-root "$extractRoot" --target ${{ matrix.target }}
+          $installRoot = "$env:RUNNER_TEMP\FirelinkSmoke"
+          Remove-Item -Recurse -Force $installRoot -ErrorAction SilentlyContinue
+          $install = Start-Process -FilePath $installer.FullName -ArgumentList @("/S", "/D=$installRoot") -Wait -PassThru
+          if ($install.ExitCode -ne 0) { throw "Silent NSIS install failed with exit code $($install.ExitCode)." }
+          $exe = $null
+          foreach ($attempt in 1..60) {
+            $exe = Get-ChildItem $installRoot -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -ieq "firelink.exe" } | Sort-Object FullName | Select-Object -First 1
+            if ($exe) { break }
+            Start-Sleep -Seconds 1
+          }
+          if (-not $exe) { throw "firelink.exe was not found under $installRoot after silent install." }
+          node scripts/smoke-packaged-app.js --executable $exe.FullName --assert-no-visible-child-windows
+      - name: Verify Linux AppImage payload and launch
+        if: runner.os == 'Linux'
+        run: |
+          APPIMAGE="$(find src-tauri/target/${{ matrix.target }}/release/bundle/appimage -name '*.AppImage' -print -quit)"
+          chmod +x "$APPIMAGE"
+          (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/$APPIMAGE" --appimage-extract >/dev/null)
+          node scripts/verify-binaries.js --search-root "$RUNNER_TEMP/squashfs-root" --target ${{ matrix.target }}
+          xvfb-run -a node scripts/smoke-packaged-app.js --executable "$RUNNER_TEMP/squashfs-root/AppRun"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: Firelink-${{ matrix.label }}-${{ github.ref_name }}
+          path: ${{ matrix.artifact }}
+          if-no-files-found: error
+          retention-days: 3
 
-      - name: Resolve version
-        id: version
+  publish:
+    name: Publish GitHub release
+    if: >-
+      github.event_name == 'workflow_dispatch' &&
+      startsWith(github.ref, 'refs/tags/v') &&
+      inputs.publish_release &&
+      inputs.certified_cross_platform
+    needs: build
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
+        with:
+          path: release-assets
+          merge-multiple: true
+      - name: Extract changelog release notes
         shell: bash
         run: |
-          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
-            VERSION="${GITHUB_REF_NAME#v}"
-          else
-            VERSION="${{ inputs.version }}"
-          fi
-
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Version: $VERSION"
-
-      - name: Show build environment
+          VERSION="${GITHUB_REF_NAME#v}"
+          awk '/^## \['"$VERSION"'\]/{flag=1; next} /^## \[/{if(flag) exit} flag' CHANGELOG.md > release_notes.md
+          test -s release_notes.md
+      - name: Generate checksums
         run: |
-          uname -a
-          swift --version
-
-      - name: Build app bundle
-        env:
-          MARKETING_VERSION: ${{ steps.version.outputs.version }}
-          BUILD_NUMBER: ${{ github.run_number }}
-        run: Scripts/create_app_bundle.sh
-
-      - name: Verify ARM64 binary
-        run: |
-          file build/Firelink.app/Contents/MacOS/Firelink
-          lipo -archs build/Firelink.app/Contents/MacOS/Firelink | grep -qx arm64
-
-      - name: Create DMG
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-          ARCH: arm64
-        run: Scripts/create_dmg.sh
-
-      - name: Upload workflow artifact
-        uses: actions/upload-artifact@v4
+          cd release-assets
+          find . -type f -print0 | sort -z | xargs -0 sha256sum > SHA256SUMS
+      - uses: softprops/action-gh-release@v3
         with:
-          name: Firelink-${{ steps.version.outputs.version }}-mac-arm64-dmg
-          path: dist/*.dmg
-          if-no-files-found: error
-
-      - name: Publish GitHub release
-        if: github.ref_type == 'tag'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
-            gh release upload "$GITHUB_REF_NAME" dist/*.dmg --clobber
-          else
-            gh release create "$GITHUB_REF_NAME" dist/*.dmg --generate-notes --verify-tag
-          fi
+          files: release-assets/**
+          body_path: release_notes.md

.gitignore

@@ -1,8 +1,83 @@
+# OS and editor files
 .DS_Store
-.build/
-build/
-dist/
-DerivedData/
+skills-lock.json
+.idea/
 .vscode/
+*.suo
+*.sw?
 *.xcuserdata/
 *.xcuserstate
+
+# Local agent and planning notes
+AGENT.md
+AGENTS.md
+CLAUDE.md
+GEMINI.md
+implementation_plan.md
+CROSS_PLATFORM_CHECKLIST.md
+Cross-platform-checklist-gemini.MD
+YouTube_media_download_handoff.md
+
+# Frontend output and logs
+node_modules/
+dist/
+dist-ssr/
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+*.local
+
+# Rust and Tauri output
+target/
+src-tauri/target/
+src-tauri/gen/
+src-tauri/engine-dist/
+src-tauri/provisioned-engines/
+
+# Locally provisioned native engines
+src-tauri/binaries/aria2c
+src-tauri/binaries/deno
+src-tauri/binaries/ffmpeg
+src-tauri/binaries/yt-dlp
+
+# Packaged artifacts
+build/
+*.dmg
+*.AppImage
+*.deb
+*.msi
+*.exe
+
+# Local secrets and signing material
+.env
+.env.*
+*.key
+*.pem
+!src-tauri/binaries/_internal/certifi/cacert.pem
+*.p8
+*.p12
+*.cer
+*.der
+*.mobileprovision
+sparkle_private_key*
+SparklePrivateKey*
+private-key*
+private_key*
+
+# Legacy Swift build output and downloaded engines
+legacy/swift/.build/
+legacy/swift/DerivedData/
+legacy/swift/Sources/Firelink/*-version.txt
+legacy/swift/Sources/Firelink/yt-dlp
+legacy/swift/Sources/Firelink/deno
+legacy/swift/Sources/Firelink/ffmpeg
+legacy/swift/Sources/Firelink/aria2c
+legacy/swift/Sources/Firelink/_internal/*
+legacy/swift/Sources/Firelink/aria2-libs/
+legacy/swift/Sources/Firelink/aria2-licenses/
+legacy/swift/Sources/Firelink/aria2-cacert.pem
+!legacy/swift/Sources/Firelink/_internal/.gitkeep

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "Extensions/Firefox"]
+	path = Extensions/Firefox
+	url = https://github.com/nimbold/Firelink-Extension.git

CHANGELOG.md

@@ -0,0 +1,396 @@
+# Changelog
+
+All notable changes to Firelink will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-07-04
+
+### Highlights
+- Firelink is now a cross-platform desktop download manager built with Rust, Tauri, React, and TypeScript.
+- macOS, Windows, and Linux release builds are prepared through native GitHub Actions runners.
+- The older macOS-only Swift app has been removed from the active product and replaced by the new desktop app.
+
+### New
+- Add full browser-to-desktop integration through Firelink Companion, including signed local requests, desktop identity checks, and automatic-capture protection.
+- Add a complete Add window for links captured from the browser, pasted manually, or extracted from media pages.
+- Add segmented direct downloads, media downloads, queue controls, scheduling, speed limits, and duplicate handling.
+- Add persistent downloads, categories, save-location settings, site logins, and safe redownload behavior.
+- Add native tray controls, notifications, completion sounds, sleep prevention, file reveal/open/trash actions, and OS keychain support where available.
+- Add built-in diagnostics for media engines, app logs, packaged-engine validation, and release smoke checks.
+
+### Improved
+- Rework the main window, settings, logs, Add window, download list, toasts, context menus, and table interactions for the new desktop interface.
+- Improve media extraction with better YouTube metadata loading, format filtering, size estimates, output names, progress, retries, and cleanup.
+- Improve download reliability on rate-limited servers, servers with broken range support, interrupted app sessions, and queue-concurrency changes.
+- Improve extension captures so browser downloads are resumed unless Firelink confirms the handoff.
+- Improve cross-platform packaging by bundling target-specific aria2, yt-dlp, FFmpeg, and Deno payloads.
+- Improve privacy by avoiding startup keychain prompts, redacting secrets from local persistence, and narrowing when browser cookies are forwarded.
+
+### Fixed
+- Fix stuck queued/downloading/completed states, stale aria2 dispatches, queue shrink behavior, retry caps, scheduler actions, and post-queue system actions.
+- Fix many Windows, Linux, and macOS packaging issues, including hidden helper consoles, AppImage engine handling, installer validation, and smoke-test timing.
+- Fix media child-process cleanup so paused, canceled, failed, or removed downloads do not leave stray processes or partial files behind.
+- Fix UI hangs, overflow, sorting, selection, animation, and contrast issues across the main list, Add window, settings, and log viewer.
+- Fix security issues around local server authentication, request signing, replay protection, private IP metadata checks, path ownership, header sanitization, and command execution boundaries.
+
+### Notes
+- This is a major release from `0.7.3`. Older Firelink Companion builds are not compatible with every 1.0 capture path; update the extension together with the desktop app.
+- macOS builds are unsigned and not notarized. Windows builds are unsigned. See [RELEASE.md](RELEASE.md) for distribution details.
+
+## [0.7.3] - 2026-06-11
+
+### New Features & Improvements
+- Add Deno to about credits and engines list.
+- Enhance speed and ETA display logic during pause and drop.
+- Accumulate track sizes to present a unified overall progress bar.
+
+### Fixes
+- Resolve unknown speed flickering and ultra-wide high-resolution detection.
+- Emit distinct status messages for individual tracks during download.
+- Pad overall progress total for first track to prevent 100% snapback.
+
+## [0.7.2] - 2026-06-11
+
+### Fixed
+- Prevented yt-dlp and JavaScript child processes from keeping metadata fetches or canceled downloads alive indefinitely.
+- Replaced the repeatedly extracted one-file yt-dlp build with a stable prewarmed runtime cache.
+- Bundled Deno so YouTube JavaScript challenges and formats above 720p do not depend on system-installed tools.
+- Stopped masking empty-format extraction failures and removed brittle forced YouTube client selection.
+
+### Changed
+- Pinned and checksum-verified yt-dlp, Deno, FFmpeg, aria2, and aria2's libraries for matching local and GitHub Actions builds.
+- Removed aria2's runtime dependency on Homebrew and configured its bundled CA certificate for direct and yt-dlp-delegated HTTPS downloads.
+- Added bounded network retries and optional aria2c acceleration for large direct media downloads.
+
+## [0.7.1] - 2026-06-11
+
+### Fixes
+- Increased the `yt-dlp` metadata extraction timeout to 120 seconds to properly handle YouTube's new JavaScript Proof-of-Work bot protection challenges.
+- Improved the `AddDownloadsView` UI to display the exact underlying error message during extraction failures rather than a generic masked string.
+
+### Security Fixes
+- Addressed multiple vulnerabilities identified in the v0.7.0 security audit.
+- Moved `yt-dlp` credential passing from CLI arguments to secure temporary configuration files to prevent process list leakage.
+- Enforced strict `0o600` POSIX permissions on `aria2c` temporary configuration files to protect generated RPC secrets.
+- Replaced the unauthenticated local connection protocol with a secure HMAC-SHA256 signature validation.
+- Excluded sensitive properties like `rpcSecret` and `rpcPort` from `DownloadItem` serialization so they are never saved to disk in plaintext.
+- Mitigated SSRF (Server-Side Request Forgery) by strictly validating metadata fetch requests against private IP addresses and loopback ranges.
+- Prevented potential path traversal vulnerabilities by validating destination file URLs during duplicate resolution.
+- Sanitized custom HTTP headers to prevent CR/LF injection vectors.
+- Re-architected `aria2c` port-finding with POSIX sockets to eliminate a known race-condition window.
+- Applied rate-limiting and text length bounds to the custom `firelink://` scheme to mitigate DoS and injection attempts.
+
+### Fixes
+- Fixed a metadata extraction timeout when downloading from YouTube by preventing child processes from holding process pipes open.
+- Resolved an issue to correctly assign filenames for auto-captured downloads.
+- Restored the UUID fallback for token generation to prevent silent failures if secure random byte generation fails.
+- Hardened local API security by immediately rejecting requests if the expected pairing token is completely empty.
+- Implemented a thread-safe cleanup mechanism for temporary directories to resolve a concurrency race condition during engine cancellation.
+
+## [0.7.0] - 2026-06-11
+
+### New Features & Improvements
+- Complete UI modernization for the context menu, toolbar, download list, and sidebar to adhere strictly to Apple's Human Interface Guidelines (HIG).
+- Overhaul of the Settings panes including Site Logins, Engine, About, Locations, and Downloads for a unified, cleaner look.
+- Introduce an "Ask where to save" global configuration option for manual location picking per download.
+- Add "Stop Time" option to the Scheduler and unit picker for the global Speed Limiter.
+- Enhance the Integration pane with a visible step counter and an up-to-date status icon.
+- Optimize `yt-dlp` execution for noticeably faster media extraction speeds.
+- Defer Keychain access prompts and track executable modification dates for a more secure "priming" mechanism.
+
+### Fixes
+- Fix issues regarding proxy environment propagation into media download processes.
+- Resolve multiple critical bugs related to configuration storage and download stability.
+- Address multiple underlying issues identified during comprehensive code reviews to improve overall resilience.
+
+## [0.6.6] - 2026-06-10
+
+### New Features
+- Add cascading media format pickers with inline loading states during metadata extraction.
+- Redesign the Integration settings pane for a more modern experience.
+- Overhaul the built-in update checker UI to integrate seamlessly into the settings.
+
+### Improvements
+- Implement keychain permission priming to defer secure access until explicitly granted, preventing unexpected macOS prompts.
+- Optimize core UI components to significantly improve rendering performance and overall app stability.
+
+### Fixes
+- Fix layout and dynamic sizing bugs in the Add Downloads window.
+- Fix formatting inconsistencies in media options selection.
+- Fix toast notification rendering glitches.
+
+## [0.6.5] - 2026-06-09
+
+### Fixes
+- Fix GitHub Actions build failure caused by an ambiguous bundle format when attempting to codesign `yt-dlp`'s embedded PyInstaller `Python.framework`.
+
+## [0.6.4] - 2026-06-09
+
+### New Features
+- Replace Sparkle with a lightweight native GitHub release checker for seamless and reliable updates.
+
+### Improvements
+- Polish the browser extension pairing UI with a secure masked token field and improved styling.
+
+### Changes
+- Remove stale references to the legacy static token from the Firelink Companion extension.
+
+### Fixes
+- Fix an issue where the app failed to detect newer padded version numbers (e.g., `1.0` vs `1.0.0`).
+- Fix missing macOS code signatures for `yt-dlp`'s embedded Python runtime, resolving potential Gatekeeper rejections.
+
+## [0.6.3] - 2026-06-09
+
+### Improvements
+- Upgrade pairing token generation to use a 32-byte cryptographically secure random sequence.
+- Migrate pairing token storage from UserDefaults to KeychainCredentialStore for enhanced security.
+- Redesign the "Connect Browser Extension" settings pane to be browser-agnostic with links to both Firefox and Chrome extension stores.
+- Add a "Regenerate" button to instantly invalidate and recreate the pairing token.
+
+### Fixes
+- Fix CORS preflight failures for the new `/ping` extension connection check by allowing `GET` methods in the local server.
+
+## [0.6.2] - 2026-06-08
+
+### Fixes
+- Fix a bug where confirming a duplicate resolution failed to close the Add Downloads window, misleading users into thinking the download didn't start.
+- Fix keyboard shortcut collision that caused the main window to intercept Enter/Escape keys when the duplicate resolution sheet was open.
+- Fix UI freeze when checking release notes for an update by parsing HTML asynchronously on a background thread.
+- Improve update changelog formatting by converting release note markup to clean Markdown instead of stripping it into an unreadable block of text.
+- Change the internal `Process xxxxx` status message to a cleaner `Starting...` message when queueing a new download.
+- Fix `EXC_BREAKPOINT` crash on app launch in production builds by prioritizing `Bundle.main` over `Bundle.module` when accessing resources.
+
+## [0.6.1] - 2026-06-08
+
+### New Features
+- No new user-facing features in this patch release.
+
+### Improvements
+- Package bundled `yt-dlp` and `ffmpeg` executables into the macOS app bundle so media extraction works in release builds.
+- Resolve bundled media engines from both app resources and SwiftPM resources to support packaged apps and local development builds.
+
+### Changes
+- Fetch release-time media engine binaries in GitHub Actions instead of storing large binaries in git.
+- Use the changelog entry for GitHub release page descriptions so published release notes match the source tree.
+- Remove stale media add-on update language now that media engines are bundled with the app.
+- Update Firelink Companion to `1.0.8`.
+
+### Fixes
+- Replace the stale pinned FFmpeg download URL with Martin Riedl's latest macOS ARM64 release redirect.
+- Fail release builds early when `yt-dlp` or `ffmpeg` cannot be fetched or made executable.
+- Remove unused media inspector and media download entry-point code left behind by the removed engine update flow.
+- Prevent Firelink Companion global capture from canceling browser downloads unless the native app confirms the local API handoff.
+
+## [0.6.0] - 2026-06-08
+
+### New features
+- Enhance mixed media support and add duplicate resolution.
+- Redesign settings panes and enhance update flows.
+- Improve yt-dlp fetching speed and redesign media detection UI.
+- Enhance media engine settings with cookie extraction and update checks.
+- Modernize Integration settings UI and add official install button.
+- Integrate yt-dlp to DownloadController and add global queue support.
+- Implement smart progressive disclosure UI and media extraction engine.
+- Implement gatekeeper architecture for on-demand media engine binaries.
+- Inline update checks to avoid unnecessary modals.
+
+### Changes
+- Add backward compatibility support for extension tokens.
+- Update Firelink-Extension submodule to latest.
+- Update app icons and icon generation scripts.
+- Tone down icon gradient to 1.9x for modern subtle look.
+- Increase gradient contrast for stronger lighting effect.
+- Switch to lighter gradient (+1 to 0).
+- Revert to plain mode without gradient.
+- Apply premium gradient to the correct new icon and app icon.
+- Remove redundant version string from up-to-date message.
+- Update release metadata for the framework-embedded dmg.
+
+### Fixes
+- Cap max height of download links text editor.
+- Harden media download flow.
+- Pass extractor arguments to yt-dlp download process.
+- Restore single click selection by removing simultaneousGesture.
+- Restore Download Properties routing and gestures.
+- Pass UUID as String for download properties WindowGroup to prevent routing failures.
+- Size column fallback and table row interactions.
+- Media download UX and table row selection.
+- Media downloads connections, progress parsing, file size, and selection highlight.
+- Stabilize yt-dlp metadata and add-on updates.
+- Block automatic metadata fetch for private IP addresses (security).
+- Actually update extension icons with the 1.9x gradient icon.
+- Correctly remove black padding and mask corners.
+- Harden release metadata.
+- Correct no-update handling to prevent false error messages.
+
+## [0.5.7] - 2026-06-06
+
+### New features
+- Replaced the basic in-app update checker with an integrated release-checking flow.
+- Added secure update metadata checks before presenting new releases in the app.
+
+## [0.5.6] - 2026-06-05
+
+### New features
+- Added the official transparent GitHub icon to the Source Code link in the About page.
+
+### Changes
+- Compacted the About settings pane to reduce vertical padding, placing the app identity and updates prominently at the top.
+- Consolidated developer, credits, and legal links into a single unified footer section in the About pane.
+
+### Fixes
+- Fixed a build script bug that prevented bundled images (like the GitHub icon) from being copied into the final app bundle.
+
+## [0.5.5] - 2026-06-05
+
+### New features
+- Added a compact Download Properties inspector with a persistent progress summary and redownload-aware transfer settings.
+- Added authenticated metadata probing so batch previews can use custom or saved credentials.
+
+### Changes
+- Updated Download Properties disclosure sections so their full title row opens and closes them.
+- Compacted Add Downloads with a smaller summary strip, queue picker, and clearer per-file speed limit wording.
+- Expanded download table hit areas so double-clicks register across empty cell space.
+
+### Fixes
+- Fixed active downloads that could remain stuck at 99% until manually stopped by detecting `aria2` completion through RPC.
+- Fixed Chunk Map layout overlap in Download Properties.
+- Fixed Download Properties controls that implied completed or active file identity edits would apply immediately.
+
+## [0.5.4] - 2026-06-04
+
+### New features
+- Added direct double-click access to Download Properties for unfinished downloads.
+- Added a `make verify` command for local build and Firefox extension manifest checks.
+
+### Changes
+- Updated Firefox integration to probe the same local fallback ports used by the app.
+- Updated global speed limiting so changes apply to active downloads through `aria2` RPC.
+- Declared SwiftPM resources and added development fallbacks for app icons and Firefox extension copying.
+- Narrowed saved site-login matching so plain host patterns match exact hosts unless a wildcard is used.
+
+### Fixes
+- Fixed browser handoff failures when the default local extension port is unavailable.
+- Fixed dropped `Referer` headers from browser extension requests.
+- Fixed scheduler configurations that could be enabled without any runnable queue target.
+- Fixed unsafe file names from URLs, metadata responses, and manual property edits.
+- Fixed a possible duplicate-open glitch when double-clicking unfinished downloads.
+
+## [0.5.3] - 2026-06-04
+
+### New features
+- Added `ChunkMapView` to visualize active segmented downloads using `aria2` RPC with minimal performance overhead.
+- Added seamless drag-and-drop support for URLs and text files in the main window and dock icon.
+
+### Changes
+- Refactored all Settings panes to use standard macOS HIG `Form` and `.toolbar` layouts.
+- Updated the "Add Downloads" dialog to use native macOS `.toolbar` with integrated cancel actions.
+
+### Fixes
+- Fixed a DNS rebinding vulnerability by rigorously validating the `Host` header within the local extension server.
+- Fixed a potentially unbounded memory leak in the download console buffer by introducing a strict 512KB cap.
+- Fixed an intermittent UI hang during the `aria2c` version check by fully decoupling the process execution into a detached background task.
+
+## [0.5.2] - 2026-06-04
+
+### Fixes
+- Fixed the hit-testing area on Settings tabs so the entire tab frame is clickable, not just the text/icon.
+- Re-architected the Settings tab bar layout to perfectly distribute available horizontal space, ensuring symmetric right/left padding.
+
+## [0.5.1] - 2026-06-04
+
+### Changes
+- Added sleek SF Symbol icons to the Settings capsule tabs to improve visual scannability and modernize the interface.
+
+## [0.5.0] - 2026-06-04
+
+### New features
+- Added a dedicated Speed Limiter UI to the main sidebar for instant global bandwidth throttling.
+- Integrated Settings directly into the main application window instead of a separate macOS scene, paving the way for future Windows/Linux cross-platform parity.
+
+### Changes
+- Modernized Settings with a sleek horizontal tab bar layout.
+- Added persistent state retention across views (remembers the last visited settings tab and custom speed limits).
+- Compacted the README file to be more concise and user-friendly.
+
+### Fixes
+- Fixed a critical memory crash (`EXC_BAD_ACCESS`) inside the Download Table caused by ephemeral string sorting during active downloads.
+- Fixed sidebar layout glitches to prevent text overlap during scroll.
+
+## [0.4.3] - 2026-06-03
+
+### Changes
+- Refined About page UI and simplified the delete confirmation dialog.
+
+### Fixes
+- Optimized disk writes and UI state updates to significantly reduce main thread CPU usage and SSD wear during concurrent downloads and table resizing.
+
+## [0.4.2] - 2026-06-03
+
+### Features added
+- Added double-click to open completed files directly from the download table.
+- Added redownload functionality for completed or failed items.
+- Added 'Copy Address' context menu action.
+- Added a monochrome template tray icon loaded explicitly with precise dimensions.
+
+### Changes
+- Improved context menu organization and conditionally displayed actions based on download status.
+
+## [0.4.1] - 2026-06-03
+
+### Features added
+- Added app theming engine with Look and Feel settings.
+- Added Font Size, List Row Density, and Menu Bar Icon settings.
+- Added tray icon and context menu for main window and queues.
+- Added site logins integration directly into the Add Downloads window.
+
+### Changes
+- Updated the paste hint to use a visual Command icon.
+
+### Fixes
+- Resolved SwiftUI infinite layout freeze caused by MenuBarExtra binding.
+- Fixed a bug with Light/System theme appearance.
+- Fixed phantom state issues with Menu Bar Icon setting and conditionally applied theme backgrounds to preserve native macOS translucency.
+
+## [0.4.0] - 2026-06-03
+
+### Changes
+- Reorganized Settings sections so related download preferences sit together and app logs live under App.
+- Hardened the release workflow with explicit macOS 26 SDK checks, newer GitHub Actions, and app signature verification.
+- Prefer the bundled `aria2c` binary inside release builds.
+
+### Fixes
+- Fixed queue-specific starts so one queue no longer starts unrelated queued downloads.
+- Fixed scheduler completion handling so empty queues do not trigger post-download system actions.
+- Fixed queue drag reordering when moving items downward.
+- Fixed scheduler Automation permission prompting.
+
+### Features added
+- Added scheduler controls with explicit Automation permission UI.
+- Added global and per-download speed limits.
+- Added advanced transfer options for checksums, headers, cookies, and mirror URLs.
+
+## [0.3.0] - 2026-06-02
+
+### Added
+- **Zero-Config Setup:** Firelink now automatically bundles the `aria2c` engine and all of its dynamic library dependencies internally via `dylibbundler`. End-users no longer need to install Homebrew or `aria2c` manually! 
+
+### Changed
+- **README Redesign:** Modernized the README with a clean layout, centered App Icon header, and updated roadmap.
+- **CI Releases:** The GitHub Actions DMG release pipeline now automatically fetches and packages dependencies during builds.
+
+## [0.2.1] - 2026-06-02
+### Changed
+- Fixed CI release runner specifying macOS 26.
+
+## [0.2.0] - 2026-06-01
+### Added
+- **In-App Update Checker:** Built-in GitHub release checks inside the Settings About pane.
+- **Queue Management:** Advanced drag-and-drop priority ordering and queue management controls.
+- **Download Recovery:** Built-in download recovery and automated retry policies.
+- Initial core download engine with `aria2c` support.
+- Native macOS Settings pane.
+- Smart file categorization and organization based on extension detection.
+- Keychain-secured authentication integration.

Makefile

@@ -1,17 +0,0 @@
-.PHONY: build app dmg run clean
-
-build:
-	swift build -c release
-
-app:
-	Scripts/create_app_bundle.sh
-
-dmg: app
-	Scripts/create_dmg.sh
-
-run:
-	swift run Firelink
-
-clean:
-	swift package clean
-	rm -rf build dist

Package.swift

@@ -1,19 +0,0 @@
-// swift-tools-version: 6.0
-
-import PackageDescription
-
-let package = Package(
-    name: "Firelink",
-    platforms: [
-        .macOS(.v14)
-    ],
-    products: [
-        .executable(name: "Firelink", targets: ["Firelink"])
-    ],
-    targets: [
-        .executableTarget(
-            name: "Firelink",
-            path: "Sources/Firelink"
-        )
-    ]
-)

README.md

@@ -1,112 +1,172 @@
 <div align="center">
-  <h1>Firelink</h1>
-  <p><strong>A clean, native SwiftUI download manager for Apple Silicon macOS</strong></p>
+  <img src="src/assets/app-icon.png" alt="Firelink" width="112" height="112" />
 
-  [![Swift Version](https://img.shields.io/badge/Swift-6.0-orange?logo=swift&logoColor=white)](https://swift.org)
-  [![Platform Support](https://img.shields.io/badge/macOS-14.0%2B-blue?logo=apple&logoColor=white)](https://apple.com)
-  [![Engine](https://img.shields.io/badge/Engine-aria2c-red?logo=terminal&logoColor=white)](https://aria2.github.io/)
-  [![License](https://img.shields.io/badge/License-MIT-green)](LICENSE)
+  # Firelink
+
+  **A fast, focused desktop download manager for macOS, Windows, and Linux.**
+
+  [![Version](https://img.shields.io/badge/version-1.0.0-6f42c1?style=flat-square)](https://github.com/nimbold/Firelink/releases)
+  [![macOS](https://img.shields.io/badge/macOS-111111?style=flat-square&logo=apple&logoColor=white)](#platforms)
+  [![Windows](https://img.shields.io/badge/Windows-0078D6?style=flat-square&logo=windows11&logoColor=white)](#platforms)
+  [![Linux](https://img.shields.io/badge/Linux-FCC624?style=flat-square&logo=linux&logoColor=black)](#platforms)
+  [![Tauri](https://img.shields.io/badge/Tauri-2-24C8DB?style=flat-square&logo=tauri&logoColor=white)](https://tauri.app/)
+  [![Rust](https://img.shields.io/badge/Rust-backend-000000?style=flat-square&logo=rust)](https://www.rust-lang.org/)
+  [![React](https://img.shields.io/badge/React-TypeScript-61DAFB?style=flat-square&logo=react&logoColor=111111)](https://react.dev/)
+  [![License](https://img.shields.io/github/license/nimbold/Firelink?style=flat-square)](LICENSE)
+  [![CI](https://img.shields.io/github/actions/workflow/status/nimbold/Firelink/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/nimbold/Firelink/actions/workflows/ci.yml)
+
+  [Features](#features) · [Install](#installation) · [Browser Extension](#browser-extension) · [Development](#development) · [Release Notes](CHANGELOG.md)
 </div>
 
----
+<br/>
 
-**Firelink** brings the efficiency of multi-segmented download managers (like IDM or FDM) to macOS with a modern, native SwiftUI interface. Designed specifically for Apple Silicon, it delivers high-speed concurrent transfers, drag-and-drop queue control, automated file organization, and Keychain-secured authentication—all in a lightweight native package.
+<div align="center">
+  <img src="Screenshots/Dark%20theme%20-%20main.png" width="24%" alt="Firelink dark theme main window" />
+  <img src="Screenshots/Dark%20theme%20-%20add%20window.png" width="24%" alt="Firelink dark theme add window" />
+  <img src="Screenshots/Light%20theme%20-%20main.png" width="24%" alt="Firelink light theme main window" />
+  <img src="Screenshots/Light%20theme%20-%20add%20window.png" width="24%" alt="Firelink light theme add window" />
 
----
+  <details>
+    <summary><b>View more screenshots</b></summary>
+    <br/>
+    <img src="Screenshots/Dark%20theme%20-%20settings.png" width="32%" alt="Firelink dark theme settings" />
+    <img src="Screenshots/Light%20theme%20-%20settings.png" width="32%" alt="Firelink light theme settings" />
+  </details>
+</div>
 
-## ✨ Key Features
+## Why Firelink
 
-- ⚡ **High-Speed Downloads:** Multi-segmented download engine powered by `aria2c` for concurrent connections and optimal bandwidth utilization. Supports HTTP, HTTPS, FTP, and SFTP.
-- 🎨 **Native macOS & SwiftUI:** Responsive interface designed natively for Apple Silicon, featuring resizable tables, customizable columns, sidebar filters, and a native Settings panel.
-- 🗂️ **Smart Queue & Categories:** Drag-and-drop priority ordering, batch link ingestion with smart parsing, and automatic file organization (`Musics`, `Movies`, `Compressed`, `Pictures`, `Documents`, `Other`) based on extension detection.
-- 🔒 **Keychain Security:** Local macOS Keychain integration for secure site credential storage and matching during transfers.
-- ⚙️ **Power & System Integrity:** Optional system sleep prevention during active downloads, disk-space safety checks, and automated cleanup of partial `.aria2` metadata cache files.
+Firelink is built for people who want a real desktop download manager again: fast segmented transfers, browser capture, media extraction, scheduling, recovery, and clear control over where files land. Version 1.0.0 completes the move from the earlier macOS-only Swift app to a modern Rust/Tauri application with a React and TypeScript interface.
 
-<details>
-<summary>🔍 View Full Feature Index (30+ features)</summary>
+The app keeps the heavy work native. Downloads are coordinated by a Rust backend, accelerated with aria2, enriched with yt-dlp and FFmpeg for media workflows, and persisted locally with SQLite so queues survive restarts and app updates.
 
-### All native SwiftUI macOS features:
+## Features
 
-- **Core Download Engine:**
-  - Segmented downloads with per-file connection/split counts.
-  - Multi-threaded, parallel downloading with configurable limits.
-  - Support for HTTP, HTTPS, FTP, and SFTP transfers via `aria2c`.
-- **Advanced Queue Control:**
-  - Drag-and-drop download reordering to manage priorities.
-  - Comprehensive download table with resizable, custom columns (Name, Size, Status, ETA, Dates).
-  - Individual download controls: pause, resume, stop, and queue actions.
-- **Smart Link Ingestion:**
-  - Batch Add window for pasting multiple links at once.
-  - Automated link parsing (whitespaces, newlines, standard separators).
-  - Disk space availability checks and total size calculation prior to adding.
-- **File Organization:**
-  - Automatic categorization of files (Music, Movies, Compressed, Documents, Images) into structured subfolders under `~/Downloads`.
-  - Smart fallback to customizable download folders per category.
-  - Automatic cleanup of unfinished `.aria2` metadata/cache files on removal.
-- **Security & System:**
-  - Local macOS Keychain integration for site logins.
-  - Prevents system sleep while active transfers are in progress, preserving display sleep.
-  - Release `.app` bundle build scripts ready for distribution.
+- **Fast segmented downloads** powered by aria2 with configurable connections, retries, and speed limits.
+- **Media extraction** with yt-dlp, FFmpeg, and Deno for video/audio links and richer format selection.
+- **A real Add window** for manual, extension-captured, and media downloads, including metadata, duplicate handling, and save-location choices before downloads start.
+- **Persistent queue management** with safe concurrency limits, pause/resume, retry, redownload, sorting, multi-select, and bulk controls.
+- **Download scheduling** with start/stop windows, speed-limiter tools, and optional post-queue actions.
+- **Smart organization** through categories, default folders, per-download overrides, and open/reveal/trash actions.
+- **Private browser handoff** through authenticated local pairing with replay protection and desktop-server proof checks.
+- **Native desktop integration** including tray controls, notifications, completion sounds, sleep prevention, and OS keychain support where available.
+- **Diagnostics built in** with engine health checks, structured logs, and packaged-engine verification.
 
-</details>
+## Installation
 
----
+Download the latest desktop build from [GitHub Releases](https://github.com/nimbold/Firelink/releases).
 
-## ⚙️ Engine Architecture
+| Platform | Package | Notes |
+| --- | --- | --- |
+| **macOS Apple silicon** | `.dmg` | Unsigned and not notarized. Open through Finder or approve once in **System Settings -> Privacy & Security**. |
+| **Windows x64** | NSIS `.exe` installer | Unsigned. Windows SmartScreen may warn until code signing is added. |
+| **Linux x64** | `.AppImage` | Make executable before launching if your desktop environment does not do that automatically. |
 
-Firelink leverages `aria2c` under the hood as its core download engine. Unlike standard `curl`, `aria2c` allows:
-- **Segmented Downloads:** Splits files into multiple streams for maximum transfer speeds.
-- **Unified Connection Control:** A single slider regulates both the server connection count and segment split count, matching the intuitive behavior of classic managers like IDM/FDM.
-- **Built-in Resumability:** Seamlessly resumes interrupted or paused downloads without data corruption.
+Production bundles include the required media engines for the target platform. Users do not need to install aria2, yt-dlp, FFmpeg, Deno, Python, Homebrew, or a package manager for normal app usage.
 
----
+## Browser Extension
 
-## 🛠️ Requirements & Setup
+<div align="center">
+  <a href="https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/"><img src="https://img.shields.io/badge/Install%20Firelink%20Companion-Firefox-FF7139?style=for-the-badge&logo=firefox-browser&logoColor=white" alt="Install Firelink Companion on Firefox" /></a>
+</div>
 
-### 1. Install Dependencies
-Ensure you have **Homebrew** and the **Swift toolchain** installed:
-```bash
-brew install aria2
-```
-- **OS Support:** macOS 14.0 or newer (built natively for Apple Silicon)
-- **Toolchain:** Xcode 15+ / Swift 6.0 toolchain
+Firelink Companion connects your browser to the desktop app so links and browser downloads can open in Firelink instead of disappearing into the browser's default download shelf.
 
-### 2. Build & Run
-Run the application directly via the terminal:
-```bash
-swift run Firelink
+What it adds:
+
+- **Automatic capture** for normal browser downloads, while still routing every captured link through Firelink's Add window.
+- **Context-menu actions** for "Download with Firelink" and selected links.
+- **Signed local requests** using the pairing token from **Settings -> Integrations**.
+- **Server identity checks** so the extension only trusts the real local Firelink app.
+- **Offline-safe behavior** that resumes browser downloads when Firelink is closed or rejects a handoff.
+- **Protocol-aware compatibility** so older desktop builds are rejected before automatic capture can cancel a browser download.
+
+Install the extension, open Firelink, then pair it from **Settings -> Integrations**. The Firefox add-on is maintained in the [Firelink-Extension](https://github.com/nimbold/Firelink-Extension) repository and is also vendored here as the `Extensions/Firefox` submodule.
+
+## Platforms
+
+| Target | Status |
+| --- | --- |
+| **macOS arm64** | Supported. Automated native build, engine validation, packaged launch smoke test, and unsigned DMG packaging. |
+| **Windows x64** | Supported. Native GitHub Actions build, engine validation, silent installer smoke test, and NSIS packaging. |
+| **Linux x64** | Supported. Native GitHub Actions build, engine validation, AppImage repackaging, and xvfb launch smoke test. |
+
+## Development
+
+### Requirements
+
+- Node.js 22 or newer
+- npm
+- Rust and Cargo
+- [Tauri 2 platform prerequisites](https://v2.tauri.app/start/prerequisites/)
+
+Clone the repository with its browser-extension submodule:
+
+```sh
+git clone --recurse-submodules https://github.com/nimbold/Firelink.git
+cd Firelink
 ```
 
-Or build a production `.app` bundle:
-```bash
-make app && open build/Firelink.app
+Install dependencies and launch the desktop app:
+
+```sh
+npm install
+npm run tauri dev
 ```
 
-Create a local Apple Silicon DMG:
-```bash
-make dmg
+Run the core checks:
+
+```sh
+node --test scripts/*.node-test.js
+npm test -- --run
+npm run build
+cd src-tauri
+cargo test --all-targets
 ```
 
-### Release
-GitHub Actions builds and publishes the macOS ARM64 DMG when a version tag is pushed:
-```bash
-git tag v0.1.0
-git push origin v0.1.0
+Create a production bundle:
+
+```sh
+npm run tauri build
 ```
 
----
+macOS development uses locked payloads in `src-tauri/binaries`. Windows and Linux payloads are provisioned from checksum-pinned archives:
 
-## 🗺️ Roadmap
+```sh
+node scripts/provision-engines.js --target x86_64-pc-windows-msvc
+node scripts/provision-engines.js --target x86_64-unknown-linux-gnu
+```
 
-- [ ] **Data Persistence:** Store history, column layout preferences, and active queues across restarts.
-- [ ] **Zero-Config Setup:** Automatically bundle and configure `aria2c` inside the `.app` bundle.
-- [ ] **Bandwidth Limits:** Add global and per-download speed caps and calendar schedules.
-- [ ] **Browser Extensions:** Capture links directly from Safari, Chrome, and Firefox.
-- [ ] **Advanced Transfer Features:** Checksum validation, cookie/header ingestion, and smart mirror failovers.
-- [ ] **Distribution:** Notarized release builds, automated Sparkle updates, and Homebrew formulae.
+Build staging includes only the current target. See `engines.lock.json`, `engine-sources.lock.json`, and [RELEASE.md](RELEASE.md).
 
----
+## Repository Structure
 
-## 📄 License
+```text
+.
+├── src/                  React and TypeScript interface
+├── src-tauri/            Rust backend, Tauri config, and native tests
+├── scripts/              Engine provisioning, release, and smoke-test tooling
+└── Extensions/Firefox/   Firelink Companion submodule
+```
 
-Firelink is released under the MIT License. See [LICENSE](LICENSE) for details.
+## Help and Project Status
+
+- Report bugs or request improvements in [GitHub Issues](https://github.com/nimbold/Firelink/issues).
+- Read [CHANGELOG.md](CHANGELOG.md) for release history.
+- Review [RELEASE.md](RELEASE.md) for packaging policy and release verification.
+
+## Technology & Credits
+
+Firelink is made possible by these open-source projects:
+
+- **[Tauri 2](https://tauri.app/)** for the lightweight desktop runtime
+- **[Rust](https://www.rust-lang.org/)** and **[Tokio](https://tokio.rs/)** for native application logic
+- **[React](https://react.dev/)** and **[TypeScript](https://www.typescriptlang.org/)** for the interface
+- **[Zustand](https://zustand-demo.pmnd.rs/)** for frontend state management
+- **[SQLite](https://www.sqlite.org/)** for persistent local data
+- **[aria2](https://aria2.github.io/)** for segmented downloading
+- **[yt-dlp](https://github.com/yt-dlp/yt-dlp)**, **[FFmpeg](https://ffmpeg.org/)**, and **[Deno](https://deno.com/)** for media extraction and processing
+
+## License
+
+Firelink is available under the [MIT License](LICENSE).

RELEASE.md

@@ -0,0 +1,75 @@
+# Firelink Release Process
+
+Targets:
+
+- macOS arm64 DMG
+- Windows x64 NSIS installer
+- Linux x64 AppImage
+
+## Distribution policy
+
+Firelink does not use an Apple Developer account. macOS releases are unsigned and not notarized. Users must explicitly approve the downloaded app through Finder or macOS Privacy & Security. Release copy must never describe these builds as signed, notarized, or Gatekeeper-approved.
+
+Windows releases are currently unsigned. SmartScreen may warn until code signing is added.
+
+## Engine supply chain
+
+Firelink never falls back to system-installed media tools.
+
+- `engines.lock.json` pins current committed macOS payload hashes.
+- `engine-sources.lock.json` pins Windows/Linux source archives and checksums.
+- `scripts/provision-engines.js` downloads and verifies target archives.
+- `scripts/stage-engines.js` creates one target-specific bundle payload.
+- `scripts/verify-binaries.js` runs architecture, packaging, version, and RPC checks.
+
+yt-dlp must remain its official PyInstaller **onedir** distribution: launcher plus adjacent `_internal` runtime. Onefile builds are rejected because repeated extraction caused roughly 17-second startup latency.
+
+## Version update
+
+Keep versions aligned:
+
+- `package.json`
+- `src-tauri/Cargo.toml`
+- `src-tauri/tauri.conf.json`
+
+## Local macOS build
+
+```bash
+npm ci
+node scripts/stage-engines.js --target aarch64-apple-darwin
+node scripts/verify-binaries.js --staged --target aarch64-apple-darwin
+npm test -- --run
+npm run build
+cd src-tauri && cargo test --all-targets
+cd ..
+npm run tauri build -- --target aarch64-apple-darwin --bundles dmg
+```
+
+Verify packaged resources, then launch outside repository working directory:
+
+```bash
+APP="src-tauri/target/aarch64-apple-darwin/release/bundle/macos/Firelink.app"
+node scripts/verify-binaries.js --search-root "$APP" --target aarch64-apple-darwin
+node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
+```
+
+GitHub release publication is intentionally manual. Tag pushes build and upload
+artifacts, but the `publish` job only runs from a `workflow_dispatch` on a `v*`
+tag when both release-certification inputs are checked after Windows, Linux,
+and macOS clean-machine QA.
+
+## Automated release builds
+
+Push a version tag to build and verify native artifacts:
+
+```bash
+git tag v<version>
+git push origin v<version>
+```
+
+GitHub Actions builds all targets on native runners, verifies engines inside
+final package contents, performs packaged launch smoke where supported, and
+uploads artifacts. Publish the GitHub Release with a manual `workflow_dispatch`
+run on the same tag after clean-machine QA is complete.
+
+No target may silently skip missing engines, failed extraction, checksum mismatch, or missing package output.

Scripts/create_app_bundle.sh

@@ -1,52 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-APP_NAME="Firelink"
-CONFIGURATION="${CONFIGURATION:-release}"
-MARKETING_VERSION="${MARKETING_VERSION:-0.1.0}"
-BUILD_NUMBER="${BUILD_NUMBER:-1}"
-APP_DIR="$ROOT_DIR/build/$APP_NAME.app"
-CONTENTS_DIR="$APP_DIR/Contents"
-MACOS_DIR="$CONTENTS_DIR/MacOS"
-RESOURCES_DIR="$CONTENTS_DIR/Resources"
-
-cd "$ROOT_DIR"
-swift build -c "$CONFIGURATION"
-
-rm -rf "$APP_DIR"
-mkdir -p "$MACOS_DIR" "$RESOURCES_DIR"
-cp ".build/$CONFIGURATION/$APP_NAME" "$MACOS_DIR/$APP_NAME"
-
-cat > "$CONTENTS_DIR/Info.plist" <<PLIST
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>$APP_NAME</string>
-  <key>CFBundleIdentifier</key>
-  <string>local.firelink.swiftui</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>$APP_NAME</string>
-  <key>CFBundlePackageType</key>
-  <string>APPL</string>
-  <key>CFBundleShortVersionString</key>
-  <string>$MARKETING_VERSION</string>
-  <key>CFBundleVersion</key>
-  <string>$BUILD_NUMBER</string>
-  <key>LSMinimumSystemVersion</key>
-  <string>14.0</string>
-  <key>LSApplicationCategoryType</key>
-  <string>public.app-category.utilities</string>
-  <key>NSHighResolutionCapable</key>
-  <true/>
-</dict>
-</plist>
-PLIST
-
-echo "Created $APP_DIR"

Scripts/create_dmg.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-APP_NAME="Firelink"
-VERSION="${VERSION:-0.1.0}"
-ARCH="${ARCH:-arm64}"
-APP_DIR="$ROOT_DIR/build/$APP_NAME.app"
-DIST_DIR="$ROOT_DIR/dist"
-DMG_STAGING_DIR="$ROOT_DIR/build/dmg"
-DMG_PATH="$DIST_DIR/$APP_NAME-$VERSION-mac-$ARCH.dmg"
-
-if [[ ! -d "$APP_DIR" ]]; then
-  echo "Missing app bundle: $APP_DIR" >&2
-  echo "Run Scripts/create_app_bundle.sh first." >&2
-  exit 1
-fi
-
-rm -rf "$DMG_STAGING_DIR"
-mkdir -p "$DMG_STAGING_DIR" "$DIST_DIR"
-cp -R "$APP_DIR" "$DMG_STAGING_DIR/"
-ln -s /Applications "$DMG_STAGING_DIR/Applications"
-
-rm -f "$DMG_PATH"
-hdiutil create \
-  -volname "$APP_NAME $VERSION" \
-  -srcfolder "$DMG_STAGING_DIR" \
-  -ov \
-  -format UDZO \
-  "$DMG_PATH"
-
-echo "Created $DMG_PATH"

Sources/Firelink/AddDownloadsView.swift

@@ -1,406 +0,0 @@
-import SwiftUI
-
-struct AddDownloadsView: View {
-    @EnvironmentObject private var controller: DownloadController
-    @EnvironmentObject private var settings: AppSettings
-    @Environment(\.dismiss) private var dismiss
-
-    @State private var linkText = ""
-    @State private var pendingDownloads: [PendingDownload] = []
-    @State private var connectionsPerServer = 16.0
-    @State private var overrideDestination = false
-    @State private var destinationPath = ""
-    @State private var metadataTask: Task<Void, Never>?
-
-    var body: some View {
-        VStack(spacing: 0) {
-            ScrollView {
-                VStack(alignment: .leading, spacing: 18) {
-                    linkSection
-                    optionsSection
-                    summarySection
-                    previewSection
-                }
-                .padding(20)
-            }
-
-            Divider()
-            actionBar
-        }
-        .frame(minWidth: 820, idealWidth: 900, minHeight: 680, idealHeight: 740)
-        .onChange(of: linkText) { _, newValue in
-            scheduleMetadataRefresh(for: newValue)
-        }
-        .onAppear {
-            connectionsPerServer = Double(settings.perServerConnections)
-            if let text = controller.pendingPasteboardText {
-                linkText = text
-                controller.pendingPasteboardText = nil
-            }
-        }
-        .onDisappear {
-            metadataTask?.cancel()
-        }
-    }
-
-    private var linkSection: some View {
-        VStack(alignment: .leading, spacing: 8) {
-            Label("Download Links", systemImage: "link")
-                .font(.headline)
-
-            TextEditor(text: $linkText)
-                .font(.system(.body, design: .monospaced))
-                .scrollContentBackground(.hidden)
-                .background(.quaternary.opacity(0.35))
-                .clipShape(RoundedRectangle(cornerRadius: 8))
-                .frame(minHeight: 140)
-
-            HStack {
-                Text("\(pendingDownloads.count) valid link\(pendingDownloads.count == 1 ? "" : "s") detected")
-                    .foregroundStyle(.secondary)
-                Spacer()
-                Button {
-                    refreshMetadata(for: linkText)
-                } label: {
-                    Label("Refresh Metadata", systemImage: "arrow.clockwise")
-                }
-                .disabled(DownloadURLParser.parse(linkText).isEmpty)
-            }
-            .font(.caption)
-        }
-    }
-
-    private var optionsSection: some View {
-        Grid(alignment: .leading, horizontalSpacing: 14, verticalSpacing: 12) {
-            GridRow {
-                Label("Save Location", systemImage: "folder")
-                    .font(.headline)
-                Toggle("Use one folder for all files", isOn: $overrideDestination)
-            }
-
-            GridRow {
-                Text("")
-                HStack(spacing: 10) {
-                    TextField("Automatic by file type", text: $destinationPath)
-                        .textFieldStyle(.roundedBorder)
-                        .font(.system(.body, design: .monospaced))
-                        .disabled(!overrideDestination)
-
-                    Button {
-                        selectDestination()
-                    } label: {
-                        Label("Select", systemImage: "folder.badge.plus")
-                    }
-                    .disabled(!overrideDestination)
-                }
-            }
-
-            GridRow {
-                Label("Connections per File", systemImage: "point.3.connected.trianglepath.dotted")
-                    .font(.headline)
-                VStack(alignment: .leading, spacing: 4) {
-                    HStack {
-                        Slider(value: $connectionsPerServer, in: 1...16, step: 1)
-                            .frame(width: 220)
-                        Text("\(Int(connectionsPerServer)) segments")
-                            .monospacedDigit()
-                            .frame(width: 130, alignment: .leading)
-                    }
-                    Text("Firelink splits each file into this many parallel segments.")
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                }
-            }
-        }
-    }
-
-    private var summarySection: some View {
-        Grid(alignment: .leading, horizontalSpacing: 12, verticalSpacing: 10) {
-            GridRow {
-                SummaryTile(title: "Files", value: "\(pendingDownloads.count)", symbolName: "doc.on.doc")
-                SummaryTile(title: "Required", value: requiredSpaceText, symbolName: "externaldrive")
-                SummaryTile(title: "Free", value: freeSpaceText, symbolName: "internaldrive")
-                SummaryTile(title: "Unknown Sizes", value: "\(unknownSizeCount)", symbolName: "questionmark.circle")
-            }
-        }
-    }
-
-    private var previewSection: some View {
-        VStack(alignment: .leading, spacing: 8) {
-            Label("Preview", systemImage: "list.bullet.rectangle")
-                .font(.headline)
-
-            Table(pendingDownloads) {
-                TableColumn("File") { item in
-                    HStack {
-                        Image(systemName: item.category.symbolName)
-                            .foregroundStyle(categoryColor(item.category))
-                        VStack(alignment: .leading, spacing: 2) {
-                            Text(item.fileName)
-                                .lineLimit(1)
-                            Text(item.url.absoluteString)
-                                .font(.caption)
-                                .foregroundStyle(.secondary)
-                                .lineLimit(1)
-                        }
-                    }
-                }
-
-                TableColumn("Size") { item in
-                    Text(ByteFormatter.string(item.sizeBytes))
-                        .monospacedDigit()
-                }
-                .width(95)
-
-                TableColumn("Save To") { item in
-                    Text(destinationDirectory(for: item).path)
-                        .font(.system(.caption, design: .monospaced))
-                        .foregroundStyle(.secondary)
-                        .lineLimit(1)
-                }
-
-                TableColumn("Status") { item in
-                    MetadataStatusView(state: item.state)
-                }
-                .width(130)
-            }
-            .frame(minHeight: 230)
-        }
-    }
-
-    private var actionBar: some View {
-        HStack {
-            Text(actionMessage)
-                .font(.caption)
-                .foregroundStyle(.secondary)
-                .lineLimit(1)
-            Spacer()
-            Button("Cancel") {
-                dismiss()
-            }
-            Button {
-                addDownloads(start: false)
-            } label: {
-                Label("Add to Queue", systemImage: "list.bullet")
-            }
-            .disabled(pendingDownloads.isEmpty)
-
-            Button {
-                addDownloads(start: true)
-            } label: {
-                Label("Start Downloads", systemImage: "play.fill")
-            }
-            .buttonStyle(.borderedProminent)
-            .disabled(pendingDownloads.isEmpty)
-        }
-        .padding(14)
-        .background(.bar)
-    }
-
-    private var requiredSpaceText: String {
-        let knownBytes = pendingDownloads.compactMap(\.sizeBytes).reduce(Int64(0), +)
-        guard knownBytes > 0 else { return "Unknown" }
-        return ByteFormatter.string(knownBytes)
-    }
-
-    private var unknownSizeCount: Int {
-        pendingDownloads.filter { $0.sizeBytes == nil }.count
-    }
-
-    private var freeSpaceText: String {
-        guard let bytes = availableCapacity() else { return "Unknown" }
-        return ByteFormatter.string(bytes)
-    }
-
-    private var actionMessage: String {
-        if pendingDownloads.isEmpty {
-            return "Paste one or more HTTP, HTTPS, FTP, or SFTP links."
-        }
-
-        if unknownSizeCount > 0 {
-            return "Some servers did not report file size before download."
-        }
-
-        return "Ready to add \(pendingDownloads.count) download\(pendingDownloads.count == 1 ? "" : "s")."
-    }
-
-    private func scheduleMetadataRefresh(for text: String) {
-        metadataTask?.cancel()
-        metadataTask = Task {
-            try? await Task.sleep(for: .milliseconds(350))
-            guard !Task.isCancelled else { return }
-            await MainActor.run {
-                refreshMetadata(for: text)
-            }
-        }
-    }
-
-    private func refreshMetadata(for text: String) {
-        let urls = DownloadURLParser.parse(text)
-        metadataTask?.cancel()
-
-        pendingDownloads = urls.map { url in
-            let fileName = FileClassifier.fileName(from: url)
-            let category = FileClassifier.category(forFileName: fileName)
-            return PendingDownload(
-                url: url,
-                fileName: fileName,
-                category: category,
-                defaultDirectory: settings.destinationDirectory(for: category),
-                state: .loading
-            )
-        }
-
-        metadataTask = Task {
-            var loaded: [PendingDownload] = []
-            for url in urls {
-                guard !Task.isCancelled else { return }
-                let item = await DownloadMetadataFetcher.fetch(for: url, settings: settings)
-                loaded.append(item)
-                await MainActor.run {
-                    for loadedItem in loaded {
-                        if let index = pendingDownloads.firstIndex(where: { $0.url == loadedItem.url }) {
-                            pendingDownloads[index] = loadedItem
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    private func selectDestination() {
-        let panel = NSOpenPanel()
-        panel.canChooseFiles = false
-        panel.canChooseDirectories = true
-        panel.allowsMultipleSelection = false
-        panel.canCreateDirectories = true
-
-        if let currentURL = overrideDirectory {
-            panel.directoryURL = currentURL
-        }
-
-        if panel.runModal() == .OK, let url = panel.url {
-            destinationPath = url.path
-            overrideDestination = true
-        }
-    }
-
-    private func addDownloads(start: Bool) {
-        controller.addPendingDownloads(
-            pendingDownloads,
-            connectionsPerServer: Int(connectionsPerServer),
-            overrideDirectory: overrideDirectory,
-            startImmediately: start
-        )
-        dismiss()
-    }
-
-    private var overrideDirectory: URL? {
-        guard overrideDestination else { return nil }
-        let trimmed = destinationPath.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else { return nil }
-        return URL(fileURLWithPath: NSString(string: trimmed).expandingTildeInPath, isDirectory: true)
-    }
-
-    private func destinationDirectory(for item: PendingDownload) -> URL {
-        overrideDirectory ?? item.defaultDirectory
-    }
-
-    private func availableCapacity() -> Int64? {
-        let urls = pendingDownloads.isEmpty
-            ? [settings.destinationDirectory(for: .other)]
-            : pendingDownloads.map { destinationDirectory(for: $0) }
-
-        return urls.compactMap { url in
-            let values = try? existingVolumeURL(for: url).resourceValues(forKeys: [
-                .volumeAvailableCapacityForImportantUsageKey,
-                .volumeAvailableCapacityKey
-            ])
-            if let important = values?.volumeAvailableCapacityForImportantUsage {
-                return important
-            }
-            if let available = values?.volumeAvailableCapacity {
-                return Int64(available)
-            }
-            return nil
-        }
-        .min()
-    }
-
-    private func existingVolumeURL(for url: URL) -> URL {
-        var candidate = url
-        while !FileManager.default.fileExists(atPath: candidate.path) {
-            let parent = candidate.deletingLastPathComponent()
-            if parent.path == candidate.path {
-                return URL(fileURLWithPath: NSHomeDirectory())
-            }
-            candidate = parent
-        }
-        return candidate
-    }
-
-    private func categoryColor(_ category: DownloadCategory) -> Color {
-        switch category {
-        case .musics: .pink
-        case .movies: .indigo
-        case .compressed: .orange
-        case .pictures: .teal
-        case .documents: .blue
-        case .other: .gray
-        }
-    }
-}
-
-private struct SummaryTile: View {
-    let title: String
-    let value: String
-    let symbolName: String
-
-    var body: some View {
-        HStack(spacing: 10) {
-            Image(systemName: symbolName)
-                .font(.title3)
-                .foregroundStyle(.secondary)
-                .frame(width: 24)
-            VStack(alignment: .leading, spacing: 2) {
-                Text(title)
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-                Text(value)
-                    .font(.headline.monospacedDigit())
-                    .lineLimit(1)
-            }
-            Spacer(minLength: 0)
-        }
-        .padding(12)
-        .frame(width: 190)
-        .frame(minHeight: 64)
-        .background(.quaternary.opacity(0.35))
-        .clipShape(RoundedRectangle(cornerRadius: 8))
-    }
-}
-
-private struct MetadataStatusView: View {
-    let state: PendingDownload.MetadataState
-
-    var body: some View {
-        switch state {
-        case .pending:
-            Label("Pending", systemImage: "clock")
-                .foregroundStyle(.secondary)
-        case .loading:
-            HStack {
-                ProgressView()
-                    .controlSize(.small)
-                Text("Checking")
-            }
-            .foregroundStyle(.secondary)
-        case .loaded:
-            Label("Ready", systemImage: "checkmark.circle")
-                .foregroundStyle(.green)
-        case .failed:
-            Label("Unknown", systemImage: "exclamationmark.circle")
-                .foregroundStyle(.orange)
-        }
-    }
-}

Sources/Firelink/AppSettings.swift

@@ -1,193 +0,0 @@
-import Foundation
-
-struct SiteLogin: Identifiable, Codable, Equatable, Sendable {
-    var id = UUID()
-    var urlPattern: String
-    var username: String
-}
-
-@MainActor
-final class AppSettings: ObservableObject {
-    @Published var perServerConnections: Int {
-        didSet {
-            let clamped = min(max(perServerConnections, 1), 16)
-            if perServerConnections != clamped {
-                perServerConnections = clamped
-            }
-            save()
-        }
-    }
-
-    @Published var maxConcurrentDownloads: Int {
-        didSet {
-            let clamped = min(max(maxConcurrentDownloads, 1), 12)
-            if maxConcurrentDownloads != clamped {
-                maxConcurrentDownloads = clamped
-            }
-            save()
-        }
-    }
-
-    @Published var preventsSleepWhileDownloading: Bool {
-        didSet { save() }
-    }
-
-    @Published var downloadDirectories: [DownloadCategory: String] {
-        didSet { save() }
-    }
-
-    @Published var siteLogins: [SiteLogin] {
-        didSet { save() }
-    }
-
-    @Published var message = ""
-
-    private let defaults: UserDefaults
-    private let storageKey = "Firelink.AppSettings.v1"
-
-    init(defaults: UserDefaults = .standard) {
-        self.defaults = defaults
-
-        if let data = defaults.data(forKey: storageKey),
-           let stored = try? JSONDecoder().decode(StoredSettings.self, from: data) {
-            perServerConnections = min(max(stored.perServerConnections, 1), 16)
-            maxConcurrentDownloads = min(max(stored.maxConcurrentDownloads ?? 3, 1), 12)
-            preventsSleepWhileDownloading = stored.preventsSleepWhileDownloading
-            siteLogins = stored.siteLogins
-            downloadDirectories = Self.decodeDirectories(stored.downloadDirectories)
-        } else {
-            perServerConnections = 16
-            maxConcurrentDownloads = 3
-            preventsSleepWhileDownloading = true
-            siteLogins = []
-            downloadDirectories = Self.defaultDirectories()
-        }
-
-        for category in DownloadCategory.allCases where downloadDirectories[category] == nil {
-            downloadDirectories[category] = Self.defaultDirectory(for: category).path
-        }
-    }
-
-    func destinationDirectory(for category: DownloadCategory) -> URL {
-        let path = downloadDirectories[category] ?? Self.defaultDirectory(for: category).path
-        return URL(fileURLWithPath: NSString(string: path).expandingTildeInPath, isDirectory: true)
-    }
-
-    func setDirectory(_ path: String, for category: DownloadCategory) {
-        let trimmed = path.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else { return }
-        downloadDirectories[category] = NSString(string: trimmed).expandingTildeInPath
-    }
-
-    func resetDirectories() {
-        downloadDirectories = Self.defaultDirectories()
-    }
-
-    func addSiteLogin(urlPattern: String, username: String, password: String) {
-        let pattern = urlPattern.trimmingCharacters(in: .whitespacesAndNewlines)
-        let cleanUsername = username.trimmingCharacters(in: .whitespacesAndNewlines)
-
-        guard !pattern.isEmpty, !cleanUsername.isEmpty else {
-            message = "Add a URL pattern and username."
-            return
-        }
-
-        let login = SiteLogin(urlPattern: pattern, username: cleanUsername)
-        guard KeychainCredentialStore.setPassword(password, for: login.id) else {
-            message = "Could not save the password to Keychain."
-            return
-        }
-
-        siteLogins.append(login)
-        message = "Added login for \(pattern)."
-    }
-
-    func deleteSiteLogins(at offsets: IndexSet) {
-        for offset in offsets {
-            KeychainCredentialStore.deletePassword(for: siteLogins[offset].id)
-        }
-        siteLogins.remove(atOffsets: offsets)
-    }
-
-    func credentials(for url: URL) -> DownloadCredentials? {
-        guard let login = siteLogins.first(where: { Self.matches(url: url, pattern: $0.urlPattern) }),
-              let password = KeychainCredentialStore.password(for: login.id) else {
-            return nil
-        }
-
-        return DownloadCredentials(username: login.username, password: password)
-    }
-
-    func credentials(for login: SiteLogin) -> DownloadCredentials? {
-        guard let password = KeychainCredentialStore.password(for: login.id) else {
-            return nil
-        }
-
-        return DownloadCredentials(username: login.username, password: password)
-    }
-
-    private func save() {
-        let stored = StoredSettings(
-            perServerConnections: perServerConnections,
-            maxConcurrentDownloads: maxConcurrentDownloads,
-            preventsSleepWhileDownloading: preventsSleepWhileDownloading,
-            downloadDirectories: Dictionary(uniqueKeysWithValues: downloadDirectories.map { ($0.key.rawValue, $0.value) }),
-            siteLogins: siteLogins
-        )
-
-        if let data = try? JSONEncoder().encode(stored) {
-            defaults.set(data, forKey: storageKey)
-        }
-    }
-
-    private static func matches(url: URL, pattern rawPattern: String) -> Bool {
-        let pattern = rawPattern.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
-        guard !pattern.isEmpty else { return false }
-
-        let host = (url.host(percentEncoded: false) ?? "").lowercased()
-        let absolute = url.absoluteString.lowercased()
-        let normalizedPattern = URL(string: pattern)?.host ?? pattern
-
-        if normalizedPattern.hasPrefix("*.") {
-            let suffix = String(normalizedPattern.dropFirst(2))
-            return host == suffix || host.hasSuffix(".\(suffix)")
-        }
-
-        if normalizedPattern.contains("*") {
-            let escaped = NSRegularExpression.escapedPattern(for: normalizedPattern)
-                .replacingOccurrences(of: "\\*", with: ".*")
-            return host.range(of: "^\(escaped)$", options: .regularExpression) != nil
-        }
-
-        if normalizedPattern.contains("/") {
-            return absolute.contains(normalizedPattern)
-        }
-
-        return host == normalizedPattern || host.hasSuffix(".\(normalizedPattern)")
-    }
-
-    private static func defaultDirectories() -> [DownloadCategory: String] {
-        Dictionary(uniqueKeysWithValues: DownloadCategory.allCases.map { ($0, defaultDirectory(for: $0).path) })
-    }
-
-    private static func defaultDirectory(for category: DownloadCategory) -> URL {
-        let downloads = FileManager.default.urls(for: .downloadsDirectory, in: .userDomainMask).first
-            ?? URL(fileURLWithPath: NSHomeDirectory()).appendingPathComponent("Downloads")
-        return downloads.appendingPathComponent(category.rawValue, isDirectory: true)
-    }
-
-    private static func decodeDirectories(_ stored: [String: String]) -> [DownloadCategory: String] {
-        Dictionary(uniqueKeysWithValues: stored.compactMap { key, value in
-            guard let category = DownloadCategory(rawValue: key) else { return nil }
-            return (category, value)
-        })
-    }
-}
-
-private struct StoredSettings: Codable {
-    var perServerConnections: Int
-    var maxConcurrentDownloads: Int?
-    var preventsSleepWhileDownloading: Bool
-    var downloadDirectories: [String: String]
-    var siteLogins: [SiteLogin]
-}

Sources/Firelink/Aria2DownloadEngine.swift

@@ -1,241 +0,0 @@
-import Foundation
-
-final class Aria2DownloadEngine {
-    struct Handle {
-        let processIdentifier: Int32
-        let cancel: @Sendable () -> Void
-    }
-
-    enum EngineError: LocalizedError {
-        case executableNotFound
-        case launchFailed(String)
-
-        var errorDescription: String? {
-            switch self {
-            case .executableNotFound:
-                "aria2c was not found. Install it with `brew install aria2`, or bundle aria2c inside the app resources."
-            case .launchFailed(let details):
-                "Could not start aria2c: \(details)"
-            }
-        }
-    }
-
-    private let executableURL: URL?
-
-    init(executableURL: URL? = Aria2DownloadEngine.findExecutable()) {
-        self.executableURL = executableURL
-    }
-
-    static func findExecutable() -> URL? {
-        let candidates = [
-            "/opt/homebrew/bin/aria2c",
-            "/usr/local/bin/aria2c",
-            "/usr/bin/aria2c"
-        ]
-
-        if let found = candidates.first(where: { FileManager.default.isExecutableFile(atPath: $0) }) {
-            return URL(fileURLWithPath: found)
-        }
-
-        let path = ProcessInfo.processInfo.environment["PATH"] ?? ""
-        for folder in path.split(separator: ":") {
-            let candidate = URL(fileURLWithPath: String(folder)).appendingPathComponent("aria2c")
-            if FileManager.default.isExecutableFile(atPath: candidate.path) {
-                return candidate
-            }
-        }
-
-        if let bundled = Bundle.main.url(forResource: "aria2c", withExtension: nil),
-           FileManager.default.isExecutableFile(atPath: bundled.path) {
-            return bundled
-        }
-
-        return nil
-    }
-
-    func start(
-        item: DownloadItem,
-        progress: @escaping @Sendable (DownloadProgress) -> Void,
-        completion: @escaping @Sendable (Result<Void, Error>) -> Void
-    ) throws -> Handle {
-        guard let executableURL else {
-            throw EngineError.executableNotFound
-        }
-
-        try FileManager.default.createDirectory(
-            at: item.destinationDirectory,
-            withIntermediateDirectories: true
-        )
-
-        let process = Process()
-        process.executableURL = executableURL
-        process.arguments = arguments(for: item)
-
-        let inputPipe = Pipe()
-        let outputPipe = Pipe()
-        let errorPipe = Pipe()
-        process.standardInput = inputPipe
-        process.standardOutput = outputPipe
-        process.standardError = errorPipe
-
-        let parser = Aria2ProgressParser()
-        let outputBuffer = LockedDataBuffer()
-        let errorBuffer = LockedDataBuffer()
-
-        outputPipe.fileHandleForReading.readabilityHandler = { handle in
-            let data = handle.availableData
-            guard !data.isEmpty else { return }
-            outputBuffer.append(data)
-            if let text = String(data: data, encoding: .utf8) {
-                for update in parser.parse(text) {
-                    progress(update)
-                }
-            }
-        }
-
-        errorPipe.fileHandleForReading.readabilityHandler = { handle in
-            let data = handle.availableData
-            guard !data.isEmpty else { return }
-            errorBuffer.append(data)
-        }
-
-        process.terminationHandler = { finishedProcess in
-            outputPipe.fileHandleForReading.readabilityHandler = nil
-            errorPipe.fileHandleForReading.readabilityHandler = nil
-
-            if finishedProcess.terminationStatus == 0 {
-                completion(.success(()))
-                return
-            }
-
-            let stderr = String(data: errorBuffer.data, encoding: .utf8)?
-                .trimmingCharacters(in: .whitespacesAndNewlines)
-            let stdout = String(data: outputBuffer.data, encoding: .utf8)?
-                .trimmingCharacters(in: .whitespacesAndNewlines)
-            let message = [stderr, stdout]
-                .compactMap { $0 }
-                .filter { !$0.isEmpty }
-                .joined(separator: "\n")
-            completion(.failure(EngineError.launchFailed(message.isEmpty ? "exit code \(finishedProcess.terminationStatus)" : message)))
-        }
-
-        do {
-            try process.run()
-            if let input = inputFileContent(for: item).data(using: .utf8) {
-                inputPipe.fileHandleForWriting.write(input)
-            }
-            inputPipe.fileHandleForWriting.closeFile()
-        } catch {
-            throw EngineError.launchFailed(error.localizedDescription)
-        }
-
-        return Handle(processIdentifier: process.processIdentifier) {
-            if process.isRunning {
-                process.terminate()
-            }
-        }
-    }
-
-    private func arguments(for item: DownloadItem) -> [String] {
-        [
-            "--continue=true",
-            "--allow-overwrite=false",
-            "--auto-file-renaming=true",
-            "--summary-interval=1",
-            "--console-log-level=warn",
-            "--download-result=hide",
-            "--file-allocation=none",
-            "--min-split-size=1M",
-            "--input-file=-"
-        ]
-    }
-
-    private func inputFileContent(for item: DownloadItem) -> String {
-        let connections = min(max(item.connectionsPerServer, 1), 16)
-        var lines = [
-            sanitizedOptionValue(item.url.absoluteString),
-            "  dir=\(sanitizedOptionValue(item.destinationDirectory.path))",
-            "  out=\(sanitizedOptionValue(item.fileName))",
-            "  split=\(connections)",
-            "  max-connection-per-server=\(connections)"
-        ]
-
-        if let credentials = item.credentials, !credentials.isEmpty {
-            let scheme = item.url.scheme?.lowercased()
-            if scheme == "ftp" || scheme == "sftp" {
-                lines.append("  ftp-user=\(sanitizedOptionValue(credentials.username))")
-                lines.append("  ftp-passwd=\(sanitizedOptionValue(credentials.password))")
-            } else {
-                lines.append("  http-user=\(sanitizedOptionValue(credentials.username))")
-                lines.append("  http-passwd=\(sanitizedOptionValue(credentials.password))")
-                lines.append("  http-auth-challenge=true")
-            }
-        }
-
-        return lines.joined(separator: "\n") + "\n"
-    }
-
-    private func sanitizedOptionValue(_ value: String) -> String {
-        value.replacingOccurrences(of: "\r", with: "")
-            .replacingOccurrences(of: "\n", with: "")
-    }
-}
-
-final class LockedDataBuffer: @unchecked Sendable {
-    private let lock = NSLock()
-    private var storage = Data()
-
-    var data: Data {
-        lock.withLock { storage }
-    }
-
-    func append(_ data: Data) {
-        lock.withLock {
-            storage.append(data)
-        }
-    }
-}
-
-final class Aria2ProgressParser: @unchecked Sendable {
-    private let percentageRegex = try? NSRegularExpression(pattern: #"\((\d+(?:\.\d+)?)%\)"#)
-    private let connectionRegex = try? NSRegularExpression(pattern: #"CN:(\d+)"#)
-    private let speedRegex = try? NSRegularExpression(pattern: #"DL:([^\s\]]+)"#)
-    private let etaRegex = try? NSRegularExpression(pattern: #"ETA:([^\s\]]+)"#)
-    private let bytesRegex = try? NSRegularExpression(pattern: #"\s([0-9.]+(?:KiB|MiB|GiB|TiB|B)?/[0-9.]+(?:KiB|MiB|GiB|TiB|B)?)\("#)
-
-    func parse(_ text: String) -> [DownloadProgress] {
-        text
-            .split(whereSeparator: { $0 == "\n" || $0 == "\r" })
-            .compactMap { parseLine(String($0)) }
-    }
-
-    private func parseLine(_ line: String) -> DownloadProgress? {
-        guard line.contains("%") else { return nil }
-
-        let percentage = firstCapture(in: line, regex: percentageRegex).flatMap(Double.init) ?? 0
-        let connections = firstCapture(in: line, regex: connectionRegex).flatMap(Int.init) ?? 0
-        let speed = firstCapture(in: line, regex: speedRegex) ?? "-"
-        let eta = firstCapture(in: line, regex: etaRegex) ?? "-"
-        let bytes = firstCapture(in: line, regex: bytesRegex) ?? "-"
-
-        return DownloadProgress(
-            fraction: min(max(percentage / 100, 0), 1),
-            bytesText: bytes,
-            speedText: speed,
-            etaText: eta,
-            connectionCount: connections
-        )
-    }
-
-    private func firstCapture(in text: String, regex: NSRegularExpression?) -> String? {
-        guard let regex else { return nil }
-        let range = NSRange(text.startIndex..<text.endIndex, in: text)
-        guard let match = regex.firstMatch(in: text, range: range), match.numberOfRanges > 1 else {
-            return nil
-        }
-        guard let captureRange = Range(match.range(at: 1), in: text) else {
-            return nil
-        }
-        return String(text[captureRange])
-    }
-}

Sources/Firelink/ContentView.swift

@@ -1,153 +0,0 @@
-import AppKit
-import SwiftUI
-
-struct ContentView: View {
-    @EnvironmentObject private var controller: DownloadController
-    @Environment(\.openWindow) private var openWindow
-    @State private var selection: Set<DownloadItem.ID> = []
-    @State private var sidebarFilter: DownloadSidebarFilter = .all
-    @State private var showDeleteConfirmation = false
-
-    var body: some View {
-        NavigationSplitView {
-            SidebarView(selection: $sidebarFilter)
-                .navigationSplitViewColumnWidth(min: 190, ideal: 220, max: 260)
-        } detail: {
-            VStack(spacing: 0) {
-                DownloadTable(
-                    items: filteredDownloads,
-                    selection: $selection,
-                    title: sidebarFilter.title
-                )
-                Divider()
-                StatusBar()
-            }
-            .toolbar {
-                ToolbarItem(placement: .primaryAction) {
-                    Button {
-                        openWindow(id: "add-downloads")
-                    } label: {
-                        Label("Add", systemImage: "plus")
-                    }
-                }
-                
-                ToolbarItem {
-                    Button {
-                        controller.startQueue()
-                    } label: {
-                        Label("Start Queue", systemImage: "play.fill")
-                    }
-                }
-
-                ToolbarItemGroup {
-                    if !selectedItems.isEmpty {
-                        if selectedItems.contains(where: { $0.status == .downloading }) {
-                            Button {
-                                for item in selectedItems where item.status == .downloading {
-                                    controller.pause(item)
-                                }
-                            } label: {
-                                Label("Stop", systemImage: "stop.fill")
-                            }
-                        }
-
-                        if selectedItems.contains(where: { $0.status == .paused || $0.status == .failed || $0.status == .canceled }) {
-                            Button {
-                                for item in selectedItems where item.status == .paused || item.status == .failed || item.status == .canceled {
-                                    controller.resume(item)
-                                }
-                            } label: {
-                                Label("Start", systemImage: "play.fill")
-                            }
-                        }
-
-                        Button(role: .destructive) {
-                            showDeleteConfirmation = true
-                        } label: {
-                            Label("Delete", systemImage: "trash")
-                        }
-                    }
-                }
-
-                ToolbarItem {
-                    SettingsLink {
-                        Label("Settings", systemImage: "gearshape")
-                    }
-                }
-            }
-            .background {
-                Button("") {
-                    if !selection.isEmpty {
-                        showDeleteConfirmation = true
-                    }
-                }
-                .keyboardShortcut(.delete, modifiers: [])
-                .opacity(0)
-                
-                Button("") {
-                    handlePaste()
-                }
-                .keyboardShortcut("v", modifiers: .command)
-                .opacity(0)
-
-                Button("") {
-                    selectAll()
-                }
-                .keyboardShortcut("a", modifiers: .command)
-                .opacity(0)
-            }
-            .confirmationDialog(
-                "Delete \(selection.count) Download\(selection.count == 1 ? "" : "s")",
-                isPresented: $showDeleteConfirmation
-            ) {
-                Button("Remove from List") {
-                    deleteSelected(deleteFiles: false)
-                }
-                Button("Move Files and Cache to Trash", role: .destructive) {
-                    deleteSelected(deleteFiles: true)
-                }
-                Button("Cancel", role: .cancel) {}
-            } message: {
-                Text("Are you sure you want to delete the selected downloads?")
-            }
-        }
-    }
-
-    private var selectedItems: [DownloadItem] {
-        controller.downloads.filter { selection.contains($0.id) }
-    }
-
-    private func deleteSelected(deleteFiles: Bool) {
-        for item in selectedItems {
-            controller.delete(item, deleteFiles: deleteFiles)
-        }
-        selection.removeAll()
-    }
-    
-    private func handlePaste() {
-        guard let text = NSPasteboard.general.string(forType: .string), !text.isEmpty else { return }
-        controller.pendingPasteboardText = text
-        openWindow(id: "add-downloads")
-    }
-
-    private func selectAll() {
-        selection = Set(filteredDownloads.map { $0.id })
-    }
-
-    private var filteredDownloads: [DownloadItem] {
-        switch sidebarFilter {
-        case .all:
-            controller.downloads
-        case .queued:
-            controller.downloads.filter { $0.status == .queued }
-        case .active:
-            controller.downloads.filter { $0.status == .downloading }
-        case .completed:
-            controller.downloads.filter { $0.status == .completed }
-        case .failed:
-            controller.downloads.filter { $0.status == .failed }
-        case .category(let category):
-            controller.downloads.filter { $0.category == category }
-        }
-    }
-}

Sources/Firelink/DownloadController.swift

@@ -1,384 +0,0 @@
-import AppKit
-import Combine
-import Foundation
-
-@MainActor
-final class DownloadController: ObservableObject {
-    @Published var downloads: [DownloadItem] = []
-    @Published var engineMessage = ""
-    @Published var pendingPasteboardText: String?
-
-    private let settings: AppSettings
-    private let engine = Aria2DownloadEngine()
-    private var activeHandles: [UUID: Aria2DownloadEngine.Handle] = [:]
-    private var sleepActivity: SleepActivityHandle?
-    private var cancellables = Set<AnyCancellable>()
-    private lazy var storageURL: URL = {
-        let supportDir = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask).first ?? URL(fileURLWithPath: NSHomeDirectory())
-        return supportDir.appendingPathComponent("Firelink").appendingPathComponent("downloads.json")
-    }()
-
-    init(settings: AppSettings) {
-        self.settings = settings
-        
-        loadDownloads()
-        
-        settings.$preventsSleepWhileDownloading
-            .sink { [weak self] _ in
-                Task { @MainActor in
-                    self?.updateSleepActivity()
-                }
-            }
-            .store(in: &cancellables)
-            
-        $downloads
-            .dropFirst()
-            .debounce(for: .seconds(2.0), scheduler: RunLoop.main)
-            .sink { [weak self] _ in
-                self?.saveDownloads()
-            }
-            .store(in: &cancellables)
-            
-        NotificationCenter.default.publisher(for: NSApplication.willTerminateNotification)
-            .sink { [weak self] _ in
-                self?.saveDownloads()
-            }
-            .store(in: &cancellables)
-    }
-
-    deinit {
-        sleepActivity?.end()
-    }
-
-    var activeCount: Int {
-        downloads.filter { $0.status == .downloading }.count
-    }
-
-    var queuedCount: Int {
-        downloads.filter { $0.status == .queued }.count
-    }
-
-    var completedCount: Int {
-        downloads.filter { $0.status == .completed }.count
-    }
-
-    var failedCount: Int {
-        downloads.filter { $0.status == .failed }.count
-    }
-
-    var hasAria2: Bool {
-        Aria2DownloadEngine.findExecutable() != nil
-    }
-
-    func add(urlText: String, connectionsPerServer: Int? = nil) {
-        guard let url = URL(string: urlText.trimmingCharacters(in: .whitespacesAndNewlines)),
-              let scheme = url.scheme?.lowercased(),
-              ["http", "https", "ftp", "sftp"].contains(scheme) else {
-            engineMessage = "Enter a valid HTTP, HTTPS, FTP, or SFTP URL."
-            return
-        }
-
-        let fileName = FileClassifier.fileName(from: url)
-        let category = FileClassifier.category(forFileName: fileName)
-        let item = DownloadItem(
-            url: url,
-            fileName: fileName,
-            category: category,
-            destinationDirectory: settings.destinationDirectory(for: category),
-            connectionsPerServer: min(max(connectionsPerServer ?? settings.perServerConnections, 1), 16),
-            credentials: settings.credentials(for: url)
-        )
-
-        downloads.append(item)
-        engineMessage = "Added \(fileName) to \(category.rawValue)."
-    }
-
-    func addPendingDownloads(
-        _ pendingDownloads: [PendingDownload],
-        connectionsPerServer: Int,
-        overrideDirectory: URL?,
-        startImmediately: Bool
-    ) {
-        let clampedConnections = min(max(connectionsPerServer, 1), 16)
-
-        let items = pendingDownloads.map { pending in
-            DownloadItem(
-                url: pending.url,
-                fileName: pending.fileName,
-                category: pending.category,
-                destinationDirectory: overrideDirectory ?? pending.defaultDirectory,
-                connectionsPerServer: clampedConnections,
-                credentials: settings.credentials(for: pending.url),
-                sizeBytes: pending.sizeBytes,
-                bytesText: ByteFormatter.string(pending.sizeBytes),
-                message: startImmediately ? "Queued to start" : "Added to queue"
-            )
-        }
-
-        downloads.append(contentsOf: items)
-        engineMessage = "Added \(items.count) download\(items.count == 1 ? "" : "s")."
-
-        if startImmediately {
-            startQueue()
-        }
-    }
-
-    func startQueue() {
-        engineMessage = ""
-        pumpQueue()
-    }
-
-    func pause(_ item: DownloadItem) {
-        activeHandles[item.id]?.cancel()
-        activeHandles[item.id] = nil
-        update(item.id) {
-            $0.status = .paused
-            $0.message = "Paused. Resume will continue from the partial file."
-        }
-        updateSleepActivity()
-        pumpQueue()
-    }
-
-    func queue(_ item: DownloadItem) {
-        activeHandles[item.id]?.cancel()
-        activeHandles[item.id] = nil
-        update(item.id) {
-            $0.status = .queued
-            if item.status != .paused {
-                $0.progress = 0
-                $0.speedText = "-"
-                $0.etaText = "-"
-                $0.connectionCount = 0
-            }
-            $0.message = "Added to queue"
-        }
-        updateSleepActivity()
-    }
-
-    func resume(_ item: DownloadItem) {
-        update(item.id) {
-            $0.status = .queued
-            $0.message = ""
-        }
-        pumpQueue()
-    }
-
-    func cancel(_ item: DownloadItem) {
-        activeHandles[item.id]?.cancel()
-        activeHandles[item.id] = nil
-        update(item.id) {
-            $0.status = .canceled
-            $0.message = "Canceled"
-        }
-        updateSleepActivity()
-        pumpQueue()
-    }
-
-    func remove(at offsets: IndexSet, deleteFiles: Bool = false) {
-        for index in offsets {
-            let item = downloads[index]
-            delete(item, deleteFiles: deleteFiles)
-        }
-    }
-
-    func delete(_ item: DownloadItem, deleteFiles: Bool = false) {
-        activeHandles[item.id]?.cancel()
-        activeHandles[item.id] = nil
-        if deleteFiles {
-            trashFiles(for: item)
-        } else if item.status != .completed {
-            removeCacheFiles(for: item)
-        }
-        downloads.removeAll { $0.id == item.id }
-        updateSleepActivity()
-    }
-
-    func move(from source: IndexSet, to destination: Int) {
-        downloads.move(fromOffsets: source, toOffset: destination)
-    }
-
-    private func pumpQueue() {
-        guard hasAria2 else {
-            engineMessage = "aria2c is not installed. Run `brew install aria2` to enable downloads."
-            return
-        }
-
-        while activeCount < settings.maxConcurrentDownloads,
-              let next = downloads.first(where: { $0.status == .queued }) {
-            start(next)
-        }
-    }
-
-    private func start(_ item: DownloadItem) {
-        update(item.id) {
-            $0.status = .downloading
-            $0.lastTryAt = Date()
-            $0.message = "Starting"
-            $0.speedText = "-"
-            $0.etaText = "-"
-        }
-
-        do {
-            let handle = try engine.start(
-                item: item,
-                progress: { [weak self] progress in
-                    Task { @MainActor in
-                        self?.update(item.id) {
-                            $0.progress = progress.fraction
-                            $0.bytesText = progress.bytesText
-                            $0.speedText = progress.speedText
-                            $0.etaText = progress.etaText
-                            $0.connectionCount = progress.connectionCount
-                            $0.message = "Downloading"
-                        }
-                    }
-                },
-                completion: { [weak self] result in
-                    Task { @MainActor in
-                        guard let self else { return }
-                        self.activeHandles[item.id] = nil
-
-                        switch result {
-                        case .success:
-                            self.update(item.id) {
-                                $0.status = .completed
-                                $0.progress = 1
-                                $0.speedText = "-"
-                                $0.etaText = "-"
-                                $0.message = "Saved to \($0.destinationPath)"
-                            }
-                        case .failure(let error):
-                            if self.downloads.first(where: { $0.id == item.id })?.status == .paused ||
-                                self.downloads.first(where: { $0.id == item.id })?.status == .canceled {
-                                return
-                            }
-                            self.update(item.id) {
-                                $0.status = .failed
-                                $0.message = error.localizedDescription
-                            }
-                        }
-
-                        self.pumpQueue()
-                        self.updateSleepActivity()
-                    }
-                }
-            )
-            activeHandles[item.id] = handle
-            update(item.id) {
-                $0.message = "Process \(handle.processIdentifier)"
-            }
-            updateSleepActivity()
-        } catch {
-            update(item.id) {
-                $0.status = .failed
-                $0.message = error.localizedDescription
-            }
-            updateSleepActivity()
-            pumpQueue()
-        }
-    }
-
-    private func update(_ id: UUID, mutate: (inout DownloadItem) -> Void) {
-        guard let index = downloads.firstIndex(where: { $0.id == id }) else { return }
-        mutate(&downloads[index])
-    }
-
-    func updateDownload(
-        id: UUID,
-        url: URL,
-        fileName: String,
-        destinationDirectory: URL,
-        connectionsPerServer: Int,
-        credentials: DownloadCredentials?
-    ) {
-        update(id) {
-            $0.url = url
-            $0.fileName = fileName
-            $0.category = FileClassifier.category(forFileName: fileName)
-            $0.destinationDirectory = destinationDirectory
-            $0.connectionsPerServer = min(max(connectionsPerServer, 1), 16)
-            $0.credentials = credentials
-            $0.message = "Properties updated"
-        }
-    }
-
-    private func updateSleepActivity() {
-        let shouldPreventSleep = settings.preventsSleepWhileDownloading && activeCount > 0
-
-        if shouldPreventSleep, sleepActivity == nil {
-            sleepActivity = SleepActivityHandle(activity: ProcessInfo.processInfo.beginActivity(
-                options: [.idleSystemSleepDisabled],
-                reason: "Firelink is downloading files."
-            ))
-        } else if !shouldPreventSleep, let activity = sleepActivity {
-            activity.end()
-            sleepActivity = nil
-        }
-    }
-
-    private func removeCacheFiles(for item: DownloadItem) {
-        let fileURL = item.destinationDirectory.appendingPathComponent(item.fileName)
-        let candidates = [URL(fileURLWithPath: fileURL.path + ".aria2")]
-
-        for candidate in candidates where FileManager.default.fileExists(atPath: candidate.path) {
-            try? FileManager.default.removeItem(at: candidate)
-        }
-    }
-
-    private func trashFiles(for item: DownloadItem) {
-        let fileURL = item.destinationDirectory.appendingPathComponent(item.fileName)
-        let candidates = [
-            fileURL,
-            URL(fileURLWithPath: fileURL.path + ".aria2")
-        ]
-
-        for candidate in candidates where FileManager.default.fileExists(atPath: candidate.path) {
-            try? FileManager.default.trashItem(at: candidate, resultingItemURL: nil)
-        }
-    }
-
-    private func saveDownloads() {
-        do {
-            let directory = storageURL.deletingLastPathComponent()
-            try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true, attributes: nil)
-            let data = try JSONEncoder().encode(downloads)
-            try data.write(to: storageURL, options: .atomic)
-        } catch {
-            print("Failed to save downloads: \(error)")
-        }
-    }
-
-    private func loadDownloads() {
-        do {
-            guard FileManager.default.fileExists(atPath: storageURL.path) else { return }
-            let data = try Data(contentsOf: storageURL)
-            let loaded = try JSONDecoder().decode([DownloadItem].self, from: data)
-            
-            self.downloads = loaded.map { item in
-                var adjusted = item
-                if adjusted.status == .downloading {
-                    adjusted.status = .paused
-                    adjusted.message = "Paused on startup"
-                    adjusted.speedText = "-"
-                    adjusted.etaText = "-"
-                    adjusted.connectionCount = 0
-                }
-                return adjusted
-            }
-        } catch {
-            print("Failed to load downloads: \(error)")
-        }
-    }
-}
-
-private final class SleepActivityHandle: @unchecked Sendable {
-    private let activity: NSObjectProtocol
-
-    init(activity: NSObjectProtocol) {
-        self.activity = activity
-    }
-
-    func end() {
-        ProcessInfo.processInfo.endActivity(activity)
-    }
-}

Sources/Firelink/DownloadMetadataFetcher.swift

@@ -1,112 +0,0 @@
-import Foundation
-
-enum DownloadURLParser {
-    static func parse(_ text: String) -> [URL] {
-        let detector = try? NSDataDetector(types: NSTextCheckingResult.CheckingType.link.rawValue)
-        let range = NSRange(text.startIndex..<text.endIndex, in: text)
-        let detected = detector?.matches(in: text, range: range).compactMap(\.url) ?? []
-
-        let tokenized = text
-            .components(separatedBy: CharacterSet.whitespacesAndNewlines.union(CharacterSet(charactersIn: ",;")))
-            .compactMap { token -> URL? in
-                let trimmed = token.trimmingCharacters(in: CharacterSet(charactersIn: "\"'<>[]()"))
-                guard let url = URL(string: trimmed),
-                      let scheme = url.scheme?.lowercased(),
-                      ["http", "https", "ftp", "sftp"].contains(scheme) else {
-                    return nil
-                }
-                return url
-            }
-
-        var seen = Set<String>()
-        return (detected + tokenized).filter { url in
-            guard let scheme = url.scheme?.lowercased(),
-                  ["http", "https", "ftp", "sftp"].contains(scheme) else {
-                return false
-            }
-            return seen.insert(url.absoluteString).inserted
-        }
-    }
-}
-
-enum DownloadMetadataFetcher {
-    static func fetch(for url: URL, settings: AppSettings) async -> PendingDownload {
-        let initialName = FileClassifier.fileName(from: url)
-        let initialCategory = FileClassifier.category(forFileName: initialName)
-        let initialDirectory = await settings.destinationDirectory(for: initialCategory)
-        var pending = PendingDownload(
-            url: url,
-            fileName: initialName,
-            category: initialCategory,
-            defaultDirectory: initialDirectory,
-            state: .loading
-        )
-
-        guard url.scheme?.lowercased().hasPrefix("http") == true else {
-            pending.state = .loaded
-            return pending
-        }
-
-        var request = URLRequest(url: url)
-        request.httpMethod = "HEAD"
-        request.timeoutInterval = 12
-        request.setValue("Firelink/0.1", forHTTPHeaderField: "User-Agent")
-
-        do {
-            let (_, response) = try await URLSession.shared.data(for: request)
-            guard let httpResponse = response as? HTTPURLResponse else {
-                pending.state = .loaded
-                return pending
-            }
-
-            if let disposition = httpResponse.value(forHTTPHeaderField: "Content-Disposition"),
-               let fileName = fileName(fromContentDisposition: disposition) {
-                pending.fileName = fileName
-                pending.category = FileClassifier.category(forFileName: fileName)
-                pending.defaultDirectory = await settings.destinationDirectory(for: pending.category)
-            }
-
-            if let contentLength = httpResponse.value(forHTTPHeaderField: "Content-Length"),
-               let bytes = Int64(contentLength) {
-                pending.sizeBytes = bytes
-            } else if response.expectedContentLength > 0 {
-                pending.sizeBytes = response.expectedContentLength
-            }
-
-            pending.mimeType = httpResponse.mimeType
-            pending.state = .loaded
-        } catch {
-            pending.state = .failed(error.localizedDescription)
-        }
-
-        return pending
-    }
-
-    private static func fileName(fromContentDisposition header: String) -> String? {
-        let parts = header.components(separatedBy: ";")
-        for part in parts {
-            let trimmed = part.trimmingCharacters(in: .whitespacesAndNewlines)
-            if trimmed.lowercased().hasPrefix("filename*="),
-               let value = trimmed.components(separatedBy: "''").last?.removingPercentEncoding {
-                return value.trimmingCharacters(in: CharacterSet(charactersIn: "\""))
-            }
-
-            if trimmed.lowercased().hasPrefix("filename=") {
-                return String(trimmed.dropFirst("filename=".count))
-                    .trimmingCharacters(in: CharacterSet(charactersIn: "\""))
-            }
-        }
-        return nil
-    }
-}
-
-enum ByteFormatter {
-    static func string(_ bytes: Int64?) -> String {
-        guard let bytes else { return "Unknown" }
-        let formatter = ByteCountFormatter()
-        formatter.countStyle = .file
-        formatter.includesUnit = true
-        formatter.includesCount = true
-        return formatter.string(fromByteCount: bytes)
-    }
-}

Sources/Firelink/DownloadPropertiesView.swift

@@ -1,216 +0,0 @@
-import AppKit
-import SwiftUI
-
-struct DownloadPropertiesWindow: View {
-    @EnvironmentObject private var controller: DownloadController
-    let downloadID: UUID
-
-    var body: some View {
-        if let item = controller.downloads.first(where: { $0.id == downloadID }) {
-            DownloadPropertiesView(item: item)
-        } else {
-            ContentUnavailableView("Download Not Found", systemImage: "questionmark.circle")
-                .frame(width: 420, height: 240)
-        }
-    }
-}
-
-struct DownloadPropertiesView: View {
-    enum LoginMode: String, CaseIterable, Identifiable {
-        case matching = "Matching site login"
-        case custom = "Custom credentials"
-        case none = "No login"
-
-        var id: String { rawValue }
-    }
-
-    @EnvironmentObject private var controller: DownloadController
-    @EnvironmentObject private var settings: AppSettings
-    @Environment(\.dismiss) private var dismiss
-
-    let item: DownloadItem
-
-    @State private var urlText: String
-    @State private var fileName: String
-    @State private var destinationPath: String
-    @State private var connections: Int
-    @State private var loginMode: LoginMode
-    @State private var username: String
-    @State private var password: String
-    @State private var errorMessage = ""
-
-    init(item: DownloadItem) {
-        self.item = item
-        _urlText = State(initialValue: item.url.absoluteString)
-        _fileName = State(initialValue: item.fileName)
-        _destinationPath = State(initialValue: item.destinationDirectory.path)
-        _connections = State(initialValue: item.connectionsPerServer)
-        if let credentials = item.credentials {
-            _loginMode = State(initialValue: .custom)
-            _username = State(initialValue: credentials.username)
-            _password = State(initialValue: credentials.password)
-        } else {
-            _loginMode = State(initialValue: .matching)
-            _username = State(initialValue: "")
-            _password = State(initialValue: "")
-        }
-    }
-
-    var body: some View {
-        VStack(spacing: 0) {
-            Form {
-                Section("Download") {
-                    TextField("URL", text: $urlText)
-                        .font(.system(.body, design: .monospaced))
-                    TextField("File name", text: $fileName)
-                    HStack {
-                        TextField("Save location", text: $destinationPath)
-                            .font(.system(.body, design: .monospaced))
-                        Button {
-                            selectDestination()
-                        } label: {
-                            Label("Select", systemImage: "folder.badge.plus")
-                        }
-                    }
-                    Stepper("Connections per file: \(connections)", value: $connections, in: 1...16)
-                }
-
-                Section("Site Login") {
-                    Picker("Login", selection: $loginMode) {
-                        ForEach(LoginMode.allCases) { mode in
-                            Text(mode.rawValue).tag(mode)
-                        }
-                    }
-                    .pickerStyle(.segmented)
-
-                    if loginMode == .matching {
-                        Text(matchingLoginText)
-                            .font(.caption)
-                            .foregroundStyle(.secondary)
-                    } else if loginMode == .custom {
-                        TextField("Username", text: $username)
-                        SecureField("Password", text: $password)
-                    }
-                }
-
-                Section("Progress") {
-                    ProgressView(value: item.progress)
-                    InfoGrid(item: item)
-                }
-            }
-            .formStyle(.grouped)
-
-            Divider()
-            HStack {
-                Text(errorMessage)
-                    .font(.caption)
-                    .foregroundStyle(.red)
-                    .lineLimit(1)
-                Spacer()
-                Button("Cancel") {
-                    dismiss()
-                }
-                Button {
-                    save()
-                } label: {
-                    Label("Save", systemImage: "checkmark")
-                }
-                .buttonStyle(.borderedProminent)
-            }
-            .padding(14)
-            .background(.bar)
-        }
-        .frame(width: 620, height: 560)
-    }
-
-    private var matchingLoginText: String {
-        guard let url = URL(string: urlText),
-              let credentials = settings.credentials(for: url) else {
-            return "No matching saved login for this URL."
-        }
-
-        return "Will use saved login for \(credentials.username)."
-    }
-
-    private func selectDestination() {
-        let panel = NSOpenPanel()
-        panel.canChooseFiles = false
-        panel.canChooseDirectories = true
-        panel.allowsMultipleSelection = false
-        panel.canCreateDirectories = true
-        panel.directoryURL = URL(fileURLWithPath: NSString(string: destinationPath).expandingTildeInPath)
-
-        if panel.runModal() == .OK, let url = panel.url {
-            destinationPath = url.path
-        }
-    }
-
-    private func save() {
-        guard let url = URL(string: urlText.trimmingCharacters(in: .whitespacesAndNewlines)),
-              let scheme = url.scheme?.lowercased(),
-              ["http", "https", "ftp", "sftp"].contains(scheme) else {
-            errorMessage = "Enter a valid HTTP, HTTPS, FTP, or SFTP URL."
-            return
-        }
-
-        let cleanFileName = fileName.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !cleanFileName.isEmpty else {
-            errorMessage = "File name cannot be empty."
-            return
-        }
-
-        let destination = URL(
-            fileURLWithPath: NSString(string: destinationPath.trimmingCharacters(in: .whitespacesAndNewlines)).expandingTildeInPath,
-            isDirectory: true
-        )
-
-        let credentials: DownloadCredentials?
-        switch loginMode {
-        case .matching:
-            credentials = settings.credentials(for: url)
-        case .custom:
-            let custom = DownloadCredentials(username: username, password: password)
-            credentials = custom.isEmpty ? nil : custom
-        case .none:
-            credentials = nil
-        }
-
-        controller.updateDownload(
-            id: item.id,
-            url: url,
-            fileName: cleanFileName,
-            destinationDirectory: destination,
-            connectionsPerServer: connections,
-            credentials: credentials
-        )
-        dismiss()
-    }
-}
-
-private struct InfoGrid: View {
-    let item: DownloadItem
-
-    var body: some View {
-        Grid(alignment: .leading, horizontalSpacing: 18, verticalSpacing: 8) {
-            info("Status", item.status.rawValue)
-            info("Progress", item.progress.formatted(.percent.precision(.fractionLength(0))))
-            info("Size", ByteFormatter.string(item.sizeBytes))
-            info("Speed", item.speedText)
-            info("ETA", item.etaText)
-            info("Live connections", "\(item.connectionCount)")
-            info("Date added", item.createdAt.formatted(date: .abbreviated, time: .shortened))
-            info("Last try", item.lastTryAt?.formatted(date: .abbreviated, time: .shortened) ?? "-")
-            info("Category", item.category.rawValue)
-            info("Destination", item.destinationPath)
-        }
-    }
-
-    private func info(_ label: String, _ value: String) -> some View {
-        GridRow {
-            Text(label)
-                .foregroundStyle(.secondary)
-            Text(value)
-                .lineLimit(2)
-        }
-    }
-}

Sources/Firelink/DownloadTable.swift

@@ -1,612 +0,0 @@
-import AppKit
-import SwiftUI
-
-enum DownloadColumn: String, CaseIterable, Identifiable, Codable {
-    case fileName = "File name"
-    case size = "Size"
-    case progress = "Progress"
-    case status = "Status"
-    case lastTry = "Last try date"
-    case dateAdded = "Date added"
-    case category = "Category"
-    case connections = "Connections"
-    case liveConnections = "Live conn."
-    case speed = "Speed"
-    case eta = "ETA"
-    case destination = "Save location"
-    case url = "URL"
-    case message = "Message"
-
-    var id: String { rawValue }
-
-    var width: CGFloat {
-        switch self {
-        case .fileName: return 340
-        case .size: return 100
-        case .status: return 105
-        case .progress: return 115
-        case .lastTry, .dateAdded: return 155
-        case .category: return 105
-        case .connections, .liveConnections: return 95
-        case .speed, .eta: return 90
-        case .destination: return 240
-        case .url: return 280
-        case .message: return 220
-        }
-    }
-}
-
-enum SortDirection: String, Codable {
-    case ascending
-    case descending
-
-    mutating func toggle() {
-        self = self == .ascending ? .descending : .ascending
-    }
-}
-
-final class TableSettings: ObservableObject {
-    @Published var visibleColumns: Set<DownloadColumn> {
-        didSet { save() }
-    }
-    @Published var columnWidths: [DownloadColumn: CGFloat] {
-        didSet { save() }
-    }
-    @Published var sortColumn: DownloadColumn {
-        didSet { save() }
-    }
-    @Published var sortDirection: SortDirection {
-        didSet { save() }
-    }
-
-    private let defaults = UserDefaults.standard
-    private let storageKey = "Firelink.TableSettings.v1"
-
-    init() {
-        if let data = defaults.data(forKey: storageKey),
-           let stored = try? JSONDecoder().decode(StoredTableSettings.self, from: data) {
-            visibleColumns = stored.visibleColumns
-            columnWidths = stored.columnWidths
-            sortColumn = stored.sortColumn
-            sortDirection = stored.sortDirection
-        } else {
-            visibleColumns = [.fileName, .size, .progress, .eta, .lastTry, .dateAdded]
-            columnWidths = Dictionary(uniqueKeysWithValues: DownloadColumn.allCases.map { ($0, $0.width) })
-            sortColumn = .dateAdded
-            sortDirection = .descending
-        }
-    }
-
-    private func save() {
-        let stored = StoredTableSettings(
-            visibleColumns: visibleColumns,
-            columnWidths: columnWidths,
-            sortColumn: sortColumn,
-            sortDirection: sortDirection
-        )
-        if let data = try? JSONEncoder().encode(stored) {
-            defaults.set(data, forKey: storageKey)
-        }
-    }
-}
-
-private struct StoredTableSettings: Codable {
-    var visibleColumns: Set<DownloadColumn>
-    var columnWidths: [DownloadColumn: CGFloat]
-    var sortColumn: DownloadColumn
-    var sortDirection: SortDirection
-}
-
-struct DownloadTable: View {
-    @EnvironmentObject private var controller: DownloadController
-    @EnvironmentObject private var settings: AppSettings
-    @Environment(\.openWindow) private var openWindow
-    let items: [DownloadItem]
-    @Binding var selection: Set<DownloadItem.ID>
-    let title: String
-
-    @StateObject private var tableSettings = TableSettings()
-    @State private var pendingDeleteItems: Set<DownloadItem.ID>?
-    @State private var resizeBaseWidths: [DownloadColumn: CGFloat] = [:]
-    @State private var lastSelectedIndex: Int?
-
-    var body: some View {
-        VStack(spacing: 0) {
-            HStack {
-                Text(title)
-                    .font(.headline)
-                Text("\(items.count)")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-                    .padding(.horizontal, 7)
-                    .padding(.vertical, 3)
-                    .background(.quaternary.opacity(0.5))
-                    .clipShape(RoundedRectangle(cornerRadius: 5))
-                Spacer()
-            }
-            .padding(.horizontal, 12)
-            .padding(.vertical, 8)
-            GeometryReader { proxy in
-                let tableWidth = max(totalWidth, proxy.size.width)
-                let trailingWidth = max(0, tableWidth - totalWidth)
-
-                ScrollView(.horizontal) {
-                    VStack(spacing: 0) {
-                        tableHeader(trailingWidth: trailingWidth)
-                        Divider()
-                        ScrollView(.vertical) {
-                            LazyVStack(spacing: 0) {
-                                ForEach(sortedItems) { item in
-                                    tableRow(for: item, tableWidth: tableWidth, trailingWidth: trailingWidth)
-                                    Divider()
-                                }
-                            }
-                            .frame(width: tableWidth, alignment: .topLeading)
-                            .frame(maxHeight: .infinity, alignment: .topLeading)
-                        }
-                        .defaultScrollAnchor(.topLeading)
-                    }
-                    .frame(width: tableWidth, height: proxy.size.height, alignment: .topLeading)
-                }
-                .overlay {
-                    if items.isEmpty {
-                        ContentUnavailableView(
-                            "No Downloads",
-                            systemImage: "arrow.down.circle",
-                            description: Text("Use Add to paste one or more links.")
-                        )
-                    }
-                }
-            }
-        }
-        .confirmationDialog(
-            "Delete Download",
-            isPresented: Binding(
-                get: { pendingDeleteItems != nil },
-                set: { isPresented in
-                    if !isPresented {
-                        pendingDeleteItems = nil
-                    }
-                }
-            ),
-            presenting: pendingDeleteItems
-        ) { ids in
-            Button("Remove from List") {
-                let items = controller.downloads.filter { ids.contains($0.id) }
-                for item in items { controller.delete(item, deleteFiles: false) }
-                selection.subtract(ids)
-                pendingDeleteItems = nil
-            }
-
-            Button("Move File and Cache to Trash", role: .destructive) {
-                let items = controller.downloads.filter { ids.contains($0.id) }
-                for item in items { controller.delete(item, deleteFiles: true) }
-                selection.subtract(ids)
-                pendingDeleteItems = nil
-            }
-
-            Button("Cancel", role: .cancel) {
-                pendingDeleteItems = nil
-            }
-        } message: { ids in
-            let items = controller.downloads.filter { ids.contains($0.id) }
-            if items.allSatisfy({ $0.status == .completed }) {
-                Text("Remove \(items.count == 1 ? "this download" : "these \(items.count) downloads") from Firelink, or also move the downloaded files to Trash.")
-            } else {
-                Text("Remove \(items.count == 1 ? "this download" : "these \(items.count) downloads") from Firelink. Partial cache files are removed automatically; moving to Trash also sends any partial files there.")
-            }
-        }
-    }
-
-    private func tableRow(for item: DownloadItem, tableWidth: CGFloat, trailingWidth: CGFloat) -> some View {
-        DownloadRow(
-            item: item,
-            visibleColumns: orderedVisibleColumns,
-            columnWidth: { width(for: $0) },
-            trailingWidth: trailingWidth
-        )
-        .id(item.id)
-        .frame(width: tableWidth, alignment: .leading)
-        .background(selection.contains(item.id) ? Color.accentColor.opacity(0.12) : Color.clear)
-        .contentShape(Rectangle())
-        .onTapGesture {
-            let index = sortedItems.firstIndex(where: { $0.id == item.id })
-            
-            if NSEvent.modifierFlags.contains(.command) {
-                if selection.contains(item.id) {
-                    selection.remove(item.id)
-                } else {
-                    selection.insert(item.id)
-                }
-                lastSelectedIndex = index
-            } else if NSEvent.modifierFlags.contains(.shift), let lastIndex = lastSelectedIndex, let currentIndex = index {
-                let range = min(lastIndex, currentIndex)...max(lastIndex, currentIndex)
-                let rangeIds = range.map { sortedItems[$0].id }
-                selection.formUnion(rangeIds)
-            } else {
-                selection = [item.id]
-                lastSelectedIndex = index
-            }
-        }
-        .contextMenu {
-            rowContextMenu(for: item)
-        }
-    }
-
-    private func tableHeader(trailingWidth: CGFloat) -> some View {
-        HStack(spacing: 0) {
-            ForEach(orderedVisibleColumns) { column in
-                ZStack(alignment: .trailing) {
-                    Button {
-                        if tableSettings.sortColumn == column {
-                            tableSettings.sortDirection.toggle()
-                        } else {
-                            tableSettings.sortColumn = column
-                            tableSettings.sortDirection = .ascending
-                        }
-                    } label: {
-                        HStack(spacing: 4) {
-                            Spacer(minLength: 0)
-                            Text(column.rawValue)
-                                .font(.caption.weight(.semibold))
-                                .lineLimit(1)
-                                .truncationMode(.tail)
-                                .multilineTextAlignment(.center)
-                                .layoutPriority(1)
-                            if tableSettings.sortColumn == column {
-                                Image(systemName: tableSettings.sortDirection == .ascending ? "chevron.up" : "chevron.down")
-                                    .font(.caption2)
-                            }
-                            Spacer(minLength: 0)
-                        }
-                        .padding(.horizontal, 8)
-                        .frame(width: width(for: column), height: 34, alignment: .center)
-                        .clipped()
-                    }
-                    .buttonStyle(.plain)
-
-                    Rectangle()
-                        .fill(.secondary.opacity(0.18))
-                        .frame(width: 1, height: 20)
-                        .frame(width: 8, height: 34)
-                        .contentShape(Rectangle())
-                        .onHover { isHovering in
-                            if isHovering {
-                                NSCursor.resizeLeftRight.push()
-                            } else {
-                                NSCursor.pop()
-                            }
-                        }
-                        .gesture(
-                            DragGesture(minimumDistance: 1)
-                                .onChanged { value in
-                                    let baseWidth = resizeBaseWidths[column] ?? width(for: column)
-                                    resizeBaseWidths[column] = baseWidth
-                                    tableSettings.columnWidths[column] = max(70, baseWidth + value.translation.width)
-                                }
-                                .onEnded { _ in
-                                    resizeBaseWidths[column] = nil
-                                }
-                        )
-                }
-                .frame(width: width(for: column), height: 34)
-                .clipped()
-            }
-
-            if trailingWidth > 0 {
-                Color.clear
-                    .frame(width: trailingWidth, height: 34)
-            }
-        }
-        .background(.bar)
-        .contextMenu {
-            Section("Columns") {
-                ForEach(DownloadColumn.allCases) { column in
-                    Toggle(column.rawValue, isOn: Binding(
-                        get: { tableSettings.visibleColumns.contains(column) },
-                        set: { isVisible in
-                            if isVisible {
-                                tableSettings.visibleColumns.insert(column)
-                            } else if tableSettings.visibleColumns.count > 1 {
-                                tableSettings.visibleColumns.remove(column)
-                            }
-                        }
-                    ))
-                }
-            }
-            Section("Sort By") {
-                ForEach(DownloadColumn.allCases) { column in
-                    Button(column.rawValue) {
-                        tableSettings.sortColumn = column
-                    }
-                }
-            }
-        }
-    }
-
-    @ViewBuilder
-    private func rowContextMenu(for item: DownloadItem) -> some View {
-        let targetItems = selection.contains(item.id) ? controller.downloads.filter { selection.contains($0.id) } : [item]
-
-        Button {
-            for target in targetItems {
-                openWindow(value: target.id)
-            }
-        } label: {
-            Label(targetItems.count > 1 ? "Properties (\(targetItems.count))" : "Properties", systemImage: "info.circle")
-        }
-
-        Button {
-            for target in targetItems {
-                showInFinder(target)
-            }
-        } label: {
-            Label(targetItems.count > 1 ? "Show in Finder (\(targetItems.count))" : "Show in Finder", systemImage: "finder")
-        }
-
-        Divider()
-
-        if targetItems.contains(where: { $0.status == .paused || $0.status == .failed || $0.status == .canceled }) {
-            Button {
-                for target in targetItems where target.status == .paused || target.status == .failed || target.status == .canceled {
-                    controller.resume(target)
-                }
-            } label: {
-                Label("Start", systemImage: "play.fill")
-            }
-        }
-
-        if targetItems.contains(where: { $0.status == .downloading }) {
-            Button {
-                for target in targetItems where target.status == .downloading {
-                    controller.pause(target)
-                }
-            } label: {
-                Label("Stop", systemImage: "stop.fill")
-            }
-        }
-
-        if targetItems.contains(where: { $0.status != .downloading && $0.status != .queued }) {
-            Button {
-                for target in targetItems where target.status != .downloading && target.status != .queued {
-                    controller.queue(target)
-                }
-            } label: {
-                Label("Add to Queue", systemImage: "list.bullet")
-            }
-        }
-
-        Divider()
-
-        Button(role: .destructive) {
-            pendingDeleteItems = Set(targetItems.map(\.id))
-        } label: {
-            Label("Delete", systemImage: "trash")
-        }
-    }
-
-    private var orderedVisibleColumns: [DownloadColumn] {
-        DownloadColumn.allCases.filter { tableSettings.visibleColumns.contains($0) }
-    }
-
-    private var totalWidth: CGFloat {
-        orderedVisibleColumns.map { width(for: $0) }.reduce(0, +)
-    }
-
-    private func width(for column: DownloadColumn) -> CGFloat {
-        max(70, tableSettings.columnWidths[column] ?? column.width)
-    }
-
-    private var sortedItems: [DownloadItem] {
-        items.sorted { lhs, rhs in
-            let result = compare(lhs, rhs, by: tableSettings.sortColumn)
-            if result == .orderedSame {
-                return lhs.id.uuidString < rhs.id.uuidString
-            }
-            return tableSettings.sortDirection == .ascending ? result == .orderedAscending : result == .orderedDescending
-        }
-    }
-
-    private func compare(_ lhs: DownloadItem, _ rhs: DownloadItem, by column: DownloadColumn) -> ComparisonResult {
-        switch column {
-        case .fileName: return lhs.fileName.localizedCaseInsensitiveCompare(rhs.fileName)
-        case .size: return compare(lhs.sizeBytes ?? -1, rhs.sizeBytes ?? -1)
-        case .status: return compare(lhs.status.rawValue, rhs.status.rawValue)
-        case .progress: return compare(lhs.progress, rhs.progress)
-        case .lastTry: return compare(lhs.lastTryAt ?? .distantPast, rhs.lastTryAt ?? .distantPast)
-        case .dateAdded: return compare(lhs.createdAt, rhs.createdAt)
-        case .category: return compare(lhs.category.rawValue, rhs.category.rawValue)
-        case .connections: return compare(lhs.connectionsPerServer, rhs.connectionsPerServer)
-        case .liveConnections: return compare(lhs.connectionCount, rhs.connectionCount)
-        case .speed: return compare(lhs.speedText, rhs.speedText)
-        case .eta: return compare(lhs.etaText, rhs.etaText)
-        case .destination: return compare(lhs.destinationPath, rhs.destinationPath)
-        case .url: return compare(lhs.url.absoluteString, rhs.url.absoluteString)
-        case .message: return compare(lhs.message, rhs.message)
-        }
-    }
-
-    private func compare<T: Comparable>(_ lhs: T, _ rhs: T) -> ComparisonResult {
-        if lhs < rhs { return .orderedAscending }
-        if lhs > rhs { return .orderedDescending }
-        return .orderedSame
-    }
-
-    private func showInFinder(_ item: DownloadItem) {
-        let fileURL = item.destinationDirectory.appendingPathComponent(item.fileName)
-        if FileManager.default.fileExists(atPath: fileURL.path) {
-            NSWorkspace.shared.activateFileViewerSelecting([fileURL])
-        } else {
-            NSWorkspace.shared.open(existingFolder(for: item.destinationDirectory))
-        }
-    }
-
-    private func existingFolder(for url: URL) -> URL {
-        var candidate = url
-        while !FileManager.default.fileExists(atPath: candidate.path) {
-            let parent = candidate.deletingLastPathComponent()
-            if parent.path == candidate.path {
-                return URL(fileURLWithPath: NSHomeDirectory())
-            }
-            candidate = parent
-        }
-        return candidate
-    }
-}
-
-private struct DownloadRow: View {
-    let item: DownloadItem
-    let visibleColumns: [DownloadColumn]
-    let columnWidth: (DownloadColumn) -> CGFloat
-    let trailingWidth: CGFloat
-
-    var body: some View {
-        HStack(alignment: .top, spacing: 0) {
-            ForEach(visibleColumns) { column in
-                cell(for: column)
-                    .padding(.horizontal, 8)
-                    .padding(.vertical, 8)
-                    .frame(width: columnWidth(column), alignment: alignment(for: column))
-                    .clipped()
-            }
-
-            if trailingWidth > 0 {
-                Color.clear
-                    .frame(width: trailingWidth)
-            }
-        }
-    }
-
-    @ViewBuilder
-    private func cell(for column: DownloadColumn) -> some View {
-        switch column {
-        case .fileName:
-            HStack(alignment: .top, spacing: 8) {
-                Image(systemName: item.category.symbolName)
-                    .font(.title3)
-                    .foregroundStyle(categoryColor)
-                    .frame(width: 22)
-                VStack(alignment: .leading, spacing: 6) {
-                    Text(item.fileName)
-                        .font(.headline)
-                        .lineLimit(1)
-                        .truncationMode(.tail)
-                    Text(item.url.absoluteString)
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                        .lineLimit(1)
-                        .truncationMode(.tail)
-                }
-                .frame(maxWidth: .infinity, alignment: .leading)
-            }
-        case .size:
-            Text(ByteFormatter.string(item.sizeBytes))
-                .monospacedDigit()
-                .lineLimit(1)
-                .truncationMode(.tail)
-        case .status, .progress:
-            progressBarCell()
-        case .lastTry:
-            Text(formatted(item.lastTryAt))
-                .lineLimit(1)
-                .truncationMode(.tail)
-        case .dateAdded:
-            Text(formatted(item.createdAt))
-                .lineLimit(1)
-                .truncationMode(.tail)
-        case .category:
-            Text(item.category.rawValue)
-                .lineLimit(1)
-                .truncationMode(.tail)
-        case .connections:
-            Text("\(item.connectionsPerServer)")
-                .monospacedDigit()
-                .lineLimit(1)
-        case .liveConnections:
-            Text("\(item.connectionCount)")
-                .monospacedDigit()
-                .lineLimit(1)
-        case .speed:
-            Text(item.speedText)
-                .lineLimit(1)
-                .truncationMode(.tail)
-        case .eta:
-            Text(item.etaText)
-                .lineLimit(1)
-                .truncationMode(.tail)
-        case .destination:
-            Text(item.destinationPath)
-                .font(.system(.caption, design: .monospaced))
-                .lineLimit(1)
-                .truncationMode(.tail)
-        case .url:
-            Text(item.url.absoluteString)
-                .font(.system(.caption, design: .monospaced))
-                .lineLimit(1)
-                .truncationMode(.tail)
-        case .message:
-            Text(item.message)
-                .foregroundStyle(.secondary)
-                .lineLimit(1)
-                .truncationMode(.tail)
-        }
-    }
-
-    private func alignment(for column: DownloadColumn) -> Alignment {
-        column == .fileName ? .leading : .center
-    }
-
-    private var categoryColor: Color {
-        switch item.category {
-        case .musics: return .pink
-        case .movies: return .indigo
-        case .compressed: return .orange
-        case .pictures: return .teal
-        case .documents: return .blue
-        case .other: return .gray
-        }
-    }
-
-    private var statusColor: Color {
-        switch item.status {
-        case .queued: return .secondary
-        case .downloading: return .blue
-        case .paused: return .orange
-        case .completed: return .green
-        case .failed: return .red
-        case .canceled: return .gray
-        }
-    }
-
-    @ViewBuilder
-    private func progressBarCell() -> some View {
-        if item.status == .completed {
-            Text("Completed")
-                .foregroundStyle(.green)
-                .lineLimit(1)
-                .truncationMode(.tail)
-        } else {
-            GeometryReader { proxy in
-                ZStack {
-                    RoundedRectangle(cornerRadius: 4)
-                        .fill(Color.secondary.opacity(0.15))
-                    
-                    RoundedRectangle(cornerRadius: 4)
-                        .fill(statusColor)
-                        .frame(width: max(0, proxy.size.width * item.progress))
-                        .frame(maxWidth: .infinity, alignment: .leading)
-                    
-                    Text(item.progress.formatted(.percent.precision(.fractionLength(0))))
-                        .font(.system(size: 11, weight: .medium, design: .monospaced))
-                        .foregroundColor(.primary)
-                }
-            }
-            .frame(height: 16)
-        }
-    }
-
-    private func formatted(_ date: Date?) -> String {
-        guard let date else { return "-" }
-        return date.formatted(date: .abbreviated, time: .shortened)
-    }
-}

Sources/Firelink/FileClassifier.swift

@@ -1,66 +0,0 @@
-import Foundation
-
-enum FileClassifier {
-    private static let musicExtensions: Set<String> = [
-        "aac", "aif", "aiff", "alac", "amr", "ape", "au", "caf", "flac", "m4a",
-        "m4b", "mid", "midi", "mp3", "oga", "ogg", "opus", "ra", "wav", "weba",
-        "wma"
-    ]
-
-    private static let movieExtensions: Set<String> = [
-        "3g2", "3gp", "avi", "divx", "f4v", "flv", "m2ts", "m4v", "mkv", "mov",
-        "mp4", "mpeg", "mpg", "mts", "ogm", "ogv", "rm", "rmvb", "ts", "vob",
-        "webm", "wmv"
-    ]
-
-    private static let compressedExtensions: Set<String> = [
-        "7z", "ace", "alz", "apk", "appx", "ar", "arc", "arj", "bz", "bz2",
-        "cab", "cpio", "deb", "dmg", "gz", "gzip", "iso", "jar", "lha", "lzh",
-        "lz", "lz4", "lzip", "lzma", "pak", "pkg", "rar", "rpm", "sit", "sitx",
-        "tar", "tbz", "tbz2", "tgz", "tlz", "txz", "war", "whl", "xar", "xz",
-        "z", "zip", "zipx", "zst"
-    ]
-
-    private static let pictureExtensions: Set<String> = [
-        "ai", "apng", "avif", "bmp", "cr2", "cr3", "dng", "emf", "eps", "gif",
-        "heic", "heif", "ico", "indd", "jfif", "jpeg", "jpg", "jxl", "nef",
-        "orf", "pbm", "pgm", "png", "pnm", "ppm", "psd", "raw", "rw2",
-        "svg", "tga", "tif", "tiff", "webp", "wmf"
-    ]
-
-    private static let documentExtensions: Set<String> = [
-        "azw", "azw3", "csv", "djvu", "doc", "docm", "docx", "dot", "dotx",
-        "epub", "fb2", "htm", "html", "ics", "key", "log", "md", "mobi", "pdf",
-        "numbers", "odp", "ods", "odt", "pages", "pot", "potx", "pps", "ppsx",
-        "ppt", "pptm", "pptx", "rtf", "tex", "txt", "vcf", "xls", "xlsm",
-        "xlsx", "xml", "xps", "yaml", "yml"
-    ]
-
-    static func category(forFileName fileName: String) -> DownloadCategory {
-        let ext = (fileName as NSString).pathExtension.lowercased()
-        guard !ext.isEmpty else { return .other }
-
-        if musicExtensions.contains(ext) { return .musics }
-        if movieExtensions.contains(ext) { return .movies }
-        if compressedExtensions.contains(ext) { return .compressed }
-        if pictureExtensions.contains(ext) { return .pictures }
-        if documentExtensions.contains(ext) { return .documents }
-        return .other
-    }
-
-    static func destinationDirectory(for category: DownloadCategory) -> URL {
-        let downloads = FileManager.default.urls(for: .downloadsDirectory, in: .userDomainMask).first
-            ?? URL(fileURLWithPath: NSHomeDirectory()).appendingPathComponent("Downloads")
-        return downloads.appendingPathComponent(category.rawValue, isDirectory: true)
-    }
-
-    static func fileName(from url: URL) -> String {
-        let pathName = url.lastPathComponent.removingPercentEncoding ?? url.lastPathComponent
-        if !pathName.isEmpty, pathName != "/" {
-            return pathName
-        }
-
-        let host = url.host(percentEncoded: false) ?? "download"
-        return "\(host)-download"
-    }
-}

Sources/Firelink/FirelinkApp.swift

@@ -1,55 +0,0 @@
-import SwiftUI
-
-@main
-struct FirelinkApp: App {
-    @StateObject private var settings: AppSettings
-    @StateObject private var controller: DownloadController
-
-    init() {
-        let settings = AppSettings()
-        _settings = StateObject(wrappedValue: settings)
-        _controller = StateObject(wrappedValue: DownloadController(settings: settings))
-    }
-
-    var body: some Scene {
-        WindowGroup {
-            ContentView()
-                .environmentObject(controller)
-                .environmentObject(settings)
-                .frame(minWidth: 1180, idealWidth: 1280, minHeight: 720, idealHeight: 760)
-        }
-        .windowStyle(.titleBar)
-
-        WindowGroup("Add Downloads", id: "add-downloads") {
-            AddDownloadsView()
-                .environmentObject(controller)
-                .environmentObject(settings)
-        }
-        .windowResizability(.contentSize)
-
-        WindowGroup("Download Properties", for: UUID.self) { $downloadID in
-            if let downloadID {
-                DownloadPropertiesWindow(downloadID: downloadID)
-                    .environmentObject(controller)
-                    .environmentObject(settings)
-            } else {
-                ContentUnavailableView("Download Not Found", systemImage: "questionmark.circle")
-            }
-        }
-        .windowResizability(.contentSize)
-
-        .commands {
-            CommandGroup(after: .newItem) {
-                Button("Start Queue") {
-                    controller.startQueue()
-                }
-                .keyboardShortcut("r", modifiers: [.command])
-            }
-        }
-
-        Settings {
-            SettingsView()
-                .environmentObject(settings)
-        }
-    }
-}

Sources/Firelink/KeychainCredentialStore.swift

@@ -1,50 +0,0 @@
-import Foundation
-import Security
-
-enum KeychainCredentialStore {
-    private static let service = "local.firelink.site-login"
-
-    static func password(for id: UUID) -> String? {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: id.uuidString,
-            kSecReturnData as String: true,
-            kSecMatchLimit as String: kSecMatchLimitOne
-        ]
-
-        var result: CFTypeRef?
-        guard SecItemCopyMatching(query as CFDictionary, &result) == errSecSuccess,
-              let data = result as? Data else {
-            return nil
-        }
-
-        return String(data: data, encoding: .utf8)
-    }
-
-    @discardableResult
-    static func setPassword(_ password: String, for id: UUID) -> Bool {
-        deletePassword(for: id)
-
-        let attributes: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: id.uuidString,
-            kSecValueData as String: Data(password.utf8)
-        ]
-
-        return SecItemAdd(attributes as CFDictionary, nil) == errSecSuccess
-    }
-
-    @discardableResult
-    static func deletePassword(for id: UUID) -> Bool {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: id.uuidString
-        ]
-
-        let status = SecItemDelete(query as CFDictionary)
-        return status == errSecSuccess || status == errSecItemNotFound
-    }
-}

Sources/Firelink/Models.swift

@@ -1,94 +0,0 @@
-import Foundation
-
-enum DownloadStatus: String, Codable, CaseIterable, Sendable {
-    case queued = "Queued"
-    case downloading = "Downloading"
-    case paused = "Paused"
-    case completed = "Completed"
-    case failed = "Failed"
-    case canceled = "Canceled"
-}
-
-enum DownloadCategory: String, Codable, CaseIterable, Sendable {
-    case musics = "Musics"
-    case movies = "Movies"
-    case compressed = "Compressed"
-    case pictures = "Pictures"
-    case documents = "Documents"
-    case other = "Other"
-
-    var symbolName: String {
-        switch self {
-        case .musics: "music.note"
-        case .movies: "film"
-        case .compressed: "archivebox"
-        case .pictures: "photo"
-        case .documents: "doc.text"
-        case .other: "folder"
-        }
-    }
-}
-
-struct DownloadCredentials: Codable, Equatable, Sendable {
-    var username: String
-    var password: String
-
-    var isEmpty: Bool {
-        username.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty &&
-            password.isEmpty
-    }
-}
-
-struct DownloadItem: Identifiable, Codable, Equatable, Sendable {
-    var id = UUID()
-    var url: URL
-    var fileName: String
-    var category: DownloadCategory
-    var destinationDirectory: URL
-    var connectionsPerServer: Int
-    var credentials: DownloadCredentials?
-    var status: DownloadStatus = .queued
-    var progress: Double = 0
-    var speedText: String = "-"
-    var etaText: String = "-"
-    var connectionCount: Int = 0
-    var sizeBytes: Int64?
-    var bytesText: String = "-"
-    var message: String = ""
-    var createdAt = Date()
-    var lastTryAt: Date?
-
-    var destinationPath: String {
-        destinationDirectory.appendingPathComponent(fileName).path
-    }
-}
-
-struct DownloadProgress: Equatable, Sendable {
-    var fraction: Double
-    var bytesText: String
-    var speedText: String
-    var etaText: String
-    var connectionCount: Int
-}
-
-struct PendingDownload: Identifiable, Equatable, Sendable {
-    enum MetadataState: Equatable, Sendable {
-        case pending
-        case loading
-        case loaded
-        case failed(String)
-    }
-
-    var id = UUID()
-    var url: URL
-    var fileName: String
-    var category: DownloadCategory
-    var defaultDirectory: URL
-    var sizeBytes: Int64?
-    var mimeType: String?
-    var state: MetadataState = .pending
-
-    var destinationPath: String {
-        defaultDirectory.appendingPathComponent(fileName).path
-    }
-}

Sources/Firelink/SettingsView.swift

@@ -1,204 +0,0 @@
-import SwiftUI
-
-struct SettingsView: View {
-    @EnvironmentObject private var settings: AppSettings
-
-    var body: some View {
-        TabView {
-            DownloadSettingsPane()
-                .tabItem {
-                    Label("Downloads", systemImage: "arrow.down.circle")
-                }
-
-            LocationsSettingsPane()
-                .tabItem {
-                    Label("Locations", systemImage: "folder")
-                }
-
-            SiteLoginsSettingsPane()
-                .tabItem {
-                    Label("Site Logins", systemImage: "key.fill")
-                }
-
-            PowerSettingsPane()
-                .tabItem {
-                    Label("Power", systemImage: "moon.zzz")
-                }
-        }
-        .padding(20)
-        .frame(width: 680, height: 470)
-    }
-}
-
-private struct DownloadSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-
-    var body: some View {
-        Form {
-            Section {
-                Stepper(
-                    "Default connections per server: \(settings.perServerConnections)",
-                    value: $settings.perServerConnections,
-                    in: 1...16
-                )
-                Text("Used as the default for new downloads. The Add Downloads window can override it per batch.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-
-                Stepper(
-                    "Parallel downloads: \(settings.maxConcurrentDownloads)",
-                    value: $settings.maxConcurrentDownloads,
-                    in: 1...12
-                )
-                Text("Controls how many files Firelink downloads at the same time.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .formStyle(.grouped)
-    }
-}
-
-private struct LocationsSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-
-    var body: some View {
-        VStack(alignment: .leading, spacing: 14) {
-            ForEach(DownloadCategory.allCases, id: \.self) { category in
-                DirectoryPickerRow(category: category)
-            }
-
-            HStack {
-                Spacer()
-                Button("Reset Defaults") {
-                    settings.resetDirectories()
-                }
-            }
-        }
-    }
-}
-
-private struct DirectoryPickerRow: View {
-    @EnvironmentObject private var settings: AppSettings
-    let category: DownloadCategory
-
-    @State private var path = ""
-
-    var body: some View {
-        HStack(spacing: 10) {
-            Label(category.rawValue, systemImage: category.symbolName)
-                .frame(width: 125, alignment: .leading)
-
-            TextField("Folder path", text: Binding(
-                get: { settings.downloadDirectories[category] ?? path },
-                set: { newValue in
-                    path = newValue
-                    settings.setDirectory(newValue, for: category)
-                }
-            ))
-            .textFieldStyle(.roundedBorder)
-            .font(.system(.body, design: .monospaced))
-
-            Button {
-                selectFolder()
-            } label: {
-                Label("Select", systemImage: "folder.badge.plus")
-            }
-        }
-    }
-
-    private func selectFolder() {
-        let panel = NSOpenPanel()
-        panel.canChooseFiles = false
-        panel.canChooseDirectories = true
-        panel.allowsMultipleSelection = false
-        panel.canCreateDirectories = true
-        panel.directoryURL = settings.destinationDirectory(for: category)
-
-        if panel.runModal() == .OK, let url = panel.url {
-            settings.setDirectory(url.path, for: category)
-        }
-    }
-}
-
-private struct SiteLoginsSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-    @State private var urlPattern = ""
-    @State private var username = ""
-    @State private var password = ""
-
-    var body: some View {
-        VStack(alignment: .leading, spacing: 16) {
-            Grid(alignment: .leading, horizontalSpacing: 10, verticalSpacing: 10) {
-                GridRow {
-                    Text("URL Pattern")
-                    TextField("*.github.com", text: $urlPattern)
-                        .textFieldStyle(.roundedBorder)
-                }
-
-                GridRow {
-                    Text("Username")
-                    TextField("Username", text: $username)
-                        .textFieldStyle(.roundedBorder)
-                }
-
-                GridRow {
-                    Text("Password")
-                    SecureField("Password", text: $password)
-                        .textFieldStyle(.roundedBorder)
-                }
-            }
-
-            HStack {
-                Text(settings.message)
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-                    .lineLimit(1)
-                Spacer()
-                Button {
-                    settings.addSiteLogin(urlPattern: urlPattern, username: username, password: password)
-                    if settings.message.hasPrefix("Added") {
-                        urlPattern = ""
-                        username = ""
-                        password = ""
-                    }
-                } label: {
-                    Label("Add Login", systemImage: "plus")
-                }
-                .buttonStyle(.borderedProminent)
-            }
-
-            List {
-                ForEach(settings.siteLogins) { login in
-                    HStack {
-                        Image(systemName: "key.horizontal")
-                            .foregroundStyle(.secondary)
-                        Text(login.urlPattern)
-                            .font(.system(.body, design: .monospaced))
-                        Spacer()
-                        Text(login.username)
-                            .foregroundStyle(.secondary)
-                    }
-                }
-                .onDelete(perform: settings.deleteSiteLogins)
-            }
-            .frame(minHeight: 180)
-        }
-    }
-}
-
-private struct PowerSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-
-    var body: some View {
-        Form {
-            Section {
-                Toggle("Prevent system sleep while downloads are active", isOn: $settings.preventsSleepWhileDownloading)
-                Text("The display may still turn off. Firelink only keeps macOS awake enough to finish active downloads.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .formStyle(.grouped)
-    }
-}

Sources/Firelink/SidebarView.swift

@@ -1,65 +0,0 @@
-import SwiftUI
-
-enum DownloadSidebarFilter: Hashable {
-    case all
-    case queued
-    case active
-    case completed
-    case failed
-    case category(DownloadCategory)
-
-    var title: String {
-        switch self {
-        case .all: "All Downloads"
-        case .queued: "Queue"
-        case .active: "Active"
-        case .completed: "Completed"
-        case .failed: "Failed"
-        case .category(let category): category.rawValue
-        }
-    }
-}
-
-struct SidebarView: View {
-    @EnvironmentObject private var controller: DownloadController
-    @Binding var selection: DownloadSidebarFilter
-
-    var body: some View {
-        List(selection: $selection) {
-            Section("Library") {
-                Label("All", systemImage: "tray.full")
-                    .badge(controller.downloads.count)
-                    .tag(DownloadSidebarFilter.all)
-                Label("Queue", systemImage: "list.bullet")
-                    .badge(controller.queuedCount)
-                    .tag(DownloadSidebarFilter.queued)
-                Label("Active", systemImage: "bolt.fill")
-                    .badge(controller.activeCount)
-                    .tag(DownloadSidebarFilter.active)
-                Label("Completed", systemImage: "checkmark.circle")
-                    .badge(controller.completedCount)
-                    .tag(DownloadSidebarFilter.completed)
-                Label("Failed", systemImage: "exclamationmark.triangle")
-                    .badge(controller.failedCount)
-                    .tag(DownloadSidebarFilter.failed)
-            }
-
-            Section("Folders") {
-                ForEach(DownloadCategory.allCases, id: \.self) { category in
-                    Label(category.rawValue, systemImage: category.symbolName)
-                        .badge(controller.downloads.filter { $0.category == category }.count)
-                        .tag(DownloadSidebarFilter.category(category))
-                }
-            }
-
-            Section("Engine") {
-                HStack {
-                    Image(systemName: controller.hasAria2 ? "checkmark.seal.fill" : "exclamationmark.triangle.fill")
-                        .foregroundStyle(controller.hasAria2 ? .green : .orange)
-                    Text(controller.hasAria2 ? "aria2c ready" : "aria2c missing")
-                }
-            }
-        }
-        .listStyle(.sidebar)
-    }
-}

Sources/Firelink/StatusBar.swift

@@ -1,21 +0,0 @@
-import SwiftUI
-
-struct StatusBar: View {
-    @EnvironmentObject private var controller: DownloadController
-
-    var body: some View {
-        HStack {
-            Text(controller.engineMessage.isEmpty ? "Ready" : controller.engineMessage)
-                .foregroundStyle(controller.hasAria2 ? Color.secondary : Color.orange)
-                .lineLimit(1)
-            Spacer()
-            Text("\(controller.activeCount) active")
-            Text("\(controller.queuedCount) queued")
-            Text("\(controller.completedCount) done")
-        }
-        .font(.caption)
-        .padding(.horizontal, 14)
-        .padding(.vertical, 8)
-        .background(.bar)
-    }
-}

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,42 @@
+# Third-Party Notices
+
+Firelink distributes separate executable tools. Firelink's MIT license does not replace their licenses.
+
+Exact versions, target hashes, sources, and build descriptions are pinned in `engines.lock.json`.
+
+## aria2
+
+- Project: <https://aria2.github.io/>
+- Source: <https://github.com/aria2/aria2>
+- License: GNU General Public License version 2 or later
+
+Corresponding source for the distributed version is available from the source link and release tag listed in `engines.lock.json`. Firelink release notes must retain that source reference.
+
+Linux x64 uses a checksum-pinned musl static build produced from upstream aria2 by <https://github.com/abcfy2/aria2-static-build>. Builder source and upstream tag are recorded in `engine-sources.lock.json`.
+
+## FFmpeg
+
+- Project and source: <https://ffmpeg.org/>
+- License information: <https://ffmpeg.org/legal.html>
+
+Current macOS binary reports `--enable-gpl --enable-version3`; distribution therefore follows GNU GPL version 3 requirements. Exact build identity is recorded in `engines.lock.json`.
+
+Windows and Linux archives come from checksum-pinned BtbN FFmpeg GPL builds. Build project: <https://github.com/BtbN/FFmpeg-Builds>.
+
+## yt-dlp
+
+- Project and source: <https://github.com/yt-dlp/yt-dlp>
+- License: The Unlicense
+
+Firelink uses a self-contained PyInstaller onedir distribution. Embedded Python packages keep their own license files inside `_internal` where supplied.
+
+## Deno
+
+- Project and source: <https://github.com/denoland/deno>
+- License: MIT
+
+## OpenSSL and bundled native libraries
+
+Engine payloads may contain OpenSSL, SQLite, c-ares, libssh2, gettext/libintl, zstd, and other runtime libraries. Their copyright and license notices remain part of their source distributions and embedded package metadata.
+
+Release engineering must review each newly added target payload before adding its hashes to `engines.lock.json`. Missing provenance or license data blocks release.

engine-sources.lock.json

@@ -0,0 +1,51 @@
+{
+  "schemaVersion": 1,
+  "targets": {
+    "x86_64-pc-windows-msvc": {
+      "yt-dlp": {
+        "version": "2026.06.09",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.06.09/yt-dlp_win.zip",
+        "sha256": "9bb27530494092870b5330deacfc65a40d3e980c7e2c67e5f09b902c37a6903d"
+      },
+      "deno": {
+        "version": "2.9.1",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.1/deno-x86_64-pc-windows-msvc.zip",
+        "sha256": "ab310b4232cca207d40ffa41867e93aaf9f893802bc76756e74f486a6b21b371"
+      },
+      "ffmpeg": {
+        "version": "8.1.2",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-06-23-13-52/ffmpeg-n8.1.2-win64-gpl-8.1.zip",
+        "sha256": "ddbe0deec00b9cfd3ee74298a46a22ac4061913ed47d92297cd168cc5a5cc625"
+      },
+      "aria2c": {
+        "version": "1.37.0",
+        "url": "https://github.com/aria2/aria2/releases/download/release-1.37.0/aria2-1.37.0-win-64bit-build1.zip",
+        "sha256": "67d015301eef0b612191212d564c5bb0a14b5b9c4796b76454276a4d28d9b288"
+      }
+    },
+    "x86_64-unknown-linux-gnu": {
+      "yt-dlp": {
+        "version": "2026.06.09",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.06.09/yt-dlp_linux.zip",
+        "sha256": "217bbc9c3ed19ea75a7f151a3e48dbfeac7f459a7dce2deeeecc2d6e2871bd5b"
+      },
+      "deno": {
+        "version": "2.9.1",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.1/deno-x86_64-unknown-linux-gnu.zip",
+        "sha256": "710c54d63477d1100844ef4818f19507ce0dbf40510903b1d883f19e394446a2"
+      },
+      "ffmpeg": {
+        "version": "8.1.2",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-06-23-13-52/ffmpeg-n8.1.2-linux64-gpl-8.1.tar.xz",
+        "sha256": "0c6772b77fdbf127cc1498eca39a40e20b88817f36b66d553cebcfcca32b6d78"
+      },
+      "aria2c": {
+        "version": "1.37.0",
+        "url": "https://github.com/abcfy2/aria2-static-build/releases/download/1.37.0/aria2-x86_64-linux-musl_static.zip",
+        "sha256": "e0a09b12ef67f35f8a8e4fdddbec851d235b7c31da549d0578bff459032b499a",
+        "upstreamSource": "https://github.com/aria2/aria2/tree/release-1.37.0",
+        "builderSource": "https://github.com/abcfy2/aria2-static-build/tree/1.37.0"
+      }
+    }
+  }
+}

engines.lock.json

@@ -0,0 +1,43 @@
+{
+  "schemaVersion": 1,
+  "targets": {
+    "aarch64-apple-darwin": {
+      "engines": {
+        "yt-dlp": {
+          "version": "2026.06.09",
+          "source": "https://github.com/yt-dlp/yt-dlp",
+          "build": "PyInstaller onedir distribution with embedded Python and yt_dlp_ejs",
+          "sha256": "4eefb498e76f8a425bec30ba3ee2079b01542ca39ca1fb61b79966450794cc13"
+        },
+        "aria2c": {
+          "version": "1.37.0",
+          "source": "https://github.com/aria2/aria2",
+          "build": "arm64 executable with adjacent aria2-libs",
+          "sha256": "111b2f5ed760f1e1a2ec06117c4e8094fcde336ba16122dda1c5e7209bf1862d"
+        },
+        "ffmpeg": {
+          "version": "N-125385-ge2e889d9da",
+          "source": "https://ffmpeg.org/",
+          "build": "GPLv3 build identified by binary as https://www.martin-riedl.de",
+          "sha256": "3027bd75166a596c31a271ce9ae14b5441492b9557011993c0bf873b5a7c6a09"
+        },
+        "deno": {
+          "version": "2.9.1",
+          "source": "https://github.com/denoland/deno",
+          "build": "official aarch64-apple-darwin executable",
+          "sha256": "df5e2cca5253ec99b9a630fb059bf01cdbbf586fed1f344017875c5462b2c483"
+        }
+      },
+      "runtimeTrees": {
+        "_internal": {
+          "files": 142,
+          "sha256": "3fabc08e6367f9393cfee32c32138f057f0e6068e430190c26a22ddfea84242b"
+        },
+        "aria2-libs": {
+          "files": 7,
+          "sha256": "f6735fa4162513ca79adcc6bb65afdccdcd34c7c05e5d45c78da6d2e0c359e57"
+        }
+      }
+    }
+  }
+}

index.html

@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/png" href="/src/assets/app-icon.png" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Firelink Download Manager</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Outfit:wght@300;400;500;600;700&display=swap" rel="stylesheet">
+  </head>
+
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package.json

@@ -0,0 +1,66 @@
+{
+  "name": "firelink",
+  "private": true,
+  "version": "1.0.0",
+  "description": "A fast cross-platform desktop download manager powered by Rust, Tauri, React, aria2, and yt-dlp.",
+  "license": "MIT",
+  "homepage": "https://github.com/nimbold/Firelink",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nimbold/Firelink.git"
+  },
+  "bugs": {
+    "url": "https://github.com/nimbold/Firelink/issues"
+  },
+  "keywords": [
+    "download-manager",
+    "tauri",
+    "rust",
+    "react",
+    "typescript",
+    "aria2",
+    "yt-dlp",
+    "ffmpeg",
+    "desktop"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "bindings": "cd src-tauri && cargo test export_bindings --lib",
+    "build": "tsc && vite build",
+    "check:updates": "node scripts/check-updates.js",
+    "preview": "vite preview",
+    "tauri": "tauri",
+    "test": "vitest"
+  },
+  "dependencies": {
+    "@formkit/auto-animate": "^0.9.0",
+    "@tailwindcss/vite": "^4.3.1",
+    "@tauri-apps/api": "^2.11.1",
+    "@tauri-apps/plugin-clipboard-manager": "^2.3.2",
+    "@tauri-apps/plugin-dialog": "^2.7.1",
+    "@tauri-apps/plugin-fs": "^2.5.1",
+    "@tauri-apps/plugin-log": "^2.8.0",
+    "@tauri-apps/plugin-notification": "^2.3.3",
+    "@tauri-apps/plugin-opener": "^2",
+    "lucide-react": "^1.23.0",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "zustand": "^5.0.14"
+  },
+  "devDependencies": {
+    "@tauri-apps/cli": "^2.11.4",
+    "@types/react": "^19.1.8",
+    "@types/react-dom": "^19.1.6",
+    "@vitejs/plugin-react": "^6.0.3",
+    "autoprefixer": "^10.5.2",
+    "postcss": "^8.5.15",
+    "tailwindcss": "^4.3.1",
+    "typescript": "^6.0.3",
+    "vite": "^8.1.3",
+    "vitest": "^4.1.9"
+  }
+}

scripts/before-tauri-build.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+
+function run(command, args, options = {}) {
+  const executable = process.platform === 'win32' && command === 'npm' ? 'npm.cmd' : command;
+  const result = spawnSync(executable, args, {
+    cwd: repoRoot,
+    stdio: 'inherit',
+    ...options,
+  });
+
+  if (result.error) {
+    console.error(`Failed to run ${executable}: ${result.error.message}`);
+    process.exit(1);
+  }
+
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+function runNpmScript(script) {
+  if (process.env.npm_execpath) {
+    run(process.execPath, [process.env.npm_execpath, 'run', script]);
+    return;
+  }
+
+  if (process.platform === 'win32') {
+    run('cmd.exe', ['/d', '/s', '/c', 'npm', 'run', script], {
+      windowsHide: true,
+    });
+    return;
+  }
+
+  run('npm', ['run', script]);
+}
+
+run(process.execPath, ['scripts/stage-engines.js']);
+run(process.execPath, ['scripts/verify-binaries.js', '--staged']);
+
+if (process.env.FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE === '1') {
+  const engineDist = path.join(repoRoot, 'src-tauri', 'engine-dist');
+  fs.rmSync(engineDist, { recursive: true, force: true });
+  fs.mkdirSync(engineDist, { recursive: true });
+  console.log('Omitted engine-dist from the initial Tauri bundle; release packaging will repack verified engines.');
+}
+
+runNpmScript('build');

scripts/check-updates.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+const userAgent = 'firelink-update-check';
+
+function parseJsonFile(file) {
+  return JSON.parse(fs.readFileSync(path.join(repoRoot, file), 'utf8'));
+}
+
+function normalizeVersion(value) {
+  return String(value || '')
+    .replace(/^v/, '')
+    .replace(/^release-/, '');
+}
+
+function compareVersions(left, right) {
+  const a = normalizeVersion(left).split(/[.-]/).map(part => (/^\d+$/.test(part) ? Number(part) : part));
+  const b = normalizeVersion(right).split(/[.-]/).map(part => (/^\d+$/.test(part) ? Number(part) : part));
+  const length = Math.max(a.length, b.length);
+  for (let index = 0; index < length; index += 1) {
+    const av = a[index] ?? 0;
+    const bv = b[index] ?? 0;
+    if (av === bv) continue;
+    if (typeof av === 'number' && typeof bv === 'number') return av > bv ? 1 : -1;
+    return String(av).localeCompare(String(bv));
+  }
+  return 0;
+}
+
+function npmOutdated(cwd) {
+  try {
+    execFileSync('npm', ['outdated', '--json'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    return {};
+  } catch (error) {
+    const output = error.stdout?.toString() || '{}';
+    return JSON.parse(output || '{}');
+  }
+}
+
+async function fetchJson(url) {
+  const response = await fetch(url, { headers: { 'User-Agent': userAgent } });
+  if (!response.ok) throw new Error(`${response.status} ${response.statusText}: ${url}`);
+  return response.json();
+}
+
+async function fetchText(url) {
+  const response = await fetch(url, { headers: { 'User-Agent': userAgent } });
+  if (!response.ok) throw new Error(`${response.status} ${response.statusText}: ${url}`);
+  return response.text();
+}
+
+async function githubLatest(repo) {
+  return fetchJson(`https://api.github.com/repos/${repo}/releases/latest`);
+}
+
+async function latestFfmpegStable() {
+  const html = await fetchText('https://ffmpeg.org/releases/');
+  const versions = [...html.matchAll(/ffmpeg-(\d+\.\d+(?:\.\d+)?)\.tar\.xz/g)].map(match => match[1]);
+  return [...new Set(versions)].sort(compareVersions).at(-1);
+}
+
+async function latestMartinRiedlMacArm64Release() {
+  const html = await fetchText('https://ffmpeg.martin-riedl.de/');
+  const releaseSection = html.split('Download Release Build')[1] || '';
+  const match =
+    releaseSection.match(/macOS \(Apple Silicon\/arm64\)[\s\S]*?<b>Release:\s*<\/b>\s*([0-9.]+)/) ||
+    releaseSection.match(/macOS \(Apple Silicon\/arm64\)[\s\S]*?Release:\s*([0-9.]+)/);
+  return match?.[1];
+}
+
+function printNpmReport(label, outdated) {
+  const entries = Object.entries(outdated);
+  if (!entries.length) {
+    console.log(`${label}: current`);
+    return 0;
+  }
+  console.log(`${label}: ${entries.length} outdated package(s)`);
+  for (const [name, info] of entries) {
+    console.log(`  ${name}: ${info.current} -> ${info.latest} (wanted ${info.wanted})`);
+  }
+  return entries.length;
+}
+
+function sourceEngineVersions(sourceLock) {
+  const rows = [];
+  for (const [target, engines] of Object.entries(sourceLock.targets || {})) {
+    for (const [engine, meta] of Object.entries(engines)) {
+      rows.push({ target, engine, version: meta.version, url: meta.url });
+    }
+  }
+  return rows;
+}
+
+function packagedEngineVersions(engineLock) {
+  const rows = [];
+  for (const [target, targetLock] of Object.entries(engineLock.targets || {})) {
+    for (const [engine, meta] of Object.entries(targetLock.engines || {})) {
+      rows.push({ target, engine, version: meta.version });
+    }
+  }
+  return rows;
+}
+
+function checkRows(rows, latestByEngine, latestByTargetEngine = {}) {
+  let outdated = 0;
+  for (const row of rows) {
+    const latest = latestByTargetEngine[`${row.target}:${row.engine}`] || latestByEngine[row.engine];
+    if (!latest) continue;
+    const current = normalizeVersion(row.version);
+    const wanted = normalizeVersion(latest);
+    const status = compareVersions(current, wanted) < 0 ? 'outdated' : 'current';
+    if (status === 'outdated') outdated += 1;
+    console.log(`  ${row.target} ${row.engine}: ${current} -> ${wanted} ${status}`);
+  }
+  return outdated;
+}
+
+async function main() {
+  let outdatedCount = 0;
+
+  outdatedCount += printNpmReport('root npm', npmOutdated(repoRoot));
+  outdatedCount += printNpmReport(
+    'Firefox extension npm',
+    npmOutdated(path.join(repoRoot, 'Extensions', 'Firefox'))
+  );
+
+  const [ytDlp, deno, aria2, ffmpeg, martinRiedlMacArm64Ffmpeg] = await Promise.all([
+    githubLatest('yt-dlp/yt-dlp'),
+    githubLatest('denoland/deno'),
+    githubLatest('aria2/aria2'),
+    latestFfmpegStable(),
+    latestMartinRiedlMacArm64Release(),
+  ]);
+  const latestByEngine = {
+    'yt-dlp': ytDlp.tag_name,
+    deno: deno.tag_name,
+    aria2c: aria2.tag_name,
+    ffmpeg,
+  };
+  const latestByTargetEngine = {
+    'aarch64-apple-darwin:ffmpeg': martinRiedlMacArm64Ffmpeg,
+  };
+
+  console.log('\nlatest engines:');
+  for (const [engine, version] of Object.entries(latestByEngine)) {
+    console.log(`  ${engine}: ${normalizeVersion(version)}`);
+  }
+
+  console.log('\nengine source lock:');
+  outdatedCount += checkRows(
+    sourceEngineVersions(parseJsonFile('engine-sources.lock.json')),
+    latestByEngine,
+    latestByTargetEngine
+  );
+
+  console.log('\npackaged engine lock:');
+  outdatedCount += checkRows(
+    packagedEngineVersions(parseJsonFile('engines.lock.json')),
+    latestByEngine,
+    latestByTargetEngine
+  );
+
+  if (outdatedCount > 0) {
+    console.error(`\n${outdatedCount} outdated item(s) found.`);
+    process.exit(1);
+  }
+  console.log('\nAll checked packages and engines are current.');
+}
+
+main().catch(error => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});

scripts/engine-payload-integrity.js

@@ -0,0 +1,45 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function sha256(file) {
+  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+
+export function collectRegularFiles(root, options = {}) {
+  const ignoredNames = new Set(options.ignoredNames || []);
+  const files = [];
+
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      const relative = path.relative(root, file).split(path.sep).join('/');
+      if (ignoredNames.has(entry.name)) {
+        continue;
+      }
+      if (entry.isSymbolicLink()) {
+        throw new Error(`Unsupported symlink in engine payload: ${relative}`);
+      }
+      if (entry.isDirectory()) {
+        walk(file);
+      } else if (entry.isFile()) {
+        files.push(file);
+      } else {
+        throw new Error(`Unsupported filesystem entry in engine payload: ${relative}`);
+      }
+    }
+  };
+
+  walk(root);
+  return files.sort((left, right) => left.localeCompare(right));
+}
+
+export function treeDigest(root) {
+  const files = collectRegularFiles(root);
+  const digest = crypto.createHash('sha256');
+  for (const file of files) {
+    const relative = path.relative(root, file).split(path.sep).join('/');
+    digest.update(`${relative}\0${sha256(file)}\n`);
+  }
+  return { files: files.length, sha256: digest.digest('hex') };
+}

scripts/engine-payload-integrity.node-test.js

@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { collectRegularFiles, treeDigest } from './engine-payload-integrity.js';
+
+test('collectRegularFiles returns regular files and honors ignored names', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-engine-payload-'));
+  try {
+    fs.mkdirSync(path.join(root, 'nested'));
+    fs.writeFileSync(path.join(root, 'engine'), 'binary');
+    fs.writeFileSync(path.join(root, 'nested', 'runtime.dat'), 'runtime');
+    fs.writeFileSync(path.join(root, 'payload-manifest.json'), '{}');
+
+    const files = collectRegularFiles(root, {
+      ignoredNames: ['payload-manifest.json'],
+    }).map(file => path.relative(root, file).split(path.sep).join('/'));
+
+    assert.deepEqual(files, ['engine', 'nested/runtime.dat']);
+    const digest = treeDigest(path.join(root, 'nested'));
+    assert.equal(digest.files, 1);
+    assert.match(digest.sha256, /^[a-f0-9]{64}$/);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('collectRegularFiles rejects symlinks in engine payloads', { skip: process.platform === 'win32' }, () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-engine-payload-'));
+  try {
+    fs.writeFileSync(path.join(root, 'target'), 'target');
+    fs.symlinkSync('target', path.join(root, 'link'));
+
+    assert.throws(
+      () => collectRegularFiles(root),
+      /Unsupported symlink in engine payload: link/
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

scripts/provision-engines.js

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { collectRegularFiles, sha256 } from './engine-payload-integrity.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+const sourceLock = JSON.parse(
+  fs.readFileSync(path.join(repoRoot, 'engine-sources.lock.json'), 'utf8')
+);
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+const target = argValue('--target')
+  || process.env.FIRELINK_TARGET_TRIPLE
+  || process.env.TAURI_ENV_TARGET_TRIPLE;
+if (!target) {
+  console.error('Pass --target <Rust target triple>.');
+  process.exit(1);
+}
+
+const targetSources = sourceLock.targets?.[target];
+if (!targetSources) {
+  console.error(`No source lock exists for ${target}.`);
+  process.exit(1);
+}
+
+const destination = path.join(repoRoot, 'src-tauri', 'provisioned-engines', target);
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), `firelink-engines-${target}-`));
+const isWindows = target.includes('windows');
+const executableSuffix = isWindows ? '.exe' : '';
+
+async function download(name, source) {
+  const sourcePath = new URL(source.url).pathname;
+  const archive = path.join(
+    temporary,
+    `${name}${sourcePath.endsWith('.tar.xz') ? '.tar.xz' : '.zip'}`
+  );
+  const response = await fetch(source.url, { redirect: 'follow' });
+  if (!response.ok || !response.body) {
+    throw new Error(`Failed to download ${name}: HTTP ${response.status}`);
+  }
+  const output = fs.createWriteStream(archive);
+  const reader = response.body.getReader();
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!output.write(Buffer.from(value))) {
+      await new Promise(resolve => output.once('drain', resolve));
+    }
+  }
+  await new Promise(resolve => output.end(resolve));
+
+  const actual = sha256(archive);
+  if (actual !== source.sha256) {
+    throw new Error(`Archive checksum mismatch for ${name}. Expected ${source.sha256}, got ${actual}`);
+  }
+  const extracted = path.join(temporary, `${name}-extracted`);
+  fs.mkdirSync(extracted);
+  if (archive.endsWith('.zip') && process.platform !== 'win32') {
+    execFileSync('unzip', ['-q', archive, '-d', extracted], { stdio: 'inherit' });
+  } else {
+    execFileSync('tar', ['-xf', archive, '-C', extracted], { stdio: 'inherit' });
+  }
+  return extracted;
+}
+
+function findFile(root, names) {
+  const wanted = new Set(names.map(name => name.toLowerCase()));
+  const matches = [];
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      if (entry.isDirectory()) walk(file);
+      else if (entry.isFile() && wanted.has(entry.name.toLowerCase())) matches.push(file);
+    }
+  };
+  walk(root);
+  if (matches.length !== 1) {
+    throw new Error(`Expected one of [${names.join(', ')}] under ${root}, found ${matches.length}`);
+  }
+  return matches[0];
+}
+
+function copyExecutable(source, engine) {
+  const output = path.join(destination, `${engine}-${target}${executableSuffix}`);
+  fs.copyFileSync(source, output);
+  if (!isWindows) fs.chmodSync(output, 0o755);
+}
+
+function writePayloadManifest() {
+  const files = collectRegularFiles(destination, {
+    ignoredNames: ['payload-manifest.json'],
+  });
+  const manifest = {
+    schemaVersion: 1,
+    target,
+    generatedFrom: Object.fromEntries(
+      Object.entries(targetSources).map(([name, source]) => [
+        name,
+        {
+          version: source.version,
+          url: source.url || source.sourceUrl,
+          sha256: source.sha256 || source.sourceSha256
+        }
+      ])
+    ),
+    files: Object.fromEntries(
+      files.map(file => [
+        path.relative(destination, file).split(path.sep).join('/'),
+        sha256(file)
+      ])
+    )
+  };
+  fs.writeFileSync(
+    path.join(destination, 'payload-manifest.json'),
+    `${JSON.stringify(manifest, null, 2)}\n`
+  );
+}
+
+try {
+  fs.rmSync(destination, { recursive: true, force: true });
+  fs.mkdirSync(destination, { recursive: true });
+
+  const ytdlp = await download('yt-dlp', targetSources['yt-dlp']);
+  copyExecutable(
+    findFile(ytdlp, isWindows ? ['yt-dlp.exe'] : ['yt-dlp_linux']),
+    'yt-dlp'
+  );
+  fs.cpSync(path.join(ytdlp, '_internal'), path.join(destination, '_internal'), {
+    recursive: true,
+    preserveTimestamps: true
+  });
+
+  const deno = await download('deno', targetSources.deno);
+  copyExecutable(findFile(deno, isWindows ? ['deno.exe'] : ['deno']), 'deno');
+
+  const ffmpeg = await download('ffmpeg', targetSources.ffmpeg);
+  copyExecutable(findFile(ffmpeg, isWindows ? ['ffmpeg.exe'] : ['ffmpeg']), 'ffmpeg');
+
+  const aria2 = await download('aria2c', targetSources.aria2c);
+  copyExecutable(findFile(aria2, isWindows ? ['aria2c.exe'] : ['aria2c']), 'aria2c');
+
+  writePayloadManifest();
+  console.log(`Provisioned locked engine payload at ${destination}`);
+} finally {
+  fs.rmSync(temporary, { recursive: true, force: true });
+}

scripts/repack-linux-appimage-engines.js

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { collectRegularFiles, sha256 } from './engine-payload-integrity.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+function mustBeDirectory(directory, label) {
+  if (!fs.existsSync(directory) || !fs.statSync(directory).isDirectory()) {
+    fail(`${label} does not exist or is not a directory: ${directory}`);
+  }
+}
+
+function mustBeFile(file, label) {
+  if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
+    fail(`${label} does not exist or is not a file: ${file}`);
+  }
+}
+
+function findSingleAppImage(directory) {
+  mustBeDirectory(directory, 'AppImage bundle directory');
+  const appImages = fs
+    .readdirSync(directory)
+    .filter(name => name.endsWith('.AppImage'))
+    .map(name => path.join(directory, name));
+
+  if (appImages.length !== 1) {
+    fail(`Expected exactly one AppImage in ${directory}, found ${appImages.length}.`);
+  }
+
+  return appImages[0];
+}
+
+function validatePayloadManifest(root, target, label) {
+  const manifestPath = path.join(root, 'payload-manifest.json');
+  mustBeFile(manifestPath, `${label} payload manifest`);
+
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  } catch (error) {
+    fail(`${label} payload manifest is not valid JSON: ${error.message}`);
+  }
+
+  if (manifest.target !== target) {
+    fail(`${label} payload target mismatch: expected ${target}, got ${manifest.target}`);
+  }
+
+  const expectedFiles = Object.keys(manifest.files || {}).sort();
+  const actualFiles = collectRegularFiles(root, { ignoredNames: ['payload-manifest.json'] })
+    .map(file => path.relative(root, file).split(path.sep).join('/'))
+    .sort();
+
+  if (JSON.stringify(actualFiles) !== JSON.stringify(expectedFiles)) {
+    fail(`${label} payload files do not match payload-manifest.json.`);
+  }
+
+  for (const relative of expectedFiles) {
+    const file = path.join(root, relative);
+    if (sha256(file) !== manifest.files[relative]) {
+      fail(`${label} payload checksum mismatch: ${relative}`);
+    }
+  }
+}
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd ?? repoRoot,
+    env: { ...process.env, ...options.env },
+    stdio: options.stdio ?? 'inherit',
+    encoding: options.stdio === 'pipe' ? 'utf8' : undefined,
+  });
+
+  if (result.error) {
+    fail(`Failed to run ${command}: ${result.error.message}`);
+  }
+
+  if (result.status !== 0) {
+    if (options.stdio === 'pipe') {
+      if (result.stdout) {
+        process.stdout.write(result.stdout);
+      }
+      if (result.stderr) {
+        process.stderr.write(result.stderr);
+      }
+    }
+    fail(`${command} exited with status ${result.status}`);
+  }
+}
+
+const target = argValue('--target') || process.env.FIRELINK_TARGET_TRIPLE || process.env.TAURI_ENV_TARGET_TRIPLE;
+if (!target) {
+  fail('Pass --target <triple>.');
+}
+
+const bundleDirectory = path.join(repoRoot, 'src-tauri', 'target', target, 'release', 'bundle', 'appimage');
+const appDir = path.resolve(argValue('--appdir') || path.join(bundleDirectory, 'Firelink.AppDir'));
+const appImage = path.resolve(argValue('--appimage') || findSingleAppImage(bundleDirectory));
+const appImageTool = path.resolve(argValue('--appimagetool') || process.env.APPIMAGETOOL || 'appimagetool');
+const source = path.join(repoRoot, 'src-tauri', 'provisioned-engines', target);
+const destination = path.join(appDir, 'usr', 'lib', 'Firelink', 'engine-dist', target);
+
+mustBeDirectory(appDir, 'Firelink.AppDir');
+mustBeDirectory(source, 'Provisioned engine payload');
+mustBeFile(appImage, 'AppImage');
+mustBeFile(appImageTool, 'appimagetool');
+
+validatePayloadManifest(source, target, 'Provisioned engine');
+
+fs.rmSync(destination, { recursive: true, force: true });
+fs.mkdirSync(path.dirname(destination), { recursive: true });
+fs.cpSync(source, destination, {
+  recursive: true,
+  dereference: false,
+  preserveTimestamps: true,
+});
+validatePayloadManifest(destination, target, 'AppDir engine');
+
+fs.chmodSync(appImageTool, 0o755);
+run(appImageTool, [appDir, appImage], {
+  env: {
+    APPIMAGE_EXTRACT_AND_RUN: '1',
+    ARCH: 'x86_64',
+  },
+});
+
+const extractRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-appimage-'));
+try {
+  fs.chmodSync(appImage, 0o755);
+  run(appImage, ['--appimage-extract'], {
+    cwd: extractRoot,
+    env: { APPIMAGE_EXTRACT_AND_RUN: '1' },
+    stdio: 'pipe',
+  });
+
+  const extractedPayload = path.join(extractRoot, 'squashfs-root', 'usr', 'lib', 'Firelink', 'engine-dist', target);
+  mustBeDirectory(extractedPayload, 'Extracted AppImage engine payload');
+  validatePayloadManifest(extractedPayload, target, 'Extracted AppImage engine');
+} finally {
+  fs.rmSync(extractRoot, { recursive: true, force: true });
+}
+
+console.log(`Repacked and verified AppImage engine payload for ${target}.`);

scripts/smoke-packaged-app.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+import { execFileSync, spawn } from 'node:child_process';
+import path from 'node:path';
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+const executableArg = argValue('--executable');
+if (!executableArg) {
+  console.error('Pass --executable <path>.');
+  process.exit(1);
+}
+
+const executable = path.resolve(executableArg);
+const assertNoVisibleChildWindows = process.argv.includes('--assert-no-visible-child-windows');
+const child = spawn(executable, [], {
+  cwd: process.env.RUNNER_TEMP || process.env.TMPDIR || process.cwd(),
+  detached: process.platform !== 'win32',
+  env: {
+    ...process.env,
+    FIRELINK_SMOKE_TEST: '1',
+    WEBKIT_DISABLE_COMPOSITING_MODE: '1',
+    GDK_BACKEND: 'x11',
+  },
+  stdio: ['ignore', 'pipe', 'pipe'],
+});
+
+let stderr = '';
+let spawnError = null;
+let readyPort = null;
+
+child.on('error', error => {
+  spawnError = error;
+});
+
+child.on('exit', (code, signal) => {
+  if (readyPort === null) {
+    console.error(`Child exited prematurely with code ${code} signal ${signal}`);
+  }
+});
+
+child.stderr.on('data', data => {
+  stderr += data.toString();
+});
+
+function sleep(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+async function findReadyPort() {
+  for (let attempt = 0; attempt < 200 && readyPort === null; attempt += 1) {
+    if (spawnError) {
+      break;
+    }
+
+    for (let port = 6412; port <= 6422; port += 1) {
+      try {
+        const response = await fetch(`http://127.0.0.1:${port}/ping`);
+        if (response.headers.get('x-firelink-server') === '1') {
+          readyPort = port;
+          break;
+        }
+      } catch {}
+    }
+
+    if (readyPort === null) {
+      await sleep(250);
+    }
+  }
+}
+
+function assertNoVisibleWindows(rootPid) {
+  if (process.platform !== 'win32') {
+    return;
+  }
+
+  const script = `
+$root = ${rootPid}
+$all = Get-CimInstance Win32_Process
+$pending = @($root)
+$descendants = @()
+while ($pending.Count -gt 0) {
+  $parent = $pending[0]
+  if ($pending.Count -eq 1) {
+    $pending = @()
+  } else {
+    $pending = $pending[1..($pending.Count - 1)]
+  }
+
+  $children = @($all | Where-Object { $_.ParentProcessId -eq $parent })
+  foreach ($child in $children) {
+    $descendants += $child.ProcessId
+    $pending += $child.ProcessId
+  }
+}
+
+$visible = foreach ($childPid in $descendants) {
+  $process = Get-Process -Id $childPid -ErrorAction SilentlyContinue
+  if ($process -and $process.MainWindowHandle -ne 0) {
+    "$($process.ProcessName)($childPid)"
+  }
+}
+
+if ($visible.Count -gt 0) {
+  Write-Error "Visible child process windows detected: $($visible -join ', ')"
+  exit 1
+}
+`;
+
+  try {
+    execFileSync('powershell', ['-NoProfile', '-Command', script], {
+      stdio: 'pipe',
+      windowsHide: true,
+    });
+  } catch (error) {
+    const detail = [error.stdout?.toString(), error.stderr?.toString()].filter(Boolean).join('\n').trim();
+    throw new Error(detail || 'Visible child process window check failed.');
+  }
+}
+
+function terminateChild() {
+  if (!child.pid) {
+    return;
+  }
+
+  if (process.platform === 'win32') {
+    spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], {
+      stdio: 'ignore',
+      windowsHide: true,
+    });
+    return;
+  }
+
+  try {
+    process.kill(-child.pid, 'SIGTERM');
+  } catch {
+    child.kill('SIGTERM');
+  }
+}
+
+await findReadyPort();
+
+try {
+  if (readyPort === null) {
+    if (spawnError) {
+      console.error(`Packaged Firelink failed to start: ${spawnError.message}`);
+    } else {
+      console.error(`Packaged Firelink did not expose extension ping endpoint. Stderr:\n${stderr.slice(-1000)}`);
+    }
+    process.exit(1);
+  }
+
+  if (assertNoVisibleChildWindows) {
+    assertNoVisibleWindows(child.pid);
+  }
+
+  console.log(`Packaged Firelink smoke passed on 127.0.0.1:${readyPort}`);
+} finally {
+  terminateChild();
+}

scripts/stage-engines.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { collectRegularFiles, sha256, treeDigest } from './engine-payload-integrity.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+const binariesRoot = path.join(repoRoot, 'src-tauri', 'binaries');
+const outputRoot = path.join(repoRoot, 'src-tauri', 'engine-dist');
+const lock = JSON.parse(fs.readFileSync(path.join(repoRoot, 'engines.lock.json'), 'utf8'));
+
+const archMap = { x64: 'x86_64', arm64: 'aarch64' };
+const platformMap = {
+  darwin: 'apple-darwin',
+  win32: 'pc-windows-msvc',
+  linux: 'unknown-linux-gnu',
+};
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+const hostTarget = `${archMap[os.arch()]}-${platformMap[os.platform()]}`;
+const target = argValue('--target')
+  || process.env.TAURI_ENV_TARGET_TRIPLE
+  || process.env.FIRELINK_TARGET_TRIPLE
+  || hostTarget;
+const isWindowsTarget = target.includes('windows');
+const suffix = isWindowsTarget ? '.exe' : '';
+const engines = ['yt-dlp', 'aria2c', 'ffmpeg', 'deno'];
+const expectedNames = engines.map(engine => `${engine}-${target}${suffix}`);
+const targetLock = lock.targets?.[target];
+
+const configuredSource = process.env.FIRELINK_ENGINE_SOURCE_DIR
+  ? path.resolve(process.env.FIRELINK_ENGINE_SOURCE_DIR)
+  : null;
+const canonicalSource = path.join(binariesRoot, target);
+const provisionedSource = path.join(repoRoot, 'src-tauri', 'provisioned-engines', target);
+const legacyMacSource = target.endsWith('apple-darwin') ? binariesRoot : null;
+const source = [configuredSource, canonicalSource, provisionedSource, legacyMacSource]
+  .filter(Boolean)
+  .find(candidate => expectedNames.every(name => fs.existsSync(path.join(candidate, name))));
+
+if (!source) {
+  console.error(`No complete engine payload found for ${target}.`);
+  console.error(`Expected source directory: ${canonicalSource}`);
+  console.error(`Expected files: ${expectedNames.join(', ')}`);
+  process.exit(1);
+}
+
+if (targetLock) {
+  for (const engine of engines) {
+    const name = `${engine}-${target}${suffix}`;
+    const expected = targetLock.engines?.[engine]?.sha256;
+    const actual = sha256(path.join(source, name));
+    if (!expected || actual !== expected) {
+      console.error(`Checksum mismatch for ${name}. Expected ${expected || 'missing lock'}, got ${actual}.`);
+      process.exit(1);
+    }
+  }
+
+  for (const [runtimeDir, expected] of Object.entries(targetLock.runtimeTrees || {})) {
+    const sourceDir = path.join(source, runtimeDir);
+    if (!fs.existsSync(sourceDir)) {
+      console.error(`Missing locked runtime directory ${runtimeDir} for ${target}.`);
+      process.exit(1);
+    }
+    const actual = treeDigest(sourceDir);
+    if (actual.files !== expected.files || actual.sha256 !== expected.sha256) {
+      console.error(`Runtime checksum mismatch for ${runtimeDir}.`);
+      process.exit(1);
+    }
+  }
+} else {
+  const manifestPath = path.join(source, 'payload-manifest.json');
+  if (!fs.existsSync(manifestPath)) {
+    console.error(`No committed lock or payload manifest exists for ${target}.`);
+    process.exit(1);
+  }
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  if (manifest.target !== target) {
+    console.error(`Payload manifest target mismatch: ${manifest.target}`);
+    process.exit(1);
+  }
+  for (const [relative, expected] of Object.entries(manifest.files || {})) {
+    const file = path.join(source, relative);
+    if (!fs.existsSync(file) || sha256(file) !== expected) {
+      console.error(`Payload manifest mismatch: ${relative}`);
+      process.exit(1);
+    }
+  }
+  const actualFiles = collectRegularFiles(source, {
+    ignoredNames: ['payload-manifest.json'],
+  }).map(file => path.relative(source, file).split(path.sep).join('/'));
+  const expectedFiles = Object.keys(manifest.files || {}).sort();
+  actualFiles.sort();
+  if (JSON.stringify(actualFiles) !== JSON.stringify(expectedFiles)) {
+    console.error(`Payload contains files not covered by manifest for ${target}.`);
+    process.exit(1);
+  }
+}
+
+const destination = path.join(outputRoot, target);
+fs.rmSync(outputRoot, { recursive: true, force: true });
+fs.mkdirSync(destination, { recursive: true });
+
+for (const name of expectedNames) {
+  fs.copyFileSync(path.join(source, name), path.join(destination, name));
+  if (!isWindowsTarget) {
+    fs.chmodSync(path.join(destination, name), 0o755);
+  }
+}
+
+for (const runtimeDir of ['_internal', 'aria2-libs']) {
+  const sourceDir = path.join(source, runtimeDir);
+  if (fs.existsSync(sourceDir)) {
+    fs.cpSync(sourceDir, path.join(destination, runtimeDir), {
+      recursive: true,
+      dereference: false,
+      preserveTimestamps: true,
+    });
+  }
+}
+const payloadManifest = path.join(source, 'payload-manifest.json');
+if (fs.existsSync(payloadManifest)) {
+  fs.copyFileSync(payloadManifest, path.join(destination, 'payload-manifest.json'));
+}
+
+console.log(`Staged Firelink engines for ${target} from ${source}`);

scripts/verify-binaries.js

@@ -0,0 +1,441 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { execFileSync, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+const archMap = { x64: 'x86_64', arm64: 'aarch64' };
+const platformMap = {
+  darwin: 'apple-darwin',
+  win32: 'pc-windows-msvc',
+  linux: 'unknown-linux-gnu',
+};
+
+const currentArch = archMap[os.arch()];
+const currentPlatform = platformMap[os.platform()];
+
+if (!currentArch || !currentPlatform) {
+  console.error(`Unsupported architecture or platform: ${os.arch()} / ${os.platform()}`);
+  process.exit(1);
+}
+
+const targetTriple = argValue('--target')
+  || process.env.FIRELINK_TARGET_TRIPLE
+  || `${currentArch}-${currentPlatform}`;
+const hostTriple = `${currentArch}-${currentPlatform}`;
+const canExecuteTarget = targetTriple === hostTriple;
+const isWindows = targetTriple.includes('windows');
+const isMacOS = targetTriple.includes('apple-darwin');
+const isLinux = targetTriple.includes('linux');
+const ext = isWindows ? '.exe' : '';
+const suffix = `-${targetTriple}${ext}`;
+
+const scriptsDir = __dirname;
+const searchRoot = argValue('--search-root');
+function findEngineRoot(root) {
+  const expected = `yt-dlp-${targetTriple}${ext}`;
+  const matches = [];
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        if (fs.existsSync(path.join(candidate, expected))) matches.push(candidate);
+        walk(candidate);
+      }
+    }
+  };
+  walk(path.resolve(root));
+  if (matches.length !== 1) {
+    throw new Error(`Expected exactly one packaged engine root under ${root}, found ${matches.length}`);
+  }
+  return matches[0];
+}
+
+const configuredRoot = argValue('--root')
+  || (process.argv.includes('--staged')
+    ? path.join(scriptsDir, '..', 'src-tauri', 'engine-dist', targetTriple)
+    : searchRoot
+      ? findEngineRoot(searchRoot)
+      : null);
+const binariesDir = configuredRoot
+  ? path.resolve(configuredRoot)
+  : path.join(scriptsDir, '..', 'src-tauri', 'binaries');
+const requiredEngines = ['yt-dlp', 'aria2c', 'ffmpeg', 'deno'];
+
+const FORBIDDEN_OTOOL_PATHS = ['/opt/homebrew', '/usr/local/Cellar'];
+const FORBIDDEN_STDERR = [
+  'Failed to load Python shared library',
+  'Library not loaded',
+  'image not found',
+  'Connection refused',
+];
+
+let exitCode = 0;
+
+function fail(msg) {
+  console.error(`[FAIL] ${msg}`);
+  exitCode = 1;
+}
+
+function ok(msg) {
+  console.log(`[OK] ${msg}`);
+}
+
+function rejectSymlinks(root, label) {
+  if (!fs.existsSync(root)) {
+    return;
+  }
+
+  let symlinkCount = 0;
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      const relative = path.relative(root, file).split(path.sep).join('/');
+      if (entry.isSymbolicLink()) {
+        fail(`Unsupported symlink in ${label}: ${relative}`);
+        symlinkCount += 1;
+      } else if (entry.isDirectory()) {
+        walk(file);
+      }
+    }
+  };
+
+  walk(root);
+  if (symlinkCount === 0) {
+    ok(`${label} contains no symlinks`);
+  }
+}
+
+function binName(engine) {
+  return `${engine}${suffix}`;
+}
+
+function binPath(engine) {
+  return path.join(binariesDir, binName(engine));
+}
+
+function engineEnv(engine) {
+  if (engine !== 'aria2c') {
+    return process.env;
+  }
+
+  const modulesDir = path.join(binariesDir, 'aria2-libs');
+  if (!fs.existsSync(modulesDir)) {
+    return process.env;
+  }
+
+  return {
+    ...process.env,
+    OPENSSL_MODULES: modulesDir,
+  };
+}
+
+// ───── Check 1: Sidecar existence ─────
+console.log(`\n─── 1. Sidecar existence (${targetTriple}) ───`);
+for (const eng of requiredEngines) {
+  const p = binPath(eng);
+  if (fs.existsSync(p)) {
+    ok(`Found ${binName(eng)}`);
+  } else {
+    fail(`Missing ${binName(eng)}`);
+  }
+}
+
+if (exitCode !== 0) {
+  console.error('\nAborting: missing required sidecars.');
+  process.exit(1);
+}
+
+// ───── Check 2: Executable permission ─────
+console.log('\n─── 2. Executable permission ───');
+for (const eng of requiredEngines) {
+  if (isWindows) {
+    ok(`Executable permission is represented by PE format on Windows: ${binName(eng)}`);
+    continue;
+  }
+  try {
+    fs.accessSync(binPath(eng), fs.constants.X_OK);
+    ok(`Executable ${binName(eng)}`);
+  } catch {
+    fail(`Not executable ${binName(eng)}`);
+  }
+}
+
+// ───── Check 3: file(1) identification ─────
+console.log('\n─── 3. file(1) identification ───');
+for (const eng of requiredEngines) {
+  if (os.platform() === 'win32') {
+    try {
+      const header = fs.readFileSync(binPath(eng)).subarray(0, 2).toString('ascii');
+      if (header === 'MZ') {
+        ok(`${binName(eng)}: Windows PE executable`);
+      } else {
+        fail(`${binName(eng)}: missing Windows PE MZ header`);
+      }
+    } catch (e) {
+      fail(`identify ${binName(eng)}: ${e.message}`);
+    }
+    continue;
+  }
+  try {
+    const out = execFileSync('file', ['--brief', binPath(eng)], {
+      encoding: 'utf-8',
+      timeout: 5000,
+    }).trim();
+    ok(`${binName(eng)}: ${out}`);
+  } catch (e) {
+    fail(`file ${binName(eng)}: ${e.message}`);
+  }
+}
+
+// ───── Check 4 & 5: otool -L linkage (macOS only) ─────
+if (isMacOS) {
+  console.log('\n─── 4 & 5. otool -L linkage check ───');
+  for (const eng of requiredEngines) {
+    const p = binPath(eng);
+    try {
+      const out = execFileSync('otool', ['-L', p], {
+        encoding: 'utf-8',
+        timeout: 10000,
+      });
+      const lines = out
+        .split('\n')
+        .slice(1)
+        .map((l) => l.trim())
+        .filter(Boolean);
+      let hasBad = false;
+      for (const fp of FORBIDDEN_OTOOL_PATHS) {
+        for (const line of lines) {
+          if (line.includes(fp)) {
+            fail(`${binName(eng)} links to '${fp}': ${line}`);
+            hasBad = true;
+          }
+        }
+      }
+      if (!hasBad) {
+        ok(`${binName(eng)}: no local-only dylib paths`);
+      }
+    } catch (e) {
+      fail(`otool -L ${binName(eng)}: ${e.message}`);
+    }
+  }
+}
+
+// ───── Check 6: yt-dlp packaging ─────
+console.log('\n─── 6. yt-dlp packaging ───');
+{
+  const yt = binPath('yt-dlp');
+  if (!fs.existsSync(yt)) {
+    fail('yt-dlp binary not found, cannot verify packaging');
+  } else {
+    const internalDir = path.join(binariesDir, '_internal');
+    const hasInternal = fs.existsSync(internalDir) && fs.statSync(internalDir).isDirectory();
+
+    if (hasInternal) {
+      console.log('  Detected PyInstaller onedir layout (_internal/ present)');
+      let entries;
+      try {
+        entries = fs.readdirSync(internalDir);
+        ok(`_internal/ directory exists with ${entries.length} entries`);
+      } catch (e) {
+        fail(`Cannot read _internal/: ${e.message}`);
+      }
+      rejectSymlinks(internalDir, '_internal/');
+
+      const requiredRuntimeFiles = [
+        path.join(internalDir, 'yt_dlp_ejs', 'yt', 'solver', 'core.min.js'),
+        path.join(internalDir, 'yt_dlp_ejs', 'yt', 'solver', 'lib.min.js'),
+      ];
+      for (const required of requiredRuntimeFiles) {
+        if (fs.existsSync(required)) {
+          ok(`yt-dlp runtime component: ${path.relative(binariesDir, required)}`);
+        } else {
+          fail(`Missing yt-dlp runtime component: ${path.relative(binariesDir, required)}`);
+        }
+      }
+      const runtimeCandidates = isWindows
+        ? fs.readdirSync(internalDir).filter(name => /^python.*\.dll$/i.test(name))
+        : isLinux
+          ? fs.readdirSync(internalDir).filter(name => /^libpython.*\.so/i.test(name) || name === 'Python')
+          : ['Python', 'Python.framework'].filter(name => fs.existsSync(path.join(internalDir, name)));
+      if (runtimeCandidates.length > 0) {
+        ok(`yt-dlp embedded Python runtime: ${runtimeCandidates[0]}`);
+      } else {
+        fail(`Missing embedded Python runtime in ${internalDir}`);
+      }
+    } else {
+      fail('yt-dlp must use the self-contained onedir distribution; onefile adds ~17 seconds to every launch');
+    }
+  }
+}
+
+const aria2LibsDir = path.join(binariesDir, 'aria2-libs');
+if (fs.existsSync(aria2LibsDir) && fs.statSync(aria2LibsDir).isDirectory()) {
+  rejectSymlinks(aria2LibsDir, 'aria2-libs/');
+}
+
+// ───── Check 7, 8 & 9: Engine version self-tests ─────
+console.log('\n─── 7 & 8 & 9. Engine version self-tests ───');
+
+function runEngine(label, engine, args, timeout = 30000) {
+  const p = binPath(engine);
+  if (!fs.existsSync(p)) {
+    fail(`${label} binary not found at ${p}`);
+    return;
+  }
+  let stderr = '';
+  try {
+    const stdout = execFileSync(p, args, {
+      encoding: 'utf-8',
+      env: engineEnv(engine),
+      timeout,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const firstLine = stdout.trim().split('\n')[0];
+    ok(`${label} version: ${firstLine}`);
+  } catch (e) {
+    stderr = e.stderr || '';
+    const stdout = e.stdout || '';
+    const detail = stdout.trim().split('\n')[0] || e.message;
+    fail(`${label} execution failed: ${detail}`);
+  }
+  if (stderr) {
+    for (const pattern of FORBIDDEN_STDERR) {
+      if (stderr.includes(pattern)) {
+        fail(`${label} stderr contains '${pattern}'`);
+      }
+    }
+  }
+}
+
+const coldStartTimeout = isMacOS ? 120000 : 30000;
+if (canExecuteTarget) {
+  runEngine('yt-dlp cold start', 'yt-dlp', ['--version'], coldStartTimeout);
+  runEngine('yt-dlp warm start', 'yt-dlp', ['--version'], 8000);
+  runEngine('ffmpeg cold start', 'ffmpeg', ['-version'], coldStartTimeout);
+  runEngine('deno cold start', 'deno', ['--version'], coldStartTimeout);
+  runEngine('aria2c cold start', 'aria2c', ['--version'], coldStartTimeout);
+  if (isMacOS) {
+    // Unsigned binaries can incur a one-time macOS provenance scan after copying.
+    // Warm checks enforce engine startup performance after that OS validation.
+    runEngine('ffmpeg warm start', 'ffmpeg', ['-version'], 8000);
+    runEngine('deno warm start', 'deno', ['--version'], 8000);
+    runEngine('aria2c warm start', 'aria2c', ['--version'], 8000);
+  }
+} else {
+  console.log(`  Runtime tests skipped on ${hostTriple}; native ${targetTriple} CI runs them.`);
+}
+
+// ───── aria2 RPC smoke test (native target only) ─────
+if (canExecuteTarget) {
+  console.log('\n─── aria2 RPC smoke test ───');
+  await (async function testAria2Rpc() {
+    const p = binPath('aria2c');
+    if (!fs.existsSync(p)) {
+      fail('aria2c binary not found, cannot run RPC test');
+      return;
+    }
+
+    const port = 16801 + (process.pid % 1000);
+    const proc = spawn(p, [
+      '--enable-rpc',
+      `--rpc-listen-port=${port}`,
+      '--rpc-max-request-size=1K',
+      '--quiet',
+      '--console-log-level=error',
+      '--rpc-listen-all=false',
+    ], {
+      env: engineEnv('aria2c'),
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 15000,
+    });
+
+    let rpcStderr = '';
+    proc.stderr.on('data', (d) => {
+      rpcStderr += d.toString();
+    });
+
+    const body = JSON.stringify({
+      jsonrpc: '2.0',
+      id: 'firelink-verify',
+      method: 'aria2.getVersion',
+      params: [],
+    });
+
+    const result = await new Promise((resolve) => {
+      const maxAttempts = 20;
+      let attempts = 0;
+
+      function tryFetch() {
+        attempts++;
+        fetch(`http://127.0.0.1:${port}/jsonrpc`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body,
+        })
+          .then(async (res) => {
+            resolve({ ok: true, data: await res.text() });
+          })
+          .catch(() => {
+            if (attempts >= maxAttempts) {
+              resolve({ ok: false, error: `RPC not ready after ${maxAttempts} attempts` });
+              return;
+            }
+            setTimeout(tryFetch, 300);
+          });
+      }
+
+      tryFetch();
+    });
+
+    // Clean up
+    proc.kill('SIGTERM');
+    setTimeout(() => {
+      try {
+        proc.kill('SIGKILL');
+      } catch {}
+    }, 2000);
+
+    if (result.ok) {
+      try {
+        const resp = JSON.parse(result.data);
+        if (resp?.result?.version) {
+          ok(`aria2 RPC version: ${resp.result.version}`);
+        } else {
+          fail(`aria2 RPC unexpected response: ${result.data}`);
+        }
+      } catch (e) {
+        fail(`aria2 RPC parse error: ${e.message}`);
+      }
+    } else {
+      fail(result.error);
+    }
+
+    if (rpcStderr) {
+      for (const pattern of FORBIDDEN_STDERR) {
+        if (rpcStderr.includes(pattern)) {
+          fail(`aria2 RPC stderr contains '${pattern}'`);
+        }
+      }
+    }
+  })();
+}
+
+// ───── Result ─────
+console.log('');
+if (exitCode !== 0) {
+  console.error(`[FAIL] ${exitCode} engine verification check(s) failed.`);
+  process.exit(1);
+} else {
+  console.log('[PASS] All engine verification checks passed.');
+  process.exit(0);
+}

src-tauri/.gitignore

@@ -0,0 +1,7 @@
+# Generated by Cargo
+# will have compiled files and executables
+/target/
+
+# Generated by Tauri
+# will have schema files for capabilities auto-completion
+/gen/schemas

src-tauri/Cargo.toml

@@ -0,0 +1,68 @@
+[package]
+name = "firelink"
+version = "1.0.0"
+description = "A fast cross-platform desktop download manager powered by Rust and Tauri"
+authors = ["NimBold"]
+edition = "2021"
+license = "MIT"
+repository = "https://github.com/nimbold/Firelink"
+homepage = "https://github.com/nimbold/Firelink"
+keywords = ["download-manager", "tauri", "aria2", "yt-dlp", "ffmpeg"]
+categories = ["network-programming"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[lib]
+# The `_lib` suffix may seem redundant but it is necessary
+# to make the lib name unique and wouldn't conflict with the bin name.
+# This seems to be only an issue on Windows, see https://github.com/rust-lang/cargo/issues/8519
+name = "firelink_lib"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+tauri = { version = "2", features = ["macos-private-api", "tray-icon", "image-png", "test"] }
+tauri-plugin-opener = "2"
+tauri-plugin-dialog = "2"
+tauri-plugin-shell = "2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tokio = { version = "1", features = ["fs", "process", "io-util", "rt", "rt-multi-thread", "macros", "sync", "time"] }
+regex = "1.10"
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "stream"] }
+uuid = { version = "1", features = ["v4"] }
+ts-rs = { version = "12", features = ["serde-compat", "uuid-impl"] }
+tauri-plugin-notification = "2.3.3"
+sysinfo = "0.39.3"
+hmac = "0.12"
+sha2 = "0.10"
+tauri-plugin-deep-link = "2"
+tauri-plugin-single-instance = { version = "2", features = ["deep-link"] }
+tempfile = "3"
+thiserror = "2.0.18"
+axum = "0.8.9"
+tower-http = { version = "0.6.11", features = ["cors"] }
+sysproxy = "0.3.0"
+semver = "1.0.28"
+keepawake = "0.6.0"
+system_shutdown = "4.1.0"
+tokio-tungstenite = "0.29.0"
+futures-util = { version = "0.3.32", features = ["sink"] }
+chrono = "0.4.38"
+url = "2"
+rusqlite = { version = "0.40.1", features = ["bundled"] }
+log = "0.4.32"
+tauri-plugin-log = "2"
+trash = "5"
+async-trait = "0.1"
+[target.'cfg(target_os = "macos")'.dependencies]
+objc = "0.2.7"
+keyring = { version = "3", features = ["apple-native"] }
+
+[target.'cfg(target_os = "windows")'.dependencies]
+keyring = { version = "3", features = ["windows-native"] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+keyring = { version = "3", features = ["sync-secret-service", "vendored"] }

src-tauri/binaries/_internal/Python.framework/Resources/Info.plist

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleName</key>
+	<string>Python</string>
+	<key>CFBundleIdentifier</key>
+	<string>org.python.python</string>
+	<key>CFBundleVersion</key>
+	<string>3.14.5</string>
+	<key>CFBundlePackageType</key>
+	<string>FMWK</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleExecutable</key>
+	<string>Python</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleShortVersionString</key>
+	<string>3.14.5</string>
+	<key>CFBundleSupportedPlatforms</key>
+	<array>
+		<string>MacOSX</string>
+	</array>
+	<key>NSHumanReadableCopyright</key>
+	<string>Copyright © 2001 Python Software Foundation. All rights reserved.</string>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleAllowMixedLocalizations</key>
+	<true/>
+</dict>
+</plist>

src-tauri/binaries/_internal/Python.framework/Versions/3.14/Resources/Info.plist

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleName</key>
+	<string>Python</string>
+	<key>CFBundleIdentifier</key>
+	<string>org.python.python</string>
+	<key>CFBundleVersion</key>
+	<string>3.14.5</string>
+	<key>CFBundlePackageType</key>
+	<string>FMWK</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleExecutable</key>
+	<string>Python</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleShortVersionString</key>
+	<string>3.14.5</string>
+	<key>CFBundleSupportedPlatforms</key>
+	<array>
+		<string>MacOSX</string>
+	</array>
+	<key>NSHumanReadableCopyright</key>
+	<string>Copyright © 2001 Python Software Foundation. All rights reserved.</string>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleAllowMixedLocalizations</key>
+	<true/>
+</dict>
+</plist>

src-tauri/binaries/_internal/Python.framework/Versions/Current/Resources/Info.plist

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleName</key>
+	<string>Python</string>
+	<key>CFBundleIdentifier</key>
+	<string>org.python.python</string>
+	<key>CFBundleVersion</key>
+	<string>3.14.5</string>
+	<key>CFBundlePackageType</key>
+	<string>FMWK</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleExecutable</key>
+	<string>Python</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleShortVersionString</key>
+	<string>3.14.5</string>
+	<key>CFBundleSupportedPlatforms</key>
+	<array>
+		<string>MacOSX</string>
+	</array>
+	<key>NSHumanReadableCopyright</key>
+	<string>Copyright © 2001 Python Software Foundation. All rights reserved.</string>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleAllowMixedLocalizations</key>
+	<true/>
+</dict>
+</plist>