chore(release): prepare Firelink 1.0.0

Add aria2 control epochs so delayed resume workers cannot unpause a transfer after a newer pause, remove, or reconfigure command wins.

Thread captured cookies into yt-dlp media runs, sanitize yt-dlp config values, reject malformed media headers, and preserve resumable media artifacts across transient retry backoff.

Cover the new queue epoch and media helper behavior with focused regression tests.

.github/workflows/ci.yml

@@ -0,0 +1,80 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  frontend:
+    name: Frontend checks
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: node --test scripts/*.node-test.js
+      - run: npm test -- --run
+      - run: npm run build
+
+  desktop:
+    name: Desktop checks (${{ matrix.target }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+          - os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - name: Install Linux dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            libdbus-1-dev \
+            pkg-config
+      - run: npm ci
+      - name: Test Rust backend
+        if: runner.os != 'Windows'
+        working-directory: src-tauri
+        run: cargo test --all-targets --target ${{ matrix.target }}
+      - name: Test Rust backend
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: |
+          cargo test --tests --target ${{ matrix.target }}
+          cargo test --lib --no-run --target ${{ matrix.target }}
+      - name: Provision locked engines
+        if: runner.os != 'macOS'
+        run: node scripts/provision-engines.js --target ${{ matrix.target }}
+      - name: Stage and verify engines
+        run: |
+          node scripts/stage-engines.js --target ${{ matrix.target }}
+          node scripts/verify-binaries.js --staged --target ${{ matrix.target }}

.github/workflows/release.yml

@@ -2,126 +2,160 @@ name: Release
 
 on:
   push:
-    tags:
-      - "v*"
+    tags: ['v*']
   workflow_dispatch:
     inputs:
-      version:
-        description: "Release version, for example 0.1.0"
-        required: true
-        default: "0.1.0"
+      publish_release:
+        description: 'Publish the GitHub release after all platform QA is certified'
+        type: boolean
+        default: false
+      certified_cross_platform:
+        description: 'Confirm Windows, Linux, and macOS clean-machine QA passed'
+        type: boolean
+        default: false
 
 permissions:
   contents: write
 
 jobs:
-  macos-arm64-dmg:
-    name: Build macOS ARM64 DMG
-    runs-on: macos-26
-
+  build:
+    name: Build ${{ matrix.label }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: macOS-arm64
+            os: macos-26
+            target: aarch64-apple-darwin
+            bundles: app,dmg
+            artifact: src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/*.dmg
+          - label: Windows-x64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+            bundles: nsis
+            artifact: src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
+          - label: Linux-x64-AppImage
+            os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            bundles: appimage
+            artifact: src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage
+    runs-on: ${{ matrix.os }}
     steps:
-      - name: Check out repository
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
-
-      - name: Resolve version
-        id: version
-        shell: bash
-        run: |
-          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
-            VERSION="${GITHUB_REF_NAME#v}"
-            TAG_NAME="${GITHUB_REF_NAME}"
-          else
-            VERSION="${{ inputs.version }}"
-            TAG_NAME="v${VERSION}"
-          fi
-
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"
-          echo "Version: $VERSION"
-
-      - name: Show build environment
-        run: |
-          uname -a
-          swift --version
-          xcodebuild -version
-          xcode-select -p
-          xcrun --sdk macosx --show-sdk-version
-
-      - name: Verify macOS 26 SDK
-        shell: bash
-        run: |
-          SDK_VERSION="$(xcrun --sdk macosx --show-sdk-version)"
-          SDK_MAJOR="${SDK_VERSION%%.*}"
-
-          if [[ "$SDK_MAJOR" != "26" ]]; then
-            echo "Expected macOS 26 SDK, got macOS $SDK_VERSION" >&2
-            exit 1
-          fi
-
-      - name: Install dependencies
-        run: brew install aria2 dylibbundler
-
-      - name: Fetch media engines
-        run: |
-          mkdir -p Sources/Firelink
-
-          # Download the one-folder macOS build. The direct one-file binary is not code-signable.
-          curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos.zip -o yt-dlp.zip
-          mkdir -p yt-dlp-macos
-          unzip -q -o yt-dlp.zip -d yt-dlp-macos
-          mv yt-dlp-macos/yt-dlp_macos Sources/Firelink/yt-dlp
-          cp -R yt-dlp-macos/_internal Sources/Firelink/_internal
-          rm -rf yt-dlp.zip yt-dlp-macos
-          chmod +x Sources/Firelink/yt-dlp
-
-          # Download latest FFmpeg release build for macOS ARM64 from Martin Riedl's build server
-          curl -fsSL "https://ffmpeg.martin-riedl.de/redirect/latest/macos/arm64/release/ffmpeg.zip" -o ffmpeg.zip
-          unzip -q -o ffmpeg.zip -d Sources/Firelink
-          rm ffmpeg.zip
-          chmod +x Sources/Firelink/ffmpeg
-          test -x Sources/Firelink/yt-dlp
-          test -x Sources/Firelink/ffmpeg
-
-      - name: Build app bundle
-        env:
-          MARKETING_VERSION: ${{ steps.version.outputs.version }}
-          BUILD_NUMBER: ${{ github.run_number }}
-        run: Scripts/create_app_bundle.sh
-
-      - name: Verify ARM64 binary
-        run: |
-          file build/Firelink.app/Contents/MacOS/Firelink
-          lipo -archs build/Firelink.app/Contents/MacOS/Firelink | grep -qx arm64
-          codesign --verify --deep build/Firelink.app
-
-      - name: Create DMG
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-          ARCH: arm64
-        run: Scripts/create_dmg.sh
-
-      - name: Upload workflow artifact
-        uses: actions/upload-artifact@v7
+      - uses: actions/setup-node@v6
         with:
-          name: Firelink-${{ steps.version.outputs.version }}-mac-arm64-dmg
-          path: dist/*.dmg
-          if-no-files-found: error
-
-      - name: Publish GitHub release
-        if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
-        env:
-          GH_TOKEN: ${{ github.token }}
+          node-version: 22
+          cache: npm
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - name: Install Linux dependencies
+        if: runner.os == 'Linux'
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          TAG_NAME="${{ steps.version.outputs.tag_name }}"
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            appstream \
+            curl \
+            patchelf \
+            libdbus-1-dev \
+            pkg-config \
+            xvfb \
+            libtinfo5
+      - run: npm ci
+      - name: Provision locked engines
+        if: runner.os != 'macOS'
+        run: node scripts/provision-engines.js --target ${{ matrix.target }}
+      - name: Build package
+        run: npm run tauri build -- -vv --target ${{ matrix.target }} --bundles ${{ matrix.bundles }}
+        env:
+          APPIMAGE_EXTRACT_AND_RUN: 1
+          FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE: ${{ runner.os == 'Linux' && '1' || '' }}
+      - name: Install pinned appimagetool (Linux only)
+        if: runner.os == 'Linux'
+        env:
+          APPIMAGETOOL_URL: https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
+          APPIMAGETOOL_SHA256: a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0
+        run: |
+          curl -fsSL "$APPIMAGETOOL_URL" -o "$RUNNER_TEMP/appimagetool"
+          echo "$APPIMAGETOOL_SHA256  $RUNNER_TEMP/appimagetool" | sha256sum -c -
+          chmod +x "$RUNNER_TEMP/appimagetool"
+      - name: Repack AppImage with engines (Linux only)
+        if: runner.os == 'Linux'
+        run: node scripts/repack-linux-appimage-engines.js --target ${{ matrix.target }} --appimagetool "$RUNNER_TEMP/appimagetool"
+      - name: Verify macOS packaged engines and launch
+        if: runner.os == 'macOS'
+        run: |
+          APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app"
+          node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }}
+          node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
+      - name: Verify Windows installer payload and launch
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $installer = Get-ChildItem "src-tauri/target/${{ matrix.target }}/release/bundle/nsis/*.exe" | Select-Object -First 1
+          if (-not $installer) { throw "Windows NSIS installer artifact was not produced." }
+          $extractRoot = "$env:RUNNER_TEMP/firelink-installer"
+          Remove-Item -Recurse -Force $extractRoot -ErrorAction SilentlyContinue
+          7z x $installer.FullName "-o$extractRoot" -y
+          node scripts/verify-binaries.js --search-root "$extractRoot" --target ${{ matrix.target }}
+          $installRoot = "$env:RUNNER_TEMP\FirelinkSmoke"
+          Remove-Item -Recurse -Force $installRoot -ErrorAction SilentlyContinue
+          $install = Start-Process -FilePath $installer.FullName -ArgumentList @("/S", "/D=$installRoot") -Wait -PassThru
+          if ($install.ExitCode -ne 0) { throw "Silent NSIS install failed with exit code $($install.ExitCode)." }
+          $exe = $null
+          foreach ($attempt in 1..60) {
+            $exe = Get-ChildItem $installRoot -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -ieq "firelink.exe" } | Sort-Object FullName | Select-Object -First 1
+            if ($exe) { break }
+            Start-Sleep -Seconds 1
+          }
+          if (-not $exe) { throw "firelink.exe was not found under $installRoot after silent install." }
+          node scripts/smoke-packaged-app.js --executable $exe.FullName --assert-no-visible-child-windows
+      - name: Verify Linux AppImage payload and launch
+        if: runner.os == 'Linux'
+        run: |
+          APPIMAGE="$(find src-tauri/target/${{ matrix.target }}/release/bundle/appimage -name '*.AppImage' -print -quit)"
+          chmod +x "$APPIMAGE"
+          (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/$APPIMAGE" --appimage-extract >/dev/null)
+          node scripts/verify-binaries.js --search-root "$RUNNER_TEMP/squashfs-root" --target ${{ matrix.target }}
+          xvfb-run -a node scripts/smoke-packaged-app.js --executable "$RUNNER_TEMP/squashfs-root/AppRun"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: Firelink-${{ matrix.label }}-${{ github.ref_name }}
+          path: ${{ matrix.artifact }}
+          if-no-files-found: error
+          retention-days: 3
+
+  publish:
+    name: Publish GitHub release
+    if: >-
+      github.event_name == 'workflow_dispatch' &&
+      startsWith(github.ref, 'refs/tags/v') &&
+      inputs.publish_release &&
+      inputs.certified_cross_platform
+    needs: build
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
+        with:
+          path: release-assets
+          merge-multiple: true
+      - name: Extract changelog release notes
+        shell: bash
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
           awk '/^## \['"$VERSION"'\]/{flag=1; next} /^## \[/{if(flag) exit} flag' CHANGELOG.md > release_notes.md
           test -s release_notes.md
-
-          if gh release view "$TAG_NAME" >/dev/null 2>&1; then
-            gh release upload "$TAG_NAME" dist/*.dmg --clobber
-            gh release edit "$TAG_NAME" --notes-file release_notes.md
-          else
-            gh release create "$TAG_NAME" dist/*.dmg --title "$TAG_NAME" --notes-file release_notes.md --verify-tag
-          fi
+      - name: Generate checksums
+        run: |
+          cd release-assets
+          find . -type f -print0 | sort -z | xargs -0 sha256sum > SHA256SUMS
+      - uses: softprops/action-gh-release@v3
+        with:
+          files: release-assets/**
+          body_path: release_notes.md

.gitignore

@@ -1,18 +1,63 @@
+# OS and editor files
 .DS_Store
-.build/
-build/
-dist/
-*.dmg
-DerivedData/
+skills-lock.json
+.idea/
 .vscode/
+*.suo
+*.sw?
 *.xcuserdata/
 *.xcuserstate
 
-# Local secrets and exported signing keys
+# Local agent and planning notes
+AGENT.md
+AGENTS.md
+CLAUDE.md
+GEMINI.md
+implementation_plan.md
+CROSS_PLATFORM_CHECKLIST.md
+Cross-platform-checklist-gemini.MD
+YouTube_media_download_handoff.md
+
+# Frontend output and logs
+node_modules/
+dist/
+dist-ssr/
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+*.local
+
+# Rust and Tauri output
+target/
+src-tauri/target/
+src-tauri/gen/
+src-tauri/engine-dist/
+src-tauri/provisioned-engines/
+
+# Locally provisioned native engines
+src-tauri/binaries/aria2c
+src-tauri/binaries/deno
+src-tauri/binaries/ffmpeg
+src-tauri/binaries/yt-dlp
+
+# Packaged artifacts
+build/
+*.dmg
+*.AppImage
+*.deb
+*.msi
+*.exe
+
+# Local secrets and signing material
 .env
 .env.*
 *.key
 *.pem
+!src-tauri/binaries/_internal/certifi/cacert.pem
 *.p8
 *.p12
 *.cer
@@ -22,9 +67,17 @@ sparkle_private_key*
 SparklePrivateKey*
 private-key*
 private_key*
-yt-dlp
-ffmpeg
-Sources/Firelink/_internal/
-!Sources/Firelink/_internal/
-Sources/Firelink/_internal/*
-!Sources/Firelink/_internal/.gitkeep
+
+# Legacy Swift build output and downloaded engines
+legacy/swift/.build/
+legacy/swift/DerivedData/
+legacy/swift/Sources/Firelink/*-version.txt
+legacy/swift/Sources/Firelink/yt-dlp
+legacy/swift/Sources/Firelink/deno
+legacy/swift/Sources/Firelink/ffmpeg
+legacy/swift/Sources/Firelink/aria2c
+legacy/swift/Sources/Firelink/_internal/*
+legacy/swift/Sources/Firelink/aria2-libs/
+legacy/swift/Sources/Firelink/aria2-licenses/
+legacy/swift/Sources/Firelink/aria2-cacert.pem
+!legacy/swift/Sources/Firelink/_internal/.gitkeep

CHANGELOG.md

@@ -1,10 +1,110 @@
 # Changelog
 
-All notable changes to this project will be documented in this file.
+All notable changes to Firelink will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.0] - 2026-07-04
+
+### Highlights
+- Firelink is now a cross-platform desktop download manager built with Rust, Tauri, React, and TypeScript.
+- macOS, Windows, and Linux release builds are prepared through native GitHub Actions runners.
+- The older macOS-only Swift app has been removed from the active product and replaced by the new desktop app.
+
+### New
+- Add full browser-to-desktop integration through Firelink Companion, including signed local requests, desktop identity checks, and automatic-capture protection.
+- Add a complete Add window for links captured from the browser, pasted manually, or extracted from media pages.
+- Add segmented direct downloads, media downloads, queue controls, scheduling, speed limits, and duplicate handling.
+- Add persistent downloads, categories, save-location settings, site logins, and safe redownload behavior.
+- Add native tray controls, notifications, completion sounds, sleep prevention, file reveal/open/trash actions, and OS keychain support where available.
+- Add built-in diagnostics for media engines, app logs, packaged-engine validation, and release smoke checks.
+
+### Improved
+- Rework the main window, settings, logs, Add window, download list, toasts, context menus, and table interactions for the new desktop interface.
+- Improve media extraction with better YouTube metadata loading, format filtering, size estimates, output names, progress, retries, and cleanup.
+- Improve download reliability on rate-limited servers, servers with broken range support, interrupted app sessions, and queue-concurrency changes.
+- Improve extension captures so browser downloads are resumed unless Firelink confirms the handoff.
+- Improve cross-platform packaging by bundling target-specific aria2, yt-dlp, FFmpeg, and Deno payloads.
+- Improve privacy by avoiding startup keychain prompts, redacting secrets from local persistence, and narrowing when browser cookies are forwarded.
+
+### Fixed
+- Fix stuck queued/downloading/completed states, stale aria2 dispatches, queue shrink behavior, retry caps, scheduler actions, and post-queue system actions.
+- Fix many Windows, Linux, and macOS packaging issues, including hidden helper consoles, AppImage engine handling, installer validation, and smoke-test timing.
+- Fix media child-process cleanup so paused, canceled, failed, or removed downloads do not leave stray processes or partial files behind.
+- Fix UI hangs, overflow, sorting, selection, animation, and contrast issues across the main list, Add window, settings, and log viewer.
+- Fix security issues around local server authentication, request signing, replay protection, private IP metadata checks, path ownership, header sanitization, and command execution boundaries.
+
+### Notes
+- This is a major release from `0.7.3`. Older Firelink Companion builds are not compatible with every 1.0 capture path; update the extension together with the desktop app.
+- macOS builds are unsigned and not notarized. Windows builds are unsigned. See [RELEASE.md](RELEASE.md) for distribution details.
+
+## [0.7.3] - 2026-06-11
+
+### New Features & Improvements
+- Add Deno to about credits and engines list.
+- Enhance speed and ETA display logic during pause and drop.
+- Accumulate track sizes to present a unified overall progress bar.
+
+### Fixes
+- Resolve unknown speed flickering and ultra-wide high-resolution detection.
+- Emit distinct status messages for individual tracks during download.
+- Pad overall progress total for first track to prevent 100% snapback.
+
+## [0.7.2] - 2026-06-11
+
+### Fixed
+- Prevented yt-dlp and JavaScript child processes from keeping metadata fetches or canceled downloads alive indefinitely.
+- Replaced the repeatedly extracted one-file yt-dlp build with a stable prewarmed runtime cache.
+- Bundled Deno so YouTube JavaScript challenges and formats above 720p do not depend on system-installed tools.
+- Stopped masking empty-format extraction failures and removed brittle forced YouTube client selection.
+
+### Changed
+- Pinned and checksum-verified yt-dlp, Deno, FFmpeg, aria2, and aria2's libraries for matching local and GitHub Actions builds.
+- Removed aria2's runtime dependency on Homebrew and configured its bundled CA certificate for direct and yt-dlp-delegated HTTPS downloads.
+- Added bounded network retries and optional aria2c acceleration for large direct media downloads.
+
+## [0.7.1] - 2026-06-11
+
+### Fixes
+- Increased the `yt-dlp` metadata extraction timeout to 120 seconds to properly handle YouTube's new JavaScript Proof-of-Work bot protection challenges.
+- Improved the `AddDownloadsView` UI to display the exact underlying error message during extraction failures rather than a generic masked string.
+
+### Security Fixes
+- Addressed multiple vulnerabilities identified in the v0.7.0 security audit.
+- Moved `yt-dlp` credential passing from CLI arguments to secure temporary configuration files to prevent process list leakage.
+- Enforced strict `0o600` POSIX permissions on `aria2c` temporary configuration files to protect generated RPC secrets.
+- Replaced the unauthenticated local connection protocol with a secure HMAC-SHA256 signature validation.
+- Excluded sensitive properties like `rpcSecret` and `rpcPort` from `DownloadItem` serialization so they are never saved to disk in plaintext.
+- Mitigated SSRF (Server-Side Request Forgery) by strictly validating metadata fetch requests against private IP addresses and loopback ranges.
+- Prevented potential path traversal vulnerabilities by validating destination file URLs during duplicate resolution.
+- Sanitized custom HTTP headers to prevent CR/LF injection vectors.
+- Re-architected `aria2c` port-finding with POSIX sockets to eliminate a known race-condition window.
+- Applied rate-limiting and text length bounds to the custom `firelink://` scheme to mitigate DoS and injection attempts.
+
+### Fixes
+- Fixed a metadata extraction timeout when downloading from YouTube by preventing child processes from holding process pipes open.
+- Resolved an issue to correctly assign filenames for auto-captured downloads.
+- Restored the UUID fallback for token generation to prevent silent failures if secure random byte generation fails.
+- Hardened local API security by immediately rejecting requests if the expected pairing token is completely empty.
+- Implemented a thread-safe cleanup mechanism for temporary directories to resolve a concurrency race condition during engine cancellation.
+
+## [0.7.0] - 2026-06-11
+
+### New Features & Improvements
+- Complete UI modernization for the context menu, toolbar, download list, and sidebar to adhere strictly to Apple's Human Interface Guidelines (HIG).
+- Overhaul of the Settings panes including Site Logins, Engine, About, Locations, and Downloads for a unified, cleaner look.
+- Introduce an "Ask where to save" global configuration option for manual location picking per download.
+- Add "Stop Time" option to the Scheduler and unit picker for the global Speed Limiter.
+- Enhance the Integration pane with a visible step counter and an up-to-date status icon.
+- Optimize `yt-dlp` execution for noticeably faster media extraction speeds.
+- Defer Keychain access prompts and track executable modification dates for a more secure "priming" mechanism.
+
+### Fixes
+- Fix issues regarding proxy environment propagation into media download processes.
+- Resolve multiple critical bugs related to configuration storage and download stability.
+- Address multiple underlying issues identified during comprehensive code reviews to improve overall resilience.
+
 ## [0.6.6] - 2026-06-10
 
 ### New Features
@@ -257,7 +357,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.4.0] - 2026-06-03
 
 ### Changes
-- Reorganized Settings sections so related download preferences sit together and app diagnostics live under App.
+- Reorganized Settings sections so related download preferences sit together and app logs live under App.
 - Hardened the release workflow with explicit macOS 26 SDK checks, newer GitHub Actions, and app signature verification.
 - Prefer the bundled `aria2c` binary inside release builds.
 

Makefile

@@ -1,24 +0,0 @@
-.PHONY: build app dmg release run verify clean
-
-build:
-	swift build -c release
-
-app:
-	Scripts/create_app_bundle.sh
-
-dmg: app
-	Scripts/create_dmg.sh
-
-release:
-	Scripts/create_app_bundle.sh
-	Scripts/create_dmg.sh
-
-run:
-	swift run Firelink
-
-verify:
-	Scripts/verify.sh
-
-clean:
-	swift package clean
-	rm -rf build dist

Package.swift

@@ -1,29 +0,0 @@
-// swift-tools-version: 6.0
-
-import PackageDescription
-
-let package = Package(
-    name: "Firelink",
-    platforms: [
-        .macOS(.v14)
-    ],
-    products: [
-        .executable(name: "Firelink", targets: ["Firelink"])
-    ],
-    dependencies: [],
-    targets: [
-        .executableTarget(
-            name: "Firelink",
-            dependencies: [],
-            path: "Sources/Firelink",
-            exclude: [
-                "_internal"
-            ],
-            resources: [
-                .process("Assets.xcassets"),
-                .copy("yt-dlp"),
-                .copy("ffmpeg")
-            ]
-        )
-    ]
-)

README.md

@@ -1,93 +1,172 @@
 <div align="center">
-  <img src="Resources/AppIcon.png" alt="Firelink Icon" width="128" height="128" />
-  <h1>Firelink</h1>
-  <p><strong>The modern, blazing-fast download manager built natively for Apple Silicon macOS.</strong></p>
+  <img src="src/assets/app-icon.png" alt="Firelink" width="112" height="112" />
 
-  <a href="https://swift.org"><img src="https://img.shields.io/badge/Swift-6.0-orange?logo=swift&logoColor=white" alt="Swift Version" /></a>
-  <a href="https://apple.com"><img src="https://img.shields.io/badge/macOS-14.0%2B-blue?logo=apple&logoColor=white" alt="Platform Support" /></a>
-  <a href="https://aria2.github.io/"><img src="https://img.shields.io/badge/Engine-aria2c-red?logo=terminal&logoColor=white" alt="Engine" /></a>
-  <a href="https://github.com/yt-dlp/yt-dlp"><img src="https://img.shields.io/badge/Engine-yt--dlp-red?logo=youtube&logoColor=white" alt="yt-dlp Engine" /></a>
-  <a href="https://ffmpeg.org/"><img src="https://img.shields.io/badge/Engine-ffmpeg-red?logo=ffmpeg&logoColor=white" alt="ffmpeg Engine" /></a>
-  <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green" alt="License" /></a>
+  # Firelink
+
+  **A fast, focused desktop download manager for macOS, Windows, and Linux.**
+
+  [![Version](https://img.shields.io/badge/version-1.0.0-6f42c1?style=flat-square)](https://github.com/nimbold/Firelink/releases)
+  [![macOS](https://img.shields.io/badge/macOS-111111?style=flat-square&logo=apple&logoColor=white)](#platforms)
+  [![Windows](https://img.shields.io/badge/Windows-0078D6?style=flat-square&logo=windows11&logoColor=white)](#platforms)
+  [![Linux](https://img.shields.io/badge/Linux-FCC624?style=flat-square&logo=linux&logoColor=black)](#platforms)
+  [![Tauri](https://img.shields.io/badge/Tauri-2-24C8DB?style=flat-square&logo=tauri&logoColor=white)](https://tauri.app/)
+  [![Rust](https://img.shields.io/badge/Rust-backend-000000?style=flat-square&logo=rust)](https://www.rust-lang.org/)
+  [![React](https://img.shields.io/badge/React-TypeScript-61DAFB?style=flat-square&logo=react&logoColor=111111)](https://react.dev/)
+  [![License](https://img.shields.io/github/license/nimbold/Firelink?style=flat-square)](LICENSE)
+  [![CI](https://img.shields.io/github/actions/workflow/status/nimbold/Firelink/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/nimbold/Firelink/actions/workflows/ci.yml)
+
+  [Features](#features) · [Install](#installation) · [Browser Extension](#browser-extension) · [Development](#development) · [Release Notes](CHANGELOG.md)
 </div>
 
----
-
-**Firelink** reimagines macOS file downloading by wrapping legendary open-source engines (`aria2c`, `yt-dlp`, and `ffmpeg`) in a beautifully crafted, highly polished SwiftUI interface. Enjoy high-speed segmented downloads, native media extraction, seamless browser integration, and intelligent file organization without compromising on the aesthetics of your Mac.
-
----
-
-## 📸 Screenshots
-
-<div align="center">
-  <img src="Resources/Screenshots/Dark/MainPage.png" alt="Firelink main window" width="32%" />
-  <img src="Resources/Screenshots/Dark/AddWindow.png" alt="Add downloads window" width="32%" />
-  <img src="Resources/Screenshots/Dark/Settings.png" alt="Settings" width="32%" />
-  <br/>
-  <sub>A premium native experience, from batch linking to advanced settings.</sub>
-</div>
-
-<details>
-<summary><b>Light Theme Screenshots</b></summary>
 <br/>
 
 <div align="center">
-  <img src="Resources/Screenshots/Light/MainPage.png" alt="Firelink main window light theme" width="32%" />
-  <img src="Resources/Screenshots/Light/AddWindow.png" alt="Add downloads window light theme" width="32%" />
-  <img src="Resources/Screenshots/Light/Settings.png" alt="Settings light theme" width="32%" />
+  <img src="Screenshots/Dark%20theme%20-%20main.png" width="24%" alt="Firelink dark theme main window" />
+  <img src="Screenshots/Dark%20theme%20-%20add%20window.png" width="24%" alt="Firelink dark theme add window" />
+  <img src="Screenshots/Light%20theme%20-%20main.png" width="24%" alt="Firelink light theme main window" />
+  <img src="Screenshots/Light%20theme%20-%20add%20window.png" width="24%" alt="Firelink light theme add window" />
+
+  <details>
+    <summary><b>View more screenshots</b></summary>
+    <br/>
+    <img src="Screenshots/Dark%20theme%20-%20settings.png" width="32%" alt="Firelink dark theme settings" />
+    <img src="Screenshots/Light%20theme%20-%20settings.png" width="32%" alt="Firelink light theme settings" />
+  </details>
 </div>
 
-</details>
+## Why Firelink
 
----
+Firelink is built for people who want a real desktop download manager again: fast segmented transfers, browser capture, media extraction, scheduling, recovery, and clear control over where files land. Version 1.0.0 completes the move from the earlier macOS-only Swift app to a modern Rust/Tauri application with a React and TypeScript interface.
 
-## ✨ Features
+The app keeps the heavy work native. Downloads are coordinated by a Rust backend, accelerated with aria2, enriched with yt-dlp and FFmpeg for media workflows, and persisted locally with SQLite so queues survive restarts and app updates.
 
-- ⚡ **Multi-Segmented Engine:** Ultra-fast parallel downloading powered by `aria2c` with configurable speed limits.
-- 🪄 **Media Downloader:** Instantly extract high-quality media (4K, 1080p, MP3) with smart cascading format pickers, powered by bundled `yt-dlp` and `ffmpeg`.
-- 🎨 **Premium Native UI:** A responsive, frosted-glass SwiftUI interface tailor-made for Apple Silicon, featuring a visual chunk map and dynamic progress tracking.
-- 🌐 **Seamless Browser Integration:** Send downloads directly from your browser via the secure Firelink Companion extension.
-- 🛡️ **Privacy & Security:** Zero-configuration setup with deferred Keychain integration ensures your credentials are kept safe and only accessed when strictly necessary.
-- 🗂️ **Smart Organization:** Auto-categorizes incoming files and remembers your preferred download locations.
-- 🔄 **Native Updater:** Built-in seamless GitHub release checking for lightweight and transparent app updates.
+## Features
 
----
+- **Fast segmented downloads** powered by aria2 with configurable connections, retries, and speed limits.
+- **Media extraction** with yt-dlp, FFmpeg, and Deno for video/audio links and richer format selection.
+- **A real Add window** for manual, extension-captured, and media downloads, including metadata, duplicate handling, and save-location choices before downloads start.
+- **Persistent queue management** with safe concurrency limits, pause/resume, retry, redownload, sorting, multi-select, and bulk controls.
+- **Download scheduling** with start/stop windows, speed-limiter tools, and optional post-queue actions.
+- **Smart organization** through categories, default folders, per-download overrides, and open/reveal/trash actions.
+- **Private browser handoff** through authenticated local pairing with replay protection and desktop-server proof checks.
+- **Native desktop integration** including tray controls, notifications, completion sounds, sleep prevention, and OS keychain support where available.
+- **Diagnostics built in** with engine health checks, structured logs, and packaged-engine verification.
 
-## 🧩 Browser Integration
+## Installation
 
-We are live! Send downloads directly from your browser to the Firelink app with zero friction.
+Download the latest desktop build from [GitHub Releases](https://github.com/nimbold/Firelink/releases).
 
-<a href="https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/"><img src="https://img.shields.io/badge/Install%20on%20Firefox-FF7139?logo=firefox-browser&logoColor=white&style=for-the-badge" alt="Install on Firefox" /></a>
+| Platform | Package | Notes |
+| --- | --- | --- |
+| **macOS Apple silicon** | `.dmg` | Unsigned and not notarized. Open through Finder or approve once in **System Settings -> Privacy & Security**. |
+| **Windows x64** | NSIS `.exe` installer | Unsigned. Windows SmartScreen may warn until code signing is added. |
+| **Linux x64** | `.AppImage` | Make executable before launching if your desktop environment does not do that automatically. |
 
-*(Check out the [Firelink-Extension source code](https://github.com/nimbold/Firelink-Extension) to contribute or learn more.)*
+Production bundles include the required media engines for the target platform. Users do not need to install aria2, yt-dlp, FFmpeg, Deno, Python, Homebrew, or a package manager for normal app usage.
 
----
+## Browser Extension
 
-## 🛠️ Quick Start
+<div align="center">
+  <a href="https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/"><img src="https://img.shields.io/badge/Install%20Firelink%20Companion-Firefox-FF7139?style=for-the-badge&logo=firefox-browser&logoColor=white" alt="Install Firelink Companion on Firefox" /></a>
+</div>
 
-**OS Support:** macOS 14.0 or newer (Apple Silicon natively).
+Firelink Companion connects your browser to the desktop app so links and browser downloads can open in Firelink instead of disappearing into the browser's default download shelf.
 
-Run the application directly:
-```bash
-swift run Firelink
+What it adds:
+
+- **Automatic capture** for normal browser downloads, while still routing every captured link through Firelink's Add window.
+- **Context-menu actions** for "Download with Firelink" and selected links.
+- **Signed local requests** using the pairing token from **Settings -> Integrations**.
+- **Server identity checks** so the extension only trusts the real local Firelink app.
+- **Offline-safe behavior** that resumes browser downloads when Firelink is closed or rejects a handoff.
+- **Protocol-aware compatibility** so older desktop builds are rejected before automatic capture can cancel a browser download.
+
+Install the extension, open Firelink, then pair it from **Settings -> Integrations**. The Firefox add-on is maintained in the [Firelink-Extension](https://github.com/nimbold/Firelink-Extension) repository and is also vendored here as the `Extensions/Firefox` submodule.
+
+## Platforms
+
+| Target | Status |
+| --- | --- |
+| **macOS arm64** | Supported. Automated native build, engine validation, packaged launch smoke test, and unsigned DMG packaging. |
+| **Windows x64** | Supported. Native GitHub Actions build, engine validation, silent installer smoke test, and NSIS packaging. |
+| **Linux x64** | Supported. Native GitHub Actions build, engine validation, AppImage repackaging, and xvfb launch smoke test. |
+
+## Development
+
+### Requirements
+
+- Node.js 22 or newer
+- npm
+- Rust and Cargo
+- [Tauri 2 platform prerequisites](https://v2.tauri.app/start/prerequisites/)
+
+Clone the repository with its browser-extension submodule:
+
+```sh
+git clone --recurse-submodules https://github.com/nimbold/Firelink.git
+cd Firelink
 ```
 
-Or build a production `.app` bundle:
-```bash
-make app && open build/Firelink.app
+Install dependencies and launch the desktop app:
+
+```sh
+npm install
+npm run tauri dev
 ```
 
----
+Run the core checks:
 
-## 🏆 Credits
+```sh
+node --test scripts/*.node-test.js
+npm test -- --run
+npm run build
+cd src-tauri
+cargo test --all-targets
+```
 
-Firelink stands on the shoulders of giants. A massive thank you to the contributors of these phenomenal open-source projects:
-- **[aria2](https://aria2.github.io/)** - The legendary multi-protocol download utility driving our core engine.
-- **[yt-dlp](https://github.com/yt-dlp/yt-dlp)** - The definitive command-line audio/video downloader.
-- **[FFmpeg](https://ffmpeg.org/)** - The industry standard for media stream manipulation and merging.
+Create a production bundle:
 
----
+```sh
+npm run tauri build
+```
 
-## 📄 License
+macOS development uses locked payloads in `src-tauri/binaries`. Windows and Linux payloads are provisioned from checksum-pinned archives:
 
-Firelink is released under the MIT License. See [LICENSE](LICENSE) for details.
+```sh
+node scripts/provision-engines.js --target x86_64-pc-windows-msvc
+node scripts/provision-engines.js --target x86_64-unknown-linux-gnu
+```
+
+Build staging includes only the current target. See `engines.lock.json`, `engine-sources.lock.json`, and [RELEASE.md](RELEASE.md).
+
+## Repository Structure
+
+```text
+.
+├── src/                  React and TypeScript interface
+├── src-tauri/            Rust backend, Tauri config, and native tests
+├── scripts/              Engine provisioning, release, and smoke-test tooling
+└── Extensions/Firefox/   Firelink Companion submodule
+```
+
+## Help and Project Status
+
+- Report bugs or request improvements in [GitHub Issues](https://github.com/nimbold/Firelink/issues).
+- Read [CHANGELOG.md](CHANGELOG.md) for release history.
+- Review [RELEASE.md](RELEASE.md) for packaging policy and release verification.
+
+## Technology & Credits
+
+Firelink is made possible by these open-source projects:
+
+- **[Tauri 2](https://tauri.app/)** for the lightweight desktop runtime
+- **[Rust](https://www.rust-lang.org/)** and **[Tokio](https://tokio.rs/)** for native application logic
+- **[React](https://react.dev/)** and **[TypeScript](https://www.typescriptlang.org/)** for the interface
+- **[Zustand](https://zustand-demo.pmnd.rs/)** for frontend state management
+- **[SQLite](https://www.sqlite.org/)** for persistent local data
+- **[aria2](https://aria2.github.io/)** for segmented downloading
+- **[yt-dlp](https://github.com/yt-dlp/yt-dlp)**, **[FFmpeg](https://ffmpeg.org/)**, and **[Deno](https://deno.com/)** for media extraction and processing
+
+## License
+
+Firelink is available under the [MIT License](LICENSE).

RELEASE.md

@@ -0,0 +1,75 @@
+# Firelink Release Process
+
+Targets:
+
+- macOS arm64 DMG
+- Windows x64 NSIS installer
+- Linux x64 AppImage
+
+## Distribution policy
+
+Firelink does not use an Apple Developer account. macOS releases are unsigned and not notarized. Users must explicitly approve the downloaded app through Finder or macOS Privacy & Security. Release copy must never describe these builds as signed, notarized, or Gatekeeper-approved.
+
+Windows releases are currently unsigned. SmartScreen may warn until code signing is added.
+
+## Engine supply chain
+
+Firelink never falls back to system-installed media tools.
+
+- `engines.lock.json` pins current committed macOS payload hashes.
+- `engine-sources.lock.json` pins Windows/Linux source archives and checksums.
+- `scripts/provision-engines.js` downloads and verifies target archives.
+- `scripts/stage-engines.js` creates one target-specific bundle payload.
+- `scripts/verify-binaries.js` runs architecture, packaging, version, and RPC checks.
+
+yt-dlp must remain its official PyInstaller **onedir** distribution: launcher plus adjacent `_internal` runtime. Onefile builds are rejected because repeated extraction caused roughly 17-second startup latency.
+
+## Version update
+
+Keep versions aligned:
+
+- `package.json`
+- `src-tauri/Cargo.toml`
+- `src-tauri/tauri.conf.json`
+
+## Local macOS build
+
+```bash
+npm ci
+node scripts/stage-engines.js --target aarch64-apple-darwin
+node scripts/verify-binaries.js --staged --target aarch64-apple-darwin
+npm test -- --run
+npm run build
+cd src-tauri && cargo test --all-targets
+cd ..
+npm run tauri build -- --target aarch64-apple-darwin --bundles dmg
+```
+
+Verify packaged resources, then launch outside repository working directory:
+
+```bash
+APP="src-tauri/target/aarch64-apple-darwin/release/bundle/macos/Firelink.app"
+node scripts/verify-binaries.js --search-root "$APP" --target aarch64-apple-darwin
+node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
+```
+
+GitHub release publication is intentionally manual. Tag pushes build and upload
+artifacts, but the `publish` job only runs from a `workflow_dispatch` on a `v*`
+tag when both release-certification inputs are checked after Windows, Linux,
+and macOS clean-machine QA.
+
+## Automated release builds
+
+Push a version tag to build and verify native artifacts:
+
+```bash
+git tag v<version>
+git push origin v<version>
+```
+
+GitHub Actions builds all targets on native runners, verifies engines inside
+final package contents, performs packaged launch smoke where supported, and
+uploads artifacts. Publish the GitHub Release with a manual `workflow_dispatch`
+run on the same tag after clean-machine QA is complete.
+
+No target may silently skip missing engines, failed extraction, checksum mismatch, or missing package output.

Scripts/create_app_bundle.sh

@@ -1,205 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-APP_NAME="Firelink"
-CONFIGURATION="${CONFIGURATION:-release}"
-DEFAULT_MARKETING_VERSION="$(git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//' || true)"
-DEFAULT_BUILD_NUMBER="$(git rev-list --count HEAD 2>/dev/null || true)"
-MARKETING_VERSION="${MARKETING_VERSION:-${DEFAULT_MARKETING_VERSION:-0.1.0}}"
-BUILD_NUMBER="${BUILD_NUMBER:-${DEFAULT_BUILD_NUMBER:-1}}"
-SIGNING_IDENTITY="${CODE_SIGN_IDENTITY:-${SIGNING_IDENTITY:-}}"
-APP_DIR="$ROOT_DIR/build/$APP_NAME.app"
-CONTENTS_DIR="$APP_DIR/Contents"
-MACOS_DIR="$CONTENTS_DIR/MacOS"
-RESOURCES_DIR="$CONTENTS_DIR/Resources"
-ICON_NAME="AppIcon"
-
-cd "$ROOT_DIR"
-
-is_valid_mach_o() {
-  local path="$1"
-  if ! file "$path" | grep -q 'Mach-O'; then
-    return 0
-  fi
-
-  lipo -archs "$path" >/dev/null 2>&1
-}
-
-ensure_ytdlp() {
-  local ytdlp_path="$ROOT_DIR/Sources/Firelink/yt-dlp"
-  local ytdlp_internal_path="$ROOT_DIR/Sources/Firelink/_internal"
-
-  if [[ -x "$ytdlp_path" ]] && [[ -d "$ytdlp_internal_path" ]] && is_valid_mach_o "$ytdlp_path"; then
-    return
-  fi
-
-  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null; then
-    echo "WARNING: yt-dlp or its runtime is missing or malformed, and curl/unzip are not available to refresh it." >&2
-    return
-  fi
-
-  echo "Refreshing bundled yt-dlp runtime..."
-  local temp_dir
-  temp_dir="$(mktemp -d)"
-  curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos.zip -o "$temp_dir/yt-dlp.zip"
-  unzip -q -o "$temp_dir/yt-dlp.zip" -d "$temp_dir"
-  cp "$temp_dir/yt-dlp_macos" "$ytdlp_path"
-  chmod +x "$ytdlp_path"
-
-  if [[ -d "$temp_dir/_internal" ]]; then
-    rm -rf "$ROOT_DIR/Sources/Firelink/_internal"
-    cp -R "$temp_dir/_internal" "$ROOT_DIR/Sources/Firelink/_internal"
-    touch "$ROOT_DIR/Sources/Firelink/_internal/.gitkeep"
-  fi
-
-  rm -rf "$temp_dir"
-}
-
-ensure_ytdlp
-
-swift build -c "$CONFIGURATION"
-
-rm -rf "$APP_DIR"
-mkdir -p "$MACOS_DIR" "$RESOURCES_DIR"
-cp ".build/$CONFIGURATION/$APP_NAME" "$MACOS_DIR/$APP_NAME"
-cp "$ROOT_DIR/Resources/$ICON_NAME.icns" "$RESOURCES_DIR/$ICON_NAME.icns"
-cp "$ROOT_DIR/Sources/Firelink/Assets.xcassets/MenuBarIcon.imageset/MenuBarIconTemplate.png" "$RESOURCES_DIR/MenuBarIconTemplate.png"
-cp "$ROOT_DIR/Resources/GitHubTemplate.png" "$RESOURCES_DIR/GitHubTemplate.png"
-
-for media_engine in yt-dlp ffmpeg; do
-  media_engine_path="$ROOT_DIR/Sources/Firelink/$media_engine"
-  if [[ -x "$media_engine_path" ]]; then
-    cp "$media_engine_path" "$RESOURCES_DIR/$media_engine"
-    chmod +x "$RESOURCES_DIR/$media_engine"
-  else
-    echo "WARNING: $media_engine not found or not executable at $media_engine_path"
-  fi
-done
-
-if [[ -d "$ROOT_DIR/Sources/Firelink/_internal" ]]; then
-  cp -R "$ROOT_DIR/Sources/Firelink/_internal" "$RESOURCES_DIR/_internal"
-fi
-
-echo "Packaging Firefox extension..."
-mkdir -p "$RESOURCES_DIR/FirefoxExtension"
-cp "$ROOT_DIR/Extensions/Firefox/background.js" "$RESOURCES_DIR/FirefoxExtension/background.js"
-cp "$ROOT_DIR/Extensions/Firefox/content.js" "$RESOURCES_DIR/FirefoxExtension/content.js"
-cp "$ROOT_DIR/Extensions/Firefox/manifest.json" "$RESOURCES_DIR/FirefoxExtension/manifest.json"
-cp -R "$ROOT_DIR/Extensions/Firefox/icons" "$RESOURCES_DIR/FirefoxExtension/icons"
-cp -R "$ROOT_DIR/Extensions/Firefox/popup" "$RESOURCES_DIR/FirefoxExtension/popup"
-
-
-ARIA2C_PATH=$(which aria2c || true)
-if [[ -n "$ARIA2C_PATH" && -x "$ARIA2C_PATH" ]]; then
-  echo "Bundling aria2c from $ARIA2C_PATH..."
-  cp "$ARIA2C_PATH" "$RESOURCES_DIR/aria2c"
-
-  if ! command -v dylibbundler &> /dev/null; then
-    echo "Installing dylibbundler..."
-    brew install dylibbundler
-  fi
-
-  FRAMEWORKS_DIR="$CONTENTS_DIR/Frameworks"
-  mkdir -p "$FRAMEWORKS_DIR"
-  dylibbundler -od -b -x "$RESOURCES_DIR/aria2c" -d "$FRAMEWORKS_DIR" -p "@executable_path/../Frameworks/"
-else
-  echo "WARNING: aria2c not found! It will not be bundled. Please install it first."
-fi
-
-FRAMEWORKS_DIR="$CONTENTS_DIR/Frameworks"
-mkdir -p "$FRAMEWORKS_DIR"
-
-install_name_tool -add_rpath "@executable_path/../Frameworks" "$MACOS_DIR/$APP_NAME" || true
-
-
-cat > "$CONTENTS_DIR/Info.plist" <<PLIST
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDevelopmentRegion</key>
-  <string>en</string>
-  <key>CFBundleExecutable</key>
-  <string>$APP_NAME</string>
-  <key>CFBundleIdentifier</key>
-  <string>local.firelink.swiftui</string>
-  <key>CFBundleInfoDictionaryVersion</key>
-  <string>6.0</string>
-  <key>CFBundleName</key>
-  <string>$APP_NAME</string>
-  <key>CFBundleIconFile</key>
-  <string>$ICON_NAME</string>
-  <key>CFBundlePackageType</key>
-  <string>APPL</string>
-  <key>CFBundleShortVersionString</key>
-  <string>$MARKETING_VERSION</string>
-  <key>CFBundleVersion</key>
-  <string>$BUILD_NUMBER</string>
-  <key>LSMinimumSystemVersion</key>
-  <string>14.0</string>
-  <key>LSApplicationCategoryType</key>
-  <string>public.app-category.utilities</string>
-  <key>NSHighResolutionCapable</key>
-  <true/>
-  <key>NSAppleEventsUsageDescription</key>
-  <string>Firelink needs permission to control Finder so it can sleep, restart, or shut down your Mac after scheduled downloads finish.</string>
-  <key>CFBundleURLTypes</key>
-  <array>
-    <dict>
-      <key>CFBundleURLName</key>
-      <string>local.firelink.swiftui</string>
-      <key>CFBundleURLSchemes</key>
-      <array>
-        <string>firelink</string>
-      </array>
-    </dict>
-  </array>
-</dict>
-</plist>
-PLIST
-
-if command -v codesign &> /dev/null; then
-  if [[ -n "$SIGNING_IDENTITY" ]]; then
-    CODESIGN_ARGS=(--force --timestamp --options runtime --sign "$SIGNING_IDENTITY")
-    echo "Signing app bundle with identity: $SIGNING_IDENTITY"
-  else
-    CODESIGN_ARGS=(--force --sign -)
-    echo "Ad-hoc signing app bundle for local use."
-  fi
-
-  sign_path() {
-    local path="$1"
-    codesign "${CODESIGN_ARGS[@]}" "$path"
-  }
-
-  sign_mach_o_file() {
-    local path="$1"
-
-    if file "$path" | grep -q 'Mach-O'; then
-      if ! sign_path "$path"; then
-        echo "WARNING: Could not sign Mach-O executable for local build: $path" >&2
-      fi
-    fi
-  }
-
-  if [[ -d "$FRAMEWORKS_DIR" ]]; then
-    while IFS= read -r -d '' executable_path; do
-      sign_mach_o_file "$executable_path"
-    done < <(find "$FRAMEWORKS_DIR" -type f -print0)
-
-    while IFS= read -r -d '' bundle_path; do
-      sign_path "$bundle_path"
-    done < <(find "$FRAMEWORKS_DIR" \( -name "*.xpc" -o -name "*.framework" \) -type d -depth -print0)
-  fi
-
-  while IFS= read -r -d '' executable_path; do
-    sign_mach_o_file "$executable_path"
-  done < <(find "$RESOURCES_DIR" -type f -print0)
-
-  sign_path "$MACOS_DIR/$APP_NAME"
-  sign_path "$APP_DIR"
-  codesign --verify --deep --verbose=2 "$APP_DIR" || true
-fi
-
-echo "Created $APP_DIR"

Scripts/create_dmg.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-APP_NAME="Firelink"
-VERSION="${VERSION:-}"
-ARCH="${ARCH:-arm64}"
-SIGNING_IDENTITY="${CODE_SIGN_IDENTITY:-${SIGNING_IDENTITY:-}}"
-APP_DIR="$ROOT_DIR/build/$APP_NAME.app"
-DIST_DIR="$ROOT_DIR/dist"
-DMG_STAGING_DIR="$ROOT_DIR/build/dmg"
-
-if [[ ! -d "$APP_DIR" ]]; then
-  echo "Missing app bundle: $APP_DIR" >&2
-  echo "Run Scripts/create_app_bundle.sh first." >&2
-  exit 1
-fi
-
-if [[ -z "$VERSION" ]]; then
-  VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$APP_DIR/Contents/Info.plist")"
-fi
-
-DMG_PATH="$DIST_DIR/$APP_NAME-$VERSION-mac-$ARCH.dmg"
-
-rm -rf "$DMG_STAGING_DIR"
-mkdir -p "$DMG_STAGING_DIR" "$DIST_DIR"
-cp -R "$APP_DIR" "$DMG_STAGING_DIR/"
-ln -s /Applications "$DMG_STAGING_DIR/Applications"
-
-rm -f "$DMG_PATH"
-hdiutil create \
-  -volname "$APP_NAME $VERSION" \
-  -srcfolder "$DMG_STAGING_DIR" \
-  -ov \
-  -format UDZO \
-  "$DMG_PATH"
-
-if [[ -n "$SIGNING_IDENTITY" ]]; then
-  codesign --force --timestamp --sign "$SIGNING_IDENTITY" "$DMG_PATH"
-fi
-
-echo "Created $DMG_PATH"

Scripts/verify.sh

@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT_DIR"
-
-swift build
-git diff --check
-python3 -m json.tool Extensions/Firefox/manifest.json >/dev/null

Sources/Firelink/AddDownloadsView.swift

@@ -1,878 +0,0 @@
-import SwiftUI
-
-struct AddDownloadsView: View {
-    @EnvironmentObject private var controller: DownloadController
-    @EnvironmentObject private var settings: AppSettings
-    @Environment(\.dismiss) private var dismiss
-
-    @State private var linkText = ""
-    @State private var pendingDownloads: [PendingDownload] = []
-    @State private var connectionsPerServer = 16.0
-    @State private var overrideDestination = false
-    @State private var destinationPath = ""
-    @State private var metadataTask: Task<Void, Never>?
-    @State private var targetQueueID = DownloadQueue.mainQueueID
-    @State private var speedLimitEnabled = false
-    @State private var speedLimitKiBPerSecond = 1024
-    @State private var showsAdvancedTransfer = false
-    @State private var checksumEnabled = false
-    @State private var checksumAlgorithm: ChecksumAlgorithm = .sha256
-    @State private var checksumValue = ""
-    @State private var headerText = ""
-    @State private var cookieText = ""
-    @State private var mirrorText = ""
-    @State private var useAuthorization = false
-    @State private var authUsername = ""
-    @State private var authPassword = ""
-    @State private var saveLogin = false
-
-    @State private var conflictingDownloads: [DuplicateDownloadItem] = []
-    @State private var showingDuplicates = false
-    @State private var pendingStartFlag = false
-
-    var body: some View {
-        VStack(spacing: 0) {
-            HStack(spacing: 0) {
-                // Left Column
-                VStack(spacing: 0) {
-                    VStack(alignment: .leading, spacing: 16) {
-                        linkSection
-                        summarySection
-                        previewSection
-                    }
-                    .padding(20)
-                }
-                .frame(maxWidth: .infinity, maxHeight: .infinity)
-
-                Divider()
-
-                // Right Column
-                VStack(spacing: 0) {
-                    Form {
-                        optionsSection
-                        advancedTransferSection
-                    }
-                    .formStyle(.grouped)
-                }
-                .frame(width: 320)
-                .background(Color(NSColor.controlBackgroundColor))
-            }
-            Divider()
-            actionBar
-                .padding(16)
-                .background(.background)
-        }
-        .frame(minWidth: 720, idealWidth: 800, minHeight: 620, idealHeight: 680)
-        .sheet(isPresented: $showingDuplicates) {
-            DuplicateResolutionView(
-                conflicts: $conflictingDownloads,
-                onConfirm: {
-                    showingDuplicates = false
-                    DispatchQueue.main.asyncAfter(deadline: .now() + 0.1) {
-                        executeAddDownloads(start: pendingStartFlag, conflicts: conflictingDownloads)
-                    }
-                },
-                onCancel: {
-                    showingDuplicates = false
-                }
-            )
-        }
-        .onChange(of: linkText) { _, newValue in
-            scheduleMetadataRefresh(for: newValue)
-        }
-        .onChange(of: metadataRequestSignature) { _, _ in
-            guard !DownloadURLParser.parse(linkText).isEmpty else { return }
-            scheduleMetadataRefresh(for: linkText)
-        }
-        .onAppear {
-            connectionsPerServer = Double(settings.perServerConnections)
-            targetQueueID = controller.pendingAddQueueID ?? DownloadQueue.mainQueueID
-            controller.pendingAddQueueID = nil
-            if let text = controller.pendingPasteboardText {
-                applyPendingReferer()
-                linkText = text
-                controller.pendingPasteboardText = nil
-            }
-        }
-        .onDisappear {
-            metadataTask?.cancel()
-            linkText = ""
-            pendingDownloads = []
-            headerText = ""
-            cookieText = ""
-            mirrorText = ""
-            useAuthorization = false
-            authUsername = ""
-            authPassword = ""
-            checksumEnabled = false
-            checksumValue = ""
-        }
-    }
-
-    private var linkSection: some View {
-        VStack(alignment: .leading, spacing: 8) {
-            Label("Download Links", systemImage: "link")
-                .font(.subheadline.weight(.semibold))
-
-            TextEditor(text: $linkText)
-                .font(.system(.callout, design: .monospaced))
-                .scrollContentBackground(.hidden)
-                .background(.quaternary.opacity(0.35))
-                .clipShape(RoundedRectangle(cornerRadius: 8))
-                .frame(minHeight: 72, idealHeight: 100, maxHeight: 160)
-
-            HStack {
-                Text("\(pendingDownloads.count) valid link\(pendingDownloads.count == 1 ? "" : "s") detected")
-                    .foregroundStyle(.secondary)
-                Spacer()
-                Button {
-                    refreshMetadata(for: linkText, isAutoFetch: false)
-                } label: {
-                    Label("Refresh Metadata", systemImage: "arrow.clockwise")
-                }
-                .disabled(DownloadURLParser.parse(linkText).isEmpty)
-            }
-            .font(.caption)
-        }
-    }
-
-    private var optionsSection: some View {
-        Group {
-            if let firstMedia = pendingDownloads.first(where: { $0.isMedia }) {
-                mediaFormatSection(for: firstMedia)
-            }
-
-            Section("Save Location") {
-                Toggle("Use one folder for all files", isOn: $overrideDestination)
-                if overrideDestination {
-                    HStack(spacing: 8) {
-                        TextField("Automatic by file type", text: $destinationPath)
-                            .textFieldStyle(.roundedBorder)
-                            .font(.system(.callout, design: .monospaced))
-                        Button {
-                            selectDestination()
-                        } label: {
-                            Label("Select...", systemImage: "folder.badge.plus")
-                        }
-                    }
-                }
-            }
-
-            Section("Queue") {
-                Picker("Target Queue", selection: $targetQueueID) {
-                    ForEach(controller.queues) { queue in
-                        Text(queue.name).tag(queue.id)
-                    }
-                }
-                .labelsHidden()
-            }
-
-            Section("Transfer Settings") {
-                VStack(alignment: .leading, spacing: 4) {
-                    Text("Connections per File")
-                    HStack {
-                        Slider(value: $connectionsPerServer, in: 1...16, step: 1)
-                        Text("\(Int(connectionsPerServer))")
-                            .monospacedDigit()
-                            .frame(width: 24, alignment: .trailing)
-                    }
-                }
-                
-                Toggle("Limit speed per file", isOn: $speedLimitEnabled)
-                if speedLimitEnabled {
-                    Stepper(
-                        "\(speedLimitKiBPerSecond) KiB/s",
-                        value: $speedLimitKiBPerSecond,
-                        in: 1...10_485_760,
-                        step: 128
-                    )
-                }
-            }
-
-            Section("Authorization") {
-                Toggle("Use authorization", isOn: $useAuthorization)
-                if useAuthorization {
-                    TextField("Username", text: $authUsername)
-                        .textFieldStyle(.roundedBorder)
-                    SecureField("Password", text: $authPassword)
-                        .textFieldStyle(.roundedBorder)
-                    Toggle("Save login for this website", isOn: $saveLogin)
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                }
-            }
-        }
-    }
-
-    private var summarySection: some View {
-        CompactSummaryStrip(
-            metrics: [
-                SummaryMetric(title: "Files", value: "\(pendingDownloads.count)", symbolName: "doc.on.doc"),
-                SummaryMetric(title: "Required", value: requiredSpaceText, symbolName: "externaldrive"),
-                SummaryMetric(title: "Free", value: freeSpaceText, symbolName: "internaldrive"),
-                SummaryMetric(title: "Unknown", value: "\(unknownSizeCount)", symbolName: "questionmark.circle")
-            ]
-        )
-    }
-
-    private var previewSection: some View {
-        VStack(alignment: .leading, spacing: 8) {
-            Label("Preview", systemImage: "list.bullet.rectangle")
-                .font(.subheadline.weight(.semibold))
-
-            Table($pendingDownloads) {
-                TableColumn("File") { $item in
-                    HStack {
-                        Image(systemName: item.category.symbolName)
-                            .foregroundStyle(categoryColor(item.category))
-                        VStack(alignment: .leading, spacing: 2) {
-                            Text(item.fileName)
-                                .lineLimit(1)
-                        }
-                    }
-                }
-
-                TableColumn("Size") { $item in
-                    Text(ByteFormatter.string(item.sizeBytes))
-                        .monospacedDigit()
-                }
-                .width(86)
-
-                TableColumn("Save To") { $item in
-                    Text(item.destinationPath)
-                        .font(.system(.caption, design: .monospaced))
-                        .foregroundStyle(.secondary)
-                        .lineLimit(1)
-                }
-
-                TableColumn("Status") { $item in
-                    if item.isMedia, case .loading = item.state {
-                        HStack {
-                            ProgressView().controlSize(.small)
-                            Text("Checking")
-                        }.foregroundStyle(.secondary)
-                    } else {
-                        MetadataStatusView(state: item.state)
-                    }
-                }
-                .width(min: 110, ideal: 140, max: 200)
-            }
-            .frame(minHeight: 160)
-        }
-    }
-
-    private var actionBar: some View {
-        HStack {
-            Text(actionMessage)
-                .font(.caption)
-                .foregroundStyle(.secondary)
-                .lineLimit(1)
-
-            if metadataTask != nil {
-                Button {
-                    metadataTask?.cancel()
-                    metadataTask = nil
-                } label: {
-                    Image(systemName: "xmark.circle.fill")
-                        .foregroundStyle(.secondary)
-                }
-                .buttonStyle(.plain)
-            }
-
-            Spacer()
-
-            Button("Cancel") {
-                dismiss()
-            }
-            .keyboardShortcut(showingDuplicates ? nil : .cancelAction)
-
-            Button("Add to Queue") {
-                addDownloads(start: false)
-            }
-            .disabled(!canAddDownloads)
-
-            Button("Start Downloads") {
-                addDownloads(start: true)
-            }
-            .buttonStyle(.borderedProminent)
-            .disabled(!canAddDownloads)
-            .keyboardShortcut(showingDuplicates ? nil : .defaultAction)
-        }
-    }
-
-    private func updateMediaOption(for firstMedia: PendingDownload, newId: String) {
-        for index in pendingDownloads.indices where pendingDownloads[index].isMedia {
-            if let option = pendingDownloads[index].mediaOptions.first(where: { $0.id == newId }) {
-                pendingDownloads[index].selectedMediaOption = option
-                if let metadata = pendingDownloads[index].mediaMetadata {
-                    let cleanTitle = FileClassifier.sanitizedFileName(metadata.title ?? "Media")
-                    pendingDownloads[index].fileName = "\(cleanTitle).\(option.outputExtension)"
-                    pendingDownloads[index].category = FileClassifier.category(forFileName: pendingDownloads[index].fileName)
-                }
-            }
-        }
-    }
-
-    @ViewBuilder
-    private func mediaFormatSection(for firstMedia: PendingDownload) -> some View {
-        Section {
-            if firstMedia.mediaOptions.isEmpty {
-                HStack(spacing: 8) {
-                    if case .loading = firstMedia.state {
-                        ProgressView().controlSize(.small)
-                        Text("Fetching media options...")
-                            .foregroundStyle(.secondary)
-                    } else if case .failed(let error) = firstMedia.state {
-                        Image(systemName: "exclamationmark.triangle.fill").foregroundStyle(.red)
-                        Text("Failed to load options.")
-                            .foregroundStyle(.secondary)
-                    } else {
-                        ProgressView().controlSize(.small)
-                        Text("Waiting for metadata...")
-                            .foregroundStyle(.secondary)
-                    }
-                }
-                .padding(.vertical, 4)
-            } else {
-                let currentOption = firstMedia.selectedMediaOption ?? firstMedia.mediaOptions.first!
-                let availableTypes = Array(Set(firstMedia.mediaOptions.map(\.mediaType))).sorted(by: { $0.rawValue > $1.rawValue })
-                let optionsForType = firstMedia.mediaOptions.filter { $0.mediaType == currentOption.mediaType }
-                let availableFormats = Array(Set(optionsForType.map(\.containerName))).sorted()
-                let optionsForFormat = optionsForType.filter { $0.containerName == currentOption.containerName }
-                
-                let availableQualities = Array(Set(optionsForFormat.map(\.qualityName))).sorted(by: { 
-                     if $0 == "Best" { return true }
-                     if $1 == "Best" { return false }
-                     return $0 > $1 
-                })
-
-                Picker("Type", selection: Binding(
-                get: { currentOption.mediaType },
-                set: { newType in
-                    if let firstOfNewType = firstMedia.mediaOptions.first(where: { $0.mediaType == newType }) {
-                        updateMediaOption(for: firstMedia, newId: firstOfNewType.id)
-                    }
-                }
-            )) {
-                ForEach(availableTypes, id: \.self) { type in
-                    Text(type.rawValue).tag(type)
-                }
-            }
-            .pickerStyle(.segmented)
-            .padding(.bottom, 4)
-
-            Picker("Format", selection: Binding(
-                get: { currentOption.containerName },
-                set: { newFormat in
-                    let matching = optionsForType.first(where: { $0.containerName == newFormat && $0.qualityName == currentOption.qualityName })
-                    let fallback = optionsForType.first(where: { $0.containerName == newFormat })
-                    if let newOption = matching ?? fallback {
-                        updateMediaOption(for: firstMedia, newId: newOption.id)
-                    }
-                }
-            )) {
-                ForEach(availableFormats, id: \.self) { format in
-                    Text(format).tag(format)
-                }
-            }
-
-            if currentOption.mediaType == .video {
-                Picker("Quality", selection: Binding(
-                    get: { currentOption.qualityName },
-                    set: { newQuality in
-                        if let newOption = optionsForFormat.first(where: { $0.qualityName == newQuality }) {
-                            updateMediaOption(for: firstMedia, newId: newOption.id)
-                        }
-                    }
-                )) {
-                    ForEach(availableQualities, id: \.self) { quality in
-                        Text(quality).tag(quality)
-                    }
-                }
-            } else {
-                Picker("Quality", selection: .constant("Best")) {
-                    Text("Best").tag("Best")
-                }
-                .disabled(true)
-            }
-            } // End of else block
-        } header: {
-            Text("Media Format").foregroundStyle(.blue)
-        }
-    }
-
-    private var advancedTransferSection: some View {
-        Section {
-            DisclosureGroup(isExpanded: $showsAdvancedTransfer) {
-                VStack(alignment: .leading, spacing: 12) {
-                    Toggle("Verify Checksum", isOn: $checksumEnabled)
-                    if checksumEnabled {
-                        Picker("Algorithm", selection: $checksumAlgorithm) {
-                            ForEach(ChecksumAlgorithm.allCases) { algorithm in
-                                Text(algorithm.title).tag(algorithm)
-                            }
-                        }
-                        TextField("Expected digest", text: $checksumValue)
-                            .textFieldStyle(.roundedBorder)
-                            .font(.system(.callout, design: .monospaced))
-                    }
-
-                    VStack(alignment: .leading, spacing: 4) {
-                        Text("Headers")
-                        TextEditor(text: $headerText)
-                            .font(.system(.callout, design: .monospaced))
-                            .scrollContentBackground(.hidden)
-                            .background(.quaternary.opacity(0.35))
-                            .clipShape(RoundedRectangle(cornerRadius: 8))
-                            .frame(minHeight: 48)
-                    }
-
-                    VStack(alignment: .leading, spacing: 4) {
-                        Text("Cookies")
-                        TextField("name=value; other=value", text: $cookieText)
-                            .textFieldStyle(.roundedBorder)
-                            .font(.system(.callout, design: .monospaced))
-                    }
-
-                    VStack(alignment: .leading, spacing: 4) {
-                        Text("Mirrors")
-                        TextEditor(text: $mirrorText)
-                            .font(.system(.callout, design: .monospaced))
-                            .scrollContentBackground(.hidden)
-                            .background(.quaternary.opacity(0.35))
-                            .clipShape(RoundedRectangle(cornerRadius: 8))
-                            .frame(minHeight: 48)
-                    }
-                }
-                .padding(.top, 8)
-            } label: {
-                Label("Advanced Transfer", systemImage: "slider.horizontal.3")
-                    .font(.subheadline.weight(.semibold))
-            }
-        }
-    }
-
-    private var requiredSpaceText: String {
-        let knownBytes = pendingDownloads.compactMap(\.sizeBytes).reduce(Int64(0), +)
-        guard knownBytes > 0 else { return "Unknown" }
-        return ByteFormatter.string(knownBytes)
-    }
-
-    private var unknownSizeCount: Int {
-        pendingDownloads.filter { $0.sizeBytes == nil }.count
-    }
-
-    private var freeSpaceText: String {
-        guard let bytes = availableCapacity() else { return "Unknown" }
-        return ByteFormatter.string(bytes)
-    }
-
-    private var actionMessage: String {
-        if pendingDownloads.isEmpty {
-            return "Paste one or more HTTP, HTTPS, FTP, or SFTP links."
-        }
-
-        if let validationMessage {
-            return validationMessage
-        }
-
-        if unknownSizeCount > 0 {
-            return "Some servers did not report file size before download."
-        }
-
-        return "Ready to add \(pendingDownloads.count) download\(pendingDownloads.count == 1 ? "" : "s")."
-    }
-
-    private var canAddDownloads: Bool {
-        !pendingDownloads.isEmpty && validationMessage == nil
-    }
-
-    private var validationMessage: String? {
-        if checksumEnabled && checksumValue.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
-            return "Add the expected checksum digest, or turn checksum off."
-        }
-
-        if DownloadTransferOptionParser.invalidHeaderLines(headerText).isEmpty == false {
-            return "Headers must use Name: Value lines."
-        }
-
-        if DownloadTransferOptionParser.invalidMirrorLines(mirrorText).isEmpty == false {
-            return "Mirrors must be valid HTTP, HTTPS, FTP, or SFTP URLs."
-        }
-
-        return nil
-    }
-
-    private var transferOptions: DownloadTransferOptions {
-        DownloadTransferOptions(
-            checksum: checksumEnabled ? DownloadChecksum(algorithm: checksumAlgorithm, value: checksumValue).normalized : nil,
-            requestHeaders: DownloadTransferOptionParser.parseHeaders(headerText),
-            cookieHeader: DownloadTransferOptionParser.cleanCookieHeader(cookieText),
-            mirrorURLs: DownloadTransferOptionParser.parseMirrorURLs(mirrorText)
-        )
-    }
-
-    private var metadataRequestSignature: String {
-        [
-            headerText,
-            cookieText,
-            useAuthorization ? "auth" : "no-auth",
-            authUsername,
-            authPassword
-        ].joined(separator: "\u{1f}")
-    }
-
-    private func metadataCredentials(for url: URL) -> DownloadCredentials? {
-        if useAuthorization {
-            let cleanUsername = authUsername.trimmingCharacters(in: .whitespacesAndNewlines)
-            guard !cleanUsername.isEmpty else { return nil }
-            return DownloadCredentials(username: cleanUsername, password: authPassword)
-        }
-
-        return settings.credentials(for: url)
-    }
-
-    private func scheduleMetadataRefresh(for text: String) {
-        metadataTask?.cancel()
-        metadataTask = Task {
-            try? await Task.sleep(for: .milliseconds(350))
-            guard !Task.isCancelled else { return }
-            await MainActor.run {
-                refreshMetadata(for: text, isAutoFetch: true)
-            }
-        }
-    }
-
-    private func applyPendingReferer() {
-        guard let referer = controller.pendingReferer?.trimmingCharacters(in: .whitespacesAndNewlines),
-              !referer.isEmpty,
-              URL(string: referer) != nil else {
-            controller.pendingReferer = nil
-            return
-        }
-
-        let refererHeader = "Referer: \(referer)"
-        let existingHeaders = DownloadTransferOptionParser.parseHeaders(headerText)
-        if !existingHeaders.contains(where: { $0.normalized.name.lowercased() == "referer" }) {
-            headerText = headerText.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
-                ? refererHeader
-                : "\(headerText.trimmingCharacters(in: .whitespacesAndNewlines))\n\(refererHeader)"
-        }
-        controller.pendingReferer = nil
-    }
-
-    private func refreshMetadata(for text: String, isAutoFetch: Bool) {
-        let urls = DownloadURLParser.parse(text)
-        metadataTask?.cancel()
-
-        pendingDownloads = urls.map { url in
-            let isMedia = MediaDetector.isSupportedMedia(url: url)
-            let fileName = FileClassifier.fileName(from: url)
-            let category = FileClassifier.category(forFileName: fileName)
-            return PendingDownload(
-                url: url,
-                fileName: fileName,
-                category: category,
-                defaultDirectory: settings.destinationDirectory(for: category),
-                state: .loading,
-                isMedia: isMedia
-            )
-        }
-
-        if let firstURL = urls.first, let creds = settings.credentials(for: firstURL) {
-            useAuthorization = true
-            authUsername = creds.username
-            authPassword = creds.password
-            saveLogin = false
-        }
-
-        guard !urls.isEmpty else {
-            metadataTask = nil
-            return
-        }
-
-        metadataTask = Task {
-            await withTaskGroup(of: PendingDownload.self) { group in
-                for item in pendingDownloads {
-                    group.addTask {
-                        if item.isMedia {
-                            var fetchedItem = item
-                            do {
-                                try await MediaEngineManager.shared.ensureAvailable(addons: [.ytDlp])
-                                let (metadata, options) = try await MediaExtractionEngine.fetchMetadata(
-                                    for: item.url,
-                                    cookieSource: settings.mediaCookieSource,
-                                    credentials: metadataCredentials(for: item.url),
-                                    transferOptions: transferOptions
-                                )
-                                fetchedItem.mediaMetadata = metadata
-                                fetchedItem.mediaOptions = options
-                                if let bestVideo = options.first(where: { !$0.isAudioOnly && $0.name.contains("Best") }) ?? options.first(where: { !$0.isAudioOnly }) ?? options.first {
-                                    fetchedItem.selectedMediaOption = bestVideo
-                                    let cleanTitle = FileClassifier.sanitizedFileName(metadata.title ?? "Media")
-                                    fetchedItem.fileName = "\(cleanTitle).\(bestVideo.outputExtension)"
-                                    fetchedItem.category = FileClassifier.category(forFileName: fetchedItem.fileName)
-                                }
-                                fetchedItem.state = .loaded
-                            } catch {
-                                fetchedItem.state = .failed(error.localizedDescription)
-                            }
-                            return fetchedItem
-                        } else {
-                            return await DownloadMetadataFetcher.fetch(
-                                for: item.url,
-                                settings: settings,
-                                credentials: metadataCredentials(for: item.url),
-                                transferOptions: transferOptions,
-                                isAutoFetch: isAutoFetch
-                            )
-                        }
-                    }
-                }
-
-                for await loadedItem in group {
-                    guard !Task.isCancelled else { break }
-                    await MainActor.run {
-                        if let index = pendingDownloads.firstIndex(where: { $0.url == loadedItem.url }) {
-                            pendingDownloads[index] = loadedItem
-                        }
-                    }
-                }
-            }
-            await MainActor.run {
-                metadataTask = nil
-            }
-        }
-    }
-
-    private func selectDestination() {
-        let panel = NSOpenPanel()
-        panel.canChooseFiles = false
-        panel.canChooseDirectories = true
-        panel.allowsMultipleSelection = false
-        panel.canCreateDirectories = true
-
-        if let currentURL = overrideDirectory {
-            panel.directoryURL = currentURL
-        }
-
-        if panel.runModal() == .OK, let url = panel.url {
-            destinationPath = url.path
-            overrideDestination = true
-        }
-    }
-
-    private func addDownloads(start: Bool) {
-        var conflicts: [DuplicateDownloadItem] = []
-        for pending in pendingDownloads {
-            let destURL = overrideDirectory ?? pending.defaultDirectory
-            let destPath = destURL.appendingPathComponent(pending.fileName).path
-            
-            if controller.downloads.contains(where: { $0.url == pending.url && $0.status != .canceled && $0.status != .completed }) {
-                conflicts.append(DuplicateDownloadItem(id: pending.id, pendingItem: pending, reason: .existingURL("URL already in queue")))
-            } else if controller.downloads.contains(where: { $0.destinationPath == destPath && $0.status != .canceled }) || FileManager.default.fileExists(atPath: destPath) {
-                conflicts.append(DuplicateDownloadItem(id: pending.id, pendingItem: pending, reason: .existingFile("File exists at destination")))
-            }
-        }
-        
-        if !conflicts.isEmpty {
-            conflictingDownloads = conflicts
-            pendingStartFlag = start
-            showingDuplicates = true
-            return
-        }
-        
-        executeAddDownloads(start: start)
-    }
-
-    private func executeAddDownloads(start: Bool, conflicts: [DuplicateDownloadItem]? = nil) {
-        var finalDownloads = pendingDownloads
-        
-        if let conflicts {
-            for conflict in conflicts {
-                guard let index = finalDownloads.firstIndex(where: { $0.id == conflict.id }) else { continue }
-                switch conflict.resolution {
-                case .skip:
-                    finalDownloads.remove(at: index)
-                case .rename:
-                    let destURL = overrideDirectory ?? finalDownloads[index].defaultDirectory
-                    var newName = finalDownloads[index].fileName
-                    var count = 1
-                    let base = URL(fileURLWithPath: newName).deletingPathExtension().lastPathComponent
-                    let ext = URL(fileURLWithPath: newName).pathExtension
-                    while controller.downloads.contains(where: { $0.destinationDirectory == destURL && $0.fileName == newName }) || FileManager.default.fileExists(atPath: destURL.appendingPathComponent(newName).path) {
-                        newName = "\(base) (\(count))" + (ext.isEmpty ? "" : ".\(ext)")
-                        count += 1
-                    }
-                    finalDownloads[index].fileName = newName
-                case .replace:
-                    let destURL = overrideDirectory ?? finalDownloads[index].defaultDirectory
-                    let path = destURL.appendingPathComponent(finalDownloads[index].fileName).path
-                    if let existingIndex = controller.downloads.firstIndex(where: { ($0.destinationPath == path || $0.url == finalDownloads[index].url) && $0.status != .canceled }) {
-                        controller.delete(controller.downloads[existingIndex], deleteFiles: true)
-                    } else if FileManager.default.fileExists(atPath: path) {
-                        try? FileManager.default.removeItem(atPath: path)
-                    }
-                }
-            }
-        }
-
-        guard !finalDownloads.isEmpty else {
-            dismiss()
-            return
-        }
-
-        let explicitCredentials = explicitCredentials(for: finalDownloads.map(\.url))
-
-        controller.addPendingDownloads(
-            finalDownloads,
-            connectionsPerServer: Int(connectionsPerServer),
-            overrideDirectory: overrideDirectory,
-            startImmediately: start,
-            queueID: targetQueueID,
-            credentials: explicitCredentials,
-            transferOptions: transferOptions,
-            speedLimitKiBPerSecond: speedLimitEnabled ? speedLimitKiBPerSecond : nil
-        )
-        dismiss()
-    }
-
-    private func explicitCredentials(for urls: [URL]) -> DownloadCredentials? {
-        guard useAuthorization else { return nil }
-
-        let cleanUsername = authUsername.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !cleanUsername.isEmpty else { return nil }
-
-        if saveLogin {
-            var savedHosts = Set<String>()
-            for url in urls {
-                if let host = url.host, !savedHosts.contains(host) {
-                    settings.addSiteLogin(urlPattern: host, username: cleanUsername, password: authPassword)
-                    savedHosts.insert(host)
-                }
-            }
-        }
-
-        return DownloadCredentials(username: cleanUsername, password: authPassword)
-    }
-
-    private var overrideDirectory: URL? {
-        guard overrideDestination else { return nil }
-        let trimmed = destinationPath.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else { return nil }
-        return URL(fileURLWithPath: NSString(string: trimmed).expandingTildeInPath, isDirectory: true)
-    }
-
-    private func destinationDirectory(for item: PendingDownload) -> URL {
-        overrideDirectory ?? item.defaultDirectory
-    }
-
-    private func availableCapacity() -> Int64? {
-        let urls = pendingDownloads.isEmpty
-            ? [settings.destinationDirectory(for: .other)]
-            : pendingDownloads.map { destinationDirectory(for: $0) }
-
-        return urls.compactMap { url in
-            let values = try? existingVolumeURL(for: url).resourceValues(forKeys: [
-                .volumeAvailableCapacityForImportantUsageKey,
-                .volumeAvailableCapacityKey
-            ])
-            if let important = values?.volumeAvailableCapacityForImportantUsage {
-                return important
-            }
-            if let available = values?.volumeAvailableCapacity {
-                return Int64(available)
-            }
-            return nil
-        }
-        .min()
-    }
-
-    private func existingVolumeURL(for url: URL) -> URL {
-        var candidate = url
-        while !FileManager.default.fileExists(atPath: candidate.path) {
-            let parent = candidate.deletingLastPathComponent()
-            if parent.path == candidate.path {
-                return URL(fileURLWithPath: NSHomeDirectory())
-            }
-            candidate = parent
-        }
-        return candidate
-    }
-
-    private func categoryColor(_ category: DownloadCategory) -> Color {
-        switch category {
-        case .musics: .pink
-        case .movies: .indigo
-        case .compressed: .orange
-        case .pictures: .teal
-        case .documents: .blue
-        case .other: .gray
-        }
-    }
-}
-
-private struct SummaryMetric: Identifiable {
-    let title: String
-    let value: String
-    let symbolName: String
-
-    var id: String { title }
-}
-
-private struct CompactSummaryStrip: View {
-    let metrics: [SummaryMetric]
-
-    var body: some View {
-        HStack(spacing: 12) {
-            ForEach(metrics) { metric in
-                HStack(spacing: 6) {
-                    Image(systemName: metric.symbolName)
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                    Text(metric.title)
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                    Text(metric.value)
-                        .font(.caption.weight(.semibold).monospacedDigit())
-                        .lineLimit(1)
-                }
-
-                if metric.id != metrics.last?.id {
-                    Divider()
-                        .frame(height: 14)
-                }
-            }
-            Spacer(minLength: 0)
-        }
-        .padding(.horizontal, 10)
-        .padding(.vertical, 7)
-        .background(.quaternary.opacity(0.35))
-        .clipShape(RoundedRectangle(cornerRadius: 8))
-    }
-}
-
-private struct MetadataStatusView: View {
-    let state: PendingDownload.MetadataState
-
-    var body: some View {
-        switch state {
-        case .pending:
-            Label("Pending", systemImage: "clock")
-                .foregroundStyle(.secondary)
-        case .loading:
-            HStack {
-                ProgressView()
-                    .controlSize(.small)
-                Text("Checking")
-            }
-            .foregroundStyle(.secondary)
-        case .loaded:
-            Label("Ready", systemImage: "checkmark.circle")
-                .foregroundStyle(.green)
-        case .failed:
-            Label("Unknown", systemImage: "exclamationmark.circle")
-                .foregroundStyle(.orange)
-        }
-    }
-}

Sources/Firelink/AppSettings.swift

@@ -1,498 +0,0 @@
-import Foundation
-
-struct SiteLogin: Identifiable, Codable, Equatable, Sendable {
-    var id = UUID()
-    var urlPattern: String
-    var username: String
-}
-
-enum ProxyMode: String, Codable, CaseIterable, Sendable {
-    case none
-    case system
-    case custom
-
-    var title: String {
-        switch self {
-        case .none: "No proxy"
-        case .system: "Use system proxy"
-        case .custom: "Set proxy"
-        }
-    }
-}
-
-enum BrowserCookieSource: String, Codable, CaseIterable, Sendable {
-    case none = "None"
-    case safari = "Safari"
-    case chrome = "Chrome"
-    case firefox = "Firefox"
-    case edge = "Edge"
-    case brave = "Brave"
-
-    var ytDlpBrowserName: String? {
-        switch self {
-        case .none:
-            nil
-        case .safari, .chrome, .firefox, .edge, .brave:
-            rawValue.lowercased()
-        }
-    }
-
-    var statusTitle: String {
-        switch self {
-        case .none:
-            "Not using browser cookies"
-        case .safari, .chrome, .firefox, .edge, .brave:
-            "Using \(rawValue) cookies"
-        }
-    }
-
-    var statusDetail: String {
-        switch self {
-        case .none:
-            "Restricted media may fail if the site requires login."
-        case .safari:
-            "yt-dlp reads Safari cookies during metadata fetch and download. Safari may require Full Disk Access."
-        case .chrome, .firefox, .edge, .brave:
-            "yt-dlp reads these browser cookies during metadata fetch and download. Firelink does not store them."
-        }
-    }
-}
-
-enum ProxyType: String, Codable, CaseIterable, Sendable {
-    case http
-    case https
-    case ftp
-    case socks5
-
-    var title: String {
-        switch self {
-        case .http: "HTTP"
-        case .https: "HTTPS (legacy)"
-        case .ftp: "FTP (legacy)"
-        case .socks5: "SOCKS5"
-        }
-    }
-
-    var uriScheme: String {
-        switch self {
-        case .http, .https, .ftp:
-            "http"
-        case .socks5:
-            "socks5"
-        }
-    }
-}
-
-struct ProxySettings: Codable, Equatable, Sendable {
-    var mode: ProxyMode = .none
-    var type: ProxyType = .http
-    var host = ""
-    var port = 8080
-
-    var normalized: ProxySettings {
-        var copy = self
-        copy.host = copy.host.trimmingCharacters(in: .whitespacesAndNewlines)
-        copy.port = min(max(copy.port, 1), 65_535)
-        if copy.type != .http {
-            copy.type = .http
-        }
-        return copy
-    }
-
-    var customProxyURI: String? {
-        let clean = normalized
-        guard !clean.host.isEmpty else { return nil }
-        return "\(clean.type.uriScheme)://\(clean.host):\(clean.port)"
-    }
-}
-
-struct DownloadProxyConfiguration: Equatable, Sendable {
-    var mode: ProxyMode
-    var customProxyURI: String?
-}
-
-@MainActor
-final class AppSettings: ObservableObject {
-    @Published var appTheme: AppTheme = .system {
-        didSet { save() }
-    }
-
-    @Published var appFontSize: AppFontSize = .standard {
-        didSet { save() }
-    }
-
-    @Published var listRowDensity: ListRowDensity = .standard {
-        didSet { save() }
-    }
-
-    @Published var perServerConnections: Int {
-        didSet {
-            let clamped = min(max(perServerConnections, 1), 16)
-            if perServerConnections != clamped {
-                perServerConnections = clamped
-            }
-            save()
-        }
-    }
-
-    @Published var maxConcurrentDownloads: Int {
-        didSet {
-            let clamped = min(max(maxConcurrentDownloads, 1), 12)
-            if maxConcurrentDownloads != clamped {
-                maxConcurrentDownloads = clamped
-            }
-            save()
-        }
-    }
-
-    @Published var globalSpeedLimitKiBPerSecond: Int {
-        didSet {
-            let clamped = min(max(globalSpeedLimitKiBPerSecond, 0), 10_485_760)
-            if globalSpeedLimitKiBPerSecond != clamped {
-                globalSpeedLimitKiBPerSecond = clamped
-                return
-            }
-            save()
-        }
-    }
-
-    @Published var preventsSleepWhileDownloading: Bool {
-        didSet { save() }
-    }
-
-    @Published var proxySettings: ProxySettings {
-        didSet {
-            let normalized = proxySettings.normalized
-            if proxySettings != normalized {
-                proxySettings = normalized
-                return
-            }
-            save()
-        }
-    }
-
-    @Published var downloadDirectories: [DownloadCategory: String] {
-        didSet { save() }
-    }
-
-    @Published var siteLogins: [SiteLogin] {
-        didSet { save() }
-    }
-
-    @Published var mediaCookieSource: BrowserCookieSource {
-        didSet { save() }
-    }
-
-    @Published var extensionPairingToken: String {
-        didSet {
-            if isKeychainAccessGranted {
-                KeychainCredentialStore.setExtensionToken(extensionPairingToken)
-            }
-        }
-    }
-
-    @Published var isKeychainAccessGranted: Bool {
-        didSet { save() }
-    }
-
-    @Published var showKeychainPrimer = false
-
-    @Published var message = ""
-
-    private let defaults: UserDefaults
-    private let storageKey = "Firelink.AppSettings.v1"
-    private var saveTask: Task<Void, Never>?
-
-    init(defaults: UserDefaults = .standard) {
-        self.defaults = defaults
-
-        let granted: Bool
-        if let data = defaults.data(forKey: storageKey),
-           let stored = try? JSONDecoder().decode(StoredSettings.self, from: data) {
-            appTheme = stored.appTheme ?? .system
-            appFontSize = stored.appFontSize ?? .standard
-            listRowDensity = stored.listRowDensity ?? .standard
-            perServerConnections = min(max(stored.perServerConnections, 1), 16)
-            maxConcurrentDownloads = min(max(stored.maxConcurrentDownloads ?? 3, 1), 12)
-            globalSpeedLimitKiBPerSecond = min(max(stored.globalSpeedLimitKiBPerSecond ?? 0, 0), 10_485_760)
-            preventsSleepWhileDownloading = stored.preventsSleepWhileDownloading
-            proxySettings = stored.proxySettings?.normalized ?? ProxySettings()
-            siteLogins = stored.siteLogins
-            mediaCookieSource = stored.mediaCookieSource ?? .none
-            downloadDirectories = Self.decodeDirectories(stored.downloadDirectories)
-            granted = stored.isKeychainAccessGranted ?? false
-            isKeychainAccessGranted = granted
-        } else {
-            appTheme = .system
-            appFontSize = .standard
-            listRowDensity = .standard
-            perServerConnections = 16
-            maxConcurrentDownloads = 3
-            globalSpeedLimitKiBPerSecond = 0
-            preventsSleepWhileDownloading = true
-            proxySettings = ProxySettings()
-            siteLogins = []
-            mediaCookieSource = .none
-            downloadDirectories = Self.defaultDirectories()
-            granted = false
-            isKeychainAccessGranted = granted
-        }
-
-        let currentVersion = Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "unknown"
-        let currentBuild = Bundle.main.infoDictionary?["CFBundleVersion"] as? String ?? "unknown"
-        let fullVersion = "\(currentVersion).\(currentBuild)"
-        let lastVersion = defaults.string(forKey: "Firelink.lastLaunchedVersion")
-        defaults.set(fullVersion, forKey: "Firelink.lastLaunchedVersion")
-
-        var needsPrimer = false
-        if granted {
-            if let lastVersion, lastVersion != fullVersion {
-                needsPrimer = true
-            }
-        }
-
-        if granted {
-            if needsPrimer {
-                showKeychainPrimer = true
-                extensionPairingToken = ""
-            } else {
-                if let token = KeychainCredentialStore.extensionToken() {
-                    extensionPairingToken = token
-                } else {
-                    extensionPairingToken = Self.generateSecureToken()
-                    // The didSet of extensionPairingToken will handle setting it in the keychain since isKeychainAccessGranted is true.
-                }
-            }
-        } else {
-            extensionPairingToken = ""
-        }
-
-        for category in DownloadCategory.allCases where downloadDirectories[category] == nil {
-            downloadDirectories[category] = Self.defaultDirectory(for: category).path
-        }
-    }
-
-    func destinationDirectory(for category: DownloadCategory) -> URL {
-        let path = downloadDirectories[category] ?? Self.defaultDirectory(for: category).path
-        return URL(fileURLWithPath: NSString(string: path).expandingTildeInPath, isDirectory: true)
-    }
-
-    func setDirectory(_ path: String, for category: DownloadCategory) {
-        let trimmed = path.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else { return }
-        downloadDirectories[category] = NSString(string: trimmed).expandingTildeInPath
-    }
-
-    func resetDirectories() {
-        downloadDirectories = Self.defaultDirectories()
-    }
-
-    var downloadProxyConfiguration: DownloadProxyConfiguration {
-        DownloadProxyConfiguration(
-            mode: proxySettings.mode,
-            customProxyURI: proxySettings.customProxyURI
-        )
-    }
-
-    func addSiteLogin(urlPattern: String, username: String, password: String) {
-        saveSiteLogin(id: nil, urlPattern: urlPattern, username: username, password: password)
-    }
-
-    func saveSiteLogin(id: UUID?, urlPattern: String, username: String, password: String) {
-        let pattern = urlPattern.trimmingCharacters(in: .whitespacesAndNewlines)
-        let cleanUsername = username.trimmingCharacters(in: .whitespacesAndNewlines)
-
-        guard !pattern.isEmpty, !cleanUsername.isEmpty else {
-            message = "Add a URL pattern and username."
-            return
-        }
-
-        if let id,
-           siteLogins.contains(where: { $0.id != id && $0.urlPattern.caseInsensitiveCompare(pattern) == .orderedSame }) {
-            message = "A login for \(pattern) already exists."
-            return
-        }
-
-        if let index = siteLogins.firstIndex(where: { login in
-            if let id {
-                return login.id == id
-            }
-            return login.urlPattern.caseInsensitiveCompare(pattern) == .orderedSame
-        }) {
-            let loginID = siteLogins[index].id
-            if !password.isEmpty, !KeychainCredentialStore.setPassword(password, for: loginID) {
-                message = "Could not save the password to Keychain."
-                return
-            }
-            siteLogins[index].urlPattern = pattern
-            siteLogins[index].username = cleanUsername
-            message = "Updated login for \(pattern)."
-            return
-        }
-
-        guard !password.isEmpty else {
-            message = "Add a password."
-            return
-        }
-
-        let login = SiteLogin(urlPattern: pattern, username: cleanUsername)
-        if !KeychainCredentialStore.setPassword(password, for: login.id) {
-            message = "Could not save the password to Keychain."
-            return
-        }
-        siteLogins.append(login)
-        message = "Added login for \(pattern)."
-    }
-
-    func deleteSiteLogins(at offsets: IndexSet) {
-        for offset in offsets {
-            KeychainCredentialStore.deletePassword(for: siteLogins[offset].id)
-        }
-        siteLogins.remove(atOffsets: offsets)
-    }
-
-    func credentials(for url: URL) -> DownloadCredentials? {
-        guard let login = siteLogins.first(where: { Self.matches(url: url, pattern: $0.urlPattern) }),
-              let password = KeychainCredentialStore.password(for: login.id) else {
-            return nil
-        }
-
-        return DownloadCredentials(username: login.username, password: password)
-    }
-
-    func credentials(for login: SiteLogin) -> DownloadCredentials? {
-        guard let password = KeychainCredentialStore.password(for: login.id) else {
-            return nil
-        }
-
-        return DownloadCredentials(username: login.username, password: password)
-    }
-
-    func grantKeychainAccess() {
-        isKeychainAccessGranted = true
-        if let token = KeychainCredentialStore.extensionToken() {
-            extensionPairingToken = token
-        } else {
-            extensionPairingToken = Self.generateSecureToken()
-        }
-    }
-
-    func revokeKeychainAccess() {
-        KeychainCredentialStore.deleteExtensionToken()
-        for login in siteLogins {
-            KeychainCredentialStore.deletePassword(for: login.id)
-        }
-        siteLogins.removeAll()
-        extensionPairingToken = ""
-        isKeychainAccessGranted = false
-    }
-
-    func resolveKeychainPrimer(grantAccess: Bool) {
-        showKeychainPrimer = false
-        if grantAccess {
-            if let token = KeychainCredentialStore.extensionToken() {
-                extensionPairingToken = token
-            } else {
-                extensionPairingToken = Self.generateSecureToken()
-            }
-        } else {
-            isKeychainAccessGranted = false
-        }
-    }
-
-    private func save() {
-        let stored = StoredSettings(
-            appTheme: appTheme,
-            appFontSize: appFontSize,
-            listRowDensity: listRowDensity,
-            perServerConnections: perServerConnections,
-            maxConcurrentDownloads: maxConcurrentDownloads,
-            globalSpeedLimitKiBPerSecond: globalSpeedLimitKiBPerSecond,
-            preventsSleepWhileDownloading: preventsSleepWhileDownloading,
-            proxySettings: proxySettings.normalized,
-            downloadDirectories: Dictionary(uniqueKeysWithValues: downloadDirectories.map { ($0.key.rawValue, $0.value) }),
-            siteLogins: siteLogins,
-            mediaCookieSource: mediaCookieSource,
-            isKeychainAccessGranted: isKeychainAccessGranted
-        )
-        let defaults = self.defaults
-        let storageKey = self.storageKey
-
-        saveTask?.cancel()
-        saveTask = Task { @MainActor [defaults, storageKey] in
-            let data = await Task.detached(priority: .background) {
-                try? JSONEncoder().encode(stored)
-            }.value
-
-            guard !Task.isCancelled, let encoded = data else { return }
-            defaults.set(encoded, forKey: storageKey)
-        }
-    }
-
-    private static func matches(url: URL, pattern rawPattern: String) -> Bool {
-        let pattern = rawPattern.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
-        guard !pattern.isEmpty else { return false }
-
-        let host = (url.host(percentEncoded: false) ?? "").lowercased()
-        let absolute = url.absoluteString.lowercased()
-        let normalizedPattern = URL(string: pattern)?.host ?? pattern
-
-        if normalizedPattern.hasPrefix("*.") {
-            let suffix = String(normalizedPattern.dropFirst(2))
-            return host == suffix || host.hasSuffix(".\(suffix)")
-        }
-
-        if normalizedPattern.contains("*") {
-            let escaped = NSRegularExpression.escapedPattern(for: normalizedPattern)
-                .replacingOccurrences(of: "\\*", with: ".*")
-            return host.range(of: "^\(escaped)$", options: .regularExpression) != nil
-        }
-
-        if normalizedPattern.contains("/") {
-            return absolute.contains(normalizedPattern)
-        }
-
-        return host == normalizedPattern
-    }
-
-    private static func generateSecureToken() -> String {
-        var bytes = [UInt8](repeating: 0, count: 32)
-        let status = SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes)
-        guard status == errSecSuccess else {
-            return UUID().uuidString
-        }
-        return Data(bytes).base64EncodedString()
-    }
-
-    private static func defaultDirectories() -> [DownloadCategory: String] {
-        Dictionary(uniqueKeysWithValues: DownloadCategory.allCases.map { ($0, defaultDirectory(for: $0).path) })
-    }
-
-    private static func defaultDirectory(for category: DownloadCategory) -> URL {
-        let downloads = FileManager.default.urls(for: .downloadsDirectory, in: .userDomainMask).first
-            ?? URL(fileURLWithPath: NSHomeDirectory()).appendingPathComponent("Downloads")
-        return downloads.appendingPathComponent(category.rawValue, isDirectory: true)
-    }
-
-    private static func decodeDirectories(_ stored: [String: String]) -> [DownloadCategory: String] {
-        Dictionary(uniqueKeysWithValues: stored.compactMap { key, value in
-            guard let category = DownloadCategory(rawValue: key) else { return nil }
-            return (category, value)
-        })
-    }
-}
-
-private struct StoredSettings: Codable {
-    var appTheme: AppTheme?
-    var appFontSize: AppFontSize?
-    var listRowDensity: ListRowDensity?
-    var perServerConnections: Int
-    var maxConcurrentDownloads: Int?
-    var globalSpeedLimitKiBPerSecond: Int?
-    var preventsSleepWhileDownloading: Bool
-    var proxySettings: ProxySettings?
-    var downloadDirectories: [String: String]
-    var siteLogins: [SiteLogin]
-    var mediaCookieSource: BrowserCookieSource?
-    var isKeychainAccessGranted: Bool?
-}

Sources/Firelink/Aria2DownloadEngine.swift

@@ -1,606 +0,0 @@
-import Foundation
-import CFNetwork
-import Network
-
-final class Aria2DownloadEngine {
-    struct Handle {
-        let processIdentifier: Int32
-        let rpcPort: Int
-        let rpcSecret: String
-        let cancel: @Sendable () -> Void
-    }
-
-    static func findFreePort() -> Int {
-        var port: UInt16 = 6800
-        let parameters = NWParameters.tcp
-        for p in 6800...6900 {
-            parameters.requiredLocalEndpoint = .hostPort(host: .ipv4(.loopback), port: NWEndpoint.Port(rawValue: UInt16(p))!)
-            if let listener = try? NWListener(using: parameters) {
-                listener.cancel()
-                port = UInt16(p)
-                break
-            }
-        }
-        return Int(port)
-    }
-
-    enum EngineError: LocalizedError {
-        case executableNotFound
-        case launchFailed(String)
-        case unsupportedProxy(String)
-
-        var errorDescription: String? {
-            switch self {
-            case .executableNotFound:
-                "aria2c was not found. Install it with `brew install aria2`, or bundle aria2c inside the app resources."
-            case .launchFailed(let details):
-                "Could not start aria2c: \(details)"
-            case .unsupportedProxy(let details):
-                details
-            }
-        }
-    }
-
-    private let executableURL: URL?
-
-    init(executableURL: URL? = Aria2DownloadEngine.findExecutable()) {
-        self.executableURL = executableURL
-    }
-
-    static func findExecutable() -> URL? {
-        if let bundled = Bundle.main.url(forResource: "aria2c", withExtension: nil),
-           FileManager.default.isExecutableFile(atPath: bundled.path) {
-            return bundled
-        }
-
-        let candidates = [
-            "/opt/homebrew/bin/aria2c",
-            "/usr/local/bin/aria2c",
-            "/usr/bin/aria2c",
-            "/opt/local/bin/aria2c"
-        ]
-
-        if let found = candidates.first(where: { FileManager.default.isExecutableFile(atPath: $0) }) {
-            return URL(fileURLWithPath: found)
-        }
-
-        return nil
-    }
-
-    static func versionString() async -> String? {
-        guard let executableURL = findExecutable() else { return nil }
-
-        return await Task.detached {
-            let process = Process()
-            let outputPipe = Pipe()
-            process.executableURL = executableURL
-            process.arguments = ["--version"]
-            process.standardOutput = outputPipe
-            process.standardError = nil
-            process.standardInput = nil // ensure no stdin is inherited that could cause blocking
-
-            do {
-                try process.run()
-                // Close the write file handle in the parent process immediately
-                // This guarantees readToEnd() won't hang waiting for the parent itself
-                outputPipe.fileHandleForWriting.closeFile()
-
-                let data = try? outputPipe.fileHandleForReading.readToEnd()
-                process.waitUntilExit()
-
-                guard process.terminationStatus == 0, let data = data else { return nil }
-
-                let output = String(data: data, encoding: .utf8) ?? ""
-                return output
-                    .split(whereSeparator: { $0 == "\n" || $0 == "\r" })
-                    .first
-                    .map(String.init)
-            } catch {
-                return nil
-            }
-        }.value
-    }
-
-    func start(
-        item: DownloadItem,
-        proxyConfiguration: DownloadProxyConfiguration,
-        speedLimitKiBPerSecond: Int?,
-        progress: @escaping @Sendable (DownloadProgress) -> Void,
-        completion: @escaping @Sendable (Result<Void, Error>) -> Void
-    ) throws -> Handle {
-        guard let executableURL else {
-            throw EngineError.executableNotFound
-        }
-
-        try FileManager.default.createDirectory(
-            at: item.destinationDirectory,
-            withIntermediateDirectories: true
-        )
-
-        let rpcPort = Self.findFreePort()
-        let rpcSecret = UUID().uuidString
-        let confURL = URL(fileURLWithPath: NSTemporaryDirectory()).appendingPathComponent("firelink-aria2-\(UUID().uuidString).conf")
-        do {
-            let confContent = "rpc-secret=\(rpcSecret)\n"
-            try confContent.write(to: confURL, atomically: true, encoding: .utf8)
-            try FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: confURL.path)
-        } catch {
-            throw EngineError.launchFailed("Could not write secure configuration file: \(error.localizedDescription)")
-        }
-
-        let process = Process()
-        process.executableURL = executableURL
-        process.arguments = try arguments(
-            for: item,
-            proxyConfiguration: proxyConfiguration,
-            speedLimitKiBPerSecond: speedLimitKiBPerSecond,
-            rpcPort: rpcPort,
-            confURL: confURL
-        )
-
-        let inputPipe = Pipe()
-        let outputPipe = Pipe()
-        let errorPipe = Pipe()
-        process.standardInput = inputPipe
-        process.standardOutput = outputPipe
-        process.standardError = errorPipe
-
-        let parser = Aria2ProgressParser()
-        let outputBuffer = LockedDataBuffer()
-        let errorBuffer = LockedDataBuffer()
-        let completionGate = CompletionGate(completion)
-        let completionMonitor = CompletionMonitor()
-
-        outputPipe.fileHandleForReading.readabilityHandler = { handle in
-            let data = handle.availableData
-            guard !data.isEmpty else { return }
-            outputBuffer.append(data)
-            if let text = String(data: data, encoding: .utf8) {
-                for update in parser.parse(text) {
-                    progress(update)
-                }
-            }
-        }
-
-        errorPipe.fileHandleForReading.readabilityHandler = { handle in
-            let data = handle.availableData
-            guard !data.isEmpty else { return }
-            errorBuffer.append(data)
-        }
-
-        process.terminationHandler = { finishedProcess in
-            try? FileManager.default.removeItem(at: confURL)
-            completionMonitor.cancel()
-            outputPipe.fileHandleForReading.readabilityHandler = nil
-            errorPipe.fileHandleForReading.readabilityHandler = nil
-
-            if finishedProcess.terminationStatus == 0 {
-                completionGate.complete(.success(()))
-                return
-            }
-
-            let stderr = String(data: errorBuffer.data, encoding: .utf8)?
-                .trimmingCharacters(in: .whitespacesAndNewlines)
-            let stdout = String(data: outputBuffer.data, encoding: .utf8)?
-                .trimmingCharacters(in: .whitespacesAndNewlines)
-            let message = [stderr, stdout]
-                .compactMap { $0 }
-                .filter { !$0.isEmpty }
-                .joined(separator: "\n")
-            completionGate.complete(.failure(EngineError.launchFailed(message.isEmpty ? "exit code \(finishedProcess.terminationStatus)" : message)))
-        }
-
-        do {
-            try process.run()
-            if let input = inputFileContent(for: item).data(using: .utf8) {
-                inputPipe.fileHandleForWriting.write(input)
-            }
-            inputPipe.fileHandleForWriting.closeFile()
-        } catch {
-            try? FileManager.default.removeItem(at: confURL)
-            throw EngineError.launchFailed(error.localizedDescription)
-        }
-
-        completionMonitor.set(
-            Self.monitorCompletion(
-                rpcPort: rpcPort,
-                rpcSecret: rpcSecret,
-                process: process,
-                completionGate: completionGate
-            )
-        )
-
-        return Handle(processIdentifier: process.processIdentifier, rpcPort: rpcPort, rpcSecret: rpcSecret) {
-            completionMonitor.cancel()
-            if process.isRunning {
-                process.terminate()
-            }
-            try? FileManager.default.removeItem(at: confURL)
-        }
-    }
-
-    private static func monitorCompletion(
-        rpcPort: Int,
-        rpcSecret: String,
-        process: Process,
-        completionGate: CompletionGate<Void>
-    ) -> Task<Void, Never> {
-        Task.detached {
-            while !Task.isCancelled && process.isRunning {
-                if await completedDownloadStatus(rpcPort: rpcPort, rpcSecret: rpcSecret) {
-                    completionGate.complete(.success(()))
-                    if process.isRunning {
-                        process.terminate()
-                    }
-                    return
-                }
-
-                do {
-                    try await Task.sleep(nanoseconds: 1_000_000_000)
-                } catch {
-                    return
-                }
-            }
-        }
-    }
-
-    private static func completedDownloadStatus(rpcPort: Int, rpcSecret: String) async -> Bool {
-        guard let stopped = await rpcCall(
-            rpcPort: rpcPort,
-            rpcSecret: rpcSecret,
-            method: "aria2.tellStopped",
-            arguments: [0, 10, ["status", "errorCode", "completedLength", "totalLength"]]
-        ) as? [[String: Any]] else {
-            return false
-        }
-
-        if stopped.contains(where: { item in
-            (item["status"] as? String) == "complete"
-        }) {
-            return true
-        }
-
-        return stopped.contains { item in
-            guard (item["status"] as? String) == "error",
-                  (item["errorCode"] as? String) == "0",
-                  let completedLength = Int64(item["completedLength"] as? String ?? ""),
-                  let totalLength = Int64(item["totalLength"] as? String ?? ""),
-                  totalLength > 0 else {
-                return false
-            }
-            return completedLength >= totalLength
-        }
-    }
-
-    private static func rpcCall(
-        rpcPort: Int,
-        rpcSecret: String,
-        method: String,
-        arguments: [Any]
-    ) async -> Any? {
-        guard let url = URL(string: "http://127.0.0.1:\(rpcPort)/jsonrpc") else { return nil }
-        let payload: [String: Any] = [
-            "jsonrpc": "2.0",
-            "method": method,
-            "id": UUID().uuidString,
-            "params": ["token:\(rpcSecret)"] + arguments
-        ]
-
-        guard let data = try? JSONSerialization.data(withJSONObject: payload) else { return nil }
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.addValue("application/json", forHTTPHeaderField: "Content-Type")
-        request.httpBody = data
-        request.timeoutInterval = 3
-
-        guard let (responseData, _) = try? await URLSession.shared.data(for: request),
-              let json = try? JSONSerialization.jsonObject(with: responseData) as? [String: Any] else {
-            return nil
-        }
-        return json["result"]
-    }
-
-    static func updateSpeedLimit(handle: Handle, speedLimitKiBPerSecond: Int?) async {
-        guard let url = URL(string: "http://127.0.0.1:\(handle.rpcPort)/jsonrpc") else { return }
-
-        let limitValue = speedLimitKiBPerSecond.map { "\($0)K" } ?? "0"
-        let payload: [String: Any] = [
-            "jsonrpc": "2.0",
-            "method": "aria2.changeGlobalOption",
-            "id": UUID().uuidString,
-            "params": [
-                "token:\(handle.rpcSecret)",
-                ["max-overall-download-limit": limitValue]
-            ]
-        ]
-
-        guard let data = try? JSONSerialization.data(withJSONObject: payload) else { return }
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.addValue("application/json", forHTTPHeaderField: "Content-Type")
-        request.httpBody = data
-        request.timeoutInterval = 3
-
-        _ = try? await URLSession.shared.data(for: request)
-    }
-
-    private func arguments(
-        for item: DownloadItem,
-        proxyConfiguration: DownloadProxyConfiguration,
-        speedLimitKiBPerSecond: Int?,
-        rpcPort: Int,
-        confURL: URL
-    ) throws -> [String] {
-        var arguments = [
-            "--conf-path=\(confURL.path)",
-            "--continue=true",
-            "--allow-overwrite=false",
-            "--auto-file-renaming=true",
-            "--summary-interval=1",
-            "--console-log-level=warn",
-            "--download-result=hide",
-            "--file-allocation=none",
-            "--min-split-size=1M",
-            "--max-tries=10",
-            "--retry-wait=5",
-            "--connect-timeout=30",
-            "--timeout=60",
-            "--uri-selector=adaptive",
-            "--input-file=-",
-            "--enable-rpc=true",
-            "--rpc-listen-port=\(rpcPort)",
-            "--rpc-listen-all=false"
-        ]
-
-        if let speedLimitKiBPerSecond, speedLimitKiBPerSecond > 0 {
-            arguments.append("--max-overall-download-limit=\(speedLimitKiBPerSecond)K")
-        }
-
-        arguments.append(contentsOf: try proxyArguments(for: item, configuration: proxyConfiguration))
-        return arguments
-    }
-
-    private func proxyArguments(for item: DownloadItem, configuration: DownloadProxyConfiguration) throws -> [String] {
-        switch configuration.mode {
-        case .none:
-            return clearedProxyArguments()
-        case .system:
-            switch systemProxyResolution(for: item.url) {
-            case .direct:
-                return clearedProxyArguments()
-            case .proxy(let proxyURI):
-                return ["\(proxyArgumentName(for: item.url.scheme))=\(sanitizedOptionValue(proxyURI))"]
-            case .unsupported(let message):
-                throw EngineError.unsupportedProxy(message)
-            }
-        case .custom:
-            guard let proxyURI = configuration.customProxyURI else { return [] }
-            return ["--all-proxy=\(sanitizedOptionValue(proxyURI))"]
-        }
-    }
-
-    private func clearedProxyArguments() -> [String] {
-        [
-            "--all-proxy=",
-            "--http-proxy=",
-            "--https-proxy=",
-            "--ftp-proxy="
-        ]
-    }
-
-    private func proxyArgumentName(for urlScheme: String?) -> String {
-        switch urlScheme?.lowercased() {
-        case "http": "--http-proxy"
-        case "https": "--https-proxy"
-        case "ftp": "--ftp-proxy"
-        default: "--all-proxy"
-        }
-    }
-
-    private enum SystemProxyResolution {
-        case direct
-        case proxy(String)
-        case unsupported(String)
-    }
-
-    private func systemProxyResolution(for url: URL) -> SystemProxyResolution {
-        guard let systemSettings = CFNetworkCopySystemProxySettings()?.takeRetainedValue() as? [String: Any],
-              let proxies = CFNetworkCopyProxiesForURL(url as CFURL, systemSettings as CFDictionary).takeRetainedValue() as? [[String: Any]] else {
-            return .direct
-        }
-
-        for proxy in proxies {
-            guard let type = proxy[kCFProxyTypeKey as String] as? String else { continue }
-            if type == kCFProxyTypeNone as String {
-                return .direct
-            }
-            if type == kCFProxyTypeSOCKS as String {
-                return .unsupported("aria2c does not support SOCKS system proxies. Choose an HTTP, HTTPS, or FTP proxy in Network settings.")
-            }
-            if type == kCFProxyTypeAutoConfigurationURL as String ||
-                type == kCFProxyTypeAutoConfigurationJavaScript as String {
-                return .unsupported("aria2c does not support automatic system proxy configuration. Choose a manual proxy in Network settings.")
-            }
-            if let uri = proxyURI(fromSystemProxy: proxy, type: type) {
-                return .proxy(uri)
-            }
-        }
-
-        return .direct
-    }
-
-    private func proxyURI(fromSystemProxy proxy: [String: Any], type: String) -> String? {
-        guard let host = proxy[kCFProxyHostNameKey as String] as? String,
-              !host.isEmpty else {
-            return nil
-        }
-
-        let port = (proxy[kCFProxyPortNumberKey as String] as? NSNumber)?.intValue
-        let scheme: String
-        if type == kCFProxyTypeHTTPS as String {
-            scheme = "https"
-        } else if type == kCFProxyTypeFTP as String {
-            scheme = "ftp"
-        } else {
-            scheme = "http"
-        }
-
-        guard let port else {
-            return "\(scheme)://\(host)"
-        }
-        return "\(scheme)://\(host):\(port)"
-    }
-
-    private func inputFileContent(for item: DownloadItem) -> String {
-        let connections = min(max(item.connectionsPerServer, 1), 16)
-        let urls = ([item.url] + (item.mirrorURLs ?? []))
-            .map { sanitizedOptionValue($0.absoluteString) }
-            .joined(separator: "\t")
-        var lines = [
-            urls,
-            "  dir=\(sanitizedOptionValue(item.destinationDirectory.path))",
-            "  out=\(sanitizedOptionValue(item.fileName.replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "\\", with: "_")))",
-            "  split=\(connections)",
-            "  max-connection-per-server=\(connections)"
-        ]
-
-        if let checksum = item.checksum?.normalized, !checksum.isEmpty {
-            lines.append("  checksum=\(checksum.algorithm.rawValue)=\(sanitizedOptionValue(checksum.value))")
-        }
-
-        for header in (item.requestHeaders ?? []).map(\.normalized) where !header.isEmpty {
-            lines.append("  header=\(sanitizedOptionValue(header.headerLine))")
-        }
-
-        if let cookieHeader = item.cookieHeader?.trimmingCharacters(in: .whitespacesAndNewlines), !cookieHeader.isEmpty {
-            lines.append("  header=Cookie: \(sanitizedOptionValue(cookieHeader))")
-        }
-
-        if let credentials = item.credentials, !credentials.isEmpty {
-            let scheme = item.url.scheme?.lowercased()
-            if scheme == "ftp" || scheme == "sftp" {
-                lines.append("  ftp-user=\(sanitizedOptionValue(credentials.username))")
-                lines.append("  ftp-passwd=\(sanitizedOptionValue(credentials.password))")
-            } else {
-                lines.append("  http-user=\(sanitizedOptionValue(credentials.username))")
-                lines.append("  http-passwd=\(sanitizedOptionValue(credentials.password))")
-                lines.append("  http-auth-challenge=true")
-            }
-        }
-
-        return lines.joined(separator: "\n") + "\n"
-    }
-
-    private func sanitizedOptionValue(_ value: String) -> String {
-        value.replacingOccurrences(of: "\r", with: "")
-            .replacingOccurrences(of: "\n", with: "")
-    }
-}
-
-final class LockedDataBuffer: @unchecked Sendable {
-    private let lock = NSLock()
-    private var storage = Data()
-    private let maxBytes: Int
-
-    init(maxBytes: Int = 512 * 1024) {
-        self.maxBytes = maxBytes
-    }
-
-    var data: Data {
-        lock.withLock { storage }
-    }
-
-    func append(_ data: Data) {
-        lock.withLock {
-            storage.append(data)
-            if storage.count > maxBytes {
-                storage.removeFirst(storage.count - maxBytes)
-            }
-        }
-    }
-}
-
-final class CompletionGate<Success>: @unchecked Sendable {
-    private let lock = NSLock()
-    private var didComplete = false
-    private let completion: @Sendable (Result<Success, Error>) -> Void
-
-    init(_ completion: @escaping @Sendable (Result<Success, Error>) -> Void) {
-        self.completion = completion
-    }
-
-    func complete(_ result: Result<Success, Error>) {
-        lock.lock()
-        let shouldComplete = !didComplete
-        if shouldComplete {
-            didComplete = true
-        }
-        lock.unlock()
-
-        guard shouldComplete else { return }
-        completion(result)
-    }
-}
-
-final class CompletionMonitor: @unchecked Sendable {
-    private let lock = NSLock()
-    private var task: Task<Void, Never>?
-
-    func set(_ task: Task<Void, Never>) {
-        lock.lock()
-        self.task = task
-        lock.unlock()
-    }
-
-    func cancel() {
-        lock.lock()
-        let task = self.task
-        self.task = nil
-        lock.unlock()
-        task?.cancel()
-    }
-}
-
-final class Aria2ProgressParser: @unchecked Sendable {
-    private let percentageRegex = try? NSRegularExpression(pattern: #"\((\d+(?:\.\d+)?)%\)"#)
-    private let connectionRegex = try? NSRegularExpression(pattern: #"CN:(\d+)"#)
-    private let speedRegex = try? NSRegularExpression(pattern: #"DL:([^\s\]]+)"#)
-    private let etaRegex = try? NSRegularExpression(pattern: #"ETA:([^\s\]]+)"#)
-    private let bytesRegex = try? NSRegularExpression(pattern: #"\s([0-9.]+(?:KiB|MiB|GiB|TiB|B)?/[0-9.]+(?:KiB|MiB|GiB|TiB|B)?)\("#)
-
-    func parse(_ text: String) -> [DownloadProgress] {
-        text
-            .split(whereSeparator: { $0 == "\n" || $0 == "\r" })
-            .compactMap { parseLine(String($0)) }
-    }
-
-    private func parseLine(_ line: String) -> DownloadProgress? {
-        guard line.contains("%") else { return nil }
-
-        let percentage = firstCapture(in: line, regex: percentageRegex).flatMap(Double.init) ?? 0
-        let connections = firstCapture(in: line, regex: connectionRegex).flatMap(Int.init) ?? 0
-        let speed = firstCapture(in: line, regex: speedRegex) ?? "-"
-        let eta = firstCapture(in: line, regex: etaRegex) ?? "-"
-        let bytes = firstCapture(in: line, regex: bytesRegex) ?? "-"
-
-        return DownloadProgress(
-            fraction: min(max(percentage / 100, 0), 1),
-            bytesText: bytes,
-            speedText: speed,
-            etaText: eta,
-            connectionCount: connections
-        )
-    }
-
-    private func firstCapture(in text: String, regex: NSRegularExpression?) -> String? {
-        guard let regex else { return nil }
-        let range = NSRange(text.startIndex..<text.endIndex, in: text)
-        guard let match = regex.firstMatch(in: text, range: range), match.numberOfRanges > 1 else {
-            return nil
-        }
-        guard let captureRange = Range(match.range(at: 1), in: text) else {
-            return nil
-        }
-        return String(text[captureRange])
-    }
-}

Sources/Firelink/Assets.xcassets/GitHub.imageset/Contents.json

@@ -1,15 +0,0 @@
-{
-  "images" : [
-    {
-      "filename" : "github-mark.png",
-      "idiom" : "universal"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  },
-  "properties" : {
-    "template-rendering-intent" : "template"
-  }
-}

Sources/Firelink/Assets.xcassets/MenuBarIcon.imageset/Contents.json

@@ -1,16 +0,0 @@
-{
-  "images" : [
-    {
-      "filename" : "MenuBarIconTemplate.png",
-      "idiom" : "mac",
-      "scale" : "2x"
-    }
-  ],
-  "info" : {
-    "author" : "xcode",
-    "version" : 1
-  },
-  "properties" : {
-    "template-rendering-intent" : "template"
-  }
-}

Sources/Firelink/ChunkMapView.swift

@@ -1,160 +0,0 @@
-import SwiftUI
-
-struct ChunkMapView: View {
-    let item: DownloadItem
-
-    @State private var bitfield: String = ""
-    @State private var numPieces: Int = 0
-    @State private var pollTask: Task<Void, Never>?
-    @State private var isVisible = false
-
-    var body: some View {
-        VStack(alignment: .leading, spacing: 8) {
-            if numPieces > 0 {
-                ChunkGrid(bitfield: bitfield, numPieces: numPieces)
-            } else {
-                Text("Loading chunk data...")
-                    .foregroundStyle(.secondary)
-                    .font(.caption)
-            }
-        }
-        .onAppear {
-            isVisible = true
-            startPolling()
-        }
-        .onDisappear {
-            isVisible = false
-            pollTask?.cancel()
-        }
-        .onChange(of: item.status) { _, status in
-            if status != .downloading {
-                pollTask?.cancel()
-            } else if isVisible && pollTask == nil {
-                startPolling()
-            }
-        }
-    }
-
-    private func startPolling() {
-        pollTask?.cancel()
-        guard let port = item.rpcPort, let secret = item.rpcSecret, item.status == .downloading else { return }
-
-        pollTask = Task {
-            while !Task.isCancelled {
-                await fetchStatus(port: port, secret: secret)
-                do {
-                    try await Task.sleep(nanoseconds: 1_000_000_000)
-                } catch {
-                    break
-                }
-            }
-        }
-    }
-
-    private func fetchStatus(port: Int, secret: String) async {
-        guard let url = URL(string: "http://127.0.0.1:\(port)/jsonrpc") else { return }
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.addValue("application/json", forHTTPHeaderField: "Content-Type")
-
-        let payload: [String: Any] = [
-            "jsonrpc": "2.0",
-            "method": "aria2.tellActive",
-            "id": "1",
-            "params": ["token:\(secret)", ["bitfield", "numPieces"]]
-        ]
-
-        guard let data = try? JSONSerialization.data(withJSONObject: payload) else { return }
-        request.httpBody = data
-
-        do {
-            let (responseData, _) = try await URLSession.shared.data(for: request)
-            guard let json = try JSONSerialization.jsonObject(with: responseData) as? [String: Any],
-                  let result = json["result"] as? [[String: Any]],
-                  let active = result.first else {
-                return
-            }
-
-            let fetchedBitfield = active["bitfield"] as? String ?? ""
-            let fetchedNumPiecesStr = active["numPieces"] as? String ?? "0"
-            let fetchedNumPieces = Int(fetchedNumPiecesStr) ?? 0
-
-            await MainActor.run {
-                self.bitfield = fetchedBitfield
-                self.numPieces = fetchedNumPieces
-            }
-        } catch {
-            // Ignore errors
-        }
-    }
-}
-
-struct ChunkGrid: View {
-    let bitfield: String
-    let numPieces: Int
-
-    private var pieces: [Bool] {
-        var result = [Bool]()
-        result.reserveCapacity(numPieces)
-        for char in bitfield {
-            if let val = char.hexDigitValue {
-                for i in (0..<4).reversed() {
-                    if result.count < numPieces {
-                        result.append((val & (1 << i)) != 0)
-                    }
-                }
-            }
-        }
-        while result.count < numPieces {
-            result.append(false)
-        }
-        return result
-    }
-
-    var body: some View {
-        let itemPieces = pieces
-        Canvas { context, size in
-            let boxSize: CGFloat = 10
-            let spacing: CGFloat = 2
-            let cornerSize = CGSize(width: 2, height: 2)
-            let width = size.width
-
-            let x: CGFloat = 0
-            let y: CGFloat = 0
-
-            let completedPath = Path { p in
-                var cx = x
-                var cy = y
-                for piece in itemPieces {
-                    if piece {
-                        p.addRoundedRect(in: CGRect(x: cx, y: cy, width: boxSize - spacing, height: boxSize - spacing), cornerSize: cornerSize)
-                    }
-                    cx += boxSize
-                    if cx + boxSize > width {
-                        cx = 0
-                        cy += boxSize
-                    }
-                }
-            }
-
-            let pendingPath = Path { p in
-                var cx: CGFloat = 0
-                var cy: CGFloat = 0
-                for piece in itemPieces {
-                    if !piece {
-                        p.addRoundedRect(in: CGRect(x: cx, y: cy, width: boxSize - spacing, height: boxSize - spacing), cornerSize: cornerSize)
-                    }
-                    cx += boxSize
-                    if cx + boxSize > width {
-                        cx = 0
-                        cy += boxSize
-                    }
-                }
-            }
-
-            context.fill(pendingPath, with: .color(Color.primary.opacity(0.08)))
-            context.fill(completedPath, with: .color(Color.accentColor))
-        }
-        .frame(minHeight: 140)
-    }
-}

Sources/Firelink/ContentView.swift

@@ -1,318 +0,0 @@
-import AppKit
-import SwiftUI
-
-struct ContentView: View {
-    @EnvironmentObject private var controller: DownloadController
-    @EnvironmentObject private var settings: AppSettings
-    @Environment(\.openWindow) private var openWindow
-    @State private var selection: Set<DownloadItem.ID> = []
-    @State private var sidebarSelection: SidebarSelection = .downloads(.all)
-    @State private var showDeleteConfirmation = false
-
-    var body: some View {
-        NavigationSplitView {
-            SidebarView(selection: $sidebarSelection)
-                .navigationSplitViewColumnWidth(min: 190, ideal: 220, max: 260)
-                .themeBackground(settings.appTheme.theme.secondaryBackground)
-        } detail: {
-            detailView
-                .themeBackground(settings.appTheme.theme.background)
-        }
-        .onReceive(NotificationCenter.default.publisher(for: NSNotification.Name("OpenAddDownloadsWindow"))) { _ in
-            openWindow(id: "add-downloads")
-        }
-        .onDrop(of: [.url, .fileURL, .plainText], isTargeted: nil) { providers in
-            for provider in providers {
-                if provider.canLoadObject(ofClass: URL.self) {
-                    _ = provider.loadObject(ofClass: URL.self) { url, _ in
-                        if let url = url {
-                            DispatchQueue.main.async {
-                                let newText = url.absoluteString
-                                if let existing = controller.pendingPasteboardText, !existing.isEmpty {
-                                    controller.pendingPasteboardText = existing + "\n" + newText
-                                } else {
-                                    controller.pendingPasteboardText = newText
-                                }
-                                controller.pendingReferer = nil
-                                openWindow(id: "add-downloads")
-                            }
-                        }
-                    }
-                } else if provider.canLoadObject(ofClass: String.self) {
-                    _ = provider.loadObject(ofClass: String.self) { text, _ in
-                        if let text = text {
-                            DispatchQueue.main.async {
-                                if let existing = controller.pendingPasteboardText, !existing.isEmpty {
-                                    controller.pendingPasteboardText = existing + "\n" + text
-                                } else {
-                                    controller.pendingPasteboardText = text
-                                }
-                                controller.pendingReferer = nil
-                                openWindow(id: "add-downloads")
-                            }
-                        }
-                    }
-                }
-            }
-            return true
-        }
-        .sheet(isPresented: $settings.showKeychainPrimer) {
-            KeychainPrimerView()
-                .environmentObject(settings)
-        }
-    }
-
-    @ViewBuilder
-    private var detailView: some View {
-        switch sidebarSelection {
-        case .downloads(let filter):
-            downloadsView(filter: filter)
-        case .queue(let queueID):
-            queueView(queueID: queueID)
-        case .scheduler:
-            SchedulerView()
-        case .speedLimiter:
-            SpeedLimiterView()
-        case .settings:
-            SettingsPaneContainer()
-        }
-    }
-
-    private func queueView(queueID: UUID) -> some View {
-        downloadsView(
-            filter: .all,
-            title: controller.queueName(for: queueID),
-            items: controller.queueItems(for: queueID),
-            queueID: queueID
-        )
-    }
-
-    private func downloadsView(filter: DownloadSidebarFilter) -> some View {
-        downloadsView(
-            filter: filter,
-            title: filter.title,
-            items: filteredDownloads(for: filter),
-            queueID: nil
-        )
-    }
-
-    private func downloadsView(filter: DownloadSidebarFilter, title: String, items: [DownloadItem], queueID: UUID?) -> some View {
-        VStack(spacing: 0) {
-            DownloadTable(
-                items: items,
-                selection: $selection,
-                title: title,
-                queueID: queueID
-            )
-            Divider()
-            StatusBar()
-        }
-        .toolbar {
-            ToolbarItem(placement: .primaryAction) {
-                Button {
-                    controller.pendingAddQueueID = queueID
-                    openWindow(id: "add-downloads")
-                } label: {
-                    Label("Add", systemImage: "plus")
-                }
-            }
-
-            ToolbarItemGroup {
-                let canStop = selectedItems.isEmpty ? hasActiveDownloads(in: queueID) : selectedItems.contains(where: { $0.status == .downloading })
-                Button {
-                    if selectedItems.isEmpty {
-                        controller.pauseActiveDownloads(queueID: queueID)
-                    } else {
-                        for item in selectedItems where item.status == .downloading {
-                            controller.pause(item)
-                        }
-                    }
-                } label: {
-                    Label(selectedItems.isEmpty ? "Stop All" : "Stop", systemImage: "stop.fill")
-                }
-                .disabled(!canStop)
-
-                let canStart = selectedItems.isEmpty ? hasQueuedDownloads(in: queueID) : selectedItems.contains(where: { $0.status == .paused || $0.status == .failed || $0.status == .canceled })
-                Button {
-                    if selectedItems.isEmpty {
-                        controller.startQueue(queueID: queueID)
-                    } else {
-                        for item in selectedItems where item.status == .paused || item.status == .failed || item.status == .canceled {
-                            controller.resume(item)
-                        }
-                    }
-                } label: {
-                    Label(selectedItems.isEmpty ? "Start Queue" : "Start", systemImage: "play.fill")
-                }
-                .disabled(!canStart)
-            }
-        }
-        .background {
-            Button("") {
-                if !selection.isEmpty {
-                    showDeleteConfirmation = true
-                }
-            }
-            .keyboardShortcut(.delete, modifiers: [])
-            .opacity(0)
-            .buttonStyle(.plain)
-            .focusable(false)
-
-            Button("") {
-                handlePaste(queueID: queueID)
-            }
-            .keyboardShortcut("v", modifiers: .command)
-            .opacity(0)
-            .buttonStyle(.plain)
-            .focusable(false)
-
-            Button("") {
-                selectAll(items: items)
-            }
-            .keyboardShortcut("a", modifiers: .command)
-            .opacity(0)
-            .buttonStyle(.plain)
-            .focusable(false)
-
-            Button("") {
-                if let item = selectedItems.first {
-                    performPrimaryAction(for: item)
-                }
-            }
-            .keyboardShortcut(.return, modifiers: [])
-            .opacity(0)
-            .buttonStyle(.plain)
-            .focusable(false)
-        }
-        .confirmationDialog(
-            "Delete \(selection.count) Download\(selection.count == 1 ? "" : "s")",
-            isPresented: $showDeleteConfirmation
-        ) {
-            Button("Remove from List") {
-                deleteSelected(deleteFiles: false)
-            }
-            Button("Move Files and Cache to Trash", role: .destructive) {
-                deleteSelected(deleteFiles: true)
-            }
-            Button("Cancel", role: .cancel) {}
-        } message: {
-            Text("Are you sure you want to delete the selected downloads?")
-        }
-    }
-
-    private var selectedItems: [DownloadItem] {
-        controller.downloads.filter { selection.contains($0.id) }
-    }
-
-    private func deleteSelected(deleteFiles: Bool) {
-        for item in selectedItems {
-            controller.delete(item, deleteFiles: deleteFiles)
-        }
-        selection.removeAll()
-    }
-
-    private func handlePaste(queueID: UUID?) {
-        guard let text = NSPasteboard.general.string(forType: .string), !text.isEmpty else { return }
-        controller.pendingPasteboardText = text
-        controller.pendingReferer = nil
-        controller.pendingAddQueueID = queueID
-        openWindow(id: "add-downloads")
-    }
-
-    private func selectAll(items: [DownloadItem]) {
-        selection = Set(items.map { $0.id })
-    }
-
-    private func performPrimaryAction(for item: DownloadItem) {
-        if item.status == .completed {
-            NSWorkspace.shared.open(URL(fileURLWithPath: item.destinationPath))
-        } else {
-            openWindow(id: "download-properties", value: item.id)
-        }
-    }
-
-    private func hasActiveDownloads(in queueID: UUID?) -> Bool {
-        if let queueID {
-            return controller.downloads.contains { $0.status == .downloading && $0.queueID == queueID }
-        }
-
-        return controller.activeCount > 0
-    }
-
-    private func hasQueuedDownloads(in queueID: UUID?) -> Bool {
-        if let queueID {
-            return controller.queueItems(for: queueID).contains { $0.status == .queued }
-        }
-
-        return controller.queuedCount > 0
-    }
-
-    private func filteredDownloads(for filter: DownloadSidebarFilter) -> [DownloadItem] {
-        switch filter {
-        case .all:
-            controller.downloads
-        case .queued:
-            controller.downloads.filter { $0.status == .queued }
-        case .active:
-            controller.downloads.filter { $0.status == .downloading }
-        case .completed:
-            controller.downloads.filter { $0.status == .completed }
-        case .unfinished:
-            controller.downloads.filter { $0.status != .completed }
-        case .category(let category):
-            controller.downloads.filter { $0.category == category }
-        }
-    }
-}
-
-struct KeychainPrimerView: View {
-    @EnvironmentObject private var settings: AppSettings
-    @Environment(\.dismiss) private var dismiss
-
-    var body: some View {
-        VStack(spacing: 24) {
-            Image(systemName: "lock.shield")
-                .resizable()
-                .scaledToFit()
-                .frame(width: 64, height: 64)
-                .foregroundStyle(settings.appTheme.theme.accent ?? Color.accentColor)
-                .padding(.top, 16)
-
-            VStack(spacing: 8) {
-                Text("Security Update")
-                    .font(.title2)
-                    .fontWeight(.semibold)
-
-                Text("Firelink has been updated. To keep your browser extension running smoothly and your site logins secure, please re-authorize access to your Mac's Keychain on the next prompt.")
-                    .font(.body)
-                    .multilineTextAlignment(.center)
-                    .foregroundStyle(.secondary)
-                    .padding(.horizontal)
-            }
-
-            VStack(spacing: 12) {
-                Button {
-                    settings.resolveKeychainPrimer(grantAccess: true)
-                } label: {
-                    Text("Grant Secure Access")
-                        .frame(maxWidth: .infinity)
-                }
-                .buttonStyle(.borderedProminent)
-                .controlSize(.large)
-
-                Button {
-                    settings.resolveKeychainPrimer(grantAccess: false)
-                } label: {
-                    Text("Not Now")
-                        .frame(maxWidth: .infinity)
-                }
-                .buttonStyle(.borderless)
-                .controlSize(.large)
-            }
-            .padding(.horizontal, 32)
-            .padding(.bottom, 16)
-        }
-        .padding(24)
-        .frame(width: 400)
-    }
-}

Sources/Firelink/DownloadMetadataFetcher.swift

@@ -1,225 +0,0 @@
-import Foundation
-
-enum DownloadURLParser {
-    private static let detector = try? NSDataDetector(types: NSTextCheckingResult.CheckingType.link.rawValue)
-
-    static func parse(_ text: String) -> [URL] {
-        let range = NSRange(text.startIndex..<text.endIndex, in: text)
-        let detected = detector?.matches(in: text, range: range).compactMap(\.url) ?? []
-
-        let tokenized = text
-            .components(separatedBy: CharacterSet.whitespacesAndNewlines.union(CharacterSet(charactersIn: ",;")))
-            .compactMap { token -> URL? in
-                let trimmed = token.trimmingCharacters(in: CharacterSet(charactersIn: "\"'<>[]()"))
-                guard let url = URL(string: trimmed),
-                      let scheme = url.scheme?.lowercased(),
-                      ["http", "https", "ftp", "sftp"].contains(scheme) else {
-                    return nil
-                }
-                return url
-            }
-
-        var seen = Set<String>()
-        return (detected + tokenized).filter { url in
-            guard let scheme = url.scheme?.lowercased(),
-                  ["http", "https", "ftp", "sftp"].contains(scheme) else {
-                return false
-            }
-            return seen.insert(url.absoluteString).inserted
-        }
-    }
-}
-
-enum DownloadMetadataFetcher {
-    static func fetch(
-        for url: URL,
-        settings: AppSettings,
-        credentials: DownloadCredentials? = nil,
-        transferOptions: DownloadTransferOptions = DownloadTransferOptions(),
-        isAutoFetch: Bool = false
-    ) async -> PendingDownload {
-        let initialName = FileClassifier.fileName(from: url)
-        let initialCategory = FileClassifier.category(forFileName: initialName)
-        let initialDirectory = await settings.destinationDirectory(for: initialCategory)
-        var pending = PendingDownload(
-            url: url,
-            fileName: initialName,
-            category: initialCategory,
-            defaultDirectory: initialDirectory,
-            state: .loading
-        )
-
-        guard url.scheme?.lowercased().hasPrefix("http") == true else {
-            pending.state = .loaded
-            return pending
-        }
-
-        if isAutoFetch, let host = url.host, isPrivateHost(host) {
-            pending.state = .loaded
-            return pending
-        }
-
-        var request = URLRequest(url: url)
-        request.httpMethod = "HEAD"
-        request.timeoutInterval = 12
-        request.setValue("Firelink/0.1", forHTTPHeaderField: "User-Agent")
-
-        let normalizedHeaders = transferOptions.requestHeaders.map(\.normalized).filter { !$0.isEmpty }
-        let hasAuthorizationHeader = normalizedHeaders.contains { $0.name.caseInsensitiveCompare("Authorization") == .orderedSame }
-        if let credentials, !credentials.isEmpty, !hasAuthorizationHeader {
-            let token = "\(credentials.username):\(credentials.password)"
-                .data(using: .utf8)?
-                .base64EncodedString()
-            if let token {
-                request.setValue("Basic \(token)", forHTTPHeaderField: "Authorization")
-            }
-        }
-
-        for header in normalizedHeaders {
-            request.setValue(header.value, forHTTPHeaderField: header.name)
-        }
-        if let cookieHeader = transferOptions.cookieHeader?.trimmingCharacters(in: .whitespacesAndNewlines), !cookieHeader.isEmpty {
-            request.setValue(cookieHeader, forHTTPHeaderField: "Cookie")
-        }
-
-        do {
-            let (_, response) = try await URLSession.shared.data(for: request)
-            guard let httpResponse = response as? HTTPURLResponse else {
-                pending.state = .loaded
-                return pending
-            }
-
-            if let disposition = httpResponse.value(forHTTPHeaderField: "Content-Disposition"),
-               let fileName = fileName(fromContentDisposition: disposition) {
-                pending.fileName = FileClassifier.sanitizedFileName(fileName)
-                pending.category = FileClassifier.category(forFileName: pending.fileName)
-                pending.defaultDirectory = await settings.destinationDirectory(for: pending.category)
-            }
-
-            if let contentLength = httpResponse.value(forHTTPHeaderField: "Content-Length"),
-               let bytes = Int64(contentLength) {
-                pending.sizeBytes = bytes
-            } else if response.expectedContentLength > 0 {
-                pending.sizeBytes = response.expectedContentLength
-            }
-
-            pending.mimeType = httpResponse.mimeType
-            pending.state = .loaded
-        } catch {
-            pending.state = .failed(error.localizedDescription)
-        }
-
-        return pending
-    }
-
-    private static func fileName(fromContentDisposition header: String) -> String? {
-        let parts = header.components(separatedBy: ";")
-        for part in parts {
-            let trimmed = part.trimmingCharacters(in: .whitespacesAndNewlines)
-            if trimmed.lowercased().hasPrefix("filename*="),
-               let value = trimmed.components(separatedBy: "''").last?.removingPercentEncoding {
-                return value.trimmingCharacters(in: CharacterSet(charactersIn: "\""))
-            }
-
-            if trimmed.lowercased().hasPrefix("filename=") {
-                return String(trimmed.dropFirst("filename=".count))
-                    .trimmingCharacters(in: CharacterSet(charactersIn: "\""))
-            }
-        }
-        return nil
-    }
-
-    private static func isPrivateHost(_ host: String) -> Bool {
-        let h = host.lowercased()
-        if h == "localhost" || h.hasSuffix(".local") { return true }
-        if !h.contains(".") && !h.contains(":") { return true }
-
-        var hints = addrinfo(
-            ai_flags: 0,
-            ai_family: AF_UNSPEC,
-            ai_socktype: SOCK_STREAM,
-            ai_protocol: 0,
-            ai_addrlen: 0,
-            ai_canonname: nil,
-            ai_addr: nil,
-            ai_next: nil
-        )
-
-        var res: UnsafeMutablePointer<addrinfo>?
-        if getaddrinfo(host, nil, &hints, &res) == 0 {
-            var current = res
-            while let info = current {
-                let family = info.pointee.ai_family
-                if family == AF_INET {
-                    let addr = info.pointee.ai_addr.withMemoryRebound(to: sockaddr_in.self, capacity: 1) { $0.pointee }
-                    let ip = UInt32(bigEndian: addr.sin_addr.s_addr)
-                    let first = (ip >> 24) & 0xFF
-                    let second = (ip >> 16) & 0xFF
-
-                    if first == 127 || first == 10 || (first == 192 && second == 168) {
-                        freeaddrinfo(res)
-                        return true
-                    }
-                    if first == 172 && (16...31).contains(second) {
-                        freeaddrinfo(res)
-                        return true
-                    }
-                    if first == 169 && second == 254 {
-                        freeaddrinfo(res)
-                        return true
-                    }
-                } else if family == AF_INET6 {
-                    let addr = info.pointee.ai_addr.withMemoryRebound(to: sockaddr_in6.self, capacity: 1) { $0.pointee }
-                    let bytes = addr.sin6_addr.__u6_addr.__u6_addr8
-                    
-                    let isLoopback = bytes.0 == 0 && bytes.1 == 0 && bytes.2 == 0 && bytes.3 == 0 &&
-                                     bytes.4 == 0 && bytes.5 == 0 && bytes.6 == 0 && bytes.7 == 0 &&
-                                     bytes.8 == 0 && bytes.9 == 0 && bytes.10 == 0 && bytes.11 == 0 &&
-                                     bytes.12 == 0 && bytes.13 == 0 && bytes.14 == 0 && bytes.15 == 1
-                    
-                    let isULA = (bytes.0 & 0xFE) == 0xFC
-                    let isLinkLocal = bytes.0 == 0xFE && (bytes.1 & 0xC0) == 0x80
-                    
-                    let isIPv4Mapped = bytes.0 == 0 && bytes.1 == 0 && bytes.2 == 0 && bytes.3 == 0 &&
-                                       bytes.4 == 0 && bytes.5 == 0 && bytes.6 == 0 && bytes.7 == 0 &&
-                                       bytes.8 == 0 && bytes.9 == 0 && bytes.10 == 0xFF && bytes.11 == 0xFF
-                    
-                    if isLoopback || isULA || isLinkLocal {
-                        freeaddrinfo(res)
-                        return true
-                    }
-                    if isIPv4Mapped {
-                        let first = bytes.12
-                        let second = bytes.13
-                        if first == 127 || first == 10 || (first == 192 && second == 168) {
-                            freeaddrinfo(res)
-                            return true
-                        }
-                        if first == 172 && (16...31).contains(second) {
-                            freeaddrinfo(res)
-                            return true
-                        }
-                        if first == 169 && second == 254 {
-                            freeaddrinfo(res)
-                            return true
-                        }
-                    }
-                }
-                current = info.pointee.ai_next
-            }
-            freeaddrinfo(res)
-        }
-        return false
-    }
-}
-
-enum ByteFormatter {
-    static func string(_ bytes: Int64?) -> String {
-        guard let bytes else { return "Unknown" }
-        let formatter = ByteCountFormatter()
-        formatter.countStyle = .file
-        formatter.includesUnit = true
-        formatter.includesCount = true
-        return formatter.string(fromByteCount: bytes)
-    }
-}

Sources/Firelink/DownloadPropertiesView.swift

@@ -1,490 +0,0 @@
-import AppKit
-import SwiftUI
-
-struct DownloadPropertiesWindow: View {
-    @EnvironmentObject private var controller: DownloadController
-    let downloadID: UUID
-
-    var body: some View {
-        if let item = controller.downloads.first(where: { $0.id == downloadID }) {
-            DownloadPropertiesView(item: item)
-        } else {
-            ContentUnavailableView("Download Not Found", systemImage: "questionmark.circle")
-                .frame(width: 420, height: 240)
-        }
-    }
-}
-
-struct DownloadPropertiesView: View {
-    enum LoginMode: String, CaseIterable, Identifiable {
-        case matching = "Matching site login"
-        case custom = "Custom credentials"
-        case none = "No login"
-
-        var id: String { rawValue }
-    }
-
-    @EnvironmentObject private var controller: DownloadController
-    @EnvironmentObject private var settings: AppSettings
-    @Environment(\.dismiss) private var dismiss
-
-    let item: DownloadItem
-
-    @State private var urlText: String
-    @State private var fileName: String
-    @State private var destinationPath: String
-    @State private var connections: Int
-    @State private var loginMode: LoginMode
-    @State private var username: String
-    @State private var password: String
-    @State private var speedLimitEnabled: Bool
-    @State private var speedLimitKiBPerSecond: Int
-    @State private var checksumEnabled: Bool
-    @State private var checksumAlgorithm: ChecksumAlgorithm
-    @State private var checksumValue: String
-    @State private var headerText: String
-    @State private var cookieText: String
-    @State private var mirrorText: String
-    @State private var errorMessage = ""
-    @State private var showsAdvancedTransfer = false
-    @State private var showsChunkMap = false
-
-    init(item: DownloadItem) {
-        self.item = item
-        _urlText = State(initialValue: item.url.absoluteString)
-        _fileName = State(initialValue: item.fileName)
-        _destinationPath = State(initialValue: item.destinationDirectory.path)
-        _connections = State(initialValue: item.connectionsPerServer)
-        _speedLimitEnabled = State(initialValue: (item.speedLimitKiBPerSecond ?? 0) > 0)
-        _speedLimitKiBPerSecond = State(initialValue: max(item.speedLimitKiBPerSecond ?? 1024, 1))
-        if let credentials = item.credentials {
-            _loginMode = State(initialValue: .custom)
-            _username = State(initialValue: credentials.username)
-            _password = State(initialValue: credentials.password)
-        } else {
-            _loginMode = State(initialValue: .matching)
-            _username = State(initialValue: "")
-            _password = State(initialValue: "")
-        }
-        if let checksum = item.checksum {
-            _checksumEnabled = State(initialValue: true)
-            _checksumAlgorithm = State(initialValue: checksum.algorithm)
-            _checksumValue = State(initialValue: checksum.value)
-        } else {
-            _checksumEnabled = State(initialValue: false)
-            _checksumAlgorithm = State(initialValue: .sha256)
-            _checksumValue = State(initialValue: "")
-        }
-        _headerText = State(initialValue: (item.requestHeaders ?? []).map(\.headerLine).joined(separator: "\n"))
-        _cookieText = State(initialValue: item.cookieHeader ?? "")
-        _mirrorText = State(initialValue: (item.mirrorURLs ?? []).map(\.absoluteString).joined(separator: "\n"))
-    }
-
-    var body: some View {
-        VStack(spacing: 0) {
-            DownloadSummaryHeader(item: item)
-                .padding(.horizontal, 18)
-                .padding(.vertical, 12)
-
-            Divider()
-
-            Form {
-                if let noticeText {
-                    Section {
-                        Label(noticeText, systemImage: noticeSystemImage)
-                            .font(.caption)
-                            .foregroundStyle(.secondary)
-                    }
-                }
-
-                Section("Download") {
-                    Grid(alignment: .leading, horizontalSpacing: 12, verticalSpacing: 8) {
-                        GridRow {
-                            Text("URL")
-                                .foregroundStyle(.secondary)
-                            TextField("URL", text: $urlText)
-                                .font(.system(.callout, design: .monospaced))
-                                .disabled(fileIdentityLocked)
-                        }
-
-                        GridRow {
-                            Text("File name")
-                                .foregroundStyle(.secondary)
-                            TextField("File name", text: $fileName)
-                                .disabled(fileIdentityLocked)
-                        }
-
-                        GridRow {
-                            Text("Save location")
-                                .foregroundStyle(.secondary)
-                            HStack(spacing: 8) {
-                                TextField("Save location", text: $destinationPath)
-                                    .font(.system(.callout, design: .monospaced))
-                                    .disabled(fileIdentityLocked)
-                                Button {
-                                    selectDestination()
-                                } label: {
-                                    Label("Select", systemImage: "folder.badge.plus")
-                                }
-                                .disabled(fileIdentityLocked)
-                            }
-                        }
-
-                        GridRow {
-                            Text("Connections")
-                                .foregroundStyle(.secondary)
-                            Stepper("\(connections) per file", value: $connections, in: 1...16)
-                                .disabled(transferSettingsLocked)
-                        }
-
-                        GridRow {
-                            Text("Speed")
-                                .foregroundStyle(.secondary)
-                            HStack {
-                                Toggle("Limit", isOn: $speedLimitEnabled)
-                                if speedLimitEnabled {
-                                    Stepper(
-                                        "\(speedLimitKiBPerSecond) KiB/s",
-                                        value: $speedLimitKiBPerSecond,
-                                        in: 1...10_485_760,
-                                        step: 128
-                                    )
-                                }
-                            }
-                        }
-                    }
-                }
-
-                Section(item.status == .completed ? "Site Login for Redownload" : "Site Login") {
-                    Picker("Login", selection: $loginMode) {
-                        ForEach(LoginMode.allCases) { mode in
-                            Text(mode.rawValue).tag(mode)
-                        }
-                    }
-                    .pickerStyle(.segmented)
-                    .disabled(transferSettingsLocked)
-
-                    if loginMode == .matching {
-                        Text(matchingLoginText)
-                            .font(.caption)
-                            .foregroundStyle(.secondary)
-                    } else if loginMode == .custom {
-                        TextField("Username", text: $username)
-                            .disabled(transferSettingsLocked)
-                        SecureField("Password", text: $password)
-                            .disabled(transferSettingsLocked)
-                    }
-                }
-
-                Section {
-                    CollapsibleGroup(title: advancedTransferTitle, isExpanded: $showsAdvancedTransfer) {
-                        Grid(alignment: .leading, horizontalSpacing: 12, verticalSpacing: 8) {
-                            GridRow {
-                                Text("Checksum")
-                                    .foregroundStyle(.secondary)
-                                Toggle("Verify", isOn: $checksumEnabled)
-                                .disabled(transferSettingsLocked)
-                            }
-
-                            if checksumEnabled {
-                                GridRow {
-                                    Text("Algorithm")
-                                        .foregroundStyle(.secondary)
-                                    Picker("Algorithm", selection: $checksumAlgorithm) {
-                                        ForEach(ChecksumAlgorithm.allCases) { algorithm in
-                                            Text(algorithm.title).tag(algorithm)
-                                        }
-                                    }
-                                    .disabled(transferSettingsLocked)
-                                }
-
-                                GridRow {
-                                    Text("Digest")
-                                        .foregroundStyle(.secondary)
-                                    TextField("Expected digest", text: $checksumValue)
-                                        .font(.system(.callout, design: .monospaced))
-                                        .disabled(transferSettingsLocked)
-                                }
-                            }
-
-                            GridRow {
-                                Text("Cookies")
-                                    .foregroundStyle(.secondary)
-                                TextField("Cookies", text: $cookieText)
-                                    .font(.system(.callout, design: .monospaced))
-                                    .disabled(transferSettingsLocked)
-                            }
-                        }
-
-                        CompactEditor(title: "Headers", text: $headerText)
-                            .disabled(transferSettingsLocked)
-                        CompactEditor(title: "Mirrors", text: $mirrorText)
-                            .disabled(transferSettingsLocked)
-                    }
-                }
-
-                if item.status == .downloading && item.rpcPort != nil {
-                    Section {
-                        CollapsibleGroup(title: "Chunk Map", isExpanded: $showsChunkMap) {
-                            ChunkMapView(item: item)
-                        }
-                    }
-                }
-            }
-            .formStyle(.grouped)
-
-            Divider()
-            HStack {
-                Text(errorMessage)
-                    .font(.caption)
-                    .foregroundStyle(.red)
-                    .lineLimit(1)
-                Spacer()
-                Button("Cancel") {
-                    dismiss()
-                }
-                Button {
-                    save()
-                } label: {
-                    Label("Save", systemImage: "checkmark")
-                }
-                .buttonStyle(.borderedProminent)
-            }
-            .padding(12)
-            .background(.bar)
-        }
-        .frame(width: 720, height: 580)
-    }
-
-    private var fileIdentityLocked: Bool {
-        item.status == .completed || item.status == .downloading
-    }
-
-    private var transferSettingsLocked: Bool {
-        item.status == .downloading
-    }
-
-    private var noticeText: String? {
-        switch item.status {
-        case .completed:
-            return "File identity is read-only. Transfer settings are saved for redownload."
-        case .downloading:
-            return "Only the speed limit applies to the current transfer. Other settings can be changed after stopping or pausing."
-        default:
-            return nil
-        }
-    }
-
-    private var noticeSystemImage: String {
-        item.status == .completed ? "checkmark.circle" : "bolt.horizontal.circle"
-    }
-
-    private var advancedTransferTitle: String {
-        item.status == .completed ? "Advanced Transfer for Redownload" : "Advanced Transfer"
-    }
-
-    private struct CompactEditor: View {
-        let title: String
-        @Binding var text: String
-
-        var body: some View {
-            VStack(alignment: .leading, spacing: 5) {
-                Text(title)
-                    .foregroundStyle(.secondary)
-                TextEditor(text: $text)
-                    .font(.system(.callout, design: .monospaced))
-                    .frame(minHeight: 44, maxHeight: 54)
-            }
-        }
-    }
-
-    private struct CollapsibleGroup<Content: View>: View {
-        let title: String
-        @Binding var isExpanded: Bool
-        @ViewBuilder var content: () -> Content
-
-        var body: some View {
-            VStack(alignment: .leading, spacing: isExpanded ? 10 : 0) {
-                Button {
-                    isExpanded.toggle()
-                } label: {
-                    HStack(spacing: 6) {
-                        Image(systemName: isExpanded ? "chevron.down" : "chevron.right")
-                            .font(.caption)
-                            .foregroundStyle(.secondary)
-                            .frame(width: 12)
-                        Text(title)
-                        Spacer(minLength: 0)
-                    }
-                    .contentShape(Rectangle())
-                }
-                .buttonStyle(.plain)
-
-                if isExpanded {
-                    content()
-                        .padding(.leading, 18)
-                }
-            }
-        }
-    }
-
-    private var matchingLoginText: String {
-        guard let url = URL(string: urlText),
-              let credentials = settings.credentials(for: url) else {
-            return "No matching saved login for this URL."
-        }
-
-        return "Will use saved login for \(credentials.username)."
-    }
-
-    private func selectDestination() {
-        let panel = NSOpenPanel()
-        panel.canChooseFiles = false
-        panel.canChooseDirectories = true
-        panel.allowsMultipleSelection = false
-        panel.canCreateDirectories = true
-        panel.directoryURL = URL(fileURLWithPath: NSString(string: destinationPath).expandingTildeInPath)
-
-        if panel.runModal() == .OK, let url = panel.url {
-            destinationPath = url.path
-        }
-    }
-
-    private func save() {
-        guard let url = URL(string: urlText.trimmingCharacters(in: .whitespacesAndNewlines)),
-              let scheme = url.scheme?.lowercased(),
-              ["http", "https", "ftp", "sftp"].contains(scheme) else {
-            errorMessage = "Enter a valid HTTP, HTTPS, FTP, or SFTP URL."
-            return
-        }
-
-        let cleanFileName = FileClassifier.sanitizedFileName(fileName)
-        guard !cleanFileName.isEmpty else {
-            errorMessage = "File name cannot be empty."
-            return
-        }
-
-        let destination = URL(
-            fileURLWithPath: NSString(string: destinationPath.trimmingCharacters(in: .whitespacesAndNewlines)).expandingTildeInPath,
-            isDirectory: true
-        )
-
-        let credentials: DownloadCredentials?
-        switch loginMode {
-        case .matching:
-            credentials = settings.credentials(for: url)
-        case .custom:
-            let custom = DownloadCredentials(username: username, password: password)
-            credentials = custom.isEmpty ? nil : custom
-        case .none:
-            credentials = nil
-        }
-
-        guard let transferOptions = validatedTransferOptions else {
-            return
-        }
-
-        controller.updateDownload(
-            id: item.id,
-            url: url,
-            fileName: cleanFileName,
-            destinationDirectory: destination,
-            connectionsPerServer: connections,
-            credentials: credentials,
-            transferOptions: transferOptions,
-            speedLimitKiBPerSecond: speedLimitEnabled ? speedLimitKiBPerSecond : nil
-        )
-        dismiss()
-    }
-
-    private var validatedTransferOptions: DownloadTransferOptions? {
-        if checksumEnabled && checksumValue.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
-            errorMessage = "Add the expected checksum digest, or turn checksum off."
-            return nil
-        }
-
-        if DownloadTransferOptionParser.invalidHeaderLines(headerText).isEmpty == false {
-            errorMessage = "Headers must use Name: Value lines."
-            return nil
-        }
-
-        if DownloadTransferOptionParser.invalidMirrorLines(mirrorText).isEmpty == false {
-            errorMessage = "Mirrors must be valid HTTP, HTTPS, FTP, or SFTP URLs."
-            return nil
-        }
-
-        return DownloadTransferOptions(
-            checksum: checksumEnabled ? DownloadChecksum(algorithm: checksumAlgorithm, value: checksumValue).normalized : nil,
-            requestHeaders: DownloadTransferOptionParser.parseHeaders(headerText),
-            cookieHeader: DownloadTransferOptionParser.cleanCookieHeader(cookieText),
-            mirrorURLs: DownloadTransferOptionParser.parseMirrorURLs(mirrorText)
-        )
-    }
-}
-
-private struct DownloadSummaryHeader: View {
-    let item: DownloadItem
-
-    var body: some View {
-        VStack(alignment: .leading, spacing: 8) {
-            HStack(alignment: .firstTextBaseline, spacing: 12) {
-                Text(item.fileName)
-                    .font(.headline)
-                    .lineLimit(1)
-                    .truncationMode(.middle)
-                Spacer()
-                Label(item.status.rawValue, systemImage: item.category.symbolName)
-                    .foregroundStyle(statusColor)
-            }
-
-            ProgressView(value: item.status == .completed ? 1.0 : item.progress)
-
-            Grid(alignment: .leading, horizontalSpacing: 18, verticalSpacing: 5) {
-                GridRow {
-                    summary("Progress", (item.status == .completed ? 1.0 : item.progress).formatted(.percent.precision(.fractionLength(0))))
-                    summary("Size", ByteFormatter.string(item.sizeBytes))
-                    summary("Speed", item.displaySpeedText)
-                    summary("ETA", item.displayETAText)
-                }
-                GridRow {
-                    summary("Live connections", "\(item.connectionCount)")
-                    summary("Speed cap", item.speedLimitText)
-                    summary("Category", item.category.rawValue)
-                    summary("Last try", item.lastTryAt?.formatted(date: .abbreviated, time: .shortened) ?? "-")
-                }
-                GridRow {
-                    summary("Date added", item.createdAt.formatted(date: .abbreviated, time: .shortened))
-                        .gridCellColumns(2)
-                    summary("Destination", item.destinationPath)
-                        .gridCellColumns(2)
-                }
-            }
-            .font(.caption)
-        }
-    }
-
-    private var statusColor: Color {
-        switch item.status {
-        case .queued:
-            .secondary
-        case .downloading:
-            .accentColor
-        case .paused:
-            .orange
-        case .completed:
-            .green
-        case .failed, .canceled:
-            .red
-        }
-    }
-
-    private func summary(_ label: String, _ value: String) -> some View {
-        HStack(spacing: 4) {
-            Text(label)
-                .foregroundStyle(.secondary)
-            Text(value)
-                .lineLimit(1)
-                .truncationMode(.middle)
-        }
-    }
-}

Sources/Firelink/DownloadTable.swift

@@ -1,360 +0,0 @@
-import AppKit
-import SwiftUI
-import UniformTypeIdentifiers
-
-struct DownloadTable: View {
-    @EnvironmentObject private var controller: DownloadController
-    @EnvironmentObject private var settings: AppSettings
-    @Environment(\.openWindow) private var openWindow
-    let items: [DownloadItem]
-    @Binding var selection: Set<DownloadItem.ID>
-    let title: String
-    var queueID: UUID?
-
-    @State private var sortOrder = [KeyPathComparator(\DownloadItem.createdAt, order: .reverse)]
-    @State private var pendingDeleteItems: Set<DownloadItem.ID>?
-
-    var sortedItems: [DownloadItem] {
-        items.sorted(using: sortOrder)
-    }
-
-    var body: some View {
-        VStack(spacing: 0) {
-            HStack {
-                Text(title)
-                    .font(.headline)
-                Text("\(items.count)")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-                    .padding(.horizontal, 7)
-                    .padding(.vertical, 3)
-                    .background(.quaternary.opacity(0.5))
-                    .clipShape(RoundedRectangle(cornerRadius: 5))
-                Spacer()
-            }
-            .padding(.horizontal, 12)
-            .padding(.vertical, 8)
-
-            Table(sortedItems, selection: $selection, sortOrder: $sortOrder) {
-                TableColumn("File Name", value: \.fileName) { item in
-                    HStack(alignment: .top, spacing: 8) {
-                        Image(systemName: item.category.symbolName)
-                            .font(.title3)
-                            .foregroundStyle(categoryColor(for: item.category))
-                            .frame(width: 22)
-                        Text(item.fileName)
-                            .font(.headline)
-                            .lineLimit(1)
-                            .truncationMode(.tail)
-                            .allowsHitTesting(false)
-                    }
-                    .draggable(item.id.uuidString)
-                }
-                .width(min: 200, ideal: 340)
-
-                TableColumn("Size", value: \.sortableSize) { item in
-                    if let size = item.sizeBytes, size > 0 {
-                        Text(ByteFormatter.string(size))
-                            .monospacedDigit()
-                            .lineLimit(1)
-                            .truncationMode(.tail)
-                    } else if item.bytesText != "-" && !item.bytesText.isEmpty {
-                        Text(item.bytesText)
-                            .monospacedDigit()
-                            .lineLimit(1)
-                            .truncationMode(.tail)
-                    } else {
-                        Text("Unknown")
-                            .monospacedDigit()
-                            .lineLimit(1)
-                            .truncationMode(.tail)
-                    }
-                }
-                .width(min: 80, ideal: 100)
-
-                TableColumn("Progress", value: \.progress) { item in
-                    progressBarCell(for: item)
-                }
-                .width(min: 100, ideal: 115)
-
-                TableColumn("Status", value: \.status.rawValue) { item in
-                    statusCell(for: item)
-                }
-                .width(min: 115, ideal: 170)
-
-                TableColumn("Speed", value: \.displaySpeedText) { item in
-                    Text(item.displaySpeedText)
-                            .lineLimit(1)
-                            .truncationMode(.tail)
-                }
-                .width(min: 70, ideal: 90)
-
-                TableColumn("ETA", value: \.displayETAText) { item in
-                    Text(item.displayETAText)
-                            .lineLimit(1)
-                            .truncationMode(.tail)
-                }
-                .width(min: 70, ideal: 90)
-
-                TableColumn("Date Added", value: \.createdAt) { item in
-                    Text(formatted(item.createdAt))
-                            .lineLimit(1)
-                            .truncationMode(.tail)
-                }
-                .width(min: 100, ideal: 155)
-            }
-            .environment(\.defaultMinListRowHeight, settings.listRowDensity.minRowHeight)
-            .animation(.default, value: sortedItems)
-            .contextMenu(forSelectionType: DownloadItem.ID.self) { itemIDs in
-                rowContextMenu(for: itemIDs)
-            } primaryAction: { itemIDs in
-                let targetItems = controller.downloads.filter { itemIDs.contains($0.id) }
-                for target in targetItems {
-                    if target.status == .completed {
-                        openFile(target)
-                    }
-                }
-            }
-            .overlay {
-                if items.isEmpty {
-                    ContentUnavailableView(
-                        "No Downloads",
-                        systemImage: "arrow.down.circle",
-                        description: Text("Use Add or press \(Image(systemName: "command"))V to paste one or more links.")
-                    )
-                }
-            }
-        }
-        .confirmationDialog(
-            "Delete Download",
-            isPresented: Binding(
-                get: { pendingDeleteItems != nil },
-                set: { isPresented in
-                    if !isPresented {
-                        pendingDeleteItems = nil
-                    }
-                }
-            ),
-            presenting: pendingDeleteItems
-        ) { ids in
-            Button("Remove from List") {
-                let items = controller.downloads.filter { ids.contains($0.id) }
-                for item in items { controller.delete(item, deleteFiles: false) }
-                selection.subtract(ids)
-                pendingDeleteItems = nil
-            }
-
-            Button("Move to Trash", role: .destructive) {
-                let items = controller.downloads.filter { ids.contains($0.id) }
-                for item in items { controller.delete(item, deleteFiles: true) }
-                selection.subtract(ids)
-                pendingDeleteItems = nil
-            }
-
-            Button("Cancel", role: .cancel) {
-                pendingDeleteItems = nil
-            }
-        } message: { ids in
-            let items = controller.downloads.filter { ids.contains($0.id) }
-            if items.allSatisfy({ $0.status == .completed }) {
-                Text("Remove \(items.count == 1 ? "this download" : "these \(items.count) downloads") from Firelink, or also move the downloaded files to Trash.")
-            } else {
-                Text("Remove \(items.count == 1 ? "this download" : "these \(items.count) downloads") from Firelink. Partial cache files are removed automatically; moving to Trash also sends any partial files there.")
-            }
-        }
-    }
-
-    @ViewBuilder
-    private func statusCell(for item: DownloadItem) -> some View {
-        let message = item.message.trimmingCharacters(in: .whitespacesAndNewlines)
-        if item.status == .downloading, !message.isEmpty {
-            Text(message)
-                .lineLimit(1)
-                .truncationMode(.tail)
-        } else {
-            Text(item.status.rawValue)
-                .lineLimit(1)
-                .truncationMode(.tail)
-        }
-    }
-
-    @ViewBuilder
-    private func rowContextMenu(for itemIDs: Set<DownloadItem.ID>) -> some View {
-        let targetItems = controller.downloads.filter { itemIDs.contains($0.id) }
-
-        if !targetItems.isEmpty {
-            if targetItems.allSatisfy({ $0.status == .completed }) {
-                Button {
-                    for target in targetItems {
-                        openFile(target)
-                    }
-                } label: {
-                    Label(targetItems.count > 1 ? "Open (\(targetItems.count))" : "Open", systemImage: "doc")
-                }
-            }
-
-            Button {
-                for target in targetItems {
-                    showInFinder(target)
-                }
-            } label: {
-                Label(targetItems.count > 1 ? "Show in Finder (\(targetItems.count))" : "Show in Finder", systemImage: "finder")
-            }
-
-            Divider()
-
-            Divider()
-
-            Menu("Controls") {
-                if targetItems.contains(where: { $0.status == .paused || $0.status == .failed || $0.status == .canceled }) {
-                    Button {
-                        for target in targetItems where target.status == .paused || target.status == .failed || target.status == .canceled {
-                            controller.resume(target)
-                        }
-                    } label: {
-                        Label("Start", systemImage: "play.fill")
-                    }
-                }
-
-                if targetItems.contains(where: { $0.status == .downloading || $0.status == .queued }) {
-                    Button {
-                        for target in targetItems where target.status == .downloading || target.status == .queued {
-                            controller.pause(target)
-                        }
-                    } label: {
-                        Label("Stop", systemImage: "stop.fill")
-                    }
-                }
-
-                if targetItems.contains(where: { $0.status == .completed || $0.status == .failed || $0.status == .canceled }) {
-                    Button {
-                        for target in targetItems where target.status == .completed || target.status == .failed || target.status == .canceled {
-                            controller.redownload(target)
-                        }
-                    } label: {
-                        Label("Redownload", systemImage: "arrow.clockwise")
-                    }
-                }
-            }
-
-            Divider()
-
-            if targetItems.contains(where: { $0.status != .completed && $0.status != .downloading }) {
-                Menu {
-                    ForEach(controller.queues) { queue in
-                        Button(queue.name) {
-                            controller.assignToQueue(
-                                itemIDs: Set(targetItems.map(\.id)),
-                                queueID: queue.id
-                            )
-                        }
-                    }
-                } label: {
-                    Label("Move to Queue", systemImage: "list.bullet")
-                }
-                Divider()
-            }
-
-            Button {
-                NSPasteboard.general.clearContents()
-                let urls = targetItems.map { $0.url.absoluteString }.joined(separator: "\n")
-                NSPasteboard.general.setString(urls, forType: .string)
-            } label: {
-                Label(targetItems.count > 1 ? "Copy Addresses" : "Copy Address", systemImage: "link")
-            }
-
-            Button {
-                for target in targetItems {
-                    openWindow(id: "download-properties", value: target.id)
-                }
-            } label: {
-                Label(targetItems.count > 1 ? "Properties (\(targetItems.count))" : "Properties", systemImage: "info.circle")
-            }
-
-            Divider()
-
-            Button(role: .destructive) {
-                pendingDeleteItems = itemIDs
-            } label: {
-                Label("Remove", systemImage: "trash")
-            }
-        }
-    }
-
-    private func categoryColor(for category: DownloadCategory) -> Color {
-        switch category {
-        case .musics: return .pink
-        case .movies: return .indigo
-        case .compressed: return .orange
-        case .pictures: return .teal
-        case .documents: return .blue
-        case .other: return .gray
-        }
-    }
-
-    private func statusColor(for status: DownloadStatus) -> Color {
-        switch status {
-        case .queued: return .secondary
-        case .downloading: return .blue
-        case .paused: return .orange
-        case .completed: return .green
-        case .failed: return .red
-        case .canceled: return .gray
-        }
-    }
-
-    @ViewBuilder
-    private func progressBarCell(for item: DownloadItem) -> some View {
-        if item.status == .completed {
-            Text("Completed")
-                .foregroundStyle(.green)
-                .lineLimit(1)
-                .truncationMode(.tail)
-        } else {
-            HStack(spacing: 4) {
-                ProgressView(value: item.progress)
-                    .progressViewStyle(.linear)
-                    .tint(statusColor(for: item.status))
-                
-                Text(item.progress.formatted(.percent.precision(.fractionLength(0))))
-                    .font(.system(size: 11, weight: .medium, design: .monospaced))
-                    .frame(width: 35, alignment: .trailing)
-            }
-        }
-    }
-
-    private func formatted(_ date: Date?) -> String {
-        guard let date else { return "-" }
-        return date.formatted(date: .abbreviated, time: .shortened)
-    }
-
-    private func showInFinder(_ item: DownloadItem) {
-        let fileURL = item.destinationDirectory.appendingPathComponent(item.fileName)
-        if FileManager.default.fileExists(atPath: fileURL.path) {
-            NSWorkspace.shared.activateFileViewerSelecting([fileURL])
-        } else {
-            NSWorkspace.shared.open(existingFolder(for: item.destinationDirectory))
-        }
-    }
-
-    private func existingFolder(for url: URL) -> URL {
-        var candidate = url
-        while !FileManager.default.fileExists(atPath: candidate.path) {
-            let parent = candidate.deletingLastPathComponent()
-            if parent.path == candidate.path {
-                return URL(fileURLWithPath: NSHomeDirectory())
-            }
-            candidate = parent
-        }
-        return candidate
-    }
-
-    private func openFile(_ item: DownloadItem) {
-        let fileURL = item.destinationDirectory.appendingPathComponent(item.fileName)
-        if FileManager.default.fileExists(atPath: fileURL.path) {
-            NSWorkspace.shared.open(fileURL)
-        } else {
-            NSWorkspace.shared.open(existingFolder(for: item.destinationDirectory))
-        }
-    }
-}

Sources/Firelink/DuplicateResolutionView.swift

@@ -1,87 +0,0 @@
-import SwiftUI
-
-struct DuplicateDownloadItem: Identifiable, Equatable {
-    let id: UUID
-    var pendingItem: PendingDownload
-    var resolution: DuplicateResolutionAction = .rename
-    let reason: DuplicateReason
-    
-    enum DuplicateReason: Equatable {
-        case existingURL(String)
-        case existingFile(String)
-    }
-}
-
-enum DuplicateResolutionAction: String, CaseIterable, Identifiable {
-    case rename = "Rename"
-    case replace = "Replace"
-    case skip = "Skip"
-    var id: String { rawValue }
-}
-
-struct DuplicateResolutionView: View {
-    @Binding var conflicts: [DuplicateDownloadItem]
-    let onConfirm: () -> Void
-    let onCancel: () -> Void
-    
-    var body: some View {
-        VStack(spacing: 0) {
-            VStack(alignment: .leading, spacing: 8) {
-                Text("Duplicate Downloads Detected")
-                    .font(.headline)
-                Text("Some of the downloads you are adding already exist in the queue or on disk. Please choose how to resolve these conflicts.")
-                    .font(.subheadline)
-                    .foregroundStyle(.secondary)
-            }
-            .padding(16)
-            .frame(maxWidth: .infinity, alignment: .leading)
-            
-            Divider()
-            
-            List($conflicts) { $conflict in
-                HStack {
-                    VStack(alignment: .leading, spacing: 2) {
-                        Text(conflict.pendingItem.fileName)
-                            .lineLimit(1)
-                            .font(.body.weight(.medium))
-                        Text(reasonText(for: conflict.reason))
-                            .font(.caption)
-                            .foregroundStyle(.orange)
-                    }
-                    
-                    Spacer()
-                    
-                    Picker("", selection: $conflict.resolution) {
-                        ForEach(DuplicateResolutionAction.allCases) { action in
-                            Text(action.rawValue).tag(action)
-                        }
-                    }
-                    .labelsHidden()
-                    .frame(width: 100)
-                }
-                .padding(.vertical, 4)
-            }
-            .frame(minHeight: 200)
-            
-            Divider()
-            
-            HStack {
-                Button("Cancel", action: onCancel)
-                    .keyboardShortcut(.cancelAction)
-                Spacer()
-                Button("Continue", action: onConfirm)
-                    .buttonStyle(.borderedProminent)
-                    .keyboardShortcut(.defaultAction)
-            }
-            .padding(16)
-        }
-        .frame(width: 500)
-    }
-    
-    private func reasonText(for reason: DuplicateDownloadItem.DuplicateReason) -> String {
-        switch reason {
-        case .existingURL(let msg): return msg
-        case .existingFile(let msg): return msg
-        }
-    }
-}

Sources/Firelink/FileClassifier.swift

@@ -1,86 +0,0 @@
-import Foundation
-
-enum FileClassifier {
-    private static let musicExtensions: Set<String> = [
-        "aac", "aif", "aiff", "alac", "amr", "ape", "au", "caf", "flac", "m4a",
-        "m4b", "mid", "midi", "mp3", "oga", "ogg", "opus", "ra", "wav", "weba",
-        "wma"
-    ]
-
-    private static let movieExtensions: Set<String> = [
-        "3g2", "3gp", "avi", "divx", "f4v", "flv", "m2ts", "m4v", "mkv", "mov",
-        "mp4", "mpeg", "mpg", "mts", "ogm", "ogv", "rm", "rmvb", "ts", "vob",
-        "webm", "wmv"
-    ]
-
-    private static let compressedExtensions: Set<String> = [
-        "7z", "ace", "alz", "apk", "appx", "ar", "arc", "arj", "bz", "bz2",
-        "cab", "cpio", "deb", "dmg", "gz", "gzip", "iso", "jar", "lha", "lzh",
-        "lz", "lz4", "lzip", "lzma", "pak", "pkg", "rar", "rpm", "sit", "sitx",
-        "tar", "tbz", "tbz2", "tgz", "tlz", "txz", "war", "whl", "xar", "xz",
-        "z", "zip", "zipx", "zst"
-    ]
-
-    private static let pictureExtensions: Set<String> = [
-        "ai", "apng", "avif", "bmp", "cr2", "cr3", "dng", "emf", "eps", "gif",
-        "heic", "heif", "ico", "indd", "jfif", "jpeg", "jpg", "jxl", "nef",
-        "orf", "pbm", "pgm", "png", "pnm", "ppm", "psd", "raw", "rw2",
-        "svg", "tga", "tif", "tiff", "webp", "wmf"
-    ]
-
-    private static let documentExtensions: Set<String> = [
-        "azw", "azw3", "csv", "djvu", "doc", "docm", "docx", "dot", "dotx",
-        "epub", "fb2", "htm", "html", "ics", "key", "log", "md", "mobi", "pdf",
-        "numbers", "odp", "ods", "odt", "pages", "pot", "potx", "pps", "ppsx",
-        "ppt", "pptm", "pptx", "rtf", "tex", "txt", "vcf", "xls", "xlsm",
-        "xlsx", "xml", "xps", "yaml", "yml"
-    ]
-
-    static func category(forFileName fileName: String) -> DownloadCategory {
-        let ext = (fileName as NSString).pathExtension.lowercased()
-        guard !ext.isEmpty else { return .other }
-
-        if musicExtensions.contains(ext) { return .musics }
-        if movieExtensions.contains(ext) { return .movies }
-        if compressedExtensions.contains(ext) { return .compressed }
-        if pictureExtensions.contains(ext) { return .pictures }
-        if documentExtensions.contains(ext) { return .documents }
-        return .other
-    }
-
-    static func destinationDirectory(for category: DownloadCategory) -> URL {
-        let downloads = FileManager.default.urls(for: .downloadsDirectory, in: .userDomainMask).first
-            ?? URL(fileURLWithPath: NSHomeDirectory()).appendingPathComponent("Downloads")
-        return downloads.appendingPathComponent(category.rawValue, isDirectory: true)
-    }
-
-    static func fileName(from url: URL) -> String {
-        let pathName = url.lastPathComponent.removingPercentEncoding ?? url.lastPathComponent
-        if !pathName.isEmpty, pathName != "/" {
-            return sanitizedFileName(pathName)
-        }
-
-        let host = url.host(percentEncoded: false) ?? "download"
-        return sanitizedFileName("\(host)-download")
-    }
-
-    static func sanitizedFileName(_ rawValue: String, fallback: String = "download") -> String {
-        let separators = CharacterSet(charactersIn: "/\\")
-        let invalidCharacters = separators
-            .union(.newlines)
-            .union(.controlCharacters)
-
-        let components = rawValue
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .components(separatedBy: invalidCharacters)
-            .filter { !$0.isEmpty }
-        let clean = components.joined(separator: "_")
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-
-        guard !clean.isEmpty, clean != ".", clean != ".." else {
-            return fallback
-        }
-
-        return String(clean.prefix(255))
-    }
-}

Sources/Firelink/FirelinkApp.swift

@@ -1,142 +0,0 @@
-import SwiftUI
-
-@main
-struct FirelinkApp: App {
-    @StateObject private var updateChecker: ReleaseUpdateChecker
-    @StateObject private var settings: AppSettings
-    @StateObject private var controller: DownloadController
-    @StateObject private var schedulerController: SchedulerController
-    @AppStorage("showMenuBarIcon") private var showMenuBarIcon = true
-
-    // Server must be retained to keep listening
-    private let extensionServer: LocalExtensionServer?
-
-    init() {
-        self._updateChecker = StateObject(wrappedValue: ReleaseUpdateChecker())
-
-        let settings = AppSettings()
-        let controller = DownloadController(settings: settings)
-        _settings = StateObject(wrappedValue: settings)
-        _controller = StateObject(wrappedValue: controller)
-        _schedulerController = StateObject(wrappedValue: SchedulerController(downloadController: controller))
-
-        extensionServer = LocalExtensionServer(downloadController: controller, settings: settings)
-        extensionServer?.start()
-        controller.extensionServerPort = extensionServer?.port
-    }
-
-    var body: some Scene {
-        WindowGroup(id: "main") {
-            ContentView()
-                .environmentObject(controller)
-                .environmentObject(settings)
-                .environmentObject(schedulerController)
-                .environmentObject(updateChecker)
-                .modifier(AppThemeModifier(theme: settings.appTheme))
-                .modifier(AppFontSizeModifier(fontSize: settings.appFontSize))
-                .task {
-                    updateChecker.checkAutomaticallyIfNeeded()
-                }
-                .onOpenURL { url in
-                    if url.scheme == "firelink" {
-                        if url.host == "add",
-                           let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
-                           let queryItems = components.queryItems,
-                           let link = queryItems.first(where: { $0.name == "url" })?.value {
-                            DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-                                controller.pendingPasteboardText = link
-                                controller.pendingReferer = nil
-                                NotificationCenter.default.post(name: NSNotification.Name("OpenAddDownloadsWindow"), object: nil)
-                            }
-                        }
-                        return
-                    }
-                    
-                    DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
-                        controller.pendingPasteboardText = url.absoluteString
-                        controller.pendingReferer = nil
-                        NotificationCenter.default.post(name: NSNotification.Name("OpenAddDownloadsWindow"), object: nil)
-                    }
-                }
-                .frame(minWidth: 1180, idealWidth: 1280, minHeight: 720, idealHeight: 760)
-        }
-        .windowStyle(.titleBar)
-
-        Window("Add Downloads", id: "add-downloads") {
-            AddDownloadsView()
-                .environmentObject(controller)
-                .environmentObject(settings)
-                .modifier(AppThemeModifier(theme: settings.appTheme))
-                .modifier(AppFontSizeModifier(fontSize: settings.appFontSize))
-        }
-        .windowResizability(.contentSize)
-
-        WindowGroup("Download Properties", id: "download-properties", for: UUID.self) { $downloadID in
-            if let downloadID {
-                DownloadPropertiesWindow(downloadID: downloadID)
-                    .environmentObject(controller)
-                    .environmentObject(settings)
-                    .modifier(AppThemeModifier(theme: settings.appTheme))
-                    .modifier(AppFontSizeModifier(fontSize: settings.appFontSize))
-            } else {
-                ContentUnavailableView("Download Not Found", systemImage: "questionmark.circle")
-                    .modifier(AppThemeModifier(theme: settings.appTheme))
-                    .modifier(AppFontSizeModifier(fontSize: settings.appFontSize))
-            }
-        }
-        .windowResizability(.contentSize)
-
-        .commands {
-            CommandGroup(after: .newItem) {
-                Button("Add Downloads...") {
-                    NotificationCenter.default.post(name: NSNotification.Name("OpenAddDownloadsWindow"), object: nil)
-                }
-                .keyboardShortcut("n", modifiers: [.command])
-
-                Divider()
-
-                Button("Start Queue") {
-                    controller.startQueue()
-                }
-                .keyboardShortcut("r", modifiers: [.command])
-
-                Button("Stop Downloads") {
-                    controller.pauseActiveDownloads()
-                }
-                .disabled(controller.activeCount == 0)
-            }
-        }
-
-        MenuBarExtra(isInserted: $showMenuBarIcon) {
-            TrayMenuView()
-                .environmentObject(controller)
-        } label: {
-            if let nsImage = { () -> NSImage? in
-                guard let url = menuBarIconURL(),
-                      let img = NSImage(contentsOf: url) else { return nil }
-                img.size = NSSize(width: 23, height: 23)
-                img.isTemplate = true
-                return img
-            }() {
-                Image(nsImage: nsImage)
-            } else {
-                Image(systemName: "arrow.down.circle")
-            }
-        }
-    }
-
-    private func menuBarIconURL() -> URL? {
-        if let bundled = Bundle.main.url(forResource: "MenuBarIconTemplate", withExtension: "png") {
-            return bundled
-        }
-
-        let sourceFile = URL(fileURLWithPath: #filePath)
-        let projectRoot = sourceFile
-            .deletingLastPathComponent()
-            .deletingLastPathComponent()
-            .deletingLastPathComponent()
-        let sourceTreeIcon = projectRoot
-            .appendingPathComponent("Sources/Firelink/Assets.xcassets/MenuBarIcon.imageset/MenuBarIconTemplate.png")
-        return FileManager.default.fileExists(atPath: sourceTreeIcon.path) ? sourceTreeIcon : nil
-    }
-}

Sources/Firelink/KeychainCredentialStore.swift

@@ -1,100 +0,0 @@
-import Foundation
-import Security
-
-enum KeychainCredentialStore {
-    private static let service = "local.firelink.site-login"
-
-    static func password(for id: UUID) -> String? {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: id.uuidString,
-            kSecReturnData as String: true,
-            kSecMatchLimit as String: kSecMatchLimitOne,
-            kSecUseAuthenticationUI as String: kSecUseAuthenticationUIFail
-        ]
-
-        var result: CFTypeRef?
-        guard SecItemCopyMatching(query as CFDictionary, &result) == errSecSuccess,
-              let data = result as? Data else {
-            return nil
-        }
-
-        return String(data: data, encoding: .utf8)
-    }
-
-    @discardableResult
-    static func setPassword(_ password: String, for id: UUID) -> Bool {
-        deletePassword(for: id)
-
-        let attributes: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: id.uuidString,
-            kSecValueData as String: Data(password.utf8),
-            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
-        ]
-
-        return SecItemAdd(attributes as CFDictionary, nil) == errSecSuccess
-    }
-
-    @discardableResult
-    static func deletePassword(for id: UUID) -> Bool {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: id.uuidString
-        ]
-
-        let status = SecItemDelete(query as CFDictionary)
-        return status == errSecSuccess || status == errSecItemNotFound
-    }
-    private static let extensionTokenService = "local.firelink.extension-token"
-    private static let extensionTokenAccount = "pairing-token"
-
-    static func extensionToken() -> String? {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: extensionTokenService,
-            kSecAttrAccount as String: extensionTokenAccount,
-            kSecReturnData as String: true,
-            kSecMatchLimit as String: kSecMatchLimitOne,
-            kSecUseAuthenticationUI as String: kSecUseAuthenticationUIFail
-        ]
-
-        var result: CFTypeRef?
-        guard SecItemCopyMatching(query as CFDictionary, &result) == errSecSuccess,
-              let data = result as? Data else {
-            return nil
-        }
-
-        return String(data: data, encoding: .utf8)
-    }
-
-    @discardableResult
-    static func setExtensionToken(_ token: String) -> Bool {
-        deleteExtensionToken()
-
-        let attributes: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: extensionTokenService,
-            kSecAttrAccount as String: extensionTokenAccount,
-            kSecValueData as String: Data(token.utf8),
-            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
-        ]
-
-        return SecItemAdd(attributes as CFDictionary, nil) == errSecSuccess
-    }
-
-    @discardableResult
-    static func deleteExtensionToken() -> Bool {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: extensionTokenService,
-            kSecAttrAccount as String: extensionTokenAccount
-        ]
-
-        let status = SecItemDelete(query as CFDictionary)
-        return status == errSecSuccess || status == errSecItemNotFound
-    }
-}

Sources/Firelink/LocalExtensionServer.swift

@@ -1,278 +0,0 @@
-import Foundation
-import Network
-import AppKit
-
-final class LocalExtensionServer: @unchecked Sendable {
-    private enum Constants {
-        static let portRange = 6412...6422
-        static let maxRequestBytes = 128 * 1024
-        static let maxURLCount = 200
-        static let extensionRequestHeader = "x-firelink-extension"
-        static let allowedSchemes = Set(["http", "https", "ftp", "sftp"])
-    }
-
-    private let listener: NWListener
-    private let downloadController: DownloadController
-    private let settings: AppSettings
-    private let queue = DispatchQueue(label: "local.firelink.server")
-    let port: UInt16
-
-    init?(downloadController: DownloadController, settings: AppSettings) {
-        self.downloadController = downloadController
-        self.settings = settings
-        let parameters = NWParameters.tcp
-
-        var createdListener: NWListener?
-        var selectedPort: UInt16?
-        for portValue in Constants.portRange {
-            parameters.requiredLocalEndpoint = .hostPort(host: .ipv4(.loopback), port: NWEndpoint.Port(rawValue: UInt16(portValue))!)
-            do {
-                createdListener = try NWListener(using: parameters)
-                selectedPort = UInt16(portValue)
-                break
-            } catch {
-                continue
-            }
-        }
-
-        guard let createdListener else {
-            print("Failed to create listener on ports 6412-6422")
-            return nil
-        }
-
-        self.listener = createdListener
-        self.port = selectedPort ?? 6412
-    }
-
-    func start() {
-        listener.newConnectionHandler = { [weak self] connection in
-            self?.handleConnection(connection)
-        }
-        listener.stateUpdateHandler = { state in
-            print("LocalExtensionServer state: \(state)")
-        }
-        listener.start(queue: queue)
-    }
-
-    private func handleConnection(_ connection: NWConnection) {
-        connection.start(queue: queue)
-        let timeoutItem = DispatchWorkItem { [weak connection] in
-            connection?.cancel()
-        }
-        queue.asyncAfter(deadline: .now() + 5.0, execute: timeoutItem)
-        receiveRequest(from: connection, accumulatedData: Data(), timeoutItem: timeoutItem)
-    }
-
-    private func receiveRequest(from connection: NWConnection, accumulatedData: Data, timeoutItem: DispatchWorkItem) {
-        connection.receive(minimumIncompleteLength: 1, maximumLength: 65536) { [weak self] data, _, isComplete, error in
-            guard let self else {
-                timeoutItem.cancel()
-                connection.cancel()
-                return
-            }
-
-            var requestData = accumulatedData
-            if let data {
-                requestData.append(data)
-            }
-
-            guard error == nil, requestData.count <= Constants.maxRequestBytes else {
-                timeoutItem.cancel()
-                self.sendResponse(.payloadTooLarge, connection: connection, origin: nil)
-                return
-            }
-
-            if let request = HTTPRequest(data: requestData) {
-                timeoutItem.cancel()
-                let status = self.processRequest(request)
-                self.sendResponse(status, connection: connection, origin: request.header(named: "origin"))
-                return
-            }
-
-            if isComplete {
-                timeoutItem.cancel()
-                self.sendResponse(.badRequest, connection: connection, origin: nil)
-                return
-            }
-
-            self.receiveRequest(from: connection, accumulatedData: requestData, timeoutItem: timeoutItem)
-        }
-    }
-
-    private func sendResponse(_ status: HTTPStatus, connection: NWConnection, origin: String?) {
-        var headers = [
-            "HTTP/1.1 \(status.rawValue) \(status.reason)",
-            "Content-Length: 0",
-            "Connection: close"
-        ]
-
-        if let origin, isAllowedExtensionOrigin(origin) {
-            headers.append("Access-Control-Allow-Origin: \(origin)")
-            headers.append("Vary: Origin")
-            headers.append("Access-Control-Allow-Methods: GET, POST, OPTIONS")
-            headers.append("Access-Control-Allow-Headers: Content-Type, X-Firelink-Extension")
-        }
-
-        let response = headers.joined(separator: "\r\n") + "\r\n\r\n"
-        connection.send(content: response.data(using: .utf8), completion: .contentProcessed { _ in
-            connection.cancel()
-        })
-    }
-
-    private func isAllowedExtensionOrigin(_ origin: String) -> Bool {
-        guard let url = URL(string: origin),
-              let scheme = url.scheme?.lowercased() else {
-            return false
-        }
-
-        return scheme == "moz-extension" || scheme == "chrome-extension"
-    }
-
-    private func processRequest(_ request: HTTPRequest) -> HTTPStatus {
-        let host = request.header(named: "host") ?? ""
-        let isLocalhost = host == "127.0.0.1:\(self.port)" || host == "localhost:\(self.port)" || host == "127.0.0.1" || host == "localhost"
-        guard isLocalhost else {
-            return .forbidden
-        }
-
-        if request.method == "OPTIONS" {
-            return isAllowedExtensionOrigin(request.header(named: "origin") ?? "") ? .noContent : .forbidden
-        }
-
-        let expectedToken = DispatchQueue.main.sync { settings.extensionPairingToken }
-        guard let token = request.header(named: Constants.extensionRequestHeader),
-              token == expectedToken else {
-            return .forbidden
-        }
-
-        if request.path == "/ping" {
-            return request.method == "GET" ? .ok : .methodNotAllowed
-        }
-
-        guard request.path == "/download" else {
-            return .notFound
-        }
-
-        guard request.method == "POST" else {
-            return .methodNotAllowed
-        }
-
-        guard request.header(named: "content-type")?.lowercased().contains("application/json") == true else {
-            return .unsupportedMediaType
-        }
-
-        struct Payload: Decodable {
-            let urls: [String]
-            let referer: String?
-        }
-
-        do {
-            let payload = try JSONDecoder().decode(Payload.self, from: request.body)
-            let validURLs = payload.urls
-                .prefix(Constants.maxURLCount)
-                .compactMap { rawURL -> String? in
-                    let trimmed = rawURL.trimmingCharacters(in: .whitespacesAndNewlines)
-                    guard let url = URL(string: trimmed),
-                          let scheme = url.scheme?.lowercased(),
-                          Constants.allowedSchemes.contains(scheme) else {
-                        return nil
-                    }
-                    return url.absoluteString
-                }
-
-            guard !validURLs.isEmpty else {
-                return .badRequest
-            }
-
-            Task { @MainActor in
-                self.downloadController.pendingPasteboardText = validURLs.joined(separator: "\n")
-                self.downloadController.pendingReferer = payload.referer
-                NotificationCenter.default.post(name: NSNotification.Name("OpenAddDownloadsWindow"), object: nil)
-                NSApp.activate(ignoringOtherApps: true)
-            }
-
-            return .ok
-        } catch {
-            print("Failed to parse local request JSON: \(error)")
-            return .badRequest
-        }
-    }
-}
-
-private struct HTTPRequest {
-    var method: String
-    var path: String
-    var headers: [String: String]
-    var body: Data
-
-    init?(data: Data) {
-        guard let headerRange = data.range(of: Data("\r\n\r\n".utf8)) else {
-            return nil
-        }
-
-        let headerData = data[..<headerRange.lowerBound]
-        guard let headerString = String(data: headerData, encoding: .utf8) else {
-            return nil
-        }
-
-        let lines = headerString.split(separator: "\r\n", omittingEmptySubsequences: false)
-        guard let requestLine = lines.first else {
-            return nil
-        }
-
-        let requestParts = requestLine.split(separator: " ", maxSplits: 2)
-        guard requestParts.count >= 2 else {
-            return nil
-        }
-
-        var parsedHeaders: [String: String] = [:]
-        for line in lines.dropFirst() {
-            guard let colonIndex = line.firstIndex(of: ":") else {
-                continue
-            }
-            let name = line[..<colonIndex].trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
-            let value = line[line.index(after: colonIndex)...].trimmingCharacters(in: .whitespacesAndNewlines)
-            parsedHeaders[name] = value
-        }
-
-        let bodyStart = headerRange.upperBound
-        let expectedBodyLength = parsedHeaders["content-length"].flatMap(Int.init) ?? 0
-        guard expectedBodyLength >= 0,
-              data.count >= bodyStart + expectedBodyLength else {
-            return nil
-        }
-
-        method = String(requestParts[0]).uppercased()
-        path = String(requestParts[1]).split(separator: "?", maxSplits: 1).first.map(String.init) ?? ""
-        headers = parsedHeaders
-        body = data[bodyStart..<(bodyStart + expectedBodyLength)]
-    }
-
-    func header(named name: String) -> String? {
-        headers[name.lowercased()]
-    }
-}
-
-private enum HTTPStatus: Int {
-    case ok = 200
-    case noContent = 204
-    case badRequest = 400
-    case forbidden = 403
-    case notFound = 404
-    case methodNotAllowed = 405
-    case payloadTooLarge = 413
-    case unsupportedMediaType = 415
-
-    var reason: String {
-        switch self {
-        case .ok: "OK"
-        case .noContent: "No Content"
-        case .badRequest: "Bad Request"
-        case .forbidden: "Forbidden"
-        case .notFound: "Not Found"
-        case .methodNotAllowed: "Method Not Allowed"
-        case .payloadTooLarge: "Payload Too Large"
-        case .unsupportedMediaType: "Unsupported Media Type"
-        }
-    }
-}

Sources/Firelink/MediaDetector.swift

@@ -1,28 +0,0 @@
-import Foundation
-
-enum MediaDetector {
-    private static let supportedDomains: Set<String> = [
-        "youtube.com", "youtu.be",
-        "twitter.com", "x.com",
-        "vimeo.com",
-        "twitch.tv",
-        "instagram.com",
-        "tiktok.com",
-        "facebook.com", "fb.watch",
-        "reddit.com", "v.redd.it",
-        "soundcloud.com"
-    ]
-
-    static func isSupportedMedia(url: URL) -> Bool {
-        guard let host = url.host?.lowercased() else { return false }
-
-        for domain in supportedDomains {
-            if host == domain || host.hasSuffix(".\(domain)") {
-                // Ignore raw files that happen to be hosted on these domains, if any,
-                // though usually these domains serve web pages for media.
-                return true
-            }
-        }
-        return false
-    }
-}

Sources/Firelink/MediaDownloadEngine.swift

@@ -1,378 +0,0 @@
-import Foundation
-
-final class MediaDownloadEngine: @unchecked Sendable {
-    struct Handle {
-        let cancel: @Sendable () -> Void
-    }
-
-    enum EngineError: LocalizedError {
-        case missingEngine(String)
-        case launchFailed(String)
-
-        var errorDescription: String? {
-            switch self {
-            case .missingEngine(let msg): return msg
-            case .launchFailed(let msg): return msg
-            }
-        }
-    }
-
-    func start(
-        item: DownloadItem,
-        cookieSource: BrowserCookieSource,
-        proxyConfiguration: DownloadProxyConfiguration,
-        speedLimitKiBPerSecond: Int?,
-        progress: @escaping @Sendable (DownloadProgress) -> Void,
-        messageUpdate: @escaping @Sendable (String) -> Void,
-        completion: @escaping @Sendable (Result<URL, Error>) -> Void
-    ) async throws -> Handle {
-        let ytDlpURL = await MediaEngineManager.shared.binaryPath(for: .ytDlp)
-        let ffmpegURL = await MediaEngineManager.shared.binaryPath(for: .ffmpeg)
-
-        guard let ytDlpURL, FileManager.default.isExecutableFile(atPath: ytDlpURL.path) else {
-            throw EngineError.missingEngine("The bundled yt-dlp executable is missing. Reinstall Firelink or rebuild the app bundle.")
-        }
-        guard let ffmpegURL, FileManager.default.isExecutableFile(atPath: ffmpegURL.path) else {
-            throw EngineError.missingEngine("The bundled FFmpeg executable is missing. Reinstall Firelink or rebuild the app bundle.")
-        }
-
-        try FileManager.default.createDirectory(at: item.destinationDirectory, withIntermediateDirectories: true)
-
-        let process = Process()
-        process.executableURL = ytDlpURL
-
-        var arguments = [
-            "--newline",
-            "--ffmpeg-location", ffmpegURL.path,
-            "--force-ipv4",
-            "-o", item.destinationPath
-        ]
-
-        if let format = item.mediaFormatSelector {
-            arguments.append("-f")
-            arguments.append(format)
-
-            if item.isAudioOnlyMedia == true {
-                let audioFormat = item.fileName.fileExtension(defaultValue: "mp3")
-                arguments.append(contentsOf: ["-x", "--audio-format", audioFormat, "--audio-quality", "0"])
-            } else {
-                let mergeFormat = item.fileName.fileExtension(defaultValue: "mp4")
-                arguments.append(contentsOf: ["--merge-output-format", mergeFormat])
-            }
-        }
-
-        MediaExtractionEngine.appendCommonArguments(
-            to: &arguments,
-            cookieSource: cookieSource,
-            credentials: item.credentials,
-            transferOptions: item.transferOptions
-        )
-
-        if let proxyURI = proxyConfiguration.customProxyURI, proxyConfiguration.mode == .custom {
-            arguments.append(contentsOf: ["--proxy", proxyURI])
-        }
-
-        if let speedLimitKiBPerSecond, speedLimitKiBPerSecond > 0 {
-            arguments.append(contentsOf: ["--limit-rate", "\(speedLimitKiBPerSecond)K"])
-        }
-
-        appendParallelDownloadArguments(to: &arguments, connectionsPerServer: item.connectionsPerServer)
-
-        arguments.append(item.url.absoluteString)
-        process.arguments = arguments
-
-        let outputPipe = Pipe()
-        let errorPipe = Pipe()
-        process.standardOutput = outputPipe
-        process.standardError = errorPipe
-
-        let parser = YTDLPProgressParser()
-        let errorBuffer = LockedDataBuffer()
-        let outputPathTracker = YTDLPOutputPathTracker()
-        let completionGate = CompletionGate(completion)
-        let outputHandler = YTDLPOutputHandler(
-            parser: parser,
-            outputPathTracker: outputPathTracker,
-            progress: progress,
-            messageUpdate: messageUpdate
-        )
-
-        let group = DispatchGroup()
-        group.enter() // output
-        group.enter() // error
-        group.enter() // process
-
-        outputPipe.fileHandleForReading.readabilityHandler = { handle in
-            let data = handle.availableData
-            if data.isEmpty {
-                handle.readabilityHandler = nil
-                group.leave()
-            } else if let text = String(data: data, encoding: .utf8) {
-                outputHandler.handle(text)
-            }
-        }
-
-        errorPipe.fileHandleForReading.readabilityHandler = { handle in
-            let data = handle.availableData
-            if data.isEmpty {
-                handle.readabilityHandler = nil
-                group.leave()
-            } else {
-                errorBuffer.append(data)
-                if let text = String(data: data, encoding: .utf8) {
-                    outputHandler.handle(text)
-                }
-            }
-        }
-
-        process.terminationHandler = { _ in
-            group.leave()
-        }
-
-        group.notify(queue: .global()) {
-            if process.terminationStatus == 0 {
-                completionGate.complete(.success(Self.resolvedOutputURL(for: item, tracker: outputPathTracker)))
-            } else {
-                let errorString = String(data: errorBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "Unknown Error"
-                completionGate.complete(.failure(EngineError.launchFailed(Self.cleanErrorMessage(errorString, status: process.terminationStatus))))
-            }
-        }
-
-        try process.run()
-        messageUpdate("Fetching media data...")
-        outputPipe.fileHandleForWriting.closeFile()
-        errorPipe.fileHandleForWriting.closeFile()
-
-        return Handle(cancel: {
-            if process.isRunning {
-                process.terminate()
-            }
-        })
-    }
-
-    private static func resolvedOutputURL(for item: DownloadItem, tracker: YTDLPOutputPathTracker) -> URL {
-        let expectedURL = URL(fileURLWithPath: item.destinationPath)
-        if FileManager.default.fileExists(atPath: expectedURL.path) {
-            return expectedURL
-        }
-
-        if let observedURL = tracker.lastExistingOutputURL {
-            return observedURL
-        }
-
-        let baseName = expectedURL.deletingPathExtension().lastPathComponent
-        let commonExtensions = ["mp4", "mkv", "webm", "mp3", "m4a", "opus", "m4v", "aac", "wav", "flac"]
-        
-        var mostRecent: URL?
-        var mostRecentDate: Date = .distantPast
-        
-        for ext in commonExtensions {
-            let candidate = item.destinationDirectory.appendingPathComponent("\(baseName).\(ext)")
-            if FileManager.default.fileExists(atPath: candidate.path) {
-                let date = (try? candidate.resourceValues(forKeys: [.contentModificationDateKey]).contentModificationDate) ?? .distantPast
-                if date >= mostRecentDate {
-                    mostRecentDate = date
-                    mostRecent = candidate
-                }
-            }
-        }
-
-        return mostRecent ?? expectedURL
-    }
-
-    private static func cleanErrorMessage(_ message: String, status: Int32) -> String {
-        guard !message.isEmpty else {
-            return "Exit code \(status)"
-        }
-
-        if message.localizedCaseInsensitiveContains("Sign in to confirm") ||
-            message.localizedCaseInsensitiveContains("not a bot") ||
-            message.localizedCaseInsensitiveContains("Use --cookies-from-browser") {
-            return "YouTube requires browser cookies for this video. Choose a browser in Settings > Engine, then retry."
-        }
-
-        if message.localizedCaseInsensitiveContains("n challenge solving failed") ||
-            message.localizedCaseInsensitiveContains("supported JavaScript runtime") {
-            return "YouTube challenge solving failed. Install Deno or Node, then retry."
-        }
-
-        return message
-    }
-
-    private func appendParallelDownloadArguments(to arguments: inout [String], connectionsPerServer: Int) {
-        let connections = min(max(connectionsPerServer, 1), 16)
-        guard connections > 1 else { return }
-
-        arguments.append(contentsOf: ["--concurrent-fragments", "\(connections)"])
-        // Use yt-dlp's native concurrent downloader instead of aria2c to ensure progress parsing works via stdout
-    }
-}
-
-final class YTDLPOutputHandler: @unchecked Sendable {
-    private let parser: YTDLPProgressParser
-    private let outputPathTracker: YTDLPOutputPathTracker
-    private let progress: @Sendable (DownloadProgress) -> Void
-    private let messageUpdate: @Sendable (String) -> Void
-
-    init(
-        parser: YTDLPProgressParser,
-        outputPathTracker: YTDLPOutputPathTracker,
-        progress: @escaping @Sendable (DownloadProgress) -> Void,
-        messageUpdate: @escaping @Sendable (String) -> Void
-    ) {
-        self.parser = parser
-        self.outputPathTracker = outputPathTracker
-        self.progress = progress
-        self.messageUpdate = messageUpdate
-    }
-
-    func handle(_ text: String) {
-        for line in text.split(whereSeparator: \.isNewline) {
-            let stringLine = String(line)
-            outputPathTracker.observe(stringLine)
-            if let update = parser.parse(stringLine) {
-                progress(update)
-                messageUpdate("Downloading Media")
-            } else if let message = statusMessage(for: stringLine) {
-                messageUpdate(message)
-            }
-        }
-    }
-
-    private func statusMessage(for line: String) -> String? {
-        if line.contains("[Merger]") || line.contains("[ExtractAudio]") || line.contains("[Fixup") {
-            return "Processing Media..."
-        }
-        if line.contains("[youtube]") && line.localizedCaseInsensitiveContains("Downloading") {
-            return "Fetching YouTube data..."
-        }
-        if line.contains("[info]") && line.localizedCaseInsensitiveContains("Downloading") {
-            return "Preparing media stream..."
-        }
-        if line.localizedCaseInsensitiveContains("Sign in to confirm") ||
-            line.localizedCaseInsensitiveContains("not a bot") ||
-            line.localizedCaseInsensitiveContains("Use --cookies-from-browser") {
-            return "YouTube requires browser cookies"
-        }
-        if line.localizedCaseInsensitiveContains("n challenge solving failed") ||
-            line.localizedCaseInsensitiveContains("supported JavaScript runtime") {
-            return "YouTube challenge solver unavailable"
-        }
-        if line.contains("Destination:") {
-            return "Starting media download..."
-        }
-        return nil
-    }
-}
-
-final class YTDLPOutputPathTracker: @unchecked Sendable {
-    private let lock = NSLock()
-    private var observedPaths: [String] = []
-    private let quotedPathRegex = try? NSRegularExpression(pattern: #""([^"]+)""#)
-
-    var lastExistingOutputURL: URL? {
-        lock.withLock {
-            observedPaths
-                .reversed()
-                .map { URL(fileURLWithPath: $0) }
-                .first { FileManager.default.fileExists(atPath: $0.path) }
-        }
-    }
-
-    func observe(_ line: String) {
-        let candidates = pathCandidates(from: line)
-        guard !candidates.isEmpty else { return }
-
-        lock.withLock {
-            for candidate in candidates where !observedPaths.contains(candidate) {
-                observedPaths.append(candidate)
-            }
-        }
-    }
-
-    private func pathCandidates(from line: String) -> [String] {
-        var paths: [String] = []
-
-        if line.contains("Destination:"),
-           let destination = line.components(separatedBy: "Destination:").last?.trimmingCharacters(in: .whitespacesAndNewlines),
-           destination.hasPrefix("/") {
-            paths.append(destination.trimmingCharacters(in: CharacterSet(charactersIn: "\"")))
-        }
-
-        for quoted in quotedCaptures(in: line) where quoted.hasPrefix("/") {
-            paths.append(quoted)
-        }
-
-        return paths
-    }
-
-    private func quotedCaptures(in text: String) -> [String] {
-        guard let quotedPathRegex else { return [] }
-        let range = NSRange(text.startIndex..<text.endIndex, in: text)
-        return quotedPathRegex.matches(in: text, range: range).compactMap { match in
-            guard match.numberOfRanges > 1,
-                  let captureRange = Range(match.range(at: 1), in: text) else {
-                return nil
-            }
-            return String(text[captureRange])
-        }
-    }
-}
-
-private extension String {
-    func fileExtension(defaultValue: String) -> String {
-        let ext = (self as NSString).pathExtension.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
-        return ext.isEmpty ? defaultValue : ext
-    }
-}
-
-final class YTDLPProgressParser: @unchecked Sendable {
-    private let percentageRegex = try? NSRegularExpression(pattern: #"(\d+(?:\.\d+)?)%"#)
-    private let speedRegex = try? NSRegularExpression(pattern: #"at\s+([^\s]+)"#)
-    private let etaRegex = try? NSRegularExpression(pattern: #"ETA\s+([^\s]+)"#)
-    private let sizeRegex = try? NSRegularExpression(pattern: #"of\s+~?([0-9.]+[a-zA-Z]+)"#)
-
-    func parse(_ line: String) -> DownloadProgress? {
-        if line.contains("[download]") && line.contains("%") {
-            let fraction = (Double(firstCapture(in: line, regex: percentageRegex) ?? "0") ?? 0) / 100.0
-            let speed = firstCapture(in: line, regex: speedRegex) ?? "-"
-            let eta = firstCapture(in: line, regex: etaRegex) ?? "-"
-            let size = firstCapture(in: line, regex: sizeRegex) ?? "-"
-
-            return DownloadProgress(
-                fraction: min(max(fraction, 0), 1),
-                bytesText: size,
-                speedText: speed,
-                etaText: eta,
-                connectionCount: 1
-            )
-        } else if line.contains("[#") && line.contains("DL:") {
-            let fraction = (Double(firstCapture(in: line, regex: try? NSRegularExpression(pattern: #"\(([\d.]+)%\)"#)) ?? "0") ?? 0) / 100.0
-            let speed = firstCapture(in: line, regex: try? NSRegularExpression(pattern: #"DL:([^\s\]]+)"#)) ?? "-"
-            let eta = firstCapture(in: line, regex: try? NSRegularExpression(pattern: #"ETA:([^\]]+)"#)) ?? "-"
-            let size = firstCapture(in: line, regex: try? NSRegularExpression(pattern: #"/([^\s\(]+)\("#)) ?? "-"
-            let cn = Int(firstCapture(in: line, regex: try? NSRegularExpression(pattern: #"CN:(\d+)"#)) ?? "1") ?? 1
-
-            return DownloadProgress(
-                fraction: min(max(fraction, 0), 1),
-                bytesText: size,
-                speedText: speed,
-                etaText: eta,
-                connectionCount: cn
-            )
-        }
-        return nil
-    }
-
-    private func firstCapture(in text: String, regex: NSRegularExpression?) -> String? {
-        guard let regex else { return nil }
-        let range = NSRange(text.startIndex..<text.endIndex, in: text)
-        guard let match = regex.firstMatch(in: text, range: range), match.numberOfRanges > 1 else {
-            return nil
-        }
-        guard let captureRange = Range(match.range(at: 1), in: text) else {
-            return nil
-        }
-        return String(text[captureRange])
-    }
-}

Sources/Firelink/MediaEngineManager.swift

@@ -1,94 +0,0 @@
-import Foundation
-import Combine
-
-enum AddonState: Equatable, Sendable {
-    case notInstalled
-    case installed(version: String)
-    case failed(error: String)
-}
-
-enum AddonType: String, CaseIterable, Sendable {
-    case ytDlp = "yt-dlp"
-    case ffmpeg
-
-    var binaryName: String {
-        switch self {
-        case .ytDlp: return "yt-dlp"
-        case .ffmpeg: return "ffmpeg"
-        }
-    }
-}
-
-@MainActor
-final class MediaEngineManager: ObservableObject {
-    static let shared = MediaEngineManager()
-
-    @Published var ytDlpState: AddonState = .notInstalled
-    @Published var ffmpegState: AddonState = .notInstalled
-
-    private init() {
-        checkLocalInstallation()
-    }
-
-    func binaryPath(for addon: AddonType) -> URL? {
-        if let bundled = Bundle.main.url(forResource: addon.binaryName, withExtension: nil),
-           FileManager.default.isExecutableFile(atPath: bundled.path) {
-            return bundled
-        }
-        
-        // Prevent fatalError crash: avoid accessing Bundle.module if running in a packaged app.
-        if Bundle.main.bundleURL.pathExtension.lowercased() != "app" {
-            #if SWIFT_PACKAGE
-            if let bundled = Bundle.module.url(forResource: addon.binaryName, withExtension: nil),
-               FileManager.default.isExecutableFile(atPath: bundled.path) {
-                return bundled
-            }
-            #endif
-        }
-        return nil
-    }
-
-    func checkLocalInstallation() {
-        for addon in AddonType.allCases {
-            if binaryPath(for: addon) != nil {
-                setState(for: addon, to: .installed(version: "Bundled"))
-            } else {
-                setState(for: addon, to: .notInstalled)
-            }
-        }
-    }
-
-    func ensureAvailable(addons requiredAddons: Set<AddonType>) async throws {
-        checkLocalInstallation()
-        let missingAddons = requiredAddons.filter { addon in
-            switch state(for: addon) {
-            case .installed:
-                return false
-            case .notInstalled, .failed:
-                return true
-            }
-        }
-
-        guard !missingAddons.isEmpty else { return }
-
-        for missing in missingAddons {
-            setState(for: missing, to: .failed(error: "Bundled executable missing"))
-        }
-
-        throw NSError(domain: "MediaEngineErrorDomain", code: 1, userInfo: [NSLocalizedDescriptionKey: "One or more required media engines are missing from the app bundle. Reinstall Firelink or rebuild the app bundle."])
-    }
-
-    private func state(for addon: AddonType) -> AddonState {
-        switch addon {
-        case .ytDlp: return ytDlpState
-        case .ffmpeg: return ffmpegState
-        }
-    }
-
-    private func setState(for addon: AddonType, to state: AddonState) {
-        switch addon {
-        case .ytDlp: ytDlpState = state
-        case .ffmpeg: ffmpegState = state
-        }
-    }
-}

Sources/Firelink/MediaExtractionEngine.swift

@@ -1,478 +0,0 @@
-import Foundation
-
-struct RawMediaFormat: Decodable, Sendable, Equatable {
-    let format_id: String?
-    let ext: String?
-    let resolution: String?
-    let format_note: String?
-    let vcodec: String?
-    let acodec: String?
-    let height: Int?
-    let filesize: Int64?
-    let filesize_approx: Int64?
-}
-
-struct MediaMetadata: Decodable, Sendable, Equatable {
-    let id: String?
-    let title: String?
-    let uploader: String?
-    let channel: String?
-    let thumbnail: URL?
-    let duration: Double?
-    let formats: [RawMediaFormat]?
-
-    var displayUploader: String? {
-        channel ?? uploader
-    }
-}
-
-enum MediaType: String, Sendable, Equatable {
-    case video = "Video"
-    case audio = "Audio"
-}
-
-struct CleanFormatOption: Identifiable, Equatable, Sendable {
-    var id: String { name }
-    let name: String
-    let formatSelector: String
-    let isAudioOnly: Bool
-    let symbol: String
-    let outputExtension: String
-    let detail: String
-    let estimatedBytes: Int64?
-    
-    let mediaType: MediaType
-    let qualityName: String
-    let containerName: String
-}
-
-enum MediaExtractionEngine {
-    private static let metadataTimeoutSeconds: UInt64 = 75
-
-    enum ExtractionError: Error, LocalizedError {
-        case processFailed(String)
-        case invalidOutput
-        case parsingFailed(Error)
-        case timedOut
-
-        var errorDescription: String? {
-            switch self {
-            case .processFailed(let msg): return "Extraction failed: \(msg)"
-            case .invalidOutput: return "Invalid output from media engine."
-            case .parsingFailed(let err): return "Failed to parse metadata: \(err.localizedDescription)"
-            case .timedOut: return "Fetching metadata timed out. Try again or change the selected browser cookie source."
-            }
-        }
-    }
-
-    static func fetchMetadata(
-        for url: URL,
-        cookieSource: BrowserCookieSource,
-        credentials: DownloadCredentials?,
-        transferOptions: DownloadTransferOptions
-    ) async throws -> (MediaMetadata, [CleanFormatOption]) {
-        guard let ytDlpURL = await MediaEngineManager.shared.binaryPath(for: .ytDlp),
-              FileManager.default.isExecutableFile(atPath: ytDlpURL.path) else {
-            throw ExtractionError.processFailed("yt-dlp binary not found.")
-        }
-        let ytDlpPath = ytDlpURL.path
-
-        var args = ["-J", "--no-warnings", "--ignore-no-formats-error", "--no-playlist", "--force-ipv4"]
-        appendCommonArguments(to: &args, cookieSource: cookieSource, credentials: credentials, transferOptions: transferOptions)
-        args.append(url.absoluteString)
-
-        let data = try await YTDLPMetadataProcess(
-            executableURL: URL(fileURLWithPath: ytDlpPath),
-            arguments: args
-        ).run(timeoutSeconds: metadataTimeoutSeconds)
-
-        guard !data.isEmpty else {
-            throw ExtractionError.invalidOutput
-        }
-
-        do {
-            let metadata = try JSONDecoder().decode(MediaMetadata.self, from: data)
-            let options = extractOptions(from: metadata)
-            return (metadata, options)
-        } catch {
-            throw ExtractionError.parsingFailed(error)
-        }
-    }
-
-    static func appendCommonArguments(
-        to args: inout [String],
-        cookieSource: BrowserCookieSource,
-        credentials: DownloadCredentials?,
-        transferOptions: DownloadTransferOptions
-    ) {
-        if let browserName = cookieSource.ytDlpBrowserName {
-            args.append(contentsOf: ["--cookies-from-browser", browserName])
-        }
-
-        appendJavaScriptRuntimeArguments(to: &args)
-
-        for header in transferOptions.requestHeaders.map(\.normalized) where !header.isEmpty {
-            args.append(contentsOf: ["--add-header", header.headerLine])
-        }
-
-        if let cookieHeader = transferOptions.cookieHeader?.trimmingCharacters(in: .whitespacesAndNewlines),
-           !cookieHeader.isEmpty {
-            args.append(contentsOf: ["--add-header", "Cookie: \(cookieHeader)"])
-        }
-
-        if let credentials, !credentials.isEmpty {
-            args.append(contentsOf: ["--username", credentials.username, "--password", credentials.password])
-        }
-    }
-
-    private static func appendJavaScriptRuntimeArguments(to args: inout [String]) {
-        var runtimes: [String] = []
-        if let denoPath = executablePath(named: "deno", candidates: [
-            "/opt/homebrew/bin/deno",
-            "/usr/local/bin/deno"
-        ]) {
-            runtimes.append("deno:\(denoPath)")
-        }
-
-        if let nodePath = executablePath(named: "node", candidates: [
-            "/opt/homebrew/bin/node",
-            "/usr/local/bin/node",
-            "/usr/bin/node"
-        ]) {
-            runtimes.append("node:\(nodePath)")
-        }
-
-        if !runtimes.isEmpty {
-            args.append(contentsOf: ["--js-runtimes", runtimes.joined(separator: ",")])
-        }
-    }
-
-    private static func executablePath(named name: String, candidates: [String]) -> String? {
-        var safeCandidates = candidates
-        safeCandidates.append(contentsOf: [
-            "/opt/homebrew/bin/\(name)",
-            "/usr/local/bin/\(name)",
-            "/usr/bin/\(name)",
-            "/opt/local/bin/\(name)"
-        ])
-
-        for candidate in safeCandidates {
-            if FileManager.default.isExecutableFile(atPath: candidate) {
-                return candidate
-            }
-        }
-        return nil
-    }
-
-    private static func extractOptions(from metadata: MediaMetadata) -> [CleanFormatOption] {
-        var options: [CleanFormatOption] = []
-        let rawFormats = metadata.formats ?? []
-
-        let standardResolutions = [
-            (2160, "4K"),
-            (1440, "1440p"),
-            (1080, "1080p"),
-            (720, "720p"),
-            (480, "480p"),
-            (360, "360p")
-        ]
-
-        let availableResolutions = standardResolutions.filter { resolution, _ in
-            rawFormats.contains { format in
-                isVideo(format) && (format.height ?? 0) > 0 && (format.height ?? 0) <= resolution && (format.height ?? 0) >= resolution - 100
-            }
-        }
-        let videoQualities = [(nil as Int?, "Best")] + availableResolutions.map { (Optional($0.0), $0.1) }
-        let videoContainers = [
-            ("mp4", "MP4"),
-            ("mkv", "MKV"),
-            ("webm", "WebM")
-        ]
-
-        for (height, qualityName) in videoQualities {
-            for (container, containerName) in videoContainers {
-                guard hasVideoFormat(rawFormats, height: height, container: container) else { continue }
-                let estimatedBytes = estimatedVideoBytes(rawFormats, height: height, container: container)
-                options.append(CleanFormatOption(
-                    name: "\(qualityName) \(containerName)",
-                    formatSelector: videoSelector(height: height, container: container),
-                    isAudioOnly: false,
-                    symbol: "play.tv.fill",
-                    outputExtension: container,
-                    detail: optionDetail(
-                        base: height == nil ? "Best available video" : "Up to \(qualityName)",
-                        estimatedBytes: estimatedBytes
-                    ),
-                    estimatedBytes: estimatedBytes,
-                    mediaType: .video,
-                    qualityName: qualityName,
-                    containerName: containerName
-                ))
-            }
-        }
-
-        if hasAudioFormat(rawFormats, preferredExtension: nil) {
-            let estimatedBytes = estimatedAudioBytes(rawFormats, preferredExtension: nil)
-            options.append(CleanFormatOption(
-                name: "Audio MP3",
-                formatSelector: "bestaudio/best",
-                isAudioOnly: true,
-                symbol: "music.note",
-                outputExtension: "mp3",
-                detail: optionDetail(base: "Converted with ffmpeg", estimatedBytes: estimatedBytes),
-                estimatedBytes: estimatedBytes,
-                mediaType: .audio,
-                qualityName: "Best",
-                containerName: "MP3"
-            ))
-        }
-
-        if hasAudioFormat(rawFormats, preferredExtension: "m4a") {
-            let estimatedBytes = estimatedAudioBytes(rawFormats, preferredExtension: "m4a")
-            options.append(CleanFormatOption(
-                name: "Audio M4A",
-                formatSelector: "bestaudio[ext=m4a]/bestaudio/best",
-                isAudioOnly: true,
-                symbol: "waveform",
-                outputExtension: "m4a",
-                detail: optionDetail(base: "Prefer native M4A", estimatedBytes: estimatedBytes),
-                estimatedBytes: estimatedBytes,
-                mediaType: .audio,
-                qualityName: "Best",
-                containerName: "M4A"
-            ))
-        }
-
-        if hasAudioFormat(rawFormats, preferredExtension: "webm") {
-            let estimatedBytes = estimatedAudioBytes(rawFormats, preferredExtension: "webm")
-            options.append(CleanFormatOption(
-                name: "Audio Opus",
-                formatSelector: "bestaudio[ext=webm]/bestaudio/best",
-                isAudioOnly: true,
-                symbol: "waveform",
-                outputExtension: "opus",
-                detail: optionDetail(base: "Efficient audio", estimatedBytes: estimatedBytes),
-                estimatedBytes: estimatedBytes,
-                mediaType: .audio,
-                qualityName: "Best",
-                containerName: "Opus"
-            ))
-        }
-
-        return options
-    }
-
-    private static func hasVideoFormat(_ formats: [RawMediaFormat], height: Int?, container: String) -> Bool {
-        formats.contains { format in
-            guard isVideo(format), matchesHeight(format, height: height) else { return false }
-            return container == "mkv" || format.ext?.caseInsensitiveCompare(container) == .orderedSame
-        }
-    }
-
-    private static func hasAudioFormat(_ formats: [RawMediaFormat], preferredExtension: String?) -> Bool {
-        formats.contains { format in
-            guard isAudio(format) else { return false }
-            guard let preferredExtension else { return true }
-            return format.ext?.caseInsensitiveCompare(preferredExtension) == .orderedSame
-        }
-    }
-
-    private static func estimatedVideoBytes(_ formats: [RawMediaFormat], height: Int?, container: String) -> Int64? {
-        let videoBytes = formats
-            .filter { format in
-                guard isVideo(format), matchesHeight(format, height: height) else { return false }
-                return container == "mkv" || format.ext?.caseInsensitiveCompare(container) == .orderedSame
-            }
-            .compactMap { formatSize($0) }
-            .max()
-
-        guard let videoBytes else { return nil }
-        let audioBytes = estimatedAudioBytes(formats, preferredExtension: container == "webm" ? "webm" : "m4a") ??
-            estimatedAudioBytes(formats, preferredExtension: nil) ??
-            0
-        return videoBytes + audioBytes
-    }
-
-    private static func estimatedAudioBytes(_ formats: [RawMediaFormat], preferredExtension: String?) -> Int64? {
-        let preferred = formats
-            .filter { format in
-                guard isAudio(format) else { return false }
-                guard let preferredExtension else { return true }
-                return format.ext?.caseInsensitiveCompare(preferredExtension) == .orderedSame
-            }
-            .compactMap { formatSize($0) }
-            .max()
-
-        if preferred != nil || preferredExtension == nil {
-            return preferred
-        }
-
-        return estimatedAudioBytes(formats, preferredExtension: nil)
-    }
-
-    private static func isVideo(_ format: RawMediaFormat) -> Bool {
-        guard let vcodec = format.vcodec?.lowercased(), vcodec != "none" else { return false }
-        return true
-    }
-
-    private static func isAudio(_ format: RawMediaFormat) -> Bool {
-        let acodec = format.acodec?.lowercased()
-        let vcodec = format.vcodec?.lowercased()
-        return acodec != nil && acodec != "none" && (vcodec == nil || vcodec == "none")
-    }
-
-    private static func matchesHeight(_ format: RawMediaFormat, height: Int?) -> Bool {
-        guard let height else { return true }
-        guard let formatHeight = format.height else { return false }
-        return formatHeight <= height && formatHeight >= height - 100
-    }
-
-    private static func formatSize(_ format: RawMediaFormat) -> Int64? {
-        format.filesize ?? format.filesize_approx
-    }
-
-    private static func optionDetail(base: String, estimatedBytes: Int64?) -> String {
-        guard let estimatedBytes, estimatedBytes > 0 else { return base }
-        return "\(base) - ~\(ByteFormatter.string(estimatedBytes))"
-    }
-
-    private static func videoSelector(height: Int?, container: String) -> String {
-        let filter = heightFilter(height)
-        switch container {
-        case "mp4":
-            return "bestvideo\(filter)[ext=mp4]+bestaudio[ext=m4a]/best\(filter)[ext=mp4]/bestvideo\(filter)+bestaudio/best\(filter)"
-        case "webm":
-            return "bestvideo\(filter)[ext=webm]+bestaudio[ext=webm]/best\(filter)[ext=webm]/bestvideo\(filter)+bestaudio/best\(filter)"
-        default:
-            return "bestvideo\(filter)+bestaudio/best\(filter)"
-        }
-    }
-
-    private static func heightFilter(_ height: Int?) -> String {
-        guard let height else { return "" }
-        return "[height<=\(height)]"
-    }
-}
-
-private final class YTDLPMetadataProcess: @unchecked Sendable {
-    private let executableURL: URL
-    private let arguments: [String]
-    private let lock = NSLock()
-    private var process: Process?
-
-    init(executableURL: URL, arguments: [String]) {
-        self.executableURL = executableURL
-        self.arguments = arguments
-    }
-
-    func run(timeoutSeconds: UInt64) async throws -> Data {
-        try await withTaskCancellationHandler {
-            try await withThrowingTaskGroup(of: Data.self) { group in
-                group.addTask {
-                    try await self.runProcess()
-                }
-                group.addTask {
-                    try await Task.sleep(for: .seconds(timeoutSeconds))
-                    self.terminate()
-                    throw MediaExtractionEngine.ExtractionError.timedOut
-                }
-
-                guard let result = try await group.next() else {
-                    throw MediaExtractionEngine.ExtractionError.invalidOutput
-                }
-                group.cancelAll()
-                return result
-            }
-        } onCancel: {
-            self.terminate()
-        }
-    }
-
-    private func runProcess() async throws -> Data {
-        try await withCheckedThrowingContinuation { continuation in
-            let process = Process()
-            let outputPipe = Pipe()
-            let errorPipe = Pipe()
-            let outputBuffer = LockedDataBuffer(maxBytes: 64 * 1024 * 1024)
-            let errorBuffer = LockedDataBuffer()
-
-            process.executableURL = executableURL
-            process.arguments = arguments
-            process.standardOutput = outputPipe
-            process.standardError = errorPipe
-            process.standardInput = nil
-
-            let group = DispatchGroup()
-            group.enter() // output
-            group.enter() // error
-            group.enter() // process
-
-            outputPipe.fileHandleForReading.readabilityHandler = { handle in
-                let data = handle.availableData
-                if data.isEmpty {
-                    handle.readabilityHandler = nil
-                    group.leave()
-                } else {
-                    outputBuffer.append(data)
-                }
-            }
-
-            errorPipe.fileHandleForReading.readabilityHandler = { handle in
-                let data = handle.availableData
-                if data.isEmpty {
-                    handle.readabilityHandler = nil
-                    group.leave()
-                } else {
-                    errorBuffer.append(data)
-                }
-            }
-
-            lock.withLock {
-                self.process = process
-            }
-
-            process.terminationHandler = { _ in
-                group.leave()
-            }
-
-            group.notify(queue: .global()) {
-                if process.terminationStatus == 0 {
-                    continuation.resume(returning: outputBuffer.data)
-                } else {
-                    let stderr = String(data: errorBuffer.data, encoding: .utf8)?
-                        .trimmingCharacters(in: .whitespacesAndNewlines)
-                    let stdout = String(data: outputBuffer.data, encoding: .utf8)?
-                        .trimmingCharacters(in: .whitespacesAndNewlines)
-                    let message = [stderr, stdout]
-                        .compactMap { $0 }
-                        .filter { !$0.isEmpty }
-                        .joined(separator: "\n")
-                    continuation.resume(
-                        throwing: MediaExtractionEngine.ExtractionError.processFailed(
-                            message.isEmpty ? "Exit code \(process.terminationStatus)" : message
-                        )
-                    )
-                }
-            }
-
-            do {
-                try process.run()
-                outputPipe.fileHandleForWriting.closeFile()
-                errorPipe.fileHandleForWriting.closeFile()
-            } catch {
-                outputPipe.fileHandleForReading.readabilityHandler = nil
-                errorPipe.fileHandleForReading.readabilityHandler = nil
-                // We do not care about the DispatchGroup if we throw immediately here
-                continuation.resume(throwing: MediaExtractionEngine.ExtractionError.processFailed(error.localizedDescription))
-            }
-        }
-    }
-
-    private func terminate() {
-        lock.withLock {
-            if let process, process.isRunning {
-                process.terminate()
-            }
-        }
-    }
-}

Sources/Firelink/Models.swift

@@ -1,281 +0,0 @@
-import Foundation
-
-enum DownloadStatus: String, Codable, CaseIterable, Sendable {
-    case queued = "Queued"
-    case downloading = "Downloading"
-    case paused = "Paused"
-    case completed = "Completed"
-    case failed = "Failed"
-    case canceled = "Canceled"
-}
-
-enum DownloadCategory: String, Codable, CaseIterable, Sendable {
-    case musics = "Musics"
-    case movies = "Movies"
-    case compressed = "Compressed"
-    case pictures = "Pictures"
-    case documents = "Documents"
-    case other = "Other"
-
-    var symbolName: String {
-        switch self {
-        case .musics: "music.note"
-        case .movies: "film"
-        case .compressed: "archivebox"
-        case .pictures: "photo"
-        case .documents: "doc.text"
-        case .other: "folder"
-        }
-    }
-}
-
-struct DownloadQueue: Identifiable, Codable, Equatable, Sendable {
-    static let mainQueueID = UUID(uuidString: "00000000-0000-0000-0000-000000000001")!
-
-    var id = UUID()
-    var name: String
-
-    var isMain: Bool {
-        id == Self.mainQueueID
-    }
-
-    static var main: DownloadQueue {
-        DownloadQueue(id: mainQueueID, name: "Main queue")
-    }
-}
-
-struct DownloadCredentials: Codable, Equatable, Sendable {
-    var username: String
-    var password: String
-
-    var isEmpty: Bool {
-        username.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty &&
-            password.isEmpty
-    }
-}
-
-enum ChecksumAlgorithm: String, Codable, CaseIterable, Identifiable, Sendable {
-    case md5
-    case sha1 = "sha-1"
-    case sha256 = "sha-256"
-    case sha512 = "sha-512"
-
-    var id: String { rawValue }
-
-    var title: String {
-        switch self {
-        case .md5: "MD5"
-        case .sha1: "SHA-1"
-        case .sha256: "SHA-256"
-        case .sha512: "SHA-512"
-        }
-    }
-}
-
-struct DownloadChecksum: Codable, Equatable, Sendable {
-    var algorithm: ChecksumAlgorithm
-    var value: String
-
-    var normalized: DownloadChecksum {
-        DownloadChecksum(
-            algorithm: algorithm,
-            value: value.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
-        )
-    }
-
-    var isEmpty: Bool {
-        value.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
-    }
-}
-
-struct DownloadRequestHeader: Codable, Equatable, Sendable {
-    var name: String
-    var value: String
-
-    var normalized: DownloadRequestHeader {
-        DownloadRequestHeader(
-            name: name.trimmingCharacters(in: .whitespacesAndNewlines),
-            value: value.trimmingCharacters(in: .whitespacesAndNewlines)
-        )
-    }
-
-    var isEmpty: Bool {
-        let clean = normalized
-        return clean.name.isEmpty && clean.value.isEmpty
-    }
-
-    var headerLine: String {
-        let clean = normalized
-        return "\(clean.name): \(clean.value)"
-    }
-}
-
-struct DownloadTransferOptions: Equatable, Sendable {
-    var checksum: DownloadChecksum?
-    var requestHeaders: [DownloadRequestHeader] = []
-    var cookieHeader: String?
-    var mirrorURLs: [URL] = []
-}
-
-enum DownloadTransferOptionParser {
-    static func parseHeaders(_ text: String) -> [DownloadRequestHeader] {
-        headerLines(text).compactMap { line in
-            guard let colonIndex = line.firstIndex(of: ":") else { return nil }
-            let name = String(line[..<colonIndex]).trimmingCharacters(in: .whitespacesAndNewlines)
-            let value = String(line[line.index(after: colonIndex)...]).trimmingCharacters(in: .whitespacesAndNewlines)
-            let header = DownloadRequestHeader(name: name, value: value).normalized
-            return header.isEmpty || header.name.isEmpty ? nil : header
-        }
-    }
-
-    static func invalidHeaderLines(_ text: String) -> [String] {
-        headerLines(text).filter { line in
-            guard let colonIndex = line.firstIndex(of: ":") else { return true }
-            let name = String(line[..<colonIndex]).trimmingCharacters(in: .whitespacesAndNewlines)
-            return name.isEmpty
-        }
-    }
-
-    static func cleanCookieHeader(_ text: String) -> String? {
-        var value = text.trimmingCharacters(in: .whitespacesAndNewlines)
-        if value.lowercased().hasPrefix("cookie:") {
-            value = String(value.dropFirst("cookie:".count)).trimmingCharacters(in: .whitespacesAndNewlines)
-        }
-        return value.isEmpty ? nil : value
-    }
-
-    static func parseMirrorURLs(_ text: String) -> [URL] {
-        DownloadURLParser.parse(text)
-    }
-
-    static func invalidMirrorLines(_ text: String) -> [String] {
-        text.split(whereSeparator: { $0 == "\n" || $0 == "\r" })
-            .map { String($0).trimmingCharacters(in: .whitespacesAndNewlines) }
-            .filter { !$0.isEmpty && DownloadURLParser.parse($0).isEmpty }
-    }
-
-    private static func headerLines(_ text: String) -> [String] {
-        text.split(whereSeparator: { $0 == "\n" || $0 == "\r" })
-            .map { String($0).trimmingCharacters(in: .whitespacesAndNewlines) }
-            .filter { !$0.isEmpty }
-    }
-}
-
-struct DownloadItem: Identifiable, Codable, Equatable, Sendable {
-    var id = UUID()
-    var url: URL
-    var fileName: String
-    var category: DownloadCategory
-    var destinationDirectory: URL
-    var connectionsPerServer: Int
-    var credentials: DownloadCredentials?
-    var checksum: DownloadChecksum?
-    var requestHeaders: [DownloadRequestHeader]?
-    var cookieHeader: String?
-    var mirrorURLs: [URL]?
-    var speedLimitKiBPerSecond: Int?
-    var status: DownloadStatus = .queued
-    var progress: Double = 0
-    var speedText: String = "-"
-    var etaText: String = "-"
-    var connectionCount: Int = 0
-    var sizeBytes: Int64?
-    var bytesText: String = "-"
-    var message: String = ""
-    var createdAt = Date()
-    var lastTryAt: Date?
-    var autoResumeOnLaunch: Bool?
-    var queueID: UUID?
-    var rpcPort: Int?
-    var rpcSecret: String?
-    var mediaFormatSelector: String?
-    var isAudioOnlyMedia: Bool?
-
-    var displaySpeedText: String {
-        status == .downloading ? speedText : "-"
-    }
-
-    var displayETAText: String {
-        status == .downloading ? etaText : "-"
-    }
-
-    var destinationPath: String {
-        destinationDirectory.appendingPathComponent(fileName).path
-    }
-
-    var sortableSize: Int64 {
-        sizeBytes ?? 0
-    }
-
-    var transferOptions: DownloadTransferOptions {
-        DownloadTransferOptions(
-            checksum: checksum,
-            requestHeaders: requestHeaders ?? [],
-            cookieHeader: cookieHeader,
-            mirrorURLs: mirrorURLs ?? []
-        )
-    }
-
-    var speedLimitText: String {
-        guard let speedLimitKiBPerSecond, speedLimitKiBPerSecond > 0 else {
-            return "No limit"
-        }
-        return "\(speedLimitKiBPerSecond) KiB/s"
-    }
-
-    var redactedForPersistence: DownloadItem {
-        var item = self
-        if item.credentials != nil {
-            item.credentials?.password = ""
-        }
-        item.cookieHeader = nil
-        item.requestHeaders = item.requestHeaders?.filter { !$0.containsSensitiveValue }
-        return item
-    }
-}
-
-private extension DownloadRequestHeader {
-    var containsSensitiveValue: Bool {
-        switch normalized.name.lowercased() {
-        case "authorization", "cookie", "set-cookie", "x-api-key", "x-auth-token":
-            true
-        default:
-            false
-        }
-    }
-}
-
-struct DownloadProgress: Equatable, Sendable {
-    var fraction: Double
-    var bytesText: String
-    var speedText: String
-    var etaText: String
-    var connectionCount: Int
-}
-
-struct PendingDownload: Identifiable, Equatable, Sendable {
-    enum MetadataState: Equatable, Sendable {
-        case pending
-        case loading
-        case loaded
-        case failed(String)
-    }
-
-    var id = UUID()
-    var url: URL
-    var fileName: String
-    var category: DownloadCategory
-    var defaultDirectory: URL
-    var sizeBytes: Int64?
-    var mimeType: String?
-    var state: MetadataState = .pending
-    
-    var isMedia: Bool = false
-    var mediaOptions: [CleanFormatOption] = []
-    var selectedMediaOption: CleanFormatOption?
-    var mediaMetadata: MediaMetadata?
-
-    var destinationPath: String {
-        defaultDirectory.appendingPathComponent(fileName).path
-    }
-}

Sources/Firelink/ReleaseUpdateChecker.swift

@@ -1,325 +0,0 @@
-import Foundation
-
-struct GitHubReleaseCheckService: @unchecked Sendable {
-    private let owner: String
-    private let repository: String
-    private let fetch: @Sendable (URLRequest) async throws -> (Data, URLResponse)
-
-    init(
-        owner: String = "nimbold",
-        repository: String = "Firelink",
-        fetch: @escaping @Sendable (URLRequest) async throws -> (Data, URLResponse) = { request in
-            try await URLSession.shared.data(for: request)
-        }
-    ) {
-        self.owner = owner
-        self.repository = repository
-        self.fetch = fetch
-    }
-
-    func checkForUpdate(currentVersion: String) async throws -> ReleaseCheckOutcome {
-        guard let current = AppVersion(currentVersion) else {
-            throw ReleaseCheckFailure.invalidCurrentVersion(currentVersion)
-        }
-
-        let release = try await latestStableRelease()
-        guard let latest = AppVersion(release.tagName) else {
-            throw ReleaseCheckFailure.invalidReleaseVersion(release.tagName)
-        }
-
-        let update = AvailableReleaseUpdate(
-            version: latest.description,
-            tagName: release.tagName,
-            title: release.name?.isEmpty == false ? release.name! : release.tagName,
-            releaseNotes: release.body?.isEmpty == false ? release.body! : "No release notes were provided for this version.",
-            releaseURL: release.htmlURL,
-            publishedAt: release.publishedAt
-        )
-
-        if latest > current {
-            return .updateAvailable(update)
-        }
-
-        return .upToDate(latestVersion: latest.description, localVersion: current.description)
-    }
-
-    private func latestStableRelease() async throws -> GitHubRelease {
-        guard let url = URL(string: "https://api.github.com/repos/\(owner)/\(repository)/releases?per_page=30") else {
-            throw ReleaseCheckFailure.invalidReleaseURL
-        }
-
-        var request = URLRequest(url: url)
-        request.setValue("application/vnd.github+json", forHTTPHeaderField: "Accept")
-        request.setValue("Firelink", forHTTPHeaderField: "User-Agent")
-
-        let (data, response) = try await fetch(request)
-
-        guard let httpResponse = response as? HTTPURLResponse else {
-            throw ReleaseCheckFailure.invalidResponse
-        }
-
-        guard (200..<300).contains(httpResponse.statusCode) else {
-            throw ReleaseCheckFailure.httpStatus(httpResponse.statusCode)
-        }
-
-        let releases = try JSONDecoder.githubReleaseDecoder.decode([GitHubRelease].self, from: data)
-        let stableReleases = releases.filter { !$0.draft && !$0.prerelease }
-        guard !stableReleases.isEmpty else {
-            throw ReleaseCheckFailure.noStableRelease
-        }
-
-        let versionedReleases = stableReleases.compactMap { release -> (release: GitHubRelease, version: AppVersion)? in
-            guard let version = AppVersion(release.tagName) else { return nil }
-            return (release, version)
-        }
-
-        guard let latest = versionedReleases.max(by: { $0.version < $1.version }) else {
-            throw ReleaseCheckFailure.invalidReleaseVersion(stableReleases[0].tagName)
-        }
-
-        return latest.release
-    }
-}
-
-struct GitHubRelease: Decodable, Equatable {
-    let tagName: String
-    let name: String?
-    let body: String?
-    let htmlURL: URL
-    let draft: Bool
-    let prerelease: Bool
-    let publishedAt: Date?
-
-    private enum CodingKeys: String, CodingKey {
-        case tagName = "tag_name"
-        case name
-        case body
-        case htmlURL = "html_url"
-        case draft
-        case prerelease
-        case publishedAt = "published_at"
-    }
-}
-
-struct AvailableReleaseUpdate: Equatable, Identifiable {
-    var id: String { tagName }
-    let version: String
-    let tagName: String
-    let title: String
-    let releaseNotes: String
-    let releaseURL: URL
-    let publishedAt: Date?
-}
-
-enum ReleaseCheckOutcome: Equatable {
-    case updateAvailable(AvailableReleaseUpdate)
-    case upToDate(latestVersion: String, localVersion: String)
-}
-
-enum ReleaseUpdateState: Equatable {
-    case idle
-    case checking
-    case updateAvailable(AvailableReleaseUpdate)
-    case upToDate(latestVersion: String, localVersion: String)
-    case failed(message: String, recovery: String)
-}
-
-enum ReleaseCheckFailure: Error, Equatable {
-    case invalidReleaseURL
-    case invalidResponse
-    case httpStatus(Int)
-    case noStableRelease
-    case invalidCurrentVersion(String)
-    case invalidReleaseVersion(String)
-}
-
-@MainActor
-final class ReleaseUpdateChecker: ObservableObject {
-    @Published private(set) var state: ReleaseUpdateState = .idle
-    @Published var automaticallyChecksForUpdates: Bool {
-        didSet {
-            UserDefaults.standard.set(automaticallyChecksForUpdates, forKey: Self.automaticChecksKey)
-        }
-    }
-
-    private let service: GitHubReleaseCheckService
-    private let bundle: Bundle
-    private var automaticCheckTask: Task<Void, Never>?
-
-    private static let automaticChecksKey = "AutomaticallyCheckForReleaseUpdates"
-    private static let lastAutomaticCheckKey = "LastReleaseUpdateCheckDate"
-    private static let automaticCheckInterval: TimeInterval = 24 * 60 * 60
-
-    init(service: GitHubReleaseCheckService = GitHubReleaseCheckService(), bundle: Bundle = .main) {
-        self.service = service
-        self.bundle = bundle
-
-        if UserDefaults.standard.object(forKey: Self.automaticChecksKey) == nil {
-            self.automaticallyChecksForUpdates = true
-        } else {
-            self.automaticallyChecksForUpdates = UserDefaults.standard.bool(forKey: Self.automaticChecksKey)
-        }
-    }
-
-    var currentVersion: String {
-        bundle.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.1.0"
-    }
-
-    func checkForUpdates() {
-        guard state != .checking else { return }
-        state = .checking
-
-        Task {
-            do {
-                let outcome = try await service.checkForUpdate(currentVersion: currentVersion)
-                UserDefaults.standard.set(Date(), forKey: Self.lastAutomaticCheckKey)
-                apply(outcome)
-            } catch {
-                state = Self.failedState(for: error)
-            }
-        }
-    }
-
-    func checkAutomaticallyIfNeeded() {
-        guard automaticallyChecksForUpdates else { return }
-        guard state == .idle else { return }
-
-        if let lastCheck = UserDefaults.standard.object(forKey: Self.lastAutomaticCheckKey) as? Date,
-           Date().timeIntervalSince(lastCheck) < Self.automaticCheckInterval {
-            return
-        }
-
-        automaticCheckTask?.cancel()
-        automaticCheckTask = Task { [weak self] in
-            self?.checkForUpdates()
-        }
-    }
-
-    private func apply(_ outcome: ReleaseCheckOutcome) {
-        switch outcome {
-        case .updateAvailable(let update):
-            state = .updateAvailable(update)
-        case .upToDate(let latestVersion, let localVersion):
-            state = .upToDate(latestVersion: latestVersion, localVersion: localVersion)
-        }
-    }
-
-    private static func failedState(for error: Error) -> ReleaseUpdateState {
-        if let urlError = error as? URLError {
-            switch urlError.code {
-            case .notConnectedToInternet, .networkConnectionLost, .cannotFindHost, .cannotConnectToHost, .timedOut:
-                return .failed(
-                    message: "Couldn't reach GitHub.",
-                    recovery: "Check your internet connection, then try again."
-                )
-            default:
-                return .failed(
-                    message: "The update check couldn't finish.",
-                    recovery: urlError.localizedDescription
-                )
-            }
-        }
-
-        if let failure = error as? ReleaseCheckFailure {
-            switch failure {
-            case .httpStatus(let statusCode):
-                return .failed(
-                    message: "GitHub returned HTTP \(statusCode).",
-                    recovery: "Try again in a moment, or open the releases page manually."
-                )
-            case .noStableRelease:
-                return .failed(
-                    message: "No stable release was found.",
-                    recovery: "Open GitHub Releases to check the project manually."
-                )
-            case .invalidCurrentVersion(let version):
-                return .failed(
-                    message: "Firelink's current version could not be read.",
-                    recovery: "The app reported version \(version)."
-                )
-            case .invalidReleaseVersion(let tag):
-                return .failed(
-                    message: "The latest release tag could not be compared.",
-                    recovery: "GitHub reported \(tag)."
-                )
-            case .invalidReleaseURL, .invalidResponse:
-                return .failed(
-                    message: "The GitHub response could not be read.",
-                    recovery: "Try again in a moment."
-                )
-            }
-        }
-
-        return .failed(
-            message: "The update check failed.",
-            recovery: error.localizedDescription
-        )
-    }
-}
-
-struct AppVersion: Comparable, CustomStringConvertible {
-    private let components: [Int]
-
-    init?(_ rawValue: String) {
-        var value = rawValue.trimmingCharacters(in: .whitespacesAndNewlines)
-        if value.hasPrefix("v") || value.hasPrefix("V") {
-            value.removeFirst()
-        }
-
-        let prefix = value.prefix { character in
-            character.isNumber || character == "."
-        }
-
-        let version = String(prefix).trimmingCharacters(in: CharacterSet(charactersIn: "."))
-        guard !version.isEmpty else { return nil }
-
-        let components = version.split(separator: ".").compactMap { Int($0) }
-        guard !components.isEmpty, components.count == version.split(separator: ".").count else {
-            return nil
-        }
-
-        self.components = components
-    }
-
-    var description: String {
-        components.map(String.init).joined(separator: ".")
-    }
-
-    static func < (lhs: AppVersion, rhs: AppVersion) -> Bool {
-        let count = max(lhs.components.count, rhs.components.count)
-
-        for index in 0..<count {
-            let left = index < lhs.components.count ? lhs.components[index] : 0
-            let right = index < rhs.components.count ? rhs.components[index] : 0
-
-            if left != right {
-                return left < right
-            }
-        }
-
-        return false
-    }
-
-    static func == (lhs: AppVersion, rhs: AppVersion) -> Bool {
-        let count = max(lhs.components.count, rhs.components.count)
-
-        for index in 0..<count {
-            let left = index < lhs.components.count ? lhs.components[index] : 0
-            let right = index < rhs.components.count ? rhs.components[index] : 0
-
-            if left != right {
-                return false
-            }
-        }
-
-        return true
-    }
-}
-
-private extension JSONDecoder {
-    static var githubReleaseDecoder: JSONDecoder {
-        let decoder = JSONDecoder()
-        decoder.dateDecodingStrategy = .iso8601
-        return decoder
-    }
-}

Sources/Firelink/SchedulerController.swift

@@ -1,240 +0,0 @@
-import AppKit
-import Combine
-import Foundation
-
-enum PostQueueAction: String, Codable, CaseIterable, Identifiable {
-    case doNothing = "Do nothing"
-    case sleep = "Sleep"
-    case restart = "Restart"
-    case shutdown = "Shut down"
-
-    var id: String { rawValue }
-}
-
-enum SchedulerDay: Int, Codable, CaseIterable, Identifiable {
-    case sunday = 1, monday, tuesday, wednesday, thursday, friday, saturday
-
-    var id: Int { rawValue }
-
-    var shortName: String {
-        switch self {
-        case .sunday: "S"
-        case .monday: "M"
-        case .tuesday: "T"
-        case .wednesday: "W"
-        case .thursday: "T"
-        case .friday: "F"
-        case .saturday: "S"
-        }
-    }
-}
-
-struct SchedulerSettings: Codable, Equatable {
-    var isEnabled: Bool = false
-    var startTime: Date = Calendar.current.date(bySettingHour: 0, minute: 0, second: 0, of: Date()) ?? Date()
-    var isEveryday: Bool = true
-    var selectedDays: Set<SchedulerDay> = Set(SchedulerDay.allCases)
-    var postQueueAction: PostQueueAction = .doNothing
-    var targetQueueIDs: Set<UUID> = [DownloadQueue.mainQueueID]
-}
-
-@MainActor
-final class SchedulerController: ObservableObject {
-    @Published var settings: SchedulerSettings
-    @Published var isRunning: Bool = false
-    @Published var hasAutomationPermission: Bool = false
-    private let downloadController: DownloadController
-    private var cancellables = Set<AnyCancellable>()
-    private var timer: Timer?
-
-    private let defaults = UserDefaults.standard
-    private let storageKey = "Firelink.SchedulerSettings.v1"
-
-    // We only trigger once per minute to prevent multiple triggers in the same minute
-    private var lastTriggeredMinute: Date?
-
-    init(downloadController: DownloadController) {
-        self.downloadController = downloadController
-
-        if let data = defaults.data(forKey: "Firelink.SchedulerSettings.v1"),
-           let stored = try? JSONDecoder().decode(SchedulerSettings.self, from: data) {
-            self.settings = stored
-        } else {
-            self.settings = SchedulerSettings()
-        }
-        if self.settings.targetQueueIDs.isEmpty {
-            self.settings.targetQueueIDs = [DownloadQueue.mainQueueID]
-        }
-
-        checkAutomationPermission()
-        startTimer()
-
-        $settings
-            .dropFirst()
-            .sink { _ in
-                // We do NOT save instantly here to UserDefaults because the UI will have a "Save" button
-            }
-            .store(in: &cancellables)
-
-        // Observe downloads to check if we should trigger post-action
-        downloadController.$downloads
-            .dropFirst()
-            .sink { [weak self] _ in
-                self?.checkIfRunningFinished()
-            }
-            .store(in: &cancellables)
-    }
-
-    func saveSettings() {
-        if let data = try? JSONEncoder().encode(settings) {
-            defaults.set(data, forKey: storageKey)
-        }
-    }
-
-    private func startTimer() {
-        timer = Timer.scheduledTimer(withTimeInterval: 10, repeats: true) { [weak self] _ in
-            Task { @MainActor in
-                self?.checkSchedule()
-            }
-        }
-    }
-
-    private func checkSchedule() {
-        guard settings.isEnabled else { return }
-
-        let now = Date()
-        let calendar = Calendar.current
-
-        // Check if we already triggered in this exact minute
-        if let last = lastTriggeredMinute, calendar.isDate(last, equalTo: now, toGranularity: .minute) {
-            return
-        }
-
-        let startHour = calendar.component(.hour, from: settings.startTime)
-        let startMinute = calendar.component(.minute, from: settings.startTime)
-
-        let currentHour = calendar.component(.hour, from: now)
-        let currentMinute = calendar.component(.minute, from: now)
-        let currentWeekday = calendar.component(.weekday, from: now)
-
-        if startHour == currentHour && startMinute == currentMinute {
-            let shouldRun: Bool
-            if settings.isEveryday {
-                shouldRun = true
-            } else {
-                let day = SchedulerDay(rawValue: currentWeekday)
-                shouldRun = day.map { settings.selectedDays.contains($0) } ?? false
-            }
-
-            if shouldRun {
-                lastTriggeredMinute = now
-                triggerQueues()
-            }
-        }
-    }
-
-    private func triggerQueues() {
-        let targetQueueIDs = effectiveTargetQueueIDs()
-        let runnableQueueIDs = targetQueueIDs.filter { queueID in
-            downloadController.queues.contains(where: { $0.id == queueID }) &&
-                downloadController.queueItems(for: queueID).contains(where: { $0.status == .queued })
-        }
-
-        guard !runnableQueueIDs.isEmpty else { return }
-
-        isRunning = true
-
-        for queueID in runnableQueueIDs {
-            downloadController.startQueue(queueID: queueID)
-        }
-
-        checkIfRunningFinished()
-    }
-
-    private func checkIfRunningFinished() {
-        guard isRunning else { return }
-
-        let targetQueueIDs = effectiveTargetQueueIDs()
-        let hasActiveItems = targetQueueIDs.contains { queueID in
-            downloadController.queueItems(for: queueID).contains {
-                $0.status == .queued || $0.status == .downloading
-            }
-        }
-
-        if !hasActiveItems {
-            isRunning = false
-            performPostAction()
-        }
-    }
-
-    private func effectiveTargetQueueIDs() -> Set<UUID> {
-        settings.targetQueueIDs.isEmpty ? [DownloadQueue.mainQueueID] : settings.targetQueueIDs
-    }
-
-    private func performPostAction() {
-        guard settings.postQueueAction != .doNothing else { return }
-
-        var scriptCode = ""
-        switch settings.postQueueAction {
-        case .sleep:
-            scriptCode = "tell application \"Finder\" to sleep"
-        case .restart:
-            scriptCode = "tell application \"Finder\" to restart"
-        case .shutdown:
-            scriptCode = "tell application \"Finder\" to shut down"
-        case .doNothing:
-            break
-        }
-
-        guard !scriptCode.isEmpty else { return }
-
-        var error: NSDictionary?
-        if let script = NSAppleScript(source: scriptCode) {
-            script.executeAndReturnError(&error)
-            if let error {
-                print("Failed to perform scheduler post action: \(error)")
-            }
-        }
-    }
-
-    func checkAutomationPermission() {
-        let target = NSAppleEventDescriptor(bundleIdentifier: "com.apple.finder")
-        let status = AEDeterminePermissionToAutomateTarget(target.aeDesc, typeWildCard, typeWildCard, false)
-        hasAutomationPermission = (status == noErr)
-    }
-
-    func requestAutomationPermission() {
-        let target = NSAppleEventDescriptor(bundleIdentifier: "com.apple.finder")
-        let status = AEDeterminePermissionToAutomateTarget(target.aeDesc, typeWildCard, typeWildCard, true)
-
-        if status != noErr {
-            triggerAutomationConsentPrompt()
-        }
-
-        checkAutomationPermission()
-
-        if !hasAutomationPermission {
-            openAutomationPermissionSettings()
-        }
-    }
-
-    func openAutomationPermissionSettings() {
-        guard let url = URL(string: "x-apple.systempreferences:com.apple.preference.security?Privacy_Automation") else {
-            return
-        }
-
-        NSWorkspace.shared.open(url)
-    }
-
-    private func triggerAutomationConsentPrompt() {
-        let scriptCode = "tell application \"Finder\" to get name"
-
-        var error: NSDictionary?
-        if let script = NSAppleScript(source: scriptCode) {
-            script.executeAndReturnError(&error)
-            if let error {
-                print("Failed to trigger Automation permission prompt: \(error)")
-            }
-        }
-    }
-}

Sources/Firelink/SchedulerView.swift

@@ -1,218 +0,0 @@
-import SwiftUI
-
-struct SchedulerView: View {
-    @EnvironmentObject private var downloadController: DownloadController
-    @EnvironmentObject private var schedulerController: SchedulerController
-    @State private var showSaveToast: Bool = false
-
-    // Local state to hold edits before saving
-    @State private var isEnabled: Bool = false
-    @State private var startTime: Date = Date()
-    @State private var isEveryday: Bool = true
-    @State private var selectedDays: Set<SchedulerDay> = []
-    @State private var postQueueAction: PostQueueAction = .doNothing
-    @State private var targetQueueIDs: Set<UUID> = []
-
-    var body: some View {
-        VStack(spacing: 0) {
-            headerView
-            Divider()
-
-            ScrollView {
-                VStack(alignment: .leading, spacing: 24) {
-                    VStack(alignment: .leading, spacing: 24) {
-                        timeSelectionSection
-                        queueSelectionSection
-                        postActionSection
-                    }
-                    .opacity(isEnabled ? 1.0 : 0.5)
-                    .disabled(!isEnabled)
-
-                    Divider()
-                    permissionsSection
-                }
-                .padding(24)
-            }
-            .frame(maxWidth: .infinity, alignment: .leading)
-        }
-        .onAppear {
-            loadState()
-            schedulerController.checkAutomationPermission()
-        }
-        .onReceive(NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)) { _ in
-            schedulerController.checkAutomationPermission()
-        }
-        .overlay {
-            if showSaveToast {
-                toastView
-                    .transition(.move(edge: .bottom).combined(with: .opacity))
-            }
-        }
-    }
-
-    private var headerView: some View {
-        HStack {
-            Toggle(isOn: $isEnabled) {
-                Text("Scheduler")
-                    .font(.title2.weight(.bold))
-            }
-            .toggleStyle(.switch)
-
-            Spacer()
-
-            Button("Save Settings") {
-                saveState()
-                withAnimation(.spring()) {
-                    showSaveToast = true
-                }
-
-                DispatchQueue.main.asyncAfter(deadline: .now() + 2.5) {
-                    withAnimation {
-                        showSaveToast = false
-                    }
-                }
-            }
-            .buttonStyle(.borderedProminent)
-        }
-        .padding(24)
-    }
-
-    private var timeSelectionSection: some View {
-        VStack(alignment: .leading, spacing: 16) {
-            Text("Start Time")
-                .font(.headline)
-
-            DatePicker("Time", selection: $startTime, displayedComponents: [.hourAndMinute])
-                .datePickerStyle(.stepperField)
-                .labelsHidden()
-
-            Toggle("Everyday", isOn: $isEveryday)
-
-            if !isEveryday {
-                HStack(spacing: 12) {
-                    ForEach(SchedulerDay.allCases) { day in
-                        Toggle(day.shortName, isOn: Binding(
-                            get: { selectedDays.contains(day) },
-                            set: { isSelected in
-                                if isSelected {
-                                    selectedDays.insert(day)
-                                } else {
-                                    selectedDays.remove(day)
-                                }
-                            }
-                        ))
-                        .toggleStyle(.button)
-                    }
-                }
-            }
-        }
-    }
-
-    private var queueSelectionSection: some View {
-        VStack(alignment: .leading, spacing: 16) {
-            Text("Queues to Start")
-                .font(.headline)
-
-            if downloadController.queues.isEmpty {
-                Text("No queues available")
-                    .foregroundStyle(.secondary)
-            } else {
-                VStack(alignment: .leading, spacing: 8) {
-                    ForEach(downloadController.queues) { queue in
-                        Toggle(queue.name, isOn: Binding(
-                            get: { targetQueueIDs.contains(queue.id) },
-                            set: { isSelected in
-                                if isSelected {
-                                    targetQueueIDs.insert(queue.id)
-                                } else {
-                                    targetQueueIDs.remove(queue.id)
-                                }
-                            }
-                        ))
-                    }
-                }
-            }
-        }
-    }
-
-    private var postActionSection: some View {
-        VStack(alignment: .leading, spacing: 16) {
-            Text("After Completion")
-                .font(.headline)
-
-            Picker("Action", selection: $postQueueAction) {
-                ForEach(PostQueueAction.allCases) { action in
-                    Text(action.rawValue).tag(action)
-                }
-            }
-            .labelsHidden()
-            .pickerStyle(.radioGroup)
-        }
-    }
-
-    private var permissionsSection: some View {
-        VStack(alignment: .leading, spacing: 12) {
-            Text("System Permissions")
-                .font(.headline)
-
-            Text("Firelink needs Automation permission to control Finder in order to automatically sleep, restart, or shut down your Mac after downloads finish.")
-                .font(.subheadline)
-                .foregroundStyle(.secondary)
-                .fixedSize(horizontal: false, vertical: true)
-
-            if schedulerController.hasAutomationPermission {
-                Button("Revoke Permissions") {
-                    schedulerController.openAutomationPermissionSettings()
-                }
-                .buttonStyle(.bordered)
-            } else {
-                Button("Grant Permission") {
-                    schedulerController.requestAutomationPermission()
-                }
-                .buttonStyle(.borderedProminent)
-            }
-        }
-    }
-
-    private var toastView: some View {
-        VStack {
-            Spacer()
-            HStack(spacing: 10) {
-                Image(systemName: "checkmark.circle.fill")
-                    .foregroundColor(.green)
-                Text("Settings Saved")
-                    .fontWeight(.medium)
-            }
-            .padding(.horizontal, 16)
-            .padding(.vertical, 10)
-            .background(.regularMaterial)
-            .clipShape(Capsule())
-            .shadow(radius: 4, y: 2)
-            .padding(.bottom, 30)
-        }
-        .allowsHitTesting(false)
-    }
-
-    private func loadState() {
-        isEnabled = schedulerController.settings.isEnabled
-        startTime = schedulerController.settings.startTime
-        isEveryday = schedulerController.settings.isEveryday
-        selectedDays = schedulerController.settings.selectedDays
-        postQueueAction = schedulerController.settings.postQueueAction
-        targetQueueIDs = schedulerController.settings.targetQueueIDs.isEmpty
-            ? [DownloadQueue.mainQueueID]
-            : schedulerController.settings.targetQueueIDs
-    }
-
-    private func saveState() {
-        schedulerController.settings.isEnabled = isEnabled
-        schedulerController.settings.startTime = startTime
-        schedulerController.settings.isEveryday = isEveryday
-        schedulerController.settings.selectedDays = selectedDays
-        schedulerController.settings.postQueueAction = postQueueAction
-        schedulerController.settings.targetQueueIDs = targetQueueIDs.isEmpty
-            ? [DownloadQueue.mainQueueID]
-            : targetQueueIDs
-        schedulerController.saveSettings()
-    }
-}

Sources/Firelink/Settings/AboutSettingsPane.swift

@@ -1,181 +0,0 @@
-import AppKit
-import SwiftUI
-
-struct AboutSettingsPane: View {
-    @EnvironmentObject private var updateChecker: ReleaseUpdateChecker
-
-    private let projectURL = URL(string: "https://github.com/nimbold/Firelink")!
-    private let releasesURL = URL(string: "https://github.com/nimbold/Firelink/releases")!
-    private let aria2URL = URL(string: "https://aria2.github.io/")!
-    private let ytDlpURL = URL(string: "https://github.com/yt-dlp/yt-dlp")!
-    private let ffmpegURL = URL(string: "https://ffmpeg.org/")!
-    private let licenseURL = URL(string: "https://github.com/nimbold/Firelink/blob/main/LICENSE")!
-
-    private var appVersion: String {
-        Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.1.0"
-    }
-
-    private var buildNumber: String {
-        Bundle.main.infoDictionary?["CFBundleVersion"] as? String ?? "Development"
-    }
-
-    var body: some View {
-        Form {
-            Section {
-                HStack(alignment: .center, spacing: 16) {
-                    Image(nsImage: NSApp.applicationIconImage)
-                        .resizable()
-                        .frame(width: 64, height: 64)
-                        .accessibilityHidden(true)
-
-                    VStack(alignment: .leading, spacing: 4) {
-                        Text("Firelink")
-                            .font(.title2.weight(.bold))
-                        Text("Version \(appVersion) (\(buildNumber))")
-                            .foregroundStyle(.secondary)
-                        Text("A native macOS download manager for fast, organized, segmented transfers.")
-                            .font(.caption)
-                            .foregroundStyle(.secondary)
-                    }
-                }
-                .padding(.vertical, 8)
-            }
-
-            Section("Updates") {
-                VStack(alignment: .leading, spacing: 16) {
-                    updateStatusView
-
-                    Divider()
-                        .padding(.vertical, 2)
-
-                    Toggle("Automatically check for updates", isOn: $updateChecker.automaticallyChecksForUpdates)
-                }
-                .padding(.vertical, 8)
-                .animation(.easeInOut, value: updateChecker.state)
-            }
-
-            Section {
-                VStack(alignment: .leading, spacing: 10) {
-                    HStack {
-                        Text("Created by NimBold")
-                        Spacer()
-                        Link(destination: projectURL) {
-                            HStack(spacing: 4) {
-                                if let imgPath = Bundle.main.path(forResource: "GitHubTemplate", ofType: "png"),
-                                   let nsImage = NSImage(contentsOfFile: imgPath) {
-                                    Image(nsImage: nsImage)
-                                        .resizable()
-                                        .renderingMode(.template)
-                                        .frame(width: 14, height: 14)
-                                        .foregroundStyle(.secondary)
-                                }
-                                Text("Source Code")
-                            }
-                        }
-                        .buttonStyle(.plain)
-                    }
-
-                    HStack {
-                        Text("Powered by")
-                        HStack(spacing: 4) {
-                            Link("aria2", destination: aria2URL)
-                            Text("•").foregroundStyle(.secondary)
-                            Link("yt-dlp", destination: ytDlpURL)
-                            Text("•").foregroundStyle(.secondary)
-                            Link("ffmpeg", destination: ffmpegURL)
-                        }
-                        Spacer()
-                        Link("MIT License", destination: licenseURL)
-                    }
-
-                    Text("Copyright © 2026 NimBold. All rights reserved.")
-                        .font(.caption2)
-                        .foregroundStyle(.secondary)
-                }
-                .font(.caption)
-                .padding(.vertical, 4)
-            }
-        }
-        .formStyle(.grouped)
-    }
-
-    @ViewBuilder
-    private var updateStatusView: some View {
-        HStack(alignment: .center) {
-            switch updateChecker.state {
-            case .idle:
-                VStack(alignment: .leading, spacing: 2) {
-                    Text("Check for Updates")
-                        .font(.headline)
-                    Text("Firelink checks GitHub Releases for new versions.")
-                        .font(.subheadline)
-                        .foregroundStyle(.secondary)
-                }
-                Spacer()
-                Button("Check Now") {
-                    updateChecker.checkForUpdates()
-                }
-
-            case .checking:
-                VStack(alignment: .leading, spacing: 2) {
-                    Text("Checking for updates...")
-                        .font(.headline)
-                    Text("Connecting to GitHub...")
-                        .font(.subheadline)
-                        .foregroundStyle(.secondary)
-                }
-                Spacer()
-                ProgressView()
-                    .controlSize(.small)
-                    .padding(.trailing, 16)
-
-            case .updateAvailable(let update):
-                VStack(alignment: .leading, spacing: 2) {
-                    Text("Firelink \(update.version) is available!")
-                        .font(.headline)
-                    Text("You currently have version \(appVersion).")
-                        .font(.subheadline)
-                        .foregroundStyle(.secondary)
-                    
-                    Link("View Release Notes", destination: update.releaseURL)
-                        .font(.caption)
-                        .padding(.top, 2)
-                }
-                Spacer()
-                Button("Download Update") {
-                    NSWorkspace.shared.open(update.releaseURL)
-                }
-                .buttonStyle(.borderedProminent)
-
-            case .upToDate(let latestVersion, _):
-                VStack(alignment: .leading, spacing: 2) {
-                    Text("Firelink is up to date")
-                        .font(.headline)
-                    Text("Version \(latestVersion) is the newest stable release.")
-                        .font(.subheadline)
-                        .foregroundStyle(.secondary)
-                }
-                Spacer()
-                Button("Check Again") {
-                    updateChecker.checkForUpdates()
-                }
-
-            case .failed(let message, let recovery):
-                VStack(alignment: .leading, spacing: 2) {
-                    Text(message)
-                        .font(.headline)
-                    Text(recovery)
-                        .font(.subheadline)
-                        .foregroundStyle(.secondary)
-                        .lineLimit(2)
-                }
-                Spacer()
-                Button("Try Again") {
-                    updateChecker.checkForUpdates()
-                }
-            }
-        }
-        .padding(.vertical, 4)
-    }
-
-}

Sources/Firelink/Settings/DownloadSettingsPane.swift

@@ -1,46 +0,0 @@
-import SwiftUI
-
-struct DownloadSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-
-    var body: some View {
-        Form {
-            Section {
-                Stepper(
-                    "Default connections per server: \(settings.perServerConnections)",
-                    value: $settings.perServerConnections,
-                    in: 1...16
-                )
-                Text("Used as the default for new downloads. The Add Downloads window can override it per batch.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-
-                Stepper(
-                    "Parallel downloads: \(settings.maxConcurrentDownloads)",
-                    value: $settings.maxConcurrentDownloads,
-                    in: 1...12
-                )
-                Text("Controls how many files Firelink downloads at the same time.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-            }
-
-            Section {
-                LabeledContent("Global speed limit") {
-                    HStack {
-                        TextField("0", value: $settings.globalSpeedLimitKiBPerSecond, format: .number)
-                            .textFieldStyle(.roundedBorder)
-                            .multilineTextAlignment(.trailing)
-                            .frame(width: 80)
-                        Text("KiB/s")
-                            .foregroundStyle(.secondary)
-                    }
-                }
-                Text("Set to 0 for unlimited speed. This limit is divided across currently active downloads.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .formStyle(.grouped)
-    }
-}

Sources/Firelink/Settings/EngineSettingsPane.swift

@@ -1,102 +0,0 @@
-import SwiftUI
-import AppKit
-
-struct EngineSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-    @StateObject private var engineManager = MediaEngineManager.shared
-    @State private var version = "Checking..."
-
-    private var executableURL: URL? {
-        Aria2DownloadEngine.findExecutable()
-    }
-
-    var body: some View {
-        Form {
-            Section {
-                LabeledContent("Version") {
-                    Text(version)
-                        .font(.system(.body, design: .monospaced))
-                        .foregroundStyle(.secondary)
-                        .textSelection(.enabled)
-                }
-
-                LabeledContent("Binary Path") {
-                    Text(executableURL?.path ?? "Not found")
-                        .font(.system(.caption, design: .monospaced))
-                        .foregroundStyle(.tertiary)
-                        .lineLimit(1)
-                        .truncationMode(.middle)
-                        .textSelection(.enabled)
-                }
-                .help(executableURL?.path ?? "")
-            } header: {
-                Text("Core Downloader (Aria2)")
-            } footer: {
-                if executableURL == nil {
-                    Text("Install aria2 with Homebrew or ensure it is bundled inside the app resources.")
-                        .foregroundStyle(.red)
-                } else {
-                    Text("Handles core HTTP/FTP and BitTorrent downloads.")
-                }
-            }
-
-            Section {
-                addonStatusRow(title: "yt-dlp", state: engineManager.ytDlpState, path: engineManager.binaryPath(for: .ytDlp))
-
-                addonStatusRow(title: "FFmpeg", state: engineManager.ffmpegState, path: engineManager.binaryPath(for: .ffmpeg))
-
-                LabeledContent("Browser Cookies") {
-                    Picker("", selection: $settings.mediaCookieSource) {
-                        ForEach(BrowserCookieSource.allCases, id: \.self) { source in
-                            Text(source.rawValue).tag(source)
-                        }
-                    }
-                    .labelsHidden()
-                    .frame(maxWidth: 200)
-                }
-            } header: {
-                Text("Media Extractors")
-            } footer: {
-                VStack(alignment: .leading, spacing: 8) {
-                    Text("Powers video and audio extraction from supported sites.")
-
-                    if settings.mediaCookieSource != .none {
-                        Text(settings.mediaCookieSource.statusDetail)
-                    }
-                }
-            }
-        }
-        .formStyle(.grouped)
-        .task {
-            version = await Aria2DownloadEngine.versionString() ?? "Unavailable"
-        }
-    }
-
-    @ViewBuilder
-    private func addonStatusRow(title: String, state: AddonState, path: URL?) -> some View {
-        LabeledContent(title) {
-            VStack(alignment: .trailing) {
-                switch state {
-                case .notInstalled:
-                    Text("Missing")
-                        .foregroundStyle(.red)
-                case .installed(let version):
-                    Text(version)
-                        .foregroundStyle(.secondary)
-                        .font(.system(.body, design: .monospaced))
-                case .failed(let error):
-                    Text("Error")
-                        .foregroundStyle(.red)
-                        .help(error)
-                }
-
-                Text(path?.path ?? "Not found")
-                    .font(.system(.caption, design: .monospaced))
-                    .foregroundStyle(.tertiary)
-                    .lineLimit(1)
-                    .truncationMode(.middle)
-                    .textSelection(.enabled)
-            }
-        }
-    }
-}

Sources/Firelink/Settings/IntegrationSettingsPane.swift

@@ -1,221 +0,0 @@
-import AppKit
-import SwiftUI
-
-struct IntegrationSettingsPane: View {
-    @EnvironmentObject private var controller: DownloadController
-    @EnvironmentObject private var settings: AppSettings
-    @State private var showToast = false
-
-    var body: some View {
-        VStack(spacing: 20) {
-            // Header
-            HStack(alignment: .center, spacing: 16) {
-                Image(systemName: "puzzlepiece.extension.fill")
-                    .resizable()
-                    .aspectRatio(contentMode: .fit)
-                    .frame(width: 40, height: 40)
-                    .foregroundStyle(Color(nsColor: NSColor(red: 1.0, green: 0.44, blue: 0.22, alpha: 1.0)))
-                    .accessibilityHidden(true)
-
-                VStack(alignment: .leading, spacing: 4) {
-                    Text("Connect Browser Extension")
-                        .font(.title2.weight(.bold))
-                    Text("Capture downloads directly from your browser in three easy steps.")
-                        .foregroundStyle(.secondary)
-                        .font(.subheadline)
-                }
-                Spacer()
-            }
-
-            KeychainAccessCard()
-
-            if settings.isKeychainAccessGranted {
-                HStack(spacing: 12) {
-                    // Step 1
-                    CompactStepCardView(
-                        stepNumber: 1,
-                        title: "Copy Token",
-                        description: "This secure token authorizes your browser extension.",
-                        icon: "doc.on.clipboard.fill",
-                        iconColor: .blue,
-                        actionText: "Copy Token",
-                        action: {
-                            NSPasteboard.general.clearContents()
-                            NSPasteboard.general.setString(settings.extensionPairingToken, forType: .string)
-                            withAnimation {
-                                showToast = true
-                            }
-                        },
-                        secondaryActionText: "Regenerate",
-                        secondaryAction: {
-                            var bytes = [UInt8](repeating: 0, count: 32)
-                            let status = SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes)
-                            settings.extensionPairingToken = status == errSecSuccess ? Data(bytes).base64EncodedString() : UUID().uuidString
-                        }
-                    )
-
-                    Image(systemName: "chevron.right")
-                        .font(.title3.weight(.bold))
-                        .foregroundStyle(Color(nsColor: .tertiaryLabelColor))
-
-                    // Step 2
-                    CompactStepCardView(
-                        stepNumber: 2,
-                        title: "Get Extension",
-                        description: "Install the Firelink Companion extension on your browser.",
-                        icon: "globe",
-                        iconColor: .orange,
-                        actionText: "Firefox Add-ons",
-                        action: {
-                            if let url = URL(string: "https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/") {
-                                NSWorkspace.shared.open(url)
-                            }
-                        },
-                        secondaryActionText: "Releases",
-                        secondaryAction: {
-                            if let url = URL(string: "https://github.com/nimbold/Firelink-Extension/releases") {
-                                NSWorkspace.shared.open(url)
-                            }
-                        }
-                    )
-
-                    Image(systemName: "chevron.right")
-                        .font(.title3.weight(.bold))
-                        .foregroundStyle(Color(nsColor: .tertiaryLabelColor))
-
-                    // Step 3
-                    CompactStepCardView(
-                        stepNumber: 3,
-                        title: "Paste & Connect",
-                        description: "Click the Firelink icon in your browser's toolbar and paste the token.",
-                        icon: "arrow.down.doc.fill",
-                        iconColor: .green,
-                        actionText: nil,
-                        action: nil
-                    )
-                }
-                .fixedSize(horizontal: false, vertical: true)
-                
-                Divider()
-                
-                // Diagnostics
-                HStack {
-                    Text("Diagnostics:")
-                        .foregroundStyle(.secondary)
-                    Spacer()
-                    if let port = controller.extensionServerPort {
-                        Label("Listening on 127.0.0.1:\(port)", systemImage: "checkmark.seal.fill")
-                            .foregroundStyle(.green)
-                    } else {
-                        Label("Not listening", systemImage: "exclamationmark.triangle.fill")
-                            .foregroundStyle(.orange)
-                    }
-                }
-                .font(.footnote)
-            }
-            Spacer()
-        }
-        .padding(24)
-        .toast(isShowing: $showToast, message: "Token copied to clipboard!")
-        .background(Color(NSColor.windowBackgroundColor))
-    }
-}
-
-struct CompactStepCardView: View {
-    let stepNumber: Int
-    let title: String
-    let description: String
-    let icon: String
-    let iconColor: Color
-    let actionText: String?
-    let action: (() -> Void)?
-    var secondaryActionText: String? = nil
-    var secondaryAction: (() -> Void)? = nil
-
-    var body: some View {
-        VStack(spacing: 12) {
-            HStack(alignment: .top) {
-                // Step Number Badge
-                ZStack {
-                    Circle()
-                        .fill(Color(nsColor: .controlBackgroundColor))
-                        .frame(width: 24, height: 24)
-                        .shadow(color: .black.opacity(0.1), radius: 1, y: 1)
-                    
-                    Text("\(stepNumber)")
-                        .font(.system(.caption, design: .rounded).weight(.bold))
-                        .foregroundStyle(.primary)
-                }
-                Spacer()
-                // Icon
-                ZStack {
-                    RoundedRectangle(cornerRadius: 8)
-                        .fill(iconColor.opacity(0.15))
-                        .frame(width: 32, height: 32)
-                    
-                    Image(systemName: icon)
-                        .font(.system(size: 16))
-                        .foregroundStyle(iconColor)
-                }
-            }
-            
-            // Text Content
-            VStack(alignment: .leading, spacing: 4) {
-                Text(title)
-                    .font(.subheadline.weight(.semibold))
-                    .frame(maxWidth: .infinity, alignment: .leading)
-                Text(description)
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-                    .frame(maxWidth: .infinity, alignment: .leading)
-                    .fixedSize(horizontal: false, vertical: true)
-            }
-            
-            Spacer(minLength: 8)
-            
-            // Action Button
-            VStack(spacing: 8) {
-                if let actionText = actionText, let action = action {
-                    Button(action: action) {
-                        Text(actionText)
-                            .font(.caption.weight(.medium))
-                            .frame(maxWidth: .infinity)
-                            .padding(.vertical, 6)
-                            .background(Color.accentColor)
-                            .foregroundColor(.white)
-                            .cornerRadius(6)
-                    }
-                    .buttonStyle(.plain)
-                }
-                
-                if let secondaryActionText = secondaryActionText, let secondaryAction = secondaryAction {
-                    Button(action: secondaryAction) {
-                        Text(secondaryActionText)
-                            .font(.caption.weight(.medium))
-                            .frame(maxWidth: .infinity)
-                            .padding(.vertical, 6)
-                            .background(Color(nsColor: .controlBackgroundColor))
-                            .foregroundColor(.primary)
-                            .cornerRadius(6)
-                            .overlay(
-                                RoundedRectangle(cornerRadius: 6)
-                                    .strokeBorder(Color(nsColor: .separatorColor).opacity(0.5), lineWidth: 1)
-                            )
-                    }
-                    .buttonStyle(.plain)
-                }
-            }
-        }
-        .padding(12)
-        .frame(maxWidth: .infinity, maxHeight: .infinity)
-        .background(
-            RoundedRectangle(cornerRadius: 12)
-                .fill(Color(nsColor: .controlBackgroundColor))
-                .shadow(color: .black.opacity(0.05), radius: 4, y: 1)
-        )
-        .overlay(
-            RoundedRectangle(cornerRadius: 12)
-                .strokeBorder(Color(nsColor: .separatorColor).opacity(0.5), lineWidth: 1)
-        )
-    }
-}

Sources/Firelink/Settings/KeychainAccessCard.swift

@@ -1,65 +0,0 @@
-import SwiftUI
-
-struct KeychainAccessCard: View {
-    @EnvironmentObject private var settings: AppSettings
-    
-    var body: some View {
-        HStack(spacing: 16) {
-            ZStack {
-                RoundedRectangle(cornerRadius: 10)
-                    .fill(settings.isKeychainAccessGranted ? Color.green.opacity(0.15) : Color.blue.opacity(0.15))
-                    .frame(width: 36, height: 36)
-                
-                Image(systemName: settings.isKeychainAccessGranted ? "lock.open.fill" : "lock.fill")
-                    .font(.system(size: 18))
-                    .foregroundStyle(settings.isKeychainAccessGranted ? .green : .blue)
-            }
-            
-            VStack(alignment: .leading, spacing: 2) {
-                Text("Keychain Access")
-                    .font(.headline)
-                Text("Firelink needs Keychain access to securely store your browser extension pairing token.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-                    .fixedSize(horizontal: false, vertical: true)
-            }
-            
-            Spacer(minLength: 16)
-            
-            if settings.isKeychainAccessGranted {
-                Label("Granted", systemImage: "checkmark.circle.fill")
-                    .foregroundStyle(.green)
-                    .font(.subheadline.weight(.medium))
-                
-                Button(role: .destructive) {
-                    settings.revokeKeychainAccess()
-                } label: {
-                    Text("Revoke")
-                }
-            } else {
-                Button {
-                    settings.grantKeychainAccess()
-                } label: {
-                    Text("Grant Access")
-                        .font(.subheadline.weight(.medium))
-                        .padding(.horizontal, 12)
-                        .padding(.vertical, 6)
-                        .background(Color.accentColor)
-                        .foregroundColor(.white)
-                        .cornerRadius(6)
-                }
-                .buttonStyle(.plain)
-            }
-        }
-        .padding(12)
-        .background(
-            RoundedRectangle(cornerRadius: 12)
-                .fill(Color(nsColor: .controlBackgroundColor))
-                .shadow(color: .black.opacity(0.05), radius: 4, y: 1)
-        )
-        .overlay(
-            RoundedRectangle(cornerRadius: 12)
-                .strokeBorder(Color(nsColor: .separatorColor).opacity(0.5), lineWidth: 1)
-        )
-    }
-}

Sources/Firelink/Settings/LocationsSettingsPane.swift

@@ -1,289 +0,0 @@
-import AppKit
-import SwiftUI
-
-struct LocationsSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-
-    var body: some View {
-        Form {
-            Section {
-                Grid(alignment: .leading, horizontalSpacing: 16, verticalSpacing: 12) {
-                    BulkDirectoryPickerRow()
-
-                    GridRow {
-                        Divider()
-                            .gridCellColumns(2)
-                    }
-
-                    ForEach(DownloadCategory.allCases, id: \.self) { category in
-                        DirectoryPickerRow(category: category)
-                    }
-                }
-
-                HStack {
-                    Spacer()
-                    Button("Reset Defaults") {
-                        settings.resetDirectories()
-                    }
-                }
-            } footer: {
-                Text("Folders will be created automatically when applied.")
-            }
-        }
-        .formStyle(.grouped)
-    }
-}
-
-struct DirectoryPickerRow: View {
-    @EnvironmentObject private var settings: AppSettings
-    let category: DownloadCategory
-
-    @State private var path = ""
-    @State private var message = ""
-
-    var body: some View {
-        GridRow(alignment: .firstTextBaseline) {
-            Label(category.rawValue, systemImage: category.symbolName)
-                .gridColumnAlignment(.leading)
-
-            VStack(alignment: .leading, spacing: 4) {
-                HStack(spacing: 8) {
-                    TextField("", text: $path, prompt: Text("Folder path"))
-                        .labelsHidden()
-                        .textFieldStyle(.roundedBorder)
-                        .font(.system(.body, design: .monospaced))
-                        .onSubmit {
-                            applyPath()
-                        }
-
-                    Button {
-                        applyPath()
-                    } label: {
-                        Label("Apply", systemImage: "checkmark")
-                    }
-                    .disabled(path.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
-
-                    Button {
-                        selectFolder()
-                    } label: {
-                        Label("Select", systemImage: "folder.badge.plus")
-                    }
-                }
-
-                if let displayMessage = message.isEmpty ? statusMessage(for: path) : message, !displayMessage.isEmpty {
-                    Text(displayMessage)
-                        .font(.caption)
-                        .foregroundStyle(isErrorMessage(displayMessage) ? .red : .secondary)
-                }
-            }
-        }
-        .onAppear {
-            syncPathFromSettings()
-        }
-        .onChange(of: settings.downloadDirectories[category]) { _, _ in
-            syncPathFromSettings()
-        }
-    }
-
-    private func selectFolder() {
-        let panel = NSOpenPanel()
-        panel.canChooseFiles = false
-        panel.canChooseDirectories = true
-        panel.allowsMultipleSelection = false
-        panel.canCreateDirectories = true
-        panel.directoryURL = settings.destinationDirectory(for: category)
-
-        if panel.runModal() == .OK, let url = panel.url {
-            path = url.path
-            settings.setDirectory(url.path, for: category)
-            message = "Saved."
-        }
-    }
-
-    private func syncPathFromSettings() {
-        path = settings.downloadDirectories[category] ?? settings.destinationDirectory(for: category).path
-        message = ""
-    }
-
-    private func applyPath() {
-        let trimmed = path.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else {
-            message = "Enter a folder path."
-            return
-        }
-
-        let expanded = NSString(string: trimmed).expandingTildeInPath
-        var isDirectory: ObjCBool = false
-
-        if FileManager.default.fileExists(atPath: expanded, isDirectory: &isDirectory) {
-            guard isDirectory.boolValue else {
-                message = "This path points to a file, not a folder."
-                return
-            }
-        } else {
-            do {
-                try FileManager.default.createDirectory(
-                    at: URL(fileURLWithPath: expanded, isDirectory: true),
-                    withIntermediateDirectories: true
-                )
-            } catch {
-                message = "Could not create folder: \(error.localizedDescription)"
-                return
-            }
-        }
-
-        guard FileManager.default.isWritableFile(atPath: expanded) else {
-            message = "Firelink cannot write to this folder."
-            return
-        }
-
-        settings.setDirectory(expanded, for: category)
-        path = expanded
-        message = "Saved."
-    }
-
-    private func statusMessage(for path: String) -> String? {
-        let trimmed = path.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else { return "Enter a folder path." }
-
-        let expanded = NSString(string: trimmed).expandingTildeInPath
-        var isDirectory: ObjCBool = false
-
-        if FileManager.default.fileExists(atPath: expanded, isDirectory: &isDirectory) {
-            if !isDirectory.boolValue {
-                return "This path points to a file, not a folder."
-            }
-            return FileManager.default.isWritableFile(atPath: expanded)
-                ? nil
-                : "Firelink cannot write to this folder."
-        }
-
-        return nil
-    }
-
-    private func isErrorMessage(_ message: String) -> Bool {
-        message == "This path points to a file, not a folder." ||
-        message.hasPrefix("Could not create folder:") ||
-        message == "Firelink cannot write to this folder." ||
-        message == "Enter a folder path."
-    }
-}
-
-struct BulkDirectoryPickerRow: View {
-    @EnvironmentObject private var settings: AppSettings
-    @State private var path = ""
-    @State private var message = ""
-
-    var body: some View {
-        GridRow(alignment: .firstTextBaseline) {
-            Label("All Categories", systemImage: "folder.fill.badge.plus")
-                .gridColumnAlignment(.leading)
-
-            VStack(alignment: .leading, spacing: 4) {
-                HStack(spacing: 8) {
-                    TextField("", text: $path, prompt: Text("Base folder path"))
-                        .labelsHidden()
-                        .textFieldStyle(.roundedBorder)
-                        .font(.system(.body, design: .monospaced))
-                        .onSubmit {
-                            applyPath()
-                        }
-
-                    Button {
-                        applyPath()
-                    } label: {
-                        Label("Apply", systemImage: "checkmark")
-                    }
-                    .disabled(path.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
-
-                    Button {
-                        selectFolder()
-                    } label: {
-                        Label("Select", systemImage: "folder.badge.plus")
-                    }
-                }
-
-                if !message.isEmpty {
-                    Text(message)
-                        .font(.caption)
-                        .foregroundStyle(isErrorMessage(message) ? .red : .secondary)
-                } else {
-                    Text("Automatically creates all category folders in the selected path.")
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                }
-            }
-        }
-    }
-
-    private func selectFolder() {
-        let panel = NSOpenPanel()
-        panel.canChooseFiles = false
-        panel.canChooseDirectories = true
-        panel.allowsMultipleSelection = false
-        panel.canCreateDirectories = true
-
-        if panel.runModal() == .OK, let url = panel.url {
-            path = url.path
-            applyPath()
-        }
-    }
-
-    private func applyPath() {
-        let trimmed = path.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else {
-            message = "Enter a base folder path."
-            return
-        }
-
-        let expanded = NSString(string: trimmed).expandingTildeInPath
-        var isDirectory: ObjCBool = false
-
-        if FileManager.default.fileExists(atPath: expanded, isDirectory: &isDirectory) {
-            guard isDirectory.boolValue else {
-                message = "This path points to a file, not a folder."
-                return
-            }
-        } else {
-            do {
-                try FileManager.default.createDirectory(
-                    at: URL(fileURLWithPath: expanded, isDirectory: true),
-                    withIntermediateDirectories: true
-                )
-            } catch {
-                message = "Could not create folder: \(error.localizedDescription)"
-                return
-            }
-        }
-
-        guard FileManager.default.isWritableFile(atPath: expanded) else {
-            message = "Firelink cannot write to this folder."
-            return
-        }
-
-        for category in DownloadCategory.allCases {
-            let categoryPath = (expanded as NSString).appendingPathComponent(category.rawValue)
-            do {
-                try FileManager.default.createDirectory(
-                    at: URL(fileURLWithPath: categoryPath, isDirectory: true),
-                    withIntermediateDirectories: true
-                )
-                settings.setDirectory(categoryPath, for: category)
-            } catch {
-                message = "Could not create category folder \(category.rawValue): \(error.localizedDescription)"
-                return
-            }
-        }
-
-        message = "Created all categories in base folder."
-        path = ""
-    }
-
-    private func isErrorMessage(_ message: String) -> Bool {
-        message == "This path points to a file, not a folder." ||
-        message.hasPrefix("Could not create folder:") ||
-        message.hasPrefix("Could not create category folder") ||
-        message == "Firelink cannot write to this folder." ||
-        message == "Enter a base folder path."
-    }
-}

Sources/Firelink/Settings/LookAndFeelSettingsPane.swift

@@ -1,47 +0,0 @@
-import SwiftUI
-
-struct LookAndFeelSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-    @AppStorage("showMenuBarIcon") private var showMenuBarIcon = true
-
-    var body: some View {
-        Form {
-            Section("App Theme") {
-                Picker("Theme", selection: $settings.appTheme) {
-                    ForEach(AppTheme.allCases) { theme in
-                        Text(theme.rawValue)
-                            .tag(theme)
-                    }
-                }
-                .pickerStyle(.radioGroup)
-
-                Text("Select a color palette for the app's user interface.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-            }
-
-            Section("Display") {
-                Picker("Font Size", selection: $settings.appFontSize) {
-                    ForEach(AppFontSize.allCases) { size in
-                        Text(size.rawValue).tag(size)
-                    }
-                }
-
-                Picker("List Row Density", selection: $settings.listRowDensity) {
-                    ForEach(ListRowDensity.allCases) { density in
-                        Text(density.rawValue).tag(density)
-                    }
-                }
-            }
-
-            Section("Menu Bar") {
-                Toggle("Show menu bar icon", isOn: $showMenuBarIcon)
-
-                Text("Provides quick access to downloads and queues from the macOS menu bar.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .formStyle(.grouped)
-    }
-}

Sources/Firelink/Settings/NetworkSettingsPane.swift

@@ -1,73 +0,0 @@
-import SwiftUI
-
-struct NetworkSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-
-    var body: some View {
-        Form {
-            Section {
-                Picker("Proxy", selection: proxyBinding(\.mode)) {
-                    ForEach(ProxyMode.allCases, id: \.self) { mode in
-                        Text(mode.title)
-                            .tag(mode)
-                    }
-                }
-                .pickerStyle(.radioGroup)
-
-                if settings.proxySettings.mode == .custom {
-                    Grid(alignment: .leading, horizontalSpacing: 10, verticalSpacing: 10) {
-                        GridRow {
-                            Text("IP or Host")
-                            TextField("127.0.0.1", text: proxyBinding(\.host))
-                                .textFieldStyle(.roundedBorder)
-                                .font(.system(.body, design: .monospaced))
-                        }
-
-                        GridRow {
-                            Text("Port")
-                            TextField("8080", value: proxyBinding(\.port), format: .number)
-                                .textFieldStyle(.roundedBorder)
-                                .frame(width: 110)
-                        }
-                    }
-                }
-
-                Text(networkSummary)
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-
-                if settings.proxySettings.mode == .custom {
-                    Text("aria2 uses an HTTP-style proxy for all protocols. SOCKS proxies are not supported by aria2.")
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                }
-            }
-        }
-        .formStyle(.grouped)
-    }
-
-    private var networkSummary: String {
-        switch settings.proxySettings.mode {
-        case .none:
-            "Downloads ignore configured proxies."
-        case .system:
-            "Downloads use the matching macOS system proxy when one is configured."
-        case .custom:
-            if let proxyURI = settings.proxySettings.customProxyURI {
-                "Downloads use \(proxyURI)."
-            } else {
-                "Enter a proxy host and port to enable the custom proxy."
-            }
-        }
-    }
-
-    private func proxyBinding<Value>(_ keyPath: WritableKeyPath<ProxySettings, Value>) -> Binding<Value> {
-        Binding {
-            settings.proxySettings[keyPath: keyPath]
-        } set: { newValue in
-            var proxySettings = settings.proxySettings
-            proxySettings[keyPath: keyPath] = newValue
-            settings.proxySettings = proxySettings
-        }
-    }
-}

Sources/Firelink/Settings/PowerSettingsPane.swift

@@ -1,17 +0,0 @@
-import SwiftUI
-
-struct PowerSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-
-    var body: some View {
-        Form {
-            Section {
-                Toggle("Prevent system sleep while downloads are active", isOn: $settings.preventsSleepWhileDownloading)
-                Text("The display may still turn off. Firelink only keeps macOS awake enough to finish active downloads.")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-            }
-        }
-        .formStyle(.grouped)
-    }
-}

Sources/Firelink/Settings/SettingsContainer.swift

@@ -1,76 +0,0 @@
-import AppKit
-import SwiftUI
-
-struct SettingsPaneContainer: View {
-    @AppStorage("lastSettingsTab") private var activeTab: SettingsSidebarFilter = .downloads
-
-    var body: some View {
-        VStack(spacing: 0) {
-            HStack(spacing: 4) {
-                ForEach(SettingsSidebarFilter.allCases, id: \.self) { filter in
-                    Button {
-                        activeTab = filter
-                    } label: {
-                        VStack(spacing: 4) {
-                            Image(systemName: filter.symbolName)
-                                .font(.system(size: 16))
-                            Text(filter.rawValue)
-                                .font(.system(size: 11, weight: .medium))
-                                .lineLimit(1)
-                                .minimumScaleFactor(0.8)
-                        }
-                        .frame(maxWidth: .infinity)
-                        .padding(.vertical, 8)
-                        .contentShape(Rectangle())
-                    }
-                    .buttonStyle(.plain)
-                    .background(activeTab == filter ? Color.accentColor : Color.clear)
-                    .foregroundStyle(activeTab == filter ? Color.white : Color.primary)
-                    .clipShape(RoundedRectangle(cornerRadius: 8))
-                }
-            }
-            .padding(.horizontal, 32)
-            .padding(.vertical, 16)
-
-            Divider()
-
-            ScrollView {
-                VStack(alignment: .leading, spacing: 0) {
-                    Text(activeTab.rawValue)
-                        .font(.largeTitle.weight(.semibold))
-                        .padding(.bottom, 24)
-
-                    selectedPane
-                        .frame(maxWidth: 720, alignment: .leading)
-                }
-                .padding(32)
-                .frame(maxWidth: .infinity, alignment: .leading)
-            }
-        }
-        .frame(maxWidth: .infinity, maxHeight: .infinity)
-    }
-
-    @ViewBuilder
-    private var selectedPane: some View {
-        switch activeTab {
-        case .downloads:
-            DownloadSettingsPane()
-        case .lookAndFeel:
-            LookAndFeelSettingsPane()
-        case .network:
-            NetworkSettingsPane()
-        case .locations:
-            LocationsSettingsPane()
-        case .siteLogins:
-            SiteLoginsSettingsPane()
-        case .power:
-            PowerSettingsPane()
-        case .engine:
-            EngineSettingsPane()
-        case .integration:
-            IntegrationSettingsPane()
-        case .about:
-            AboutSettingsPane()
-        }
-    }
-}

Sources/Firelink/Settings/SiteLoginsSettingsPane.swift

@@ -1,100 +0,0 @@
-import SwiftUI
-
-struct SiteLoginsSettingsPane: View {
-    @EnvironmentObject private var settings: AppSettings
-    @State private var urlPattern = ""
-    @State private var username = ""
-    @State private var password = ""
-    @State private var editingLoginID: UUID?
-
-    var body: some View {
-        Form {
-            Section {
-                KeychainAccessCard()
-            }
-            .listRowBackground(Color.clear)
-            .listRowInsets(EdgeInsets())
-
-            if settings.isKeychainAccessGranted {
-                Section(editingLoginID == nil ? "Add Login" : "Edit Login") {
-                TextField("URL Pattern (e.g., *.github.com)", text: $urlPattern)
-                TextField("Username", text: $username)
-                SecureField(editingLoginID == nil ? "Password" : "Password (leave blank to keep current)", text: $password)
-
-                HStack {
-                    Text(settings.message)
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                        .lineLimit(1)
-                    Spacer()
-                    if editingLoginID != nil {
-                        Button("Cancel Edit") {
-                            resetForm()
-                        }
-                    }
-                    Button {
-                        settings.saveSiteLogin(
-                            id: editingLoginID,
-                            urlPattern: urlPattern,
-                            username: username,
-                            password: password
-                        )
-                        if settings.message.hasPrefix("Added") || settings.message.hasPrefix("Updated") {
-                            resetForm()
-                        }
-                    } label: {
-                        Label(editingLoginID == nil ? "Add Login" : "Save Login", systemImage: editingLoginID == nil ? "plus" : "checkmark")
-                    }
-                    .buttonStyle(.borderedProminent)
-                }
-            }
-
-            Section("Saved Logins") {
-                if settings.siteLogins.isEmpty {
-                    Text("No saved logins.")
-                        .foregroundStyle(.secondary)
-                } else {
-                    List {
-                        ForEach(settings.siteLogins) { login in
-                            HStack {
-                                Image(systemName: "key.horizontal")
-                                    .foregroundStyle(.secondary)
-                                    .accessibilityHidden(true)
-                                Text(login.urlPattern)
-                                    .font(.system(.body, design: .monospaced))
-                                Spacer()
-                                Text(login.username)
-                                    .foregroundStyle(.secondary)
-                                Button {
-                                    edit(login)
-                                } label: {
-                                    Label("Edit", systemImage: "pencil")
-                                }
-                                .labelStyle(.iconOnly)
-                                .buttonStyle(.borderless)
-                            }
-                        }
-                        .onDelete(perform: settings.deleteSiteLogins)
-                    }
-                    .frame(minHeight: 180)
-                }
-                }
-            }
-        }
-        .formStyle(.grouped)
-    }
-
-    private func edit(_ login: SiteLogin) {
-        editingLoginID = login.id
-        urlPattern = login.urlPattern
-        username = login.username
-        password = ""
-    }
-
-    private func resetForm() {
-        editingLoginID = nil
-        urlPattern = ""
-        username = ""
-        password = ""
-    }
-}

Sources/Firelink/Settings/ToastNotification.swift

@@ -1,44 +0,0 @@
-import SwiftUI
-
-struct ToastNotification: ViewModifier {
-    var message: String
-    @Binding var isShowing: Bool
-
-    func body(content: Content) -> some View {
-        ZStack(alignment: .bottom) {
-            content
-            
-            if isShowing {
-                VStack {
-                    Spacer()
-                    Text(message)
-                        .font(.subheadline.weight(.medium))
-                        .foregroundColor(.white)
-                        .padding(.horizontal, 16)
-                        .padding(.vertical, 10)
-                        .background(
-                            Capsule()
-                                .fill(Color.black.opacity(0.8))
-                                .shadow(color: .black.opacity(0.2), radius: 8, x: 0, y: 4)
-                        )
-                        .transition(.move(edge: .bottom).combined(with: .opacity))
-                        .padding(.bottom, 24)
-                }
-                .zIndex(1)
-                .animation(.spring(response: 0.3, dampingFraction: 0.7), value: isShowing)
-                .task {
-                    try? await Task.sleep(nanoseconds: 2_000_000_000)
-                    withAnimation {
-                        isShowing = false
-                    }
-                }
-            }
-        }
-    }
-}
-
-extension View {
-    func toast(isShowing: Binding<Bool>, message: String) -> some View {
-        self.modifier(ToastNotification(message: message, isShowing: isShowing))
-    }
-}

Sources/Firelink/SidebarView.swift

@@ -1,243 +0,0 @@
-import SwiftUI
-import UniformTypeIdentifiers
-
-enum DownloadSidebarFilter: Hashable {
-    case all
-    case queued
-    case active
-    case completed
-    case unfinished
-    case category(DownloadCategory)
-
-    var title: String {
-        switch self {
-        case .all: "All Downloads"
-        case .queued: "Queue"
-        case .active: "Active"
-        case .completed: "Completed"
-        case .unfinished: "Unfinished"
-        case .category(let category): category.rawValue
-        }
-    }
-}
-
-enum SettingsSidebarFilter: String, CaseIterable, Hashable {
-    case downloads = "Downloads"
-    case lookAndFeel = "Look and feel"
-    case network = "Network"
-    case locations = "Locations"
-    case siteLogins = "Site Logins"
-    case power = "Power"
-    case engine = "Engine"
-    case integration = "Integrations"
-    case about = "About"
-
-    var symbolName: String {
-        switch self {
-        case .downloads: "arrow.down.circle"
-        case .lookAndFeel: "paintpalette"
-        case .network: "network"
-        case .locations: "folder"
-        case .siteLogins: "key.fill"
-        case .power: "moon.zzz"
-        case .engine: "terminal"
-        case .integration: "puzzlepiece.extension"
-        case .about: "info.circle"
-        }
-    }
-}
-
-enum SidebarSelection: Hashable {
-    case downloads(DownloadSidebarFilter)
-    case queue(UUID)
-    case scheduler
-    case speedLimiter
-    case settings
-}
-
-struct SidebarView: View {
-    @EnvironmentObject private var controller: DownloadController
-    @Binding var selection: SidebarSelection
-    @State private var queueBeingRenamed: DownloadQueue?
-    @State private var queueBeingRemoved: DownloadQueue?
-    @State private var queueName = ""
-
-    var body: some View {
-        List(selection: $selection) {
-            Section("Library") {
-                Label("All", systemImage: "tray.full")
-                    .badge(controller.downloads.count)
-                    .tag(SidebarSelection.downloads(.all))
-                Label("Active", systemImage: "bolt.fill")
-                    .badge(controller.activeCount)
-                    .tag(SidebarSelection.downloads(.active))
-                Label("Completed", systemImage: "checkmark.circle")
-                    .badge(controller.completedCount)
-                    .tag(SidebarSelection.downloads(.completed))
-                Label("Unfinished", systemImage: "circle.dashed")
-                    .badge(controller.unfinishedCount)
-                    .tag(SidebarSelection.downloads(.unfinished))
-            }
-
-            Section("Folders") {
-                ForEach(DownloadCategory.allCases, id: \.self) { category in
-                    folderRow(for: category)
-                }
-            }
-
-            Section("Queues") {
-                ForEach(controller.queues) { queue in
-                    queueRow(for: queue)
-                }
-
-                Button {
-                    let queue = controller.addQueue()
-                    selection = .queue(queue.id)
-                } label: {
-                    Label("Add new queue", systemImage: "plus")
-                }
-                .buttonStyle(.plain)
-            }
-
-            Section("Tools") {
-                Label("Scheduler", systemImage: "calendar.badge.clock")
-                    .tag(SidebarSelection.scheduler)
-                Label("Speed Limiter", systemImage: "speedometer")
-                    .tag(SidebarSelection.speedLimiter)
-            }
-
-        }
-        .listStyle(.sidebar)
-        .safeAreaInset(edge: .bottom) {
-            VStack(spacing: 0) {
-                Divider()
-                Button {
-                    selection = .settings
-                } label: {
-                    Label("Settings", systemImage: "gearshape")
-                        .padding(.horizontal, 10)
-                        .padding(.vertical, 8)
-                        .frame(maxWidth: .infinity, alignment: .leading)
-                        .contentShape(Rectangle())
-                }
-                .buttonStyle(.plain)
-                .background(selection == .settings ? Color.accentColor : Color.clear)
-                .foregroundStyle(selection == .settings ? Color.white : Color.primary)
-                .clipShape(RoundedRectangle(cornerRadius: 8))
-                .padding(.horizontal, 8)
-                .padding(.vertical, 8)
-            }
-            .background(.regularMaterial)
-        }
-        .alert("Rename Queue", isPresented: Binding(
-            get: { queueBeingRenamed != nil },
-            set: { isPresented in
-                if !isPresented {
-                    queueBeingRenamed = nil
-                }
-            }
-        )) {
-            TextField("Queue name", text: $queueName)
-            Button("Rename") {
-                if let queue = queueBeingRenamed {
-                    controller.renameQueue(id: queue.id, name: queueName)
-                }
-                queueBeingRenamed = nil
-            }
-            Button("Cancel", role: .cancel) {
-                queueBeingRenamed = nil
-            }
-        }
-        .confirmationDialog(
-            "Delete Queue",
-            isPresented: Binding(
-                get: { queueBeingRemoved != nil },
-                set: { isPresented in
-                    if !isPresented {
-                        queueBeingRemoved = nil
-                    }
-                }
-            ),
-            presenting: queueBeingRemoved
-        ) { queue in
-            Button("Delete Queue", role: .destructive) {
-                controller.removeQueue(id: queue.id)
-                if selection == .queue(queue.id) {
-                    selection = .downloads(.unfinished)
-                }
-                queueBeingRemoved = nil
-            }
-            Button("Cancel", role: .cancel) {
-                queueBeingRemoved = nil
-            }
-        } message: { queue in
-            Text("Downloads in \(queue.name) will stay in All and Unfinished, but no longer belong to a queue.")
-        }
-    }
-
-    private func folderRow(for category: DownloadCategory) -> some View {
-        Label(category.rawValue, systemImage: category.symbolName)
-            .badge(controller.downloads.filter { $0.category == category }.count)
-            .tag(SidebarSelection.downloads(.category(category)))
-    }
-
-    private func queueRow(for queue: DownloadQueue) -> some View {
-        Label(queue.name, systemImage: queue.isMain ? "list.bullet.rectangle" : "list.bullet")
-            .badge(controller.queueCount(for: queue.id))
-            .tag(SidebarSelection.queue(queue.id))
-            .onDrop(
-                of: [.text],
-                delegate: QueueSidebarDropDelegate(
-                    queueID: queue.id,
-                    selection: $selection,
-                    controller: controller
-                )
-            )
-            .contextMenu {
-                if !queue.isMain {
-                    Button("Rename") {
-                        queueBeingRenamed = queue
-                        queueName = queue.name
-                    }
-                    Button("Delete", role: .destructive) {
-                        queueBeingRemoved = queue
-                    }
-                }
-            }
-    }
-}
-
-private struct QueueSidebarDropDelegate: DropDelegate {
-    let queueID: UUID
-    @Binding var selection: SidebarSelection
-    let controller: DownloadController
-
-    func performDrop(info: DropInfo) -> Bool {
-        guard let provider = info.itemProviders(for: [.text]).first else {
-            return false
-        }
-
-        provider.loadItem(forTypeIdentifier: UTType.text.identifier, options: nil) { item, _ in
-            guard let itemIDs = Self.itemIDs(from: item), !itemIDs.isEmpty else { return }
-            Task { @MainActor in
-                controller.assignToQueue(itemIDs: itemIDs, queueID: queueID)
-                selection = .queue(queueID)
-            }
-        }
-        return true
-    }
-
-    nonisolated private static func itemIDs(from item: NSSecureCoding?) -> Set<UUID>? {
-        let text: String?
-        if let data = item as? Data {
-            text = String(data: data, encoding: .utf8)
-        } else {
-            text = item as? String
-        }
-
-        guard let text else { return nil }
-        return Set(text
-            .split(whereSeparator: { $0 == "\n" || $0 == "," || $0 == " " })
-            .compactMap { UUID(uuidString: String($0)) })
-    }
-}

Sources/Firelink/SpeedLimiterView.swift

@@ -1,132 +0,0 @@
-import SwiftUI
-
-struct SpeedLimiterView: View {
-    @EnvironmentObject private var settings: AppSettings
-    @State private var showSaveToast: Bool = false
-
-    // Local state to hold edits before saving
-    @State private var isEnabled: Bool = false
-    @State private var speedLimitKiBPerSecond: Int = 1024
-
-    var body: some View {
-        VStack(spacing: 0) {
-            headerView
-            Divider()
-
-            ScrollView {
-                VStack(alignment: .leading, spacing: 24) {
-                    limitSelectionSection
-                        .opacity(isEnabled ? 1.0 : 0.5)
-                        .disabled(!isEnabled)
-                }
-                .padding(24)
-            }
-            .frame(maxWidth: .infinity, alignment: .leading)
-        }
-        .onAppear {
-            loadState()
-        }
-        .overlay {
-            if showSaveToast {
-                toastView
-                    .transition(.move(edge: .bottom).combined(with: .opacity))
-            }
-        }
-    }
-
-    private var headerView: some View {
-        HStack {
-            Toggle(isOn: $isEnabled) {
-                Text("Speed Limiter")
-                    .font(.title2.weight(.bold))
-            }
-            .toggleStyle(.switch)
-
-            Spacer()
-
-            Button("Save Limit") {
-                saveState()
-                withAnimation(.spring()) {
-                    showSaveToast = true
-                }
-
-                DispatchQueue.main.asyncAfter(deadline: .now() + 2.5) {
-                    withAnimation {
-                        showSaveToast = false
-                    }
-                }
-            }
-            .buttonStyle(.borderedProminent)
-        }
-        .padding(24)
-    }
-
-    private var limitSelectionSection: some View {
-        VStack(alignment: .leading, spacing: 16) {
-            Text("Global Speed Limit")
-                .font(.headline)
-
-            Text("This limit applies globally to all active downloads. Individual downloads can also have their own specific limits defined in their properties.")
-                .font(.subheadline)
-                .foregroundStyle(.secondary)
-
-            HStack {
-                Stepper(value: $speedLimitKiBPerSecond, in: 1...10_485_760, step: 512) {
-                    Text("Maximum Speed:")
-                }
-
-                TextField("Speed", value: $speedLimitKiBPerSecond, format: .number)
-                    .textFieldStyle(.roundedBorder)
-                    .frame(width: 80)
-
-                Text("KiB/s")
-                    .foregroundStyle(.secondary)
-            }
-
-            // Helpful presets
-            HStack(spacing: 12) {
-                Button("1 MB/s") { speedLimitKiBPerSecond = 1024 }
-                Button("5 MB/s") { speedLimitKiBPerSecond = 5120 }
-                Button("10 MB/s") { speedLimitKiBPerSecond = 10240 }
-            }
-            .buttonStyle(.bordered)
-            .padding(.top, 8)
-        }
-    }
-
-    private var toastView: some View {
-        VStack {
-            Spacer()
-            HStack(spacing: 10) {
-                Image(systemName: "checkmark.circle.fill")
-                    .foregroundColor(.green)
-                Text("Speed Limit Saved")
-                    .fontWeight(.medium)
-            }
-            .padding(.horizontal, 16)
-            .padding(.vertical, 10)
-            .background(.regularMaterial)
-            .clipShape(Capsule())
-            .shadow(radius: 4, y: 2)
-            .padding(.bottom, 30)
-        }
-        .allowsHitTesting(false)
-    }
-
-    @AppStorage("lastCustomSpeedLimit") private var lastCustomSpeedLimit: Int = 1024
-
-    private func loadState() {
-        let currentLimit = settings.globalSpeedLimitKiBPerSecond
-        isEnabled = currentLimit > 0
-        speedLimitKiBPerSecond = currentLimit > 0 ? currentLimit : lastCustomSpeedLimit
-    }
-
-    private func saveState() {
-        // Clamp to ensure it doesn't break aria2
-        let clampedSpeed = max(min(speedLimitKiBPerSecond, 10_485_760), 1)
-        speedLimitKiBPerSecond = clampedSpeed
-
-        lastCustomSpeedLimit = clampedSpeed
-        settings.globalSpeedLimitKiBPerSecond = isEnabled ? clampedSpeed : 0
-    }
-}

Sources/Firelink/StatusBar.swift

@@ -1,21 +0,0 @@
-import SwiftUI
-
-struct StatusBar: View {
-    @EnvironmentObject private var controller: DownloadController
-
-    var body: some View {
-        HStack {
-            Text(controller.engineMessage.isEmpty ? "Ready" : controller.engineMessage)
-                .foregroundStyle(controller.hasAria2 ? Color.secondary : Color.orange)
-                .lineLimit(1)
-            Spacer()
-            Text("\(controller.activeCount) active")
-            Text("\(controller.queuedCount) queued")
-            Text("\(controller.completedCount) done")
-        }
-        .font(.caption)
-        .padding(.horizontal, 14)
-        .padding(.vertical, 8)
-        .background(.bar)
-    }
-}

Sources/Firelink/Theme.swift

@@ -1,181 +0,0 @@
-import SwiftUI
-import AppKit
-
-enum AppFontSize: String, Codable, CaseIterable, Identifiable, Sendable {
-    case small = "Small"
-    case standard = "Standard"
-    case large = "Large"
-
-    var id: String { rawValue }
-
-    var dynamicTypeSize: DynamicTypeSize {
-        switch self {
-        case .small: return .xSmall
-        case .standard: return .medium
-        case .large: return .xxLarge
-        }
-    }
-
-    var defaultFont: Font {
-        switch self {
-        case .small:
-            return .system(size: 12)
-        case .standard:
-            return .system(size: 13)
-        case .large:
-            return .system(size: 15)
-        }
-    }
-
-    var controlSize: ControlSize {
-        switch self {
-        case .small:
-            return .small
-        case .standard:
-            return .regular
-        case .large:
-            return .large
-        }
-    }
-}
-
-enum ListRowDensity: String, Codable, CaseIterable, Identifiable, Sendable {
-    case compact = "Compact"
-    case standard = "Standard"
-    case relaxed = "Relaxed"
-
-    var id: String { rawValue }
-
-    var verticalPadding: CGFloat {
-        switch self {
-        case .compact: return 4
-        case .standard: return 8
-        case .relaxed: return 14
-        }
-    }
-
-    var minRowHeight: CGFloat {
-        switch self {
-        case .compact: return 24
-        case .standard: return 32
-        case .relaxed: return 44
-        }
-    }
-}
-
-enum AppTheme: String, Codable, CaseIterable, Identifiable, Sendable {
-    case system = "System Default"
-    case light = "Light"
-    case dark = "Dark"
-    case dracula = "Dracula"
-    case nord = "Nord"
-
-    var id: String { rawValue }
-
-    var theme: Theme {
-        switch self {
-        case .system, .dark:
-            return Theme.system
-        case .light:
-            return Theme.modernLight
-        case .dracula:
-            return Theme.dracula
-        case .nord:
-            return Theme.nord
-        }
-    }
-
-    var appearance: NSAppearance? {
-        switch self {
-        case .system: return nil
-        case .light: return NSAppearance(named: .aqua)
-        case .dark, .dracula, .nord: return NSAppearance(named: .darkAqua)
-        }
-    }
-}
-
-struct Theme: Equatable, Sendable {
-    var background: Color?
-    var secondaryBackground: Color?
-    var text: Color?
-    var secondaryText: Color?
-    var accent: Color?
-
-    static let system = Theme(
-        background: nil,
-        secondaryBackground: nil,
-        text: nil,
-        secondaryText: nil,
-        accent: nil
-    )
-
-    static let modernLight = Theme(
-        background: Color(nsColor: NSColor(calibratedRed: 0.98, green: 0.98, blue: 0.99, alpha: 1.0)),
-        secondaryBackground: Color(nsColor: NSColor(calibratedRed: 0.94, green: 0.94, blue: 0.96, alpha: 1.0)),
-        text: Color.primary,
-        secondaryText: Color.secondary,
-        accent: Color.accentColor
-    )
-
-    static let dracula = Theme(
-        background: Color(nsColor: NSColor(calibratedRed: 0.16, green: 0.16, blue: 0.21, alpha: 1.0)),
-        secondaryBackground: Color(nsColor: NSColor(calibratedRed: 0.27, green: 0.28, blue: 0.35, alpha: 1.0)),
-        text: Color(nsColor: NSColor(calibratedRed: 0.97, green: 0.97, blue: 0.95, alpha: 1.0)),
-        secondaryText: Color(nsColor: NSColor(calibratedRed: 0.38, green: 0.44, blue: 0.58, alpha: 1.0)),
-        accent: Color(nsColor: NSColor(calibratedRed: 1.00, green: 0.47, blue: 0.65, alpha: 1.0)) // Pink
-    )
-
-    static let nord = Theme(
-        background: Color(nsColor: NSColor(calibratedRed: 0.18, green: 0.20, blue: 0.25, alpha: 1.0)), // nord0
-        secondaryBackground: Color(nsColor: NSColor(calibratedRed: 0.23, green: 0.26, blue: 0.32, alpha: 1.0)), // nord1
-        text: Color(nsColor: NSColor(calibratedRed: 0.85, green: 0.87, blue: 0.91, alpha: 1.0)), // nord4
-        secondaryText: Color(nsColor: NSColor(calibratedRed: 0.57, green: 0.63, blue: 0.70, alpha: 1.0)), // nord3
-        accent: Color(nsColor: NSColor(calibratedRed: 0.53, green: 0.75, blue: 0.82, alpha: 1.0)) // nord8
-    )
-}
-
-struct AppThemeModifier: ViewModifier {
-    let theme: AppTheme
-
-    func body(content: Content) -> some View {
-        content
-            .tint(theme.theme.accent)
-            .onAppear {
-                NSApp.appearance = theme.appearance
-            }
-            .onChange(of: theme) { _, newTheme in
-                NSApp.appearance = newTheme.appearance
-            }
-    }
-}
-
-struct AppFontSizeModifier: ViewModifier {
-    let fontSize: AppFontSize
-
-    func body(content: Content) -> some View {
-        content
-            .font(fontSize.defaultFont)
-            .controlSize(fontSize.controlSize)
-            .dynamicTypeSize(fontSize.dynamicTypeSize)
-    }
-}
-
-struct ThemeBackgroundModifier: ViewModifier {
-    let color: Color?
-
-    func body(content: Content) -> some View {
-        if let color {
-            content
-                .scrollContentBackground(.hidden)
-                .background(color)
-        } else {
-            content
-        }
-    }
-}
-
-extension View {
-    func themeBackground(_ color: Color?) -> some View {
-        modifier(ThemeBackgroundModifier(color: color))
-    }
-}

Sources/Firelink/TrayMenuView.swift

@@ -1,41 +0,0 @@
-import SwiftUI
-
-struct TrayMenuView: View {
-    @Environment(\.openWindow) private var openWindow
-    @EnvironmentObject private var controller: DownloadController
-
-    var body: some View {
-        Button("Show main window") {
-            openWindow(id: "main")
-            NSApp.activate(ignoringOtherApps: true)
-        }
-
-        Button("Add downloads") {
-            openWindow(id: "add-downloads")
-            NSApp.activate(ignoringOtherApps: true)
-        }
-
-        Menu("Start queue") {
-            ForEach(controller.queues) { queue in
-                Button(queue.name) {
-                    controller.startQueue(queueID: queue.id)
-                }
-            }
-        }
-
-        Button("Stop downloads") {
-            for download in controller.downloads where download.status == .downloading {
-                controller.pause(download)
-            }
-        }
-
-        Divider()
-
-        Button("Exit") {
-            NSApplication.shared.terminate(nil)
-        }
-        .onReceive(NotificationCenter.default.publisher(for: NSNotification.Name("OpenAddDownloadsWindow"))) { _ in
-            openWindow(id: "add-downloads")
-        }
-    }
-}

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,42 @@
+# Third-Party Notices
+
+Firelink distributes separate executable tools. Firelink's MIT license does not replace their licenses.
+
+Exact versions, target hashes, sources, and build descriptions are pinned in `engines.lock.json`.
+
+## aria2
+
+- Project: <https://aria2.github.io/>
+- Source: <https://github.com/aria2/aria2>
+- License: GNU General Public License version 2 or later
+
+Corresponding source for the distributed version is available from the source link and release tag listed in `engines.lock.json`. Firelink release notes must retain that source reference.
+
+Linux x64 uses a checksum-pinned musl static build produced from upstream aria2 by <https://github.com/abcfy2/aria2-static-build>. Builder source and upstream tag are recorded in `engine-sources.lock.json`.
+
+## FFmpeg
+
+- Project and source: <https://ffmpeg.org/>
+- License information: <https://ffmpeg.org/legal.html>
+
+Current macOS binary reports `--enable-gpl --enable-version3`; distribution therefore follows GNU GPL version 3 requirements. Exact build identity is recorded in `engines.lock.json`.
+
+Windows and Linux archives come from checksum-pinned BtbN FFmpeg GPL builds. Build project: <https://github.com/BtbN/FFmpeg-Builds>.
+
+## yt-dlp
+
+- Project and source: <https://github.com/yt-dlp/yt-dlp>
+- License: The Unlicense
+
+Firelink uses a self-contained PyInstaller onedir distribution. Embedded Python packages keep their own license files inside `_internal` where supplied.
+
+## Deno
+
+- Project and source: <https://github.com/denoland/deno>
+- License: MIT
+
+## OpenSSL and bundled native libraries
+
+Engine payloads may contain OpenSSL, SQLite, c-ares, libssh2, gettext/libintl, zstd, and other runtime libraries. Their copyright and license notices remain part of their source distributions and embedded package metadata.
+
+Release engineering must review each newly added target payload before adding its hashes to `engines.lock.json`. Missing provenance or license data blocks release.

engine-sources.lock.json

@@ -0,0 +1,51 @@
+{
+  "schemaVersion": 1,
+  "targets": {
+    "x86_64-pc-windows-msvc": {
+      "yt-dlp": {
+        "version": "2026.06.09",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.06.09/yt-dlp_win.zip",
+        "sha256": "9bb27530494092870b5330deacfc65a40d3e980c7e2c67e5f09b902c37a6903d"
+      },
+      "deno": {
+        "version": "2.9.1",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.1/deno-x86_64-pc-windows-msvc.zip",
+        "sha256": "ab310b4232cca207d40ffa41867e93aaf9f893802bc76756e74f486a6b21b371"
+      },
+      "ffmpeg": {
+        "version": "8.1.2",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-06-23-13-52/ffmpeg-n8.1.2-win64-gpl-8.1.zip",
+        "sha256": "ddbe0deec00b9cfd3ee74298a46a22ac4061913ed47d92297cd168cc5a5cc625"
+      },
+      "aria2c": {
+        "version": "1.37.0",
+        "url": "https://github.com/aria2/aria2/releases/download/release-1.37.0/aria2-1.37.0-win-64bit-build1.zip",
+        "sha256": "67d015301eef0b612191212d564c5bb0a14b5b9c4796b76454276a4d28d9b288"
+      }
+    },
+    "x86_64-unknown-linux-gnu": {
+      "yt-dlp": {
+        "version": "2026.06.09",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.06.09/yt-dlp_linux.zip",
+        "sha256": "217bbc9c3ed19ea75a7f151a3e48dbfeac7f459a7dce2deeeecc2d6e2871bd5b"
+      },
+      "deno": {
+        "version": "2.9.1",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.1/deno-x86_64-unknown-linux-gnu.zip",
+        "sha256": "710c54d63477d1100844ef4818f19507ce0dbf40510903b1d883f19e394446a2"
+      },
+      "ffmpeg": {
+        "version": "8.1.2",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-06-23-13-52/ffmpeg-n8.1.2-linux64-gpl-8.1.tar.xz",
+        "sha256": "0c6772b77fdbf127cc1498eca39a40e20b88817f36b66d553cebcfcca32b6d78"
+      },
+      "aria2c": {
+        "version": "1.37.0",
+        "url": "https://github.com/abcfy2/aria2-static-build/releases/download/1.37.0/aria2-x86_64-linux-musl_static.zip",
+        "sha256": "e0a09b12ef67f35f8a8e4fdddbec851d235b7c31da549d0578bff459032b499a",
+        "upstreamSource": "https://github.com/aria2/aria2/tree/release-1.37.0",
+        "builderSource": "https://github.com/abcfy2/aria2-static-build/tree/1.37.0"
+      }
+    }
+  }
+}

engines.lock.json

@@ -0,0 +1,43 @@
+{
+  "schemaVersion": 1,
+  "targets": {
+    "aarch64-apple-darwin": {
+      "engines": {
+        "yt-dlp": {
+          "version": "2026.06.09",
+          "source": "https://github.com/yt-dlp/yt-dlp",
+          "build": "PyInstaller onedir distribution with embedded Python and yt_dlp_ejs",
+          "sha256": "4eefb498e76f8a425bec30ba3ee2079b01542ca39ca1fb61b79966450794cc13"
+        },
+        "aria2c": {
+          "version": "1.37.0",
+          "source": "https://github.com/aria2/aria2",
+          "build": "arm64 executable with adjacent aria2-libs",
+          "sha256": "111b2f5ed760f1e1a2ec06117c4e8094fcde336ba16122dda1c5e7209bf1862d"
+        },
+        "ffmpeg": {
+          "version": "N-125385-ge2e889d9da",
+          "source": "https://ffmpeg.org/",
+          "build": "GPLv3 build identified by binary as https://www.martin-riedl.de",
+          "sha256": "3027bd75166a596c31a271ce9ae14b5441492b9557011993c0bf873b5a7c6a09"
+        },
+        "deno": {
+          "version": "2.9.1",
+          "source": "https://github.com/denoland/deno",
+          "build": "official aarch64-apple-darwin executable",
+          "sha256": "df5e2cca5253ec99b9a630fb059bf01cdbbf586fed1f344017875c5462b2c483"
+        }
+      },
+      "runtimeTrees": {
+        "_internal": {
+          "files": 142,
+          "sha256": "3fabc08e6367f9393cfee32c32138f057f0e6068e430190c26a22ddfea84242b"
+        },
+        "aria2-libs": {
+          "files": 7,
+          "sha256": "f6735fa4162513ca79adcc6bb65afdccdcd34c7c05e5d45c78da6d2e0c359e57"
+        }
+      }
+    }
+  }
+}

index.html

@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/png" href="/src/assets/app-icon.png" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Firelink Download Manager</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Outfit:wght@300;400;500;600;700&display=swap" rel="stylesheet">
+  </head>
+
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package.json

@@ -0,0 +1,66 @@
+{
+  "name": "firelink",
+  "private": true,
+  "version": "1.0.0",
+  "description": "A fast cross-platform desktop download manager powered by Rust, Tauri, React, aria2, and yt-dlp.",
+  "license": "MIT",
+  "homepage": "https://github.com/nimbold/Firelink",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nimbold/Firelink.git"
+  },
+  "bugs": {
+    "url": "https://github.com/nimbold/Firelink/issues"
+  },
+  "keywords": [
+    "download-manager",
+    "tauri",
+    "rust",
+    "react",
+    "typescript",
+    "aria2",
+    "yt-dlp",
+    "ffmpeg",
+    "desktop"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "bindings": "cd src-tauri && cargo test export_bindings --lib",
+    "build": "tsc && vite build",
+    "check:updates": "node scripts/check-updates.js",
+    "preview": "vite preview",
+    "tauri": "tauri",
+    "test": "vitest"
+  },
+  "dependencies": {
+    "@formkit/auto-animate": "^0.9.0",
+    "@tailwindcss/vite": "^4.3.1",
+    "@tauri-apps/api": "^2.11.1",
+    "@tauri-apps/plugin-clipboard-manager": "^2.3.2",
+    "@tauri-apps/plugin-dialog": "^2.7.1",
+    "@tauri-apps/plugin-fs": "^2.5.1",
+    "@tauri-apps/plugin-log": "^2.8.0",
+    "@tauri-apps/plugin-notification": "^2.3.3",
+    "@tauri-apps/plugin-opener": "^2",
+    "lucide-react": "^1.23.0",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "zustand": "^5.0.14"
+  },
+  "devDependencies": {
+    "@tauri-apps/cli": "^2.11.4",
+    "@types/react": "^19.1.8",
+    "@types/react-dom": "^19.1.6",
+    "@vitejs/plugin-react": "^6.0.3",
+    "autoprefixer": "^10.5.2",
+    "postcss": "^8.5.15",
+    "tailwindcss": "^4.3.1",
+    "typescript": "^6.0.3",
+    "vite": "^8.1.3",
+    "vitest": "^4.1.9"
+  }
+}

process_icon.py

@@ -1,84 +0,0 @@
-import sys
-from PIL import Image, ImageDraw
-
-def process_images(src_path):
-    img = Image.open(src_path).convert("RGBA")
-
-    # Crop the 28px black padding
-    img = img.crop((28, 28, 1226, 1226))
-    width, height = img.size
-    pixels = img.load()
-
-    # Lighter color (+1) at top, original color (0) at bottom
-    bg_color = pixels[100, 100]
-    # Use a 1.9x multiplier for a subtle, modern "lit from above" macOS effect
-    top_color = (min(255, int(bg_color[0] * 1.9)), min(255, int(bg_color[1] * 1.9)), min(255, int(bg_color[2] * 1.9)), 255)
-    bottom_color = (bg_color[0], bg_color[1], bg_color[2], 255)
-
-    new_img = Image.new("RGBA", (width, height))
-    new_pixels = new_img.load()
-
-    for y in range(height):
-        ratio = y / float(height - 1)
-        grad_r = int(top_color[0] * (1 - ratio) + bottom_color[0] * ratio)
-        grad_g = int(top_color[1] * (1 - ratio) + bottom_color[1] * ratio)
-        grad_b = int(top_color[2] * (1 - ratio) + bottom_color[2] * ratio)
-        grad_color = (grad_r, grad_g, grad_b, 255)
-
-        for x in range(width):
-            p = pixels[x, y]
-            dist = max(abs(p[0]-bg_color[0]), abs(p[1]-bg_color[1]), abs(p[2]-bg_color[2]))
-
-            # Replace pure black corners or background with gradient
-            if p[0] < 15 and p[1] < 15 and p[2] < 15:
-                new_pixels[x, y] = grad_color
-            elif dist < 15:
-                new_pixels[x, y] = grad_color
-            elif dist < 60:
-                alpha = (dist - 15) / 45.0
-                r = int(p[0] * alpha + grad_color[0] * (1 - alpha))
-                g = int(p[1] * alpha + grad_color[1] * (1 - alpha))
-                b = int(p[2] * alpha + grad_color[2] * (1 - alpha))
-                new_pixels[x, y] = (r, g, b, 255)
-            else:
-                new_pixels[x, y] = p
-
-    img = new_img
-    radius = int(width * 0.225)
-    mask = Image.new("L", (width, height), 0)
-    draw = ImageDraw.Draw(mask)
-    draw.rounded_rectangle((0, 0, width, height), radius=radius, fill=255)
-    img.putalpha(mask)
-
-    # Save standard png
-    img_1024 = img.resize((1024, 1024), Image.Resampling.LANCZOS)
-    img_1024.save("Resources/AppIcon.png")
-
-    # Save Firefox extension icons
-    img_48 = img.resize((48, 48), Image.Resampling.LANCZOS)
-    img_48.save("Extensions/Firefox/icons/icon-48.png")
-    img_128 = img.resize((128, 128), Image.Resampling.LANCZOS)
-    img_128.save("Extensions/Firefox/icons/icon-128.png")
-
-    # MenuBarIconTemplate (64x64 monochrome)
-    data = img.getdata()
-    new_data = []
-
-    for item in data:
-        r, g, b, a = item
-        if r > 100 and r > b * 1.5 and a > 0:
-            alpha = min(255, max(0, int((r - 40) * 1.2)))
-            new_data.append((0, 0, 0, alpha))
-        else:
-            new_data.append((0, 0, 0, 0))
-
-    menu_bar_full = Image.new("RGBA", img.size)
-    menu_bar_full.putdata(new_data)
-
-    menu_bar_64 = menu_bar_full.resize((64, 64), Image.Resampling.LANCZOS)
-    menu_bar_64.save("Sources/Firelink/Assets.xcassets/MenuBarIcon.imageset/MenuBarIconTemplate.png")
-
-    print("Done generating main PNGs")
-
-if __name__ == '__main__':
-    process_images(sys.argv[1])

scripts/before-tauri-build.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+
+function run(command, args, options = {}) {
+  const executable = process.platform === 'win32' && command === 'npm' ? 'npm.cmd' : command;
+  const result = spawnSync(executable, args, {
+    cwd: repoRoot,
+    stdio: 'inherit',
+    ...options,
+  });
+
+  if (result.error) {
+    console.error(`Failed to run ${executable}: ${result.error.message}`);
+    process.exit(1);
+  }
+
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+function runNpmScript(script) {
+  if (process.env.npm_execpath) {
+    run(process.execPath, [process.env.npm_execpath, 'run', script]);
+    return;
+  }
+
+  if (process.platform === 'win32') {
+    run('cmd.exe', ['/d', '/s', '/c', 'npm', 'run', script], {
+      windowsHide: true,
+    });
+    return;
+  }
+
+  run('npm', ['run', script]);
+}
+
+run(process.execPath, ['scripts/stage-engines.js']);
+run(process.execPath, ['scripts/verify-binaries.js', '--staged']);
+
+if (process.env.FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE === '1') {
+  const engineDist = path.join(repoRoot, 'src-tauri', 'engine-dist');
+  fs.rmSync(engineDist, { recursive: true, force: true });
+  fs.mkdirSync(engineDist, { recursive: true });
+  console.log('Omitted engine-dist from the initial Tauri bundle; release packaging will repack verified engines.');
+}
+
+runNpmScript('build');

scripts/check-updates.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+const userAgent = 'firelink-update-check';
+
+function parseJsonFile(file) {
+  return JSON.parse(fs.readFileSync(path.join(repoRoot, file), 'utf8'));
+}
+
+function normalizeVersion(value) {
+  return String(value || '')
+    .replace(/^v/, '')
+    .replace(/^release-/, '');
+}
+
+function compareVersions(left, right) {
+  const a = normalizeVersion(left).split(/[.-]/).map(part => (/^\d+$/.test(part) ? Number(part) : part));
+  const b = normalizeVersion(right).split(/[.-]/).map(part => (/^\d+$/.test(part) ? Number(part) : part));
+  const length = Math.max(a.length, b.length);
+  for (let index = 0; index < length; index += 1) {
+    const av = a[index] ?? 0;
+    const bv = b[index] ?? 0;
+    if (av === bv) continue;
+    if (typeof av === 'number' && typeof bv === 'number') return av > bv ? 1 : -1;
+    return String(av).localeCompare(String(bv));
+  }
+  return 0;
+}
+
+function npmOutdated(cwd) {
+  try {
+    execFileSync('npm', ['outdated', '--json'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    return {};
+  } catch (error) {
+    const output = error.stdout?.toString() || '{}';
+    return JSON.parse(output || '{}');
+  }
+}
+
+async function fetchJson(url) {
+  const response = await fetch(url, { headers: { 'User-Agent': userAgent } });
+  if (!response.ok) throw new Error(`${response.status} ${response.statusText}: ${url}`);
+  return response.json();
+}
+
+async function fetchText(url) {
+  const response = await fetch(url, { headers: { 'User-Agent': userAgent } });
+  if (!response.ok) throw new Error(`${response.status} ${response.statusText}: ${url}`);
+  return response.text();
+}
+
+async function githubLatest(repo) {
+  return fetchJson(`https://api.github.com/repos/${repo}/releases/latest`);
+}
+
+async function latestFfmpegStable() {
+  const html = await fetchText('https://ffmpeg.org/releases/');
+  const versions = [...html.matchAll(/ffmpeg-(\d+\.\d+(?:\.\d+)?)\.tar\.xz/g)].map(match => match[1]);
+  return [...new Set(versions)].sort(compareVersions).at(-1);
+}
+
+async function latestMartinRiedlMacArm64Release() {
+  const html = await fetchText('https://ffmpeg.martin-riedl.de/');
+  const releaseSection = html.split('Download Release Build')[1] || '';
+  const match =
+    releaseSection.match(/macOS \(Apple Silicon\/arm64\)[\s\S]*?<b>Release:\s*<\/b>\s*([0-9.]+)/) ||
+    releaseSection.match(/macOS \(Apple Silicon\/arm64\)[\s\S]*?Release:\s*([0-9.]+)/);
+  return match?.[1];
+}
+
+function printNpmReport(label, outdated) {
+  const entries = Object.entries(outdated);
+  if (!entries.length) {
+    console.log(`${label}: current`);
+    return 0;
+  }
+  console.log(`${label}: ${entries.length} outdated package(s)`);
+  for (const [name, info] of entries) {
+    console.log(`  ${name}: ${info.current} -> ${info.latest} (wanted ${info.wanted})`);
+  }
+  return entries.length;
+}
+
+function sourceEngineVersions(sourceLock) {
+  const rows = [];
+  for (const [target, engines] of Object.entries(sourceLock.targets || {})) {
+    for (const [engine, meta] of Object.entries(engines)) {
+      rows.push({ target, engine, version: meta.version, url: meta.url });
+    }
+  }
+  return rows;
+}
+
+function packagedEngineVersions(engineLock) {
+  const rows = [];
+  for (const [target, targetLock] of Object.entries(engineLock.targets || {})) {
+    for (const [engine, meta] of Object.entries(targetLock.engines || {})) {
+      rows.push({ target, engine, version: meta.version });
+    }
+  }
+  return rows;
+}
+
+function checkRows(rows, latestByEngine, latestByTargetEngine = {}) {
+  let outdated = 0;
+  for (const row of rows) {
+    const latest = latestByTargetEngine[`${row.target}:${row.engine}`] || latestByEngine[row.engine];
+    if (!latest) continue;
+    const current = normalizeVersion(row.version);
+    const wanted = normalizeVersion(latest);
+    const status = compareVersions(current, wanted) < 0 ? 'outdated' : 'current';
+    if (status === 'outdated') outdated += 1;
+    console.log(`  ${row.target} ${row.engine}: ${current} -> ${wanted} ${status}`);
+  }
+  return outdated;
+}
+
+async function main() {
+  let outdatedCount = 0;
+
+  outdatedCount += printNpmReport('root npm', npmOutdated(repoRoot));
+  outdatedCount += printNpmReport(
+    'Firefox extension npm',
+    npmOutdated(path.join(repoRoot, 'Extensions', 'Firefox'))
+  );
+
+  const [ytDlp, deno, aria2, ffmpeg, martinRiedlMacArm64Ffmpeg] = await Promise.all([
+    githubLatest('yt-dlp/yt-dlp'),
+    githubLatest('denoland/deno'),
+    githubLatest('aria2/aria2'),
+    latestFfmpegStable(),
+    latestMartinRiedlMacArm64Release(),
+  ]);
+  const latestByEngine = {
+    'yt-dlp': ytDlp.tag_name,
+    deno: deno.tag_name,
+    aria2c: aria2.tag_name,
+    ffmpeg,
+  };
+  const latestByTargetEngine = {
+    'aarch64-apple-darwin:ffmpeg': martinRiedlMacArm64Ffmpeg,
+  };
+
+  console.log('\nlatest engines:');
+  for (const [engine, version] of Object.entries(latestByEngine)) {
+    console.log(`  ${engine}: ${normalizeVersion(version)}`);
+  }
+
+  console.log('\nengine source lock:');
+  outdatedCount += checkRows(
+    sourceEngineVersions(parseJsonFile('engine-sources.lock.json')),
+    latestByEngine,
+    latestByTargetEngine
+  );
+
+  console.log('\npackaged engine lock:');
+  outdatedCount += checkRows(
+    packagedEngineVersions(parseJsonFile('engines.lock.json')),
+    latestByEngine,
+    latestByTargetEngine
+  );
+
+  if (outdatedCount > 0) {
+    console.error(`\n${outdatedCount} outdated item(s) found.`);
+    process.exit(1);
+  }
+  console.log('\nAll checked packages and engines are current.');
+}
+
+main().catch(error => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});

scripts/engine-payload-integrity.js

@@ -0,0 +1,45 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function sha256(file) {
+  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+
+export function collectRegularFiles(root, options = {}) {
+  const ignoredNames = new Set(options.ignoredNames || []);
+  const files = [];
+
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      const relative = path.relative(root, file).split(path.sep).join('/');
+      if (ignoredNames.has(entry.name)) {
+        continue;
+      }
+      if (entry.isSymbolicLink()) {
+        throw new Error(`Unsupported symlink in engine payload: ${relative}`);
+      }
+      if (entry.isDirectory()) {
+        walk(file);
+      } else if (entry.isFile()) {
+        files.push(file);
+      } else {
+        throw new Error(`Unsupported filesystem entry in engine payload: ${relative}`);
+      }
+    }
+  };
+
+  walk(root);
+  return files.sort((left, right) => left.localeCompare(right));
+}
+
+export function treeDigest(root) {
+  const files = collectRegularFiles(root);
+  const digest = crypto.createHash('sha256');
+  for (const file of files) {
+    const relative = path.relative(root, file).split(path.sep).join('/');
+    digest.update(`${relative}\0${sha256(file)}\n`);
+  }
+  return { files: files.length, sha256: digest.digest('hex') };
+}

scripts/engine-payload-integrity.node-test.js

@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { collectRegularFiles, treeDigest } from './engine-payload-integrity.js';
+
+test('collectRegularFiles returns regular files and honors ignored names', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-engine-payload-'));
+  try {
+    fs.mkdirSync(path.join(root, 'nested'));
+    fs.writeFileSync(path.join(root, 'engine'), 'binary');
+    fs.writeFileSync(path.join(root, 'nested', 'runtime.dat'), 'runtime');
+    fs.writeFileSync(path.join(root, 'payload-manifest.json'), '{}');
+
+    const files = collectRegularFiles(root, {
+      ignoredNames: ['payload-manifest.json'],
+    }).map(file => path.relative(root, file).split(path.sep).join('/'));
+
+    assert.deepEqual(files, ['engine', 'nested/runtime.dat']);
+    const digest = treeDigest(path.join(root, 'nested'));
+    assert.equal(digest.files, 1);
+    assert.match(digest.sha256, /^[a-f0-9]{64}$/);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('collectRegularFiles rejects symlinks in engine payloads', { skip: process.platform === 'win32' }, () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-engine-payload-'));
+  try {
+    fs.writeFileSync(path.join(root, 'target'), 'target');
+    fs.symlinkSync('target', path.join(root, 'link'));
+
+    assert.throws(
+      () => collectRegularFiles(root),
+      /Unsupported symlink in engine payload: link/
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

scripts/provision-engines.js

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { collectRegularFiles, sha256 } from './engine-payload-integrity.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+const sourceLock = JSON.parse(
+  fs.readFileSync(path.join(repoRoot, 'engine-sources.lock.json'), 'utf8')
+);
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+const target = argValue('--target')
+  || process.env.FIRELINK_TARGET_TRIPLE
+  || process.env.TAURI_ENV_TARGET_TRIPLE;
+if (!target) {
+  console.error('Pass --target <Rust target triple>.');
+  process.exit(1);
+}
+
+const targetSources = sourceLock.targets?.[target];
+if (!targetSources) {
+  console.error(`No source lock exists for ${target}.`);
+  process.exit(1);
+}
+
+const destination = path.join(repoRoot, 'src-tauri', 'provisioned-engines', target);
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), `firelink-engines-${target}-`));
+const isWindows = target.includes('windows');
+const executableSuffix = isWindows ? '.exe' : '';
+
+async function download(name, source) {
+  const sourcePath = new URL(source.url).pathname;
+  const archive = path.join(
+    temporary,
+    `${name}${sourcePath.endsWith('.tar.xz') ? '.tar.xz' : '.zip'}`
+  );
+  const response = await fetch(source.url, { redirect: 'follow' });
+  if (!response.ok || !response.body) {
+    throw new Error(`Failed to download ${name}: HTTP ${response.status}`);
+  }
+  const output = fs.createWriteStream(archive);
+  const reader = response.body.getReader();
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!output.write(Buffer.from(value))) {
+      await new Promise(resolve => output.once('drain', resolve));
+    }
+  }
+  await new Promise(resolve => output.end(resolve));
+
+  const actual = sha256(archive);
+  if (actual !== source.sha256) {
+    throw new Error(`Archive checksum mismatch for ${name}. Expected ${source.sha256}, got ${actual}`);
+  }
+  const extracted = path.join(temporary, `${name}-extracted`);
+  fs.mkdirSync(extracted);
+  if (archive.endsWith('.zip') && process.platform !== 'win32') {
+    execFileSync('unzip', ['-q', archive, '-d', extracted], { stdio: 'inherit' });
+  } else {
+    execFileSync('tar', ['-xf', archive, '-C', extracted], { stdio: 'inherit' });
+  }
+  return extracted;
+}
+
+function findFile(root, names) {
+  const wanted = new Set(names.map(name => name.toLowerCase()));
+  const matches = [];
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      if (entry.isDirectory()) walk(file);
+      else if (entry.isFile() && wanted.has(entry.name.toLowerCase())) matches.push(file);
+    }
+  };
+  walk(root);
+  if (matches.length !== 1) {
+    throw new Error(`Expected one of [${names.join(', ')}] under ${root}, found ${matches.length}`);
+  }
+  return matches[0];
+}
+
+function copyExecutable(source, engine) {
+  const output = path.join(destination, `${engine}-${target}${executableSuffix}`);
+  fs.copyFileSync(source, output);
+  if (!isWindows) fs.chmodSync(output, 0o755);
+}
+
+function writePayloadManifest() {
+  const files = collectRegularFiles(destination, {
+    ignoredNames: ['payload-manifest.json'],
+  });
+  const manifest = {
+    schemaVersion: 1,
+    target,
+    generatedFrom: Object.fromEntries(
+      Object.entries(targetSources).map(([name, source]) => [
+        name,
+        {
+          version: source.version,
+          url: source.url || source.sourceUrl,
+          sha256: source.sha256 || source.sourceSha256
+        }
+      ])
+    ),
+    files: Object.fromEntries(
+      files.map(file => [
+        path.relative(destination, file).split(path.sep).join('/'),
+        sha256(file)
+      ])
+    )
+  };
+  fs.writeFileSync(
+    path.join(destination, 'payload-manifest.json'),
+    `${JSON.stringify(manifest, null, 2)}\n`
+  );
+}
+
+try {
+  fs.rmSync(destination, { recursive: true, force: true });
+  fs.mkdirSync(destination, { recursive: true });
+
+  const ytdlp = await download('yt-dlp', targetSources['yt-dlp']);
+  copyExecutable(
+    findFile(ytdlp, isWindows ? ['yt-dlp.exe'] : ['yt-dlp_linux']),
+    'yt-dlp'
+  );
+  fs.cpSync(path.join(ytdlp, '_internal'), path.join(destination, '_internal'), {
+    recursive: true,
+    preserveTimestamps: true
+  });
+
+  const deno = await download('deno', targetSources.deno);
+  copyExecutable(findFile(deno, isWindows ? ['deno.exe'] : ['deno']), 'deno');
+
+  const ffmpeg = await download('ffmpeg', targetSources.ffmpeg);
+  copyExecutable(findFile(ffmpeg, isWindows ? ['ffmpeg.exe'] : ['ffmpeg']), 'ffmpeg');
+
+  const aria2 = await download('aria2c', targetSources.aria2c);
+  copyExecutable(findFile(aria2, isWindows ? ['aria2c.exe'] : ['aria2c']), 'aria2c');
+
+  writePayloadManifest();
+  console.log(`Provisioned locked engine payload at ${destination}`);
+} finally {
+  fs.rmSync(temporary, { recursive: true, force: true });
+}

scripts/repack-linux-appimage-engines.js

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { collectRegularFiles, sha256 } from './engine-payload-integrity.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+function mustBeDirectory(directory, label) {
+  if (!fs.existsSync(directory) || !fs.statSync(directory).isDirectory()) {
+    fail(`${label} does not exist or is not a directory: ${directory}`);
+  }
+}
+
+function mustBeFile(file, label) {
+  if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
+    fail(`${label} does not exist or is not a file: ${file}`);
+  }
+}
+
+function findSingleAppImage(directory) {
+  mustBeDirectory(directory, 'AppImage bundle directory');
+  const appImages = fs
+    .readdirSync(directory)
+    .filter(name => name.endsWith('.AppImage'))
+    .map(name => path.join(directory, name));
+
+  if (appImages.length !== 1) {
+    fail(`Expected exactly one AppImage in ${directory}, found ${appImages.length}.`);
+  }
+
+  return appImages[0];
+}
+
+function validatePayloadManifest(root, target, label) {
+  const manifestPath = path.join(root, 'payload-manifest.json');
+  mustBeFile(manifestPath, `${label} payload manifest`);
+
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  } catch (error) {
+    fail(`${label} payload manifest is not valid JSON: ${error.message}`);
+  }
+
+  if (manifest.target !== target) {
+    fail(`${label} payload target mismatch: expected ${target}, got ${manifest.target}`);
+  }
+
+  const expectedFiles = Object.keys(manifest.files || {}).sort();
+  const actualFiles = collectRegularFiles(root, { ignoredNames: ['payload-manifest.json'] })
+    .map(file => path.relative(root, file).split(path.sep).join('/'))
+    .sort();
+
+  if (JSON.stringify(actualFiles) !== JSON.stringify(expectedFiles)) {
+    fail(`${label} payload files do not match payload-manifest.json.`);
+  }
+
+  for (const relative of expectedFiles) {
+    const file = path.join(root, relative);
+    if (sha256(file) !== manifest.files[relative]) {
+      fail(`${label} payload checksum mismatch: ${relative}`);
+    }
+  }
+}
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd ?? repoRoot,
+    env: { ...process.env, ...options.env },
+    stdio: options.stdio ?? 'inherit',
+    encoding: options.stdio === 'pipe' ? 'utf8' : undefined,
+  });
+
+  if (result.error) {
+    fail(`Failed to run ${command}: ${result.error.message}`);
+  }
+
+  if (result.status !== 0) {
+    if (options.stdio === 'pipe') {
+      if (result.stdout) {
+        process.stdout.write(result.stdout);
+      }
+      if (result.stderr) {
+        process.stderr.write(result.stderr);
+      }
+    }
+    fail(`${command} exited with status ${result.status}`);
+  }
+}
+
+const target = argValue('--target') || process.env.FIRELINK_TARGET_TRIPLE || process.env.TAURI_ENV_TARGET_TRIPLE;
+if (!target) {
+  fail('Pass --target <triple>.');
+}
+
+const bundleDirectory = path.join(repoRoot, 'src-tauri', 'target', target, 'release', 'bundle', 'appimage');
+const appDir = path.resolve(argValue('--appdir') || path.join(bundleDirectory, 'Firelink.AppDir'));
+const appImage = path.resolve(argValue('--appimage') || findSingleAppImage(bundleDirectory));
+const appImageTool = path.resolve(argValue('--appimagetool') || process.env.APPIMAGETOOL || 'appimagetool');
+const source = path.join(repoRoot, 'src-tauri', 'provisioned-engines', target);
+const destination = path.join(appDir, 'usr', 'lib', 'Firelink', 'engine-dist', target);
+
+mustBeDirectory(appDir, 'Firelink.AppDir');
+mustBeDirectory(source, 'Provisioned engine payload');
+mustBeFile(appImage, 'AppImage');
+mustBeFile(appImageTool, 'appimagetool');
+
+validatePayloadManifest(source, target, 'Provisioned engine');
+
+fs.rmSync(destination, { recursive: true, force: true });
+fs.mkdirSync(path.dirname(destination), { recursive: true });
+fs.cpSync(source, destination, {
+  recursive: true,
+  dereference: false,
+  preserveTimestamps: true,
+});
+validatePayloadManifest(destination, target, 'AppDir engine');
+
+fs.chmodSync(appImageTool, 0o755);
+run(appImageTool, [appDir, appImage], {
+  env: {
+    APPIMAGE_EXTRACT_AND_RUN: '1',
+    ARCH: 'x86_64',
+  },
+});
+
+const extractRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-appimage-'));
+try {
+  fs.chmodSync(appImage, 0o755);
+  run(appImage, ['--appimage-extract'], {
+    cwd: extractRoot,
+    env: { APPIMAGE_EXTRACT_AND_RUN: '1' },
+    stdio: 'pipe',
+  });
+
+  const extractedPayload = path.join(extractRoot, 'squashfs-root', 'usr', 'lib', 'Firelink', 'engine-dist', target);
+  mustBeDirectory(extractedPayload, 'Extracted AppImage engine payload');
+  validatePayloadManifest(extractedPayload, target, 'Extracted AppImage engine');
+} finally {
+  fs.rmSync(extractRoot, { recursive: true, force: true });
+}
+
+console.log(`Repacked and verified AppImage engine payload for ${target}.`);

scripts/smoke-packaged-app.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+import { execFileSync, spawn } from 'node:child_process';
+import path from 'node:path';
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+const executableArg = argValue('--executable');
+if (!executableArg) {
+  console.error('Pass --executable <path>.');
+  process.exit(1);
+}
+
+const executable = path.resolve(executableArg);
+const assertNoVisibleChildWindows = process.argv.includes('--assert-no-visible-child-windows');
+const child = spawn(executable, [], {
+  cwd: process.env.RUNNER_TEMP || process.env.TMPDIR || process.cwd(),
+  detached: process.platform !== 'win32',
+  env: {
+    ...process.env,
+    FIRELINK_SMOKE_TEST: '1',
+    WEBKIT_DISABLE_COMPOSITING_MODE: '1',
+    GDK_BACKEND: 'x11',
+  },
+  stdio: ['ignore', 'pipe', 'pipe'],
+});
+
+let stderr = '';
+let spawnError = null;
+let readyPort = null;
+
+child.on('error', error => {
+  spawnError = error;
+});
+
+child.on('exit', (code, signal) => {
+  if (readyPort === null) {
+    console.error(`Child exited prematurely with code ${code} signal ${signal}`);
+  }
+});
+
+child.stderr.on('data', data => {
+  stderr += data.toString();
+});
+
+function sleep(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+async function findReadyPort() {
+  for (let attempt = 0; attempt < 200 && readyPort === null; attempt += 1) {
+    if (spawnError) {
+      break;
+    }
+
+    for (let port = 6412; port <= 6422; port += 1) {
+      try {
+        const response = await fetch(`http://127.0.0.1:${port}/ping`);
+        if (response.headers.get('x-firelink-server') === '1') {
+          readyPort = port;
+          break;
+        }
+      } catch {}
+    }
+
+    if (readyPort === null) {
+      await sleep(250);
+    }
+  }
+}
+
+function assertNoVisibleWindows(rootPid) {
+  if (process.platform !== 'win32') {
+    return;
+  }
+
+  const script = `
+$root = ${rootPid}
+$all = Get-CimInstance Win32_Process
+$pending = @($root)
+$descendants = @()
+while ($pending.Count -gt 0) {
+  $parent = $pending[0]
+  if ($pending.Count -eq 1) {
+    $pending = @()
+  } else {
+    $pending = $pending[1..($pending.Count - 1)]
+  }
+
+  $children = @($all | Where-Object { $_.ParentProcessId -eq $parent })
+  foreach ($child in $children) {
+    $descendants += $child.ProcessId
+    $pending += $child.ProcessId
+  }
+}
+
+$visible = foreach ($childPid in $descendants) {
+  $process = Get-Process -Id $childPid -ErrorAction SilentlyContinue
+  if ($process -and $process.MainWindowHandle -ne 0) {
+    "$($process.ProcessName)($childPid)"
+  }
+}
+
+if ($visible.Count -gt 0) {
+  Write-Error "Visible child process windows detected: $($visible -join ', ')"
+  exit 1
+}
+`;
+
+  try {
+    execFileSync('powershell', ['-NoProfile', '-Command', script], {
+      stdio: 'pipe',
+      windowsHide: true,
+    });
+  } catch (error) {
+    const detail = [error.stdout?.toString(), error.stderr?.toString()].filter(Boolean).join('\n').trim();
+    throw new Error(detail || 'Visible child process window check failed.');
+  }
+}
+
+function terminateChild() {
+  if (!child.pid) {
+    return;
+  }
+
+  if (process.platform === 'win32') {
+    spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], {
+      stdio: 'ignore',
+      windowsHide: true,
+    });
+    return;
+  }
+
+  try {
+    process.kill(-child.pid, 'SIGTERM');
+  } catch {
+    child.kill('SIGTERM');
+  }
+}
+
+await findReadyPort();
+
+try {
+  if (readyPort === null) {
+    if (spawnError) {
+      console.error(`Packaged Firelink failed to start: ${spawnError.message}`);
+    } else {
+      console.error(`Packaged Firelink did not expose extension ping endpoint. Stderr:\n${stderr.slice(-1000)}`);
+    }
+    process.exit(1);
+  }
+
+  if (assertNoVisibleChildWindows) {
+    assertNoVisibleWindows(child.pid);
+  }
+
+  console.log(`Packaged Firelink smoke passed on 127.0.0.1:${readyPort}`);
+} finally {
+  terminateChild();
+}

scripts/stage-engines.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { collectRegularFiles, sha256, treeDigest } from './engine-payload-integrity.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+const binariesRoot = path.join(repoRoot, 'src-tauri', 'binaries');
+const outputRoot = path.join(repoRoot, 'src-tauri', 'engine-dist');
+const lock = JSON.parse(fs.readFileSync(path.join(repoRoot, 'engines.lock.json'), 'utf8'));
+
+const archMap = { x64: 'x86_64', arm64: 'aarch64' };
+const platformMap = {
+  darwin: 'apple-darwin',
+  win32: 'pc-windows-msvc',
+  linux: 'unknown-linux-gnu',
+};
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+const hostTarget = `${archMap[os.arch()]}-${platformMap[os.platform()]}`;
+const target = argValue('--target')
+  || process.env.TAURI_ENV_TARGET_TRIPLE
+  || process.env.FIRELINK_TARGET_TRIPLE
+  || hostTarget;
+const isWindowsTarget = target.includes('windows');
+const suffix = isWindowsTarget ? '.exe' : '';
+const engines = ['yt-dlp', 'aria2c', 'ffmpeg', 'deno'];
+const expectedNames = engines.map(engine => `${engine}-${target}${suffix}`);
+const targetLock = lock.targets?.[target];
+
+const configuredSource = process.env.FIRELINK_ENGINE_SOURCE_DIR
+  ? path.resolve(process.env.FIRELINK_ENGINE_SOURCE_DIR)
+  : null;
+const canonicalSource = path.join(binariesRoot, target);
+const provisionedSource = path.join(repoRoot, 'src-tauri', 'provisioned-engines', target);
+const legacyMacSource = target.endsWith('apple-darwin') ? binariesRoot : null;
+const source = [configuredSource, canonicalSource, provisionedSource, legacyMacSource]
+  .filter(Boolean)
+  .find(candidate => expectedNames.every(name => fs.existsSync(path.join(candidate, name))));
+
+if (!source) {
+  console.error(`No complete engine payload found for ${target}.`);
+  console.error(`Expected source directory: ${canonicalSource}`);
+  console.error(`Expected files: ${expectedNames.join(', ')}`);
+  process.exit(1);
+}
+
+if (targetLock) {
+  for (const engine of engines) {
+    const name = `${engine}-${target}${suffix}`;
+    const expected = targetLock.engines?.[engine]?.sha256;
+    const actual = sha256(path.join(source, name));
+    if (!expected || actual !== expected) {
+      console.error(`Checksum mismatch for ${name}. Expected ${expected || 'missing lock'}, got ${actual}.`);
+      process.exit(1);
+    }
+  }
+
+  for (const [runtimeDir, expected] of Object.entries(targetLock.runtimeTrees || {})) {
+    const sourceDir = path.join(source, runtimeDir);
+    if (!fs.existsSync(sourceDir)) {
+      console.error(`Missing locked runtime directory ${runtimeDir} for ${target}.`);
+      process.exit(1);
+    }
+    const actual = treeDigest(sourceDir);
+    if (actual.files !== expected.files || actual.sha256 !== expected.sha256) {
+      console.error(`Runtime checksum mismatch for ${runtimeDir}.`);
+      process.exit(1);
+    }
+  }
+} else {
+  const manifestPath = path.join(source, 'payload-manifest.json');
+  if (!fs.existsSync(manifestPath)) {
+    console.error(`No committed lock or payload manifest exists for ${target}.`);
+    process.exit(1);
+  }
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  if (manifest.target !== target) {
+    console.error(`Payload manifest target mismatch: ${manifest.target}`);
+    process.exit(1);
+  }
+  for (const [relative, expected] of Object.entries(manifest.files || {})) {
+    const file = path.join(source, relative);
+    if (!fs.existsSync(file) || sha256(file) !== expected) {
+      console.error(`Payload manifest mismatch: ${relative}`);
+      process.exit(1);
+    }
+  }
+  const actualFiles = collectRegularFiles(source, {
+    ignoredNames: ['payload-manifest.json'],
+  }).map(file => path.relative(source, file).split(path.sep).join('/'));
+  const expectedFiles = Object.keys(manifest.files || {}).sort();
+  actualFiles.sort();
+  if (JSON.stringify(actualFiles) !== JSON.stringify(expectedFiles)) {
+    console.error(`Payload contains files not covered by manifest for ${target}.`);
+    process.exit(1);
+  }
+}
+
+const destination = path.join(outputRoot, target);
+fs.rmSync(outputRoot, { recursive: true, force: true });
+fs.mkdirSync(destination, { recursive: true });
+
+for (const name of expectedNames) {
+  fs.copyFileSync(path.join(source, name), path.join(destination, name));
+  if (!isWindowsTarget) {
+    fs.chmodSync(path.join(destination, name), 0o755);
+  }
+}
+
+for (const runtimeDir of ['_internal', 'aria2-libs']) {
+  const sourceDir = path.join(source, runtimeDir);
+  if (fs.existsSync(sourceDir)) {
+    fs.cpSync(sourceDir, path.join(destination, runtimeDir), {
+      recursive: true,
+      dereference: false,
+      preserveTimestamps: true,
+    });
+  }
+}
+const payloadManifest = path.join(source, 'payload-manifest.json');
+if (fs.existsSync(payloadManifest)) {
+  fs.copyFileSync(payloadManifest, path.join(destination, 'payload-manifest.json'));
+}
+
+console.log(`Staged Firelink engines for ${target} from ${source}`);

scripts/verify-binaries.js

@@ -0,0 +1,441 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { execFileSync, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+const archMap = { x64: 'x86_64', arm64: 'aarch64' };
+const platformMap = {
+  darwin: 'apple-darwin',
+  win32: 'pc-windows-msvc',
+  linux: 'unknown-linux-gnu',
+};
+
+const currentArch = archMap[os.arch()];
+const currentPlatform = platformMap[os.platform()];
+
+if (!currentArch || !currentPlatform) {
+  console.error(`Unsupported architecture or platform: ${os.arch()} / ${os.platform()}`);
+  process.exit(1);
+}
+
+const targetTriple = argValue('--target')
+  || process.env.FIRELINK_TARGET_TRIPLE
+  || `${currentArch}-${currentPlatform}`;
+const hostTriple = `${currentArch}-${currentPlatform}`;
+const canExecuteTarget = targetTriple === hostTriple;
+const isWindows = targetTriple.includes('windows');
+const isMacOS = targetTriple.includes('apple-darwin');
+const isLinux = targetTriple.includes('linux');
+const ext = isWindows ? '.exe' : '';
+const suffix = `-${targetTriple}${ext}`;
+
+const scriptsDir = __dirname;
+const searchRoot = argValue('--search-root');
+function findEngineRoot(root) {
+  const expected = `yt-dlp-${targetTriple}${ext}`;
+  const matches = [];
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        if (fs.existsSync(path.join(candidate, expected))) matches.push(candidate);
+        walk(candidate);
+      }
+    }
+  };
+  walk(path.resolve(root));
+  if (matches.length !== 1) {
+    throw new Error(`Expected exactly one packaged engine root under ${root}, found ${matches.length}`);
+  }
+  return matches[0];
+}
+
+const configuredRoot = argValue('--root')
+  || (process.argv.includes('--staged')
+    ? path.join(scriptsDir, '..', 'src-tauri', 'engine-dist', targetTriple)
+    : searchRoot
+      ? findEngineRoot(searchRoot)
+      : null);
+const binariesDir = configuredRoot
+  ? path.resolve(configuredRoot)
+  : path.join(scriptsDir, '..', 'src-tauri', 'binaries');
+const requiredEngines = ['yt-dlp', 'aria2c', 'ffmpeg', 'deno'];
+
+const FORBIDDEN_OTOOL_PATHS = ['/opt/homebrew', '/usr/local/Cellar'];
+const FORBIDDEN_STDERR = [
+  'Failed to load Python shared library',
+  'Library not loaded',
+  'image not found',
+  'Connection refused',
+];
+
+let exitCode = 0;
+
+function fail(msg) {
+  console.error(`[FAIL] ${msg}`);
+  exitCode = 1;
+}
+
+function ok(msg) {
+  console.log(`[OK] ${msg}`);
+}
+
+function rejectSymlinks(root, label) {
+  if (!fs.existsSync(root)) {
+    return;
+  }
+
+  let symlinkCount = 0;
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      const relative = path.relative(root, file).split(path.sep).join('/');
+      if (entry.isSymbolicLink()) {
+        fail(`Unsupported symlink in ${label}: ${relative}`);
+        symlinkCount += 1;
+      } else if (entry.isDirectory()) {
+        walk(file);
+      }
+    }
+  };
+
+  walk(root);
+  if (symlinkCount === 0) {
+    ok(`${label} contains no symlinks`);
+  }
+}
+
+function binName(engine) {
+  return `${engine}${suffix}`;
+}
+
+function binPath(engine) {
+  return path.join(binariesDir, binName(engine));
+}
+
+function engineEnv(engine) {
+  if (engine !== 'aria2c') {
+    return process.env;
+  }
+
+  const modulesDir = path.join(binariesDir, 'aria2-libs');
+  if (!fs.existsSync(modulesDir)) {
+    return process.env;
+  }
+
+  return {
+    ...process.env,
+    OPENSSL_MODULES: modulesDir,
+  };
+}
+
+// ───── Check 1: Sidecar existence ─────
+console.log(`\n─── 1. Sidecar existence (${targetTriple}) ───`);
+for (const eng of requiredEngines) {
+  const p = binPath(eng);
+  if (fs.existsSync(p)) {
+    ok(`Found ${binName(eng)}`);
+  } else {
+    fail(`Missing ${binName(eng)}`);
+  }
+}
+
+if (exitCode !== 0) {
+  console.error('\nAborting: missing required sidecars.');
+  process.exit(1);
+}
+
+// ───── Check 2: Executable permission ─────
+console.log('\n─── 2. Executable permission ───');
+for (const eng of requiredEngines) {
+  if (isWindows) {
+    ok(`Executable permission is represented by PE format on Windows: ${binName(eng)}`);
+    continue;
+  }
+  try {
+    fs.accessSync(binPath(eng), fs.constants.X_OK);
+    ok(`Executable ${binName(eng)}`);
+  } catch {
+    fail(`Not executable ${binName(eng)}`);
+  }
+}
+
+// ───── Check 3: file(1) identification ─────
+console.log('\n─── 3. file(1) identification ───');
+for (const eng of requiredEngines) {
+  if (os.platform() === 'win32') {
+    try {
+      const header = fs.readFileSync(binPath(eng)).subarray(0, 2).toString('ascii');
+      if (header === 'MZ') {
+        ok(`${binName(eng)}: Windows PE executable`);
+      } else {
+        fail(`${binName(eng)}: missing Windows PE MZ header`);
+      }
+    } catch (e) {
+      fail(`identify ${binName(eng)}: ${e.message}`);
+    }
+    continue;
+  }
+  try {
+    const out = execFileSync('file', ['--brief', binPath(eng)], {
+      encoding: 'utf-8',
+      timeout: 5000,
+    }).trim();
+    ok(`${binName(eng)}: ${out}`);
+  } catch (e) {
+    fail(`file ${binName(eng)}: ${e.message}`);
+  }
+}
+
+// ───── Check 4 & 5: otool -L linkage (macOS only) ─────
+if (isMacOS) {
+  console.log('\n─── 4 & 5. otool -L linkage check ───');
+  for (const eng of requiredEngines) {
+    const p = binPath(eng);
+    try {
+      const out = execFileSync('otool', ['-L', p], {
+        encoding: 'utf-8',
+        timeout: 10000,
+      });
+      const lines = out
+        .split('\n')
+        .slice(1)
+        .map((l) => l.trim())
+        .filter(Boolean);
+      let hasBad = false;
+      for (const fp of FORBIDDEN_OTOOL_PATHS) {
+        for (const line of lines) {
+          if (line.includes(fp)) {
+            fail(`${binName(eng)} links to '${fp}': ${line}`);
+            hasBad = true;
+          }
+        }
+      }
+      if (!hasBad) {
+        ok(`${binName(eng)}: no local-only dylib paths`);
+      }
+    } catch (e) {
+      fail(`otool -L ${binName(eng)}: ${e.message}`);
+    }
+  }
+}
+
+// ───── Check 6: yt-dlp packaging ─────
+console.log('\n─── 6. yt-dlp packaging ───');
+{
+  const yt = binPath('yt-dlp');
+  if (!fs.existsSync(yt)) {
+    fail('yt-dlp binary not found, cannot verify packaging');
+  } else {
+    const internalDir = path.join(binariesDir, '_internal');
+    const hasInternal = fs.existsSync(internalDir) && fs.statSync(internalDir).isDirectory();
+
+    if (hasInternal) {
+      console.log('  Detected PyInstaller onedir layout (_internal/ present)');
+      let entries;
+      try {
+        entries = fs.readdirSync(internalDir);
+        ok(`_internal/ directory exists with ${entries.length} entries`);
+      } catch (e) {
+        fail(`Cannot read _internal/: ${e.message}`);
+      }
+      rejectSymlinks(internalDir, '_internal/');
+
+      const requiredRuntimeFiles = [
+        path.join(internalDir, 'yt_dlp_ejs', 'yt', 'solver', 'core.min.js'),
+        path.join(internalDir, 'yt_dlp_ejs', 'yt', 'solver', 'lib.min.js'),
+      ];
+      for (const required of requiredRuntimeFiles) {
+        if (fs.existsSync(required)) {
+          ok(`yt-dlp runtime component: ${path.relative(binariesDir, required)}`);
+        } else {
+          fail(`Missing yt-dlp runtime component: ${path.relative(binariesDir, required)}`);
+        }
+      }
+      const runtimeCandidates = isWindows
+        ? fs.readdirSync(internalDir).filter(name => /^python.*\.dll$/i.test(name))
+        : isLinux
+          ? fs.readdirSync(internalDir).filter(name => /^libpython.*\.so/i.test(name) || name === 'Python')
+          : ['Python', 'Python.framework'].filter(name => fs.existsSync(path.join(internalDir, name)));
+      if (runtimeCandidates.length > 0) {
+        ok(`yt-dlp embedded Python runtime: ${runtimeCandidates[0]}`);
+      } else {
+        fail(`Missing embedded Python runtime in ${internalDir}`);
+      }
+    } else {
+      fail('yt-dlp must use the self-contained onedir distribution; onefile adds ~17 seconds to every launch');
+    }
+  }
+}
+
+const aria2LibsDir = path.join(binariesDir, 'aria2-libs');
+if (fs.existsSync(aria2LibsDir) && fs.statSync(aria2LibsDir).isDirectory()) {
+  rejectSymlinks(aria2LibsDir, 'aria2-libs/');
+}
+
+// ───── Check 7, 8 & 9: Engine version self-tests ─────
+console.log('\n─── 7 & 8 & 9. Engine version self-tests ───');
+
+function runEngine(label, engine, args, timeout = 30000) {
+  const p = binPath(engine);
+  if (!fs.existsSync(p)) {
+    fail(`${label} binary not found at ${p}`);
+    return;
+  }
+  let stderr = '';
+  try {
+    const stdout = execFileSync(p, args, {
+      encoding: 'utf-8',
+      env: engineEnv(engine),
+      timeout,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const firstLine = stdout.trim().split('\n')[0];
+    ok(`${label} version: ${firstLine}`);
+  } catch (e) {
+    stderr = e.stderr || '';
+    const stdout = e.stdout || '';
+    const detail = stdout.trim().split('\n')[0] || e.message;
+    fail(`${label} execution failed: ${detail}`);
+  }
+  if (stderr) {
+    for (const pattern of FORBIDDEN_STDERR) {
+      if (stderr.includes(pattern)) {
+        fail(`${label} stderr contains '${pattern}'`);
+      }
+    }
+  }
+}
+
+const coldStartTimeout = isMacOS ? 120000 : 30000;
+if (canExecuteTarget) {
+  runEngine('yt-dlp cold start', 'yt-dlp', ['--version'], coldStartTimeout);
+  runEngine('yt-dlp warm start', 'yt-dlp', ['--version'], 8000);
+  runEngine('ffmpeg cold start', 'ffmpeg', ['-version'], coldStartTimeout);
+  runEngine('deno cold start', 'deno', ['--version'], coldStartTimeout);
+  runEngine('aria2c cold start', 'aria2c', ['--version'], coldStartTimeout);
+  if (isMacOS) {
+    // Unsigned binaries can incur a one-time macOS provenance scan after copying.
+    // Warm checks enforce engine startup performance after that OS validation.
+    runEngine('ffmpeg warm start', 'ffmpeg', ['-version'], 8000);
+    runEngine('deno warm start', 'deno', ['--version'], 8000);
+    runEngine('aria2c warm start', 'aria2c', ['--version'], 8000);
+  }
+} else {
+  console.log(`  Runtime tests skipped on ${hostTriple}; native ${targetTriple} CI runs them.`);
+}
+
+// ───── aria2 RPC smoke test (native target only) ─────
+if (canExecuteTarget) {
+  console.log('\n─── aria2 RPC smoke test ───');
+  await (async function testAria2Rpc() {
+    const p = binPath('aria2c');
+    if (!fs.existsSync(p)) {
+      fail('aria2c binary not found, cannot run RPC test');
+      return;
+    }
+
+    const port = 16801 + (process.pid % 1000);
+    const proc = spawn(p, [
+      '--enable-rpc',
+      `--rpc-listen-port=${port}`,
+      '--rpc-max-request-size=1K',
+      '--quiet',
+      '--console-log-level=error',
+      '--rpc-listen-all=false',
+    ], {
+      env: engineEnv('aria2c'),
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 15000,
+    });
+
+    let rpcStderr = '';
+    proc.stderr.on('data', (d) => {
+      rpcStderr += d.toString();
+    });
+
+    const body = JSON.stringify({
+      jsonrpc: '2.0',
+      id: 'firelink-verify',
+      method: 'aria2.getVersion',
+      params: [],
+    });
+
+    const result = await new Promise((resolve) => {
+      const maxAttempts = 20;
+      let attempts = 0;
+
+      function tryFetch() {
+        attempts++;
+        fetch(`http://127.0.0.1:${port}/jsonrpc`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body,
+        })
+          .then(async (res) => {
+            resolve({ ok: true, data: await res.text() });
+          })
+          .catch(() => {
+            if (attempts >= maxAttempts) {
+              resolve({ ok: false, error: `RPC not ready after ${maxAttempts} attempts` });
+              return;
+            }
+            setTimeout(tryFetch, 300);
+          });
+      }
+
+      tryFetch();
+    });
+
+    // Clean up
+    proc.kill('SIGTERM');
+    setTimeout(() => {
+      try {
+        proc.kill('SIGKILL');
+      } catch {}
+    }, 2000);
+
+    if (result.ok) {
+      try {
+        const resp = JSON.parse(result.data);
+        if (resp?.result?.version) {
+          ok(`aria2 RPC version: ${resp.result.version}`);
+        } else {
+          fail(`aria2 RPC unexpected response: ${result.data}`);
+        }
+      } catch (e) {
+        fail(`aria2 RPC parse error: ${e.message}`);
+      }
+    } else {
+      fail(result.error);
+    }
+
+    if (rpcStderr) {
+      for (const pattern of FORBIDDEN_STDERR) {
+        if (rpcStderr.includes(pattern)) {
+          fail(`aria2 RPC stderr contains '${pattern}'`);
+        }
+      }
+    }
+  })();
+}
+
+// ───── Result ─────
+console.log('');
+if (exitCode !== 0) {
+  console.error(`[FAIL] ${exitCode} engine verification check(s) failed.`);
+  process.exit(1);
+} else {
+  console.log('[PASS] All engine verification checks passed.');
+  process.exit(0);
+}

src-tauri/.gitignore

@@ -0,0 +1,7 @@
+# Generated by Cargo
+# will have compiled files and executables
+/target/
+
+# Generated by Tauri
+# will have schema files for capabilities auto-completion
+/gen/schemas

src-tauri/Cargo.toml

@@ -0,0 +1,68 @@
+[package]
+name = "firelink"
+version = "1.0.0"
+description = "A fast cross-platform desktop download manager powered by Rust and Tauri"
+authors = ["NimBold"]
+edition = "2021"
+license = "MIT"
+repository = "https://github.com/nimbold/Firelink"
+homepage = "https://github.com/nimbold/Firelink"
+keywords = ["download-manager", "tauri", "aria2", "yt-dlp", "ffmpeg"]
+categories = ["network-programming"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[lib]
+# The `_lib` suffix may seem redundant but it is necessary
+# to make the lib name unique and wouldn't conflict with the bin name.
+# This seems to be only an issue on Windows, see https://github.com/rust-lang/cargo/issues/8519
+name = "firelink_lib"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+tauri = { version = "2", features = ["macos-private-api", "tray-icon", "image-png", "test"] }
+tauri-plugin-opener = "2"
+tauri-plugin-dialog = "2"
+tauri-plugin-shell = "2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tokio = { version = "1", features = ["fs", "process", "io-util", "rt", "rt-multi-thread", "macros", "sync", "time"] }
+regex = "1.10"
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "stream"] }
+uuid = { version = "1", features = ["v4"] }
+ts-rs = { version = "12", features = ["serde-compat", "uuid-impl"] }
+tauri-plugin-notification = "2.3.3"
+sysinfo = "0.39.3"
+hmac = "0.12"
+sha2 = "0.10"
+tauri-plugin-deep-link = "2"
+tauri-plugin-single-instance = { version = "2", features = ["deep-link"] }
+tempfile = "3"
+thiserror = "2.0.18"
+axum = "0.8.9"
+tower-http = { version = "0.6.11", features = ["cors"] }
+sysproxy = "0.3.0"
+semver = "1.0.28"
+keepawake = "0.6.0"
+system_shutdown = "4.1.0"
+tokio-tungstenite = "0.29.0"
+futures-util = { version = "0.3.32", features = ["sink"] }
+chrono = "0.4.38"
+url = "2"
+rusqlite = { version = "0.40.1", features = ["bundled"] }
+log = "0.4.32"
+tauri-plugin-log = "2"
+trash = "5"
+async-trait = "0.1"
+[target.'cfg(target_os = "macos")'.dependencies]
+objc = "0.2.7"
+keyring = { version = "3", features = ["apple-native"] }
+
+[target.'cfg(target_os = "windows")'.dependencies]
+keyring = { version = "3", features = ["windows-native"] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+keyring = { version = "3", features = ["sync-secret-service", "vendored"] }