feat(ui): add Deno to about credits and engines list

Gatekeeper enforces Library Validation and prevents `dlopen` of quarantined ad-hoc signed dynamic libraries on ARM64. Because the `_internal` folder was shipped inside the DMG, the user's system flagged it with the com.apple.quarantine attribute, causing the Python shared library to fail to load inside `yt-dlp`.

By reverting back to the single-file PyInstaller binary (which is now properly code-signable without corruption on macOS), PyInstaller extracts the `_internal` folder at runtime to `/var/folders/...`. These extracted files do not inherit the quarantine flag, allowing AMFI to successfully load them and completely bypassing the dlopen system policy rejection.

.github/workflows/release.yml

@@ -60,29 +60,8 @@ jobs:
             exit 1
           fi
 
-      - name: Install dependencies
-        run: brew install aria2 dylibbundler
-
       - name: Fetch media engines
-        run: |
-          mkdir -p Sources/Firelink
-
-          # Download the one-folder macOS build. The direct one-file binary is not code-signable.
-          curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos.zip -o yt-dlp.zip
-          mkdir -p yt-dlp-macos
-          unzip -q -o yt-dlp.zip -d yt-dlp-macos
-          mv yt-dlp-macos/yt-dlp_macos Sources/Firelink/yt-dlp
-          cp -R yt-dlp-macos/_internal Sources/Firelink/_internal
-          rm -rf yt-dlp.zip yt-dlp-macos
-          chmod +x Sources/Firelink/yt-dlp
-
-          # Download latest FFmpeg release build for macOS ARM64 from Martin Riedl's build server
-          curl -fsSL "https://ffmpeg.martin-riedl.de/redirect/latest/macos/arm64/release/ffmpeg.zip" -o ffmpeg.zip
-          unzip -q -o ffmpeg.zip -d Sources/Firelink
-          rm ffmpeg.zip
-          chmod +x Sources/Firelink/ffmpeg
-          test -x Sources/Firelink/yt-dlp
-          test -x Sources/Firelink/ffmpeg
+        run: Scripts/fetch_media_engines.sh
 
       - name: Build app bundle
         env:
@@ -94,7 +73,25 @@ jobs:
         run: |
           file build/Firelink.app/Contents/MacOS/Firelink
           lipo -archs build/Firelink.app/Contents/MacOS/Firelink | grep -qx arm64
-          codesign --verify --deep build/Firelink.app
+          codesign --verify --deep --strict build/Firelink.app
+
+          RESOURCES="build/Firelink.app/Contents/Resources"
+          test -d "$RESOURCES/_internal"
+          test -x "$RESOURCES/yt-dlp"
+          test -x "$RESOURCES/deno"
+          test -x "$RESOURCES/ffmpeg"
+          test -x "$RESOURCES/aria2c"
+          test -f "$RESOURCES/aria2-cacert.pem"
+          test -d "$RESOURCES/aria2-libs"
+          test "$(tr -d '[:space:]' < "$RESOURCES/aria2-version.txt")" = "1.37.0-2-arm64-sonoma"
+          test "$("$RESOURCES/yt-dlp" --version)" = "$(tr -d '[:space:]' < "$RESOURCES/yt-dlp-version.txt")"
+          "$RESOURCES/deno" --version
+          "$RESOURCES/ffmpeg" -version
+          "$RESOURCES/aria2c" --version | grep -q '^aria2 version 1.37.0$'
+          for library in "$RESOURCES"/aria2-libs/*.dylib; do
+            lipo -archs "$library" | grep -qx arm64
+          done
+          ! otool -L "$RESOURCES/aria2c" "$RESOURCES"/aria2-libs/*.dylib | grep -Eq '(@@HOMEBREW|/opt/homebrew|/usr/local)'
 
       - name: Create DMG
         env:

.gitignore

@@ -23,8 +23,14 @@ SparklePrivateKey*
 private-key*
 private_key*
 yt-dlp
+deno
 ffmpeg
+aria2c
+Sources/Firelink/*-version.txt
 Sources/Firelink/_internal/
+Sources/Firelink/aria2-libs/
+Sources/Firelink/aria2-licenses/
+Sources/Firelink/aria2-cacert.pem
 !Sources/Firelink/_internal/
 Sources/Firelink/_internal/*
 !Sources/Firelink/_internal/.gitkeep

CHANGELOG.md

@@ -5,6 +5,46 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.7.2] - 2026-06-11
+
+### Fixed
+- Prevented yt-dlp and JavaScript child processes from keeping metadata fetches or canceled downloads alive indefinitely.
+- Replaced the repeatedly extracted one-file yt-dlp build with a stable prewarmed runtime cache.
+- Bundled Deno so YouTube JavaScript challenges and formats above 720p do not depend on system-installed tools.
+- Stopped masking empty-format extraction failures and removed brittle forced YouTube client selection.
+
+### Changed
+- Pinned and checksum-verified yt-dlp, Deno, FFmpeg, aria2, and aria2's libraries for matching local and GitHub Actions builds.
+- Removed aria2's runtime dependency on Homebrew and configured its bundled CA certificate for direct and yt-dlp-delegated HTTPS downloads.
+- Added bounded network retries and optional aria2c acceleration for large direct media downloads.
+
+## [0.7.1] - 2026-06-11
+
+### Fixes
+- Increased the `yt-dlp` metadata extraction timeout to 120 seconds to properly handle YouTube's new JavaScript Proof-of-Work bot protection challenges.
+- Improved the `AddDownloadsView` UI to display the exact underlying error message during extraction failures rather than a generic masked string.
+
+### Security Fixes
+- Addressed multiple vulnerabilities identified in the v0.7.0 security audit.
+- Moved `yt-dlp` credential passing from CLI arguments to secure temporary configuration files to prevent process list leakage.
+- Enforced strict `0o600` POSIX permissions on `aria2c` temporary configuration files to protect generated RPC secrets.
+- Replaced the unauthenticated local connection protocol with a secure HMAC-SHA256 signature validation.
+- Excluded sensitive properties like `rpcSecret` and `rpcPort` from `DownloadItem` serialization so they are never saved to disk in plaintext.
+- Mitigated SSRF (Server-Side Request Forgery) by strictly validating metadata fetch requests against private IP addresses and loopback ranges.
+- Prevented potential path traversal vulnerabilities by validating destination file URLs during duplicate resolution.
+- Sanitized custom HTTP headers to prevent CR/LF injection vectors.
+- Re-architected `aria2c` port-finding with POSIX sockets to eliminate a known race-condition window.
+- Applied rate-limiting and text length bounds to the custom `firelink://` scheme to mitigate DoS and injection attempts.
+
+### Fixes
+- Fixed a metadata extraction timeout when downloading from YouTube by preventing child processes from holding process pipes open.
+- Resolved an issue to correctly assign filenames for auto-captured downloads.
+- Restored the UUID fallback for token generation to prevent silent failures if secure random byte generation fails.
+- Hardened local API security by immediately rejecting requests if the expected pairing token is completely empty.
+- Implemented a thread-safe cleanup mechanism for temporary directories to resolve a concurrency race condition during engine cancellation.
+
 ## [0.7.0] - 2026-06-11
 
 ### New Features & Improvements

Makefile

@@ -1,6 +1,9 @@
-.PHONY: build app dmg release run verify clean
+.PHONY: engines build app dmg release run verify clean
 
-build:
+engines:
+	Scripts/fetch_media_engines.sh
+
+build: engines
 	swift build -c release
 
 app:
@@ -13,7 +16,7 @@ release:
 	Scripts/create_app_bundle.sh
 	Scripts/create_dmg.sh
 
-run:
+run: engines
 	swift run Firelink
 
 verify:

Package.swift

@@ -17,12 +17,21 @@ let package = Package(
             dependencies: [],
             path: "Sources/Firelink",
             exclude: [
-                "_internal"
+                "deno-version.txt",
+                "ffmpeg-version.txt"
             ],
             resources: [
                 .process("Assets.xcassets"),
                 .copy("yt-dlp"),
-                .copy("ffmpeg")
+                .copy("yt-dlp-version.txt"),
+                .copy("_internal"),
+                .copy("deno"),
+                .copy("ffmpeg"),
+                .copy("aria2c"),
+                .copy("aria2-libs"),
+                .copy("aria2-cacert.pem"),
+                .copy("aria2-version.txt"),
+                .copy("aria2-licenses")
             ]
         )
     ]

README.md

@@ -8,6 +8,7 @@
   <a href="https://aria2.github.io/"><img src="https://img.shields.io/badge/Engine-aria2c-red?logo=terminal&logoColor=white" alt="Engine" /></a>
   <a href="https://github.com/yt-dlp/yt-dlp"><img src="https://img.shields.io/badge/Engine-yt--dlp-red?logo=youtube&logoColor=white" alt="yt-dlp Engine" /></a>
   <a href="https://ffmpeg.org/"><img src="https://img.shields.io/badge/Engine-ffmpeg-red?logo=ffmpeg&logoColor=white" alt="ffmpeg Engine" /></a>
+  <a href="https://deno.com/"><img src="https://img.shields.io/badge/Engine-deno-blue?logo=deno&logoColor=white" alt="Deno Engine" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green" alt="License" /></a>
 </div>
 
@@ -47,7 +48,7 @@
 - 🪄 **Media Downloader:** Instantly extract high-quality media (4K, 1080p, MP3) with smart cascading format pickers, powered by bundled `yt-dlp` and `ffmpeg`.
 - 🎨 **Premium Native UI:** A responsive, frosted-glass SwiftUI interface strictly adhering to Apple Human Interface Guidelines, featuring a visual chunk map and dynamic progress tracking.
 - 🌐 **Seamless Browser Integration:** Send downloads directly from your browser via the secure Firelink Companion extension.
-- 🛡️ **Privacy & Security:** Zero-configuration setup with deferred Keychain integration ensures your credentials are kept safe and only accessed when strictly necessary.
+- 🛡️ **Privacy & Security:** Zero-configuration setup with deferred Keychain integration and secure HMAC-SHA256 authenticated local API endpoints ensure your system remains strictly isolated and protected from malicious scripts.
 - 🗂️ **Smart Organization:** Auto-categorizes incoming files and remembers your preferred download locations.
 - 🔄 **Native Updater:** Built-in seamless GitHub release checking for lightweight and transparent app updates.
 
@@ -85,6 +86,7 @@ Firelink stands on the shoulders of giants. A massive thank you to the contribut
 - **[aria2](https://aria2.github.io/)** - The legendary multi-protocol download utility driving our core engine.
 - **[yt-dlp](https://github.com/yt-dlp/yt-dlp)** - The definitive command-line audio/video downloader.
 - **[FFmpeg](https://ffmpeg.org/)** - The industry standard for media stream manipulation and merging.
+- **[Deno](https://deno.com/)** - The secure runtime for JavaScript and TypeScript solving complex media extraction challenges.
 
 ---
 

Scripts/create_app_bundle.sh

@@ -17,46 +17,7 @@ ICON_NAME="AppIcon"
 
 cd "$ROOT_DIR"
 
-is_valid_mach_o() {
-  local path="$1"
-  if ! file "$path" | grep -q 'Mach-O'; then
-    return 1
-  fi
-
-  lipo -archs "$path" >/dev/null 2>&1
-}
-
-ensure_ytdlp() {
-  local ytdlp_path="$ROOT_DIR/Sources/Firelink/yt-dlp"
-  local ytdlp_internal_path="$ROOT_DIR/Sources/Firelink/_internal"
-
-  if [[ -x "$ytdlp_path" ]] && [[ -d "$ytdlp_internal_path" ]] && is_valid_mach_o "$ytdlp_path"; then
-    return
-  fi
-
-  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null; then
-    echo "WARNING: yt-dlp or its runtime is missing or malformed, and curl/unzip are not available to refresh it." >&2
-    return
-  fi
-
-  echo "Refreshing bundled yt-dlp runtime..."
-  local temp_dir
-  temp_dir="$(mktemp -d)"
-  curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos.zip -o "$temp_dir/yt-dlp.zip"
-  unzip -q -o "$temp_dir/yt-dlp.zip" -d "$temp_dir"
-  cp "$temp_dir/yt-dlp_macos" "$ytdlp_path"
-  chmod +x "$ytdlp_path"
-
-  if [[ -d "$temp_dir/_internal" ]]; then
-    rm -rf "$ROOT_DIR/Sources/Firelink/_internal"
-    cp -R "$temp_dir/_internal" "$ROOT_DIR/Sources/Firelink/_internal"
-    touch "$ROOT_DIR/Sources/Firelink/_internal/.gitkeep"
-  fi
-
-  rm -rf "$temp_dir"
-}
-
-ensure_ytdlp
+"$ROOT_DIR/Scripts/fetch_media_engines.sh"
 
 swift build -c "$CONFIGURATION"
 
@@ -67,7 +28,7 @@ cp "$ROOT_DIR/Resources/$ICON_NAME.icns" "$RESOURCES_DIR/$ICON_NAME.icns"
 cp "$ROOT_DIR/Sources/Firelink/Assets.xcassets/MenuBarIcon.imageset/MenuBarIconTemplate.png" "$RESOURCES_DIR/MenuBarIconTemplate.png"
 cp "$ROOT_DIR/Resources/GitHubTemplate.png" "$RESOURCES_DIR/GitHubTemplate.png"
 
-for media_engine in yt-dlp ffmpeg; do
+for media_engine in yt-dlp deno ffmpeg aria2c; do
   media_engine_path="$ROOT_DIR/Sources/Firelink/$media_engine"
   if [[ -x "$media_engine_path" ]]; then
     cp "$media_engine_path" "$RESOURCES_DIR/$media_engine"
@@ -77,9 +38,23 @@ for media_engine in yt-dlp ffmpeg; do
   fi
 done
 
-if [[ -d "$ROOT_DIR/Sources/Firelink/_internal" ]]; then
-  cp -R "$ROOT_DIR/Sources/Firelink/_internal" "$RESOURCES_DIR/_internal"
-fi
+for resource_directory in _internal aria2-libs aria2-licenses; do
+  source_path="$ROOT_DIR/Sources/Firelink/$resource_directory"
+  if [[ ! -d "$source_path" ]]; then
+    echo "Required runtime directory is missing: $source_path" >&2
+    exit 1
+  fi
+  cp -R "$source_path" "$RESOURCES_DIR/$resource_directory"
+done
+
+for resource_file in yt-dlp-version.txt aria2-version.txt aria2-cacert.pem; do
+  source_path="$ROOT_DIR/Sources/Firelink/$resource_file"
+  if [[ ! -f "$source_path" ]]; then
+    echo "Required runtime file is missing: $source_path" >&2
+    exit 1
+  fi
+  cp "$source_path" "$RESOURCES_DIR/$resource_file"
+done
 
 echo "Packaging Firefox extension..."
 mkdir -p "$RESOURCES_DIR/FirefoxExtension"
@@ -90,23 +65,6 @@ cp -R "$ROOT_DIR/Extensions/Firefox/icons" "$RESOURCES_DIR/FirefoxExtension/icon
 cp -R "$ROOT_DIR/Extensions/Firefox/popup" "$RESOURCES_DIR/FirefoxExtension/popup"
 
 
-ARIA2C_PATH=$(which aria2c || true)
-if [[ -n "$ARIA2C_PATH" && -x "$ARIA2C_PATH" ]]; then
-  echo "Bundling aria2c from $ARIA2C_PATH..."
-  cp "$ARIA2C_PATH" "$RESOURCES_DIR/aria2c"
-
-  if ! command -v dylibbundler &> /dev/null; then
-    echo "Installing dylibbundler..."
-    brew install dylibbundler
-  fi
-
-  FRAMEWORKS_DIR="$CONTENTS_DIR/Frameworks"
-  mkdir -p "$FRAMEWORKS_DIR"
-  dylibbundler -od -b -x "$RESOURCES_DIR/aria2c" -d "$FRAMEWORKS_DIR" -p "@executable_path/../Frameworks/"
-else
-  echo "WARNING: aria2c not found! It will not be bundled. Please install it first."
-fi
-
 FRAMEWORKS_DIR="$CONTENTS_DIR/Frameworks"
 mkdir -p "$FRAMEWORKS_DIR"
 
@@ -175,6 +133,11 @@ if command -v codesign &> /dev/null; then
 
   sign_mach_o_file() {
     local path="$1"
+    case "$path" in
+      */Python.framework/Python|*/Python.framework/Versions/Current/*)
+        return
+        ;;
+    esac
 
     if file "$path" | grep -q 'Mach-O'; then
       if ! sign_path "$path"; then
@@ -199,7 +162,7 @@ if command -v codesign &> /dev/null; then
 
   sign_path "$MACOS_DIR/$APP_NAME"
   sign_path "$APP_DIR"
-  codesign --verify --deep --verbose=2 "$APP_DIR" || true
+  codesign --verify --deep --strict --verbose=2 "$APP_DIR"
 fi
 
 echo "Created $APP_DIR"

Scripts/fetch_media_engines.sh

@@ -0,0 +1,337 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SOURCE_DIR="$ROOT_DIR/Sources/Firelink"
+
+YTDLP_VERSION="2026.06.09"
+YTDLP_MACOS_ZIP_SHA256="62a3108d7c37090107f0bb9a2369b953b35e43f4bc76ab0ea87e4ab593c23ec7"
+
+DENO_VERSION="2.8.2"
+DENO_ARM64_ZIP_SHA256="02e5eb795c9f763772dfd081429cead9029e0a4a6aaff6d4e5f3ed6d2e94d361"
+DENO_X86_64_ZIP_SHA256="77cf27f835f1921e49434449675c57432c6314d54edc725e2474cc825546e206"
+
+FFMPEG_VERSION="8.1.1"
+FFMPEG_ARM64_URL="https://ffmpeg.martin-riedl.de/download/macos/arm64/1778761665_8.1.1/ffmpeg.zip"
+FFMPEG_ARM64_ZIP_SHA256="a05b1a47bb3ac89a95a55eec713f8bbb347051bb07015f3b7d08fb62ed81a21e"
+
+ARIA2_VERSION="1.37.0"
+ARIA2_BOTTLE_REVISION="2"
+ARIA2_RUNTIME_ID="$ARIA2_VERSION-$ARIA2_BOTTLE_REVISION-arm64-sonoma"
+ARIA2_BOTTLE_SHA256="8815b6b79395235863349628dc0d753bbee9069e99d94257b7646ffd85615623"
+CARES_VERSION="1.34.6"
+CARES_BOTTLE_SHA256="17f44048d8003b88231d69bac0408cf22be2f712ef8588d4933ff0811b92342c"
+LIBSSH2_VERSION="1.11.1_1"
+LIBSSH2_BOTTLE_SHA256="34927ad08cd265d32f1390a92d84451f85ab5b2f28101ca951da3d3e9df12047"
+OPENSSL_VERSION="3.6.2"
+OPENSSL_BOTTLE_SHA256="aaa5f4f3d87868ecd5f5fd6967da0c305eb335a58171faba193e9c7e39fbf35c"
+SQLITE_VERSION="3.53.0"
+SQLITE_BOTTLE_SHA256="36080e3273614fe3d606ff0bd5bb090ad33c19f186ba44c35807b8f97afa15be"
+GETTEXT_VERSION="1.0"
+GETTEXT_BOTTLE_SHA256="f9ea4eed738746ea4150a4f83e8dd11ca21ca3de5bb113995c25eec409bb5749"
+
+ARIA2_RUNTIME_SHA256="111b2f5ed760f1e1a2ec06117c4e8094fcde336ba16122dda1c5e7209bf1862d"
+CARES_RUNTIME_SHA256="86ceec6264753bfffb1562df22e81cbbed72d370105936ee083f3152c9dc1673"
+LIBCRYPTO_RUNTIME_SHA256="a13e280563c6eb85058f590f6f558fb20f54e171024f3b9b3637df140add1714"
+LIBINTL_RUNTIME_SHA256="7e6628118b26b58b57346f3f088b1f87b263c677736ade678f0aced5579ea357"
+LIBSQLITE_RUNTIME_SHA256="27da39c4cc96e7f43c8ed0134d2de6dd2fd36008dcb044c03aeee3eec9edc545"
+LIBSSH2_RUNTIME_SHA256="67cbce90dca26590a8a7627af8f4abccfd94f41cae48f7fa67a5f0cb98efc85b"
+LIBSSL_RUNTIME_SHA256="f5676ffe68757ea2629898c29bcee5f15982e06fe878bec4f70d159dd1b70452"
+
+mkdir -p "$SOURCE_DIR"
+
+sha256() {
+  shasum -a 256 "$1" | awk '{print $1}'
+}
+
+verify_sha256() {
+  local path="$1"
+  local expected="$2"
+  local actual
+  actual="$(sha256 "$path")"
+  if [[ "$actual" != "$expected" ]]; then
+    echo "Checksum mismatch for $path" >&2
+    echo "Expected: $expected" >&2
+    echo "Actual:   $actual" >&2
+    exit 1
+  fi
+}
+
+version_matches() {
+  local marker_path="$1"
+  local expected="$2"
+  [[ -f "$marker_path" ]] && [[ "$(tr -d '[:space:]' < "$marker_path")" == "$expected" ]]
+}
+
+fetch_homebrew_bottle() {
+  local repository="$1"
+  local digest="$2"
+  local output_path="$3"
+  local token
+
+  token="$(
+    curl -fsSL "https://ghcr.io/token?service=ghcr.io&scope=repository:homebrew/core/$repository:pull" |
+      python3 -c 'import json, sys; print(json.load(sys.stdin)["token"])'
+  )"
+  curl -fsSL \
+    -H "Authorization: Bearer $token" \
+    "https://ghcr.io/v2/homebrew/core/$repository/blobs/sha256:$digest" \
+    -o "$output_path"
+  verify_sha256 "$output_path" "$digest"
+}
+
+fetch_ytdlp() {
+  local executable="$SOURCE_DIR/yt-dlp"
+  local runtime="$SOURCE_DIR/_internal"
+  local marker="$SOURCE_DIR/yt-dlp-version.txt"
+
+  if [[ -x "$executable" ]] && [[ -d "$runtime" ]] && version_matches "$marker" "$YTDLP_VERSION"; then
+    return
+  fi
+
+  echo "Fetching yt-dlp $YTDLP_VERSION one-folder runtime..."
+  local temp_dir
+  temp_dir="$(mktemp -d)"
+  curl -fsSL \
+    "https://github.com/yt-dlp/yt-dlp/releases/download/$YTDLP_VERSION/yt-dlp_macos.zip" \
+    -o "$temp_dir/yt-dlp.zip"
+  verify_sha256 "$temp_dir/yt-dlp.zip" "$YTDLP_MACOS_ZIP_SHA256"
+  unzip -q -o "$temp_dir/yt-dlp.zip" -d "$temp_dir/runtime"
+
+  rm -rf "$runtime"
+  cp "$temp_dir/runtime/yt-dlp_macos" "$executable"
+  cp -R "$temp_dir/runtime/_internal" "$runtime"
+  touch "$runtime/.gitkeep"
+  chmod +x "$executable"
+  printf '%s\n' "$YTDLP_VERSION" > "$marker"
+  rm -rf "$temp_dir"
+}
+
+fetch_deno() {
+  local machine_arch
+  machine_arch="$(uname -m)"
+
+  local asset_arch
+  local expected_sha
+  case "$machine_arch" in
+    arm64)
+      asset_arch="aarch64"
+      expected_sha="$DENO_ARM64_ZIP_SHA256"
+      ;;
+    x86_64)
+      asset_arch="x86_64"
+      expected_sha="$DENO_X86_64_ZIP_SHA256"
+      ;;
+    *)
+      echo "Unsupported architecture for bundled Deno: $machine_arch" >&2
+      exit 1
+      ;;
+  esac
+
+  local executable="$SOURCE_DIR/deno"
+  local marker="$SOURCE_DIR/deno-version.txt"
+  if [[ -x "$executable" ]] && version_matches "$marker" "$DENO_VERSION-$machine_arch"; then
+    return
+  fi
+
+  echo "Fetching Deno $DENO_VERSION for $machine_arch..."
+  local temp_dir
+  temp_dir="$(mktemp -d)"
+  curl -fsSL \
+    "https://github.com/denoland/deno/releases/download/v$DENO_VERSION/deno-$asset_arch-apple-darwin.zip" \
+    -o "$temp_dir/deno.zip"
+  verify_sha256 "$temp_dir/deno.zip" "$expected_sha"
+  unzip -q -o "$temp_dir/deno.zip" -d "$temp_dir/runtime"
+  cp "$temp_dir/runtime/deno" "$executable"
+  chmod +x "$executable"
+  printf '%s\n' "$DENO_VERSION-$machine_arch" > "$marker"
+  rm -rf "$temp_dir"
+}
+
+fetch_ffmpeg() {
+  local executable="$SOURCE_DIR/ffmpeg"
+  local marker="$SOURCE_DIR/ffmpeg-version.txt"
+
+  if [[ "$(uname -m)" != "arm64" ]]; then
+    if [[ ! -x "$executable" ]]; then
+      echo "A local ffmpeg executable is required on non-ARM64 development hosts." >&2
+      exit 1
+    fi
+    return
+  fi
+
+  if [[ -x "$executable" ]] && version_matches "$marker" "$FFMPEG_VERSION-arm64"; then
+    return
+  fi
+
+  echo "Fetching FFmpeg $FFMPEG_VERSION for arm64..."
+  local temp_dir
+  temp_dir="$(mktemp -d)"
+  curl -fsSL "$FFMPEG_ARM64_URL" -o "$temp_dir/ffmpeg.zip"
+  verify_sha256 "$temp_dir/ffmpeg.zip" "$FFMPEG_ARM64_ZIP_SHA256"
+  unzip -q -o "$temp_dir/ffmpeg.zip" -d "$temp_dir/runtime"
+  cp "$temp_dir/runtime/ffmpeg" "$executable"
+  chmod +x "$executable"
+  printf '%s\n' "$FFMPEG_VERSION-arm64" > "$marker"
+  rm -rf "$temp_dir"
+}
+
+aria2_runtime_is_ready() {
+  local required_paths=(
+    "$SOURCE_DIR/aria2c"
+    "$SOURCE_DIR/aria2-cacert.pem"
+    "$SOURCE_DIR/aria2-libs/libcares.2.dylib"
+    "$SOURCE_DIR/aria2-libs/libcrypto.3.dylib"
+    "$SOURCE_DIR/aria2-libs/libintl.8.dylib"
+    "$SOURCE_DIR/aria2-libs/libsqlite3.dylib"
+    "$SOURCE_DIR/aria2-libs/libssh2.1.dylib"
+    "$SOURCE_DIR/aria2-libs/libssl.3.dylib"
+  )
+
+  version_matches "$SOURCE_DIR/aria2-version.txt" "$ARIA2_RUNTIME_ID" || return 1
+  [[ -x "$SOURCE_DIR/aria2c" ]] || return 1
+  [[ -d "$SOURCE_DIR/aria2-licenses" ]] || return 1
+
+  local path
+  for path in "${required_paths[@]}"; do
+    [[ -e "$path" ]] || return 1
+  done
+
+  [[ "$(sha256 "$SOURCE_DIR/aria2c")" == "$ARIA2_RUNTIME_SHA256" ]] || return 1
+  [[ "$(sha256 "$SOURCE_DIR/aria2-libs/libcares.2.dylib")" == "$CARES_RUNTIME_SHA256" ]] || return 1
+  [[ "$(sha256 "$SOURCE_DIR/aria2-libs/libcrypto.3.dylib")" == "$LIBCRYPTO_RUNTIME_SHA256" ]] || return 1
+  [[ "$(sha256 "$SOURCE_DIR/aria2-libs/libintl.8.dylib")" == "$LIBINTL_RUNTIME_SHA256" ]] || return 1
+  [[ "$(sha256 "$SOURCE_DIR/aria2-libs/libsqlite3.dylib")" == "$LIBSQLITE_RUNTIME_SHA256" ]] || return 1
+  [[ "$(sha256 "$SOURCE_DIR/aria2-libs/libssh2.1.dylib")" == "$LIBSSH2_RUNTIME_SHA256" ]] || return 1
+  [[ "$(sha256 "$SOURCE_DIR/aria2-libs/libssl.3.dylib")" == "$LIBSSL_RUNTIME_SHA256" ]] || return 1
+}
+
+fetch_aria2() {
+  if [[ "$(uname -m)" != "arm64" ]]; then
+    echo "The pinned aria2 runtime is currently available only for ARM64 macOS." >&2
+    exit 1
+  fi
+
+  if aria2_runtime_is_ready; then
+    return
+  fi
+
+  echo "Fetching aria2 $ARIA2_VERSION Homebrew ARM64 Sonoma runtime..."
+  local temp_dir
+  temp_dir="$(mktemp -d)"
+  local bottles_dir="$temp_dir/bottles"
+  local extracted_dir="$temp_dir/extracted"
+  local runtime_dir="$temp_dir/runtime"
+  local libraries_dir="$runtime_dir/aria2-libs"
+  local licenses_dir="$runtime_dir/aria2-licenses"
+  mkdir -p "$bottles_dir" "$extracted_dir" "$libraries_dir" "$licenses_dir"
+
+  fetch_homebrew_bottle "aria2" "$ARIA2_BOTTLE_SHA256" "$bottles_dir/aria2.tar.gz"
+  fetch_homebrew_bottle "c-ares" "$CARES_BOTTLE_SHA256" "$bottles_dir/c-ares.tar.gz"
+  fetch_homebrew_bottle "libssh2" "$LIBSSH2_BOTTLE_SHA256" "$bottles_dir/libssh2.tar.gz"
+  fetch_homebrew_bottle "openssl/3" "$OPENSSL_BOTTLE_SHA256" "$bottles_dir/openssl.tar.gz"
+  fetch_homebrew_bottle "sqlite" "$SQLITE_BOTTLE_SHA256" "$bottles_dir/sqlite.tar.gz"
+  fetch_homebrew_bottle "gettext" "$GETTEXT_BOTTLE_SHA256" "$bottles_dir/gettext.tar.gz"
+
+  local bottle
+  for bottle in "$bottles_dir"/*.tar.gz; do
+    tar -xzf "$bottle" -C "$extracted_dir"
+  done
+
+  cp "$extracted_dir/aria2/$ARIA2_VERSION"_"$ARIA2_BOTTLE_REVISION/bin/aria2c" "$runtime_dir/aria2c"
+  cp "$extracted_dir/c-ares/$CARES_VERSION/lib/libcares.2.19.5.dylib" "$libraries_dir/libcares.2.dylib"
+  cp "$extracted_dir/libssh2/$LIBSSH2_VERSION/lib/libssh2.1.dylib" "$libraries_dir/libssh2.1.dylib"
+  cp "$extracted_dir/openssl@3/$OPENSSL_VERSION/lib/libssl.3.dylib" "$libraries_dir/libssl.3.dylib"
+  cp "$extracted_dir/openssl@3/$OPENSSL_VERSION/lib/libcrypto.3.dylib" "$libraries_dir/libcrypto.3.dylib"
+  cp "$extracted_dir/sqlite/$SQLITE_VERSION/lib/libsqlite3.3.53.0.dylib" "$libraries_dir/libsqlite3.dylib"
+  cp "$extracted_dir/gettext/$GETTEXT_VERSION/lib/libintl.8.dylib" "$libraries_dir/libintl.8.dylib"
+  cp "$SOURCE_DIR/_internal/certifi/cacert.pem" "$runtime_dir/aria2-cacert.pem"
+
+  cp "$extracted_dir/aria2/$ARIA2_VERSION"_"$ARIA2_BOTTLE_REVISION/COPYING" "$licenses_dir/aria2-COPYING"
+  cp "$extracted_dir/c-ares/$CARES_VERSION/LICENSE.md" "$licenses_dir/c-ares-LICENSE.md"
+  cp "$extracted_dir/libssh2/$LIBSSH2_VERSION/COPYING" "$licenses_dir/libssh2-COPYING"
+  cp "$extracted_dir/openssl@3/$OPENSSL_VERSION/LICENSE.txt" "$licenses_dir/openssl-LICENSE.txt"
+  cp "$extracted_dir/gettext/$GETTEXT_VERSION/COPYING" "$licenses_dir/gettext-COPYING"
+  cp "$extracted_dir/sqlite/$SQLITE_VERSION/sbom.spdx.json" "$licenses_dir/sqlite-sbom.spdx.json"
+
+  install_name_tool \
+    -change "@@HOMEBREW_PREFIX@@/opt/sqlite/lib/libsqlite3.dylib" "@loader_path/aria2-libs/libsqlite3.dylib" \
+    -change "@@HOMEBREW_PREFIX@@/opt/openssl@3/lib/libssl.3.dylib" "@loader_path/aria2-libs/libssl.3.dylib" \
+    -change "@@HOMEBREW_PREFIX@@/opt/openssl@3/lib/libcrypto.3.dylib" "@loader_path/aria2-libs/libcrypto.3.dylib" \
+    -change "@@HOMEBREW_PREFIX@@/opt/libssh2/lib/libssh2.1.dylib" "@loader_path/aria2-libs/libssh2.1.dylib" \
+    -change "@@HOMEBREW_PREFIX@@/opt/c-ares/lib/libcares.2.dylib" "@loader_path/aria2-libs/libcares.2.dylib" \
+    -change "@@HOMEBREW_PREFIX@@/opt/gettext/lib/libintl.8.dylib" "@loader_path/aria2-libs/libintl.8.dylib" \
+    "$runtime_dir/aria2c"
+
+  local library
+  for library in "$libraries_dir"/*.dylib; do
+    install_name_tool -id "@loader_path/$(basename "$library")" "$library"
+  done
+
+  install_name_tool \
+    -change "@@HOMEBREW_PREFIX@@/opt/openssl@3/lib/libssl.3.dylib" "@loader_path/libssl.3.dylib" \
+    -change "@@HOMEBREW_PREFIX@@/opt/openssl@3/lib/libcrypto.3.dylib" "@loader_path/libcrypto.3.dylib" \
+    "$libraries_dir/libssh2.1.dylib"
+  install_name_tool \
+    -change "@@HOMEBREW_CELLAR@@/openssl@3/$OPENSSL_VERSION/lib/libcrypto.3.dylib" "@loader_path/libcrypto.3.dylib" \
+    "$libraries_dir/libssl.3.dylib"
+
+  chmod +x "$runtime_dir/aria2c"
+  for library in "$libraries_dir"/*.dylib; do
+    codesign --force --sign - "$library"
+  done
+  codesign --force --sign - "$runtime_dir/aria2c"
+
+  verify_sha256 "$runtime_dir/aria2c" "$ARIA2_RUNTIME_SHA256"
+  verify_sha256 "$libraries_dir/libcares.2.dylib" "$CARES_RUNTIME_SHA256"
+  verify_sha256 "$libraries_dir/libcrypto.3.dylib" "$LIBCRYPTO_RUNTIME_SHA256"
+  verify_sha256 "$libraries_dir/libintl.8.dylib" "$LIBINTL_RUNTIME_SHA256"
+  verify_sha256 "$libraries_dir/libsqlite3.dylib" "$LIBSQLITE_RUNTIME_SHA256"
+  verify_sha256 "$libraries_dir/libssh2.1.dylib" "$LIBSSH2_RUNTIME_SHA256"
+  verify_sha256 "$libraries_dir/libssl.3.dylib" "$LIBSSL_RUNTIME_SHA256"
+
+  if otool -L "$runtime_dir/aria2c" "$libraries_dir"/*.dylib | grep -Eq '(@@HOMEBREW|/opt/homebrew|/usr/local)'; then
+    echo "The prepared aria2 runtime still contains a Homebrew path." >&2
+    rm -rf "$temp_dir"
+    exit 1
+  fi
+  if ! vtool -show-build "$runtime_dir/aria2c" | grep -q 'minos 14.0'; then
+    echo "The pinned aria2 runtime no longer supports the app's macOS 14 deployment target." >&2
+    rm -rf "$temp_dir"
+    exit 1
+  fi
+  if [[ "$("$runtime_dir/aria2c" --version | head -n 1)" != "aria2 version $ARIA2_VERSION" ]]; then
+    echo "The prepared aria2 runtime failed its version check." >&2
+    rm -rf "$temp_dir"
+    exit 1
+  fi
+
+  rm -rf "$SOURCE_DIR/aria2-libs" "$SOURCE_DIR/aria2-licenses"
+  cp "$runtime_dir/aria2c" "$SOURCE_DIR/aria2c"
+  cp "$runtime_dir/aria2-cacert.pem" "$SOURCE_DIR/aria2-cacert.pem"
+  cp -R "$libraries_dir" "$SOURCE_DIR/aria2-libs"
+  cp -R "$licenses_dir" "$SOURCE_DIR/aria2-licenses"
+  printf '%s\n' "$ARIA2_RUNTIME_ID" > "$SOURCE_DIR/aria2-version.txt"
+  rm -rf "$temp_dir"
+}
+
+fetch_ytdlp
+fetch_deno
+fetch_ffmpeg
+fetch_aria2
+
+if command -v xattr >/dev/null; then
+  xattr -cr \
+    "$SOURCE_DIR/yt-dlp" \
+    "$SOURCE_DIR/_internal" \
+    "$SOURCE_DIR/deno" \
+    "$SOURCE_DIR/ffmpeg" \
+    "$SOURCE_DIR/aria2c" \
+    "$SOURCE_DIR/aria2-libs" 2>/dev/null || true
+fi
+
+echo "Media engines are ready:"
+echo "  yt-dlp $YTDLP_VERSION"
+echo "  Deno $DENO_VERSION"
+echo "  FFmpeg $FFMPEG_VERSION"
+echo "  aria2 $ARIA2_VERSION (Homebrew bottle revision $ARIA2_BOTTLE_REVISION)"

Scripts/verify.sh

@@ -4,6 +4,25 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT_DIR"
 
+"$ROOT_DIR/Scripts/fetch_media_engines.sh"
+
+ARIA2C="$ROOT_DIR/Sources/Firelink/aria2c"
+ARIA2_LIBS="$ROOT_DIR/Sources/Firelink/aria2-libs"
+test -x "$ARIA2C"
+test -f "$ROOT_DIR/Sources/Firelink/aria2-cacert.pem"
+test -d "$ARIA2_LIBS"
+"$ARIA2C" --version | grep -q '^aria2 version 1.37.0$'
+test "$(tr -d '[:space:]' < "$ROOT_DIR/Sources/Firelink/aria2-version.txt")" = "1.37.0-2-arm64-sonoma"
+lipo -archs "$ARIA2C" | grep -qx arm64
+vtool -show-build "$ARIA2C" | grep -q 'minos 14.0'
+for library in "$ARIA2_LIBS"/*.dylib; do
+  lipo -archs "$library" | grep -qx arm64
+done
+if otool -L "$ARIA2C" "$ARIA2_LIBS"/*.dylib | grep -Eq '(@@HOMEBREW|/opt/homebrew|/usr/local)'; then
+  echo "Bundled aria2 runtime contains a non-portable dependency path." >&2
+  exit 1
+fi
+
 swift build
 git diff --check
 python3 -m json.tool Extensions/Firefox/manifest.json >/dev/null

Sources/Firelink/AddDownloadsView.swift

@@ -322,10 +322,18 @@ struct AddDownloadsView: View {
                         ProgressView().controlSize(.small)
                         Text("Fetching media options...")
                             .foregroundStyle(.secondary)
-                    } else if case .failed(_) = firstMedia.state {
-                        Image(systemName: "exclamationmark.triangle.fill").foregroundStyle(.red)
-                        Text("Failed to load options.")
-                            .foregroundStyle(.secondary)
+                    } else if case .failed(let errorMsg) = firstMedia.state {
+                        VStack(alignment: .leading, spacing: 4) {
+                            HStack(spacing: 8) {
+                                Image(systemName: "exclamationmark.triangle.fill").foregroundStyle(.red)
+                                Text("Failed to load options.")
+                                    .foregroundStyle(.secondary)
+                            }
+                            Text(errorMsg)
+                                .font(.caption)
+                                .foregroundStyle(.red)
+                                .lineLimit(3)
+                        }
                     } else {
                         ProgressView().controlSize(.small)
                         Text("Waiting for metadata...")
@@ -425,6 +433,9 @@ struct AddDownloadsView: View {
                             .background(.quaternary.opacity(0.35))
                             .clipShape(RoundedRectangle(cornerRadius: 8))
                             .frame(minHeight: 48)
+                            .onChange(of: headerText) { _, newValue in
+                                if newValue.count > 65536 { headerText = String(newValue.prefix(65536)) }
+                            }
                     }
 
                     VStack(alignment: .leading, spacing: 4) {
@@ -432,6 +443,9 @@ struct AddDownloadsView: View {
                         TextField("name=value; other=value", text: $cookieText)
                             .textFieldStyle(.roundedBorder)
                             .font(.system(.callout, design: .monospaced))
+                            .onChange(of: cookieText) { _, newValue in
+                                if newValue.count > 65536 { cookieText = String(newValue.prefix(65536)) }
+                            }
                     }
 
                     VStack(alignment: .leading, spacing: 4) {
@@ -442,6 +456,9 @@ struct AddDownloadsView: View {
                             .background(.quaternary.opacity(0.35))
                             .clipShape(RoundedRectangle(cornerRadius: 8))
                             .frame(minHeight: 48)
+                            .onChange(of: mirrorText) { _, newValue in
+                                if newValue.count > 65536 { mirrorText = String(newValue.prefix(65536)) }
+                            }
                     }
                 }
                 .padding(.top, 8)
@@ -709,6 +726,7 @@ struct AddDownloadsView: View {
                 case .replace:
                     let destURL = overrideDirectory ?? finalDownloads[index].defaultDirectory
                     let path = destURL.appendingPathComponent(finalDownloads[index].fileName).path
+                    guard URL(fileURLWithPath: path).standardized.path.hasPrefix(destURL.standardized.path) else { continue }
                     if let existingIndex = controller.downloads.firstIndex(where: { ($0.destinationPath == path || $0.url == finalDownloads[index].url) && $0.status != .canceled }) {
                         controller.delete(controller.downloads[existingIndex], deleteFiles: true)
                     } else if FileManager.default.fileExists(atPath: path) {

Sources/Firelink/AppSettings.swift

@@ -298,13 +298,15 @@ final class AppSettings: ObservableObject {
         }
 
         if granted {
-            if let token = KeychainCredentialStore.extensionToken() {
-                extensionPairingToken = token
-            } else {
-                extensionPairingToken = Self.generateSecureToken()
-            }
             if needsPrimer {
                 showKeychainPrimer = true
+                extensionPairingToken = ""
+            } else {
+                if let token = KeychainCredentialStore.extensionToken() {
+                    extensionPairingToken = token
+                } else {
+                    extensionPairingToken = Self.generateSecureToken()
+                }
             }
         } else {
             extensionPairingToken = ""

Sources/Firelink/Aria2DownloadEngine.swift

@@ -10,18 +10,43 @@ final class Aria2DownloadEngine: Sendable {
         let cancel: @Sendable () -> Void
     }
 
-    static func findFreePort() -> UInt16 {
-        var port: UInt16 = 6800
-        let parameters = NWParameters.tcp
-        for p in 6800...6900 {
-            parameters.requiredLocalEndpoint = .hostPort(host: .ipv4(.loopback), port: NWEndpoint.Port(rawValue: UInt16(p))!)
-            if let listener = try? NWListener(using: parameters) {
-                listener.cancel()
-                port = UInt16(p)
-                break
+    static func findFreePort() -> (UInt16, Int32)? {
+        var addr = sockaddr_in()
+        addr.sin_len = UInt8(MemoryLayout<sockaddr_in>.size)
+        addr.sin_family = sa_family_t(AF_INET)
+        addr.sin_addr.s_addr = inet_addr("127.0.0.1")
+        addr.sin_port = 0
+
+        let sock = socket(AF_INET, SOCK_STREAM, 0)
+        guard sock >= 0 else { return nil }
+
+        var addrPtr = addr
+        let bindResult = withUnsafePointer(to: &addrPtr) { ptr in
+            ptr.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                bind(sock, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
             }
         }
-        return port
+
+        guard bindResult == 0 else {
+            close(sock)
+            return nil
+        }
+
+        var boundAddr = sockaddr_in()
+        var len = socklen_t(MemoryLayout<sockaddr_in>.size)
+        let getsocknameResult = withUnsafeMutablePointer(to: &boundAddr) { ptr in
+            ptr.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                getsockname(sock, $0, &len)
+            }
+        }
+
+        guard getsocknameResult == 0 else {
+            close(sock)
+            return nil
+        }
+
+        let port = UInt16(bigEndian: boundAddr.sin_port)
+        return (port, sock)
     }
 
     enum EngineError: LocalizedError {
@@ -32,7 +57,7 @@ final class Aria2DownloadEngine: Sendable {
         var errorDescription: String? {
             switch self {
             case .executableNotFound:
-                "aria2c was not found. Install it with `brew install aria2`, or bundle aria2c inside the app resources."
+                "The bundled aria2c runtime is missing. Reinstall Firelink or rebuild its media engines."
             case .launchFailed(let details):
                 "Could not start aria2c: \(details)"
             case .unsupportedProxy(let details):
@@ -48,20 +73,30 @@ final class Aria2DownloadEngine: Sendable {
     }
 
     static func findExecutable() -> URL? {
-        if let bundled = Bundle.main.url(forResource: "aria2c", withExtension: nil),
-           FileManager.default.isExecutableFile(atPath: bundled.path) {
+        bundledResource(named: "aria2c", executable: true)
+    }
+
+    static func certificateBundleURL() -> URL? {
+        bundledResource(named: "aria2-cacert.pem", executable: false)
+    }
+
+    private static func bundledResource(named name: String, executable: Bool) -> URL? {
+        func validResource(in bundle: Bundle) -> URL? {
+            guard let url = bundle.resourceURL?.appendingPathComponent(name) else { return nil }
+            let isValid = executable
+                ? FileManager.default.isExecutableFile(atPath: url.path)
+                : FileManager.default.fileExists(atPath: url.path)
+            return isValid ? url : nil
+        }
+
+        if let bundled = validResource(in: .main) {
             return bundled
         }
 
-        let candidates = [
-            "/opt/homebrew/bin/aria2c",
-            "/usr/local/bin/aria2c",
-            "/usr/bin/aria2c",
-            "/opt/local/bin/aria2c"
-        ]
-
-        if let found = candidates.first(where: { FileManager.default.isExecutableFile(atPath: $0) }) {
-            return URL(fileURLWithPath: found)
+        if Bundle.main.bundleURL.pathExtension.lowercased() != "app" {
+            #if SWIFT_PACKAGE
+            return validResource(in: .module)
+            #endif
         }
 
         return nil
@@ -120,13 +155,36 @@ final class Aria2DownloadEngine: Sendable {
         var lastError: Error?
 
         for _ in 1...5 {
-            let rpcPort = Int(Self.findFreePort())
+            guard let (rpcPortVal, portSocket) = Self.findFreePort() else {
+                lastError = EngineError.launchFailed("Could not find free port")
+                continue
+            }
+            let rpcPort = Int(rpcPortVal)
             let rpcSecret = UUID().uuidString
             let tempDir = URL(fileURLWithPath: NSTemporaryDirectory()).appendingPathComponent("firelink-aria2-\(UUID().uuidString)")
             
+            final class CleanupState: @unchecked Sendable {
+                private let lock = NSLock()
+                private var didCleanup = false
+                func cleanup(tempDir: URL) {
+                    lock.lock()
+                    defer { lock.unlock() }
+                    if !didCleanup {
+                        try? FileManager.default.removeItem(at: tempDir)
+                        didCleanup = true
+                    }
+                }
+            }
+            
+            let cleanupState = CleanupState()
+            let cleanupTempDir: @Sendable () -> Void = {
+                cleanupState.cleanup(tempDir: tempDir)
+            }
+            
             do {
                 try FileManager.default.createDirectory(at: tempDir, withIntermediateDirectories: true, attributes: [.posixPermissions: 0o700])
             } catch {
+                close(portSocket)
                 lastError = EngineError.launchFailed("Could not create secure temporary directory: \(error.localizedDescription)")
                 continue
             }
@@ -135,7 +193,9 @@ final class Aria2DownloadEngine: Sendable {
             do {
                 let confContent = "rpc-secret=\(rpcSecret)\n"
                 try confContent.write(to: confURL, atomically: true, encoding: .utf8)
+                try FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: confURL.path)
             } catch {
+                close(portSocket)
                 lastError = EngineError.launchFailed("Could not write secure configuration file: \(error.localizedDescription)")
                 continue
             }
@@ -152,6 +212,7 @@ final class Aria2DownloadEngine: Sendable {
                     confURL: confURL
                 )
             } catch {
+                close(portSocket)
                 lastError = error
                 break
             }
@@ -187,7 +248,7 @@ final class Aria2DownloadEngine: Sendable {
         }
 
         process.terminationHandler = { finishedProcess in
-            try? FileManager.default.removeItem(at: tempDir)
+            cleanupTempDir()
             completionMonitor.cancel()
             outputPipe.fileHandleForReading.readabilityHandler = nil
             errorPipe.fileHandleForReading.readabilityHandler = nil
@@ -210,6 +271,7 @@ final class Aria2DownloadEngine: Sendable {
 
             var didThrow = false
             do {
+                close(portSocket)
                 try process.run()
                 if let input = inputFileContent(for: item).data(using: .utf8) {
                     inputPipe.fileHandleForWriting.write(input)
@@ -223,7 +285,7 @@ final class Aria2DownloadEngine: Sendable {
             if didThrow {
                 outputPipe.fileHandleForReading.readabilityHandler = nil
                 errorPipe.fileHandleForReading.readabilityHandler = nil
-                try? FileManager.default.removeItem(at: tempDir)
+                cleanupTempDir()
                 continue
             }
             
@@ -232,7 +294,7 @@ final class Aria2DownloadEngine: Sendable {
             if !process.isRunning {
                 let stderr = String(data: errorBuffer.data, encoding: .utf8) ?? ""
                 if stderr.contains("Address already in use") || stderr.contains("Failed to bind") || stderr.contains("bind: Address") {
-                    try? FileManager.default.removeItem(at: tempDir)
+                    cleanupTempDir()
                     continue
                 }
                 // If it exited for another reason, we might still want to fail or let the terminationHandler process it.
@@ -251,9 +313,9 @@ final class Aria2DownloadEngine: Sendable {
             return Handle(processIdentifier: process.processIdentifier, rpcPort: rpcPort, rpcSecret: rpcSecret) {
                 completionMonitor.cancel()
                 if process.isRunning {
-                    process.terminate()
+                    ProcessTreeTerminator.terminate(process)
                 }
-                try? FileManager.default.removeItem(at: tempDir)
+                cleanupTempDir()
             }
         }
         
@@ -271,7 +333,7 @@ final class Aria2DownloadEngine: Sendable {
                 if await completedDownloadStatus(rpcPort: rpcPort, rpcSecret: rpcSecret) {
                     completionGate.complete(.success(()))
                     if process.isRunning {
-                        process.terminate()
+                        ProcessTreeTerminator.terminate(process)
                     }
                     return
                 }
@@ -397,6 +459,10 @@ final class Aria2DownloadEngine: Sendable {
             arguments.append("--max-overall-download-limit=\(speedLimitKiBPerSecond)K")
         }
 
+        if let certificateBundleURL = Self.certificateBundleURL() {
+            arguments.append("--ca-certificate=\(certificateBundleURL.path)")
+        }
+
         arguments.append(contentsOf: try proxyArguments(for: item, configuration: proxyConfiguration))
         return arguments
     }

Sources/Firelink/DownloadController.swift

@@ -129,7 +129,7 @@ final class DownloadController: ObservableObject {
         }
     }
 
-    func add(urlText: String, connectionsPerServer: Int? = nil, queueID: UUID = DownloadQueue.mainQueueID) {
+    func add(urlText: String, connectionsPerServer: Int? = nil, queueID: UUID = DownloadQueue.mainQueueID, filename: String? = nil) {
         guard let url = URL(string: urlText.trimmingCharacters(in: .whitespacesAndNewlines)),
               let scheme = url.scheme?.lowercased(),
               ["http", "https", "ftp", "sftp"].contains(scheme) else {
@@ -137,11 +137,12 @@ final class DownloadController: ObservableObject {
             return
         }
 
-        let fileName = FileClassifier.fileName(from: url)
-        let category = FileClassifier.category(forFileName: fileName)
+        let explicitName = filename?.trimmingCharacters(in: .whitespacesAndNewlines)
+        let resolvedFileName = (explicitName != nil && !explicitName!.isEmpty) ? explicitName! : FileClassifier.fileName(from: url)
+        let category = FileClassifier.category(forFileName: resolvedFileName)
         let item = DownloadItem(
             url: url,
-            fileName: fileName,
+            fileName: resolvedFileName,
             category: category,
             destinationDirectory: settings.destinationDirectory(for: category),
             connectionsPerServer: min(max(connectionsPerServer ?? settings.perServerConnections, 1), 16),
@@ -154,7 +155,7 @@ final class DownloadController: ObservableObject {
         }
 
         downloads.append(item)
-        engineMessage = "Added \(fileName) to \(category.rawValue)."
+        engineMessage = "Added \(resolvedFileName) to \(category.rawValue)."
         saveDownloads()
     }
 
@@ -471,7 +472,7 @@ final class DownloadController: ObservableObject {
         }
 
         guard hasRunnableQueuedDownload else {
-            engineMessage = "aria2c is not installed. Run `brew install aria2` to enable downloads."
+            engineMessage = "The bundled aria2c runtime is missing. Reinstall Firelink or rebuild its media engines."
             return
         }
 
@@ -545,7 +546,7 @@ final class DownloadController: ObservableObject {
                         progress: { [weak self] progress in
                             Task { @MainActor in
                                 let now = Date()
-                                if let last = self?.lastProgressUpdateTimes[item.id], now.timeIntervalSince(last) < 0.25 {
+                                if let last = self?.lastProgressUpdateTimes[item.id], now.timeIntervalSince(last) < 0.5 {
                                     return
                                 }
                                 self?.lastProgressUpdateTimes[item.id] = now
@@ -603,7 +604,7 @@ final class DownloadController: ObservableObject {
                         progress: { [weak self] progress in
                             Task { @MainActor in
                                 let now = Date()
-                                if let last = self?.lastProgressUpdateTimes[item.id], now.timeIntervalSince(last) < 0.25 {
+                                if let last = self?.lastProgressUpdateTimes[item.id], now.timeIntervalSince(last) < 0.5 {
                                     return
                                 }
                                 self?.lastProgressUpdateTimes[item.id] = now

Sources/Firelink/DownloadMetadataFetcher.swift

@@ -54,7 +54,7 @@ enum DownloadMetadataFetcher {
             return pending
         }
 
-        if isAutoFetch, let host = url.host {
+        if let host = url.host {
             let isPrivate = await Task.detached {
                 isPrivateHost(host)
             }.value

Sources/Firelink/DownloadTable.swift

@@ -363,6 +363,12 @@ struct DownloadTable: View {
             } label: {
                 Label(targetItems.count > 1 ? "Properties (\(targetItems.count))" : "Properties", systemImage: "info.circle")
             }
+        } else {
+            Button {
+                openWindow(id: "add-downloads")
+            } label: {
+                Label("Add Download", systemImage: "plus")
+            }
         }
     }
 

Sources/Firelink/FirelinkApp.swift

@@ -7,6 +7,8 @@ struct FirelinkApp: App {
     @StateObject private var controller: DownloadController
     @StateObject private var schedulerController: SchedulerController
     @AppStorage("showMenuBarIcon") private var showMenuBarIcon = true
+    @State private var lastURLSchemeInvocation: Date = .distantPast
+    @State private var urlSchemeInvocationCount: Int = 0
 
     // Server must be retained to keep listening
     private let extensionServer: LocalExtensionServer?
@@ -36,13 +38,23 @@ struct FirelinkApp: App {
                 .modifier(AppFontSizeModifier(fontSize: settings.appFontSize))
                 .task {
                     updateChecker.checkAutomaticallyIfNeeded()
+                    _ = await MediaEngineManager.shared.preparedBinaryPath(for: .ytDlp)
                 }
                 .onOpenURL { url in
+                    let now = Date()
+                    if now.timeIntervalSince(lastURLSchemeInvocation) > 5 {
+                        urlSchemeInvocationCount = 0
+                    }
+                    guard urlSchemeInvocationCount < 3 else { return }
+                    urlSchemeInvocationCount += 1
+                    lastURLSchemeInvocation = now
+
                     if url.scheme == "firelink" {
                         if url.host == "add",
                            let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
                            let queryItems = components.queryItems,
-                           let link = queryItems.first(where: { $0.name == "url" })?.value {
+                           let link = queryItems.first(where: { $0.name == "url" })?.value,
+                           link.count < 65536 {
                             DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
                                 controller.pendingPasteboardText = link
                                 controller.pendingReferer = nil
@@ -52,6 +64,7 @@ struct FirelinkApp: App {
                         return
                     }
                     
+                    guard url.absoluteString.count < 65536 else { return }
                     DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
                         controller.pendingPasteboardText = url.absoluteString
                         controller.pendingReferer = nil

Sources/Firelink/LocalExtensionServer.swift

@@ -2,13 +2,13 @@ import Foundation
 import Network
 import AppKit
 import Combine
+import CryptoKit
 
 final class LocalExtensionServer: @unchecked Sendable {
     private enum Constants {
         static let portRange = 6412...6422
         static let maxRequestBytes = 128 * 1024
         static let maxURLCount = 200
-        static let extensionRequestHeader = "x-firelink-extension"
         static let allowedSchemes = Set(["http", "https", "ftp", "sftp"])
     }
 
@@ -126,7 +126,7 @@ final class LocalExtensionServer: @unchecked Sendable {
             headers.append("Access-Control-Allow-Origin: \(origin)")
             headers.append("Vary: Origin")
             headers.append("Access-Control-Allow-Methods: GET, POST, OPTIONS")
-            headers.append("Access-Control-Allow-Headers: Content-Type, X-Firelink-Extension")
+            headers.append("Access-Control-Allow-Headers: Content-Type, X-Firelink-Signature, X-Firelink-Timestamp")
         }
 
         let response = headers.joined(separator: "\r\n") + "\r\n\r\n"
@@ -156,8 +156,29 @@ final class LocalExtensionServer: @unchecked Sendable {
         }
 
         let expectedToken = currentPairingToken
-        guard let token = request.header(named: Constants.extensionRequestHeader),
-              token == expectedToken else {
+        guard !expectedToken.isEmpty else {
+            return .forbidden
+        }
+        
+        let bodyString = String(data: request.body, encoding: .utf8) ?? ""
+        guard let signatureHex = request.header(named: "x-firelink-signature"),
+              let timestampStr = request.header(named: "x-firelink-timestamp"),
+              let timestamp = TimeInterval(timestampStr) else {
+            return .forbidden
+        }
+
+        let now = Date().timeIntervalSince1970 * 1000
+        guard abs(now - timestamp) < 60000 else {
+            return .forbidden
+        }
+
+        let keyData = expectedToken.data(using: .utf8) ?? Data()
+        let key = SymmetricKey(data: keyData)
+        let messageData = (timestampStr + bodyString).data(using: .utf8) ?? Data()
+        let hmac = HMAC<SHA256>.authenticationCode(for: messageData, using: key)
+        let expectedSignature = hmac.map { String(format: "%02x", $0) }.joined()
+
+        guard signatureHex.lowercased() == expectedSignature else {
             return .forbidden
         }
 
@@ -180,6 +201,8 @@ final class LocalExtensionServer: @unchecked Sendable {
         struct Payload: Decodable {
             let urls: [String]
             let referer: String?
+            let silent: Bool?
+            let filename: String?
         }
 
         do {
@@ -201,14 +224,15 @@ final class LocalExtensionServer: @unchecked Sendable {
             }
 
             Task { @MainActor in
-                if self.settings.askWhereToSaveEachFile {
+                let shouldAsk = self.settings.askWhereToSaveEachFile || payload.silent != true
+                if shouldAsk {
                     self.downloadController.pendingPasteboardText = validURLs.joined(separator: "\n")
                     self.downloadController.pendingReferer = payload.referer
                     NotificationCenter.default.post(name: NSNotification.Name("OpenAddDownloadsWindow"), object: nil)
                     NSApp.activate(ignoringOtherApps: true)
                 } else {
                     for validURL in validURLs {
-                        self.downloadController.add(urlText: validURL)
+                        self.downloadController.add(urlText: validURL, filename: payload.filename)
                     }
                     self.downloadController.startQueue()
                 }

Sources/Firelink/MediaDownloadEngine.swift

@@ -26,7 +26,7 @@ final class MediaDownloadEngine: @unchecked Sendable {
         messageUpdate: @escaping @Sendable (String) -> Void,
         completion: @escaping @Sendable (Result<URL, Error>) -> Void
     ) async throws -> Handle {
-        let ytDlpURL = await MediaEngineManager.shared.binaryPath(for: .ytDlp)
+        let ytDlpURL = await MediaEngineManager.shared.preparedBinaryPath(for: .ytDlp)
         let ffmpegURL = await MediaEngineManager.shared.binaryPath(for: .ffmpeg)
 
         guard let ytDlpURL, FileManager.default.isExecutableFile(atPath: ytDlpURL.path) else {
@@ -44,9 +44,13 @@ final class MediaDownloadEngine: @unchecked Sendable {
         var arguments = [
             "--newline",
             "--ffmpeg-location", ffmpegURL.path,
-            "--force-ipv4",
-            "--live-from-start",
-            "--extractor-args", "youtube:player_client=ios,web",
+            "--no-check-formats",
+            "--socket-timeout", "20",
+            "--retries", "3",
+            "--extractor-retries", "3",
+            "--fragment-retries", "10",
+            "--retry-sleep", "0",
+            "--skip-unavailable-fragments",
             "--compat-options", "no-youtube-unavailable-videos",
             "-o", item.destinationPath
         ]
@@ -64,11 +68,12 @@ final class MediaDownloadEngine: @unchecked Sendable {
             }
         }
 
-        MediaExtractionEngine.appendCommonArguments(
+        let tempConfigDir = MediaExtractionEngine.appendCommonArguments(
             to: &arguments,
             cookieSource: cookieSource,
             credentials: item.credentials,
-            transferOptions: item.transferOptions
+            transferOptions: item.transferOptions,
+            preferredDenoURL: ytDlpURL.deletingLastPathComponent().appendingPathComponent("deno")
         )
 
         if let proxyURI = proxyConfiguration.customProxyURI, proxyConfiguration.mode == .custom {
@@ -79,7 +84,11 @@ final class MediaDownloadEngine: @unchecked Sendable {
             arguments.append(contentsOf: ["--limit-rate", "\(speedLimitKiBPerSecond)K"])
         }
 
-        appendParallelDownloadArguments(to: &arguments, connectionsPerServer: item.connectionsPerServer)
+        appendParallelDownloadArguments(
+            to: &arguments,
+            item: item,
+            speedLimitKiBPerSecond: speedLimitKiBPerSecond
+        )
 
         arguments.append(item.url.absoluteString)
         process.arguments = arguments
@@ -100,19 +109,25 @@ final class MediaDownloadEngine: @unchecked Sendable {
             messageUpdate: messageUpdate
         )
 
+        let readGroup = DispatchGroup()
+
+        readGroup.enter()
         outputPipe.fileHandleForReading.readabilityHandler = { handle in
             let data = handle.availableData
             if data.isEmpty {
                 handle.readabilityHandler = nil
+                readGroup.leave()
             } else if let text = String(data: data, encoding: .utf8) {
                 outputHandler.handle(text)
             }
         }
 
+        readGroup.enter()
         errorPipe.fileHandleForReading.readabilityHandler = { handle in
             let data = handle.availableData
             if data.isEmpty {
                 handle.readabilityHandler = nil
+                readGroup.leave()
             } else {
                 errorBuffer.append(data)
                 if let text = String(data: data, encoding: .utf8) {
@@ -122,25 +137,40 @@ final class MediaDownloadEngine: @unchecked Sendable {
         }
 
         process.terminationHandler = { finishedProcess in
-            outputPipe.fileHandleForReading.readabilityHandler = nil
-            errorPipe.fileHandleForReading.readabilityHandler = nil
-            
-            if finishedProcess.terminationStatus == 0 {
-                completionGate.complete(.success(Self.resolvedOutputURL(for: item, tracker: outputPathTracker)))
-            } else {
-                let errorString = String(data: errorBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "Unknown Error"
-                completionGate.complete(.failure(EngineError.launchFailed(Self.cleanErrorMessage(errorString, status: finishedProcess.terminationStatus))))
+            if let tempConfigDir {
+                try? FileManager.default.removeItem(at: tempConfigDir)
+            }
+            let complete: @Sendable () -> Void = {
+                if finishedProcess.terminationStatus == 0 {
+                    completionGate.complete(.success(Self.resolvedOutputURL(for: item, tracker: outputPathTracker)))
+                } else {
+                    let errorString = String(data: errorBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "Unknown Error"
+                    completionGate.complete(.failure(EngineError.launchFailed(Self.cleanErrorMessage(errorString, status: finishedProcess.terminationStatus))))
+                }
+            }
+            readGroup.notify(queue: .global(), execute: complete)
+            DispatchQueue.global().asyncAfter(deadline: .now() + 1) {
+                outputPipe.fileHandleForReading.readabilityHandler = nil
+                errorPipe.fileHandleForReading.readabilityHandler = nil
+                complete()
             }
         }
 
+        var didRun = false
+        defer {
+            if !didRun, let tempConfigDir {
+                try? FileManager.default.removeItem(at: tempConfigDir)
+            }
+        }
         try process.run()
+        didRun = true
         messageUpdate("Fetching media data...")
         outputPipe.fileHandleForWriting.closeFile()
         errorPipe.fileHandleForWriting.closeFile()
 
         return Handle(cancel: {
             if process.isRunning {
-                process.terminate()
+                ProcessTreeTerminator.terminate(process)
             }
         })
     }
@@ -194,12 +224,37 @@ final class MediaDownloadEngine: @unchecked Sendable {
         return message
     }
 
-    private func appendParallelDownloadArguments(to arguments: inout [String], connectionsPerServer: Int) {
-        let connections = min(max(connectionsPerServer, 1), 16)
+    private func appendParallelDownloadArguments(
+        to arguments: inout [String],
+        item: DownloadItem,
+        speedLimitKiBPerSecond: Int?
+    ) {
+        let connections = min(max(item.connectionsPerServer, 1), 16)
         guard connections > 1 else { return }
 
         arguments.append(contentsOf: ["--concurrent-fragments", "\(connections)"])
-        // Use yt-dlp's native concurrent downloader instead of aria2c to ensure progress parsing works via stdout
+        let largeDirectDownloadThreshold: Int64 = 128 * 1024 * 1024
+        guard item.isAudioOnlyMedia != true,
+              (item.sizeBytes ?? 0) >= largeDirectDownloadThreshold,
+              speedLimitKiBPerSecond == nil,
+              let aria2URL = Aria2DownloadEngine.findExecutable() else {
+            return
+        }
+
+        let aria2Connections = min(connections, 8)
+        let certificateArgument = Aria2DownloadEngine.certificateBundleURL().map {
+            " --ca-certificate=\(Self.shellQuoted($0.path))"
+        } ?? ""
+        arguments.append(contentsOf: [
+            "--downloader", aria2URL.path,
+            "--downloader", "dash,m3u8:native",
+            "--downloader-args",
+            "aria2c:-x\(aria2Connections) -s\(aria2Connections) -k1M --file-allocation=none --summary-interval=1\(certificateArgument)"
+        ])
+    }
+
+    private static func shellQuoted(_ value: String) -> String {
+        "'\(value.replacingOccurrences(of: "'", with: "'\"'\"'"))'"
     }
 }
 

Sources/Firelink/MediaEngineManager.swift

@@ -1,5 +1,6 @@
 import Foundation
 import Combine
+import Darwin
 
 enum AddonState: Equatable, Sendable {
     case notInstalled
@@ -10,11 +11,13 @@ enum AddonState: Equatable, Sendable {
 enum AddonType: String, CaseIterable, Sendable {
     case ytDlp = "yt-dlp"
     case ffmpeg
+    case deno
 
     var binaryName: String {
         switch self {
         case .ytDlp: return "yt-dlp"
         case .ffmpeg: return "ffmpeg"
+        case .deno: return "deno"
         }
     }
 }
@@ -25,9 +28,35 @@ final class MediaEngineManager: ObservableObject {
 
     @Published var ytDlpState: AddonState = .notInstalled
     @Published var ffmpegState: AddonState = .notInstalled
+    @Published var denoState: AddonState = .notInstalled
+    private var ytDlpPreparationTask: Task<URL?, Never>?
 
     private init() {
         checkLocalInstallation()
+        Task { [weak self] in
+            _ = await self?.preparedBinaryPath(for: .ytDlp)
+        }
+    }
+
+    func preparedBinaryPath(for addon: AddonType) async -> URL? {
+        guard addon == .ytDlp else { return binaryPath(for: addon) }
+
+        if let ytDlpPreparationTask {
+            return await ytDlpPreparationTask.value
+        }
+
+        guard let bundledURL = binaryPath(for: .ytDlp) else { return nil }
+        let runtimeVersion = bundledRuntimeVersion(near: bundledURL)
+        let task = Task<URL?, Never>.detached(priority: .userInitiated) {
+            let executableURL = Self.installStableYtDlpRuntime(
+                bundledExecutableURL: bundledURL,
+                version: runtimeVersion
+            ) ?? bundledURL
+            Self.prewarm(executableURL)
+            return executableURL
+        }
+        ytDlpPreparationTask = task
+        return await task.value
     }
 
     func binaryPath(for addon: AddonType) -> URL? {
@@ -48,6 +77,144 @@ final class MediaEngineManager: ObservableObject {
         return nil
     }
 
+    private func bundledRuntimeVersion(near executableURL: URL) -> String {
+        let versionURL = executableURL.deletingLastPathComponent()
+            .appendingPathComponent("yt-dlp-version.txt")
+        if let version = try? String(contentsOf: versionURL, encoding: .utf8)
+            .trimmingCharacters(in: .whitespacesAndNewlines),
+           !version.isEmpty {
+            return version
+        }
+
+        return Bundle.main.object(forInfoDictionaryKey: "CFBundleVersion") as? String ?? "unknown"
+    }
+
+    nonisolated private static func installStableYtDlpRuntime(
+        bundledExecutableURL: URL,
+        version: String
+    ) -> URL? {
+        let fileManager = FileManager.default
+        let bundledDirectory = bundledExecutableURL.deletingLastPathComponent()
+        let bundledInternalURL = bundledDirectory.appendingPathComponent("_internal", isDirectory: true)
+        let bundledDenoURL = bundledDirectory.appendingPathComponent("deno")
+        let hasBundledDeno = fileManager.isExecutableFile(atPath: bundledDenoURL.path)
+
+        guard fileManager.fileExists(atPath: bundledInternalURL.path) else {
+            return bundledExecutableURL
+        }
+
+        guard let applicationSupportURL = fileManager.urls(
+            for: .applicationSupportDirectory,
+            in: .userDomainMask
+        ).first else {
+            return bundledExecutableURL
+        }
+
+        let safeVersion = version.replacingOccurrences(
+            of: #"[^A-Za-z0-9._-]"#,
+            with: "_",
+            options: .regularExpression
+        )
+        let enginesURL = applicationSupportURL
+            .appendingPathComponent("Firelink", isDirectory: true)
+            .appendingPathComponent("MediaEngines", isDirectory: true)
+            .appendingPathComponent("yt-dlp", isDirectory: true)
+        let runtimeURL = enginesURL.appendingPathComponent(safeVersion, isDirectory: true)
+        let executableURL = runtimeURL.appendingPathComponent("yt-dlp")
+        let internalURL = runtimeURL.appendingPathComponent("_internal", isDirectory: true)
+        let denoURL = runtimeURL.appendingPathComponent("deno")
+
+        if fileManager.isExecutableFile(atPath: executableURL.path),
+           fileManager.fileExists(atPath: internalURL.path),
+           !hasBundledDeno || fileManager.isExecutableFile(atPath: denoURL.path) {
+            return executableURL
+        }
+
+        let temporaryURL = enginesURL.appendingPathComponent(
+            ".install-\(UUID().uuidString)",
+            isDirectory: true
+        )
+
+        do {
+            try fileManager.createDirectory(at: enginesURL, withIntermediateDirectories: true)
+            try fileManager.createDirectory(at: temporaryURL, withIntermediateDirectories: true)
+            try fileManager.copyItem(
+                at: bundledExecutableURL,
+                to: temporaryURL.appendingPathComponent("yt-dlp")
+            )
+            try fileManager.copyItem(
+                at: bundledInternalURL,
+                to: temporaryURL.appendingPathComponent("_internal", isDirectory: true)
+            )
+            if hasBundledDeno {
+                try fileManager.copyItem(
+                    at: bundledDenoURL,
+                    to: temporaryURL.appendingPathComponent("deno")
+                )
+            }
+            removeTransportAttributesRecursively(at: temporaryURL)
+
+            if fileManager.fileExists(atPath: runtimeURL.path) {
+                try fileManager.removeItem(at: runtimeURL)
+            }
+            try fileManager.moveItem(at: temporaryURL, to: runtimeURL)
+            return executableURL
+        } catch {
+            try? fileManager.removeItem(at: temporaryURL)
+            return bundledExecutableURL
+        }
+    }
+
+    nonisolated private static func removeTransportAttributesRecursively(at rootURL: URL) {
+        removeTransportAttributes(at: rootURL)
+
+        guard let enumerator = FileManager.default.enumerator(
+            at: rootURL,
+            includingPropertiesForKeys: nil,
+            options: [],
+            errorHandler: nil
+        ) else {
+            return
+        }
+
+        for case let itemURL as URL in enumerator {
+            removeTransportAttributes(at: itemURL)
+        }
+    }
+
+    nonisolated private static func removeTransportAttributes(at url: URL) {
+        url.withUnsafeFileSystemRepresentation { path in
+            guard let path else { return }
+            removexattr(path, "com.apple.quarantine", 0)
+            removexattr(path, "com.apple.provenance", 0)
+        }
+    }
+
+    nonisolated private static func prewarm(_ executableURL: URL) {
+        runVersionCommand(executableURL)
+
+        let denoURL = executableURL.deletingLastPathComponent().appendingPathComponent("deno")
+        if FileManager.default.isExecutableFile(atPath: denoURL.path) {
+            runVersionCommand(denoURL)
+        }
+    }
+
+    nonisolated private static func runVersionCommand(_ executableURL: URL) {
+        let process = Process()
+        process.executableURL = executableURL
+        process.arguments = ["--version"]
+        process.standardOutput = nil
+        process.standardError = nil
+        process.standardInput = nil
+
+        do {
+            try process.run()
+            process.waitUntilExit()
+        } catch {
+            return
+        }
+    }
+
     func checkLocalInstallation() {
         for addon in AddonType.allCases {
             if binaryPath(for: addon) != nil {
@@ -82,6 +249,7 @@ final class MediaEngineManager: ObservableObject {
         switch addon {
         case .ytDlp: return ytDlpState
         case .ffmpeg: return ffmpegState
+        case .deno: return denoState
         }
     }
 
@@ -89,6 +257,7 @@ final class MediaEngineManager: ObservableObject {
         switch addon {
         case .ytDlp: ytDlpState = state
         case .ffmpeg: ffmpegState = state
+        case .deno: denoState = state
         }
     }
 }

Sources/Firelink/MediaExtractionEngine.swift

@@ -47,7 +47,19 @@ struct CleanFormatOption: Identifiable, Equatable, Sendable {
 }
 
 enum MediaExtractionEngine {
-    private static let metadataTimeoutSeconds: UInt64 = 75
+    private final class CacheEntry {
+        let metadata: MediaMetadata
+        let options: [CleanFormatOption]
+        let date: Date
+        init(metadata: MediaMetadata, options: [CleanFormatOption], date: Date) {
+            self.metadata = metadata
+            self.options = options
+            self.date = date
+        }
+    }
+    nonisolated(unsafe) private static let metadataCache = NSCache<NSURL, CacheEntry>()
+
+    private static let metadataTimeoutSeconds: UInt64 = 120
 
     enum ExtractionError: Error, LocalizedError {
         case processFailed(String)
@@ -72,27 +84,47 @@ enum MediaExtractionEngine {
         transferOptions: DownloadTransferOptions,
         proxyConfiguration: DownloadProxyConfiguration
     ) async throws -> (MediaMetadata, [CleanFormatOption]) {
-        guard let ytDlpURL = await MediaEngineManager.shared.binaryPath(for: .ytDlp),
+        if let cached = metadataCache.object(forKey: url as NSURL), Date().timeIntervalSince(cached.date) < 300 {
+            return (cached.metadata, cached.options)
+        }
+        guard let ytDlpURL = await MediaEngineManager.shared.preparedBinaryPath(for: .ytDlp),
               FileManager.default.isExecutableFile(atPath: ytDlpURL.path) else {
             throw ExtractionError.processFailed("yt-dlp binary not found.")
         }
         let ytDlpPath = ytDlpURL.path
 
         var args = [
-            "-J", 
-            "--no-warnings", 
-            "--ignore-no-formats-error", 
-            "--no-playlist", 
-            "--force-ipv4",
-            "--extractor-args", "youtube:player_client=ios,web",
+            "-J",
+            "--no-warnings",
+            "--no-playlist",
+            "--no-check-formats",
+            "--socket-timeout", "20",
+            "--retries", "3",
+            "--extractor-retries", "3",
             "--compat-options", "no-youtube-unavailable-videos"
         ]
 
+        if let ffmpegURL = await MediaEngineManager.shared.binaryPath(for: .ffmpeg),
+           FileManager.default.isExecutableFile(atPath: ffmpegURL.path) {
+            args.append(contentsOf: ["--ffmpeg-location", ffmpegURL.path])
+        }
+
         if let proxyURI = proxyConfiguration.customProxyURI, proxyConfiguration.mode == .custom {
             args.append(contentsOf: ["--proxy", proxyURI])
         }
 
-        appendCommonArguments(to: &args, cookieSource: cookieSource, credentials: credentials, transferOptions: transferOptions)
+        let tempConfigDir = appendCommonArguments(
+            to: &args,
+            cookieSource: cookieSource,
+            credentials: credentials,
+            transferOptions: transferOptions,
+            preferredDenoURL: cachedDenoURL(near: ytDlpURL)
+        )
+        defer {
+            if let tempConfigDir {
+                try? FileManager.default.removeItem(at: tempConfigDir)
+            }
+        }
         args.append(url.absoluteString)
 
         let data = try await YTDLPMetadataProcess(
@@ -107,6 +139,7 @@ enum MediaExtractionEngine {
         do {
             let metadata = try JSONDecoder().decode(MediaMetadata.self, from: data)
             let options = extractOptions(from: metadata)
+            metadataCache.setObject(CacheEntry(metadata: metadata, options: options, date: Date()), forKey: url as NSURL)
             return (metadata, options)
         } catch {
             throw ExtractionError.parsingFailed(error)
@@ -117,13 +150,14 @@ enum MediaExtractionEngine {
         to args: inout [String],
         cookieSource: BrowserCookieSource,
         credentials: DownloadCredentials?,
-        transferOptions: DownloadTransferOptions
-    ) {
+        transferOptions: DownloadTransferOptions,
+        preferredDenoURL: URL? = nil
+    ) -> URL? {
         if let browserName = cookieSource.ytDlpBrowserName {
             args.append(contentsOf: ["--cookies-from-browser", browserName])
         }
 
-        appendJavaScriptRuntimeArguments(to: &args)
+        appendJavaScriptRuntimeArguments(to: &args, preferredDenoURL: preferredDenoURL)
 
         for header in transferOptions.requestHeaders.map(\.normalized) where !header.isEmpty {
             args.append(contentsOf: ["--add-header", header.headerLine])
@@ -134,14 +168,28 @@ enum MediaExtractionEngine {
             args.append(contentsOf: ["--add-header", "Cookie: \(cookieHeader)"])
         }
 
+        var tempConfigDir: URL?
         if let credentials, !credentials.isEmpty {
-            args.append(contentsOf: ["--username", credentials.username, "--password", credentials.password])
+            let configContent = "--username \"\(credentials.username)\"\n--password \"\(credentials.password)\"\n"
+            let tempDir = URL(fileURLWithPath: NSTemporaryDirectory()).appendingPathComponent("firelink-yt-dlp-\(UUID().uuidString)")
+            try? FileManager.default.createDirectory(at: tempDir, withIntermediateDirectories: true, attributes: [.posixPermissions: 0o700])
+            let fileURL = tempDir.appendingPathComponent("yt-dlp.conf")
+            try? configContent.write(to: fileURL, atomically: true, encoding: .utf8)
+            try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: fileURL.path)
+            args.append(contentsOf: ["--config-locations", fileURL.path])
+            tempConfigDir = tempDir
         }
+        return tempConfigDir
     }
 
-    private static func appendJavaScriptRuntimeArguments(to args: inout [String]) {
+    private static func appendJavaScriptRuntimeArguments(
+        to args: inout [String],
+        preferredDenoURL: URL?
+    ) {
         var runtimes: [String] = []
-        if let denoPath = executablePath(named: "deno", candidates: [
+        if let denoPath = executablePath(at: preferredDenoURL) ??
+            bundledExecutablePath(named: "deno") ??
+            executablePath(named: "deno", candidates: [
             "/opt/homebrew/bin/deno",
             "/usr/local/bin/deno"
         ]) {
@@ -161,6 +209,36 @@ enum MediaExtractionEngine {
         }
     }
 
+    private static func cachedDenoURL(near ytDlpURL: URL) -> URL? {
+        let denoURL = ytDlpURL.deletingLastPathComponent().appendingPathComponent("deno")
+        return FileManager.default.isExecutableFile(atPath: denoURL.path) ? denoURL : nil
+    }
+
+    private static func executablePath(at url: URL?) -> String? {
+        guard let url, FileManager.default.isExecutableFile(atPath: url.path) else {
+            return nil
+        }
+        return url.path
+    }
+
+    private static func bundledExecutablePath(named name: String) -> String? {
+        if let bundled = Bundle.main.url(forResource: name, withExtension: nil),
+           FileManager.default.isExecutableFile(atPath: bundled.path) {
+            return bundled.path
+        }
+
+        if Bundle.main.bundleURL.pathExtension.lowercased() != "app" {
+            #if SWIFT_PACKAGE
+            if let bundled = Bundle.module.url(forResource: name, withExtension: nil),
+               FileManager.default.isExecutableFile(atPath: bundled.path) {
+                return bundled.path
+            }
+            #endif
+        }
+
+        return nil
+    }
+
     private static func executablePath(named name: String, candidates: [String]) -> String? {
         var safeCandidates = candidates
         safeCandidates.append(contentsOf: [
@@ -439,30 +517,35 @@ private final class YTDLPMetadataProcess: @unchecked Sendable {
             }
 
             process.terminationHandler = { finishedProcess in
-                outputPipe.fileHandleForReading.readabilityHandler = nil
-                errorPipe.fileHandleForReading.readabilityHandler = nil
-                
-                if finishedProcess.terminationStatus == 0 {
-                    continuation.resume(returning: outputBuffer.data)
-                } else {
-                    let stderr = String(data: errorBuffer.data, encoding: .utf8)?
-                        .trimmingCharacters(in: .whitespacesAndNewlines)
-                    let stdout = String(data: outputBuffer.data, encoding: .utf8)?
-                        .trimmingCharacters(in: .whitespacesAndNewlines)
-                    let message = [stderr, stdout]
-                        .compactMap { $0 }
-                        .filter { !$0.isEmpty }
-                        .joined(separator: "\n")
-                    continuation.resume(
-                        throwing: MediaExtractionEngine.ExtractionError.processFailed(
-                            message.isEmpty ? "Exit code \(finishedProcess.terminationStatus)" : message
+                // Allow a brief moment for final pipe data to flush
+                DispatchQueue.global().asyncAfter(deadline: .now() + 0.25) {
+                    outputPipe.fileHandleForReading.readabilityHandler = nil
+                    errorPipe.fileHandleForReading.readabilityHandler = nil
+                    if finishedProcess.terminationStatus == 0 {
+                        continuation.resume(returning: outputBuffer.data)
+                    } else {
+                        let stderr = String(data: errorBuffer.data, encoding: .utf8)?
+                            .trimmingCharacters(in: .whitespacesAndNewlines)
+                        let stdout = String(data: outputBuffer.data, encoding: .utf8)?
+                            .trimmingCharacters(in: .whitespacesAndNewlines)
+                        let message = [stderr, stdout]
+                            .compactMap { $0 }
+                            .filter { !$0.isEmpty }
+                            .joined(separator: "\n")
+                        continuation.resume(
+                            throwing: MediaExtractionEngine.ExtractionError.processFailed(
+                                message.isEmpty ? "Exit code \(finishedProcess.terminationStatus)" : message
+                            )
                         )
-                    )
+                    }
                 }
             }
 
             do {
                 try process.run()
+                if Task.isCancelled {
+                    self.terminate()
+                }
                 outputPipe.fileHandleForWriting.closeFile()
                 errorPipe.fileHandleForWriting.closeFile()
             } catch {
@@ -475,10 +558,8 @@ private final class YTDLPMetadataProcess: @unchecked Sendable {
     }
 
     private func terminate() {
-        lock.withLock {
-            if let process, process.isRunning {
-                process.terminate()
-            }
-        }
+        let p = lock.withLock { self.process }
+        guard let p, p.isRunning else { return }
+        ProcessTreeTerminator.terminate(p)
     }
 }

Sources/Firelink/Models.swift

@@ -93,10 +93,9 @@ struct DownloadRequestHeader: Codable, Equatable, Sendable {
     var value: String
 
     var normalized: DownloadRequestHeader {
-        DownloadRequestHeader(
-            name: name.trimmingCharacters(in: .whitespacesAndNewlines),
-            value: value.trimmingCharacters(in: .whitespacesAndNewlines)
-        )
+        let cleanName = name.trimmingCharacters(in: .whitespacesAndNewlines).replacingOccurrences(of: "\r", with: "").replacingOccurrences(of: "\n", with: "")
+        let cleanValue = value.trimmingCharacters(in: .whitespacesAndNewlines).replacingOccurrences(of: "\r", with: "").replacingOccurrences(of: "\n", with: "")
+        return DownloadRequestHeader(name: cleanName, value: cleanValue)
     }
 
     var isEmpty: Bool {
@@ -191,6 +190,14 @@ struct DownloadItem: Identifiable, Codable, Equatable, Sendable {
     var mediaFormatSelector: String?
     var isAudioOnlyMedia: Bool?
 
+    private enum CodingKeys: String, CodingKey {
+        case id, url, fileName, category, destinationDirectory, connectionsPerServer
+        case credentials, checksum, requestHeaders, cookieHeader, mirrorURLs, speedLimitKiBPerSecond
+        case status, progress, speedText, etaText, connectionCount, sizeBytes, bytesText, message
+        case createdAt, lastTryAt, autoResumeOnLaunch, queueID
+        case mediaFormatSelector, isAudioOnlyMedia
+    }
+
     var displaySpeedText: String {
         status == .downloading ? speedText : "-"
     }

Sources/Firelink/ProcessTreeTerminator.swift

@@ -0,0 +1,53 @@
+import Foundation
+import Darwin
+
+enum ProcessTreeTerminator {
+    static func terminate(_ process: Process, forceAfter delay: TimeInterval = 0.5) {
+        let rootPID = process.processIdentifier
+        guard rootPID > 0 else { return }
+
+        let processIDs = descendants(of: rootPID) + [rootPID]
+        signal(processIDs.reversed(), with: SIGTERM)
+
+        DispatchQueue.global(qos: .utility).asyncAfter(deadline: .now() + delay) {
+            signal(processIDs.reversed(), with: SIGKILL)
+        }
+    }
+
+    private static func descendants(of rootPID: pid_t) -> [pid_t] {
+        var result: [pid_t] = []
+        var pending = directChildren(of: rootPID)
+
+        while let processID = pending.popLast() {
+            result.append(processID)
+            pending.append(contentsOf: directChildren(of: processID))
+        }
+
+        return result
+    }
+
+    private static func directChildren(of processID: pid_t) -> [pid_t] {
+        var capacity = 32
+
+        while capacity <= 4096 {
+            var processIDs = [pid_t](repeating: 0, count: capacity)
+            let count = processIDs.withUnsafeMutableBytes { buffer in
+                proc_listchildpids(processID, buffer.baseAddress, Int32(buffer.count))
+            }
+
+            guard count > 0 else { return [] }
+            if count < capacity {
+                return Array(processIDs.prefix(Int(count))).filter { $0 > 0 }
+            }
+            capacity *= 2
+        }
+
+        return []
+    }
+
+    private static func signal<S: Sequence>(_ processIDs: S, with signal: Int32) where S.Element == pid_t {
+        for processID in processIDs where processID > 0 {
+            kill(processID, signal)
+        }
+    }
+}

Sources/Firelink/Settings/AboutSettingsPane.swift

@@ -9,6 +9,7 @@ struct AboutSettingsPane: View {
     private let aria2URL = URL(string: "https://aria2.github.io/")!
     private let ytDlpURL = URL(string: "https://github.com/yt-dlp/yt-dlp")!
     private let ffmpegURL = URL(string: "https://ffmpeg.org/")!
+    private let denoURL = URL(string: "https://deno.com/")!
     private let licenseURL = URL(string: "https://github.com/nimbold/Firelink/blob/main/LICENSE")!
 
     private var appVersion: String {
@@ -80,6 +81,8 @@ struct AboutSettingsPane: View {
                             Link("yt-dlp", destination: ytDlpURL)
                             Text("•").foregroundStyle(.secondary)
                             Link("ffmpeg", destination: ffmpegURL)
+                            Text("•").foregroundStyle(.secondary)
+                            Link("Deno", destination: denoURL)
                         }
                         Spacer()
                         Link("MIT License", destination: licenseURL)

Sources/Firelink/Settings/EngineSettingsPane.swift

@@ -34,7 +34,7 @@ struct EngineSettingsPane: View {
                 Text("Core Downloader (Aria2)")
             } footer: {
                 if executableURL == nil {
-                    Text("Install aria2 with Homebrew or ensure it is bundled inside the app resources.")
+                    Text("The bundled aria2 runtime is missing. Reinstall Firelink or rebuild its media engines.")
                         .foregroundStyle(.red)
                 } else {
                     Text("Handles core HTTP/FTP and BitTorrent downloads.")
@@ -46,6 +46,8 @@ struct EngineSettingsPane: View {
 
                 addonStatusRow(title: "FFmpeg", state: engineManager.ffmpegState, path: engineManager.binaryPath(for: .ffmpeg))
 
+                addonStatusRow(title: "Deno", state: engineManager.denoState, path: engineManager.binaryPath(for: .deno))
+
                 LabeledContent("Browser Cookies") {
                     HStack {
                         Spacer()

Sources/Firelink/Settings/IntegrationSettingsPane.swift

@@ -59,7 +59,11 @@ struct IntegrationSettingsPane: View {
                             secondaryAction: {
                                 var bytes = [UInt8](repeating: 0, count: 32)
                                 let status = SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes)
-                                settings.extensionPairingToken = status == errSecSuccess ? Data(bytes).base64EncodedString() : UUID().uuidString
+                                if status == errSecSuccess {
+                                    settings.extensionPairingToken = Data(bytes).base64EncodedString()
+                                } else {
+                                    settings.extensionPairingToken = UUID().uuidString
+                                }
                             }
                         )
 

Sources/Firelink/SidebarView.swift

@@ -158,8 +158,9 @@ struct SidebarView: View {
             .tag(SidebarSelection.downloads(.category(category)))
     }
 
+    @ViewBuilder
     private func queueRow(for queue: DownloadQueue) -> some View {
-        Label(queue.name, systemImage: queue.isMain ? "list.bullet.rectangle" : "list.bullet")
+        let row = Label(queue.name, systemImage: queue.isMain ? "list.bullet.rectangle" : "list.bullet")
             .badge(controller.queueCount(for: queue.id))
             .tag(SidebarSelection.queue(queue.id))
             .onDrop(
@@ -170,17 +171,20 @@ struct SidebarView: View {
                     controller: controller
                 )
             )
-            .contextMenu {
-                if !queue.isMain {
-                    Button("Rename") {
-                        queueBeingRenamed = queue
-                        queueName = queue.name
-                    }
-                    Button("Delete", role: .destructive) {
-                        queueBeingRemoved = queue
-                    }
+            
+        if queue.isMain {
+            row
+        } else {
+            row.contextMenu {
+                Button("Rename") {
+                    queueBeingRenamed = queue
+                    queueName = queue.name
+                }
+                Button("Delete", role: .destructive) {
+                    queueBeingRemoved = queue
                 }
             }
+        }
     }
 }
 

help.txt

@@ -0,0 +1,893 @@
+Usage: yt-dlp [OPTIONS] URL [URL...]
+
+Options:
+
+  General Options:
+    -h, --help                      Print this help text and exit
+    --version                       Print program version and exit
+    -U, --update                    Check if updates are available. Auto-update
+                                    is not supported for unpackaged executables;
+                                    Re-download the latest release
+    --no-update                     Do not check for updates (default)
+    --update-to [CHANNEL]@[TAG]     Upgrade/downgrade to a specific version.
+                                    CHANNEL can be a repository as well. CHANNEL
+                                    and TAG default to "stable" and "latest"
+                                    respectively if omitted; See "UPDATE" for
+                                    details. Supported channels: stable,
+                                    nightly, master
+    -i, --ignore-errors             Ignore download and postprocessing errors.
+                                    The download will be considered successful
+                                    even if the postprocessing fails
+    --no-abort-on-error             Continue with next video on download errors;
+                                    e.g. to skip unavailable videos in a
+                                    playlist (default)
+    --abort-on-error                Abort downloading of further videos if an
+                                    error occurs (Alias: --no-ignore-errors)
+    --list-extractors               List all supported extractors and exit
+    --extractor-descriptions        Output descriptions of all supported
+                                    extractors and exit
+    --use-extractors NAMES          Extractor names to use separated by commas.
+                                    You can also use regexes, "all", "default"
+                                    and "end" (end URL matching); e.g. --ies
+                                    "holodex.*,end,youtube". Prefix the name
+                                    with a "-" to exclude it, e.g. --ies
+                                    default,-generic. Use --list-extractors for
+                                    a list of extractor names. (Alias: --ies)
+    --default-search PREFIX         Use this prefix for unqualified URLs. E.g.
+                                    "gvsearch2:python" downloads two videos from
+                                    google videos for the search term "python".
+                                    Use the value "auto" to let yt-dlp guess
+                                    ("auto_warning" to emit a warning when
+                                    guessing). "error" just throws an error. The
+                                    default value "fixup_error" repairs broken
+                                    URLs, but emits an error if this is not
+                                    possible instead of searching
+    --ignore-config                 Don't load any more configuration files
+                                    except those given to --config-locations.
+                                    For backward compatibility, if this option
+                                    is found inside the system configuration
+                                    file, the user configuration is not loaded.
+                                    (Alias: --no-config)
+    --no-config-locations           Do not load any custom configuration files
+                                    (default). When given inside a configuration
+                                    file, ignore all previous --config-locations
+                                    defined in the current file
+    --config-locations PATH         Location of the main configuration file;
+                                    either the path to the config or its
+                                    containing directory ("-" for stdin). Can be
+                                    used multiple times and inside other
+                                    configuration files
+    --plugin-dirs DIR               Path to an additional directory to search
+                                    for plugins. This option can be used
+                                    multiple times to add multiple directories.
+                                    Use "default" to search the default plugin
+                                    directories (default)
+    --no-plugin-dirs                Clear plugin directories to search,
+                                    including defaults and those provided by
+                                    previous --plugin-dirs
+    --js-runtimes RUNTIME[:PATH]    Additional JavaScript runtime to enable,
+                                    with an optional location for the runtime
+                                    (either the path to the binary or its
+                                    containing directory). This option can be
+                                    used multiple times to enable multiple
+                                    runtimes. Supported runtimes are (in order
+                                    of priority, from highest to lowest): deno,
+                                    node, quickjs, bun. Only "deno" is enabled
+                                    by default. The highest priority runtime
+                                    that is both enabled and available will be
+                                    used. In order to use a lower priority
+                                    runtime when "deno" is available, --no-js-
+                                    runtimes needs to be passed before enabling
+                                    other runtimes
+    --no-js-runtimes                Clear JavaScript runtimes to enable,
+                                    including defaults and those provided by
+                                    previous --js-runtimes
+    --remote-components COMPONENT   Remote components to allow yt-dlp to fetch
+                                    when required. This option is currently not
+                                    needed if you are using an official
+                                    executable or have the requisite version of
+                                    the yt-dlp-ejs package installed. You can
+                                    use this option multiple times to allow
+                                    multiple components. Supported values:
+                                    ejs:npm (external JavaScript components from
+                                    npm), ejs:github (external JavaScript
+                                    components from yt-dlp-ejs GitHub). By
+                                    default, no remote components are allowed
+    --no-remote-components          Disallow fetching of all remote components,
+                                    including any previously allowed by
+                                    --remote-components or defaults.
+    --flat-playlist                 Do not extract a playlist's URL result
+                                    entries; some entry metadata may be missing
+                                    and downloading may be bypassed
+    --no-flat-playlist              Fully extract the videos of a playlist
+                                    (default)
+    --live-from-start               Download livestreams from the start.
+                                    Currently experimental and only supported
+                                    for YouTube, Twitch, and TVer
+    --no-live-from-start            Download livestreams from the current time
+                                    (default)
+    --wait-for-video MIN[-MAX]      Wait for scheduled streams to become
+                                    available. Pass the minimum number of
+                                    seconds (or range) to wait between retries
+    --no-wait-for-video             Do not wait for scheduled streams (default)
+    --mark-watched                  Mark videos watched (even with --simulate)
+    --no-mark-watched               Do not mark videos watched (default)
+    --color [STREAM:]POLICY         Whether to emit color codes in output,
+                                    optionally prefixed by the STREAM (stdout or
+                                    stderr) to apply the setting to. Can be one
+                                    of "always", "auto" (default), "never", or
+                                    "no_color" (use non color terminal
+                                    sequences). Use "auto-tty" or "no_color-tty"
+                                    to decide based on terminal support only.
+                                    Can be used multiple times
+    --compat-options OPTS           Options that can help keep compatibility
+                                    with youtube-dl or youtube-dlc
+                                    configurations by reverting some of the
+                                    changes made in yt-dlp. See "Differences in
+                                    default behavior" for details
+    --alias ALIASES OPTIONS         Create aliases for an option string. Unless
+                                    an alias starts with a dash "-", it is
+                                    prefixed with "--". Arguments are parsed
+                                    according to the Python string formatting
+                                    mini-language. E.g. --alias get-audio,-X "-S
+                                    aext:{0},abr -x --audio-format {0}" creates
+                                    options "--get-audio" and "-X" that takes an
+                                    argument (ARG0) and expands to "-S
+                                    aext:ARG0,abr -x --audio-format ARG0". All
+                                    defined aliases are listed in the --help
+                                    output. Alias options can trigger more
+                                    aliases; so be careful to avoid defining
+                                    recursive options. As a safety measure, each
+                                    alias may be triggered a maximum of 100
+                                    times. This option can be used multiple
+                                    times
+    -t, --preset-alias PRESET       Applies a predefined set of options. e.g.
+                                    --preset-alias mp3. The following presets
+                                    are available: mp3, aac, mp4, mkv, sleep.
+                                    See the "Preset Aliases" section at the end
+                                    for more info. This option can be used
+                                    multiple times
+
+  Network Options:
+    --proxy URL                     Use the specified HTTP/HTTPS/SOCKS proxy. To
+                                    enable SOCKS proxy, specify a proper scheme,
+                                    e.g. socks5://user:pass@127.0.0.1:1080/.
+                                    Pass in an empty string (--proxy "") for
+                                    direct connection
+    --socket-timeout SECONDS        Time to wait before giving up, in seconds
+    --source-address IP             Client-side IP address to bind to
+    --impersonate CLIENT[:OS]       Client to impersonate for requests. E.g.
+                                    chrome, chrome-110, chrome:windows-10. Pass
+                                    --impersonate="" to impersonate any client.
+                                    Note that forcing impersonation for all
+                                    requests may have a detrimental impact on
+                                    download speed and stability
+    --list-impersonate-targets      List available clients to impersonate.
+    -4, --force-ipv4                Make all connections via IPv4
+    -6, --force-ipv6                Make all connections via IPv6
+    --enable-file-urls              Enable file:// URLs. This is disabled by
+                                    default for security reasons.
+
+  Geo-restriction:
+    --geo-verification-proxy URL    Use this proxy to verify the IP address for
+                                    some geo-restricted sites. The default proxy
+                                    specified by --proxy (or none, if the option
+                                    is not present) is used for the actual
+                                    downloading
+    --xff VALUE                     How to fake X-Forwarded-For HTTP header to
+                                    try bypassing geographic restriction. One of
+                                    "default" (only when known to be useful),
+                                    "never", an IP block in CIDR notation, or a
+                                    two-letter ISO 3166-2 country code
+
+  Video Selection:
+    -I, --playlist-items ITEM_SPEC  Comma-separated playlist_index of the items
+                                    to download. You can specify a range using
+                                    "[START]:[STOP][:STEP]". For backward
+                                    compatibility, START-STOP is also supported.
+                                    Use negative indices to count from the right
+                                    and negative STEP to download in reverse
+                                    order. E.g. "-I 1:3,7,-5::2" used on a
+                                    playlist of size 15 will download the items
+                                    at index 1,2,3,7,11,13,15
+    --min-filesize SIZE             Abort download if filesize is smaller than
+                                    SIZE, e.g. 50k or 44.6M
+    --max-filesize SIZE             Abort download if filesize is larger than
+                                    SIZE, e.g. 50k or 44.6M
+    --date DATE                     Download only videos uploaded on this date.
+                                    The date can be "YYYYMMDD" or in the format
+                                    [now|today|yesterday][-
+                                    N[day|week|month|year]]. E.g. "--date
+                                    today-2weeks" downloads only videos uploaded
+                                    on the same day two weeks ago
+    --datebefore DATE               Download only videos uploaded on or before
+                                    this date. The date formats accepted are the
+                                    same as --date
+    --dateafter DATE                Download only videos uploaded on or after
+                                    this date. The date formats accepted are the
+                                    same as --date
+    --match-filters FILTER          Generic video filter. Any "OUTPUT TEMPLATE"
+                                    field can be compared with a number or a
+                                    string using the operators defined in
+                                    "Filtering Formats". You can also simply
+                                    specify a field to match if the field is
+                                    present, use "!field" to check if the field
+                                    is not present, and "&" to check multiple
+                                    conditions. Use a "\" to escape "&" or
+                                    quotes if needed. If used multiple times,
+                                    the filter matches if at least one of the
+                                    conditions is met. E.g. --match-filters
+                                    !is_live --match-filters "like_count>?100 &
+                                    description~='(?i)\bcats \& dogs\b'" matches
+                                    only videos that are not live OR those that
+                                    have a like count more than 100 (or the like
+                                    field is not available) and also has a
+                                    description that contains the phrase "cats &
+                                    dogs" (caseless). Use "--match-filters -" to
+                                    interactively ask whether to download each
+                                    video
+    --no-match-filters              Do not use any --match-filters (default)
+    --break-match-filters FILTER    Same as "--match-filters" but stops the
+                                    download process when a video is rejected
+    --no-break-match-filters        Do not use any --break-match-filters
+                                    (default)
+    --no-playlist                   Download only the video, if the URL refers
+                                    to a video and a playlist
+    --yes-playlist                  Download the playlist, if the URL refers to
+                                    a video and a playlist
+    --age-limit YEARS               Download only videos suitable for the given
+                                    age
+    --download-archive FILE         Download only videos not listed in the
+                                    archive file. Record the IDs of all
+                                    downloaded videos in it
+    --no-download-archive           Do not use archive file (default)
+    --max-downloads NUMBER          Abort after downloading NUMBER files
+    --break-on-existing             Stop the download process when encountering
+                                    a file that is in the archive supplied with
+                                    the --download-archive option
+    --no-break-on-existing          Do not stop the download process when
+                                    encountering a file that is in the archive
+                                    (default)
+    --break-per-input               Alters --max-downloads, --break-on-existing,
+                                    --break-match-filters, and autonumber to
+                                    reset per input URL
+    --no-break-per-input            --break-on-existing and similar options
+                                    terminates the entire download queue
+    --skip-playlist-after-errors N  Number of allowed failures until the rest of
+                                    the playlist is skipped
+
+  Download Options:
+    -N, --concurrent-fragments N    Number of fragments of a dash/hlsnative
+                                    video that should be downloaded concurrently
+                                    (default is 1)
+    -r, --limit-rate RATE           Maximum download rate in bytes per second,
+                                    e.g. 50K or 4.2M
+    --throttled-rate RATE           Minimum download rate in bytes per second
+                                    below which throttling is assumed and the
+                                    video data is re-extracted, e.g. 100K
+    -R, --retries RETRIES           Number of retries (default is 10), or
+                                    "infinite"
+    --file-access-retries RETRIES   Number of times to retry on file access
+                                    error (default is 3), or "infinite"
+    --fragment-retries RETRIES      Number of retries for a fragment (default is
+                                    10), or "infinite" (DASH, hlsnative and ISM)
+    --retry-sleep [TYPE:]EXPR       Time to sleep between retries in seconds
+                                    (optionally) prefixed by the type of retry
+                                    (http (default), fragment, file_access,
+                                    extractor) to apply the sleep to. EXPR can
+                                    be a number, linear=START[:END[:STEP=1]] or
+                                    exp=START[:END[:BASE=2]]. This option can be
+                                    used multiple times to set the sleep for the
+                                    different retry types, e.g. --retry-sleep
+                                    linear=1::2 --retry-sleep fragment:exp=1:20
+    --skip-unavailable-fragments    Skip unavailable fragments for DASH,
+                                    hlsnative and ISM downloads (default)
+                                    (Alias: --no-abort-on-unavailable-fragments)
+    --abort-on-unavailable-fragments
+                                    Abort download if a fragment is unavailable
+                                    (Alias: --no-skip-unavailable-fragments)
+    --keep-fragments                Keep downloaded fragments on disk after
+                                    downloading is finished
+    --no-keep-fragments             Delete downloaded fragments after
+                                    downloading is finished (default)
+    --buffer-size SIZE              Size of download buffer, e.g. 1024 or 16K
+                                    (default is 1024)
+    --resize-buffer                 The buffer size is automatically resized
+                                    from an initial value of --buffer-size
+                                    (default)
+    --no-resize-buffer              Do not automatically adjust the buffer size
+    --http-chunk-size SIZE          Size of a chunk for chunk-based HTTP
+                                    downloading, e.g. 10485760 or 10M (default
+                                    is disabled). May be useful for bypassing
+                                    bandwidth throttling imposed by a webserver
+                                    (experimental)
+    --playlist-random               Download playlist videos in random order
+    --lazy-playlist                 Process entries in the playlist as they are
+                                    received. This disables n_entries,
+                                    --playlist-random and --playlist-reverse
+    --no-lazy-playlist              Process videos in the playlist only after
+                                    the entire playlist is parsed (default)
+    --hls-use-mpegts                Use the mpegts container for HLS videos;
+                                    allowing some players to play the video
+                                    while downloading, and reducing the chance
+                                    of file corruption if download is
+                                    interrupted. This is enabled by default for
+                                    live streams
+    --no-hls-use-mpegts             Do not use the mpegts container for HLS
+                                    videos. This is default when not downloading
+                                    live streams
+    --download-sections REGEX       Download only chapters that match the
+                                    regular expression. A "*" prefix denotes
+                                    time-range instead of chapter. Negative
+                                    timestamps are calculated from the end.
+                                    "*from-url" can be used to download between
+                                    the "start_time" and "end_time" extracted
+                                    from the URL. Needs ffmpeg. This option can
+                                    be used multiple times to download multiple
+                                    sections, e.g. --download-sections
+                                    "*10:15-inf" --download-sections "intro"
+    --downloader [PROTO:]NAME       Name or path of the external downloader to
+                                    use (optionally) prefixed by the protocols
+                                    (http, ftp, m3u8, dash, rstp, rtmp, mms) to
+                                    use it for. Currently supports native,
+                                    aria2c, axel, curl, ffmpeg, httpie, wget.
+                                    You can use this option multiple times to
+                                    set different downloaders for different
+                                    protocols. E.g. --downloader aria2c
+                                    --downloader "dash,m3u8:native" will use
+                                    aria2c for http/ftp downloads, and the
+                                    native downloader for dash/m3u8 downloads
+                                    (Alias: --external-downloader)
+    --downloader-args NAME:ARGS     Give these arguments to the external
+                                    downloader. Specify the downloader name and
+                                    the arguments separated by a colon ":". For
+                                    ffmpeg, arguments can be passed to different
+                                    positions using the same syntax as
+                                    --postprocessor-args. You can use this
+                                    option multiple times to give different
+                                    arguments to different downloaders (Alias:
+                                    --external-downloader-args)
+
+  Filesystem Options:
+    -a, --batch-file FILE           File containing URLs to download ("-" for
+                                    stdin), one URL per line. Lines starting
+                                    with "#", ";" or "]" are considered as
+                                    comments and ignored
+    --no-batch-file                 Do not read URLs from batch file (default)
+    -P, --paths [TYPES:]PATH        The paths where the files should be
+                                    downloaded. Specify the type of file and the
+                                    path separated by a colon ":". All the same
+                                    TYPES as --output are supported.
+                                    Additionally, you can also provide "home"
+                                    (default) and "temp" paths. All intermediary
+                                    files are first downloaded to the temp path
+                                    and then the final files are moved over to
+                                    the home path after download is finished.
+                                    This option is ignored if --output is an
+                                    absolute path
+    -o, --output [TYPES:]TEMPLATE   Output filename template; see "OUTPUT
+                                    TEMPLATE" for details
+    --output-na-placeholder TEXT    Placeholder for unavailable fields in
+                                    --output (default: "NA")
+    --restrict-filenames            Restrict filenames to only ASCII characters,
+                                    and avoid "&" and spaces in filenames
+    --no-restrict-filenames         Allow Unicode characters, "&" and spaces in
+                                    filenames (default)
+    --windows-filenames             Force filenames to be Windows-compatible
+    --no-windows-filenames          Sanitize filenames only minimally
+    --trim-filenames LENGTH         Limit the filename length (excluding
+                                    extension) to the specified number of
+                                    characters
+    -w, --no-overwrites             Do not overwrite any files
+    --force-overwrites              Overwrite all video and metadata files. This
+                                    option includes --no-continue
+    --no-force-overwrites           Do not overwrite the video, but overwrite
+                                    related files (default)
+    -c, --continue                  Resume partially downloaded files/fragments
+                                    (default)
+    --no-continue                   Do not resume partially downloaded
+                                    fragments. If the file is not fragmented,
+                                    restart download of the entire file
+    --part                          Use .part files instead of writing directly
+                                    into output file (default)
+    --no-part                       Do not use .part files - write directly into
+                                    output file
+    --mtime                         Use the Last-modified header to set the file
+                                    modification time
+    --no-mtime                      Do not use the Last-modified header to set
+                                    the file modification time (default)
+    --write-description             Write video description to a .description
+                                    file
+    --no-write-description          Do not write video description (default)
+    --write-info-json               Write video metadata to a .info.json file
+                                    (this may contain personal information)
+    --no-write-info-json            Do not write video metadata (default)
+    --write-playlist-metafiles      Write playlist metadata in addition to the
+                                    video metadata when using --write-info-json,
+                                    --write-description etc. (default)
+    --no-write-playlist-metafiles   Do not write playlist metadata when using
+                                    --write-info-json, --write-description etc.
+    --clean-info-json               Remove some internal metadata such as
+                                    filenames from the infojson (default)
+    --no-clean-info-json            Write all fields to the infojson
+    --write-comments                Retrieve video comments to be placed in the
+                                    infojson. The comments are fetched even
+                                    without this option if the extraction is
+                                    known to be quick (Alias: --get-comments)
+    --no-write-comments             Do not retrieve video comments unless the
+                                    extraction is known to be quick (Alias:
+                                    --no-get-comments)
+    --load-info-json FILE           JSON file containing the video information
+                                    (created with the "--write-info-json"
+                                    option)
+    --cookies FILE                  Netscape formatted file to read cookies from
+                                    and dump cookie jar in
+    --no-cookies                    Do not read/dump cookies from/to file
+                                    (default)
+    --cookies-from-browser BROWSER[+KEYRING][:PROFILE][::CONTAINER]
+                                    The name of the browser to load cookies
+                                    from. Currently supported browsers are:
+                                    brave, chrome, chromium, edge, firefox,
+                                    opera, safari, vivaldi, whale. Optionally,
+                                    the KEYRING used for decrypting Chromium
+                                    cookies on Linux, the name/path of the
+                                    PROFILE to load cookies from, and the
+                                    CONTAINER name (if Firefox) ("none" for no
+                                    container) can be given with their
+                                    respective separators. By default, all
+                                    containers of the most recently accessed
+                                    profile are used. Currently supported
+                                    keyrings are: basictext, gnomekeyring,
+                                    kwallet, kwallet5, kwallet6
+    --no-cookies-from-browser       Do not load cookies from browser (default)
+    --cache-dir DIR                 Location in the filesystem where yt-dlp can
+                                    store some downloaded information (such as
+                                    client ids and signatures) permanently. By
+                                    default ${XDG_CACHE_HOME}/yt-dlp
+    --no-cache-dir                  Disable filesystem caching
+    --rm-cache-dir                  Delete all filesystem cache files
+
+  Thumbnail Options:
+    --write-thumbnail               Write thumbnail image to disk
+    --no-write-thumbnail            Do not write thumbnail image to disk
+                                    (default)
+    --write-all-thumbnails          Write all thumbnail image formats to disk
+    --list-thumbnails               List available thumbnails of each video.
+                                    Simulate unless --no-simulate is used
+
+  Internet Shortcut Options:
+    --write-link                    Write an internet shortcut file, depending
+                                    on the current platform (.url, .webloc or
+                                    .desktop). The URL may be cached by the OS
+    --write-url-link                Write a .url Windows internet shortcut. The
+                                    OS caches the URL based on the file path
+    --write-webloc-link             Write a .webloc macOS internet shortcut
+    --write-desktop-link            Write a .desktop Linux internet shortcut
+
+  Verbosity and Simulation Options:
+    -q, --quiet                     Activate quiet mode. If used with --verbose,
+                                    print the log to stderr
+    --no-quiet                      Deactivate quiet mode. (Default)
+    --no-warnings                   Ignore warnings
+    -s, --simulate                  Do not download the video and do not write
+                                    anything to disk
+    --no-simulate                   Download the video even if printing/listing
+                                    options are used
+    --ignore-no-formats-error       Ignore "No video formats" error. Useful for
+                                    extracting metadata even if the videos are
+                                    not actually available for download
+                                    (experimental)
+    --no-ignore-no-formats-error    Throw error when no downloadable video
+                                    formats are found (default)
+    --skip-download                 Do not download the video but write all
+                                    related files (Alias: --no-download)
+    -O, --print [WHEN:]TEMPLATE     Field name or output template to print to
+                                    screen, optionally prefixed with when to
+                                    print it, separated by a ":". Supported
+                                    values of "WHEN" are the same as that of
+                                    --use-postprocessor (default: video).
+                                    Implies --quiet. Implies --simulate unless
+                                    --no-simulate or later stages of WHEN are
+                                    used. This option can be used multiple times
+    --print-to-file [WHEN:]TEMPLATE FILE
+                                    Append given template to the file. The
+                                    values of WHEN and TEMPLATE are the same as
+                                    that of --print. FILE uses the same syntax
+                                    as the output template. This option can be
+                                    used multiple times
+    -j, --dump-json                 Quiet, but print JSON information for each
+                                    video. Simulate unless --no-simulate is
+                                    used. See "OUTPUT TEMPLATE" for a
+                                    description of available keys
+    -J, --dump-single-json          Quiet, but print JSON information for each
+                                    URL or infojson passed. Simulate unless
+                                    --no-simulate is used. If the URL refers to
+                                    a playlist, the whole playlist information
+                                    is dumped in a single line
+    --force-write-archive           Force download archive entries to be written
+                                    as far as no errors occur, even if -s or
+                                    another simulation option is used (Alias:
+                                    --force-download-archive)
+    --newline                       Output progress bar as new lines
+    --no-progress                   Do not print progress bar
+    --progress                      Show progress bar, even if in quiet mode
+    --console-title                 Display progress in console titlebar
+    --progress-template [TYPES:]TEMPLATE
+                                    Template for progress outputs, optionally
+                                    prefixed with one of "download:" (default),
+                                    "download-title:" (the console title),
+                                    "postprocess:",  or "postprocess-title:".
+                                    The video's fields are accessible under the
+                                    "info" key and the progress attributes are
+                                    accessible under "progress" key. E.g.
+                                    --console-title --progress-template
+                                    "download-
+                                    title:%(info.id)s-%(progress.eta)s"
+    --progress-delta SECONDS        Time between progress output (default: 0)
+    -v, --verbose                   Print various debugging information
+    --dump-pages                    Print downloaded pages encoded using base64
+                                    to debug problems (very verbose)
+    --write-pages                   Write downloaded intermediary pages to files
+                                    in the current directory to debug problems
+    --print-traffic                 Display sent and read HTTP traffic
+
+  Workarounds:
+    --encoding ENCODING             Force the specified encoding (experimental)
+    --legacy-server-connect         Explicitly allow HTTPS connection to servers
+                                    that do not support RFC 5746 secure
+                                    renegotiation
+    --no-check-certificates         Suppress HTTPS certificate validation
+    --prefer-insecure               Use an unencrypted connection to retrieve
+                                    information about the video (Currently
+                                    supported only for YouTube)
+    --add-headers FIELD:VALUE       Specify a custom HTTP header and its value,
+                                    separated by a colon ":". You can use this
+                                    option multiple times
+    --bidi-workaround               Work around terminals that lack
+                                    bidirectional text support. Requires bidiv
+                                    or fribidi executable in PATH
+    --sleep-requests SECONDS        Number of seconds to sleep between requests
+                                    during data extraction
+    --sleep-interval SECONDS        Number of seconds to sleep before each
+                                    download. This is the minimum time to sleep
+                                    when used along with --max-sleep-interval
+                                    (Alias: --min-sleep-interval)
+    --max-sleep-interval SECONDS    Maximum number of seconds to sleep. Can only
+                                    be used along with --min-sleep-interval
+    --sleep-subtitles SECONDS       Number of seconds to sleep before each
+                                    subtitle download
+
+  Video Format Options:
+    -f, --format FORMAT             Video format code, see "FORMAT SELECTION"
+                                    for more details
+    -S, --format-sort SORTORDER     Sort the formats by the fields given, see
+                                    "Sorting Formats" for more details
+    --format-sort-reset             Disregard previous user specified sort order
+                                    and reset to the default
+    --format-sort-force             Force user specified sort order to have
+                                    precedence over all fields, see "Sorting
+                                    Formats" for more details (Alias: --S-force)
+    --no-format-sort-force          Some fields have precedence over the user
+                                    specified sort order (default)
+    --video-multistreams            Allow multiple video streams to be merged
+                                    into a single file
+    --no-video-multistreams         Only one video stream is downloaded for each
+                                    output file (default)
+    --audio-multistreams            Allow multiple audio streams to be merged
+                                    into a single file
+    --no-audio-multistreams         Only one audio stream is downloaded for each
+                                    output file (default)
+    --prefer-free-formats           Prefer video formats with free containers
+                                    over non-free ones of the same quality. Use
+                                    with "-S ext" to strictly prefer free
+                                    containers irrespective of quality
+    --no-prefer-free-formats        Don't give any special preference to free
+                                    containers (default)
+    --check-formats                 Make sure formats are selected only from
+                                    those that are actually downloadable
+    --check-all-formats             Check all formats for whether they are
+                                    actually downloadable
+    --no-check-formats              Do not check that the formats are actually
+                                    downloadable
+    -F, --list-formats              List available formats of each video.
+                                    Simulate unless --no-simulate is used
+    --merge-output-format FORMAT    Containers that may be used when merging
+                                    formats, separated by "/", e.g. "mp4/mkv".
+                                    Ignored if no merge is required. (currently
+                                    supported: avi, flv, mkv, mov, mp4, webm)
+
+  Subtitle Options:
+    --write-subs                    Write subtitle file
+    --no-write-subs                 Do not write subtitle file (default)
+    --write-auto-subs               Write automatically generated subtitle file
+                                    (Alias: --write-automatic-subs)
+    --no-write-auto-subs            Do not write auto-generated subtitles
+                                    (default) (Alias: --no-write-automatic-subs)
+    --list-subs                     List available subtitles of each video.
+                                    Simulate unless --no-simulate is used
+    --sub-format FORMAT             Subtitle format; accepts formats preference
+                                    separated by "/", e.g. "srt" or
+                                    "ass/srt/best"
+    --sub-langs LANGS               Languages of the subtitles to download (can
+                                    be regex) or "all" separated by commas, e.g.
+                                    --sub-langs "en.*,ja" (where "en.*" is a
+                                    regex pattern that matches "en" followed by
+                                    0 or more of any character). You can prefix
+                                    the language code with a "-" to exclude it
+                                    from the requested languages, e.g. --sub-
+                                    langs all,-live_chat. Use --list-subs for a
+                                    list of available language tags
+
+  Authentication Options:
+    -u, --username USERNAME         Login with this account ID
+    -p, --password PASSWORD         Account password. If this option is left
+                                    out, yt-dlp will ask interactively
+    -2, --twofactor TWOFACTOR       Two-factor authentication code
+    -n, --netrc                     Use .netrc authentication data
+    --netrc-location PATH           Location of .netrc authentication data;
+                                    either the path or its containing directory.
+                                    Defaults to ~/.netrc
+    --netrc-cmd NETRC_CMD           Command to execute to get the credentials
+                                    for an extractor.
+    --video-password PASSWORD       Video-specific password
+    --ap-mso MSO                    Adobe Pass multiple-system operator (TV
+                                    provider) identifier, use --ap-list-mso for
+                                    a list of available MSOs
+    --ap-username USERNAME          Multiple-system operator account login
+    --ap-password PASSWORD          Multiple-system operator account password.
+                                    If this option is left out, yt-dlp will ask
+                                    interactively
+    --ap-list-mso                   List all supported multiple-system operators
+    --client-certificate CERTFILE   Path to client certificate file in PEM
+                                    format. May include the private key
+    --client-certificate-key KEYFILE
+                                    Path to private key file for client
+                                    certificate
+    --client-certificate-password PASSWORD
+                                    Password for client certificate private key,
+                                    if encrypted. If not provided, and the key
+                                    is encrypted, yt-dlp will ask interactively
+
+  Post-Processing Options:
+    -x, --extract-audio             Convert video files to audio-only files
+                                    (requires ffmpeg and ffprobe)
+    --audio-format FORMAT           Format to convert the audio to when -x is
+                                    used. (currently supported: best (default),
+                                    aac, alac, flac, m4a, mp3, opus, vorbis,
+                                    wav). You can specify multiple rules using
+                                    similar syntax as --remux-video
+    --audio-quality QUALITY         Specify ffmpeg audio quality to use when
+                                    converting the audio with -x. Insert a value
+                                    between 0 (best) and 10 (worst) for VBR or a
+                                    specific bitrate like 128K (default 5)
+    --remux-video FORMAT            Remux the video into another container if
+                                    necessary (currently supported: avi, flv,
+                                    gif, mkv, mov, mp4, webm, aac, aiff, alac,
+                                    flac, m4a, mka, mp3, ogg, opus, vorbis,
+                                    wav). If the target container does not
+                                    support the video/audio codec, remuxing will
+                                    fail. You can specify multiple rules; e.g.
+                                    "aac>m4a/mov>mp4/mkv" will remux aac to m4a,
+                                    mov to mp4 and anything else to mkv
+    --recode-video FORMAT           Re-encode the video into another format if
+                                    necessary. The syntax and supported formats
+                                    are the same as --remux-video
+    --postprocessor-args NAME:ARGS  Give these arguments to the postprocessors.
+                                    Specify the postprocessor/executable name
+                                    and the arguments separated by a colon ":"
+                                    to give the argument to the specified
+                                    postprocessor/executable. Supported PP are:
+                                    Merger, ModifyChapters, SplitChapters,
+                                    ExtractAudio, VideoRemuxer, VideoConvertor,
+                                    Metadata, EmbedSubtitle, EmbedThumbnail,
+                                    SubtitlesConvertor, ThumbnailsConvertor,
+                                    FixupStretched, FixupM4a, FixupM3u8,
+                                    FixupTimestamp and FixupDuration. The
+                                    supported executables are: AtomicParsley,
+                                    FFmpeg and FFprobe. You can also specify
+                                    "PP+EXE:ARGS" to give the arguments to the
+                                    specified executable only when being used by
+                                    the specified postprocessor. Additionally,
+                                    for ffmpeg/ffprobe, "_i"/"_o" can be
+                                    appended to the prefix optionally followed
+                                    by a number to pass the argument before the
+                                    specified input/output file, e.g. --ppa
+                                    "Merger+ffmpeg_i1:-v quiet". You can use
+                                    this option multiple times to give different
+                                    arguments to different postprocessors.
+                                    (Alias: --ppa)
+    -k, --keep-video                Keep the intermediate video file on disk
+                                    after post-processing
+    --no-keep-video                 Delete the intermediate video file after
+                                    post-processing (default)
+    --post-overwrites               Overwrite post-processed files (default)
+    --no-post-overwrites            Do not overwrite post-processed files
+    --embed-subs                    Embed subtitles in the video (only for mp4,
+                                    webm and mkv videos)
+    --no-embed-subs                 Do not embed subtitles (default)
+    --embed-thumbnail               Embed thumbnail in the video as cover art
+    --no-embed-thumbnail            Do not embed thumbnail (default)
+    --embed-metadata                Embed metadata to the video file. Also
+                                    embeds chapters/infojson if present unless
+                                    --no-embed-chapters/--no-embed-info-json are
+                                    used (Alias: --add-metadata)
+    --no-embed-metadata             Do not add metadata to file (default)
+                                    (Alias: --no-add-metadata)
+    --embed-chapters                Add chapter markers to the video file
+                                    (Alias: --add-chapters)
+    --no-embed-chapters             Do not add chapter markers (default) (Alias:
+                                    --no-add-chapters)
+    --embed-info-json               Embed the infojson as an attachment to
+                                    mkv/mka video files
+    --no-embed-info-json            Do not embed the infojson as an attachment
+                                    to the video file
+    --parse-metadata [WHEN:]FROM:TO
+                                    Parse additional metadata like title/artist
+                                    from other fields; see "MODIFYING METADATA"
+                                    for details. Supported values of "WHEN" are
+                                    the same as that of --use-postprocessor
+                                    (default: pre_process)
+    --replace-in-metadata [WHEN:]FIELDS REGEX REPLACE
+                                    Replace text in a metadata field using the
+                                    given regex. This option can be used
+                                    multiple times. Supported values of "WHEN"
+                                    are the same as that of --use-postprocessor
+                                    (default: pre_process)
+    --xattrs                        Write metadata to the video file's xattrs
+                                    (using Dublin Core and XDG standards)
+    --concat-playlist POLICY        Concatenate videos in a playlist. One of
+                                    "never", "always", or "multi_video"
+                                    (default; only when the videos form a single
+                                    show). All the video files must have the
+                                    same codecs and number of streams to be
+                                    concatenable. The "pl_video:" prefix can be
+                                    used with "--paths" and "--output" to set
+                                    the output filename for the concatenated
+                                    files. See "OUTPUT TEMPLATE" for details
+    --fixup POLICY                  Automatically correct known faults of the
+                                    file. One of never (do nothing), warn (only
+                                    emit a warning), detect_or_warn (the
+                                    default; fix the file if we can, warn
+                                    otherwise), force (try fixing even if the
+                                    file already exists)
+    --ffmpeg-location PATH          Location of the ffmpeg binary; either the
+                                    path to the binary or its containing
+                                    directory
+    --exec [WHEN:]CMD               Execute a command, optionally prefixed with
+                                    when to execute it, separated by a ":".
+                                    Supported values of "WHEN" are the same as
+                                    that of --use-postprocessor (default:
+                                    after_move). The same syntax as the output
+                                    template can be used to pass any field as
+                                    arguments to the command. If no fields are
+                                    passed, %(filepath,_filename|)q is appended
+                                    to the end of the command. This option can
+                                    be used multiple times
+    --no-exec                       Remove any previously defined --exec
+    --convert-subs FORMAT           Convert the subtitles to another format
+                                    (currently supported: ass, lrc, srt, vtt).
+                                    Use "--convert-subs none" to disable
+                                    conversion (default) (Alias: --convert-
+                                    subtitles)
+    --convert-thumbnails FORMAT     Convert the thumbnails to another format
+                                    (currently supported: jpg, png, webp). You
+                                    can specify multiple rules using similar
+                                    syntax as "--remux-video". Use "--convert-
+                                    thumbnails none" to disable conversion
+                                    (default)
+    --split-chapters                Split video into multiple files based on
+                                    internal chapters. The "chapter:" prefix can
+                                    be used with "--paths" and "--output" to set
+                                    the output filename for the split files. See
+                                    "OUTPUT TEMPLATE" for details
+    --no-split-chapters             Do not split video based on chapters
+                                    (default)
+    --remove-chapters REGEX         Remove chapters whose title matches the
+                                    given regular expression. The syntax is the
+                                    same as --download-sections. This option can
+                                    be used multiple times
+    --no-remove-chapters            Do not remove any chapters from the file
+                                    (default)
+    --force-keyframes-at-cuts       Force keyframes at cuts when
+                                    downloading/splitting/removing sections.
+                                    This is slow due to needing a re-encode, but
+                                    the resulting video may have fewer artifacts
+                                    around the cuts
+    --no-force-keyframes-at-cuts    Do not force keyframes around the chapters
+                                    when cutting/splitting (default)
+    --use-postprocessor NAME[:ARGS]
+                                    The (case-sensitive) name of plugin
+                                    postprocessors to be enabled, and
+                                    (optionally) arguments to be passed to it,
+                                    separated by a colon ":". ARGS are a
+                                    semicolon ";" delimited list of NAME=VALUE.
+                                    The "when" argument determines when the
+                                    postprocessor is invoked. It can be one of
+                                    "pre_process" (after video extraction),
+                                    "after_filter" (after video passes filter),
+                                    "video" (after --format; before
+                                    --print/--output), "before_dl" (before each
+                                    video download), "post_process" (after each
+                                    video download; default), "after_move"
+                                    (after moving the video file to its final
+                                    location), "after_video" (after downloading
+                                    and processing all formats of a video), or
+                                    "playlist" (at end of playlist). This option
+                                    can be used multiple times to add different
+                                    postprocessors
+
+  SponsorBlock Options:
+    Make chapter entries for, or remove various segments (sponsor,
+    introductions, etc.) from downloaded YouTube videos using the
+    SponsorBlock API (https://sponsor.ajay.app)
+
+    --sponsorblock-mark CATS        SponsorBlock categories to create chapters
+                                    for, separated by commas. Available
+                                    categories are sponsor, intro, outro,
+                                    selfpromo, preview, filler, interaction,
+                                    music_offtopic, hook, poi_highlight,
+                                    chapter, all and default (=all). You can
+                                    prefix the category with a "-" to exclude
+                                    it. See [1] for descriptions of the
+                                    categories. E.g. --sponsorblock-mark
+                                    all,-preview [1] https://wiki.sponsor.ajay.a
+                                    pp/w/Segment_Categories
+    --sponsorblock-remove CATS      SponsorBlock categories to be removed from
+                                    the video file, separated by commas. If a
+                                    category is present in both mark and remove,
+                                    remove takes precedence. The syntax and
+                                    available categories are the same as for
+                                    --sponsorblock-mark except that "default"
+                                    refers to "all,-filler" and poi_highlight,
+                                    chapter are not available
+    --sponsorblock-chapter-title TEMPLATE
+                                    An output template for the title of the
+                                    SponsorBlock chapters created by
+                                    --sponsorblock-mark. The only available
+                                    fields are start_time, end_time, category,
+                                    categories, name, category_names. Defaults
+                                    to "[SponsorBlock]: %(category_names)l"
+    --no-sponsorblock               Disable both --sponsorblock-mark and
+                                    --sponsorblock-remove
+    --sponsorblock-api URL          SponsorBlock API location, defaults to
+                                    https://sponsor.ajay.app
+
+  Extractor Options:
+    --extractor-retries RETRIES     Number of retries for known extractor errors
+                                    (default is 3), or "infinite"
+    --allow-dynamic-mpd             Process dynamic DASH manifests (default)
+                                    (Alias: --no-ignore-dynamic-mpd)
+    --ignore-dynamic-mpd            Do not process dynamic DASH manifests
+                                    (Alias: --no-allow-dynamic-mpd)
+    --hls-split-discontinuity       Split HLS playlists to different formats at
+                                    discontinuities such as ad breaks
+    --no-hls-split-discontinuity    Do not split HLS playlists into different
+                                    formats at discontinuities such as ad breaks
+                                    (default)
+    --extractor-args IE_KEY:ARGS    Pass ARGS arguments to the IE_KEY extractor.
+                                    See "EXTRACTOR ARGUMENTS" for details. You
+                                    can use this option multiple times to give
+                                    arguments for different extractors
+
+  Preset Aliases:
+    Predefined aliases for convenience and ease of use. Note that future
+    versions of yt-dlp may add or adjust presets, but the existing preset
+    names will not be changed or removed
+
+    -t mp3                          -f 'ba[acodec^=mp3]/ba/b' -x --audio-format
+                                    mp3
+
+    -t aac                          -f
+                                    'ba[acodec^=aac]/ba[acodec^=mp4a.40.]/ba/b'
+                                    -x --audio-format aac
+
+    -t mp4                          --merge-output-format mp4 --remux-video mp4
+                                    -S vcodec:h264,lang,quality,res,fps,hdr:12,a
+                                    codec:aac
+
+    -t mkv                          --merge-output-format mkv --remux-video mkv
+
+    -t sleep                        --sleep-subtitles 5 --sleep-requests 0.75
+                                    --sleep-interval 10 --max-sleep-interval 20
+
+See full documentation at  https://github.com/yt-dlp/yt-dlp#readme

test_ytdlp.swift

@@ -0,0 +1,50 @@
+import Foundation
+
+struct RawMediaFormat: Decodable {
+    let format_id: String?
+}
+
+struct MediaMetadata: Decodable {
+    let id: String?
+    let formats: [RawMediaFormat]?
+}
+
+let executableURL = URL(fileURLWithPath: "/Users/nima/Documents/Code/Firelink/Sources/Firelink/yt-dlp")
+let arguments = [
+    "-J", 
+    "--no-warnings", 
+    "--ignore-no-formats-error", 
+    "--no-playlist", 
+    "--force-ipv4",
+    "https://www.youtube.com/watch?v=jNQXAC9IVRw"
+]
+
+let process = Process()
+let outputPipe = Pipe()
+let errorPipe = Pipe()
+
+process.executableURL = executableURL
+process.arguments = arguments
+process.standardOutput = outputPipe
+process.standardError = errorPipe
+
+do {
+    try process.run()
+    process.waitUntilExit()
+    
+    let outputData = outputPipe.fileHandleForReading.readDataToEndOfFile()
+    
+    if process.terminationStatus == 0 {
+        do {
+            let metadata = try JSONDecoder().decode(MediaMetadata.self, from: outputData)
+            print("Successfully decoded metadata with \(metadata.formats?.count ?? 0) formats")
+        } catch {
+            print("Decoding failed: \(error)")
+        }
+    } else {
+        print("Failed! Exit code: \(process.terminationStatus)")
+        print(String(data: errorPipe.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? "")
+    }
+} catch {
+    print("Process run threw error: \(error.localizedDescription)")
+}