fix(release): extract RPM packages with bsdtar

Prevent queue action clicks from triggering row double-clicks, preserve aria2/yt-dlp resumable sidecars during duplicate replacement, and make aria2 require resume instead of silently restarting.

Add a persisted, accessible Folders collapse control with reduced-motion animation and regression coverage for replacement sidecar handling.

Fixes #11

Fixes #12

Closes #13

Refs #14

.github/badges/windows.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="86" height="20" role="img" aria-label="Windows">
+  <title>Windows</title>
+  <rect width="86" height="20" fill="#0078D6"/>
+  <path fill="#fff" d="M7 5.3 12.8 4.5v5H7V5.3Zm6.6-1 7.4-1.1v6.3h-7.4V4.3ZM7 10.5h5.8v5L7 14.7v-4.2Zm6.6 0H21v6.3l-7.4-1.1v-5.2Z"/>
+  <text x="28" y="14" fill="#fff" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="11">Windows</text>
+</svg>

.github/workflows/release.yml

@@ -6,13 +6,9 @@ on:
   workflow_dispatch:
     inputs:
       publish_release:
-        description: 'Publish the GitHub release after all platform QA is certified'
+        description: 'Publish the GitHub release after all platform build and verification jobs pass'
         type: boolean
-        default: false
-      certified_cross_platform:
-        description: 'Confirm Windows, Linux, and macOS clean-machine QA passed'
-        type: boolean
-        default: false
+        default: true
 
 permissions:
   contents: write
@@ -65,16 +61,39 @@ jobs:
             libdbus-1-dev \
             pkg-config \
             xvfb \
-            libtinfo5
+            libtinfo5 \
+            rpm \
+            cpio \
+            libarchive-tools \
+            desktop-file-utils \
+            xdg-utils
       - run: npm ci
       - name: Provision locked engines
         if: runner.os != 'macOS'
         run: node scripts/provision-engines.js --target ${{ matrix.target }}
       - name: Build package
+        if: runner.os != 'Linux'
         run: npm run tauri build -- -vv --target ${{ matrix.target }} --bundles ${{ matrix.bundles }}
         env:
           APPIMAGE_EXTRACT_AND_RUN: 1
-          FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE: ${{ runner.os == 'Linux' && '1' || '' }}
+      - name: Build Linux native packages
+        if: runner.os == 'Linux'
+        run: npm run tauri build -- -vv --target ${{ matrix.target }} --bundles deb,rpm
+        env:
+          APPIMAGE_EXTRACT_AND_RUN: 1
+      - name: Verify and preserve Linux native packages
+        if: runner.os == 'Linux'
+        run: |
+          node scripts/verify-linux-packages.js --target ${{ matrix.target }}
+          mkdir -p "$RUNNER_TEMP/firelink-native-packages/deb" "$RUNNER_TEMP/firelink-native-packages/rpm"
+          cp src-tauri/target/${{ matrix.target }}/release/bundle/deb/*.deb "$RUNNER_TEMP/firelink-native-packages/deb/"
+          cp src-tauri/target/${{ matrix.target }}/release/bundle/rpm/*.rpm "$RUNNER_TEMP/firelink-native-packages/rpm/"
+      - name: Build Linux AppImage
+        if: runner.os == 'Linux'
+        run: npm run tauri build -- -vv --target ${{ matrix.target }} --bundles appimage
+        env:
+          APPIMAGE_EXTRACT_AND_RUN: 1
+          FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE: '1'
       - name: Install pinned appimagetool (Linux only)
         if: runner.os == 'Linux'
         env:
@@ -91,6 +110,9 @@ jobs:
         if: runner.os == 'macOS'
         run: |
           APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app"
+          DMG="$(find src-tauri/target/${{ matrix.target }}/release/bundle/dmg -name '*.dmg' -print -quit)"
+          test -n "$DMG"
+          npm run verify:macos-signing -- --app "$APP" --dmg "$DMG"
           node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }}
           node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
       - name: Verify Windows installer payload and launch
@@ -129,14 +151,29 @@ jobs:
           path: ${{ matrix.artifact }}
           if-no-files-found: error
           retention-days: 3
+      - uses: actions/upload-artifact@v7
+        if: runner.os == 'Linux'
+        with:
+          name: Firelink-Linux-x64-Deb-${{ github.ref_name }}
+          path: ${{ runner.temp }}/firelink-native-packages/deb/*.deb
+          if-no-files-found: error
+          retention-days: 3
+      - uses: actions/upload-artifact@v7
+        if: runner.os == 'Linux'
+        with:
+          name: Firelink-Linux-x64-RPM-${{ github.ref_name }}
+          path: ${{ runner.temp }}/firelink-native-packages/rpm/*.rpm
+          if-no-files-found: error
+          retention-days: 3
 
   publish:
     name: Publish GitHub release
     if: >-
-      github.event_name == 'workflow_dispatch' &&
       startsWith(github.ref, 'refs/tags/v') &&
-      inputs.publish_release &&
-      inputs.certified_cross_platform
+      (
+        github.event_name == 'push' ||
+        (github.event_name == 'workflow_dispatch' && inputs.publish_release)
+      )
     needs: build
     runs-on: ubuntu-22.04
     steps:
@@ -169,6 +206,8 @@ jobs:
 
           rename_asset '*.dmg' "Firelink_${VERSION}_macOS-ARM64.dmg"
           rename_asset '*.AppImage' "Firelink_${VERSION}_Linux-x64.AppImage"
+          rename_asset '*.deb' "Firelink_${VERSION}_Linux-x64.deb"
+          rename_asset '*.rpm' "Firelink_${VERSION}_Linux-x64.rpm"
           rename_asset '*.exe' "Firelink_${VERSION}_Windows-x64-setup.exe"
       - name: Generate checksums
         run: |

.gitignore

@@ -17,6 +17,7 @@ implementation_plan.md
 CROSS_PLATFORM_CHECKLIST.md
 Cross-platform-checklist-gemini.MD
 YouTube_media_download_handoff.md
+Release_checklist.md
 
 # Frontend output and logs
 node_modules/

.gitmodules

@@ -1,3 +1,3 @@
-[submodule "Extensions/Firefox"]
-	path = Extensions/Firefox
+[submodule "Extensions/Browser"]
+	path = Extensions/Browser
 	url = https://github.com/nimbold/Firelink-Extension.git

CHANGELOG.md

@@ -5,6 +5,57 @@ All notable changes to Firelink will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.4] - 2026-07-12
+
+### New
+- Automatically fill the Add window with valid links from the clipboard when you choose **Add link**, addressing [#10](https://github.com/nimbold/Firelink/issues/10).
+- Add a persistent, accessible collapse control for the **Folders** section so the sidebar can stay tidy, addressing [#13](https://github.com/nimbold/Firelink/issues/13).
+- Add verified Linux `.deb` and `.rpm` packages alongside the portable AppImage, completing the Linux packaging request in [#3](https://github.com/nimbold/Firelink/issues/3).
+
+### Improved
+- Make queue actions safer: rapid clicks no longer open item properties by accident, and replacing an existing download preserves resumable progress instead of starting from zero, addressing [#11](https://github.com/nimbold/Firelink/issues/11) and [#12](https://github.com/nimbold/Firelink/issues/12).
+- Improve browser-captured batches so each link keeps its own metadata, headers, cookies, and destination instead of sharing stale request details.
+- Make media downloads more reliable with custom or system proxies, clearer metadata errors, more accurate quality choices, and steadier retry, speed, ETA, and progress updates, continuing the work reported in [#5](https://github.com/nimbold/Firelink/issues/5) and [#8](https://github.com/nimbold/Firelink/issues/8).
+- Keep the Logs view responsive while it is open and redact local paths and usernames from diagnostic output before it is shown or exported.
+- Keep dialogs and controls clear of macOS, Windows, and Linux window controls, and strengthen pause, resume, retry, and removal behavior during rapid actions.
+- Clarify incomplete-download handling: aria2 sidecar files show when a download is unfinished, preserve resume information, and are removed after completion, addressing [#14](https://github.com/nimbold/Firelink/issues/14).
+
+### Fixed
+- Prevent stale background queue work from resurrecting, duplicating, or restarting downloads after a newer pause, remove, or edit action wins.
+- Keep explicit media requests on Firelink's configured browser-cookie source instead of forwarding raw browser cookies, while preserving the browser session for ordinary captured downloads.
+- Make final HTTP errors visible during metadata requests and prevent internal retry limits from multiplying unexpectedly.
+
+## [1.0.3] - 2026-07-09
+
+### Improved
+- Refresh bundled Deno to 2.9.2 and update the TypeScript build toolchain used by the desktop app.
+- Keep release publishing aligned with the changelog so tag builds publish GitHub release notes automatically after the platform builds pass.
+
+### Fixed
+- Fix YouTube and other yt-dlp downloads that appeared stuck at 0% even while the transfer was active, addressing the progress problem reported around [#8](https://github.com/nimbold/Firelink/issues/8).
+- Improve media download speed and ETA updates so short stalls no longer make the main list look frozen or misleading.
+- Keep media progress sizes from replacing the final file size until the completed file is actually known.
+
+## [1.0.2] - 2026-07-08
+
+### New
+- Add explicit **Fetch media** actions for Firelink Companion so video and audio pages can be sent to Firelink from the extension popup or page context menu.
+- Add a Chromium extension install path in Firelink's Integrations settings and release documentation, addressing the Chromium support request in [#4](https://github.com/nimbold/Firelink/issues/4).
+
+### Improved
+- Improve YouTube and social-media download handling with better proxy support, cleaner diagnostics, safer log redaction, and more reliable metadata fetching based on reports in [#5](https://github.com/nimbold/Firelink/issues/5) and [#8](https://github.com/nimbold/Firelink/issues/8).
+- Let category subfolders be disabled so files can save directly into a base download folder, addressing [#6](https://github.com/nimbold/Firelink/issues/6).
+- Refresh bundled media engines and release tooling for the current cross-platform desktop builds.
+- Strengthen release packaging checks for macOS, Windows, and Linux, including macOS ad-hoc signing verification and Windows installer icon handling.
+
+### Fixed
+- Fix YouTube downloads that failed when Chrome's cookie database could not be copied by retrying public media without browser cookies, addressing [#7](https://github.com/nimbold/Firelink/issues/7).
+- Fix the hidden-sidebar trap on Settings and other pages so the sidebar can always be shown again, addressing [#9](https://github.com/nimbold/Firelink/issues/9).
+- Fix Windows proxy detection so system proxy schemes are preserved for metadata and media requests, addressing [#5](https://github.com/nimbold/Firelink/issues/5).
+- Fix captured and auto-captured browser links so they always route through Firelink's Add window before reaching the download list.
+- Fix media downloads after a metadata fallback so pages without selectable preview formats can still let yt-dlp choose the best downloadable file instead of crashing.
+- Fix media cleanup and retry paths so failed, canceled, or retried media downloads leave fewer stale temporary files behind.
+
 ## [1.0.1] - 2026-07-04
 
 ### Fixed

README.md

@@ -5,13 +5,10 @@
 
   **A fast, focused desktop download manager for macOS, Windows, and Linux.**
 
-  [![Version](https://img.shields.io/badge/version-1.0.1-6f42c1?style=flat-square)](https://github.com/nimbold/Firelink/releases)
+  [![Version](https://img.shields.io/badge/version-1.0.4-6f42c1?style=flat-square)](https://github.com/nimbold/Firelink/releases)
   [![macOS](https://img.shields.io/badge/macOS-111111?style=flat-square&logo=apple&logoColor=white)](#platforms)
-  [![Windows](https://img.shields.io/badge/Windows-0078D6?style=flat-square&logo=windows11&logoColor=white)](#platforms)
+  [![Windows](.github/badges/windows.svg)](#platforms)
   [![Linux](https://img.shields.io/badge/Linux-FCC624?style=flat-square&logo=linux&logoColor=black)](#platforms)
-  [![Tauri](https://img.shields.io/badge/Tauri-2-24C8DB?style=flat-square&logo=tauri&logoColor=white)](https://tauri.app/)
-  [![Rust](https://img.shields.io/badge/Rust-backend-000000?style=flat-square&logo=rust)](https://www.rust-lang.org/)
-  [![React](https://img.shields.io/badge/React-TypeScript-61DAFB?style=flat-square&logo=react&logoColor=111111)](https://react.dev/)
   [![License](https://img.shields.io/github/license/nimbold/Firelink?style=flat-square)](LICENSE)
   [![CI](https://img.shields.io/github/actions/workflow/status/nimbold/Firelink/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/nimbold/Firelink/actions/workflows/ci.yml)
 
@@ -36,60 +33,69 @@
 
 ## Why Firelink
 
-Firelink is built for people who want a real desktop download manager again: fast segmented transfers, browser capture, media extraction, scheduling, recovery, and clear control over where files land. Version 1.0.0 completes the move from the earlier macOS-only Swift app to a modern Rust/Tauri application with a React and TypeScript interface.
+Firelink is a desktop download manager for fast transfers, browser capture, media extraction, scheduling, and clear file placement.
 
-The app keeps the heavy work native. Downloads are coordinated by a Rust backend, accelerated with aria2, enriched with yt-dlp and FFmpeg for media workflows, and persisted locally with SQLite so queues survive restarts and app updates.
+It is now a cross-platform Rust/Tauri app with a React and TypeScript interface. A native backend coordinates downloads with aria2, yt-dlp, FFmpeg, Deno, and SQLite.
+
+The current desktop release is **1.0.4**, paired with Firelink Companion **2.0.3**.
 
 ## Features
 
-- **Fast segmented downloads** powered by aria2 with configurable connections, retries, and speed limits.
-- **Media extraction** with yt-dlp, FFmpeg, and Deno for video/audio links and richer format selection.
-- **A real Add window** for manual, extension-captured, and media downloads, including metadata, duplicate handling, and save-location choices before downloads start.
-- **Persistent queue management** with safe concurrency limits, pause/resume, retry, redownload, sorting, multi-select, and bulk controls.
-- **Download scheduling** with start/stop windows, speed-limiter tools, and optional post-queue actions.
-- **Smart organization** through categories, default folders, per-download overrides, and open/reveal/trash actions.
-- **Private browser handoff** through authenticated local pairing with replay protection and desktop-server proof checks.
-- **Native desktop integration** including tray controls, notifications, completion sounds, sleep prevention, and OS keychain support where available.
-- **Diagnostics built in** with engine health checks, structured logs, and packaged-engine verification.
+- **Segmented downloads** with aria2, retries, speed limits, and connection controls.
+- **Media downloads** with yt-dlp, FFmpeg, Deno, live progress, speed, and ETA.
+- **Add window** for metadata, duplicates, location choices, captured links, and clipboard-prefilled URLs.
+- **Persistent queues** with pause, resume, retry, redownload, sorting, multi-select, and bulk actions.
+- **Scheduling** with start/stop windows, speed rules, and post-queue actions.
+- **File organization** with categories, default folders, a collapsible Folders section, per-download overrides, and reveal/trash actions.
+- **Browser handoff** through local pairing, signed requests, Add window review, replay protection, and server checks.
+- **Desktop integration** with tray controls, notifications, sounds, sleep prevention, and secure credential storage.
+- **Diagnostics** with engine health checks, structured logs, and package verification.
 
 ## Installation
 
-Download the latest desktop build from [GitHub Releases](https://github.com/nimbold/Firelink/releases).
+Download desktop builds from [GitHub Releases](https://github.com/nimbold/Firelink/releases).
 
 | Platform | Package | Notes |
 | --- | --- | --- |
-| **macOS Apple silicon** | `.dmg` | Unsigned and not notarized. Open through Finder or approve once in **System Settings -> Privacy & Security**. |
+| **macOS Apple silicon** | `.dmg` | Not notarized. If macOS blocks the first launch, approve Firelink in **System Settings -> Privacy & Security**. |
 | **Windows x64** | NSIS `.exe` installer | Unsigned. Windows SmartScreen may warn until code signing is added. |
-| **Linux x64** | `.AppImage` | Make executable before launching if your desktop environment does not do that automatically. |
+| **Linux x64** | `.deb`, `.rpm`, or `.AppImage` | Use `.deb` for Debian-family systems, `.rpm` for Fedora/RPM-family systems, or AppImage as the portable fallback. AppImage may need executable permission. |
 
-Production bundles include the required media engines for the target platform. Users do not need to install aria2, yt-dlp, FFmpeg, Deno, Python, Homebrew, or a package manager for normal app usage.
+Bundles include the required engines. Users do not need aria2, yt-dlp, FFmpeg, Deno, Python, Homebrew, or another package manager.
+
+The native packages use the distribution's normal desktop runtime dependencies, while AppImage remains the portable installation option.
 
 ## Browser Extension
 
-<div align="center">
-  <a href="https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/"><img src="https://img.shields.io/badge/Install%20Firelink%20Companion-Firefox-FF7139?style=for-the-badge&logo=firefox-browser&logoColor=white" alt="Install Firelink Companion on Firefox" /></a>
-</div>
+<p align="center">
+  <a href="https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/"><img src="https://img.shields.io/badge/Install%20from-Firefox%20Add--ons-FF7139?style=for-the-badge&logo=firefox-browser&logoColor=white" alt="Install Firelink Companion from Firefox Add-ons" /></a>
+  &nbsp;&nbsp;
+  <a href="https://github.com/nimbold/Firelink-Extension#manual-chromium-installation"><img src="https://img.shields.io/badge/Manual%20install-Chromium-4285F4?style=for-the-badge&logo=googlechrome&logoColor=white" alt="Read manual Chromium install instructions" /></a>
+</p>
 
-Firelink Companion connects your browser to the desktop app so links and browser downloads can open in Firelink instead of disappearing into the browser's default download shelf.
+Firelink Companion sends browser links and downloads to the desktop app.
 
 What it adds:
 
-- **Automatic capture** for normal browser downloads, while still routing every captured link through Firelink's Add window.
-- **Context-menu actions** for "Download with Firelink" and selected links.
-- **Signed local requests** using the pairing token from **Settings -> Integrations**.
-- **Server identity checks** so the extension only trusts the real local Firelink app.
-- **Offline-safe behavior** that resumes browser downloads when Firelink is closed or rejects a handoff.
-- **Protocol-aware compatibility** so older desktop builds are rejected before automatic capture can cancel a browser download.
+- Automatic capture for regular browser downloads.
+- Explicit Fetch media actions from the popup and page context menu.
+- Context-menu actions for links and selected text.
+- Firefox and Chromium support.
+- Signed local requests using the token from **Settings -> Integrations**.
+- Fallback to the browser download when Firelink is closed or rejects a handoff.
+- Captured links always open Firelink's Add window before anything is added to the download list.
 
-Install the extension, open Firelink, then pair it from **Settings -> Integrations**. The Firefox add-on is maintained in the [Firelink-Extension](https://github.com/nimbold/Firelink-Extension) repository and is also vendored here as the `Extensions/Firefox` submodule.
+Install the extension, open Firelink, then pair it from **Settings -> Integrations**. Firefox users can install from Mozilla Add-ons. Chromium users can use the [manual load-unpacked flow](https://github.com/nimbold/Firelink-Extension#manual-chromium-installation) with `firelink-chromium.zip` from the [extension releases](https://github.com/nimbold/Firelink-Extension/releases). Firelink Companion 2.0.3 is the matching extension release for Firelink 1.0.4.
+
+The extension lives in [Firelink-Extension](https://github.com/nimbold/Firelink-Extension). This repo also vendors it as the `Extensions/Browser` submodule.
 
 ## Platforms
 
 | Target | Status |
 | --- | --- |
-| **macOS arm64** | Supported. Automated native build, engine validation, packaged launch smoke test, and unsigned DMG packaging. |
-| **Windows x64** | Supported. Native GitHub Actions build, engine validation, silent installer smoke test, and NSIS packaging. |
-| **Linux x64** | Supported. Native GitHub Actions build, engine validation, AppImage repackaging, and xvfb launch smoke test. |
+| **macOS arm64** | Supported. Native build, engine checks, launch smoke test, ad-hoc-signed DMG workflow. |
+| **Windows x64** | Supported. Native build, engine checks, silent installer smoke test, NSIS installer. |
+| **Linux x64** | Supported. Native build, bundled-engine checks, package/AppImage launch smoke tests, `.deb`, `.rpm`, and AppImage. |
 
 ## Development
 
@@ -130,7 +136,7 @@ Create a production bundle:
 npm run tauri build
 ```
 
-macOS development uses locked payloads in `src-tauri/binaries`. Windows and Linux payloads are provisioned from checksum-pinned archives:
+macOS uses locked payloads in `src-tauri/binaries`. Provision Windows and Linux payloads from checksum-pinned archives:
 
 ```sh
 node scripts/provision-engines.js --target x86_64-pc-windows-msvc
@@ -146,7 +152,7 @@ Build staging includes only the current target. See `engines.lock.json`, `engine
 ├── src/                  React and TypeScript interface
 ├── src-tauri/            Rust backend, Tauri config, and native tests
 ├── scripts/              Engine provisioning, release, and smoke-test tooling
-└── Extensions/Firefox/   Firelink Companion submodule
+└── Extensions/Browser/   Firelink Companion submodule
 ```
 
 ## Help and Project Status

RELEASE.md

@@ -5,6 +5,8 @@ Targets:
 - macOS arm64 DMG
 - Windows x64 NSIS installer
 - Linux x64 AppImage
+- Linux x64 Debian package
+- Linux x64 RPM package
 
 ## Distribution policy
 
@@ -22,6 +24,8 @@ Firelink never falls back to system-installed media tools.
 - `scripts/stage-engines.js` creates one target-specific bundle payload.
 - `scripts/verify-binaries.js` runs architecture, packaging, version, and RPC checks.
 
+Linux `.deb` and `.rpm` packages are built with the complete verified engine payload. The AppImage is built separately with the engine payload temporarily omitted, then repacked from the verified payload because the AppImage tooling can rewrite bundled native binaries.
+
 yt-dlp must remain its official PyInstaller **onedir** distribution: launcher plus adjacent `_internal` runtime. Onefile builds are rejected because repeated extraction caused roughly 17-second startup latency.
 
 ## Version update

engine-sources.lock.json

@@ -3,19 +3,19 @@
   "targets": {
     "x86_64-pc-windows-msvc": {
       "yt-dlp": {
-        "version": "2026.06.09",
-        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.06.09/yt-dlp_win.zip",
-        "sha256": "9bb27530494092870b5330deacfc65a40d3e980c7e2c67e5f09b902c37a6903d"
+        "version": "2026.07.04",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.07.04/yt-dlp_win.zip",
+        "sha256": "90254845be5282b1f4d843a873abff04f569f857f64250f833fe152b21eec152"
       },
       "deno": {
-        "version": "2.9.1",
-        "url": "https://github.com/denoland/deno/releases/download/v2.9.1/deno-x86_64-pc-windows-msvc.zip",
-        "sha256": "ab310b4232cca207d40ffa41867e93aaf9f893802bc76756e74f486a6b21b371"
+        "version": "2.9.2",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.2/deno-x86_64-pc-windows-msvc.zip",
+        "sha256": "5fe194d26ac5ef77fcc5288c2c438c7a0465f3b6180440ebf04092714bf2dcdf"
       },
       "ffmpeg": {
-        "version": "8.1.2",
-        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-06-23-13-52/ffmpeg-n8.1.2-win64-gpl-8.1.zip",
-        "sha256": "ddbe0deec00b9cfd3ee74298a46a22ac4061913ed47d92297cd168cc5a5cc625"
+        "version": "8.1.2-22-g94138f6973",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-07-06-14-19/ffmpeg-n8.1.2-22-g94138f6973-win64-gpl-8.1.zip",
+        "sha256": "a758e2836a8f33c5f21fc44270cb00392acc6d0085dd0ba14fe14ae75935813d"
       },
       "aria2c": {
         "version": "1.37.0",
@@ -25,19 +25,19 @@
     },
     "x86_64-unknown-linux-gnu": {
       "yt-dlp": {
-        "version": "2026.06.09",
-        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.06.09/yt-dlp_linux.zip",
-        "sha256": "217bbc9c3ed19ea75a7f151a3e48dbfeac7f459a7dce2deeeecc2d6e2871bd5b"
+        "version": "2026.07.04",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.07.04/yt-dlp_linux.zip",
+        "sha256": "d7d2d09e900b5ae11821b5784b18cf064984a2bd88b1ca5c798d744bcbe3658b"
       },
       "deno": {
-        "version": "2.9.1",
-        "url": "https://github.com/denoland/deno/releases/download/v2.9.1/deno-x86_64-unknown-linux-gnu.zip",
-        "sha256": "710c54d63477d1100844ef4818f19507ce0dbf40510903b1d883f19e394446a2"
+        "version": "2.9.2",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.2/deno-x86_64-unknown-linux-gnu.zip",
+        "sha256": "934d1bd5cb09eaed7f2e4a4fc58208d04a3c5c0fcde9f319d93d735265c67a4a"
       },
       "ffmpeg": {
-        "version": "8.1.2",
-        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-06-23-13-52/ffmpeg-n8.1.2-linux64-gpl-8.1.tar.xz",
-        "sha256": "0c6772b77fdbf127cc1498eca39a40e20b88817f36b66d553cebcfcca32b6d78"
+        "version": "8.1.2-22-g94138f6973",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-07-06-14-19/ffmpeg-n8.1.2-22-g94138f6973-linux64-gpl-8.1.tar.xz",
+        "sha256": "df99ffb3803ee56dc68954f43f950ea9f33685a3595a5da8a3e73ef4bef37e3c"
       },
       "aria2c": {
         "version": "1.37.0",

engines.lock.json

@@ -4,10 +4,10 @@
     "aarch64-apple-darwin": {
       "engines": {
         "yt-dlp": {
-          "version": "2026.06.09",
+          "version": "2026.07.04",
           "source": "https://github.com/yt-dlp/yt-dlp",
           "build": "PyInstaller onedir distribution with embedded Python and yt_dlp_ejs",
-          "sha256": "4eefb498e76f8a425bec30ba3ee2079b01542ca39ca1fb61b79966450794cc13"
+          "sha256": "ff7d4fc44b8fbf42da021c1bca950da0326cdb0cdb84992fdc7fb7ec215df435"
         },
         "aria2c": {
           "version": "1.37.0",
@@ -16,22 +16,22 @@
           "sha256": "111b2f5ed760f1e1a2ec06117c4e8094fcde336ba16122dda1c5e7209bf1862d"
         },
         "ffmpeg": {
-          "version": "N-125385-ge2e889d9da",
+          "version": "N-125450-gfad2e0bc50",
           "source": "https://ffmpeg.org/",
           "build": "GPLv3 build identified by binary as https://www.martin-riedl.de",
-          "sha256": "3027bd75166a596c31a271ce9ae14b5441492b9557011993c0bf873b5a7c6a09"
+          "sha256": "be2c39e5c9ef923f60da6cb62f5a209ed98b4da8a732d9f06de4355d5ea99e58"
         },
         "deno": {
-          "version": "2.9.1",
+          "version": "2.9.2",
           "source": "https://github.com/denoland/deno",
           "build": "official aarch64-apple-darwin executable",
-          "sha256": "df5e2cca5253ec99b9a630fb059bf01cdbbf586fed1f344017875c5462b2c483"
+          "sha256": "218ab752ae8f64f0a7822af710886488f15169fdae153a3aada4861f9635b266"
         }
       },
       "runtimeTrees": {
         "_internal": {
           "files": 142,
-          "sha256": "3fabc08e6367f9393cfee32c32138f057f0e6068e430190c26a22ddfea84242b"
+          "sha256": "769507d9b8d97164ef81ebb449873072697bf82acac8c7d61c7bfd96c551e210"
         },
         "aria2-libs": {
           "files": 7,

package-lock.json

@@ -1,15 +1,15 @@
 {
   "name": "firelink",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "firelink",
-      "version": "1.0.1",
+      "version": "1.0.4",
       "license": "MIT",
       "dependencies": {
-        "@formkit/auto-animate": "^0.9.0",
+        "@formkit/auto-animate": "^0.10.0",
         "@tailwindcss/vite": "^4.3.1",
         "@tauri-apps/api": "^2.11.1",
         "@tauri-apps/plugin-clipboard-manager": "^2.3.2",
@@ -18,7 +18,7 @@
         "@tauri-apps/plugin-log": "^2.8.0",
         "@tauri-apps/plugin-notification": "^2.3.3",
         "@tauri-apps/plugin-opener": "^2",
-        "lucide-react": "^1.23.0",
+        "lucide-react": "^1.24.0",
         "react": "^19.1.0",
         "react-dom": "^19.1.0",
         "zustand": "^5.0.14"
@@ -31,9 +31,9 @@
         "autoprefixer": "^10.5.2",
         "postcss": "^8.5.15",
         "tailwindcss": "^4.3.1",
-        "typescript": "^6.0.3",
-        "vite": "^8.1.3",
-        "vitest": "^4.1.9"
+        "typescript": "^7.0.2",
+        "vite": "^8.1.4",
+        "vitest": "^4.1.10"
       },
       "engines": {
         "node": ">=22"
@@ -71,9 +71,9 @@
       }
     },
     "node_modules/@formkit/auto-animate": {
-      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/@formkit/auto-animate/-/auto-animate-0.9.0.tgz",
-      "integrity": "sha512-VhP4zEAacXS3dfTpJpJ88QdLqMTcabMg0jwpOSxZ/VzfQVfl3GkZSCZThhGC5uhq/TxPHPzW0dzr4H9Bb1OgKA==",
+      "version": "0.10.0",
+      "resolved": "https://registry.npmjs.org/@formkit/auto-animate/-/auto-animate-0.10.0.tgz",
+      "integrity": "sha512-KGomRttjUfORuPUaR/ZGQw+6xfMrTM+sxnILv7JAd9AmabU9rg9i6gF/iC0Ih+QpKCubJpCA/1DX9UHKE8cX+A==",
       "license": "MIT"
     },
     "node_modules/@jridgewell/gen-mapping": {
@@ -140,18 +140,18 @@
       }
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.137.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.137.0.tgz",
-      "integrity": "sha512-WT+Gb24i8hmvo85AIv2oEYouEXkRlKAlT9WaCa3TfLgNCN+GhrJOGZuIlMouAh38Qe4QOx26eUOVsq70qXrywA==",
+      "version": "0.139.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.139.0.tgz",
+      "integrity": "sha512-r9gHphtCs+1M7J0pw6Sn/hh/Wpa/iQrOOkrNAlVLF/gHq+/CJmHIWKKUUhdWjcD6CIa8idarspCsASiXCXvFUw==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/Boshen"
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.3.tgz",
-      "integrity": "sha512-DT6Z3PhvioeHMvxo+xHc3KtqggrI7CCTXCmC2h/5zUlp5jVitv7XEy+9q5/7v8IolhlioawpMo8Kg0EEBy7J0g==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.5.tgz",
+      "integrity": "sha512-lZg8fqIv2v7FF237bwMgzGZEJvGL79/s5knJ/i6FmsGF4XXlzccZ4jb+TrFIxtSSxFtIpdsgrPZeMk1I9AFcyQ==",
       "cpu": [
         "arm64"
       ],
@@ -165,9 +165,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.3.tgz",
-      "integrity": "sha512-0NwgwsjM7LrsuVnXMK3koTpagBNOhloc/BNjKqZjv4V5zI5r13qx69uVhRx+o5Z0yy4Hzq+lpy7TAgUG/ocvrw==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.5.tgz",
+      "integrity": "sha512-51Bnx9pNiMRKSUNtBfySkNJ9vMU9Hh3I1ozDd6gyPPYzaXCfnptUcEZxXGYFn+ul2dtcMUiqGR1Yai2K10uoTw==",
       "cpu": [
         "arm64"
       ],
@@ -181,9 +181,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.3.tgz",
-      "integrity": "sha512-YtiBp4disu6V560loT6PjMdiRaWmVvDNrUunAalbiFx2ggeJwxdAsgZMcoGP17uyAsTwAj5V1niksxlHnVQ1Sw==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.5.tgz",
+      "integrity": "sha512-Tm+gbfC0aHu1tBA/JvKQh32S0K6YgCHkiAF4/W6xX0K0RmNuc94VeK419dJoE65R5aRxmo+noZQSWrAMF6yb6g==",
       "cpu": [
         "x64"
       ],
@@ -197,9 +197,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.3.tgz",
-      "integrity": "sha512-yD3EkEdXk2LypPxnf/kSZHirarsI8gcPzc62SukhR9VJTyvV+F9Q/GxWNuCojc7sXyuVC4DxRGhdDK4X8VSsbw==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.5.tgz",
+      "integrity": "sha512-JMzDKCCXq93YccG5gz3hvOs1oXRKAf0XYpfOS88e+wZrC8Iugj6j68867vrYZkvpDDpKn/KoKORThmchMpF6TA==",
       "cpu": [
         "x64"
       ],
@@ -213,9 +213,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.3.tgz",
-      "integrity": "sha512-c+8vieQbsD7HNAHKIA34w0GJ9FedFFuJGD+7E6vz7Q3uqAIugL5p45fhlsj4UaAsHpcmlqugBWMhA0/j7o0sIg==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.5.tgz",
+      "integrity": "sha512-uML21j2K5TfPGutKxub+M+nLjZIrWjXQ5Grx4lCe/nimTj9B4L63zHpjXLl4y0L3mcm2htEQIb06oCG/szerNw==",
       "cpu": [
         "arm"
       ],
@@ -229,9 +229,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.3.tgz",
-      "integrity": "sha512-50jD0uUwLvur7Zz9LHz17kaAdTPjn5wN93hEgjvmYFRZwiR7ZJYovTd5ipyWJDAnXKvZ+wgc+/Ika6dwSF5OcA==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.5.tgz",
+      "integrity": "sha512-navSiuTMogvnQoZoM/v+l3ZWo50/NTwSHSzheABx/RCnmUPaKwq9qSo4Br2OYRs21+Fz8uFqITZM3H4opOB0/Q==",
       "cpu": [
         "arm64"
       ],
@@ -245,9 +245,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.3.tgz",
-      "integrity": "sha512-BO9+oPL8K9poZJBfYPsXNtYjPE5uM3qeehT3aFcW4LITOl+iSqhp0abzjR2nWBUNjIZeKXjAEWBZ64WjNoHd6w==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.5.tgz",
+      "integrity": "sha512-lAryqH7IteztmCXQXk0etKj4wBQ7Gx5S6LjKhsgp9zb8I5bsuvU/2llH1hDQcjsFeqIsovMVN339/8pUDDBXxA==",
       "cpu": [
         "arm64"
       ],
@@ -261,9 +261,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.3.tgz",
-      "integrity": "sha512-f3VpLB1vQ0Eo6ecr/6cekLnvYMFF4YBFoVGkfkvPLq1bAkbAwHYQPZKoAmG6OJyTcxxoC+AvezGx/S1obNC0Mw==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.5.tgz",
+      "integrity": "sha512-fsK/sNBnxzBlL4O1JNrZakVQxPspqpED5dLtNsZS9oOKmtSpdNIzxH2kkol5HYTWJN47sE20ztMJPxfZ89qGOg==",
       "cpu": [
         "ppc64"
       ],
@@ -277,9 +277,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.3.tgz",
-      "integrity": "sha512-AmurZ26Pqx/RI9N1gzEOCklkKXl927yjfXWUUS0O7Puh8ARM/Ob8qfrD3qnWksScdw6cSrW5PSHE9DyLu7+PtA==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.5.tgz",
+      "integrity": "sha512-gLYb4BIadlfTOYT5gO503n8zQjXflgzpD0FcyKh0Mzx3rqCZKnHoJWV9xe1KXUJ5lx2JfcSHr/mhzS0PC/McAA==",
       "cpu": [
         "s390x"
       ],
@@ -293,9 +293,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.3.tgz",
-      "integrity": "sha512-JJpqs8bRGITDOdbkNKnlojzBabbOHrqjSvDr0IVsZObE1lBcPjxItUEY9eWIDbxaJ3cGrXPWGfGkIxFijg/URg==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.5.tgz",
+      "integrity": "sha512-FjcpEKUyJygHgs1o50VYNvkt5+7Le/VEdYt0AkRpkL33MnyQfwr8l5mXwMmfmTbyMPr5vJLC+8/Gd9gXnwU1QQ==",
       "cpu": [
         "x64"
       ],
@@ -309,9 +309,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.3.tgz",
-      "integrity": "sha512-rSJcdjPxzA/by/6/rYs+v+bXU7UjvnbUWz8MJb6kh6+knqB1dCrtHg0uu7C/4haqJvqdkYHQ5IGn+tCH9GLW/g==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.5.tgz",
+      "integrity": "sha512-Me+PfPI2TMeOQk0gYWfLQZtTktrmzbr8cDboqX83XKc7UrgAi55gF+2dUkWdxd19n55Essp2yeca+O9N5rBxHg==",
       "cpu": [
         "x64"
       ],
@@ -325,9 +325,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.3.tgz",
-      "integrity": "sha512-hQ3/PYkDJICgevvyNcVrihVeqq7k1Pp3VZ9lY+dauAYUJKO+auqApvANhvR1An9BhmqYKvW2Mu1F9u4DXSMLxQ==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.5.tgz",
+      "integrity": "sha512-yc5WrLzXks6zCQfn9Oxr8pORKyl/pF+QjHmW/Qx3qu0oyrrNC+y2JLTU1E2rcWYAmzlnqngWXHQjy51VzW70Vw==",
       "cpu": [
         "arm64"
       ],
@@ -341,9 +341,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.3.tgz",
-      "integrity": "sha512-Elcv/BtML9lXrV6JuKITc/grN2kYV9gjsQpW8Jfw4ioK0TOkjBjye0nnyqQNy9STNaI20lXNaQBRrD5gSgR0Yg==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.5.tgz",
+      "integrity": "sha512-VbQGPX2b4r48TAMIM2cjgluIM1HYutm4pcTEJsle7iEP7sB1dFqtPLBVbdLAZCxy1txCcPxf4QFf4v8uvltPqA==",
       "cpu": [
         "wasm32"
       ],
@@ -359,9 +359,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.3.tgz",
-      "integrity": "sha512-2DrEfhluH9yhiaFApmsjsjwrSYbNcY1oFTzYSP1a535jDbV98zCFanA/96TBUd0iDFcxGmw9QRExwGCXz3U+/g==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.5.tgz",
+      "integrity": "sha512-gHv82k63z4qpV5+Q1y/12KrK0ltWBukVDI8nZcbT7Tt/ZlOIVwppazneq0F93oDxTo3IgAMEDIoQh3E2n6mVsw==",
       "cpu": [
         "arm64"
       ],
@@ -375,9 +375,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.3.tgz",
-      "integrity": "sha512-OL4OMk7UPXOeVGGd3qo5zJyPIljf4AFgk5QAkPPS+OoLuOOozhuaQGC18MxVTnw/06q93gShAJzlwnSCY9YtqA==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.5.tgz",
+      "integrity": "sha512-tTZuDBPw85tEN5PQi1pnEBzDy0Z49HtScLAbD5t6hyeU92A95pRWaSMw1GZZi/RwgSgUIl0xrSlXIT/9QzvYSA==",
       "cpu": [
         "x64"
       ],
@@ -996,6 +996,346 @@
         "@types/react": "^19.2.0"
       }
     },
+    "node_modules/@typescript/typescript-aix-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
+      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
+      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
+      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
+      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
+      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
+      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-loong64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
+      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-mips64el": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
+      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
+      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-riscv64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
+      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-s390x": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
+      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
+      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-sunos-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
+      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-win32-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
+      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-win32-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
+      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
     "node_modules/@vitejs/plugin-react": {
       "version": "6.0.3",
       "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.3.tgz",
@@ -1023,16 +1363,16 @@
       }
     },
     "node_modules/@vitest/expect": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
-      "integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==",
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.10.tgz",
+      "integrity": "sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.9",
-        "@vitest/utils": "4.1.9",
+        "@vitest/spy": "4.1.10",
+        "@vitest/utils": "4.1.10",
         "chai": "^6.2.2",
         "tinyrainbow": "^3.1.0"
       },
@@ -1041,13 +1381,13 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz",
-      "integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==",
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.10.tgz",
+      "integrity": "sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.9",
+        "@vitest/spy": "4.1.10",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -1068,9 +1408,9 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
-      "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.10.tgz",
+      "integrity": "sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1081,13 +1421,13 @@
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz",
-      "integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==",
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.10.tgz",
+      "integrity": "sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.9",
+        "@vitest/utils": "4.1.10",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -1095,14 +1435,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz",
-      "integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==",
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.10.tgz",
+      "integrity": "sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.9",
-        "@vitest/utils": "4.1.9",
+        "@vitest/pretty-format": "4.1.10",
+        "@vitest/utils": "4.1.10",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -1111,9 +1451,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
-      "integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.10.tgz",
+      "integrity": "sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -1121,13 +1461,13 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
-      "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.10.tgz",
+      "integrity": "sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.9",
+        "@vitest/pretty-format": "4.1.10",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -1650,9 +1990,9 @@
       }
     },
     "node_modules/lucide-react": {
-      "version": "1.23.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.23.0.tgz",
-      "integrity": "sha512-38BpJcD0JhFosxHApP/BYsBetLpQFRoTRzEzstM/XCc3jsAG7wqaY1lgVwxiUe3xqYE+lNxo2PkCmYwXWrwwIw==",
+      "version": "1.24.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.24.0.tgz",
+      "integrity": "sha512-YT6mBD8lGKkg4nM39enlm94/sfJIiW0YKUT60fBy4YK8tai31ylg1VhGNWxkpSKHo9UagfnZqwIff3HTDQwXeA==",
       "license": "ISC",
       "peerDependencies": {
         "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
@@ -1723,9 +2063,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -1791,12 +2131,12 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.3.tgz",
-      "integrity": "sha512-1F1eEtUBtFvcGm1HQ9TiUIUHPQG7mSAODrhIzjxoUEFuo8OcbrGLiVLkevNgj84TE4lnHvnumwFjhJO5Eu135g==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.5.tgz",
+      "integrity": "sha512-t9z29cJjXf/vxQ8dyhCSpt6H6aSwHTk8cT5I3iy6SMXuFpk5mB6PL6XfC8PCwrPTx93udwKUm9HRteAlTGBLiA==",
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.137.0",
+        "@oxc-project/types": "=0.139.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -1806,21 +2146,21 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.1.3",
-        "@rolldown/binding-darwin-arm64": "1.1.3",
-        "@rolldown/binding-darwin-x64": "1.1.3",
-        "@rolldown/binding-freebsd-x64": "1.1.3",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.1.3",
-        "@rolldown/binding-linux-arm64-gnu": "1.1.3",
-        "@rolldown/binding-linux-arm64-musl": "1.1.3",
-        "@rolldown/binding-linux-ppc64-gnu": "1.1.3",
-        "@rolldown/binding-linux-s390x-gnu": "1.1.3",
-        "@rolldown/binding-linux-x64-gnu": "1.1.3",
-        "@rolldown/binding-linux-x64-musl": "1.1.3",
-        "@rolldown/binding-openharmony-arm64": "1.1.3",
-        "@rolldown/binding-wasm32-wasi": "1.1.3",
-        "@rolldown/binding-win32-arm64-msvc": "1.1.3",
-        "@rolldown/binding-win32-x64-msvc": "1.1.3"
+        "@rolldown/binding-android-arm64": "1.1.5",
+        "@rolldown/binding-darwin-arm64": "1.1.5",
+        "@rolldown/binding-darwin-x64": "1.1.5",
+        "@rolldown/binding-freebsd-x64": "1.1.5",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.5",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.5",
+        "@rolldown/binding-linux-arm64-musl": "1.1.5",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.5",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.5",
+        "@rolldown/binding-linux-x64-gnu": "1.1.5",
+        "@rolldown/binding-linux-x64-musl": "1.1.5",
+        "@rolldown/binding-openharmony-arm64": "1.1.5",
+        "@rolldown/binding-wasm32-wasi": "1.1.5",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.5",
+        "@rolldown/binding-win32-x64-msvc": "1.1.5"
       }
     },
     "node_modules/scheduler": {
@@ -1929,17 +2269,38 @@
       "optional": true
     },
     "node_modules/typescript": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
-      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
+      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
+        "tsc": "bin/tsc"
       },
       "engines": {
-        "node": ">=14.17"
+        "node": ">=16.20.0"
+      },
+      "optionalDependencies": {
+        "@typescript/typescript-aix-ppc64": "7.0.2",
+        "@typescript/typescript-darwin-arm64": "7.0.2",
+        "@typescript/typescript-darwin-x64": "7.0.2",
+        "@typescript/typescript-freebsd-arm64": "7.0.2",
+        "@typescript/typescript-freebsd-x64": "7.0.2",
+        "@typescript/typescript-linux-arm": "7.0.2",
+        "@typescript/typescript-linux-arm64": "7.0.2",
+        "@typescript/typescript-linux-loong64": "7.0.2",
+        "@typescript/typescript-linux-mips64el": "7.0.2",
+        "@typescript/typescript-linux-ppc64": "7.0.2",
+        "@typescript/typescript-linux-riscv64": "7.0.2",
+        "@typescript/typescript-linux-s390x": "7.0.2",
+        "@typescript/typescript-linux-x64": "7.0.2",
+        "@typescript/typescript-netbsd-arm64": "7.0.2",
+        "@typescript/typescript-netbsd-x64": "7.0.2",
+        "@typescript/typescript-openbsd-arm64": "7.0.2",
+        "@typescript/typescript-openbsd-x64": "7.0.2",
+        "@typescript/typescript-sunos-x64": "7.0.2",
+        "@typescript/typescript-win32-arm64": "7.0.2",
+        "@typescript/typescript-win32-x64": "7.0.2"
       }
     },
     "node_modules/update-browserslist-db": {
@@ -1974,15 +2335,15 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.1.3",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.3.tgz",
-      "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
+      "version": "8.1.4",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.4.tgz",
+      "integrity": "sha512-bTT9PsdWO+MQMNG9ZXIP/qM9wGh37DFxTV/sPq9cFpHr3w4jkgef032PkAL9jAqhk3Nz8NQw3O8n6/xFkqO4QQ==",
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
-        "picomatch": "^4.0.4",
+        "picomatch": "^4.0.5",
         "postcss": "^8.5.16",
-        "rolldown": "~1.1.3",
+        "rolldown": "~1.1.4",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
@@ -2051,19 +2412,19 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
-      "integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==",
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.10.tgz",
+      "integrity": "sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.9",
-        "@vitest/mocker": "4.1.9",
-        "@vitest/pretty-format": "4.1.9",
-        "@vitest/runner": "4.1.9",
-        "@vitest/snapshot": "4.1.9",
-        "@vitest/spy": "4.1.9",
-        "@vitest/utils": "4.1.9",
+        "@vitest/expect": "4.1.10",
+        "@vitest/mocker": "4.1.10",
+        "@vitest/pretty-format": "4.1.10",
+        "@vitest/runner": "4.1.10",
+        "@vitest/snapshot": "4.1.10",
+        "@vitest/spy": "4.1.10",
+        "@vitest/utils": "4.1.10",
         "es-module-lexer": "^2.0.0",
         "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
@@ -2091,12 +2452,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.9",
-        "@vitest/browser-preview": "4.1.9",
-        "@vitest/browser-webdriverio": "4.1.9",
-        "@vitest/coverage-istanbul": "4.1.9",
-        "@vitest/coverage-v8": "4.1.9",
-        "@vitest/ui": "4.1.9",
+        "@vitest/browser-playwright": "4.1.10",
+        "@vitest/browser-preview": "4.1.10",
+        "@vitest/browser-webdriverio": "4.1.10",
+        "@vitest/coverage-istanbul": "4.1.10",
+        "@vitest/coverage-v8": "4.1.10",
+        "@vitest/ui": "4.1.10",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"

package.json

@@ -1,7 +1,7 @@
 {
   "name": "firelink",
   "private": true,
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "A fast cross-platform desktop download manager powered by Rust, Tauri, React, aria2, and yt-dlp.",
   "license": "MIT",
   "homepage": "https://github.com/nimbold/Firelink",
@@ -32,12 +32,13 @@
     "bindings": "cd src-tauri && cargo test export_bindings --lib",
     "build": "tsc && vite build",
     "check:updates": "node scripts/check-updates.js",
+    "verify:macos-signing": "node scripts/verify-macos-signing.js",
     "preview": "vite preview",
     "tauri": "tauri",
     "test": "vitest"
   },
   "dependencies": {
-    "@formkit/auto-animate": "^0.9.0",
+    "@formkit/auto-animate": "^0.10.0",
     "@tailwindcss/vite": "^4.3.1",
     "@tauri-apps/api": "^2.11.1",
     "@tauri-apps/plugin-clipboard-manager": "^2.3.2",
@@ -46,7 +47,7 @@
     "@tauri-apps/plugin-log": "^2.8.0",
     "@tauri-apps/plugin-notification": "^2.3.3",
     "@tauri-apps/plugin-opener": "^2",
-    "lucide-react": "^1.23.0",
+    "lucide-react": "^1.24.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "zustand": "^5.0.14"
@@ -59,8 +60,8 @@
     "autoprefixer": "^10.5.2",
     "postcss": "^8.5.15",
     "tailwindcss": "^4.3.1",
-    "typescript": "^6.0.3",
-    "vite": "^8.1.3",
-    "vitest": "^4.1.9"
+    "typescript": "^7.0.2",
+    "vite": "^8.1.4",
+    "vitest": "^4.1.10"
   }
 }

scripts/check-updates.js

@@ -33,10 +33,17 @@ function compareVersions(left, right) {
 }
 
 function npmOutdated(cwd) {
+  if (!fs.existsSync(path.join(cwd, 'package.json'))) {
+    throw new Error(`npm workspace is missing package.json: ${cwd}`);
+  }
   try {
     execFileSync('npm', ['outdated', '--json'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
     return {};
   } catch (error) {
+    if (error.status !== 1) {
+      const details = error.stderr?.toString().trim();
+      throw new Error(details || `npm outdated failed in ${cwd}`);
+    }
     const output = error.stdout?.toString() || '{}';
     return JSON.parse(output || '{}');
   }
@@ -73,6 +80,30 @@ async function latestMartinRiedlMacArm64Release() {
   return match?.[1];
 }
 
+async function latestMartinRiedlMacArm64Snapshot() {
+  const html = await fetchText('https://ffmpeg.martin-riedl.de/');
+  const snapshotSection = html.split('Download Snapshot Build')[1]?.split('Download Release Build')[0] || '';
+  const match =
+    snapshotSection.match(/macOS \(Apple Silicon\/arm64\)[\s\S]*?<b>Release:\s*<\/b>\s*([A-Za-z0-9.-]+)/) ||
+    snapshotSection.match(/macOS \(Apple Silicon\/arm64\)[\s\S]*?Release:\s*([A-Za-z0-9.-]+)/);
+  return match?.[1];
+}
+
+async function latestBtbnFfmpegN81Build() {
+  const releases = await fetchJson('https://api.github.com/repos/BtbN/FFmpeg-Builds/releases?per_page=10');
+  for (const release of releases) {
+    if (release.tag_name === 'latest') continue;
+    const versions = (release.assets || [])
+      .map(asset => asset.name.match(/^ffmpeg-n(8\.1\.\d+-\d+-g[0-9a-f]+)-(?:win64-gpl-8\.1\.zip|linux64-gpl-8\.1\.tar\.xz)$/)?.[1])
+      .filter(Boolean);
+    const unique = [...new Set(versions)];
+    if (unique.length === 1 && versions.length >= 2) {
+      return unique[0];
+    }
+  }
+  return undefined;
+}
+
 function printNpmReport(label, outdated) {
   const entries = Object.entries(outdated);
   if (!entries.length) {
@@ -125,16 +156,26 @@ async function main() {
 
   outdatedCount += printNpmReport('root npm', npmOutdated(repoRoot));
   outdatedCount += printNpmReport(
-    'Firefox extension npm',
-    npmOutdated(path.join(repoRoot, 'Extensions', 'Firefox'))
+    'Browser extension npm',
+    npmOutdated(path.join(repoRoot, 'Extensions', 'Browser'))
   );
 
-  const [ytDlp, deno, aria2, ffmpeg, martinRiedlMacArm64Ffmpeg] = await Promise.all([
+  const [
+    ytDlp,
+    deno,
+    aria2,
+    ffmpeg,
+    martinRiedlMacArm64Ffmpeg,
+    martinRiedlMacArm64Snapshot,
+    btbnFfmpegN81Build,
+  ] = await Promise.all([
     githubLatest('yt-dlp/yt-dlp'),
     githubLatest('denoland/deno'),
     githubLatest('aria2/aria2'),
     latestFfmpegStable(),
     latestMartinRiedlMacArm64Release(),
+    latestMartinRiedlMacArm64Snapshot(),
+    latestBtbnFfmpegN81Build(),
   ]);
   const latestByEngine = {
     'yt-dlp': ytDlp.tag_name,
@@ -143,13 +184,18 @@ async function main() {
     ffmpeg,
   };
   const latestByTargetEngine = {
-    'aarch64-apple-darwin:ffmpeg': martinRiedlMacArm64Ffmpeg,
+    'x86_64-pc-windows-msvc:ffmpeg': btbnFfmpegN81Build || ffmpeg,
+    'x86_64-unknown-linux-gnu:ffmpeg': btbnFfmpegN81Build || ffmpeg,
+    'aarch64-apple-darwin:ffmpeg': martinRiedlMacArm64Snapshot || martinRiedlMacArm64Ffmpeg,
   };
 
   console.log('\nlatest engines:');
   for (const [engine, version] of Object.entries(latestByEngine)) {
     console.log(`  ${engine}: ${normalizeVersion(version)}`);
   }
+  console.log('\nlatest engine provider builds:');
+  console.log(`  BtbN FFmpeg n8.1 Windows/Linux: ${normalizeVersion(btbnFfmpegN81Build || ffmpeg)}`);
+  console.log(`  Martin Riedl FFmpeg macOS arm64 snapshot: ${normalizeVersion(martinRiedlMacArm64Snapshot || martinRiedlMacArm64Ffmpeg)}`);
 
   console.log('\nengine source lock:');
   outdatedCount += checkRows(

scripts/verify-linux-packages.js

@@ -0,0 +1,264 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { collectRegularFiles, sha256 } from './engine-payload-integrity.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const __filename = fileURLToPath(import.meta.url);
+const repoRoot = path.resolve(__dirname, '..');
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function fail(message) {
+  console.error(`[FAIL] ${message}`);
+  process.exit(1);
+}
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd ?? repoRoot,
+    env: { ...process.env, ...options.env },
+    stdio: options.stdio ?? 'inherit',
+    encoding: options.stdio === 'pipe' ? 'utf8' : undefined,
+  });
+
+  if (result.error) {
+    fail(`Failed to run ${command}: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    if (options.stdio === 'pipe') {
+      if (result.stdout) process.stdout.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+    }
+    fail(`${command} exited with status ${result.status}`);
+  }
+  return result;
+}
+
+function findSingle(directory, extension, label) {
+  if (!fs.existsSync(directory) || !fs.statSync(directory).isDirectory()) {
+    fail(`${label} directory does not exist: ${directory}`);
+  }
+
+  const matches = fs.readdirSync(directory)
+    .filter(name => name.endsWith(extension))
+    .map(name => path.join(directory, name));
+  if (matches.length !== 1) {
+    fail(`Expected exactly one ${label}, found ${matches.length} in ${directory}`);
+  }
+  return matches[0];
+}
+
+function assertPackageListing(packageFile, packageType, expectedPath) {
+  const result = packageType === 'deb'
+    ? run('dpkg-deb', ['--contents', packageFile], { stdio: 'pipe' })
+    : run('rpm', ['-qpl', packageFile], { stdio: 'pipe' });
+  const listing = result.stdout ?? '';
+  assertSafePackageListing(listing, packageType);
+  if (!listing.includes(expectedPath)) {
+    fail(`${packageType} package is missing ${expectedPath}`);
+  }
+  if (!/usr\/share\/applications\/[^/]+\.desktop/.test(listing)) {
+    fail(`${packageType} package is missing its desktop entry`);
+  }
+}
+
+function assertPackageRecommendations(packageFile, packageType) {
+  const result = packageType === 'deb'
+    ? run('dpkg-deb', ['--field', packageFile, 'Recommends'], { stdio: 'pipe' })
+    : run('rpm', ['-qp', '--recommends', packageFile], { stdio: 'pipe' });
+  const recommendations = result.stdout ?? '';
+  const dependencyNames = packageType === 'deb'
+    ? recommendations
+      .split(/[,|]/)
+      .map(value => value.trim().split(/\s+/, 1)[0]?.split(':', 1)[0])
+    : recommendations
+      .split('\n')
+      .map(value => value.trim().split(/\s+/, 1)[0]);
+  for (const dependency of ['desktop-file-utils', 'xdg-utils']) {
+    if (!dependencyNames.includes(dependency)) {
+      fail(`${packageType} package is missing its ${dependency} recommendation`);
+    }
+  }
+}
+
+export function parseDebianPackagePath(line) {
+  const match = line.match(/^\S+\s+\S+\s+\S+\s+\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}\s+(.*)$/);
+  if (!match) {
+    throw new Error(`Could not parse a Debian package path: ${line}`);
+  }
+  return match[1].replace(/^\.\//, '');
+}
+
+function assertSafePackageListing(listing, packageType) {
+  const lines = listing.split('\n').filter(Boolean);
+  const paths = packageType === 'deb'
+    ? lines.map(line => {
+      try {
+        return parseDebianPackagePath(line);
+      } catch (error) {
+        fail(error.message);
+      }
+    })
+    : lines.map(line => line.replace(/^\/+/, ''));
+
+  for (const packagePath of paths) {
+    const parts = packagePath.split('/');
+    if (parts.includes('..') || (parts[0] !== 'usr' && packagePath !== 'usr')) {
+      fail(`${packageType} package contains an unsafe path: ${packagePath}`);
+    }
+  }
+}
+
+function extractDeb(packageFile, destination) {
+  fs.mkdirSync(destination, { recursive: true });
+  run('dpkg-deb', ['--extract', packageFile, destination]);
+}
+
+function extractRpm(packageFile, destination) {
+  fs.mkdirSync(destination, { recursive: true });
+  run('bsdtar', [
+    '--extract',
+    '--file', packageFile,
+    '--directory', destination,
+    '--no-same-owner',
+    '--no-same-permissions',
+  ]);
+}
+
+function readPayloadManifest(root, label) {
+  const manifestPath = path.join(root, 'payload-manifest.json');
+  if (!fs.existsSync(manifestPath)) {
+    fail(`${label} payload manifest is missing`);
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  } catch (error) {
+    fail(`${label} payload manifest is invalid: ${error.message}`);
+  }
+  return manifest;
+}
+
+function findPayloadRoot(root, target, label) {
+  const expectedBinary = `yt-dlp-${target}`;
+  const matches = [];
+  const walk = directory => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const candidate = path.join(directory, entry.name);
+      if (!entry.isDirectory()) continue;
+      if (fs.existsSync(path.join(candidate, expectedBinary)) && fs.existsSync(path.join(candidate, 'payload-manifest.json'))) {
+        matches.push(candidate);
+      }
+      walk(candidate);
+    }
+  };
+  walk(root);
+  if (matches.length !== 1) {
+    fail(`Expected exactly one ${label} engine payload root, found ${matches.length}`);
+  }
+  return matches[0];
+}
+
+function assertPayloadMatchesSource(sourceRoot, packagedRoot, target, label) {
+  const sourceManifest = readPayloadManifest(sourceRoot, 'Provisioned engine');
+  if (sourceManifest.target !== target) {
+    fail(`Provisioned engine payload target mismatch: expected ${target}, got ${sourceManifest.target}`);
+  }
+
+  const packagedManifest = readPayloadManifest(packagedRoot, label);
+  if (packagedManifest.target !== target) {
+    fail(`${label} payload target mismatch: expected ${target}, got ${packagedManifest.target}`);
+  }
+
+  const expectedFiles = Object.keys(sourceManifest.files || {}).sort();
+  const packagedFiles = collectRegularFiles(packagedRoot, { ignoredNames: ['payload-manifest.json'] })
+    .map(file => path.relative(packagedRoot, file).split(path.sep).join('/'))
+    .sort();
+  if (JSON.stringify(packagedFiles) !== JSON.stringify(expectedFiles)) {
+    fail(`${label} payload files differ from the provisioned engine manifest`);
+  }
+
+  for (const relative of expectedFiles) {
+    const packagedFile = path.join(packagedRoot, relative);
+    if (sha256(packagedFile) !== sourceManifest.files[relative]) {
+      fail(`${label} payload checksum mismatch: ${relative}`);
+    }
+  }
+}
+
+function findExecutable(root) {
+  const candidates = [
+    path.join(root, 'usr', 'bin', 'firelink'),
+    path.join(root, 'usr', 'bin', 'Firelink'),
+  ];
+  const executable = candidates.find(candidate => {
+    if (!fs.existsSync(candidate)) return false;
+    const stat = fs.lstatSync(candidate);
+    return stat.isFile() && !stat.isSymbolicLink();
+  });
+  if (!executable) {
+    fail(`Packaged Firelink executable was not found under ${root}`);
+  }
+  return executable;
+}
+
+function verifyExtractedPackage(packageType, packageFile, target, root) {
+  const sourceRoot = path.join(repoRoot, 'src-tauri', 'provisioned-engines', target);
+  const packagedRoot = findPayloadRoot(root, target, packageType);
+  assertPayloadMatchesSource(sourceRoot, packagedRoot, target, packageType);
+  run(process.execPath, [
+    path.join(repoRoot, 'scripts', 'verify-binaries.js'),
+    '--search-root',
+    root,
+    '--target',
+    target,
+  ]);
+
+  const executable = findExecutable(root);
+  run('xvfb-run', [
+    '-a',
+    process.execPath,
+    path.join(repoRoot, 'scripts', 'smoke-packaged-app.js'),
+    '--executable',
+    executable,
+  ], { env: { APPDIR: root } });
+}
+
+function main() {
+  const target = argValue('--target');
+  if (!target) fail('Pass --target <Rust target triple>.');
+  if (os.platform() !== 'linux') fail('Linux package verification must run on Linux.');
+
+  const bundleRoot = path.join(repoRoot, 'src-tauri', 'target', target, 'release', 'bundle');
+  const deb = findSingle(path.join(bundleRoot, 'deb'), '.deb', 'Debian package');
+  const rpm = findSingle(path.join(bundleRoot, 'rpm'), '.rpm', 'RPM package');
+  const extractionRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-linux-packages-'));
+  const debRoot = path.join(extractionRoot, 'deb');
+  const rpmRoot = path.join(extractionRoot, 'rpm');
+
+  try {
+    assertPackageListing(deb, 'deb', 'usr/share/metainfo/com.nimbold.firelink.metainfo.xml');
+    assertPackageRecommendations(deb, 'deb');
+    extractDeb(deb, debRoot);
+    verifyExtractedPackage('deb', deb, target, debRoot);
+
+    assertPackageListing(rpm, 'rpm', 'usr/share/metainfo/com.nimbold.firelink.metainfo.xml');
+    assertPackageRecommendations(rpm, 'rpm');
+    extractRpm(rpm, rpmRoot);
+    verifyExtractedPackage('rpm', rpm, target, rpmRoot);
+    console.log('Linux .deb and .rpm payload and launch verification passed.');
+  } finally {
+    fs.rmSync(extractionRoot, { recursive: true, force: true });
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === __filename) {
+  main();
+}

scripts/verify-linux-packages.node-test.js

@@ -0,0 +1,25 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { parseDebianPackagePath } from './verify-linux-packages.js';
+
+test('parses current dpkg-deb listings without a ./ prefix', () => {
+  assert.equal(
+    parseDebianPackagePath('drwxr-xr-x 0/0               0 2026-07-12 07:24 usr/share/'),
+    'usr/share/'
+  );
+});
+
+test('parses legacy dpkg-deb listings with a ./ prefix', () => {
+  assert.equal(
+    parseDebianPackagePath('-rwxr-xr-x root/root     123 2026-07-12 07:24 ./usr/bin/firelink'),
+    'usr/bin/firelink'
+  );
+});
+
+test('rejects malformed dpkg-deb listing lines', () => {
+  assert.throws(
+    () => parseDebianPackagePath('not a dpkg-deb listing'),
+    /Could not parse a Debian package path/
+  );
+});

scripts/verify-macos-signing.js

@@ -0,0 +1,306 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync, spawnSync } from 'node:child_process';
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+const appArg = argValue('--app');
+const dmgArg = argValue('--dmg');
+
+if (process.platform !== 'darwin') {
+  console.error('macOS signing verification must run on a macOS host.');
+  process.exit(1);
+}
+
+if (!appArg && !dmgArg) {
+  console.error('Pass --app <Firelink.app> and/or --dmg <Firelink.dmg>.');
+  process.exit(1);
+}
+
+let exitCode = 0;
+
+function fail(message) {
+  console.error(`[FAIL] ${message}`);
+  exitCode = 1;
+}
+
+function ok(message) {
+  console.log(`[OK] ${message}`);
+}
+
+function note(message) {
+  console.log(`[INFO] ${message}`);
+}
+
+function run(command, args, options = {}) {
+  return execFileSync(command, args, {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    ...options,
+  });
+}
+
+function runResult(command, args) {
+  return spawnSync(command, args, {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+}
+
+function assertAppPath(appPath, label) {
+  if (!fs.existsSync(appPath)) {
+    fail(`${label} does not exist at ${appPath}`);
+    return false;
+  }
+
+  const stat = fs.statSync(appPath);
+  if (!stat.isDirectory() || path.extname(appPath) !== '.app') {
+    fail(`${label} is not an .app bundle: ${appPath}`);
+    return false;
+  }
+
+  ok(`${label} exists: ${appPath}`);
+  return true;
+}
+
+function codesignDetails(targetPath) {
+  const result = runResult('codesign', ['-dv', '--verbose=4', targetPath]);
+  return {
+    ok: result.status === 0,
+    output: `${result.stdout || ''}${result.stderr || ''}`,
+  };
+}
+
+function verifyCodeSignature(targetPath, label, options = {}) {
+  const {
+    deep = false,
+    quietOk = false,
+    requireAdhoc = false,
+    warnOnVerifyFailure = false,
+  } = options;
+  const verifyArgs = ['--verify'];
+  if (deep) {
+    verifyArgs.push('--deep');
+  }
+  verifyArgs.push('--strict', '--verbose=2', targetPath);
+
+  const details = codesignDetails(targetPath);
+  if (!details.ok) {
+    fail(`${label}: no readable code signature: ${details.output.trim() || 'codesign -dv failed'}`);
+    return 'failed';
+  }
+
+  let status = 'verified';
+  try {
+    run('codesign', verifyArgs);
+    if (!quietOk) {
+      ok(`${label}: codesign verification passed`);
+    }
+  } catch (error) {
+    const detail = error.stderr?.trim() || error.message;
+    if (!warnOnVerifyFailure) {
+      fail(`${label}: codesign verification failed: ${detail}`);
+      return 'failed';
+    }
+    note(`${label}: signed, but individual verification warned: ${detail}`);
+    status = 'warning';
+  }
+
+  if (requireAdhoc && !details.output.includes('Signature=adhoc')) {
+    fail(`${label}: expected ad-hoc signature, but codesign did not report Signature=adhoc`);
+    return 'failed';
+  }
+  if (requireAdhoc && !quietOk) {
+    ok(`${label}: ad-hoc signature present`);
+  }
+
+  return status;
+}
+
+function walkFiles(root, visitor) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const entryPath = path.join(root, entry.name);
+    if (entry.isSymbolicLink()) {
+      continue;
+    }
+    if (entry.isDirectory()) {
+      walkFiles(entryPath, visitor);
+      continue;
+    }
+    if (entry.isFile()) {
+      visitor(entryPath);
+    }
+  }
+}
+
+function fileBrief(filePath) {
+  try {
+    return run('file', ['--brief', filePath], { timeout: 5000 }).trim();
+  } catch (error) {
+    fail(`file(1) failed for ${filePath}: ${error.stderr?.trim() || error.message}`);
+    return '';
+  }
+}
+
+function verifyMachOObjects(appPath, label) {
+  const machOFiles = [];
+  walkFiles(appPath, filePath => {
+    const description = fileBrief(filePath);
+    if (description.includes('Mach-O')) {
+      machOFiles.push(filePath);
+    }
+  });
+
+  if (machOFiles.length === 0) {
+    fail(`${label}: no Mach-O files found inside app bundle`);
+    return;
+  }
+
+  let warningCount = 0;
+  let signedCount = 0;
+  let verifiedCount = 0;
+  for (const filePath of machOFiles) {
+    const relative = path.relative(appPath, filePath).split(path.sep).join('/');
+    const isPrimaryExecutable = relative === 'Contents/MacOS/firelink';
+    const isDirectEngine = /^Contents\/Resources\/engine-dist\/[^/]+\/(?:yt-dlp|aria2c|ffmpeg|deno)-/.test(relative);
+    const mayWarn = !isPrimaryExecutable && !isDirectEngine;
+
+    const result = verifyCodeSignature(filePath, `${label} ${relative}`, {
+      quietOk: true,
+      warnOnVerifyFailure: mayWarn,
+    });
+    if (result !== 'failed') {
+      signedCount += 1;
+      if (result === 'verified') {
+        verifiedCount += 1;
+      } else {
+        warningCount += 1;
+      }
+    }
+  }
+  ok(`${label}: found signatures on ${signedCount}/${machOFiles.length} Mach-O code object(s)`);
+  ok(`${label}: individually verified ${verifiedCount}/${machOFiles.length} Mach-O code object(s)`);
+  if (warningCount > 0) {
+    note(`${label}: ${warningCount} nested signed framework object(s) produced individual verification warnings; the outer bundle signature remains authoritative.`);
+  }
+}
+
+function assessGatekeeper(appPath, label) {
+  const result = runResult('spctl', ['--assess', '--type', 'execute', '--verbose=4', appPath]);
+  const output = `${result.stdout || ''}${result.stderr || ''}`.trim();
+
+  if (result.status === 0) {
+    note(`${label}: Gatekeeper accepted this app (${output || 'no spctl detail'}).`);
+    return;
+  }
+
+  const normalized = output.toLowerCase();
+  if (normalized.includes('not signed at all') || normalized.includes('invalid signature')) {
+    fail(`${label}: Gatekeeper rejection indicates a broken signature: ${output}`);
+    return;
+  }
+
+  note(`${label}: Gatekeeper rejected the app as expected for ad-hoc, unnotarized distribution: ${output || `exit ${result.status}`}`);
+}
+
+function reportQuarantine(targetPath, label) {
+  const result = runResult('xattr', ['-p', 'com.apple.quarantine', targetPath]);
+  if (result.status === 0) {
+    fail(`${label}: build artifact unexpectedly has com.apple.quarantine=${result.stdout.trim()}`);
+  } else {
+    ok(`${label}: no quarantine xattr on generated artifact`);
+  }
+}
+
+function verifyApp(appPath, label) {
+  const resolved = path.resolve(appPath);
+  if (!assertAppPath(resolved, label)) {
+    return;
+  }
+
+  reportQuarantine(resolved, label);
+  verifyCodeSignature(resolved, label, { deep: true, requireAdhoc: true });
+  verifyMachOObjects(resolved, label);
+  assessGatekeeper(resolved, label);
+}
+
+function attachDmg(dmgPath) {
+  const mountPoint = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-dmg-'));
+  try {
+    const plist = run('hdiutil', [
+      'attach',
+      '-plist',
+      '-nobrowse',
+      '-readonly',
+      '-mountpoint',
+      mountPoint,
+      dmgPath,
+    ], { timeout: 60000 });
+    return { mountPoint, plist };
+  } catch (error) {
+    fs.rmSync(mountPoint, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function detachDmg(mountPoint) {
+  const result = runResult('hdiutil', ['detach', mountPoint]);
+  if (result.status !== 0) {
+    note(`Initial hdiutil detach failed, retrying with -force: ${result.stderr?.trim() || result.stdout?.trim()}`);
+    const forced = runResult('hdiutil', ['detach', '-force', mountPoint]);
+    if (forced.status !== 0) {
+      fail(`Failed to detach DMG mount point ${mountPoint}: ${forced.stderr?.trim() || forced.stdout?.trim()}`);
+    }
+  }
+  fs.rmSync(mountPoint, { recursive: true, force: true });
+}
+
+function verifyDmg(dmgPath) {
+  const resolved = path.resolve(dmgPath);
+  if (!fs.existsSync(resolved)) {
+    fail(`DMG does not exist at ${resolved}`);
+    return;
+  }
+
+  reportQuarantine(resolved, 'DMG');
+  let mount;
+  try {
+    mount = attachDmg(resolved);
+    ok(`DMG mounted at ${mount.mountPoint}`);
+    const apps = fs.readdirSync(mount.mountPoint)
+      .filter(name => name.endsWith('.app'))
+      .map(name => path.join(mount.mountPoint, name));
+    if (apps.length !== 1) {
+      fail(`Expected exactly one .app inside DMG, found ${apps.length}`);
+      return;
+    }
+    verifyApp(apps[0], 'DMG app');
+  } catch (error) {
+    fail(`DMG verification failed: ${error.stderr?.trim() || error.message}`);
+  } finally {
+    if (mount) {
+      detachDmg(mount.mountPoint);
+    }
+  }
+}
+
+if (appArg) {
+  verifyApp(appArg, 'Built app');
+}
+
+if (dmgArg) {
+  verifyDmg(dmgArg);
+}
+
+console.log('');
+if (exitCode !== 0) {
+  console.error('[FAIL] macOS signing verification failed.');
+  process.exit(1);
+}
+
+console.log('[PASS] macOS ad-hoc signing verification passed.');

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "firelink"
-version = "1.0.1"
+version = "1.0.4"
 description = "A fast cross-platform desktop download manager powered by Rust and Tauri"
 authors = ["NimBold"]
 edition = "2021"
@@ -31,24 +31,26 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["fs", "process", "io-util", "rt", "rt-multi-thread", "macros", "sync", "time"] }
 regex = "1.10"
-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "stream"] }
+reqwest = { version = "0.13", default-features = false, features = ["rustls-no-provider", "json", "stream", "socks"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 uuid = { version = "1", features = ["v4"] }
 ts-rs = { version = "12", features = ["serde-compat", "uuid-impl"] }
 tauri-plugin-notification = "2.3.3"
+tauri-plugin-clipboard-manager = "2.3.2"
 sysinfo = "0.39.3"
-hmac = "0.12"
-sha2 = "0.10"
+hmac = "0.13"
+sha2 = "0.11"
 tauri-plugin-deep-link = "2"
 tauri-plugin-single-instance = { version = "2", features = ["deep-link"] }
 tempfile = "3"
 thiserror = "2.0.18"
 axum = "0.8.9"
-tower-http = { version = "0.6.11", features = ["cors"] }
+tower-http = { version = "0.7", features = ["cors"] }
 sysproxy = "0.3.0"
 semver = "1.0.28"
 keepawake = "0.6.0"
 system_shutdown = "4.1.0"
-tokio-tungstenite = "0.29.0"
+tokio-tungstenite = "0.30.0"
 futures-util = { version = "0.3.32", features = ["sink"] }
 chrono = "0.4.38"
 url = "2"
@@ -57,12 +59,13 @@ log = "0.4.32"
 tauri-plugin-log = "2"
 trash = "5"
 async-trait = "0.1"
+keyring-core = "1.0.0"
 [target.'cfg(target_os = "macos")'.dependencies]
+apple-native-keyring-store = { version = "1.0.0", features = ["keychain"] }
 objc = "0.2.7"
-keyring = { version = "3", features = ["apple-native"] }
 
 [target.'cfg(target_os = "windows")'.dependencies]
-keyring = { version = "3", features = ["windows-native"] }
+windows-native-keyring-store = "1.1.0"
 
 [target.'cfg(target_os = "linux")'.dependencies]
-keyring = { version = "3", features = ["sync-secret-service", "vendored"] }
+zbus-secret-service-keyring-store = { version = "1.0.0", features = ["crypto-rust"] }

src-tauri/binaries/_internal/Python.framework/Resources/Info.plist

@@ -7,7 +7,7 @@
 	<key>CFBundleIdentifier</key>
 	<string>org.python.python</string>
 	<key>CFBundleVersion</key>
-	<string>3.14.5</string>
+	<string>3.14.6</string>
 	<key>CFBundlePackageType</key>
 	<string>FMWK</string>
 	<key>CFBundleSignature</key>
@@ -17,7 +17,7 @@
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
 	<key>CFBundleShortVersionString</key>
-	<string>3.14.5</string>
+	<string>3.14.6</string>
 	<key>CFBundleSupportedPlatforms</key>
 	<array>
 		<string>MacOSX</string>

src-tauri/binaries/_internal/Python.framework/Versions/3.14/Resources/Info.plist

@@ -7,7 +7,7 @@
 	<key>CFBundleIdentifier</key>
 	<string>org.python.python</string>
 	<key>CFBundleVersion</key>
-	<string>3.14.5</string>
+	<string>3.14.6</string>
 	<key>CFBundlePackageType</key>
 	<string>FMWK</string>
 	<key>CFBundleSignature</key>
@@ -17,7 +17,7 @@
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
 	<key>CFBundleShortVersionString</key>
-	<string>3.14.5</string>
+	<string>3.14.6</string>
 	<key>CFBundleSupportedPlatforms</key>
 	<array>
 		<string>MacOSX</string>

src-tauri/binaries/_internal/Python.framework/Versions/Current/Resources/Info.plist

@@ -7,7 +7,7 @@
 	<key>CFBundleIdentifier</key>
 	<string>org.python.python</string>
 	<key>CFBundleVersion</key>
-	<string>3.14.5</string>
+	<string>3.14.6</string>
 	<key>CFBundlePackageType</key>
 	<string>FMWK</string>
 	<key>CFBundleSignature</key>
@@ -17,7 +17,7 @@
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
 	<key>CFBundleShortVersionString</key>
-	<string>3.14.5</string>
+	<string>3.14.6</string>
 	<key>CFBundleSupportedPlatforms</key>
 	<array>
 		<string>MacOSX</string>

src-tauri/binaries/_internal/certifi/cacert.pem

@@ -3528,35 +3528,6 @@ xeSDwWrruoBa3lwtcHb4yOWHh8qgnaHlIhInD0Q9HWzq1MKLL295q39QpsQZp6F6
 t5b5wR9iWqJDB0BeJsas7a5wFsWqynKKTbDPAYsDP27X
 -----END CERTIFICATE-----
 
-# Issuer: CN=SecureSign Root CA12 O=Cybertrust Japan Co., Ltd.
-# Subject: CN=SecureSign Root CA12 O=Cybertrust Japan Co., Ltd.
-# Label: "SecureSign Root CA12"
-# Serial: 587887345431707215246142177076162061960426065942
-# MD5 Fingerprint: c6:89:ca:64:42:9b:62:08:49:0b:1e:7f:e9:07:3d:e8
-# SHA1 Fingerprint: 7a:22:1e:3d:de:1b:06:ac:9e:c8:47:70:16:8e:3c:e5:f7:6b:06:f4
-# SHA256 Fingerprint: 3f:03:4b:b5:70:4d:44:b2:d0:85:45:a0:20:57:de:93:eb:f3:90:5f:ce:72:1a:cb:c7:30:c0:6d:da:ee:90:4e
------BEGIN CERTIFICATE-----
-MIIDcjCCAlqgAwIBAgIUZvnHwa/swlG07VOX5uaCwysckBYwDQYJKoZIhvcNAQEL
-BQAwUTELMAkGA1UEBhMCSlAxIzAhBgNVBAoTGkN5YmVydHJ1c3QgSmFwYW4gQ28u
-LCBMdGQuMR0wGwYDVQQDExRTZWN1cmVTaWduIFJvb3QgQ0ExMjAeFw0yMDA0MDgw
-NTM2NDZaFw00MDA0MDgwNTM2NDZaMFExCzAJBgNVBAYTAkpQMSMwIQYDVQQKExpD
-eWJlcnRydXN0IEphcGFuIENvLiwgTHRkLjEdMBsGA1UEAxMUU2VjdXJlU2lnbiBS
-b290IENBMTIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6OcE3emhF
-KxS06+QT61d1I02PJC0W6K6OyX2kVzsqdiUzg2zqMoqUm048luT9Ub+ZyZN+v/mt
-p7JIKwccJ/VMvHASd6SFVLX9kHrko+RRWAPNEHl57muTH2SOa2SroxPjcf59q5zd
-J1M3s6oYwlkm7Fsf0uZlfO+TvdhYXAvA42VvPMfKWeP+bl+sg779XSVOKik71gur
-FzJ4pOE+lEa+Ym6b3kaosRbnhW70CEBFEaCeVESE99g2zvVQR9wsMJvuwPWW0v4J
-hscGWa5Pro4RmHvzC1KqYiaqId+OJTN5lxZJjfU+1UefNzFJM3IFTQy2VYzxV4+K
-h9GtxRESOaCtAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD
-AgEGMB0GA1UdDgQWBBRXNPN0zwRL1SXm8UC2LEzZLemgrTANBgkqhkiG9w0BAQsF
-AAOCAQEAPrvbFxbS8hQBICw4g0utvsqFepq2m2um4fylOqyttCg6r9cBg0krY6Ld
-mmQOmFxv3Y67ilQiLUoT865AQ9tPkbeGGuwAtEGBpE/6aouIs3YIcipJQMPTw4WJ
-mBClnW8Zt7vPemVV2zfrPIpyMpcemik+rY3moxtt9XUa5rBouVui7mlHJzWhhpmA
-8zNL4WukJsPvdFlseqJkth5Ew1DgDzk9qTPxpfPSvWKErI4cqc1avTc7bgoitPQV
-55FYxTpE05Uo2cBl6XLK0A+9H7MV2anjpEcJnuDLN/v9vZfVvhgaaaI5gdka9at/
-yOPiZwud9AzqVN/Ssq+xIvEg37xEHA==
------END CERTIFICATE-----
-
 # Issuer: CN=SecureSign Root CA14 O=Cybertrust Japan Co., Ltd.
 # Subject: CN=SecureSign Root CA14 O=Cybertrust Japan Co., Ltd.
 # Label: "SecureSign Root CA14"

src-tauri/binaries/_internal/curl_cffi-0.15.0.dist-info/RECORD

@@ -1,60 +1,60 @@
-../../../bin/curl-cffi,sha256=1WNmf_w0emP0-PeIpDGlHiBy4Gdet6ASfQxBOR-BNMA,187
-curl_cffi-0.15.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
-curl_cffi-0.15.0.dist-info/METADATA,sha256=ryYvNCZOl96BIMI2134ZhyRWy7sr-0-xOc0Q_TfaU9A,18405
-curl_cffi-0.15.0.dist-info/RECORD,,
-curl_cffi-0.15.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-curl_cffi-0.15.0.dist-info/WHEEL,sha256=BX73HzL_Z8VmcUg66xwFel1CJ1goP9ZPbeeVSSFaesY,140
-curl_cffi-0.15.0.dist-info/direct_url.json,sha256=lpNNgQ8844-2Q1nCwxiwtLw07Je0dsNXHPwhnLfnit4,313
-curl_cffi-0.15.0.dist-info/entry_points.txt,sha256=HzTwoUpbiKIo5uJrqnxPk5OdxZ0PhT0dPTSqUP8Js70,49
-curl_cffi-0.15.0.dist-info/licenses/LICENSE,sha256=PoiwKbULav021rGGQs5Mi27uTJA_HPq-9bgR9h4HBQs,1106
-curl_cffi-0.15.0.dist-info/top_level.txt,sha256=b51YB50I_vu6XAbSERmqtgaYciYADCA_baVoZ_T5Lzs,10
-curl_cffi/__init__.py,sha256=fPBkVIThnbk_a7U41V5S3Qwhh1_WxZkMerXQNv1iOpA,1781
-curl_cffi/__main__.py,sha256=L0AH-xyDlgmsPM-HTecPVb1_hV9X35Qf1Mw7h7JVnx0,39
-curl_cffi/__pycache__/__init__.cpython-314.pyc,,
-curl_cffi/__pycache__/__main__.cpython-314.pyc,,
-curl_cffi/__pycache__/__version__.cpython-314.pyc,,
-curl_cffi/__pycache__/_asyncio_selector.cpython-314.pyc,,
-curl_cffi/__pycache__/aio.cpython-314.pyc,,
-curl_cffi/__pycache__/const.cpython-314.pyc,,
-curl_cffi/__pycache__/curl.cpython-314.pyc,,
-curl_cffi/__pycache__/utils.cpython-314.pyc,,
-curl_cffi/__version__.py,sha256=FdOv9cpHIUGkFkcWA4O9gte0sun1QgJI69rIgzUkswo,413
-curl_cffi/_asyncio_selector.py,sha256=dxKOC6B8mlRu3WYi0trSq0L-FsWV6l_pg9TP35OpDI4,13043
-curl_cffi/_wrapper.abi3.so,sha256=4sMTX_Q2WMouO96xfxc3BZjZxnMZnLjZV8nF_FCU_zE,12691712
-curl_cffi/aio.py,sha256=oTiffUFDNfxxSHmCVAsjX0CIOs4IuBQ6mhm4WuY5KZs,11925
-curl_cffi/cli/__init__.py,sha256=y-XQAfYkBDN3ejfVex1aKy5bcqsPUglAvm-i177wM5I,7290
-curl_cffi/cli/__pycache__/__init__.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/doctor.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/output.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/parse.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/request.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/run.cpython-314.pyc,,
-curl_cffi/cli/doctor.py,sha256=4wfyWF44JLxDtoH9YCDdmxrJ-1cWbNwSXcMc9Aopd1c,416
-curl_cffi/cli/output.py,sha256=YzWbYLJ2zowR6G9mJxeTytcPrnSk2WQVwfmv8V404X4,6709
-curl_cffi/cli/parse.py,sha256=OzqGEZPqOrH2nq14UKnaXwKAblAw6V867tDEp9XSLdo,2549
-curl_cffi/cli/request.py,sha256=MJskNMJBIR8oq_fvrPvsi61Wy-bR4-aC8QQJb1YcqRg,3522
-curl_cffi/cli/run.py,sha256=WYaPbX9h85DZQNkDbUUyvp3bryaAuNOxnjU6GpenigQ,7554
-curl_cffi/const.py,sha256=mF3H1kHsqj-dfd7GWHMHyuB2bZ3QZd61tC1iCZgEjyo,18523
-curl_cffi/curl.py,sha256=woBPw1OQk4FH7neNETuj_GwqcQa1jCjd1tA0ZxPSTA8,26928
-curl_cffi/py.typed,sha256=dcrsqJrcYfTX-ckLFJMTaj6mD8aDe2u0tkQG-ZYxnEg,26
-curl_cffi/requests/__init__.py,sha256=3ZO7mC7gNJZydze0VQLEYpEc9dMlf1uRbFS-fxKSQPs,6148
-curl_cffi/requests/__pycache__/__init__.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/cookies.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/errors.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/exceptions.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/headers.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/impersonate.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/models.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/session.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/utils.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/websockets.cpython-314.pyc,,
-curl_cffi/requests/cookies.py,sha256=QDEuhtsSjh6iNAKmp5TnGyyAe8wdDJCADCHY_GWCeCc,11867
-curl_cffi/requests/errors.py,sha256=R6N5lmOTdRukThkNGUihDAQRu8HSh27M8E3zfUJJX74,250
-curl_cffi/requests/exceptions.py,sha256=ViyLx3XHii_s7kjrO3GhVOVXhq2_UsYfAQl8MPwDnEM,6187
-curl_cffi/requests/headers.py,sha256=Q1jrRdJ2YMLOcl5W3WBaKZAdLbPGPPERJ6MYzos3YXk,11535
-curl_cffi/requests/impersonate.py,sha256=dKRpbPTqLCABrCmSKmgXyhA1zmrv0DMuSuqQyhn5-FU,13389
-curl_cffi/requests/models.py,sha256=SaN9QUYyljUDFDQnUrYZRl9KiUe25nb2c2ca-dfq3Nw,11487
-curl_cffi/requests/session.py,sha256=LkfPvAr8BIVzB_K91xwh0wIPRW26mi2VJd1cEYorIho,58871
-curl_cffi/requests/utils.py,sha256=zMKaWoXcAPFNBv6FglE3FSAPNuxYr_leUcWKnhfYecw,26618
-curl_cffi/requests/websockets.py,sha256=RJVNqCDrlLWzQ12Ym9M5_T0SW4EmoqKUYsXXTaQmBRQ,71685
-curl_cffi/utils.py,sha256=gRVzO-vhjf596V6kr_SjwHlwJfDIwTrPbRLJvvNlUNE,307
+../../../bin/curl-cffi,sha256=1WNmf_w0emP0-PeIpDGlHiBy4Gdet6ASfQxBOR-BNMA,187
+curl_cffi-0.15.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+curl_cffi-0.15.0.dist-info/METADATA,sha256=ryYvNCZOl96BIMI2134ZhyRWy7sr-0-xOc0Q_TfaU9A,18405
+curl_cffi-0.15.0.dist-info/RECORD,,
+curl_cffi-0.15.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+curl_cffi-0.15.0.dist-info/WHEEL,sha256=BX73HzL_Z8VmcUg66xwFel1CJ1goP9ZPbeeVSSFaesY,140
+curl_cffi-0.15.0.dist-info/direct_url.json,sha256=ORhsskaIg_jwHIDYD7oRH5nzN3fKYa7xVFg-8WceJ5E,313
+curl_cffi-0.15.0.dist-info/entry_points.txt,sha256=HzTwoUpbiKIo5uJrqnxPk5OdxZ0PhT0dPTSqUP8Js70,49
+curl_cffi-0.15.0.dist-info/licenses/LICENSE,sha256=PoiwKbULav021rGGQs5Mi27uTJA_HPq-9bgR9h4HBQs,1106
+curl_cffi-0.15.0.dist-info/top_level.txt,sha256=b51YB50I_vu6XAbSERmqtgaYciYADCA_baVoZ_T5Lzs,10
+curl_cffi/__init__.py,sha256=fPBkVIThnbk_a7U41V5S3Qwhh1_WxZkMerXQNv1iOpA,1781
+curl_cffi/__main__.py,sha256=L0AH-xyDlgmsPM-HTecPVb1_hV9X35Qf1Mw7h7JVnx0,39
+curl_cffi/__pycache__/__init__.cpython-314.pyc,,
+curl_cffi/__pycache__/__main__.cpython-314.pyc,,
+curl_cffi/__pycache__/__version__.cpython-314.pyc,,
+curl_cffi/__pycache__/_asyncio_selector.cpython-314.pyc,,
+curl_cffi/__pycache__/aio.cpython-314.pyc,,
+curl_cffi/__pycache__/const.cpython-314.pyc,,
+curl_cffi/__pycache__/curl.cpython-314.pyc,,
+curl_cffi/__pycache__/utils.cpython-314.pyc,,
+curl_cffi/__version__.py,sha256=FdOv9cpHIUGkFkcWA4O9gte0sun1QgJI69rIgzUkswo,413
+curl_cffi/_asyncio_selector.py,sha256=dxKOC6B8mlRu3WYi0trSq0L-FsWV6l_pg9TP35OpDI4,13043
+curl_cffi/_wrapper.abi3.so,sha256=4sMTX_Q2WMouO96xfxc3BZjZxnMZnLjZV8nF_FCU_zE,12691712
+curl_cffi/aio.py,sha256=oTiffUFDNfxxSHmCVAsjX0CIOs4IuBQ6mhm4WuY5KZs,11925
+curl_cffi/cli/__init__.py,sha256=y-XQAfYkBDN3ejfVex1aKy5bcqsPUglAvm-i177wM5I,7290
+curl_cffi/cli/__pycache__/__init__.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/doctor.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/output.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/parse.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/request.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/run.cpython-314.pyc,,
+curl_cffi/cli/doctor.py,sha256=4wfyWF44JLxDtoH9YCDdmxrJ-1cWbNwSXcMc9Aopd1c,416
+curl_cffi/cli/output.py,sha256=YzWbYLJ2zowR6G9mJxeTytcPrnSk2WQVwfmv8V404X4,6709
+curl_cffi/cli/parse.py,sha256=OzqGEZPqOrH2nq14UKnaXwKAblAw6V867tDEp9XSLdo,2549
+curl_cffi/cli/request.py,sha256=MJskNMJBIR8oq_fvrPvsi61Wy-bR4-aC8QQJb1YcqRg,3522
+curl_cffi/cli/run.py,sha256=WYaPbX9h85DZQNkDbUUyvp3bryaAuNOxnjU6GpenigQ,7554
+curl_cffi/const.py,sha256=mF3H1kHsqj-dfd7GWHMHyuB2bZ3QZd61tC1iCZgEjyo,18523
+curl_cffi/curl.py,sha256=woBPw1OQk4FH7neNETuj_GwqcQa1jCjd1tA0ZxPSTA8,26928
+curl_cffi/py.typed,sha256=dcrsqJrcYfTX-ckLFJMTaj6mD8aDe2u0tkQG-ZYxnEg,26
+curl_cffi/requests/__init__.py,sha256=3ZO7mC7gNJZydze0VQLEYpEc9dMlf1uRbFS-fxKSQPs,6148
+curl_cffi/requests/__pycache__/__init__.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/cookies.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/errors.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/exceptions.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/headers.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/impersonate.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/models.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/session.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/utils.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/websockets.cpython-314.pyc,,
+curl_cffi/requests/cookies.py,sha256=QDEuhtsSjh6iNAKmp5TnGyyAe8wdDJCADCHY_GWCeCc,11867
+curl_cffi/requests/errors.py,sha256=R6N5lmOTdRukThkNGUihDAQRu8HSh27M8E3zfUJJX74,250
+curl_cffi/requests/exceptions.py,sha256=ViyLx3XHii_s7kjrO3GhVOVXhq2_UsYfAQl8MPwDnEM,6187
+curl_cffi/requests/headers.py,sha256=Q1jrRdJ2YMLOcl5W3WBaKZAdLbPGPPERJ6MYzos3YXk,11535
+curl_cffi/requests/impersonate.py,sha256=dKRpbPTqLCABrCmSKmgXyhA1zmrv0DMuSuqQyhn5-FU,13389
+curl_cffi/requests/models.py,sha256=SaN9QUYyljUDFDQnUrYZRl9KiUe25nb2c2ca-dfq3Nw,11487
+curl_cffi/requests/session.py,sha256=LkfPvAr8BIVzB_K91xwh0wIPRW26mi2VJd1cEYorIho,58871
+curl_cffi/requests/utils.py,sha256=zMKaWoXcAPFNBv6FglE3FSAPNuxYr_leUcWKnhfYecw,26618
+curl_cffi/requests/websockets.py,sha256=RJVNqCDrlLWzQ12Ym9M5_T0SW4EmoqKUYsXXTaQmBRQ,71685
+curl_cffi/utils.py,sha256=gRVzO-vhjf596V6kr_SjwHlwJfDIwTrPbRLJvvNlUNE,307

src-tauri/binaries/_internal/curl_cffi-0.15.0.dist-info/direct_url.json

@@ -1 +1 @@
-{"archive_info": {"hash": "sha256=bf985a468ffb52bdcdfa1dac713555144c7711521428cd9267578a208c8f45ab", "hashes": {"sha256": "bf985a468ffb52bdcdfa1dac713555144c7711521428cd9267578a208c8f45ab"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/universal2/curl_cffi-0.15.0-cp310-abi3-macosx_10_9_universal2.whl"}
+{"archive_info": {"hash": "sha256=630653d283070b21deca8ee408dcdc98ac4202d80cc9d038db805d45e0b40550", "hashes": {"sha256": "630653d283070b21deca8ee408dcdc98ac4202d80cc9d038db805d45e0b40550"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/universal2/curl_cffi-0.15.0-cp310-abi3-macosx_10_9_universal2.whl"}

src-tauri/capabilities/default.json

@@ -13,6 +13,7 @@
     "dialog:default",
     "log:default",
     "notification:default",
-    "notification:allow-is-permission-granted"
+    "notification:allow-is-permission-granted",
+    "clipboard-manager:allow-read-text"
   ]
 }

src-tauri/src/db.rs

@@ -12,6 +12,7 @@ const CURRENT_SCHEMA_VERSION: i64 = 1;
 const TOKEN_CHANGED_NOTICE: &str = "pairing-token-changed";
 pub const PAIRING_TOKEN_KEYCHAIN_ID: &str = "extension-pairing-token";
 const KEYCHAIN_SERVICE: &str = "com.firelink.app";
+static KEYRING_OPERATION_LOCK: Mutex<()> = Mutex::new(());
 
 pub struct DbState {
     conn: Mutex<Connection>,
@@ -864,21 +865,168 @@ pub fn save_pairing_token_to_settings(
     save_settings(connection, &updated)
 }
 
+fn ensure_keyring_store() -> Result<(), String> {
+    if keyring_core::get_default_store().is_some() {
+        return Ok(());
+    }
+
+    static STORE_INIT_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+    let _guard = STORE_INIT_LOCK
+        .lock()
+        .map_err(|_| "keyring store initialization lock is unavailable".to_string())?;
+
+    if keyring_core::get_default_store().is_some() {
+        return Ok(());
+    }
+
+    #[cfg(target_os = "macos")]
+    {
+        let store = apple_native_keyring_store::keychain::Store::new()
+            .map_err(|error| error.to_string())?;
+        keyring_core::set_default_store(store);
+        Ok(())
+    }
+
+    #[cfg(target_os = "windows")]
+    {
+        let store =
+            windows_native_keyring_store::Store::new().map_err(|error| error.to_string())?;
+        keyring_core::set_default_store(store);
+        Ok(())
+    }
+
+    #[cfg(target_os = "linux")]
+    {
+        let store =
+            zbus_secret_service_keyring_store::Store::new().map_err(|error| error.to_string())?;
+        keyring_core::set_default_store(store);
+        Ok(())
+    }
+
+    #[cfg(not(any(target_os = "macos", target_os = "windows", target_os = "linux")))]
+    {
+        Err("No native keyring store is available for this platform".to_string())
+    }
+}
+
+fn keychain_entry_with_target(
+    id: &str,
+    target: Option<&str>,
+) -> Result<keyring_core::Entry, String> {
+    ensure_keyring_store()?;
+    if let Some(target) = target {
+        return keyring_core::Entry::new_with_modifiers(
+            KEYCHAIN_SERVICE,
+            id,
+            &std::collections::HashMap::from([("target", target)]),
+        )
+        .map_err(|error| error.to_string());
+    }
+    keyring_core::Entry::new(KEYCHAIN_SERVICE, id).map_err(|error| error.to_string())
+}
+
+fn keychain_entry(id: &str) -> Result<keyring_core::Entry, String> {
+    #[cfg(target_os = "linux")]
+    {
+        return keychain_entry_with_target(id, Some("default"));
+    }
+
+    #[cfg(not(target_os = "linux"))]
+    keychain_entry_with_target(id, None)
+}
+
+fn lock_keyring_operations() -> Result<std::sync::MutexGuard<'static, ()>, String> {
+    KEYRING_OPERATION_LOCK
+        .lock()
+        .map_err(|_| "keyring operation lock is unavailable".to_string())
+}
+
+#[cfg(target_os = "linux")]
+fn legacy_linux_keychain_entries(id: &str) -> Result<Vec<keyring_core::Entry>, String> {
+    ensure_keyring_store()?;
+    let entries = keyring_core::Entry::search(&std::collections::HashMap::from([
+        ("service", KEYCHAIN_SERVICE),
+        ("username", id),
+    ]))
+    .map_err(|error| error.to_string())?;
+    let mut legacy = Vec::new();
+    for entry in entries {
+        let attributes = entry.get_attributes().map_err(|error| error.to_string())?;
+        if !attributes.contains_key("target") {
+            legacy.push(entry);
+        }
+    }
+    Ok(legacy)
+}
+
+#[cfg(target_os = "linux")]
+fn unique_legacy_linux_keychain_entry(id: &str) -> Result<Option<keyring_core::Entry>, String> {
+    let mut entries = legacy_linux_keychain_entries(id)?;
+    match entries.len() {
+        0 => Ok(None),
+        1 => Ok(entries.pop()),
+        count => Err(format!(
+            "Entry is matched by {count} legacy Linux credentials"
+        )),
+    }
+}
+
 pub fn set_keychain_password(id: &str, password: &str) -> Result<(), String> {
-    let entry = keyring::Entry::new(KEYCHAIN_SERVICE, id).map_err(|error| error.to_string())?;
+    let _guard = lock_keyring_operations()?;
+    let entry = keychain_entry(id)?;
+
+    #[cfg(target_os = "linux")]
+    if let Err(error) = entry.get_credential() {
+        match error {
+            keyring_core::Error::NoEntry => {
+                if let Some(legacy) = unique_legacy_linux_keychain_entry(id)? {
+                    return legacy
+                        .set_password(password)
+                        .map_err(|error| error.to_string());
+                }
+            }
+            error => return Err(error.to_string()),
+        }
+    }
+
     entry
         .set_password(password)
         .map_err(|error| error.to_string())
 }
 
 pub fn get_keychain_password(id: &str) -> Result<String, String> {
-    let entry = keyring::Entry::new(KEYCHAIN_SERVICE, id).map_err(|error| error.to_string())?;
-    entry.get_password().map_err(|error| error.to_string())
+    let _guard = lock_keyring_operations()?;
+    let entry = keychain_entry(id)?;
+    match entry.get_password() {
+        Ok(password) => Ok(password),
+        #[cfg(target_os = "linux")]
+        Err(keyring_core::Error::NoEntry) => unique_legacy_linux_keychain_entry(id)?
+            .ok_or_else(|| keyring_core::Error::NoEntry.to_string())?
+            .get_password()
+            .map_err(|error| error.to_string()),
+        #[cfg(target_os = "linux")]
+        Err(error) => Err(error.to_string()),
+        #[cfg(not(target_os = "linux"))]
+        Err(error) => Err(error.to_string()),
+    }
 }
 
 pub fn delete_keychain_password(id: &str) -> Result<(), String> {
-    let entry = keyring::Entry::new(KEYCHAIN_SERVICE, id).map_err(|error| error.to_string())?;
-    let _ = entry.delete_credential();
+    let _guard = lock_keyring_operations()?;
+    let entry = keychain_entry(id)?;
+    match entry.delete_credential() {
+        Ok(()) | Err(keyring_core::Error::NoEntry) => {}
+        Err(error) => return Err(error.to_string()),
+    }
+
+    #[cfg(target_os = "linux")]
+    for legacy in legacy_linux_keychain_entries(id)? {
+        match legacy.delete_credential() {
+            Ok(()) | Err(keyring_core::Error::NoEntry) => {}
+            Err(error) => return Err(error.to_string()),
+        }
+    }
+
     Ok(())
 }
 

src-tauri/src/download.rs

@@ -1,74 +1,18 @@
-use crate::DownloadProgressEvent;
-use futures_util::StreamExt;
-use reqwest::{
-    header::{self, HeaderMap, HeaderName, HeaderValue},
-    Client, StatusCode,
-};
-use std::{
-    collections::{HashMap, HashSet},
-    path::PathBuf,
-    str::FromStr,
-    time::{Duration, Instant},
-};
+use std::collections::{HashMap, HashSet};
 use tauri::{AppHandle, Emitter};
-use tokio::{
-    fs::{self, OpenOptions},
-    io::{AsyncWriteExt, BufWriter},
-    sync::{mpsc, watch},
-};
-use uuid::Uuid;
-
-const PROGRESS_INTERVAL: Duration = Duration::from_millis(1000);
-const WRITE_BUFFER_CAPACITY: usize = 256 * 1024;
+use tokio::sync::{mpsc, watch};
 
 #[derive(Debug)]
 pub enum DownloadCmd {
-    Start(Box<DownloadPayload>),
-    Pause(Uuid),
-    PauseWithAck(Uuid, tokio::sync::oneshot::Sender<()>),
-    CancelWithAck(Uuid, tokio::sync::oneshot::Sender<()>),
     CaptureUrls(Vec<String>),
     FrontendReady(bool),
 }
 
 #[derive(Clone, Debug, PartialEq)]
 pub enum DownloadEvent {
-    Progress {
-        id: Uuid,
-        fraction: f64,
-        completed: u64,
-        total: Option<u64>,
-    },
-    Completed(Uuid),
-    Failed {
-        id: Uuid,
-        error: String,
-    },
-    /// Transient network drop: a backoff retry is scheduled and the slot is
-    /// still held. Carries the 0-based strike number and the classified reason.
-    Retrying {
-        id: Uuid,
-        strike: usize,
-        reason: String,
-    },
     CapturedUrls(String),
 }
 
-#[derive(Debug)]
-pub struct DownloadPayload {
-    pub id: Uuid,
-    pub urls: Vec<String>,
-    pub output_path: PathBuf,
-    pub speed_limit: Option<String>,
-    pub username: Option<String>,
-    pub password: Option<String>,
-    pub headers: Option<String>,
-    pub cookies: Option<String>,
-    pub user_agent: Option<String>,
-    pub max_tries: u32,
-    pub proxy: Option<String>,
-}
-
 #[derive(Clone)]
 pub struct DownloadCoordinator {
     tx: mpsc::Sender<DownloadCmd>,
@@ -141,107 +85,6 @@ enum CoordinatorEventSink {
 }
 
 impl CoordinatorEventSink {
-    fn emit_progress(
-        &self,
-        id: Uuid,
-        completed: u64,
-        total: Option<u64>,
-        interval_bytes: u64,
-        interval: Duration,
-    ) {
-        let speed_bytes = if interval.is_zero() {
-            0.0
-        } else {
-            interval_bytes as f64 / interval.as_secs_f64()
-        };
-        let fraction = total
-            .filter(|total| *total > 0)
-            .map(|total| completed as f64 / total as f64)
-            .unwrap_or(0.0)
-            .clamp(0.0, 1.0);
-
-        match self {
-            Self::Tauri(app_handle) => {
-                let eta = total
-                    .filter(|total| speed_bytes > 0.0 && *total > completed)
-                    .map(|total| format_duration((total - completed) as f64 / speed_bytes))
-                    .unwrap_or_else(|| "-".to_string());
-                let _ = app_handle.emit(
-                    "download-progress",
-                    DownloadProgressEvent {
-                        id: id.to_string(),
-                        fraction,
-                        speed: format_speed(speed_bytes),
-                        eta,
-                        size: total.map(|t| format_size(t as f64)),
-                        size_is_final: false,
-                    },
-                );
-            }
-            Self::Headless(event_tx) => {
-                let _ = event_tx.send(DownloadEvent::Progress {
-                    id,
-                    fraction,
-                    completed,
-                    total,
-                });
-            }
-        }
-    }
-
-    fn emit_completed(&self, id: Uuid) {
-        match self {
-            Self::Tauri(app_handle) => {
-                let _ = app_handle.emit("download-complete", id.to_string());
-            }
-            Self::Headless(event_tx) => {
-                let _ = event_tx.send(DownloadEvent::Completed(id));
-            }
-        }
-    }
-
-    fn emit_failed(&self, id: Uuid, error: String) {
-        match self {
-            Self::Tauri(app_handle) => {
-                log::error!("native download {} failed: {}", id, error);
-                let _ = app_handle.emit("download-failed", id.to_string());
-            }
-            Self::Headless(event_tx) => {
-                let _ = event_tx.send(DownloadEvent::Failed { id, error });
-            }
-        }
-    }
-
-    /// Emit a transient `Retrying` state. In production this drives the
-    /// `download-state` event with status `retrying` (consumed by the queue's
-    /// completion listener and the frontend store); in headless tests it flows
-    /// through the `DownloadEvent` channel. The strike is 0-based and becomes
-    /// the human-facing attempt number (strike + 1).
-    fn emit_retrying(&self, id: Uuid, strike: usize, reason: String) {
-        match self {
-            Self::Tauri(app_handle) => {
-                use crate::ipc::{DownloadStateEvent, DownloadStatus};
-                let attempt = strike + 1;
-                let payload = DownloadStateEvent::retrying(
-                    id.to_string(),
-                    format!("Network drop — retry #{attempt}: {reason}"),
-                );
-                // Drive the same `download-state` channel the queue emits on
-                // so the frontend status flips to `retrying` uniformly.
-                let _ = app_handle.emit("download-state", payload);
-                log::warn!(
-                    "download {id} transient error, backing off before retry #{attempt}: {reason}"
-                );
-                // Keep the compiler honest about DownloadStatus being used if a
-                // future refactor drops the `retrying` constructor path.
-                let _ = DownloadStatus::Retrying.as_str();
-            }
-            Self::Headless(event_tx) => {
-                let _ = event_tx.send(DownloadEvent::Retrying { id, strike, reason });
-            }
-        }
-    }
-
     fn emit_captured_urls(&self, payload: String) -> bool {
         match self {
             Self::Tauri(app_handle) => app_handle.emit("deep-link-add-download", payload).is_ok(),
@@ -260,46 +103,15 @@ enum MediaCmd {
     Finished(String),
 }
 
-#[derive(Debug, Clone, Copy)]
-enum DownloadControl {
-    Pause,
-    Cancel,
-    Replace,
-}
-
-struct ActiveDownload {
-    generation: u64,
-    control_tx: mpsc::Sender<DownloadControl>,
-}
-
-enum WorkerEvent {
-    Finished {
-        id: Uuid,
-        generation: u64,
-        outcome: DownloadOutcome,
-    },
-}
-
-enum DownloadOutcome {
-    Completed,
-    Paused,
-    Cancelled,
-    Failed(String),
-}
-
 async fn run_coordinator(
     events: CoordinatorEventSink,
     mut command_rx: mpsc::Receiver<DownloadCmd>,
     mut media_rx: mpsc::Receiver<MediaCmd>,
 ) {
-    let (worker_tx, mut worker_rx) = mpsc::channel(128);
-    let mut active = HashMap::<Uuid, ActiveDownload>::new();
     let mut active_media = HashMap::<String, watch::Sender<bool>>::new();
-    let mut pending_acks = HashMap::<Uuid, tokio::sync::oneshot::Sender<()>>::new();
     let mut pending_media_acks = HashMap::<String, tokio::sync::oneshot::Sender<()>>::new();
     let mut pending_captured_urls = Vec::<String>::new();
     let mut frontend_ready = false;
-    let mut next_generation = 0_u64;
 
     loop {
         tokio::select! {
@@ -309,48 +121,6 @@ async fn run_coordinator(
                 };
 
                 match command {
-                    DownloadCmd::Start(payload_box) => {
-                        let payload = *payload_box;
-                        if let Some(previous) = active.remove(&payload.id) {
-                            let _ = previous.control_tx.send(DownloadControl::Replace).await;
-                        }
-
-                        next_generation = next_generation.wrapping_add(1);
-                        let generation = next_generation;
-                        let id = payload.id;
-                        let (control_tx, control_rx) = mpsc::channel(1);
-                        active.insert(id, ActiveDownload { generation, control_tx });
-
-                        let events = events.clone();
-                        let worker_tx = worker_tx.clone();
-                        tauri::async_runtime::spawn(async move {
-                            let outcome = download_file(events, payload, control_rx).await;
-                            let _ = worker_tx
-                                .send(WorkerEvent::Finished { id, generation, outcome })
-                                .await;
-                        });
-                    }
-                    DownloadCmd::Pause(id) => {
-                        if let Some(download) = active.remove(&id) {
-                            let _ = download.control_tx.send(DownloadControl::Pause).await;
-                        }
-                    }
-                    DownloadCmd::PauseWithAck(id, ack) => {
-                        if let Some(download) = active.remove(&id) {
-                            let _ = download.control_tx.send(DownloadControl::Pause).await;
-                            pending_acks.insert(id, ack);
-                        } else {
-                            let _ = ack.send(());
-                        }
-                    }
-                    DownloadCmd::CancelWithAck(id, ack) => {
-                        if let Some(download) = active.remove(&id) {
-                            let _ = download.control_tx.send(DownloadControl::Cancel).await;
-                            pending_acks.insert(id, ack);
-                        } else {
-                            let _ = ack.send(());
-                        }
-                    }
                     DownloadCmd::CaptureUrls(urls) => {
                         append_unique_urls(&mut pending_captured_urls, urls);
                         if frontend_ready && !pending_captured_urls.is_empty() {
@@ -371,32 +141,6 @@ async fn run_coordinator(
                     }
                 }
             }
-            event = worker_rx.recv() => {
-                let Some(WorkerEvent::Finished { id, generation, outcome }) = event else {
-                    continue;
-                };
-
-                let is_current = active
-                    .get(&id)
-                    .is_some_and(|download| download.generation == generation);
-                if is_current {
-                    active.remove(&id);
-                }
-
-                if let Some(ack) = pending_acks.remove(&id) {
-                    let _ = ack.send(());
-                }
-
-                match (is_current, outcome) {
-                    (true, DownloadOutcome::Completed) => {
-                        events.emit_completed(id);
-                    }
-                    (true, DownloadOutcome::Failed(error)) => {
-                        events.emit_failed(id, error);
-                    }
-                    _ => {}
-                }
-            }
             command = media_rx.recv() => {
                 let Some(command) = command else {
                     continue;
@@ -431,9 +175,6 @@ async fn run_coordinator(
         }
     }
 
-    for (_, download) in active {
-        let _ = download.control_tx.send(DownloadControl::Cancel).await;
-    }
     for (_, cancel_tx) in active_media {
         let _ = cancel_tx.send(true);
     }
@@ -444,315 +185,6 @@ fn append_unique_urls(target: &mut Vec<String>, urls: Vec<String>) {
     target.extend(urls.into_iter().filter(|url| seen.insert(url.clone())));
 }
 
-async fn download_file(
-    events: CoordinatorEventSink,
-    payload: DownloadPayload,
-    mut control_rx: mpsc::Receiver<DownloadControl>,
-) -> DownloadOutcome {
-    if let Some(parent) = payload.output_path.parent() {
-        if let Err(error) = fs::create_dir_all(parent).await {
-            return DownloadOutcome::Failed(error.to_string());
-        }
-    }
-
-    let (client, default_headers) = match build_client(&payload) {
-        Ok(client) => client,
-        Err(error) => return DownloadOutcome::Failed(error),
-    };
-    let mut last_error = "no download URL was provided".to_string();
-
-    // Connection-aware retry policy. A transient network drop never transitions
-    // the download straight to `Failed`: it is classified, the UI is told the
-    // item is `Retrying`, and a 3-strike exponential backoff (2s/5s/10s from
-    // `retry::BACKOFF_SCHEDULE`) runs before the next attempt — all while the
-    // worker slot stays held (the coordinator does not drop the active entry
-    // until this future resolves). `download_attempt` re-issues a Range header
-    // from the existing partial file on every retry, so no bytes are discarded.
-    //
-    // `max_tries` is the user-facing retry count. Attempts include the first
-    // try plus those configured retries.
-    let max_retries = payload.max_tries as usize;
-    let max_attempts = max_retries + 1;
-    'url: for url in &payload.urls {
-        let mut strike = 0_usize;
-        let mut attempts = 0_usize;
-        loop {
-            attempts += 1;
-            match download_attempt(
-                &events,
-                &client,
-                &default_headers,
-                &payload,
-                url,
-                &mut control_rx,
-            )
-            .await
-            {
-                Ok(()) => return DownloadOutcome::Completed,
-                Err(AttemptError::Controlled(DownloadControl::Pause)) => {
-                    return DownloadOutcome::Paused;
-                }
-                Err(AttemptError::Controlled(DownloadControl::Cancel)) => {
-                    if let Err(e) = fs::remove_file(&payload.output_path).await {
-                        log::warn!(
-                            "Failed to remove cancelled file '{}': {}",
-                            payload.output_path.display(),
-                            e
-                        );
-                    }
-                    return DownloadOutcome::Cancelled;
-                }
-                Err(AttemptError::Controlled(DownloadControl::Replace)) => {
-                    return DownloadOutcome::Cancelled;
-                }
-                Err(AttemptError::Failed(error)) => {
-                    last_error = error.clone();
-
-                    if attempts >= max_attempts {
-                        continue 'url;
-                    }
-
-                    let transient = crate::retry::is_transient_network_error(&error);
-                    let strikes_left = strike < max_retries;
-
-                    if transient && strikes_left {
-                        // Transient: announce `Retrying`, back off, then retry.
-                        // The backoff sleep is itself cancelable so a user
-                        // pause/cancel during the wait is honored immediately.
-                        events.emit_retrying(payload.id, strike, error);
-                        let delay = crate::retry::backoff_for(strike);
-                        tokio::select! {
-                            _ = tokio::time::sleep(delay) => {}
-                            control = control_rx.recv() => {
-                                return match control.unwrap_or(DownloadControl::Cancel) {
-                                    DownloadControl::Pause => DownloadOutcome::Paused,
-                                    DownloadControl::Cancel => {
-                                        if let Err(e) = fs::remove_file(&payload.output_path).await {
-                                            log::warn!("Failed to remove cancelled file '{}': {}", payload.output_path.display(), e);
-                                        }
-                                        DownloadOutcome::Cancelled
-                                    }
-                                    DownloadControl::Replace => DownloadOutcome::Cancelled,
-                                };
-                            }
-                        }
-                        strike += 1;
-                        continue;
-                    }
-
-                    if !transient && !crate::retry::is_permanent_network_error(&error) {
-                        // Legacy `max_tries` cap for ambiguous HTTP statuses (e.g.
-                        // 500) that are neither clearly transient nor permanent.
-                        tokio::time::sleep(Duration::from_millis(500)).await;
-                        continue;
-                    }
-
-                    // Permanent error or transient strike budget exhausted.
-                    continue 'url;
-                }
-            }
-        }
-    }
-
-    DownloadOutcome::Failed(last_error)
-}
-
-enum AttemptError {
-    Controlled(DownloadControl),
-    Failed(String),
-}
-
-async fn download_attempt(
-    events: &CoordinatorEventSink,
-    client: &Client,
-    default_headers: &reqwest::header::HeaderMap,
-    payload: &DownloadPayload,
-    url: &str,
-    control_rx: &mut mpsc::Receiver<DownloadControl>,
-) -> Result<(), AttemptError> {
-    let existing_len = fs::metadata(&payload.output_path)
-        .await
-        .map(|metadata| metadata.len())
-        .unwrap_or(0);
-    let mut request = client.get(url).headers(default_headers.clone());
-    if existing_len > 0 {
-        request = request.header(header::RANGE, format!("bytes={existing_len}-"));
-    }
-    if let Some(username) = payload
-        .username
-        .as_deref()
-        .filter(|value| !value.is_empty())
-    {
-        request = request.basic_auth(username, payload.password.as_deref());
-    }
-
-    let response = tokio::select! {
-        control = control_rx.recv() => {
-            return Err(AttemptError::Controlled(control.unwrap_or(DownloadControl::Cancel)));
-        }
-        response = request.send() => {
-            response.map_err(|error| AttemptError::Failed(error.to_string()))?
-        }
-    };
-    if !(response.status().is_success() || response.status() == StatusCode::PARTIAL_CONTENT) {
-        return Err(AttemptError::Failed(format!(
-            "{url} returned HTTP {}",
-            response.status()
-        )));
-    }
-
-    let resumed = existing_len > 0 && response.status() == StatusCode::PARTIAL_CONTENT;
-    if resumed {
-        let content_range = response
-            .headers()
-            .get(reqwest::header::CONTENT_RANGE)
-            .and_then(|h| h.to_str().ok());
-        if !content_range.is_some_and(|r| r.starts_with(&format!("bytes {}-", existing_len))) {
-            return Err(AttemptError::Failed(
-                "Server returned invalid Content-Range for resume".to_string(),
-            ));
-        }
-    }
-    let completed_at_start = if resumed { existing_len } else { 0 };
-    let total_len = response
-        .content_length()
-        .map(|remaining| remaining.saturating_add(completed_at_start));
-    let file = OpenOptions::new()
-        .create(true)
-        .write(true)
-        .append(resumed)
-        .truncate(!resumed)
-        .open(&payload.output_path)
-        .await
-        .map_err(|error| AttemptError::Failed(error.to_string()))?;
-    let mut writer = BufWriter::with_capacity(WRITE_BUFFER_CAPACITY, file);
-    let mut stream = response.bytes_stream();
-    let mut last_emitted_at = Instant::now();
-    let mut last_emitted_bytes = completed_at_start;
-    let mut completed = completed_at_start;
-    let speed_limit = payload.speed_limit.as_deref().and_then(parse_speed_limit);
-    let transfer_started_at = Instant::now();
-    let mut transferred_this_attempt = 0_u64;
-
-    loop {
-        tokio::select! {
-            control = control_rx.recv() => {
-                writer.flush().await.map_err(|error| AttemptError::Failed(error.to_string()))?;
-                return Err(AttemptError::Controlled(control.unwrap_or(DownloadControl::Cancel)));
-            }
-            chunk = stream.next() => {
-                match chunk {
-                    Some(Ok(bytes)) => {
-                        writer
-                            .write_all(&bytes)
-                            .await
-                            .map_err(|error| AttemptError::Failed(error.to_string()))?;
-                        completed = completed.saturating_add(bytes.len() as u64);
-                        transferred_this_attempt =
-                            transferred_this_attempt.saturating_add(bytes.len() as u64);
-
-                        if let Some(bytes_per_second) = speed_limit {
-                            let expected_elapsed =
-                                Duration::from_secs_f64(transferred_this_attempt as f64 / bytes_per_second as f64);
-                            let actual_elapsed = transfer_started_at.elapsed();
-                            if expected_elapsed > actual_elapsed {
-                                tokio::select! {
-                                    control = control_rx.recv() => {
-                                        writer.flush().await.map_err(|error| AttemptError::Failed(error.to_string()))?;
-                                        return Err(AttemptError::Controlled(control.unwrap_or(DownloadControl::Cancel)));
-                                    }
-                                    _ = tokio::time::sleep(expected_elapsed - actual_elapsed) => {}
-                                }
-                            }
-                        }
-
-                        let now = Instant::now();
-                        let interval = now.duration_since(last_emitted_at);
-                        if interval >= PROGRESS_INTERVAL {
-                            events.emit_progress(
-                                payload.id,
-                                completed,
-                                total_len,
-                                completed.saturating_sub(last_emitted_bytes),
-                                interval,
-                            );
-                            last_emitted_at = now;
-                            last_emitted_bytes = completed;
-                        }
-                    }
-                    Some(Err(error)) => {
-                        writer.flush().await.map_err(|flush_error| AttemptError::Failed(flush_error.to_string()))?;
-                        return Err(AttemptError::Failed(error.to_string()));
-                    }
-                    None => break,
-                }
-            }
-        }
-    }
-
-    writer
-        .flush()
-        .await
-        .map_err(|error| AttemptError::Failed(error.to_string()))?;
-    events.emit_progress(
-        payload.id,
-        completed,
-        total_len,
-        completed.saturating_sub(last_emitted_bytes),
-        last_emitted_at.elapsed(),
-    );
-    Ok(())
-}
-
-fn build_client(payload: &DownloadPayload) -> Result<(Client, HeaderMap), String> {
-    let mut headers = HeaderMap::new();
-    if let Some(raw_headers) = payload.headers.as_deref() {
-        for line in raw_headers
-            .lines()
-            .map(str::trim)
-            .filter(|line| !line.is_empty())
-        {
-            let (name, value) = line
-                .split_once(':')
-                .ok_or_else(|| format!("invalid HTTP header: {line}"))?;
-            headers.insert(
-                HeaderName::from_str(name.trim()).map_err(|error| error.to_string())?,
-                HeaderValue::from_str(value.trim()).map_err(|error| error.to_string())?,
-            );
-        }
-    }
-    if let Some(cookies) = payload.cookies.as_deref().filter(|value| !value.is_empty()) {
-        headers.insert(
-            header::COOKIE,
-            HeaderValue::from_str(cookies).map_err(|error| error.to_string())?,
-        );
-    }
-
-    let mut builder = Client::builder();
-    if let Some(user_agent) = payload
-        .user_agent
-        .as_deref()
-        .filter(|value| !value.is_empty())
-    {
-        builder = builder.user_agent(user_agent);
-    }
-    if let Some(proxy) = payload.proxy.as_deref().map(str::trim).filter(|value| !value.is_empty()) {
-        if proxy.eq_ignore_ascii_case("none") {
-            builder = builder.no_proxy();
-        } else {
-            builder = builder.proxy(
-                reqwest::Proxy::all(proxy)
-                    .map_err(|_| "Invalid proxy URL configured".to_string())?,
-            );
-        }
-    }
-
-    builder
-        .build()
-        .map_err(|error| error.to_string())
-        .map(|c| (c, headers))
-}
-
 pub(crate) fn format_speed(bytes_per_second: f64) -> String {
     if bytes_per_second >= 1024.0 * 1024.0 {
         format!("{:.1} MB/s", bytes_per_second / (1024.0 * 1024.0))
@@ -785,49 +217,11 @@ pub(crate) fn format_duration(seconds: f64) -> String {
     }
 }
 
-fn parse_speed_limit(value: &str) -> Option<u64> {
-    let normalized = value.trim().to_ascii_lowercase();
-    if normalized.is_empty() || normalized == "0" {
-        return None;
-    }
-
-    let (number, multiplier) = if let Some(number) = normalized.strip_suffix("kb/s") {
-        (number, 1024.0)
-    } else if let Some(number) = normalized.strip_suffix("mb/s") {
-        (number, 1024.0 * 1024.0)
-    } else if let Some(number) = normalized.strip_suffix("gb/s") {
-        (number, 1024.0 * 1024.0 * 1024.0)
-    } else if let Some(number) = normalized.strip_suffix('k') {
-        (number, 1024.0)
-    } else if let Some(number) = normalized.strip_suffix('m') {
-        (number, 1024.0 * 1024.0)
-    } else if let Some(number) = normalized.strip_suffix('g') {
-        (number, 1024.0 * 1024.0 * 1024.0)
-    } else {
-        (normalized.as_str(), 1.0)
-    };
-
-    number
-        .trim()
-        .parse::<f64>()
-        .ok()
-        .filter(|number| *number > 0.0)
-        .map(|number| (number * multiplier) as u64)
-}
-
 #[cfg(test)]
 mod tests {
-    use super::{parse_speed_limit, DownloadCmd, DownloadCoordinator, DownloadEvent};
+    use super::{DownloadCmd, DownloadCoordinator, DownloadEvent};
     use std::time::Duration;
 
-    #[test]
-    fn parses_aria_style_speed_limits() {
-        assert_eq!(parse_speed_limit("512K"), Some(512 * 1024));
-        assert_eq!(parse_speed_limit("1.5M"), Some(1_572_864));
-        assert_eq!(parse_speed_limit("2 MB/s"), Some(2 * 1024 * 1024));
-        assert_eq!(parse_speed_limit("0"), None);
-    }
-
     #[tokio::test]
     async fn buffers_captured_urls_until_frontend_is_ready() {
         let (coordinator, mut events) = DownloadCoordinator::spawn_headless();

src-tauri/src/download_ownership.rs

@@ -168,6 +168,9 @@ fn legacy_download_queue_paths(app_handle: &tauri::AppHandle) -> Result<Vec<Path
         }
 
         let category_destination = settings.as_ref().map(|settings| {
+            if !settings.category_subfolders_enabled {
+                return settings.base_download_folder.clone();
+            }
             settings
                 .category_directory_overrides
                 .get(&category)
@@ -178,10 +181,13 @@ fn legacy_download_queue_paths(app_handle: &tauri::AppHandle) -> Result<Vec<Path
                         .get(&category)
                         .cloned()
                         .unwrap_or_else(|| category.clone());
-                    std::path::PathBuf::from(&settings.base_download_folder)
-                        .join(subfolder)
-                        .to_string_lossy()
-                        .to_string()
+                    let base = std::path::PathBuf::from(&settings.base_download_folder);
+                    let destination = if subfolder.is_empty() {
+                        base
+                    } else {
+                        base.join(subfolder)
+                    };
+                    destination.to_string_lossy().to_string()
                 })
         });
         let default_destination = settings

src-tauri/src/extension_server.rs

@@ -7,7 +7,7 @@ use axum::{
     routing::{get, post},
     Router,
 };
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit, Mac};
 use reqwest::Url;
 use serde::{Deserialize, Serialize};
 use sha2::Sha256;
@@ -31,7 +31,7 @@ const CLIENT_NONCE_HEADER: &str = "x-firelink-client-nonce";
 const SERVER_PROOF_HEADER: &str = "x-firelink-server-proof";
 const SERVER_PORT_HEADER: &str = "x-firelink-server-port";
 const SERVER_PROOF_PREFIX: &[u8] = b"firelink-server-proof\n";
-const PROTOCOL_VERSION: &str = "3";
+const PROTOCOL_VERSION: &str = "4";
 
 type HmacSha256 = Hmac<Sha256>;
 pub type SharedExtensionToken = Arc<RwLock<String>>;
@@ -61,6 +61,8 @@ struct ExtensionRequest {
     headers: Option<String>,
     #[serde(default)]
     cookies: Option<String>,
+    #[serde(default)]
+    media: bool,
 }
 
 #[derive(Clone, Serialize, TS)]
@@ -72,6 +74,7 @@ pub struct ExtensionDownload {
     filename: Option<String>,
     headers: Option<String>,
     cookies: Option<String>,
+    media: bool,
 }
 
 pub async fn start_server(
@@ -192,13 +195,8 @@ async fn ping_handler(
         return Err(StatusCode::FORBIDDEN);
     }
 
-    let proof = sign_server_proof(
-        timestamp_str,
-        nonce,
-        state.bound_port,
-        &state.pairing_token,
-    )
-    .map_err(|_| StatusCode::FORBIDDEN)?;
+    let proof = sign_server_proof(timestamp_str, nonce, state.bound_port, &state.pairing_token)
+        .map_err(|_| StatusCode::FORBIDDEN)?;
 
     let mut response = Response::new(Body::empty());
     response.headers_mut().insert(
@@ -310,17 +308,45 @@ fn normalize_download(payload: ExtensionRequest) -> Option<ExtensionDownload> {
         matches!(url.scheme(), "http" | "https").then(|| url.to_string())
     });
     let filename = payload.filename.and_then(|value| sanitize_filename(&value));
+    let headers = normalize_headers(payload.headers, payload.media);
 
     Some(ExtensionDownload {
         urls,
         referer,
         silent: payload.silent,
         filename,
-        headers: payload.headers.filter(|value| !value.trim().is_empty()),
-        cookies: payload.cookies.filter(|value| !value.trim().is_empty()),
+        headers,
+        // Explicit media is resolved by yt-dlp, which must use Firelink's
+        // configured browser-cookie source. Forwarding a browser's complete
+        // Cookie header can exceed upstream limits and makes old extension
+        // builds pay for a doomed metadata request before retrying. Ordinary
+        // captured downloads still need their exact request cookies.
+        cookies: (!payload.media)
+            .then_some(payload.cookies)
+            .flatten()
+            .filter(|value| !value.trim().is_empty()),
+        media: payload.media,
     })
 }
 
+fn normalize_headers(headers: Option<String>, media: bool) -> Option<String> {
+    let headers = headers?;
+    if !media {
+        return (!headers.trim().is_empty()).then_some(headers);
+    }
+
+    let filtered = headers
+        .lines()
+        .filter(|line| {
+            line.split_once(':')
+                .map(|(name, _)| !name.trim().eq_ignore_ascii_case("cookie"))
+                .unwrap_or(true)
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+    (!filtered.trim().is_empty()).then_some(filtered)
+}
+
 fn normalize_url(raw_url: &str) -> Option<String> {
     let url = Url::parse(raw_url.trim()).ok()?;
     matches!(url.scheme(), "http" | "https" | "ftp" | "sftp").then(|| url.to_string())
@@ -450,11 +476,11 @@ fn is_allowed_origin(origin: &str) -> bool {
 #[cfg(test)]
 mod tests {
     use super::{
-        add_server_identity, is_valid_client_nonce, sign_server_proof, PROTOCOL_VERSION_HEADER,
-        SERVER_HEADER,
+        add_server_identity, is_valid_client_nonce, normalize_download, sign_server_proof,
+        ExtensionRequest, PROTOCOL_VERSION_HEADER, SERVER_HEADER,
     };
     use axum::{http::StatusCode, middleware, routing::get, Router};
-    use hmac::{Hmac, Mac};
+    use hmac::{Hmac, KeyInit, Mac};
     use sha2::Sha256;
     use std::sync::{Arc, RwLock};
 
@@ -471,6 +497,7 @@ mod tests {
             axum::serve(listener, app).await.unwrap();
         });
 
+        crate::ensure_reqwest_crypto_provider();
         let response = reqwest::get(format!("http://{address}/ping"))
             .await
             .unwrap();
@@ -478,7 +505,7 @@ mod tests {
         assert_eq!(response.headers().get(SERVER_HEADER).unwrap(), "1");
         assert_eq!(
             response.headers().get(PROTOCOL_VERSION_HEADER).unwrap(),
-            "3"
+            "4"
         );
 
         server.abort();
@@ -492,6 +519,47 @@ mod tests {
         assert!(!is_valid_client_nonce("0123456789abcdef0123456789abcdeg"));
     }
 
+    #[test]
+    fn explicit_media_drops_the_extension_cookie_header() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec!["https://www.youtube.com/watch?v=example".to_string()],
+            referer: None,
+            silent: false,
+            filename: None,
+            headers: Some(format!(
+                "Cookie: stale={};\nUser-Agent: Firefox",
+                "x".repeat(64 * 1024)
+            )),
+            cookies: Some(format!("large={}", "x".repeat(64 * 1024))),
+            media: true,
+        })
+        .expect("valid media handoff");
+
+        assert!(download.media);
+        assert!(download.cookies.is_none());
+        assert_eq!(download.headers.as_deref(), Some("User-Agent: Firefox"));
+    }
+
+    #[test]
+    fn regular_capture_preserves_the_extension_cookie_header() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec!["https://example.com/private.zip".to_string()],
+            referer: None,
+            silent: true,
+            filename: None,
+            headers: None,
+            cookies: Some("session=browser-cookie-header".to_string()),
+            media: false,
+        })
+        .expect("valid download handoff");
+
+        assert!(!download.media);
+        assert_eq!(
+            download.cookies.as_deref(),
+            Some("session=browser-cookie-header")
+        );
+    }
+
     #[test]
     fn signs_server_proof_with_timestamp_nonce_and_bound_port() {
         let token = Arc::new(RwLock::new("pairing-token".to_string()));

src-tauri/src/ipc.rs

@@ -108,6 +108,8 @@ pub struct DownloadItem {
     pub queue_position: Option<i32>,
     #[ts(optional)]
     pub has_been_dispatched: Option<bool>,
+    #[ts(optional)]
+    pub last_error: Option<String>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, TS)]
@@ -244,6 +246,7 @@ pub struct SchedulerSettings {
 pub struct PersistedSettings {
     pub theme: Theme,
     pub base_download_folder: String,
+    pub category_subfolders_enabled: bool,
     pub category_subfolders: HashMap<String, String>,
     pub category_directory_overrides: HashMap<String, String>,
     pub approved_download_roots: Vec<String>,
@@ -275,12 +278,11 @@ pub struct PersistedSettings {
     pub prevents_sleep_while_downloading: bool,
     pub media_cookie_source: MediaCookieSource,
     pub site_logins: Vec<SiteLogin>,
-    /// HMAC shared secret for the browser extension.  It is persisted in the
-    /// settings database so that startup never needs to touch the OS keychain.
-    /// The keychain is still used as defence-in-depth — grant_keychain_access
-    /// writes the token there — but the DB copy is the primary read path,
-    /// eliminating the OS credential prompt that macOS shows when the binary
-    /// signature changes after an update.
+    // HMAC shared secret for the browser extension. It is persisted in the
+    // settings database so startup never needs to touch the OS keychain.
+    // The keychain is still used as defense-in-depth by grant_keychain_access,
+    // but the DB copy is the primary read path, eliminating the OS credential
+    // prompt that macOS shows when the binary signature changes after an update.
     #[serde(default)]
     pub extension_pairing_token: String,
     pub auto_check_updates: bool,

src-tauri/src/parity.rs

@@ -1,24 +1,454 @@
 use serde::{Deserialize, Serialize};
+use std::process::Command;
 use ts_rs::TS;
 
 use crate::ipc::DownloadCategory;
 
 #[tauri::command]
 pub async fn get_system_proxy() -> Result<Option<String>, String> {
-    match sysproxy::Sysproxy::get_system_proxy() {
-        Ok(proxy) => {
-            if proxy.enable {
-                let protocol = if proxy.host.contains("://") {
-                    ""
+    match native_system_proxy() {
+        Ok(Some(proxy)) => Ok(Some(proxy)),
+        Ok(None) => Ok(proxy_from_environment()),
+        Err(native_error) => match sysproxy::Sysproxy::get_system_proxy() {
+            Ok(proxy) if proxy.enable => {
+                if proxy.host.contains('=') {
+                    Ok(parse_windows_proxy_server(&proxy.host).or_else(proxy_from_environment))
                 } else {
-                    "http://"
-                };
-                Ok(Some(format!("{}{}:{}", protocol, proxy.host, proxy.port)))
-            } else {
-                Ok(None)
+                    Ok(normalize_sysproxy_address(&proxy.host, proxy.port)
+                        .or_else(proxy_from_environment))
+                }
+            }
+            Ok(_) => Ok(proxy_from_environment()),
+            Err(error) => proxy_from_environment().map(Some).ok_or_else(|| {
+                format!(
+                    "failed to read system proxy settings: {native_error}; sysproxy fallback: {error}"
+                )
+            }),
+        },
+    }
+}
+
+#[cfg(target_os = "windows")]
+fn native_system_proxy() -> Result<Option<String>, String> {
+    fallback_windows_proxy().map_err(|_| "failed to read Windows proxy registry".to_string())
+}
+
+#[cfg(target_os = "macos")]
+fn native_system_proxy() -> Result<Option<String>, String> {
+    let proxy = sysproxy::Sysproxy::get_system_proxy().map_err(|error| error.to_string())?;
+    if !proxy.enable {
+        return Ok(None);
+    }
+    Ok(macos_proxy_for_host_port(&proxy.host, proxy.port)
+        .unwrap_or_else(|| {
+            normalize_sysproxy_address(&proxy.host, proxy.port)
+                .unwrap_or_else(|| format!("http://{}:{}", proxy.host, proxy.port))
+        })
+        .into())
+}
+
+#[cfg(target_os = "linux")]
+fn native_system_proxy() -> Result<Option<String>, String> {
+    let mode =
+        command_stdout(Command::new("gsettings").args(["get", "org.gnome.system.proxy", "mode"]))
+            .map_err(|error| error.to_string())?;
+    if strip_gsettings_string(&mode) != "manual" {
+        return Ok(None);
+    }
+
+    Ok(linux_gsettings_proxy("https", "http")
+        .or_else(|| linux_gsettings_proxy("http", "http"))
+        .or_else(|| linux_gsettings_proxy("socks", "socks5")))
+}
+
+#[cfg(not(any(target_os = "windows", target_os = "macos", target_os = "linux")))]
+fn native_system_proxy() -> Result<Option<String>, String> {
+    Ok(None)
+}
+
+fn proxy_from_environment() -> Option<String> {
+    [
+        "HTTPS_PROXY",
+        "https_proxy",
+        "HTTP_PROXY",
+        "http_proxy",
+        "ALL_PROXY",
+        "all_proxy",
+    ]
+    .into_iter()
+    .find_map(|name| {
+        std::env::var(name)
+            .ok()
+            .and_then(|value| normalize_proxy_address(&value, "http"))
+    })
+}
+
+fn command_stdout(command: &mut Command) -> std::io::Result<String> {
+    let output = command.output()?;
+    if !output.status.success() {
+        return Err(std::io::Error::other(format!(
+            "command exited with {}",
+            output.status
+        )));
+    }
+    Ok(String::from_utf8_lossy(&output.stdout).to_string())
+}
+
+fn normalize_proxy_address(raw: &str, default_scheme: &str) -> Option<String> {
+    let trimmed = raw.trim().trim_matches('"').trim_end_matches('/');
+    if trimmed.is_empty() {
+        return None;
+    }
+
+    let candidate = if trimmed.contains("://") {
+        trimmed.to_string()
+    } else {
+        format!("{default_scheme}://{trimmed}")
+    };
+    let parsed = url::Url::parse(&candidate).ok()?;
+    match parsed.scheme() {
+        "http" | "https" | "socks4" | "socks4a" | "socks5" | "socks5h" => {}
+        _ => return None,
+    }
+    parsed.host_str()?;
+    Some(candidate)
+}
+
+fn normalize_sysproxy_address(host: &str, port: u16) -> Option<String> {
+    let host = host.trim();
+    if host.is_empty() {
+        return None;
+    }
+
+    if host.contains("://") {
+        let mut parsed = url::Url::parse(host).ok()?;
+        if parsed.port().is_none() && port != 0 {
+            parsed.set_port(Some(port)).ok()?;
+        }
+        return normalize_proxy_address(parsed.as_str(), "http");
+    }
+
+    if port == 0 {
+        normalize_proxy_address(host, "http")
+    } else {
+        normalize_proxy_address(&format!("{host}:{port}"), "http")
+    }
+}
+
+fn parse_windows_proxy_server(value: &str) -> Option<String> {
+    let value = value.trim().trim_matches('"');
+    if value.is_empty() {
+        return None;
+    }
+
+    if !value.contains('=') {
+        return normalize_proxy_address(value, "http");
+    }
+
+    let mut http = None;
+    let mut https = None;
+    let mut socks = None;
+    for entry in value.split(';') {
+        let Some((kind, address)) = entry.split_once('=') else {
+            continue;
+        };
+        let kind = kind.trim().to_ascii_lowercase();
+        let address = address.trim();
+        match kind.as_str() {
+            "http" => http = normalize_proxy_address(address, "http"),
+            "https" => https = normalize_proxy_address(address, "http"),
+            "socks" => socks = normalize_proxy_address(address, "socks5"),
+            _ => {}
+        }
+    }
+
+    https.or(http).or(socks)
+}
+
+#[cfg(target_os = "macos")]
+fn macos_proxy_for_host_port(host: &str, port: u16) -> Option<String> {
+    let services_output =
+        command_stdout(Command::new("networksetup").arg("-listallnetworkservices")).ok()?;
+    for service in parse_macos_network_services(&services_output) {
+        for (target, scheme) in [
+            ("securewebproxy", "http"),
+            ("webproxy", "http"),
+            ("socksfirewallproxy", "socks5"),
+        ] {
+            let output = command_stdout(
+                Command::new("networksetup").args([format!("-get{target}"), service.clone()]),
+            )
+            .ok()?;
+            if let Some(proxy) = parse_macos_networksetup_proxy(&output, scheme)
+                .filter(|proxy| proxy_matches_host_port(proxy, host, port))
+            {
+                return Some(proxy);
             }
         }
-        Err(error) => Err(format!("failed to read system proxy settings: {error}")),
+    }
+    None
+}
+
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+fn parse_macos_network_services(output: &str) -> Vec<String> {
+    output
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty())
+        .filter(|line| !line.starts_with("An asterisk"))
+        .filter(|line| !line.starts_with('*'))
+        .map(str::to_string)
+        .collect()
+}
+
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+fn parse_macos_networksetup_proxy(output: &str, scheme: &str) -> Option<String> {
+    let enabled = macos_networksetup_value(output, "Enabled:")
+        .is_some_and(|value| value.eq_ignore_ascii_case("yes"));
+    if !enabled {
+        return None;
+    }
+    let server = macos_networksetup_value(output, "Server:")?;
+    let port = macos_networksetup_value(output, "Port:")?;
+    normalize_proxy_address(&format!("{scheme}://{server}:{port}"), scheme)
+}
+
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+fn proxy_matches_host_port(proxy: &str, host: &str, port: u16) -> bool {
+    let Ok(parsed) = url::Url::parse(proxy) else {
+        return false;
+    };
+    parsed.host_str() == Some(host) && parsed.port() == Some(port)
+}
+
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+fn macos_networksetup_value<'a>(output: &'a str, key: &str) -> Option<&'a str> {
+    output
+        .lines()
+        .map(str::trim)
+        .find_map(|line| line.strip_prefix(key).map(str::trim))
+        .filter(|value| !value.is_empty())
+}
+
+#[cfg(target_os = "linux")]
+fn linux_gsettings_proxy(service: &str, scheme: &str) -> Option<String> {
+    let schema = format!("org.gnome.system.proxy.{service}");
+    let host = command_stdout(Command::new("gsettings").args(["get", &schema, "host"])).ok()?;
+    let host = strip_gsettings_string(&host);
+    if host.is_empty() {
+        return None;
+    }
+    let port = command_stdout(Command::new("gsettings").args(["get", &schema, "port"])).ok()?;
+    let port = port.trim();
+    normalize_proxy_address(&format!("{scheme}://{host}:{port}"), scheme)
+}
+
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+fn strip_gsettings_string(value: &str) -> String {
+    value
+        .trim()
+        .trim_matches('\'')
+        .trim_matches('"')
+        .to_string()
+}
+
+#[cfg(target_os = "windows")]
+fn fallback_windows_proxy() -> Result<Option<String>, ()> {
+    use std::os::windows::process::CommandExt;
+    use std::process::Command;
+    const CREATE_NO_WINDOW: u32 = 0x08000000;
+
+    let output = Command::new("reg")
+        .args(&[
+            "query",
+            "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
+            "/v",
+            "ProxyEnable",
+        ])
+        .creation_flags(CREATE_NO_WINDOW)
+        .output()
+        .map_err(|_| ())?;
+
+    if !output.status.success() {
+        return Err(());
+    }
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let enabled = registry_value(&stdout, "ProxyEnable")
+        .as_deref()
+        .is_some_and(windows_proxy_enabled);
+    if !enabled {
+        return Ok(None);
+    }
+
+    let output = Command::new("reg")
+        .args(&[
+            "query",
+            "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
+            "/v",
+            "ProxyServer",
+        ])
+        .creation_flags(CREATE_NO_WINDOW)
+        .output()
+        .map_err(|_| ())?;
+
+    if !output.status.success() {
+        return Err(());
+    }
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    Ok(registry_value(&stdout, "ProxyServer").and_then(|value| parse_windows_proxy_server(&value)))
+}
+
+#[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+fn windows_proxy_enabled(value: &str) -> bool {
+    let value = value.trim();
+    if value == "1" {
+        return true;
+    }
+    value
+        .strip_prefix("0x")
+        .or_else(|| value.strip_prefix("0X"))
+        .and_then(|hex| u32::from_str_radix(hex, 16).ok())
+        .is_some_and(|enabled| enabled == 1)
+}
+
+#[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+fn registry_value(output: &str, name: &str) -> Option<String> {
+    for line in output.lines() {
+        let trimmed = line.trim();
+        let mut parts = trimmed.split_whitespace();
+        let Some(key) = parts.next() else {
+            continue;
+        };
+        if !key.eq_ignore_ascii_case(name) {
+            continue;
+        }
+        if parts.next().is_none() {
+            continue;
+        }
+        let data = parts.collect::<Vec<_>>().join(" ");
+        if !data.is_empty() {
+            return Some(data);
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+mod proxy_tests {
+    use super::{
+        normalize_proxy_address, normalize_sysproxy_address, parse_macos_network_services,
+        parse_macos_networksetup_proxy, parse_windows_proxy_server, proxy_matches_host_port,
+        registry_value, strip_gsettings_string, windows_proxy_enabled,
+    };
+
+    #[test]
+    fn normalizes_bare_proxy_addresses() {
+        assert_eq!(
+            normalize_proxy_address("127.0.0.1:8080", "http").as_deref(),
+            Some("http://127.0.0.1:8080")
+        );
+        assert_eq!(
+            normalize_proxy_address(" socks5://127.0.0.1:1080/ ", "http").as_deref(),
+            Some("socks5://127.0.0.1:1080")
+        );
+        assert_eq!(normalize_proxy_address("file:///tmp/proxy", "http"), None);
+    }
+
+    #[test]
+    fn parses_windows_protocol_proxy_server_values() {
+        assert_eq!(
+            parse_windows_proxy_server("http=127.0.0.1:8080;https=127.0.0.1:8081").as_deref(),
+            Some("http://127.0.0.1:8081")
+        );
+        assert_eq!(
+            parse_windows_proxy_server("socks=127.0.0.1:1080").as_deref(),
+            Some("socks5://127.0.0.1:1080")
+        );
+        assert_eq!(
+            parse_windows_proxy_server("proxy.local:9000").as_deref(),
+            Some("http://proxy.local:9000")
+        );
+    }
+
+    #[test]
+    fn normalizes_sysproxy_host_without_duplicating_ports() {
+        assert_eq!(
+            normalize_sysproxy_address("http://proxy.local", 8080).as_deref(),
+            Some("http://proxy.local:8080")
+        );
+        assert_eq!(
+            normalize_sysproxy_address("http://proxy.local:9000", 8080).as_deref(),
+            Some("http://proxy.local:9000")
+        );
+        assert_eq!(
+            normalize_sysproxy_address("proxy.local", 8080).as_deref(),
+            Some("http://proxy.local:8080")
+        );
+    }
+
+    #[test]
+    fn parses_macos_proxy_outputs_with_scheme() {
+        let services = r#"
+An asterisk (*) denotes that a network service is disabled.
+Wi-Fi
+*USB 10/100/1000 LAN
+Thunderbolt Bridge
+"#;
+        assert_eq!(
+            parse_macos_network_services(services),
+            vec!["Wi-Fi".to_string(), "Thunderbolt Bridge".to_string()]
+        );
+
+        let proxy = r#"
+Enabled: Yes
+Server: 127.0.0.1
+Port: 1080
+Authenticated Proxy Enabled: 0
+"#;
+        assert_eq!(
+            parse_macos_networksetup_proxy(proxy, "socks5").as_deref(),
+            Some("socks5://127.0.0.1:1080")
+        );
+        assert!(proxy_matches_host_port(
+            "socks5://127.0.0.1:1080",
+            "127.0.0.1",
+            1080
+        ));
+        assert!(!proxy_matches_host_port(
+            "socks5://127.0.0.1:1080",
+            "127.0.0.1",
+            1081
+        ));
+
+        let disabled = proxy.replace("Enabled: Yes", "Enabled: No");
+        assert_eq!(parse_macos_networksetup_proxy(&disabled, "socks5"), None);
+    }
+
+    #[test]
+    fn strips_gsettings_string_quotes() {
+        assert_eq!(strip_gsettings_string("'manual'\n"), "manual");
+        assert_eq!(strip_gsettings_string("\"127.0.0.1\"\n"), "127.0.0.1");
+    }
+
+    #[test]
+    fn parses_reg_query_output_values() {
+        let output = r#"
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
+    ProxyEnable    REG_DWORD    0x1
+    ProxyServer    REG_SZ       http=127.0.0.1:8080;https=127.0.0.1:8081
+"#;
+
+        assert!(registry_value(output, "ProxyEnable")
+            .as_deref()
+            .is_some_and(windows_proxy_enabled));
+        assert_eq!(
+            registry_value(output, "ProxyServer").as_deref(),
+            Some("http=127.0.0.1:8080;https=127.0.0.1:8081")
+        );
+        assert!(!windows_proxy_enabled("0X0"));
+        assert!(windows_proxy_enabled("0X1"));
     }
 }
 
@@ -111,6 +541,7 @@ pub async fn check_for_updates(
 ) -> Result<ReleaseCheckOutcome, String> {
     let current_version = app_handle.package_info().version.to_string();
 
+    crate::ensure_reqwest_crypto_provider();
     let client = reqwest::Client::new();
     let res = client
         .get("https://api.github.com/repos/nimbold/Firelink/releases?per_page=30")
@@ -225,6 +656,11 @@ pub static SUPPORTED_DOMAINS: &[&str] = &[
     "reddit.com",
     "v.redd.it",
     "soundcloud.com",
+    "pornhub.com",
+    "redtube.com",
+    "xhamster.com",
+    "xnxx.com",
+    "xvideos.com",
 ];
 
 #[tauri::command]

src-tauri/src/process.rs

@@ -9,10 +9,8 @@ pub fn kill_process_tree(pid: u32) {
     while i < to_kill.len() {
         let current_pid = to_kill[i];
         for (p, process) in sys.processes() {
-            if process.parent() == Some(current_pid) {
-                if !to_kill.contains(p) {
-                    to_kill.push(*p);
-                }
+            if process.parent() == Some(current_pid) && !to_kill.contains(p) {
+                to_kill.push(*p);
             }
         }
         i += 1;

src-tauri/src/queue.rs

@@ -28,7 +28,6 @@ pub enum PendingOutcome {
 pub enum TaskKind {
     Aria2,
     Media,
-    Native,
 }
 
 /// Everything needed to start a sidecar, captured at enqueue time so the
@@ -64,7 +63,7 @@ pub struct SpawnPayload {
     pub is_media: bool,
 }
 
-/// A sidecar spawner. In production this calls the real aria2/yt-dlp/native
+/// A sidecar spawner. In production this calls the real aria2/yt-dlp
 /// runners; in tests it is replaced with a fake that records calls and
 /// optionally hangs to simulate a long-running download.
 #[async_trait::async_trait]
@@ -80,14 +79,13 @@ pub trait SidecarSpawner: Send + Sync + 'static {
     /// Run a media download to completion. The permit is parked for the full
     /// duration; release is handled by QueueManager on the runner's exit.
     async fn run_media(&self, id: &str, payload: &SpawnPayload) -> Result<(), String>;
-
-    /// Run a native HTTP download to completion.
-    async fn run_native(&self, id: &str, payload: &SpawnPayload) -> Result<(), String>;
 }
 
 /// The centralized concurrency gatekeeper. One instance lives in AppState.
 pub struct QueueManager<R: tauri::Runtime = tauri::Wry> {
     registered_ids: Mutex<HashSet<String>>,
+    enqueue_cancellations: Mutex<HashMap<String, u64>>,
+    enqueue_generations: Mutex<HashMap<String, u64>>,
     pending: Mutex<VecDeque<QueuedTask>>,
     semaphore: Arc<Semaphore>,
     active_permits: Mutex<HashMap<String, OwnedSemaphorePermit>>,
@@ -95,7 +93,6 @@ pub struct QueueManager<R: tauri::Runtime = tauri::Wry> {
     target_capacity: AtomicUsize,
     slots_to_retire: AtomicUsize,
     notify: Notify,
-    notify_permit_released: Notify,
 
     /// aria2 gid -> download id map (shared with the WS poller).
     pub aria2_gids: Arc<std::sync::RwLock<HashMap<String, String>>>,
@@ -112,6 +109,8 @@ pub struct QueueManager<R: tauri::Runtime = tauri::Wry> {
 
     /// Download ids whose aria2 retry loop must not create another job.
     aria2_retry_cancelled: Mutex<HashSet<String>>,
+    /// Wakes retry backoff workers when a pause/remove action cancels them.
+    aria2_retry_cancel_notify: Notify,
 
     /// Monotonic per-download aria2 control generation. Long-running queued
     /// resume tasks capture this and abort when a later pause/remove wins.
@@ -138,6 +137,8 @@ impl<R: tauri::Runtime> QueueManager<R> {
     ) -> Self {
         Self {
             registered_ids: Mutex::new(HashSet::new()),
+            enqueue_cancellations: Mutex::new(HashMap::new()),
+            enqueue_generations: Mutex::new(HashMap::new()),
             pending: Mutex::new(VecDeque::new()),
             semaphore: Arc::new(Semaphore::new(capacity)),
             active_permits: Mutex::new(HashMap::new()),
@@ -145,12 +146,12 @@ impl<R: tauri::Runtime> QueueManager<R> {
             target_capacity: AtomicUsize::new(capacity),
             slots_to_retire: AtomicUsize::new(0),
             notify: Notify::new(),
-            notify_permit_released: Notify::new(),
             aria2_gids: Arc::new(std::sync::RwLock::new(HashMap::new())),
             pending_completion: Arc::new(Mutex::new(HashMap::new())),
             aria2_payloads: Mutex::new(HashMap::new()),
             aria2_retry_strikes: Mutex::new(HashMap::new()),
             aria2_retry_cancelled: Mutex::new(HashSet::new()),
+            aria2_retry_cancel_notify: Notify::new(),
             aria2_control_epochs: Mutex::new(HashMap::new()),
             spawner,
             app_handle,
@@ -177,6 +178,108 @@ impl<R: tauri::Runtime> QueueManager<R> {
         self.registered_ids.lock().await.contains(id)
     }
 
+    /// Reject an in-flight enqueue generation if a newer UI action supersedes it.
+    pub async fn cancel_enqueue_generation(&self, id: &str, generation: u64) {
+        let mut cancellations = self.enqueue_cancellations.lock().await;
+        cancellations
+            .entry(id.to_string())
+            .and_modify(|current| *current = (*current).max(generation))
+            .or_insert(generation);
+    }
+
+    /// Atomically reserve an ID after rejecting cancelled or replayed generations.
+    /// The returned watermark must be passed to `rollback_enqueue_reservation`
+    /// if ownership registration fails before the task is committed.
+    pub async fn reserve_enqueue_generation(
+        &self,
+        id: &str,
+        generation: u64,
+    ) -> Result<Option<u64>, String> {
+        let cancellations = self.enqueue_cancellations.lock().await;
+        if cancellations
+            .get(id)
+            .is_some_and(|cancelled| *cancelled >= generation)
+        {
+            return Err("Download enqueue was superseded by a newer user action".to_string());
+        }
+        let mut generations = self.enqueue_generations.lock().await;
+        let previous_generation = generations.get(id).copied();
+        if previous_generation.is_some_and(|seen| seen >= generation) {
+            return Err("Download enqueue was superseded by a newer user action".to_string());
+        }
+
+        let mut registered = self.registered_ids.lock().await;
+        if registered.contains(id) {
+            return Err("Duplicate task".to_string());
+        }
+        registered.insert(id.to_string());
+        generations.insert(id.to_string(), generation);
+        Ok(previous_generation)
+    }
+
+    pub async fn rollback_enqueue_reservation(
+        &self,
+        id: &str,
+        generation: u64,
+        previous_generation: Option<u64>,
+    ) {
+        let mut generations = self.enqueue_generations.lock().await;
+        let mut registered = self.registered_ids.lock().await;
+        if generations.get(id).copied() != Some(generation) {
+            return;
+        }
+        registered.remove(id);
+        match previous_generation {
+            Some(previous) => {
+                generations.insert(id.to_string(), previous);
+            }
+            None => {
+                generations.remove(id);
+            }
+        }
+    }
+
+    pub async fn commit_reserved_enqueue(
+        &self,
+        task: QueuedTask,
+        generation: u64,
+    ) -> Result<(), String> {
+        let id = task.id.clone();
+        let cancellations = self.enqueue_cancellations.lock().await;
+        if cancellations
+            .get(&id)
+            .is_some_and(|cancelled| *cancelled >= generation)
+        {
+            return Err("Download enqueue was superseded by a newer user action".to_string());
+        }
+        self.pending.lock().await.push_back(task);
+        self.emit_state(id, DownloadStatus::Queued);
+        self.notify.notify_one();
+        Ok(())
+    }
+
+    /// Atomically checks the generation watermark before registering a task.
+    pub async fn push_with_generation(
+        &self,
+        task: QueuedTask,
+        generation: u64,
+    ) -> Result<(), String> {
+        let id = task.id.clone();
+        let previous_generation = self.reserve_enqueue_generation(&id, generation).await?;
+        if let Err(error) = self.commit_reserved_enqueue(task, generation).await {
+            self.rollback_enqueue_reservation(&id, generation, previous_generation)
+                .await;
+            return Err(error);
+        }
+        Ok(())
+    }
+
+    /// Enqueue a task without a frontend lifecycle token. This is retained for
+    /// internal/test callers and still gets replay protection at generation 0.
+    pub async fn push(&self, task: QueuedTask) -> Result<(), String> {
+        self.push_with_generation(task, 0).await
+    }
+
     pub async fn next_aria2_control_epoch(&self, id: &str) -> u64 {
         let mut epochs = self.aria2_control_epochs.lock().await;
         let epoch = epochs.get(id).copied().unwrap_or_default().wrapping_add(1);
@@ -202,22 +305,6 @@ impl<R: tauri::Runtime> QueueManager<R> {
         self.aria2_retry_strikes.lock().await.contains_key(id)
     }
 
-    /// Enqueue a task. Checks the centralized `registered_ids` for deduplication.
-    pub async fn push(&self, task: QueuedTask) -> Result<(), String> {
-        let id = task.id.clone();
-        let mut registered = self.registered_ids.lock().await;
-        if registered.contains(&id) {
-            return Err("Duplicate task".to_string());
-        }
-        registered.insert(id.clone());
-        drop(registered);
-
-        self.pending.lock().await.push_back(task);
-        self.emit_state(id, DownloadStatus::Queued);
-        self.notify.notify_one();
-        Ok(())
-    }
-
     /// Pop the next task, or None if empty.
     pub async fn pop_front(&self) -> Option<QueuedTask> {
         self.pending.lock().await.pop_front()
@@ -298,7 +385,6 @@ impl<R: tauri::Runtime> QueueManager<R> {
         let removed = self.active_permits.lock().await.remove(id).is_some();
         self.active_kinds.lock().await.remove(id);
         if removed {
-            self.notify_permit_released.notify_waiters();
             self.notify.notify_one();
         }
     }
@@ -407,7 +493,7 @@ impl<R: tauri::Runtime> QueueManager<R> {
         let id = task.id.clone();
         // Park the permit BEFORE spawning. Uniform parking:
         // aria2's RPC returns instantly, so the permit must outlive the
-        // dispatch_one call. Media/Native runners release on exit.
+        // dispatch_one call. Media runners release on exit.
         self.park_permit(&id, permit).await;
         self.active_kinds
             .lock()
@@ -432,15 +518,13 @@ impl<R: tauri::Runtime> QueueManager<R> {
                                 id,
                                 gid
                             );
-                            if !gid.starts_with("native:") {
-                                if let Err(error) = self.spawner.remove_uri(&gid).await {
-                                    log::warn!(
-                                        "aria2 dispatch cancellation [{}]: failed to remove late gid {}: {}",
-                                        id,
-                                        gid,
-                                        error
-                                    );
-                                }
+                            if let Err(error) = self.spawner.remove_uri(&gid).await {
+                                log::warn!(
+                                    "aria2 dispatch cancellation [{}]: failed to remove late gid {}: {}",
+                                    id,
+                                    gid,
+                                    error
+                                );
                             }
                             self.clear_aria2_retry_state(&id).await;
                             self.release_permit(&id).await;
@@ -464,21 +548,6 @@ impl<R: tauri::Runtime> QueueManager<R> {
                     this.finish_runner(&id_for_task, outcome).await;
                 });
             }
-            TaskKind::Native => {
-                // Native coordinator is event-driven (fire-and-observe). Send
-                // Start; completion is handled by the download-complete/
-                // download-failed listener in lib.rs setup() which calls
-                // release_permit + apply_completion.
-                let this = Arc::clone(&self);
-                let payload = task.payload.clone();
-                let id_for_task = id.clone();
-                tauri::async_runtime::spawn(async move {
-                    if let Err(error) = this.spawner.run_native(&id_for_task, &payload).await {
-                        this.emit_failed(&id_for_task, error);
-                        this.release_permit(&id_for_task).await;
-                    }
-                });
-            }
         }
     }
 
@@ -575,6 +644,7 @@ impl<R: tauri::Runtime> QueueManager<R> {
             .lock()
             .await
             .insert(id.to_string());
+        self.aria2_retry_cancel_notify.notify_waiters();
     }
 
     pub async fn allow_aria2_retries(&self, id: &str) {
@@ -617,36 +687,6 @@ impl<R: tauri::Runtime> QueueManager<R> {
         removed.last().cloned()
     }
 
-    /// Overwrite a stale aria2 gid with the fresh gid minted by a retry
-    /// `addUri`. Failing to call this after re-add leaks the semaphore permit.
-    pub fn rotate_aria2_gid(&self, id: &str, stale_gid: &str, new_gid: &str) {
-        let mut gids = self.aria2_gids.write().unwrap();
-        gids.remove(stale_gid);
-        gids.insert(new_gid.to_string(), id.to_string());
-        log::info!(
-            "aria2 gid transition [{}]: rotated {} -> {}",
-            id,
-            stale_gid,
-            new_gid
-        );
-    }
-
-    async fn wait_permit_released(self: &Arc<Self>, id: &str) {
-        loop {
-            if !self.active_permits.lock().await.contains_key(id) {
-                return;
-            }
-            let notified = self.notify_permit_released.notified();
-            if !self.active_permits.lock().await.contains_key(id) {
-                return;
-            }
-            tokio::select! {
-                _ = notified => {}
-                _ = tokio::time::sleep(std::time::Duration::from_secs(5)) => {}
-            }
-        }
-    }
-
     /// Intercept transient `onDownloadError` events: backoff, re-issue
     /// `addUri`, and rotate the gid mapping. Permanent errors and exhausted
     /// strikes fall through to a hard `Failed` state.
@@ -716,14 +756,27 @@ impl<R: tauri::Runtime> QueueManager<R> {
         }
 
         let this = Arc::clone(self);
-        let stale_gid = gid.to_string();
         let id_for_task = id.clone();
         let error_for_emit = error.clone();
         tauri::async_runtime::spawn(async move {
+            let retry_cancel = async {
+                loop {
+                    if this.is_aria2_retry_cancelled(&id_for_task).await {
+                        break;
+                    }
+                    let notified = this.aria2_retry_cancel_notify.notified();
+                    tokio::pin!(notified);
+                    notified.as_mut().enable();
+                    if this.is_aria2_retry_cancelled(&id_for_task).await {
+                        break;
+                    }
+                    notified.await;
+                }
+            };
             let outcome = backoff_and_emit(
                 strike,
                 error_for_emit,
-                this.wait_permit_released(&id_for_task),
+                retry_cancel,
                 |reason| {
                     use tauri::Emitter;
                     let _ = this.app_handle.emit(
@@ -773,11 +826,12 @@ impl<R: tauri::Runtime> QueueManager<R> {
                             );
                             return;
                         }
-                        this.rotate_aria2_gid(&id_for_task, &stale_gid, &new_gid);
+                        let retained_gid = new_gid.clone();
+                        this.remember_gid(id_for_task.clone(), new_gid).await;
                         log::warn!(
                             "aria2 retry cancellation [{}]: retained late gid {} mapping for remove retry",
                             id_for_task,
-                            new_gid
+                            retained_gid
                         );
                         return;
                     }
@@ -785,8 +839,8 @@ impl<R: tauri::Runtime> QueueManager<R> {
                         .lock()
                         .await
                         .insert(id_for_task.clone(), strike + 1);
-                    this.rotate_aria2_gid(&id_for_task, &stale_gid, &new_gid);
                     this.emit_state(&id_for_task, DownloadStatus::Downloading);
+                    this.remember_gid(id_for_task.clone(), new_gid).await;
                 }
                 Err(retry_error) => {
                     this.apply_completion(&id_for_task, PendingOutcome::Error(retry_error))
@@ -876,40 +930,6 @@ impl<R: tauri::Runtime> QueueManager<R> {
         }
         removed
     }
-
-    /// Bulk enqueue by appending tasks. Used by startup and start-all.
-    pub async fn enqueue_many(&self, tasks: Vec<QueuedTask>) -> Vec<crate::ipc::EnqueueResult> {
-        let mut results = Vec::new();
-        let mut registered = self.registered_ids.lock().await;
-        let mut pending = self.pending.lock().await;
-
-        for task in tasks {
-            let id = task.id.clone();
-            let filename = task.payload.filename.clone();
-            if registered.contains(&id) {
-                results.push(crate::ipc::EnqueueResult {
-                    id: id.clone(),
-                    success: false,
-                    filename: None,
-                    error: Some("Duplicate task".to_string()),
-                });
-                continue;
-            }
-            registered.insert(id.clone());
-            pending.push_back(task);
-            self.emit_state(id.clone(), DownloadStatus::Queued);
-            results.push(crate::ipc::EnqueueResult {
-                id,
-                success: true,
-                filename: Some(filename),
-                error: None,
-            });
-        }
-        drop(pending);
-        drop(registered);
-        self.notify.notify_one();
-        results
-    }
 }
 
 fn automatic_retry_limit(max_tries: Option<i32>) -> usize {
@@ -917,13 +937,28 @@ fn automatic_retry_limit(max_tries: Option<i32>) -> usize {
 }
 
 fn aria2_attempt_limit(max_tries: Option<i32>) -> u32 {
-    (automatic_retry_limit(max_tries) + 1) as u32
+    // Firelink owns the retry budget and performs the backoff/GID rotation.
+    // Keep each aria2 GID to one attempt so `max_tries` is not multiplied by
+    // aria2's own internal retry loop.
+    let _ = max_tries;
+    1
 }
 
 fn is_retryable_aria2_error(error: &str) -> bool {
     is_transient_network_error(error) || is_aria2_range_mode_error(error)
 }
 
+fn is_aria2_rpc_unavailable(error: &str) -> bool {
+    let lower = error.to_ascii_lowercase();
+    is_transient_network_error(error)
+        || lower.contains("aria2 did not become ready")
+        || lower.contains("connection refused")
+        || lower.contains("failed to connect")
+        || lower.contains("error trying to connect")
+        || lower.contains("connection closed")
+        || lower.contains("connection reset")
+}
+
 fn is_aria2_range_mode_error(error: &str) -> bool {
     let lower = error.to_ascii_lowercase();
     lower.contains("invalid range header")
@@ -1008,10 +1043,34 @@ fn uri_host_for_log(uri: &str) -> String {
         .unwrap_or_else(|| "<unknown host>".to_string())
 }
 
+fn proxy_scheme(proxy: &str) -> Option<String> {
+    proxy
+        .split_once("://")
+        .map(|(scheme, _)| scheme.trim().to_ascii_lowercase())
+}
+
+fn aria2_all_proxy_value(proxy: &str) -> Result<Option<String>, String> {
+    let proxy = proxy.trim();
+    if proxy.is_empty() {
+        return Ok(None);
+    }
+    if proxy.eq_ignore_ascii_case("none") {
+        return Ok(Some(String::new()));
+    }
+    if proxy_scheme(proxy).is_some_and(|scheme| scheme.starts_with("socks")) {
+        return Err(
+            "SOCKS system proxies are not supported for normal file downloads because aria2 only accepts HTTP/HTTPS/FTP proxy URLs. Use an HTTP proxy endpoint for normal downloads, or use media downloads where yt-dlp supports SOCKS.".to_string(),
+        );
+    }
+    Ok(Some(proxy.to_string()))
+}
+
 async fn probe_bounded_range_support(
     uri: &str,
     payload: &SpawnPayload,
 ) -> Result<BoundedRangeSupport, String> {
+    crate::ensure_reqwest_crypto_provider();
+
     let mut builder = reqwest::Client::builder()
         .redirect(reqwest::redirect::Policy::limited(5))
         .timeout(std::time::Duration::from_secs(10));
@@ -1123,8 +1182,7 @@ fn parse_content_range_bounds(value: &str) -> Option<(u64, u64)> {
     Some((start.trim().parse().ok()?, end.trim().parse().ok()?))
 }
 
-/// Production spawner that delegates to the real aria2 RPC, yt-dlp, and
-/// native coordinator runners.
+/// Production spawner that delegates to the real aria2 RPC and yt-dlp runners.
 pub struct ProductionSpawner {
     app_handle: AppHandle<tauri::Wry>,
 }
@@ -1133,6 +1191,32 @@ impl ProductionSpawner {
     pub fn new(app_handle: AppHandle<tauri::Wry>) -> Self {
         Self { app_handle }
     }
+
+    async fn add_uri_rpc(
+        &self,
+        state: &crate::AppState,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value, String> {
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(15);
+        loop {
+            match crate::rpc_call(
+                state.aria2_port.load(std::sync::atomic::Ordering::Relaxed),
+                &state.aria2_secret,
+                "aria2.addUri",
+                params.clone(),
+            )
+            .await
+            {
+                Ok(result) => return Ok(result),
+                Err(error) => {
+                    if !is_aria2_rpc_unavailable(&error) || std::time::Instant::now() >= deadline {
+                        return Err(error);
+                    }
+                    tokio::time::sleep(std::time::Duration::from_millis(250)).await;
+                }
+            }
+        }
+    }
 }
 
 #[async_trait::async_trait]
@@ -1144,6 +1228,12 @@ impl SidecarSpawner for ProductionSpawner {
         if !crate::is_safe_path(&resolved_dest, &self.app_handle) {
             return Err("Path traversal blocked".to_string());
         }
+        let proxy_value = payload
+            .proxy
+            .as_deref()
+            .map(aria2_all_proxy_value)
+            .transpose()?
+            .flatten();
         options.insert(
             "dir".to_string(),
             serde_json::json!(resolved_dest.to_string_lossy().to_string()),
@@ -1161,7 +1251,13 @@ impl SidecarSpawner for ProductionSpawner {
         options.insert("max-tries".to_string(), serde_json::json!(mt.to_string()));
         options.insert("retry-wait".to_string(), serde_json::json!("2"));
         options.insert("continue".to_string(), serde_json::json!("true"));
-        if let Some(speed) = &payload.speed_limit {
+        options.insert("always-resume".to_string(), serde_json::json!("true"));
+        options.insert("auto-file-renaming".to_string(), serde_json::json!("false"));
+        if let Some(speed) = payload
+            .speed_limit
+            .as_deref()
+            .and_then(crate::normalize_speed_limit_for_aria2)
+        {
             options.insert("max-download-limit".to_string(), serde_json::json!(speed));
         }
         if let Some(user) = &payload.username {
@@ -1195,29 +1291,13 @@ impl SidecarSpawner for ProductionSpawner {
         if !header_list.is_empty() {
             options.insert("header".to_string(), serde_json::json!(header_list));
         }
-        if let Some(prox) = payload
-            .proxy
-            .as_deref()
-            .map(str::trim)
-            .filter(|s| !s.is_empty())
-        {
-            if prox.eq_ignore_ascii_case("none") {
-                options.insert("all-proxy".to_string(), serde_json::json!(""));
-            } else {
-                options.insert("all-proxy".to_string(), serde_json::json!(prox));
-            }
+        if let Some(prox) = proxy_value {
+            options.insert("all-proxy".to_string(), serde_json::json!(prox));
         }
         let uris = crate::collect_download_uris(&payload.url, payload.mirrors.as_deref());
         let params = serde_json::json!([uris, options]);
 
-        match crate::rpc_call(
-            state.aria2_port.load(std::sync::atomic::Ordering::Relaxed),
-            &state.aria2_secret,
-            "aria2.addUri",
-            params,
-        )
-        .await
-        {
+        match self.add_uri_rpc(&state, &params).await {
             Ok(result) => {
                 let gid = result.as_str().unwrap_or("").to_string();
                 if gid.is_empty() {
@@ -1228,35 +1308,8 @@ impl SidecarSpawner for ProductionSpawner {
                 }
             }
             Err(e) => {
-                // aria2 unavailable — fall back to native coordinator.
-                log::warn!("aria2 addUri failed, falling back to native: {}", e);
-                let download_id = uuid::Uuid::parse_str(id).map_err(|e| e.to_string())?;
-                let mt = automatic_retry_limit(payload.max_tries) as u32;
-                let safe_filename =
-                    crate::download_ownership::canonical_download_filename(&payload.filename);
-                state
-                    .download_coordinator
-                    .send(crate::download::DownloadCmd::Start(Box::new(
-                        crate::download::DownloadPayload {
-                            id: download_id,
-                            urls: crate::collect_download_uris(
-                                &payload.url,
-                                payload.mirrors.as_deref(),
-                            ),
-                            output_path: resolved_dest.join(safe_filename),
-                            speed_limit: payload.speed_limit.clone(),
-                            username: payload.username.clone(),
-                            password: payload.password.clone(),
-                            headers: payload.headers.clone(),
-                            cookies: payload.cookies.clone(),
-                            user_agent: payload.user_agent.clone(),
-                            max_tries: mt,
-                            proxy: payload.proxy.clone(),
-                        },
-                    )))
-                    .await
-                    .map_err(|e| e.to_string())?;
-                Ok(format!("native:{id}"))
+                log::error!("aria2 addUri [{}] failed: {}", id, e);
+                Err(format!("aria2 addUri failed: {e}"))
             }
         }
     }
@@ -1320,36 +1373,6 @@ impl SidecarSpawner for ProductionSpawner {
             .await;
         outcome.map(|_| ())
     }
-
-    async fn run_native(&self, id: &str, payload: &SpawnPayload) -> Result<(), String> {
-        let state = self.app_handle.state::<crate::AppState>();
-        let download_id = uuid::Uuid::parse_str(id).map_err(|e| e.to_string())?;
-        let mt = automatic_retry_limit(payload.max_tries) as u32;
-        let resolved_dest = crate::resolve_path(&payload.destination, &self.app_handle);
-        let safe_filename =
-            crate::download_ownership::canonical_download_filename(&payload.filename);
-        let output_path = resolved_dest.join(safe_filename);
-        let _ = crate::download_ownership::set_primary_path(&self.app_handle, id, &output_path);
-        state
-            .download_coordinator
-            .send(crate::download::DownloadCmd::Start(Box::new(
-                crate::download::DownloadPayload {
-                    id: download_id,
-                    urls: crate::collect_download_uris(&payload.url, payload.mirrors.as_deref()),
-                    output_path,
-                    speed_limit: payload.speed_limit.clone(),
-                    username: payload.username.clone(),
-                    password: payload.password.clone(),
-                    headers: payload.headers.clone(),
-                    cookies: payload.cookies.clone(),
-                    user_agent: payload.user_agent.clone(),
-                    max_tries: mt,
-                    proxy: payload.proxy.clone(),
-                },
-            )))
-            .await?;
-        Ok(())
-    }
 }
 
 #[derive(Debug, Clone, Deserialize, TS)]
@@ -1374,6 +1397,9 @@ pub struct EnqueueItem {
     pub format_selector: Option<String>,
     pub cookie_source: Option<String>,
     pub is_media: Option<bool>,
+    #[serde(default)]
+    #[ts(optional)]
+    pub lifecycle_generation: Option<String>,
 }
 
 impl EnqueueItem {
@@ -1438,6 +1464,20 @@ mod tests {
         );
     }
 
+    #[test]
+    fn aria2_proxy_value_rejects_socks_proxies() {
+        assert_eq!(aria2_all_proxy_value("none").unwrap().as_deref(), Some(""));
+        assert_eq!(
+            aria2_all_proxy_value("http://127.0.0.1:8080")
+                .unwrap()
+                .as_deref(),
+            Some("http://127.0.0.1:8080")
+        );
+        assert!(aria2_all_proxy_value("socks5://127.0.0.1:1080")
+            .unwrap_err()
+            .contains("SOCKS system proxies are not supported"));
+    }
+
     #[test]
     fn bounded_range_probe_rejects_server_that_expands_to_end() {
         assert_eq!(
@@ -1464,4 +1504,23 @@ mod tests {
         ));
         assert!(!is_retryable_aria2_error("No URI available."));
     }
+
+    #[test]
+    fn aria2_startup_rpc_errors_are_retryable() {
+        assert!(is_aria2_rpc_unavailable(
+            "error trying to connect: tcp connect error: Connection refused"
+        ));
+        assert!(is_aria2_rpc_unavailable(
+            "aria2 did not become ready: connection refused"
+        ));
+        assert!(!is_aria2_rpc_unavailable(
+            "aria2 error code 3: Resource not found"
+        ));
+    }
+
+    #[test]
+    fn aria2_internal_attempts_do_not_multiply_firelink_retry_budget() {
+        assert_eq!(aria2_attempt_limit(Some(0)), 1);
+        assert_eq!(aria2_attempt_limit(Some(10)), 1);
+    }
 }