test(startup): compare v1.3.1 source (#37)

- Issue #37: compare the pre-1.4.0 application source with the current packaged-app stability workflow.\n- Keep the current workflow and 5-second delayed-crash check so the Windows result is comparable.\n\nRefs #37.

.github/workflows/ci.yml

@@ -27,6 +27,7 @@ jobs:
 
   desktop:
     name: Desktop checks (${{ matrix.target }})
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -52,8 +53,28 @@ jobs:
       - name: Install Linux dependencies
         if: runner.os == 'Linux'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
+          # The hosted Ubuntu image can expose an unreachable Azure mirror in
+          # its apt sources while the public Ubuntu archive is reachable.
+          # Normalize every apt source, including the image's mirror list,
+          # before refreshing indexes so a transient runner-local mirror does
+          # not consume the whole job timeout.
+          sudo find /etc/apt -type f \
+            -exec sed -i \
+              -e 's#http://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              -e 's#https://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              {} +
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            update
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            install -y --no-install-recommends \
             libwebkit2gtk-4.1-dev \
             libappindicator3-dev \
             librsvg2-dev \
@@ -65,12 +86,34 @@ jobs:
         if: runner.os != 'Windows'
         working-directory: src-tauri
         run: cargo test --all-targets --target ${{ matrix.target }}
-      - name: Test Rust backend
+      - name: Test Windows Torrent RPC integration
         if: runner.os == 'Windows'
         working-directory: src-tauri
-        run: |
-          cargo test --tests --target ${{ matrix.target }}
-          cargo test --lib --no-run --target ${{ matrix.target }}
+        run: cargo test --test torrent_rpc --target ${{ matrix.target }} -- --nocapture
+      - name: Compile Windows queue-manager integration
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test queue_manager --no-run --target ${{ matrix.target }}
+      - name: Compile Windows Rust library tests
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --lib --no-run --target ${{ matrix.target }}
+      - name: Run Windows headless production contracts
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test production_contract --target ${{ matrix.target }} -- --nocapture
+      - name: Verify Windows atomic Torrent storage
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test atomic_file --target ${{ matrix.target }} -- --nocapture
+      - name: Verify Windows Torrent cache safety
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test torrent_cache --target ${{ matrix.target }} -- --nocapture
+      - name: Verify Windows Torrent web-seed normalization
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test torrent_web_seed --target ${{ matrix.target }} -- --nocapture
       - name: Provision locked engines
         if: runner.os != 'macOS'
         run: node scripts/provision-engines.js --target ${{ matrix.target }}
@@ -78,3 +121,9 @@ jobs:
         run: |
           node scripts/stage-engines.js --target ${{ matrix.target }}
           node scripts/verify-binaries.js --staged --target ${{ matrix.target }}
+      - name: Run Torrent process smoke
+        run: node scripts/smoke-torrent.js --binary src-tauri/engine-dist/${{ matrix.target }}/aria2c-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }} --failure-paths
+      - name: Run Aria2 resolver smoke
+        run: node scripts/smoke-aria2-resolver.js --binary src-tauri/engine-dist/${{ matrix.target }}/aria2c-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
+      - name: Run Aria2 normal-transfer smoke
+        run: node scripts/smoke-aria2-transfers.js --binary src-tauri/engine-dist/${{ matrix.target }}/aria2c-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}

.github/workflows/release.yml

@@ -40,18 +40,50 @@ jobs:
       - uses: actions/checkout@v7
         with:
           submodules: recursive
+          fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
+      - name: Verify tagged release version
+        if: github.event_name == 'push' || inputs.publish_release
+        run: node scripts/verify-release-version.js
+      - name: Verify non-publishing package version
+        if: github.event_name == 'workflow_dispatch' && !inputs.publish_release
+        run: node scripts/verify-release-version.js --allow-untagged
+      - name: Verify tagged Companion release identity
+        if: github.event_name == 'push' || inputs.publish_release
+        run: node scripts/verify-companion-release.js
+      - name: Verify non-publishing Companion package metadata
+        if: github.event_name == 'workflow_dispatch' && !inputs.publish_release
+        run: node scripts/verify-companion-release.js --allow-untagged
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
       - name: Install Linux dependencies
         if: runner.os == 'Linux'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
+          # Hosted Ubuntu images can expose an unreachable Azure mirror in
+          # their apt sources while the public Ubuntu archive is reachable.
+          # Keep release jobs bounded and use the same source normalization as
+          # the native CI path so a runner-local mirror cannot hang packaging.
+          sudo find /etc/apt -type f \
+            -exec sed -i \
+              -e 's#http://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              -e 's#https://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              {} +
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            update
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            install -y \
             libwebkit2gtk-4.1-dev \
             libappindicator3-dev \
             librsvg2-dev \
@@ -88,12 +120,11 @@ jobs:
           mkdir -p "$RUNNER_TEMP/firelink-native-packages/deb" "$RUNNER_TEMP/firelink-native-packages/rpm"
           cp src-tauri/target/${{ matrix.target }}/release/bundle/deb/*.deb "$RUNNER_TEMP/firelink-native-packages/deb/"
           cp src-tauri/target/${{ matrix.target }}/release/bundle/rpm/*.rpm "$RUNNER_TEMP/firelink-native-packages/rpm/"
-      - name: Build Linux AppImage
+      - name: Build Linux AppImage from existing binary
         if: runner.os == 'Linux'
-        run: npm run tauri build -- -vv --target ${{ matrix.target }} --bundles appimage
+        run: node scripts/build-linux-appimage.js --target ${{ matrix.target }}
         env:
           APPIMAGE_EXTRACT_AND_RUN: 1
-          FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE: '1'
       - name: Install pinned appimagetool (Linux only)
         if: runner.os == 'Linux'
         env:
@@ -109,11 +140,25 @@ jobs:
       - name: Verify macOS packaged engines and launch
         if: runner.os == 'macOS'
         run: |
-          APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app"
+          set -euo pipefail
           DMG="$(find src-tauri/target/${{ matrix.target }}/release/bundle/dmg -name '*.dmg' -print -quit)"
           test -n "$DMG"
-          npm run verify:macos-signing -- --app "$APP" --dmg "$DMG"
+          npm run verify:macos-signing -- --dmg "$DMG"
+          MOUNT_POINT="$(mktemp -d "$RUNNER_TEMP/firelink-dmg-mount.XXXXXX")"
+          cleanup() {
+            hdiutil detach "$MOUNT_POINT" -quiet || hdiutil detach "$MOUNT_POINT" -force -quiet || true
+            rmdir "$MOUNT_POINT" 2>/dev/null || true
+          }
+          trap cleanup EXIT
+          hdiutil attach -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$DMG" >/dev/null
+          APP_COUNT="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' | wc -l | tr -d ' ')"
+          test "$APP_COUNT" -eq 1
+          APP="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' -print -quit)"
+          FIRELINK_MACOS_APP="$APP" node scripts/app-associations.node-test.js
           node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }}
+          ARIA2="$(find "$APP" -type f -name 'aria2c-${{ matrix.target }}' -print -quit)"
+          test -n "$ARIA2"
+          node scripts/smoke-aria2-transfers.js --binary "$ARIA2"
           node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
       - name: Verify Windows installer payload and launch
         if: runner.os == 'Windows'
@@ -123,8 +168,61 @@ jobs:
           if (-not $installer) { throw "Windows NSIS installer artifact was not produced." }
           $extractRoot = "$env:RUNNER_TEMP/firelink-installer"
           Remove-Item -Recurse -Force $extractRoot -ErrorAction SilentlyContinue
-          7z x $installer.FullName "-o$extractRoot" -y
+          & 7z x $installer.FullName "-o$extractRoot" -y
+          if ($LASTEXITCODE -ne 0) { throw "7z failed to extract the Windows installer payload (exit code $LASTEXITCODE)." }
           node scripts/verify-binaries.js --search-root "$extractRoot" --target ${{ matrix.target }}
+          $aria2 = Get-ChildItem $extractRoot -Recurse -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Name -ieq "aria2c-${{ matrix.target }}.exe" } |
+            Sort-Object FullName |
+            Select-Object -First 1
+          if (-not $aria2) { throw "Packaged Aria2 executable was not found in the installer payload." }
+          node scripts/smoke-aria2-transfers.js --binary $aria2.FullName
+
+          $portableRoot = "$env:RUNNER_TEMP/firelink-portable-payload"
+          $portableArtifactDir = "$env:RUNNER_TEMP/firelink-portable"
+          Remove-Item -Recurse -Force $portableRoot -ErrorAction SilentlyContinue
+          Remove-Item -Recurse -Force $portableArtifactDir -ErrorAction SilentlyContinue
+          New-Item -ItemType Directory -Path $portableRoot -Force | Out-Null
+          New-Item -ItemType Directory -Path $portableArtifactDir -Force | Out-Null
+          $payloadExe = Get-ChildItem $extractRoot -Recurse -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Name -ieq "firelink.exe" } |
+            Sort-Object FullName |
+            Select-Object -First 1
+          if (-not $payloadExe) { throw "firelink.exe was not found in the extracted installer payload." }
+          Copy-Item (Join-Path $payloadExe.Directory.FullName '*') $portableRoot -Recurse -Force
+          Set-Content -Path (Join-Path $portableRoot 'portable.flag') -Value 'portable' -NoNewline
+          @"
+          Firelink portable
+
+          Extract this folder to a writable location and launch firelink.exe.
+          Close Firelink before copying or moving this folder.
+          Settings, queues, logs, and WebView data are stored under data\.
+          Only one Firelink instance can run at a time; close the installed app before launching this copy.
+          Credentials, browser cookies, and URL query/fragment data are not persisted in portable queue records.
+          Saved site passwords remain in the Windows credential store and are not portable.
+          The portable folder contains the extension pairing credential; treat it as sensitive and do not share it.
+          Saved absolute download locations may need to be selected again after moving to another drive.
+          The portable archive does not register the firelink:// protocol; use the installer for browser launch integration.
+          "@ | Set-Content -Path (Join-Path $portableRoot 'PORTABLE_README.txt')
+          New-Item -ItemType Directory -Path (Join-Path $portableRoot 'data') -Force | Out-Null
+          $portableExe = Join-Path $portableRoot 'firelink.exe'
+          node scripts/verify-binaries.js --search-root "$portableRoot" --target ${{ matrix.target }}
+          node scripts/smoke-packaged-app.js --executable $portableExe --assert-no-visible-child-windows --assert-portable-data
+          Get-ChildItem $portableRoot -Recurse -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Name -match '^(unins|Uninstall).*\.exe$' } |
+            Remove-Item -Force -ErrorAction SilentlyContinue
+          $portableDataDir = Join-Path $portableRoot 'data'
+          for ($attempt = 1; $attempt -le 10; $attempt++) {
+            Remove-Item -Recurse -Force $portableDataDir -ErrorAction SilentlyContinue
+            if (-not (Test-Path $portableDataDir)) { break }
+            Start-Sleep -Milliseconds (200 * $attempt)
+          }
+          if (Test-Path $portableDataDir) {
+            throw "Portable test data could not be removed after smoke; refusing to package a ZIP containing runtime data."
+          }
+          $portableZip = "$portableArtifactDir/Firelink_${{ github.ref_name }}_Windows-x64-portable.zip"
+          7z a -tzip $portableZip "$portableRoot\*" -y
+
           $installRoot = "$env:RUNNER_TEMP\FirelinkSmoke"
           Remove-Item -Recurse -Force $installRoot -ErrorAction SilentlyContinue
           $install = Start-Process -FilePath $installer.FullName -ArgumentList @("/S", "/D=$installRoot") -Wait -PassThru
@@ -144,6 +242,9 @@ jobs:
           chmod +x "$APPIMAGE"
           (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/$APPIMAGE" --appimage-extract >/dev/null)
           node scripts/verify-binaries.js --search-root "$RUNNER_TEMP/squashfs-root" --target ${{ matrix.target }}
+          ARIA2="$(find "$RUNNER_TEMP/squashfs-root" -type f -name 'aria2c-${{ matrix.target }}' -print -quit)"
+          test -n "$ARIA2"
+          node scripts/smoke-aria2-transfers.js --binary "$ARIA2"
           xvfb-run -a node scripts/smoke-packaged-app.js --executable "$RUNNER_TEMP/squashfs-root/AppRun"
       - uses: actions/upload-artifact@v7
         with:
@@ -151,6 +252,13 @@ jobs:
           path: ${{ matrix.artifact }}
           if-no-files-found: error
           retention-days: 3
+      - uses: actions/upload-artifact@v7
+        if: runner.os == 'Windows'
+        with:
+          name: Firelink-Windows-x64-portable-${{ github.ref_name }}
+          path: ${{ runner.temp }}/firelink-portable/*.zip
+          if-no-files-found: error
+          retention-days: 3
       - uses: actions/upload-artifact@v7
         if: runner.os == 'Linux'
         with:
@@ -196,11 +304,12 @@ jobs:
             local pattern="$1"
             local destination="$2"
             local source
-            source="$(find release-assets -maxdepth 1 -type f -name "$pattern" -print -quit)"
-            if [[ -z "$source" ]]; then
-              echo "::error::Missing release asset matching $pattern"
+            mapfile -d '' -t matches < <(find release-assets -maxdepth 1 -type f -name "$pattern" -print0)
+            if (( ${#matches[@]} != 1 )); then
+              echo "::error::Expected exactly one release asset matching $pattern, found ${#matches[@]}"
               exit 1
             fi
+            source="${matches[0]}"
             mv "$source" "release-assets/$destination"
           }
 
@@ -209,6 +318,7 @@ jobs:
           rename_asset '*.deb' "Firelink_${VERSION}_Linux-x64.deb"
           rename_asset '*.rpm' "Firelink_${VERSION}_Linux-x64.rpm"
           rename_asset '*.exe' "Firelink_${VERSION}_Windows-x64-setup.exe"
+          rename_asset '*.zip' "Firelink_${VERSION}_Windows-x64-portable.zip"
       - name: Generate checksums
         run: |
           cd release-assets

.gitignore

@@ -11,15 +11,24 @@ skills-lock.json
 # Local agent and planning notes
 AGENT.md
 AGENTS.md
+TORRENT_FEATURES.md
+torrent_features.md
+TORRENT_UI_IMPLEMENTATION_PLAN.md
 CLAUDE.md
 GEMINI.md
 implementation_plan.md
 CROSS_PLATFORM_CHECKLIST.md
 Cross-platform-checklist-gemini.MD
+ARIA2_AVERAGE_USER_AUDIT.md
 YouTube_media_download_handoff.md
 Release_checklist.md
+Release Checklist/
+RC Read-only/
+RC Read_only/
 
 # Frontend output and logs
+.agents/
+release_notes.md
 node_modules/
 dist/
 dist-ssr/
@@ -56,6 +65,7 @@ build/
 # Local secrets and signing material
 .env
 .env.*
+implementation_plan.md
 *.key
 *.pem
 !src-tauri/binaries/_internal/certifi/cacert.pem

CHANGELOG.md

@@ -5,6 +5,172 @@ All notable changes to Firelink will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.0] - 2026-08-27
+
+This release adds built-in Torrent downloads and a dedicated Properties window, while making regular downloads, browser handoffs, and cross-platform packages more dependable.
+
+### New features
+
+- **Torrent downloads**
+  - Add `.torrent` files and magnet links from the Add window, file associations, `magnet:` links, and Firelink Companion.
+  - Resolve remote metadata before enqueueing and safely reuse validated Torrent metadata.
+  - Select files, prioritize pieces, preallocate or allocate as needed, verify existing data, remove unselected files safely, and add per-file web seeds.
+  - Manage trackers and exclusions, tracker timing, DHT/IPv6/PEX/LPD discovery, encryption, peer limits, network identity, and resource limits.
+  - View file progress, piece availability, connected and listed peers, seeders, upload totals and speed, and the info hash.
+  - Set upload limits, seed time or ratio, stop timeout, concurrent seed slots, and move Torrent data to a new location.
+  - Use a dedicated Torrents category with pause, resume, retry, redownload, and safe cleanup.
+- **Download and Torrent Properties windows**
+  - Open a selected download in its own window with overview, transfer, and advanced controls.
+  - Use Torrent tabs for file selection, trackers, peers, options, and live diagnostics.
+  - Edit supported settings while a transfer is active, including speed, connections, Torrent upload and peer limits, seeding, verification, allocation, and encryption.
+  - Inspect allocation, exact progress, resume failures, destinations, and current diagnostics; copy long URLs or paths and export magnet links where available.
+  - Keep the window size during the app session while the window follows the current theme and locale.
+- **Adaptive mirror selection**
+  - Optionally use recent transfer performance to choose among multiple mirrors. Mirror statistics stay private on this device.
+- **Transfer and layout visibility**
+  - Show the file-allocation phase while a normal download prepares its destination.
+  - Remember the main-window size and position and the Folders collapse preference between launches.
+
+### Improvements
+
+- Improve normal-download recovery across restarts, stale transfers, redirects, mirrors, connection-pool slowdowns, retries, and resume operations without saved credentials.
+- Improve media recovery and resume messaging, preserve exact progress at the end of a transfer, and restore adaptive YouTube formats. This responds to the interrupted-YouTube-download report in [#36](https://github.com/nimbold/Firelink/issues/36).
+- Make browser and deep-link inputs arrive in order, keep magnet clipboard handoffs usable, and make Add-window destination and metadata validation clearer.
+- Improve the download table, sidebar, Add window, Settings, RTL keyboard navigation, and accessibility behavior at narrow window sizes.
+- Add clear guidance for the macOS first-launch security warning and safe approval steps, responding to [#34](https://github.com/nimbold/Firelink/issues/34).
+- Refresh bundled engines and dependencies, resume interrupted engine downloads safely, and strengthen package, release, and cross-platform verification.
+
+### Fixes
+
+- Retry affected transfers through the system resolver when a VPN or network tunnel leaves aria2 unable to resolve a host, addressing [#35](https://github.com/nimbold/Firelink/issues/35).
+- Prevent late or duplicate lifecycle events from reviving, removing, or misreporting a download after a newer action has already won.
+- Keep replacement, removal, and pre-admission cleanup from leaving stale queue entries, partial files, or misleading progress behind.
+- Keep completed, paused, failed, and retrying downloads authoritative while allocation and progress updates arrive asynchronously.
+- Make scheduled actions, speed limits, logs, persisted settings, and browser credentials safer when several changes happen close together.
+
+### Compatibility
+
+- Use [Firelink Companion `2.2.0`](https://github.com/nimbold/Firelink-Extension/releases/tag/v2.2.0), or the [latest Companion release](https://github.com/nimbold/Firelink-Extension/releases/latest), with Firelink `1.4.0`.
+
+## [1.3.1] - 2026-07-30
+
+This hotfix improves filename handling, localized display details, and release reliability across platforms.
+
+### Fixes
+
+- Prevent filename errors for long downloads and Windows-reserved names such as `CON` and `COM1`. Names are shortened safely while keeping their file extensions, addressing [#29](https://github.com/nimbold/Firelink/issues/29).
+- Correct Persian date formatting in affected settings and timezone cases, while preserving Hebrew locale formatting.
+- Fix remaining light-theme overlay and contrast details reported with the broader appearance and localization work in [#31](https://github.com/nimbold/Firelink/issues/31).
+
+### Improvements
+
+- Make Linux AppImage packaging more reliable and avoid compiling the same Rust release binary twice.
+- Strengthen cross-platform release checks so Windows and Linux test builds handle macOS-only code correctly.
+
+### Compatibility
+
+- Firelink Companion `2.1.0` remains the current compatible extension. No extension update is required for this hotfix; use the [latest Companion release](https://github.com/nimbold/Firelink-Extension/releases/latest).
+
+## [1.3.0] - 2026-07-29
+
+This release focuses on smoother queue control, a more comfortable interface, and safer recovery when downloads or browser handoffs are interrupted.
+
+### New features
+
+- **Live speed limits and connection controls** can be adjusted while a download is active.
+- **Queue reordering and bulk actions** are easier to use, with paused downloads kept behind work that is ready to run.
+- **Appearance preferences** now include a Windows 11-style option, sidebar-aware window controls, curated fonts for supported languages, and optional localized calendar dates. These improvements respond to [#31](https://github.com/nimbold/Firelink/issues/31).
+- **Firelink Companion `2.1.0`** is included in the `Extensions/Browser` submodule. Get the latest extension from the [Firelink-Extension releases](https://github.com/nimbold/Firelink-Extension/releases/latest).
+
+### Improvements
+
+- Resume, retry, pause, and redownload actions now recover more reliably when an earlier attempt has disappeared or a background event arrives late, addressing the failed-resume report in [#28](https://github.com/nimbold/Firelink/issues/28).
+- Browser captures recover more safely when Firelink is starting, the extension restarts, or capture settings change during handoff. Captures remain in the Add window for review.
+- macOS minimize and Dock, Spotlight, and Raycast reopen behavior are more consistent, addressing [#30](https://github.com/nimbold/Firelink/issues/30).
+- The downloads table stays readable at narrow widths: row actions remain contained, columns resize consistently, and controls no longer cover Date Added text, addressing [#32](https://github.com/nimbold/Firelink/issues/32).
+- Add-window metadata, duplicate resolution, playlist selection, floating menus, page navigation, and table interactions provide clearer feedback and better keyboard behavior.
+- Startup consent and keychain access are more predictable, with clearer permission feedback and safer modal focus.
+
+### Fixes
+
+- Prevent stale pause, resume, retry, completion, and remove actions from reviving a download, reporting the wrong result, or leaving a row stuck in a misleading state.
+- Keep queue limits, connection recovery, missing completion events, and retry cleanup from leaving downloads stranded or exceeding the user’s settings.
+- Keep paused work behind pending downloads and make queue controls behave correctly when several actions happen close together.
+- Automatically shorten media filenames that exceed the cross-platform per-file-name limit, addressing [#29](https://github.com/nimbold/Firelink/issues/29).
+- Refresh dependencies and bundled engines, and strengthen release, package, portable-mode, and cross-platform verification.
+
+## [1.2.0] - 2026-07-22
+
+This release makes everyday download management easier to organize, review, and trust across the desktop app and browser extension.
+
+### New features
+
+- **Localized desktop interface** for Persian, Hebrew, Russian, Ukrainian, and Simplified Chinese, responding to the Chinese-language request in [#17](https://github.com/nimbold/Firelink/issues/17). These translations are currently produced with help from LLMs and need user review; please report corrections so they can improve.
+- **Customizable download table** with selectable columns, drag-to-reorder controls, sorting, clearer size alignment, and better bulk actions.
+- **Optional batch folders** for multi-link downloads, addressing [#27](https://github.com/nimbold/Firelink/issues/27). Firelink can suggest an editable folder name from the page title or common filename while keeping the existing category-based behavior as the default.
+- **Remember the last Add-window directory**, with an opt-in setting so users remain in control of where it applies, addressing [#23](https://github.com/nimbold/Firelink/issues/23).
+- **Per-download connection controls** for normal and media transfers, with the active aria2 connection count shown in the download table. This also follows the connection-setting report in [#20](https://github.com/nimbold/Firelink/issues/20).
+- **Latest Firelink Companion 2.0.6** in the `Extensions/Browser` submodule, including selected-link batch context and safer automatic capture recovery.
+
+### Improvements
+
+- Make pause, resume, retry, remove, redownload, queue, scheduler, and settings actions safer when several operations overlap or background events arrive late.
+- Reuse unfinished downloads when their filenames match, addressing [#26](https://github.com/nimbold/Firelink/issues/26), while reducing the chance of stale state creating duplicate or misleading rows.
+- Improve first-open navigation, lazy page loading, table layout, drag interactions, sorting, and window-control placement.
+- Improve RTL behavior while keeping the download table's physical file columns readable.
+- Handle locked browser cookie databases more gracefully and keep browser metadata and authenticated captures on the correct path, addressing the media reports in [#22](https://github.com/nimbold/Firelink/issues/22) and [#24](https://github.com/nimbold/Firelink/issues/24).
+- Enforce startup consent before accessing saved credentials and make keychain-related startup behavior more predictable.
+- Refresh dependencies and bundled engines, and strengthen checks for macOS, Windows portable, Linux packages, release assets, and release version identity.
+- Refine localized wording, including Persian status labels.
+
+### Fixes
+
+- Prevent stale lifecycle work, duplicate terminal events, and overlapping controls from deleting, reviving, or leaving the wrong download in a misleading state.
+- Keep missed completion events and connection-limit updates from leaving a finished or active download visually stuck.
+- Bound backend connection counts so user-selected limits are respected instead of allowing overlapping settings to exceed them.
+- Keep extension handoffs in the Add window and make selected-link batches retain their page context for folder suggestions.
+
+## [1.1.1] - 2026-07-17
+
+This patch release focuses on transfer reliability, browser captures, and easier download control.
+
+### New
+- Add YouTube playlist downloads with smoother queueing and scrolling for large playlists.
+- Add live per-download connection controls, clipboard capture for the Add window, and byte-level progress updates.
+
+### Improved
+- Recover slow or stalled transfers more reliably and apply connection defaults consistently, addressing [#19](https://github.com/nimbold/Firelink/issues/19) and [#20](https://github.com/nimbold/Firelink/issues/20).
+- Make pause, resume, retry, cancel, remove, and completion handling more consistent when actions or background events overlap.
+- Improve playlist state, media size estimates, and large-list performance.
+- Keep clipboard, browser, and deep-link handoffs behind the startup consent explanation, and make that boundary clearer.
+- Refresh bundled engines and dependencies while strengthening cross-platform package and diagnostic checks.
+
+### Fixed
+- Fix Gmail and other authenticated browser downloads that could lose their filename or save a sign-in page after a redirect, including Chrome Incognito, addressing [#21](https://github.com/nimbold/Firelink/issues/21).
+- Keep browser-capture metadata, cookies, and destinations tied to the correct download through redirects.
+- Prevent invalid URLs, late download events, stale progress, and abandoned media work from creating misleading rows or leftover temporary files.
+- Keep sensitive local paths, credentials, and persisted records protected in errors, diagnostics, and download state.
+
+## [1.1.0] - 2026-07-15
+
+This is a stability-focused release with safer downloads, browser handoffs, settings, and cross-platform packages.
+
+### New
+- Add a secure Windows portable ZIP, addressing the portable-version request in [#15](https://github.com/nimbold/Firelink/issues/15). Settings, queues, logs, and WebView data stay with the portable folder, while saved site passwords remain protected in Windows Credential Manager.
+
+### Improved
+- Make pause, resume, retry, remove, redownload, and queue actions reliable when several operations happen close together. Downloads now recover their state more consistently instead of restarting unexpectedly or appearing stuck after completion.
+- Make browser captures and the Add window safer and more dependable. Captured cookies are no longer sent to metadata checks unless authentication is actually needed, while ordinary downloads still keep the browser session they need. This resolves the fallback error reported in [#16](https://github.com/nimbold/Firelink/issues/16).
+- Improve settings and startup behavior: speed-limit units stay consistent, saved settings are handled more safely, and credential-store access waits until it is needed.
+- Improve browser handoff safety with stronger local request, replay, path, and credential checks.
+- Strengthen macOS, Windows, and Linux release verification, refresh the bundled FFmpeg payload, and make package and diagnostic checks more reliable.
+
+### Fixed
+- Prevent late or duplicate background events from bringing back downloads after a newer pause, remove, or edit action has already won.
+- Reconcile completed downloads even when a background completion event is missed, so finished files do not remain visually stuck at the end of the transfer.
+- Decode URL-derived filenames so links containing encoded characters such as `%20` produce readable names, addressing [#18](https://github.com/nimbold/Firelink/issues/18).
+- Keep local paths, usernames, credentials, and other sensitive values out of errors and diagnostic output where they are not needed.
+
 ## [1.0.4] - 2026-07-12
 
 ### New

README.md

@@ -1,101 +1,114 @@
-<div align="center">
-  <img src="src/assets/app-icon.png" alt="Firelink" width="112" height="112" />
+<p align="center">
+  <img src="src/assets/app-icon.png" alt="Firelink app icon" width="128" height="128" />
+</p>
 
-  # Firelink
+# Firelink
 
-  **A fast, focused desktop download manager for macOS, Windows, and Linux.**
+> A fast, focused desktop download manager for macOS, Windows, and Linux.
 
-  [![Version](https://img.shields.io/badge/version-1.0.4-6f42c1?style=flat-square)](https://github.com/nimbold/Firelink/releases)
-  [![macOS](https://img.shields.io/badge/macOS-111111?style=flat-square&logo=apple&logoColor=white)](#platforms)
-  [![Windows](.github/badges/windows.svg)](#platforms)
-  [![Linux](https://img.shields.io/badge/Linux-FCC624?style=flat-square&logo=linux&logoColor=black)](#platforms)
-  [![License](https://img.shields.io/github/license/nimbold/Firelink?style=flat-square)](LICENSE)
-  [![CI](https://img.shields.io/github/actions/workflow/status/nimbold/Firelink/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/nimbold/Firelink/actions/workflows/ci.yml)
+[![Latest release](https://img.shields.io/github/v/release/nimbold/Firelink?style=flat-square)](https://github.com/nimbold/Firelink/releases/latest)
+[![CI](https://img.shields.io/github/actions/workflow/status/nimbold/Firelink/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/nimbold/Firelink/actions/workflows/ci.yml)
+[![License](https://img.shields.io/github/license/nimbold/Firelink?style=flat-square)](LICENSE)
+[![macOS](https://img.shields.io/badge/macOS-Apple%20silicon-111111?style=flat-square&logo=apple&logoColor=white)](#installation)
+[![Windows](.github/badges/windows.svg)](#installation)
+[![Linux](https://img.shields.io/badge/Linux-x64-FCC624?style=flat-square&logo=linux&logoColor=black)](#installation)
 
-  [Features](#features) · [Install](#installation) · [Browser Extension](#browser-extension) · [Development](#development) · [Release Notes](CHANGELOG.md)
-</div>
-
-<br/>
-
-<div align="center">
+<p align="center">
   <img src="Screenshots/Dark%20theme%20-%20main.png" width="24%" alt="Firelink dark theme main window" />
   <img src="Screenshots/Dark%20theme%20-%20add%20window.png" width="24%" alt="Firelink dark theme add window" />
   <img src="Screenshots/Light%20theme%20-%20main.png" width="24%" alt="Firelink light theme main window" />
   <img src="Screenshots/Light%20theme%20-%20add%20window.png" width="24%" alt="Firelink light theme add window" />
+</p>
 
-  <details>
-    <summary><b>View more screenshots</b></summary>
-    <br/>
-    <img src="Screenshots/Dark%20theme%20-%20settings.png" width="32%" alt="Firelink dark theme settings" />
-    <img src="Screenshots/Light%20theme%20-%20settings.png" width="32%" alt="Firelink light theme settings" />
-  </details>
-</div>
+## What is Firelink?
 
-## Why Firelink
+Firelink manages direct downloads, browser captures, media, playlists, queues, and scheduling from one desktop app.
 
-Firelink is a desktop download manager for fast transfers, browser capture, media extraction, scheduling, and clear file placement.
+It uses a Rust and Tauri backend with a React and TypeScript interface. Required download and media engines are bundled with the app.
 
-It is now a cross-platform Rust/Tauri app with a React and TypeScript interface. A native backend coordinates downloads with aria2, yt-dlp, FFmpeg, Deno, and SQLite.
+## Status
 
-The current desktop release is **1.0.4**, paired with Firelink Companion **2.0.3**.
+Firelink `1.4.0` is the latest desktop release.
+
+Use [the latest Firelink Companion release, `2.2.0`](https://github.com/nimbold/Firelink-Extension/releases/tag/v2.2.0) with Firelink. The Companion is maintained in the [Firelink-Extension repository](https://github.com/nimbold/Firelink-Extension).
+
+The project is actively maintained. See the [changelog](CHANGELOG.md) for release history and current work.
+
+Translations are available for English, Simplified Chinese, Hebrew, Persian, Ukrainian, and Russian. Translation corrections are welcome.
 
 ## Features
 
-- **Segmented downloads** with aria2, retries, speed limits, and connection controls.
-- **Media downloads** with yt-dlp, FFmpeg, Deno, live progress, speed, and ETA.
-- **Add window** for metadata, duplicates, location choices, captured links, and clipboard-prefilled URLs.
-- **Persistent queues** with pause, resume, retry, redownload, sorting, multi-select, and bulk actions.
-- **Scheduling** with start/stop windows, speed rules, and post-queue actions.
-- **File organization** with categories, default folders, a collapsible Folders section, per-download overrides, and reveal/trash actions.
-- **Browser handoff** through local pairing, signed requests, Add window review, replay protection, and server checks.
-- **Desktop integration** with tray controls, notifications, sounds, sleep prevention, and secure credential storage.
-- **Diagnostics** with engine health checks, structured logs, and package verification.
+- Segmented HTTP and HTTPS downloads with retries, speed limits, and connection controls.
+- Media and playlist downloads through yt-dlp, FFmpeg, and Deno.
+- BitTorrent downloads from `.torrent` files, magnet links, and browser handoff, with file selection, web seeds, seeding, and live diagnostics.
+- Standalone Download and Torrent Properties windows with live controls, transfer details, and safe Torrent relocation.
+- Adaptive mirror selection for multi-source downloads.
+- An Add window for metadata, duplicate handling, save locations, and download options.
+- Persistent queues with pause, resume, retry, redownload, and scheduling.
+- Visible allocation and resume status with clearer transfer diagnostics.
+- Live speed and connection controls for active downloads.
+- A customizable download table with sorting, column selection, reordering, and bulk actions.
+- File organization with categories, default folders, and per-download locations.
+- Appearance preferences with window styles, multilingual fonts, and localized calendar dates.
+- Browser handoff through local pairing and signed requests.
+- Tray controls, notifications, sounds, sleep prevention, and secure credential storage.
+- RTL support for Hebrew and Persian.
 
 ## Installation
 
-Download desktop builds from [GitHub Releases](https://github.com/nimbold/Firelink/releases).
+Download the [latest Firelink release](https://github.com/nimbold/Firelink/releases/latest).
 
 | Platform | Package | Notes |
 | --- | --- | --- |
-| **macOS Apple silicon** | `.dmg` | Not notarized. If macOS blocks the first launch, approve Firelink in **System Settings -> Privacy & Security**. |
-| **Windows x64** | NSIS `.exe` installer | Unsigned. Windows SmartScreen may warn until code signing is added. |
-| **Linux x64** | `.deb`, `.rpm`, or `.AppImage` | Use `.deb` for Debian-family systems, `.rpm` for Fedora/RPM-family systems, or AppImage as the portable fallback. AppImage may need executable permission. |
+| macOS Apple silicon | `.dmg` | Ad-hoc signed and not notarized. macOS may require approval in **System Settings -> Privacy & Security**. |
+| Windows x64 | NSIS `.exe` | Unsigned. Windows SmartScreen may display a warning. |
+| Windows x64 portable | `.zip` | Extract to a writable folder and launch `firelink.exe`. |
+| Linux x64 | `.deb`, `.rpm`, or `.AppImage` | Choose the package for your distribution, or use AppImage. |
 
-Bundles include the required engines. Users do not need aria2, yt-dlp, FFmpeg, Deno, Python, Homebrew, or another package manager.
+All packages include aria2, yt-dlp, FFmpeg, Deno, and SQLite support. No separate engine installation is required.
 
-The native packages use the distribution's normal desktop runtime dependencies, while AppImage remains the portable installation option.
+<details>
+<summary><strong>macOS security warning and first launch</strong></summary>
 
-## Browser Extension
+Firelink's macOS release is ad-hoc signed but not notarized by Apple. A paid Apple Developer Program account is required for Apple's Developer ID signing and notarization, so macOS may warn that it cannot verify Firelink or check that it is free of malware. This warning does not by itself mean that the app contains malware.
 
-<p align="center">
-  <a href="https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/"><img src="https://img.shields.io/badge/Install%20from-Firefox%20Add--ons-FF7139?style=for-the-badge&logo=firefox-browser&logoColor=white" alt="Install Firelink Companion from Firefox Add-ons" /></a>
-  &nbsp;&nbsp;
-  <a href="https://github.com/nimbold/Firelink-Extension#manual-chromium-installation"><img src="https://img.shields.io/badge/Manual%20install-Chromium-4285F4?style=for-the-badge&logo=googlechrome&logoColor=white" alt="Read manual Chromium install instructions" /></a>
+Only use these steps for Firelink downloaded from the [official GitHub release page](https://github.com/nimbold/Firelink/releases/latest). After moving `Firelink.app` to Applications, use one of these methods to approve the first launch:
+
+1. In Finder, Control-click or right-click `Firelink.app`, choose **Open**, then choose **Open** again.
+2. Try opening Firelink once, then open **System Settings -> Privacy & Security**, scroll down, and choose **Open Anyway** for Firelink.
+3. In Terminal, remove only the downloaded-file quarantine flag:
+
+   ```bash
+   xattr -dr com.apple.quarantine /Applications/Firelink.app
+   ```
+
+   If Firelink is stored somewhere else, replace the path with the actual path to `Firelink.app`. The approval is normally needed only once.
+
+</details>
+
+<details>
+<summary><strong>Windows portable ZIP notes</strong></summary>
+
+- Keep the folder writable. Avoid `Program Files` and read-only media.
+- Settings, queues, logs, and WebView data are stored beside the executable in `data/`.
+- Close Firelink before moving or copying the folder.
+- Treat the folder as sensitive because it contains the extension pairing credential.
+- The installer remains the supported path for `firelink://` browser launch registration.
+
+</details>
+
+## Browser integration
+
+[Firelink Companion `2.2.0`](https://github.com/nimbold/Firelink-Extension/releases/tag/v2.2.0) connects browser downloads, links, media pages, magnets, and Torrent metadata to Firelink. Use the [latest Companion release](https://github.com/nimbold/Firelink-Extension/releases/latest) with the [latest Firelink release](https://github.com/nimbold/Firelink/releases/latest).
+
+Captured links open Firelink's Add window for review before they are started or queued.
+
+<p>
+  <a href="https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/"><img src="https://img.shields.io/badge/Install%20from-Firefox%20Add--ons-FF7139?style=for-the-badge&logo=firefox-browser&logoColor=white" alt="Install from Firefox Add-ons" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/nimbold/Firelink-Extension#manual-chromium-installation"><img src="https://img.shields.io/badge/Manual%20install-Chromium-4285F4?style=for-the-badge&logo=googlechrome&logoColor=white" alt="Manual install for Chromium browsers" /></a>
 </p>
 
-Firelink Companion sends browser links and downloads to the desktop app.
-
-What it adds:
-
-- Automatic capture for regular browser downloads.
-- Explicit Fetch media actions from the popup and page context menu.
-- Context-menu actions for links and selected text.
-- Firefox and Chromium support.
-- Signed local requests using the token from **Settings -> Integrations**.
-- Fallback to the browser download when Firelink is closed or rejects a handoff.
-- Captured links always open Firelink's Add window before anything is added to the download list.
-
-Install the extension, open Firelink, then pair it from **Settings -> Integrations**. Firefox users can install from Mozilla Add-ons. Chromium users can use the [manual load-unpacked flow](https://github.com/nimbold/Firelink-Extension#manual-chromium-installation) with `firelink-chromium.zip` from the [extension releases](https://github.com/nimbold/Firelink-Extension/releases). Firelink Companion 2.0.3 is the matching extension release for Firelink 1.0.4.
-
-The extension lives in [Firelink-Extension](https://github.com/nimbold/Firelink-Extension). This repo also vendors it as the `Extensions/Browser` submodule.
-
-## Platforms
-
-| Target | Status |
-| --- | --- |
-| **macOS arm64** | Supported. Native build, engine checks, launch smoke test, ad-hoc-signed DMG workflow. |
-| **Windows x64** | Supported. Native build, engine checks, silent installer smoke test, NSIS installer. |
-| **Linux x64** | Supported. Native build, bundled-engine checks, package/AppImage launch smoke tests, `.deb`, `.rpm`, and AppImage. |
+See the [Companion README](https://github.com/nimbold/Firelink-Extension#readme) for browser installation, pairing, and privacy details.
 
 ## Development
 
@@ -106,73 +119,50 @@ The extension lives in [Firelink-Extension](https://github.com/nimbold/Firelink-
 - Rust and Cargo
 - [Tauri 2 platform prerequisites](https://v2.tauri.app/start/prerequisites/)
 
-Clone the repository with its browser-extension submodule:
+### Quick start
 
 ```sh
 git clone --recurse-submodules https://github.com/nimbold/Firelink.git
 cd Firelink
-```
-
-Install dependencies and launch the desktop app:
-
-```sh
 npm install
 npm run tauri dev
 ```
 
-Run the core checks:
+Run the main checks with:
 
 ```sh
 node --test scripts/*.node-test.js
 npm test -- --run
 npm run build
-cd src-tauri
-cargo test --all-targets
+cd src-tauri && cargo test --all-targets
 ```
 
-Create a production bundle:
+See [RELEASE.md](RELEASE.md) for engine provisioning, packaging, and release verification.
 
-```sh
-npm run tauri build
-```
+## Contributing and support
 
-macOS uses locked payloads in `src-tauri/binaries`. Provision Windows and Linux payloads from checksum-pinned archives:
-
-```sh
-node scripts/provision-engines.js --target x86_64-pc-windows-msvc
-node scripts/provision-engines.js --target x86_64-unknown-linux-gnu
-```
-
-Build staging includes only the current target. See `engines.lock.json`, `engine-sources.lock.json`, and [RELEASE.md](RELEASE.md).
-
-## Repository Structure
-
-```text
-.
-├── src/                  React and TypeScript interface
-├── src-tauri/            Rust backend, Tauri config, and native tests
-├── scripts/              Engine provisioning, release, and smoke-test tooling
-└── Extensions/Browser/   Firelink Companion submodule
-```
-
-## Help and Project Status
-
-- Report bugs or request improvements in [GitHub Issues](https://github.com/nimbold/Firelink/issues).
+- Report bugs and request features in [GitHub Issues](https://github.com/nimbold/Firelink/issues).
+- Open focused pull requests with tests for behavior changes.
+- Report translation corrections in an issue or pull request.
 - Read [CHANGELOG.md](CHANGELOG.md) for release history.
-- Review [RELEASE.md](RELEASE.md) for packaging policy and release verification.
 
-## Technology & Credits
+## Credits
 
-Firelink is made possible by these open-source projects:
+Core technologies:
 
-- **[Tauri 2](https://tauri.app/)** for the lightweight desktop runtime
-- **[Rust](https://www.rust-lang.org/)** and **[Tokio](https://tokio.rs/)** for native application logic
-- **[React](https://react.dev/)** and **[TypeScript](https://www.typescriptlang.org/)** for the interface
-- **[Zustand](https://zustand-demo.pmnd.rs/)** for frontend state management
-- **[SQLite](https://www.sqlite.org/)** for persistent local data
-- **[aria2](https://aria2.github.io/)** for segmented downloading
-- **[yt-dlp](https://github.com/yt-dlp/yt-dlp)**, **[FFmpeg](https://ffmpeg.org/)**, and **[Deno](https://deno.com/)** for media extraction and processing
+- [Tauri 2](https://v2.tauri.app/), [Rust](https://www.rust-lang.org/), [Tokio](https://tokio.rs/)
+- [React](https://react.dev/), [TypeScript](https://www.typescriptlang.org/), [Zustand](https://zustand-demo.pmnd.rs/)
+- [SQLite](https://www.sqlite.org/)
+
+Bundled engines:
+
+- [aria2](https://aria2.github.io/)
+- [yt-dlp](https://github.com/yt-dlp/yt-dlp)
+- [FFmpeg](https://ffmpeg.org/)
+- [Deno](https://deno.com/)
+
+Font licenses, engine versions, source references, and third-party notices are documented in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
 
 ## License
 
-Firelink is available under the [MIT License](LICENSE).
+Firelink is available under the [MIT License](LICENSE). Bundled tools and fonts retain their own licenses.

RELEASE.md

@@ -4,13 +4,14 @@ Targets:
 
 - macOS arm64 DMG
 - Windows x64 NSIS installer
+- Windows x64 portable ZIP
 - Linux x64 AppImage
 - Linux x64 Debian package
 - Linux x64 RPM package
 
 ## Distribution policy
 
-Firelink does not use an Apple Developer account. macOS releases are unsigned and not notarized. Users must explicitly approve the downloaded app through Finder or macOS Privacy & Security. Release copy must never describe these builds as signed, notarized, or Gatekeeper-approved.
+Firelink does not use an Apple Developer account. macOS releases are ad-hoc signed but not notarized or Gatekeeper-approved. Users may still need to explicitly approve the downloaded app through Finder or macOS Privacy & Security. Release copy must not describe these builds as Developer ID signed, notarized, or Gatekeeper-approved.
 
 Windows releases are currently unsigned. SmartScreen may warn until code signing is added.
 
@@ -24,7 +25,7 @@ Firelink never falls back to system-installed media tools.
 - `scripts/stage-engines.js` creates one target-specific bundle payload.
 - `scripts/verify-binaries.js` runs architecture, packaging, version, and RPC checks.
 
-Linux `.deb` and `.rpm` packages are built with the complete verified engine payload. The AppImage is built separately with the engine payload temporarily omitted, then repacked from the verified payload because the AppImage tooling can rewrite bundled native binaries.
+Linux `.deb` and `.rpm` packages are built with the complete verified engine payload. The AppImage is bundled separately with the engine resource excluded from the initial Linux packaging pass, then repacked from the verified payload because the AppImage tooling can rewrite bundled native binaries.
 
 yt-dlp must remain its official PyInstaller **onedir** distribution: launcher plus adjacent `_internal` runtime. Onefile builds are rejected because repeated extraction caused roughly 17-second startup latency.
 
@@ -49,18 +50,39 @@ cd ..
 npm run tauri build -- --target aarch64-apple-darwin --bundles dmg
 ```
 
-Verify packaged resources, then launch outside repository working directory:
+Verify the DMG and the app it contains, then launch outside the repository
+working directory. The DMG bundler removes the intermediate app directory, so
+the post-build checks must use the mounted release artifact:
 
 ```bash
-APP="src-tauri/target/aarch64-apple-darwin/release/bundle/macos/Firelink.app"
+DMG="$(find src-tauri/target/aarch64-apple-darwin/release/bundle/dmg -name '*.dmg' -print -quit)"
+test -n "$DMG"
+npm run verify:macos-signing -- --dmg "$DMG"
+MOUNT_POINT="$(mktemp -d -t firelink-dmg)"
+cleanup() {
+  hdiutil detach "$MOUNT_POINT" -quiet || hdiutil detach "$MOUNT_POINT" -force -quiet || true
+  rmdir "$MOUNT_POINT" 2>/dev/null || true
+}
+trap cleanup EXIT
+hdiutil attach -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$DMG" >/dev/null
+APP_COUNT="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' | wc -l | tr -d ' ')"
+test "$APP_COUNT" -eq 1
+APP="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' -print -quit)"
 node scripts/verify-binaries.js --search-root "$APP" --target aarch64-apple-darwin
 node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
 ```
 
-GitHub release publication is intentionally manual. Tag pushes build and upload
-artifacts, but the `publish` job only runs from a `workflow_dispatch` on a `v*`
-tag when both release-certification inputs are checked after Windows, Linux,
-and macOS clean-machine QA.
+GitHub release publication follows `.github/workflows/release.yml`. A `v*` tag
+push builds, verifies, and publishes the GitHub release after the platform jobs
+pass. A `workflow_dispatch` on a `v*` tag also publishes when its
+`publish_release` input is enabled. The current workflow has no separate
+release-certification inputs; clean-machine QA remains a release-owner gate
+before pushing the tag.
+
+For paired releases, publish and verify the Companion release first. The
+desktop release workflow requires `Extensions/Browser` to be at a clean commit
+whose exact tag matches both the Companion `package.json` and `manifest.json`
+versions before building desktop packages.
 
 ## Automated release builds
 
@@ -73,7 +95,6 @@ git push origin v<version>
 
 GitHub Actions builds all targets on native runners, verifies engines inside
 final package contents, performs packaged launch smoke where supported, and
-uploads artifacts. Publish the GitHub Release with a manual `workflow_dispatch`
-run on the same tag after clean-machine QA is complete.
+publishes the GitHub Release after the build matrix passes.
 
 No target may silently skip missing engines, failed extraction, checksum mismatch, or missing package output.

THIRD_PARTY_NOTICES.md

@@ -4,6 +4,23 @@ Firelink distributes separate executable tools. Firelink's MIT license does not
 
 Exact versions, target hashes, sources, and build descriptions are pinned in `engines.lock.json`.
 
+## Bundled fonts
+
+Firelink bundles variable WOFF2 web fonts through Fontsource. Each font is
+licensed under the SIL Open Font License, Version 1.1. The corresponding
+license and author information are available from the linked project sources.
+
+- Inter: <https://github.com/rsms/inter>
+- Outfit: <https://github.com/Outfitio/Outfit-Fonts>
+- Roboto: <https://github.com/googlefonts/roboto-classic>
+- Vazirmatn: <https://github.com/rastikerdar/vazirmatn>
+- Noto Sans Hebrew: <https://github.com/notofonts/hebrew>
+- Noto Sans SC: <https://github.com/notofonts/noto-cjk>
+
+Fontsource distribution: <https://github.com/fontsource/font-files>
+
+License text: <https://openfontlicense.org/open-font-license-official-text/>
+
 ## aria2
 
 - Project: <https://aria2.github.io/>

engine-sources.lock.json

@@ -3,19 +3,19 @@
   "targets": {
     "x86_64-pc-windows-msvc": {
       "yt-dlp": {
-        "version": "2026.07.04",
-        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.07.04/yt-dlp_win.zip",
-        "sha256": "90254845be5282b1f4d843a873abff04f569f857f64250f833fe152b21eec152"
+        "version": "2026.08.19",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.08.19/yt-dlp_win.zip",
+        "sha256": "30b4c14aafab6082becff7881e41b76df46dc43ea7633479410a91e29da492bf"
       },
       "deno": {
-        "version": "2.9.2",
-        "url": "https://github.com/denoland/deno/releases/download/v2.9.2/deno-x86_64-pc-windows-msvc.zip",
-        "sha256": "5fe194d26ac5ef77fcc5288c2c438c7a0465f3b6180440ebf04092714bf2dcdf"
+        "version": "2.9.5",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.5/deno-x86_64-pc-windows-msvc.zip",
+        "sha256": "171efab55ac6b9881fd53ee4c20f8bf3bb1340ffc618483746909014db12216a"
       },
       "ffmpeg": {
-        "version": "8.1.2-22-g94138f6973",
-        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-07-06-14-19/ffmpeg-n8.1.2-22-g94138f6973-win64-gpl-8.1.zip",
-        "sha256": "a758e2836a8f33c5f21fc44270cb00392acc6d0085dd0ba14fe14ae75935813d"
+        "version": "8.1.2-46-g139afe709a",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-26-13-06/ffmpeg-n8.1.2-46-g139afe709a-win64-gpl-8.1.zip",
+        "sha256": "f966bc2e843bcd680dedd6d1a2c0c895bab859a402c6dd107cbe72a796dfebcf"
       },
       "aria2c": {
         "version": "1.37.0",
@@ -25,19 +25,19 @@
     },
     "x86_64-unknown-linux-gnu": {
       "yt-dlp": {
-        "version": "2026.07.04",
-        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.07.04/yt-dlp_linux.zip",
-        "sha256": "d7d2d09e900b5ae11821b5784b18cf064984a2bd88b1ca5c798d744bcbe3658b"
+        "version": "2026.08.19",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.08.19/yt-dlp_linux.zip",
+        "sha256": "32e72032766bef9199d99d15beb69fd52e46df8f8b06f0d8745db59e04d339e9"
       },
       "deno": {
-        "version": "2.9.2",
-        "url": "https://github.com/denoland/deno/releases/download/v2.9.2/deno-x86_64-unknown-linux-gnu.zip",
-        "sha256": "934d1bd5cb09eaed7f2e4a4fc58208d04a3c5c0fcde9f319d93d735265c67a4a"
+        "version": "2.9.5",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.5/deno-x86_64-unknown-linux-gnu.zip",
+        "sha256": "8b010a3b1a4a0188a67cdb8a7a27348b2a501af78aec7fc74f2ace167368d530"
       },
       "ffmpeg": {
-        "version": "8.1.2-22-g94138f6973",
-        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-07-06-14-19/ffmpeg-n8.1.2-22-g94138f6973-linux64-gpl-8.1.tar.xz",
-        "sha256": "df99ffb3803ee56dc68954f43f950ea9f33685a3595a5da8a3e73ef4bef37e3c"
+        "version": "8.1.2-46-g139afe709a",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-26-13-06/ffmpeg-n8.1.2-46-g139afe709a-linux64-gpl-8.1.tar.xz",
+        "sha256": "0814f4491c2673ea505be8fb65a76c2bfabaa5aad8f33d49b1c5b87a2262e8c5"
       },
       "aria2c": {
         "version": "1.37.0",

engines.lock.json

@@ -4,10 +4,10 @@
     "aarch64-apple-darwin": {
       "engines": {
         "yt-dlp": {
-          "version": "2026.07.04",
+          "version": "2026.08.19",
           "source": "https://github.com/yt-dlp/yt-dlp",
           "build": "PyInstaller onedir distribution with embedded Python and yt_dlp_ejs",
-          "sha256": "ff7d4fc44b8fbf42da021c1bca950da0326cdb0cdb84992fdc7fb7ec215df435"
+          "sha256": "4f54eb67e4e96c7c3ffa49dd5deb81bc348bbb495080889b47d157d5c6d74443"
         },
         "aria2c": {
           "version": "1.37.0",
@@ -16,22 +16,23 @@
           "sha256": "111b2f5ed760f1e1a2ec06117c4e8094fcde336ba16122dda1c5e7209bf1862d"
         },
         "ffmpeg": {
-          "version": "N-125450-gfad2e0bc50",
+          "version": "N-125892-g406c5a37aa",
           "source": "https://ffmpeg.org/",
           "build": "GPLv3 build identified by binary as https://www.martin-riedl.de",
-          "sha256": "be2c39e5c9ef923f60da6cb62f5a209ed98b4da8a732d9f06de4355d5ea99e58"
+          "url": "https://ffmpeg.martin-riedl.de/download/macos/arm64/1785661721_N-125892-g406c5a37aa/ffmpeg.zip",
+          "sha256": "734e6b72a0c2d0d5e089b5a0094be74fa058c15158f6b0689207a01fedafd8f5"
         },
         "deno": {
-          "version": "2.9.2",
+          "version": "2.9.5",
           "source": "https://github.com/denoland/deno",
           "build": "official aarch64-apple-darwin executable",
-          "sha256": "218ab752ae8f64f0a7822af710886488f15169fdae153a3aada4861f9635b266"
+          "sha256": "b5bd08edab254d42d7b05aa5b6cb4c9b8d4dede4975aff76951ce2cce18866fa"
         }
       },
       "runtimeTrees": {
         "_internal": {
-          "files": 142,
-          "sha256": "769507d9b8d97164ef81ebb449873072697bf82acac8c7d61c7bfd96c551e210"
+          "files": 133,
+          "sha256": "24ac8c7557dbef0ef9e5685365b4620bc441a168daf314b71218276b782dc449"
         },
         "aria2-libs": {
           "files": 7,

index.html

@@ -5,9 +5,6 @@
     <link rel="icon" type="image/png" href="/src/assets/app-icon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Firelink Download Manager</title>
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Outfit:wght@300;400;500;600;700&display=swap" rel="stylesheet">
   </head>
 
   <body>

package.json

@@ -1,7 +1,7 @@
 {
   "name": "firelink",
   "private": true,
-  "version": "1.0.4",
+  "version": "1.4.0",
   "description": "A fast cross-platform desktop download manager powered by Rust, Tauri, React, aria2, and yt-dlp.",
   "license": "MIT",
   "homepage": "https://github.com/nimbold/Firelink",
@@ -31,37 +31,51 @@
     "dev": "vite",
     "bindings": "cd src-tauri && cargo test export_bindings --lib",
     "build": "tsc && vite build",
+    "check:i18n": "vitest run src/i18n/resources.test.ts",
     "check:updates": "node scripts/check-updates.js",
+    "smoke:torrent": "node scripts/smoke-torrent.js",
+    "smoke:torrent:failure-paths": "node scripts/smoke-torrent.js --failure-paths",
+    "smoke:aria2:resolver": "node scripts/smoke-aria2-resolver.js",
+    "smoke:aria2:transfers": "node scripts/smoke-aria2-transfers.js",
+    "test:torrent:rpc": "cd src-tauri && cargo test --test torrent_rpc -- --nocapture",
     "verify:macos-signing": "node scripts/verify-macos-signing.js",
     "preview": "vite preview",
     "tauri": "tauri",
     "test": "vitest"
   },
   "dependencies": {
+    "@fontsource-variable/inter": "^5.3.0",
+    "@fontsource-variable/noto-sans-hebrew": "^5.3.0",
+    "@fontsource-variable/noto-sans-sc": "^5.3.0",
+    "@fontsource-variable/outfit": "^5.3.0",
+    "@fontsource-variable/roboto": "^5.3.0",
+    "@fontsource-variable/vazirmatn": "^5.3.0",
     "@formkit/auto-animate": "^0.10.0",
-    "@tailwindcss/vite": "^4.3.1",
+    "@tailwindcss/vite": "^4.3.3",
     "@tauri-apps/api": "^2.11.1",
     "@tauri-apps/plugin-clipboard-manager": "^2.3.2",
-    "@tauri-apps/plugin-dialog": "^2.7.1",
+    "@tauri-apps/plugin-dialog": "^2.7.2",
     "@tauri-apps/plugin-fs": "^2.5.1",
-    "@tauri-apps/plugin-log": "^2.8.0",
+    "@tauri-apps/plugin-log": "^2.9.0",
     "@tauri-apps/plugin-notification": "^2.3.3",
     "@tauri-apps/plugin-opener": "^2",
-    "lucide-react": "^1.24.0",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0",
-    "zustand": "^5.0.14"
+    "i18next": "^26.4.0",
+    "lucide-react": "^1.34.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-i18next": "^17.0.12",
+    "zustand": "^5.0.15"
   },
   "devDependencies": {
     "@tauri-apps/cli": "^2.11.4",
-    "@types/react": "^19.1.8",
-    "@types/react-dom": "^19.1.6",
-    "@vitejs/plugin-react": "^6.0.3",
-    "autoprefixer": "^10.5.2",
-    "postcss": "^8.5.15",
-    "tailwindcss": "^4.3.1",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.5",
+    "@vitejs/plugin-react": "^6.1.0",
+    "autoprefixer": "^10.5.4",
+    "postcss": "^8.5.26",
+    "tailwindcss": "^4.3.3",
     "typescript": "^7.0.2",
-    "vite": "^8.1.4",
-    "vitest": "^4.1.10"
+    "vite": "^8.2.2",
+    "vitest": "^4.1.11"
   }
 }

scripts/app-associations.node-test.js

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+
+const repositoryRoot = path.resolve(import.meta.dirname, '..');
+const tauriConfig = JSON.parse(
+  fs.readFileSync(path.join(repositoryRoot, 'src-tauri', 'tauri.conf.json'), 'utf8')
+);
+
+const torrentAssociation = tauriConfig.bundle.fileAssociations.find(association =>
+  association.ext?.some(extension => extension.toLowerCase() === 'torrent')
+);
+
+test('declares the native macOS BitTorrent content type', () => {
+  assert.ok(torrentAssociation, 'the bundle must declare a .torrent association');
+  assert.equal(torrentAssociation.mimeType, 'application/x-bittorrent');
+  assert.deepEqual(torrentAssociation.exportedType, {
+    identifier: 'org.bittorrent.torrent',
+    conformsTo: ['public.data', 'public.item']
+  });
+  assert.equal(
+    torrentAssociation.contentTypes,
+    undefined,
+    'the UTI declaration supplies the extension and MIME tags for clean installs'
+  );
+});
+
+test('declares magnet as a desktop deep-link scheme', () => {
+  assert.deepEqual(tauriConfig.plugins['deep-link'].desktop.schemes, ['firelink', 'magnet']);
+});
+
+const packagedAppPath = process.env.FIRELINK_MACOS_APP;
+
+if (packagedAppPath) {
+  test('packaged macOS app exports the Torrent UTI and magnet URL scheme', () => {
+    assert.equal(process.platform, 'darwin', 'packaged macOS association checks require macOS');
+    const infoPlistPath = path.join(packagedAppPath, 'Contents', 'Info.plist');
+    assert.ok(fs.existsSync(infoPlistPath), `missing packaged Info.plist: ${infoPlistPath}`);
+
+    const plist = JSON.parse(execFileSync('plutil', ['-convert', 'json', '-o', '-', infoPlistPath], {
+      encoding: 'utf8'
+    }));
+    const urlTypes = Array.isArray(plist.CFBundleURLTypes) ? plist.CFBundleURLTypes : [];
+    const schemes = urlTypes.flatMap(entry => (
+      entry && typeof entry === 'object' && Array.isArray(entry.CFBundleURLSchemes)
+        ? entry.CFBundleURLSchemes.filter(scheme => typeof scheme === 'string')
+        : []
+    ));
+    assert.ok(schemes.includes('firelink'), 'packaged app must retain the Firelink deep-link scheme');
+    assert.ok(schemes.includes('magnet'), 'packaged app must export the magnet URL scheme');
+
+    const documentTypes = Array.isArray(plist.CFBundleDocumentTypes) ? plist.CFBundleDocumentTypes : [];
+    const torrentDocument = documentTypes.find(entry =>
+      entry
+      && typeof entry === 'object'
+      && Array.isArray(entry.CFBundleTypeExtensions)
+      && entry.CFBundleTypeExtensions.some(extension =>
+        typeof extension === 'string' && extension.toLowerCase() === 'torrent'
+      )
+    );
+    assert.ok(torrentDocument, 'packaged app must claim the .torrent extension');
+    assert.ok(
+      Array.isArray(torrentDocument.LSItemContentTypes)
+      && torrentDocument.LSItemContentTypes.includes('org.bittorrent.torrent'),
+      'packaged app must claim the standard BitTorrent UTI'
+    );
+  });
+}

scripts/audit-aria2-options.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs';
+
+const sourceArgument = process.argv.indexOf('--source');
+const sourceLocation = sourceArgument >= 0
+  ? process.argv[sourceArgument + 1]
+  : 'https://raw.githubusercontent.com/aria2/aria2/release-1.37.0/doc/manual-src/en/aria2c.rst';
+
+if (!sourceLocation) throw new Error('--source requires a path or URL');
+
+const source = /^https:\/\//.test(sourceLocation)
+  ? await fetch(sourceLocation, { signal: AbortSignal.timeout(15000) }).then(response => {
+      if (!response.ok) throw new Error(`Aria2 manual fetch failed with HTTP ${response.status}`);
+      return response.text();
+    })
+  : fs.readFileSync(sourceLocation, 'utf8');
+
+function section(start, end) {
+  const startIndex = source.indexOf(`${start}\n`);
+  const endIndex = source.indexOf(`${end}\n`, startIndex + start.length);
+  if (startIndex < 0 || endIndex < 0) throw new Error(`Could not find manual section ${start} -> ${end}`);
+  return source.slice(startIndex, endIndex);
+}
+
+function options(text) {
+  const names = [...text.matchAll(/^\.\. option:: .*?(--[a-z0-9-]+)/gm)]
+    .map(match => match[1].slice(2));
+  return [...new Set(names)].sort();
+}
+
+const normal = options(section('HTTP/FTP/SFTP Options', 'BitTorrent/Metalink Options'));
+const torrent = options(
+  `${section('BitTorrent/Metalink Options', 'BitTorrent Specific Options')}\n${section('BitTorrent Specific Options', 'Metalink Specific Options')}`,
+);
+
+if (torrent.length !== 46) {
+  throw new Error(`Expected 46 unique Aria2 1.37.0 Torrent options, found ${torrent.length}`);
+}
+
+console.log(JSON.stringify({
+  source: sourceLocation,
+  aria2Version: '1.37.0',
+  normal: { count: normal.length, options: normal },
+  torrent: { count: torrent.length, options: torrent },
+}, null, 2));

scripts/before-tauri-build.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -41,14 +41,15 @@ function runNpmScript(script) {
   run('npm', ['run', script]);
 }
 
+// A packaged Tauri artifact must have its own consent identity. A source or
+// commit fingerprint cannot distinguish two fresh signed/package builds made
+// from the same checkout, which would let an updated binary silently reuse the
+// previous binary's credential-store approval. Keep any configured identity
+// as useful provenance, but always add the artifact nonce.
+const configuredBuildId = process.env.VITE_BUILD_ID?.trim();
+process.env.VITE_BUILD_ID = `${configuredBuildId || 'artifact'}-${randomUUID()}`;
+
 run(process.execPath, ['scripts/stage-engines.js']);
 run(process.execPath, ['scripts/verify-binaries.js', '--staged']);
 
-if (process.env.FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE === '1') {
-  const engineDist = path.join(repoRoot, 'src-tauri', 'engine-dist');
-  fs.rmSync(engineDist, { recursive: true, force: true });
-  fs.mkdirSync(engineDist, { recursive: true });
-  console.log('Omitted engine-dist from the initial Tauri bundle; release packaging will repack verified engines.');
-}
-
 runNpmScript('build');

scripts/build-linux-appimage.js

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+let activeChild;
+let receivedSignal;
+
+export const APPIMAGE_CONFIG = JSON.stringify({
+  bundle: {
+    resources: {
+      // Tauri merges --config values using JSON Merge Patch. An omitted key
+      // would leave the base engine resource enabled; null explicitly removes
+      // it for this first packaging pass. The verified payload is added back
+      // by repack-linux-appimage-engines.js after linuxdeploy finishes.
+      'engine-dist/': null,
+    },
+  },
+});
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function signalExitCode(signal) {
+  return {
+    SIGHUP: 129,
+    SIGINT: 130,
+    SIGTERM: 143,
+  }[signal] ?? 1;
+}
+
+function npmInvocation(args) {
+  if (process.env.npm_execpath) {
+    return [process.execPath, [process.env.npm_execpath, ...args]];
+  }
+
+  if (process.platform === 'win32') {
+    return ['cmd.exe', ['/d', '/s', '/c', 'npm', ...args]];
+  }
+
+  return ['npm', args];
+}
+
+export function appImageBundleArguments(target) {
+  return [
+    'run',
+    'tauri',
+    '--',
+    'bundle',
+    '-vv',
+    '--target',
+    target,
+    '--bundles',
+    'appimage',
+    '--config',
+    APPIMAGE_CONFIG,
+  ];
+}
+
+function run(command, args, options = {}) {
+  const child = spawn(command, args, {
+    cwd: options.cwd ?? repoRoot,
+    env: { ...process.env, ...options.env },
+    stdio: options.stdio ?? 'inherit',
+    windowsHide: true,
+    detached: process.platform !== 'win32',
+  });
+
+  activeChild = child;
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+
+    child.once('error', error => {
+      if (activeChild === child) activeChild = undefined;
+      if (!settled) {
+        settled = true;
+        reject(error);
+      }
+    });
+
+    child.once('close', (code, signal) => {
+      if (activeChild === child) activeChild = undefined;
+      if (!settled) {
+        settled = true;
+        resolve({ code, signal });
+      }
+    });
+  });
+}
+
+async function runChecked(command, args, label = command) {
+  let result;
+  try {
+    result = await run(command, args);
+  } catch (error) {
+    throw new Error(`Failed to run ${label}: ${error.message}`, { cause: error });
+  }
+
+  if (result.signal) {
+    const error = new Error(`${label} was terminated by ${result.signal}.`);
+    error.exitCode = signalExitCode(result.signal);
+    throw error;
+  }
+
+  if (result.code !== 0) {
+    const error = new Error(`${label} exited with status ${result.code}.`);
+    error.exitCode = result.code ?? 1;
+    throw error;
+  }
+
+  return result;
+}
+
+function assertSafeTarget(target) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(target)) {
+    throw new Error(`Invalid target triple: ${target}`);
+  }
+}
+
+async function main() {
+  const target = argValue('--target') || process.env.FIRELINK_TARGET_TRIPLE;
+  if (!target) {
+    throw new Error('Pass --target <triple>.');
+  }
+  assertSafeTarget(target);
+
+  // The native-package build has already staged and verified the engines.
+  // Verify once more before creating the AppImage so a failed preparation
+  // cannot produce an artifact that later appears valid only because its
+  // payload is absent.
+  await runChecked(
+    process.execPath,
+    ['scripts/verify-binaries.js', '--staged', '--target', target],
+    'staged engine verification'
+  );
+
+  if (receivedSignal) {
+    const error = new Error(`Build interrupted by ${receivedSignal}.`);
+    error.exitCode = signalExitCode(receivedSignal);
+    throw error;
+  }
+
+  const [npmCommand, npmArgs] = npmInvocation(appImageBundleArguments(target));
+  await runChecked(npmCommand, npmArgs, 'Tauri AppImage bundling');
+
+  if (receivedSignal) {
+    const error = new Error(`Build interrupted by ${receivedSignal}.`);
+    error.exitCode = signalExitCode(receivedSignal);
+    throw error;
+  }
+
+  console.log(`Built the Linux AppImage from the existing ${target} release binary.`);
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+
+if (isMain) {
+  const handleSignal = signal => {
+    receivedSignal ??= signal;
+
+    // npm and Tauri can have Rust/packaging descendants. On POSIX, the child
+    // is a detached process-group leader, so signal the whole group instead of
+    // leaving descendants running after the wrapper exits.
+    if (activeChild && activeChild.exitCode === null && activeChild.signalCode === null) {
+      try {
+        if (process.platform === 'win32' || !activeChild.pid) {
+          activeChild.kill(signal);
+        } else {
+          process.kill(-activeChild.pid, signal);
+        }
+      } catch (error) {
+        if (error.code !== 'ESRCH') {
+          console.error(`[WARN] Could not terminate the AppImage build process group: ${error.message}`);
+        }
+      }
+    } else {
+      process.exitCode = signalExitCode(signal);
+    }
+  };
+
+  for (const signal of ['SIGHUP', 'SIGINT', 'SIGTERM']) {
+    process.once(signal, () => handleSignal(signal));
+  }
+
+  main()
+    .catch(error => {
+      console.error(`[FAIL] ${error.message}`);
+      process.exitCode = error.exitCode ?? 1;
+    })
+    .finally(() => {
+      for (const signal of ['SIGHUP', 'SIGINT', 'SIGTERM']) {
+        process.removeAllListeners(signal);
+      }
+    });
+}

scripts/build-linux-appimage.node-test.js

@@ -0,0 +1,20 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { APPIMAGE_CONFIG, appImageBundleArguments } from './build-linux-appimage.js';
+
+test('AppImage config explicitly removes the staged engine payload', () => {
+  assert.deepEqual(JSON.parse(APPIMAGE_CONFIG), {
+    bundle: {
+      resources: {
+        'engine-dist/': null,
+      },
+    },
+  });
+});
+
+test('AppImage bundling uses the existing binary instead of tauri build', () => {
+  const args = appImageBundleArguments('x86_64-unknown-linux-gnu');
+  assert.equal(args[3], 'bundle');
+  assert.equal(args.includes('build'), false);
+  assert.deepEqual(args.slice(-2), ['--config', APPIMAGE_CONFIG]);
+});

scripts/check-updates.js

@@ -7,6 +7,14 @@ import { fileURLToPath } from 'node:url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, '..');
 const userAgent = 'firelink-update-check';
+const fetchRetryDelaysMs = [250, 1_000];
+const fetchTimeoutMs = 30_000;
+const retryableHttpStatuses = new Set([408, 425, 429, 500, 502, 503, 504]);
+
+function httpResponseError(response, url) {
+  const status = [response.status, response.statusText].filter(Boolean).join(' ');
+  return new Error(`${status}: ${url}`);
+}
 
 function parseJsonFile(file) {
   return JSON.parse(fs.readFileSync(path.join(repoRoot, file), 'utf8'));
@@ -32,12 +40,46 @@ function compareVersions(left, right) {
   return 0;
 }
 
+function parseSha256Digest(value) {
+  const match = /^sha256:([0-9a-f]{64})$/i.exec(String(value || ''));
+  return match?.[1].toLowerCase();
+}
+
+function releaseAssetHashes(release) {
+  return Object.fromEntries(
+    (release?.assets || [])
+      .map(asset => {
+        const digest = parseSha256Digest(asset.digest);
+        return digest && typeof asset.browser_download_url === 'string'
+          ? [asset.browser_download_url, digest]
+          : undefined;
+      })
+      .filter(Boolean),
+  );
+}
+
+function providerAssetHashes({ ytDlp, deno, aria2 }) {
+  return {
+    ...releaseAssetHashes(ytDlp),
+    ...releaseAssetHashes(deno),
+    ...releaseAssetHashes(aria2),
+  };
+}
+
+function npmExecutable(platform = process.platform) {
+  return platform === 'win32' ? 'npm.cmd' : 'npm';
+}
+
 function npmOutdated(cwd) {
   if (!fs.existsSync(path.join(cwd, 'package.json'))) {
     throw new Error(`npm workspace is missing package.json: ${cwd}`);
   }
   try {
-    execFileSync('npm', ['outdated', '--json'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    execFileSync(npmExecutable(), ['outdated', '--json'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
     return {};
   } catch (error) {
     if (error.status !== 1) {
@@ -50,25 +92,67 @@ function npmOutdated(cwd) {
 }
 
 async function fetchJson(url) {
-  const response = await fetch(url, { headers: { 'User-Agent': userAgent } });
-  if (!response.ok) throw new Error(`${response.status} ${response.statusText}: ${url}`);
-  return response.json();
+  return fetchWithContext(url, response => response.json());
 }
 
 async function fetchText(url) {
-  const response = await fetch(url, { headers: { 'User-Agent': userAgent } });
-  if (!response.ok) throw new Error(`${response.status} ${response.statusText}: ${url}`);
-  return response.text();
+  return fetchWithContext(url, response => response.text());
+}
+
+async function fetchWithContext(url, readResponse) {
+  let lastError;
+  for (let attempt = 0; attempt <= fetchRetryDelaysMs.length; attempt += 1) {
+    let response;
+    try {
+      response = await fetch(url, {
+        headers: { 'User-Agent': userAgent },
+        signal: AbortSignal.timeout(fetchTimeoutMs),
+      });
+    } catch (error) {
+      lastError = error;
+      if (attempt === fetchRetryDelaysMs.length) break;
+      await new Promise(resolve => setTimeout(resolve, fetchRetryDelaysMs[attempt]));
+      continue;
+    }
+
+    if (!response.ok) {
+      const error = httpResponseError(response, url);
+      if (!retryableHttpStatuses.has(response.status) || attempt === fetchRetryDelaysMs.length) {
+        await response.body?.cancel();
+        throw error;
+      }
+      await response.body?.cancel();
+      lastError = error;
+      await new Promise(resolve => setTimeout(resolve, fetchRetryDelaysMs[attempt]));
+      continue;
+    }
+
+    try {
+      return await readResponse(response);
+    } catch (error) {
+      lastError = error;
+      if (attempt === fetchRetryDelaysMs.length) break;
+      await new Promise(resolve => setTimeout(resolve, fetchRetryDelaysMs[attempt]));
+    }
+  }
+  const detail = lastError instanceof Error ? lastError.message : String(lastError);
+  throw new Error(`fetch failed for ${url}: ${detail}`, { cause: lastError });
 }
 
 async function githubLatest(repo) {
-  return fetchJson(`https://api.github.com/repos/${repo}/releases/latest`);
+  const release = await fetchJson(`https://api.github.com/repos/${repo}/releases/latest`);
+  if (!release || Array.isArray(release) || typeof release.tag_name !== 'string' || !release.tag_name.trim()) {
+    throw new Error(`GitHub latest release response for ${repo} has no usable tag_name`);
+  }
+  return release;
 }
 
 async function latestFfmpegStable() {
   const html = await fetchText('https://ffmpeg.org/releases/');
   const versions = [...html.matchAll(/ffmpeg-(\d+\.\d+(?:\.\d+)?)\.tar\.xz/g)].map(match => match[1]);
-  return [...new Set(versions)].sort(compareVersions).at(-1);
+  const latest = [...new Set(versions)].sort(compareVersions).at(-1);
+  if (!latest) throw new Error('FFmpeg release page contained no usable stable release version');
+  return latest;
 }
 
 async function latestMartinRiedlMacArm64Release() {
@@ -83,22 +167,44 @@ async function latestMartinRiedlMacArm64Release() {
 async function latestMartinRiedlMacArm64Snapshot() {
   const html = await fetchText('https://ffmpeg.martin-riedl.de/');
   const snapshotSection = html.split('Download Snapshot Build')[1]?.split('Download Release Build')[0] || '';
+  const card = snapshotSection.match(/<h3>macOS \(Apple Silicon\/arm64\)<\/h3>[\s\S]*?<\/div>/)?.[0] || '';
   const match =
-    snapshotSection.match(/macOS \(Apple Silicon\/arm64\)[\s\S]*?<b>Release:\s*<\/b>\s*([A-Za-z0-9.-]+)/) ||
-    snapshotSection.match(/macOS \(Apple Silicon\/arm64\)[\s\S]*?Release:\s*([A-Za-z0-9.-]+)/);
-  return match?.[1];
+    card.match(/<b>Release:\s*<\/b>\s*([A-Za-z0-9.-]+)/) ||
+    card.match(/Release:\s*([A-Za-z0-9.-]+)/);
+  const url = card.match(/href="([^"]+\/ffmpeg\.zip)"/)?.[1];
+  return match?.[1]
+    ? { version: match[1], url: url ? new URL(url, 'https://ffmpeg.martin-riedl.de').href : undefined }
+    : undefined;
 }
 
 async function latestBtbnFfmpegN81Build() {
   const releases = await fetchJson('https://api.github.com/repos/BtbN/FFmpeg-Builds/releases?per_page=10');
   for (const release of releases) {
     if (release.tag_name === 'latest') continue;
-    const versions = (release.assets || [])
-      .map(asset => asset.name.match(/^ffmpeg-n(8\.1\.\d+-\d+-g[0-9a-f]+)-(?:win64-gpl-8\.1\.zip|linux64-gpl-8\.1\.tar\.xz)$/)?.[1])
+    const assets = (release.assets || [])
+      .map(asset => {
+        const match = asset.name.match(/^ffmpeg-n(8\.1\.\d+-\d+-g[0-9a-f]+)-(win64|linux64)-gpl-8\.1\.(?:zip|tar\.xz)$/);
+        if (!match) return undefined;
+        return {
+          target: match[2] === 'win64' ? 'windows' : 'linux',
+          version: match[1],
+          url: asset.browser_download_url,
+          sha256: parseSha256Digest(asset.digest),
+        };
+      })
       .filter(Boolean);
-    const unique = [...new Set(versions)];
-    if (unique.length === 1 && versions.length >= 2) {
-      return unique[0];
+    const unique = [...new Set(assets.map(asset => asset.version))];
+    const byTarget = Object.fromEntries(assets.map(asset => [asset.target, asset]));
+    if (
+      unique.length === 1 &&
+      byTarget.windows?.sha256 &&
+      byTarget.linux?.sha256
+    ) {
+      return {
+        version: unique[0],
+        urls: { windows: byTarget.windows.url, linux: byTarget.linux.url },
+        hashes: { windows: byTarget.windows.sha256, linux: byTarget.linux.sha256 },
+      };
     }
   }
   return undefined;
@@ -121,7 +227,7 @@ function sourceEngineVersions(sourceLock) {
   const rows = [];
   for (const [target, engines] of Object.entries(sourceLock.targets || {})) {
     for (const [engine, meta] of Object.entries(engines)) {
-      rows.push({ target, engine, version: meta.version, url: meta.url });
+      rows.push({ target, engine, version: meta.version, url: meta.url, sha256: meta.sha256 });
     }
   }
   return rows;
@@ -131,22 +237,58 @@ function packagedEngineVersions(engineLock) {
   const rows = [];
   for (const [target, targetLock] of Object.entries(engineLock.targets || {})) {
     for (const [engine, meta] of Object.entries(targetLock.engines || {})) {
-      rows.push({ target, engine, version: meta.version });
+      rows.push({ target, engine, version: meta.version, url: meta.url, sha256: meta.sha256 });
     }
   }
   return rows;
 }
 
-function checkRows(rows, latestByEngine, latestByTargetEngine = {}) {
+function unavailableLatestVersionError(target, engine, targetSpecific) {
+  const error = new Error(
+    `${targetSpecific ? 'Latest provider version' : 'Latest version'} is unavailable for ${target} ${engine}`
+  );
+  error.code = 'LATEST_VERSION_UNAVAILABLE';
+  return error;
+}
+
+function checkRows(
+  rows,
+  latestByEngine,
+  latestByTargetEngine = {},
+  latestUrlsByTargetEngine = {},
+  targetSpecificEngines = new Set(),
+  latestHashesByTargetEngine = {},
+  latestHashesByUrl = {},
+) {
   let outdated = 0;
   for (const row of rows) {
-    const latest = latestByTargetEngine[`${row.target}:${row.engine}`] || latestByEngine[row.engine];
-    if (!latest) continue;
+    const targetSpecific = targetSpecificEngines.has(row.engine);
+    const targetKey = `${row.target}:${row.engine}`;
+    const latest = targetSpecific
+      ? latestByTargetEngine[targetKey]
+      : latestByTargetEngine[targetKey] || latestByEngine[row.engine];
+    if (typeof latest !== 'string' || !latest.trim()) {
+      throw unavailableLatestVersionError(row.target, row.engine, targetSpecific);
+    }
     const current = normalizeVersion(row.version);
     const wanted = normalizeVersion(latest);
-    const status = compareVersions(current, wanted) < 0 ? 'outdated' : 'current';
-    if (status === 'outdated') outdated += 1;
+    const latestUrl = latestUrlsByTargetEngine[targetKey];
+    const versionOutdated = compareVersions(current, wanted) < 0;
+    const sourceOutdated = Boolean(latestUrl && row.url && row.url !== latestUrl);
+    const latestHash = latestHashesByTargetEngine[targetKey] || latestHashesByUrl[row.url];
+    const currentHash = typeof row.sha256 === 'string' ? row.sha256.toLowerCase() : '';
+    const hashOutdated = Boolean(latestHash && currentHash !== latestHash);
+    const status = versionOutdated
+      ? 'outdated'
+      : sourceOutdated
+        ? 'source-outdated'
+        : hashOutdated
+          ? 'hash-outdated'
+          : 'current';
+    if (status !== 'current') outdated += 1;
     console.log(`  ${row.target} ${row.engine}: ${current} -> ${wanted} ${status}`);
+    if (sourceOutdated) console.log(`    source: ${row.url} -> ${latestUrl}`);
+    if (hashOutdated) console.log(`    sha256: ${row.sha256 || 'missing'} -> ${latestHash}`);
   }
   return outdated;
 }
@@ -160,65 +302,158 @@ async function main() {
     npmOutdated(path.join(repoRoot, 'Extensions', 'Browser'))
   );
 
-  const [
-    ytDlp,
-    deno,
-    aria2,
-    ffmpeg,
-    martinRiedlMacArm64Ffmpeg,
-    martinRiedlMacArm64Snapshot,
-    btbnFfmpegN81Build,
-  ] = await Promise.all([
-    githubLatest('yt-dlp/yt-dlp'),
-    githubLatest('denoland/deno'),
-    githubLatest('aria2/aria2'),
-    latestFfmpegStable(),
-    latestMartinRiedlMacArm64Release(),
-    latestMartinRiedlMacArm64Snapshot(),
-    latestBtbnFfmpegN81Build(),
-  ]);
+  const providerChecks = [
+    ['yt-dlp latest release', () => githubLatest('yt-dlp/yt-dlp')],
+    ['Deno latest release', () => githubLatest('denoland/deno')],
+    ['aria2 latest release', () => githubLatest('aria2/aria2')],
+    [
+      'FFmpeg stable release',
+      async () => {
+        const version = await latestFfmpegStable();
+        if (!version) throw new Error('FFmpeg release provider response has no usable version');
+        return version;
+      },
+    ],
+    [
+      'Martin Riedl macOS release',
+      async () => {
+        const version = await latestMartinRiedlMacArm64Release();
+        if (!version) throw new Error('Martin Riedl macOS release provider response has no usable version');
+        return version;
+      },
+    ],
+    [
+      'Martin Riedl macOS snapshot',
+      async () => {
+        const build = await latestMartinRiedlMacArm64Snapshot();
+        if (!build?.version || !build.url) {
+          throw new Error('Martin Riedl FFmpeg provider response has no complete macOS arm64 snapshot');
+        }
+        return build;
+      },
+    ],
+    [
+      'BtbN FFmpeg Windows/Linux build',
+      async () => {
+        const build = await latestBtbnFfmpegN81Build();
+        if (
+          !build?.version ||
+          !build.urls?.windows ||
+          !build.urls?.linux ||
+          !build.hashes?.windows ||
+          !build.hashes?.linux
+        ) {
+          throw new Error('BtbN FFmpeg provider response has no complete Windows/Linux build with SHA-256 digests');
+        }
+        return build;
+      },
+    ],
+  ];
+  const providerResults = await Promise.allSettled(providerChecks.map(([, check]) => check()));
+  const providerFailures = [];
+  for (const [index, [label]] of providerChecks.entries()) {
+    const result = providerResults[index];
+    if (result.status === 'rejected') {
+      const detail = result.reason instanceof Error ? result.reason.message : String(result.reason);
+      providerFailures.push(label);
+      console.error(`provider unavailable: ${label}: ${detail}`);
+    }
+  }
+  const providerValue = index =>
+    providerResults[index].status === 'fulfilled' ? providerResults[index].value : undefined;
+  const ytDlp = providerValue(0);
+  const deno = providerValue(1);
+  const aria2 = providerValue(2);
+  const ffmpeg = providerValue(3);
+  const martinRiedlMacArm64Snapshot = providerValue(5);
+  const btbnFfmpegN81Build = providerValue(6);
   const latestByEngine = {
-    'yt-dlp': ytDlp.tag_name,
-    deno: deno.tag_name,
-    aria2c: aria2.tag_name,
+    'yt-dlp': ytDlp?.tag_name,
+    deno: deno?.tag_name,
+    aria2c: aria2?.tag_name,
     ffmpeg,
   };
-  const latestByTargetEngine = {
-    'x86_64-pc-windows-msvc:ffmpeg': btbnFfmpegN81Build || ffmpeg,
-    'x86_64-unknown-linux-gnu:ffmpeg': btbnFfmpegN81Build || ffmpeg,
-    'aarch64-apple-darwin:ffmpeg': martinRiedlMacArm64Snapshot || martinRiedlMacArm64Ffmpeg,
-  };
+  const latestByTargetEngine = {};
+  const latestUrlsByTargetEngine = {};
+  const latestHashesByTargetEngine = {};
+  const latestHashesByUrl = providerAssetHashes({ ytDlp, deno, aria2 });
+  if (btbnFfmpegN81Build?.version && btbnFfmpegN81Build.urls?.windows && btbnFfmpegN81Build.urls?.linux) {
+    latestByTargetEngine['x86_64-pc-windows-msvc:ffmpeg'] = btbnFfmpegN81Build.version;
+    latestByTargetEngine['x86_64-unknown-linux-gnu:ffmpeg'] = btbnFfmpegN81Build.version;
+    latestUrlsByTargetEngine['x86_64-pc-windows-msvc:ffmpeg'] = btbnFfmpegN81Build.urls.windows;
+    latestUrlsByTargetEngine['x86_64-unknown-linux-gnu:ffmpeg'] = btbnFfmpegN81Build.urls.linux;
+    latestHashesByTargetEngine['x86_64-pc-windows-msvc:ffmpeg'] = btbnFfmpegN81Build.hashes?.windows;
+    latestHashesByTargetEngine['x86_64-unknown-linux-gnu:ffmpeg'] = btbnFfmpegN81Build.hashes?.linux;
+  }
+  if (martinRiedlMacArm64Snapshot?.version && martinRiedlMacArm64Snapshot.url) {
+    latestByTargetEngine['aarch64-apple-darwin:ffmpeg'] = martinRiedlMacArm64Snapshot.version;
+    latestUrlsByTargetEngine['aarch64-apple-darwin:ffmpeg'] = martinRiedlMacArm64Snapshot.url;
+  }
+  const displayVersion = value => (value ? normalizeVersion(value) : 'unavailable');
 
   console.log('\nlatest engines:');
   for (const [engine, version] of Object.entries(latestByEngine)) {
-    console.log(`  ${engine}: ${normalizeVersion(version)}`);
+    console.log(`  ${engine}: ${displayVersion(version)}`);
   }
   console.log('\nlatest engine provider builds:');
-  console.log(`  BtbN FFmpeg n8.1 Windows/Linux: ${normalizeVersion(btbnFfmpegN81Build || ffmpeg)}`);
-  console.log(`  Martin Riedl FFmpeg macOS arm64 snapshot: ${normalizeVersion(martinRiedlMacArm64Snapshot || martinRiedlMacArm64Ffmpeg)}`);
+  console.log(`  BtbN FFmpeg n8.1 Windows/Linux: ${displayVersion(btbnFfmpegN81Build?.version)}`);
+  console.log(`  Martin Riedl FFmpeg macOS arm64 snapshot: ${displayVersion(martinRiedlMacArm64Snapshot?.version)}`);
+
+  const targetSpecificEngines = new Set(['ffmpeg']);
+  const engineCheckFailures = [];
+  const runEngineCheck = (label, rows) => {
+    try {
+      return checkRows(
+        rows,
+        latestByEngine,
+        latestByTargetEngine,
+        latestUrlsByTargetEngine,
+        targetSpecificEngines,
+        latestHashesByTargetEngine,
+        latestHashesByUrl,
+      );
+    } catch (error) {
+      if (error?.code !== 'LATEST_VERSION_UNAVAILABLE') throw error;
+      const detail = error instanceof Error ? error.message : String(error);
+      engineCheckFailures.push(label);
+      console.error(`engine provider unavailable: ${label}: ${detail}`);
+      return 0;
+    }
+  };
 
   console.log('\nengine source lock:');
-  outdatedCount += checkRows(
+  outdatedCount += runEngineCheck(
+    'engine source lock',
     sourceEngineVersions(parseJsonFile('engine-sources.lock.json')),
-    latestByEngine,
-    latestByTargetEngine
   );
 
   console.log('\npackaged engine lock:');
-  outdatedCount += checkRows(
+  outdatedCount += runEngineCheck(
+    'packaged engine lock',
     packagedEngineVersions(parseJsonFile('engines.lock.json')),
-    latestByEngine,
-    latestByTargetEngine
   );
 
   if (outdatedCount > 0) {
     console.error(`\n${outdatedCount} outdated item(s) found.`);
     process.exit(1);
   }
+  if (providerFailures.length > 0) {
+    console.error(`\n${providerFailures.length} provider check(s) unavailable; refusing to claim that all updates are current.`);
+  }
+  if (engineCheckFailures.length > 0) {
+    console.error(`\n${engineCheckFailures.length} engine lock check(s) unavailable; refusing to claim that all engines are current.`);
+  }
+  if (providerFailures.length > 0 || engineCheckFailures.length > 0) {
+    process.exit(1);
+  }
   console.log('\nAll checked packages and engines are current.');
 }
 
-main().catch(error => {
-  console.error(error instanceof Error ? error.message : error);
-  process.exit(1);
-});
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch(error => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+  });
+}
+
+export { checkRows, fetchJson, fetchText, fetchWithContext, npmExecutable, providerAssetHashes };

scripts/check-updates.node-test.js

@@ -0,0 +1,119 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+
+import { checkRows, fetchJson, fetchText, npmExecutable, providerAssetHashes } from './check-updates.js';
+
+async function withMockFetch(mockFetch, callback) {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = mockFetch;
+  try {
+    return await callback();
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+}
+
+test('fetchJson retries transient HTTP responses before succeeding', async () => {
+  let attempts = 0;
+  const result = await withMockFetch(async () => {
+    attempts += 1;
+    if (attempts < 3) return new Response('temporarily unavailable', { status: 503 });
+    return new Response(JSON.stringify({ status: 'ok' }), {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }, () => fetchJson('https://example.test/releases'));
+
+  assert.deepEqual(result, { status: 'ok' });
+  assert.equal(attempts, 3);
+});
+
+test('fetchText does not retry terminal HTTP responses', async () => {
+  let attempts = 0;
+  await assert.rejects(
+    () =>
+      withMockFetch(async () => {
+        attempts += 1;
+        return new Response('not found', { status: 404 });
+      }, () => fetchText('https://example.test/missing')),
+    /404: https:\/\/example\.test\/missing/
+  );
+  assert.equal(attempts, 1);
+});
+
+test('checkRows fails closed when a latest version is unavailable', () => {
+  assert.throws(
+    () =>
+      checkRows(
+        [{ target: 'test-target', engine: 'test-engine', version: '1.0.0', url: 'https://example.test/engine' }],
+        {}
+      ),
+    /Latest version is unavailable for test-target test-engine/
+  );
+});
+
+test('checkRows does not fall back to the generic release for target-specific engines', () => {
+  assert.throws(
+    () =>
+      checkRows(
+        [{ target: 'test-target', engine: 'ffmpeg', version: '8.1.2', url: 'https://example.test/engine' }],
+        { ffmpeg: '9.0.1' },
+        {},
+        {},
+        new Set(['ffmpeg'])
+      ),
+    /Latest provider version is unavailable for test-target ffmpeg/
+  );
+});
+
+test('checkRows detects a provider hash change when version and URL are current', () => {
+  const outdated = checkRows(
+    [{
+      target: 'test-target',
+      engine: 'test-engine',
+      version: '1.0.0',
+      url: 'https://example.test/engine',
+      sha256: 'a'.repeat(64),
+    }],
+    { 'test-engine': '1.0.0' },
+    {},
+    {},
+    new Set(),
+    {},
+    { 'https://example.test/engine': 'b'.repeat(64) },
+  );
+
+  assert.equal(outdated, 1);
+});
+
+test('checkRows detects an aria2 asset digest change when the provider supplies it', () => {
+  const url = 'https://github.com/aria2/aria2/releases/download/release-1.37.0/aria2-1.37.0-win-64bit-build1.zip';
+  const digest = 'b'.repeat(64);
+  const hashes = providerAssetHashes({
+    aria2: { assets: [{ browser_download_url: url, digest: `sha256:${digest}` }] },
+  });
+
+  const outdated = checkRows(
+    [{
+      target: 'x86_64-pc-windows-msvc',
+      engine: 'aria2c',
+      version: '1.37.0',
+      url,
+      sha256: 'a'.repeat(64),
+    }],
+    { aria2c: '1.37.0' },
+    {},
+    {},
+    new Set(),
+    {},
+    hashes,
+  );
+
+  assert.equal(outdated, 1);
+});
+
+test('npm executable selection uses the Windows command shim when needed', () => {
+  assert.equal(npmExecutable('win32'), 'npm.cmd');
+  assert.equal(npmExecutable('darwin'), 'npm');
+  assert.equal(npmExecutable('linux'), 'npm');
+});

scripts/engine-download.js

@@ -0,0 +1,243 @@
+import fs from 'node:fs';
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+import { sha256 } from './engine-payload-integrity.js';
+
+const DEFAULT_ATTEMPTS = 3;
+const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
+const DEFAULT_RETRY_DELAYS_MS = [2_000, 5_000];
+const FILE_RESET_RETRY_DELAYS_MS = [100, 250, 500, 1_000, 2_000];
+
+function parseContentRange(value) {
+  const match = /^bytes (\d+)-(\d+)\/(\d+|\*)$/.exec(value || '');
+  if (!match) return undefined;
+  const start = Number(match[1]);
+  const end = Number(match[2]);
+  const total = match[3] === '*' ? undefined : Number(match[3]);
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || end < start) {
+    return undefined;
+  }
+  if (total !== undefined && (!Number.isSafeInteger(total) || end >= total)) {
+    return undefined;
+  }
+  return { start, end, total };
+}
+
+function responseLength(response) {
+  const value = response.headers.get('content-length');
+  if (!value || !/^\d+$/.test(value)) return undefined;
+  const length = Number(value);
+  return Number.isSafeInteger(length) ? length : undefined;
+}
+
+function createDownloadTimeout(idleTimeoutMs) {
+  const controller = new AbortController();
+  let timer;
+  const refresh = () => {
+    clearTimeout(timer);
+    timer = setTimeout(() => {
+      controller.abort(new Error(`Download idle for ${idleTimeoutMs}ms`));
+    }, idleTimeoutMs);
+  };
+  const dispose = () => clearTimeout(timer);
+  refresh();
+  return { signal: controller.signal, refresh, dispose };
+}
+
+function abortReason(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  return new Error('Engine archive download aborted');
+}
+
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortReason(signal);
+}
+
+function combineAbortSignals(signals) {
+  const activeSignals = signals.filter(Boolean);
+  const controller = new AbortController();
+  const listeners = [];
+  const abort = signal => {
+    if (!controller.signal.aborted) controller.abort(abortReason(signal));
+  };
+
+  for (const signal of activeSignals) {
+    const listener = () => abort(signal);
+    listeners.push([signal, listener]);
+    if (signal.aborted) abort(signal);
+    else signal.addEventListener('abort', listener, { once: true });
+  }
+
+  return {
+    signal: controller.signal,
+    dispose() {
+      for (const [signal, listener] of listeners) {
+        signal.removeEventListener('abort', listener);
+      }
+    },
+  };
+}
+
+function archiveSize(archive) {
+  try {
+    return fs.statSync(archive).size;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return 0;
+    throw error;
+  }
+}
+
+function checksumMismatchError(name, expected, actual) {
+  const error = new Error(`Archive checksum mismatch for ${name}. Expected ${expected}, got ${actual}`);
+  error.code = 'ARCHIVE_CHECKSUM_MISMATCH';
+  return error;
+}
+
+function sleep(milliseconds, signal) {
+  if (!signal) return new Promise(resolve => setTimeout(resolve, milliseconds));
+  return new Promise((resolve, reject) => {
+    let timer;
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal.removeEventListener('abort', onAbort);
+    };
+    const finish = () => {
+      cleanup();
+      resolve();
+    };
+    const onAbort = () => {
+      cleanup();
+      reject(abortReason(signal));
+    };
+    timer = setTimeout(finish, milliseconds);
+    signal.addEventListener('abort', onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+}
+
+async function resetArchive(archive) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      fs.rmSync(archive, { force: true });
+      return;
+    } catch (error) {
+      const retryable = process.platform === 'win32'
+        && ['EACCES', 'EBUSY', 'EPERM'].includes(error?.code);
+      if (!retryable || attempt >= FILE_RESET_RETRY_DELAYS_MS.length) throw error;
+      await sleep(FILE_RESET_RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
+
+/**
+ * Download and checksum an engine archive, resuming an interrupted response
+ * when the provider honors HTTP range requests. A provider that ignores the
+ * range is handled safely by replacing the partial file instead of appending
+ * a second full archive to it.
+ */
+export async function downloadEngineArchive({
+  name,
+  url,
+  archive,
+  expectedSha256,
+  attempts = DEFAULT_ATTEMPTS,
+  idleTimeoutMs = DEFAULT_IDLE_TIMEOUT_MS,
+  retryDelaysMs = DEFAULT_RETRY_DELAYS_MS,
+  signal,
+}) {
+  let lastError;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    throwIfAborted(signal);
+    const partialSize = archiveSize(archive);
+    if (partialSize > 0 && sha256(archive) === expectedSha256) return archive;
+    const downloadTimeout = createDownloadTimeout(idleTimeoutMs);
+    const requestSignal = combineAbortSignals([signal, downloadTimeout.signal]);
+    let resetForRetry = false;
+
+    try {
+      const response = await fetch(url, {
+        headers: partialSize > 0 ? { Range: `bytes=${partialSize}-` } : undefined,
+        redirect: 'follow',
+        signal: requestSignal.signal,
+      });
+
+      if (response.status === 416 && partialSize > 0) {
+        await response.body?.cancel();
+        resetForRetry = true;
+        throw new Error(`Retained partial archive range is not satisfiable for ${name}`);
+      }
+
+      if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        throw new Error(`Failed to download ${name}: HTTP ${response.status}`);
+      }
+
+      const contentRange = response.status === 206
+        ? parseContentRange(response.headers.get('content-range'))
+        : undefined;
+      if (response.status === 206 && (!contentRange || contentRange.start !== partialSize)) {
+        await response.body.cancel();
+        throw new Error(`Invalid Content-Range while downloading ${name}`);
+      }
+
+      const append = response.status === 206 && partialSize > 0;
+      const expectedResponseLength = responseLength(response);
+      if (!append && partialSize > 0) {
+        // The provider ignored Range and returned the complete archive.
+        await resetArchive(archive);
+      }
+
+      await pipeline(
+        Readable.fromWeb(response.body),
+        new Transform({
+          transform(chunk, encoding, callback) {
+            downloadTimeout.refresh();
+            callback(null, chunk, encoding);
+          },
+        }),
+        fs.createWriteStream(archive, { flags: append ? 'a' : 'w' }),
+        { signal: requestSignal.signal },
+      );
+
+      throwIfAborted(signal);
+      const finalSize = archiveSize(archive);
+      const expectedFinalSize = contentRange?.total
+        ?? (expectedResponseLength === undefined
+          ? undefined
+          : (append ? partialSize + expectedResponseLength : expectedResponseLength));
+      if (expectedFinalSize !== undefined && finalSize !== expectedFinalSize) {
+        throw new Error(
+          `Incomplete archive for ${name}: expected ${expectedFinalSize} bytes, got ${finalSize}`,
+        );
+      }
+
+      const actual = sha256(archive);
+      if (actual === expectedSha256) return archive;
+
+      resetForRetry = true;
+      throw checksumMismatchError(name, expectedSha256, actual);
+    } catch (error) {
+      if (signal?.aborted) throw abortReason(signal);
+      lastError = error;
+      if (resetForRetry || error?.code === 'ARCHIVE_CHECKSUM_MISMATCH') {
+        await resetArchive(archive);
+      }
+      if (attempt === attempts) {
+        throw new Error(
+          `Failed to download ${name} after ${attempts} attempts: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+          { cause: error },
+        );
+      }
+      await sleep(retryDelaysMs[attempt - 1] ?? 0, signal);
+    } finally {
+      requestSignal.dispose();
+      downloadTimeout.dispose();
+    }
+  }
+
+  throw lastError;
+}

scripts/engine-download.node-test.js

@@ -0,0 +1,227 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { test } from 'node:test';
+
+import { downloadEngineArchive } from './engine-download.js';
+
+async function withMockFetch(mockFetch, callback) {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = mockFetch;
+  try {
+    return await callback();
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+}
+
+function makeBody(chunks, failure) {
+  return new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) controller.enqueue(Buffer.from(chunk));
+      if (failure) controller.error(failure);
+      else controller.close();
+    },
+  });
+}
+
+function makeArchivePath() {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-engine-download-'));
+  return {
+    directory,
+    archive: path.join(directory, 'engine.zip'),
+  };
+}
+
+function digest(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+test('resumes an interrupted archive response from the retained partial file', async () => {
+  const { directory, archive } = makeArchivePath();
+  const full = Buffer.from('complete archive payload');
+  const prefix = full.subarray(0, 8);
+  const middle = full.subarray(8, 15);
+  const suffix = full.subarray(15);
+  fs.writeFileSync(archive, Buffer.concat([prefix, middle]));
+  const ranges = [];
+  let calls = 0;
+
+  try {
+    await withMockFetch(async (_url, options) => {
+      calls += 1;
+      ranges.push(options.headers?.Range);
+      if (calls === 1) {
+        return new Response(makeBody([], new Error('connection reset')), {
+          status: 206,
+          headers: {
+            'Content-Length': String(suffix.length),
+            'Content-Range': `bytes ${prefix.length + middle.length}-${full.length - 1}/${full.length}`,
+          },
+        });
+      }
+      return new Response(makeBody([suffix]), {
+        status: 206,
+        headers: {
+          'Content-Length': String(suffix.length),
+          'Content-Range': `bytes ${prefix.length + middle.length}-${full.length - 1}/${full.length}`,
+        },
+      });
+    }, async () => {
+      await downloadEngineArchive({
+        name: 'test',
+        url: 'https://example.test/engine.zip',
+        archive,
+        expectedSha256: digest(full),
+        attempts: 2,
+        retryDelaysMs: [0],
+      });
+    });
+
+    assert.deepEqual(
+      ranges,
+      [`bytes=${prefix.length + middle.length}-`, `bytes=${prefix.length + middle.length}-`],
+    );
+    assert.deepEqual(fs.readFileSync(archive), full);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('replaces a partial archive when the provider ignores the Range request', async () => {
+  const { directory, archive } = makeArchivePath();
+  const full = Buffer.from('complete archive after range fallback');
+  fs.writeFileSync(archive, Buffer.from('stale partial bytes'));
+  let requestedRange;
+
+  try {
+    await withMockFetch(async (_url, options) => {
+      requestedRange = options.headers?.Range;
+      return new Response(full, {
+        status: 200,
+        headers: { 'Content-Length': String(full.length) },
+      });
+    }, async () => {
+      await downloadEngineArchive({
+        name: 'test',
+        url: 'https://example.test/engine.zip',
+        archive,
+        expectedSha256: digest(full),
+        attempts: 1,
+      });
+    });
+
+    assert.equal(requestedRange, 'bytes=19-');
+    assert.deepEqual(fs.readFileSync(archive), full);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('accepts a complete retained archive without issuing an unsatisfiable range', async () => {
+  const { directory, archive } = makeArchivePath();
+  const full = Buffer.from('complete archive retained after a late connection reset');
+  fs.writeFileSync(archive, full);
+  let calls = 0;
+
+  try {
+    await withMockFetch(async () => {
+      calls += 1;
+      throw new Error('fetch should not be called for a complete retained archive');
+    }, async () => {
+      await downloadEngineArchive({
+        name: 'test',
+        url: 'https://example.test/engine.zip',
+        archive,
+        expectedSha256: digest(full),
+        attempts: 1,
+      });
+    });
+
+    assert.equal(calls, 0);
+    assert.deepEqual(fs.readFileSync(archive), full);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('restarts from zero after an unsatisfiable retained range', async () => {
+  const { directory, archive } = makeArchivePath();
+  const full = Buffer.from('complete archive after a stale range response');
+  fs.writeFileSync(archive, Buffer.from('stale partial bytes'));
+  const ranges = [];
+  let calls = 0;
+
+  try {
+    await withMockFetch(async (_url, options) => {
+      calls += 1;
+      ranges.push(options.headers?.Range);
+      if (calls === 1) return new Response(null, { status: 416 });
+      return new Response(full, {
+        status: 200,
+        headers: { 'Content-Length': String(full.length) },
+      });
+    }, async () => {
+      await downloadEngineArchive({
+        name: 'test',
+        url: 'https://example.test/engine.zip',
+        archive,
+        expectedSha256: digest(full),
+        attempts: 2,
+        retryDelaysMs: [0],
+      });
+    });
+
+    assert.deepEqual(ranges, ['bytes=19-', undefined]);
+    assert.deepEqual(fs.readFileSync(archive), full);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('propagates external cancellation without retrying an in-flight archive', async () => {
+  const { directory, archive } = makeArchivePath();
+  const abortController = new AbortController();
+  let calls = 0;
+
+  try {
+    await withMockFetch(async (_url, options) => {
+      calls += 1;
+      assert.equal(options.signal.aborted, false);
+      setTimeout(() => {
+        abortController.abort(new Error('provisioning interrupted'));
+      }, 10);
+      return new Response(new ReadableStream({
+        start(controller) {
+          controller.enqueue(Buffer.from('partial archive bytes'));
+        },
+      }), {
+        status: 200,
+        headers: { 'Content-Length': '100' },
+      });
+    }, async () => {
+      await assert.rejects(
+        downloadEngineArchive({
+          name: 'test',
+          url: 'https://example.test/engine.zip',
+          archive,
+          expectedSha256: digest(Buffer.from('never completed')),
+          attempts: 3,
+          retryDelaysMs: [500, 500],
+          signal: abortController.signal,
+        }),
+        error => {
+          assert.match(error.message, /provisioning interrupted/);
+          return true;
+        },
+      );
+    });
+
+    assert.equal(calls, 1);
+    assert.ok(fs.statSync(archive).size > 0);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});

scripts/engine-payload-promotion.js

@@ -0,0 +1,164 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const RETRY_DELAYS_MS = [100, 250, 500, 1_000, 2_000];
+
+function pathExists(value) {
+  try {
+    fs.lstatSync(value);
+    return true;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+function previousPayloadPrefix(destination) {
+  return `.${path.basename(destination)}.previous-`;
+}
+
+function previousPayloads(destination) {
+  const parent = path.dirname(destination);
+  const prefix = previousPayloadPrefix(destination);
+  return fs.readdirSync(parent, { withFileTypes: true })
+    .filter(entry => entry.name.startsWith(prefix))
+    .map(entry => path.join(parent, entry.name));
+}
+
+function previousPayloadOwner(destination, candidate) {
+  const suffix = path.basename(candidate).slice(previousPayloadPrefix(destination).length);
+  const separator = suffix.indexOf('-');
+  const pid = separator >= 0 ? suffix.slice(0, separator) : suffix;
+  return /^\d+$/.test(pid) ? Number(pid) : null;
+}
+
+function isProcessAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === 'EPERM';
+  }
+}
+
+async function removeOrphanedPreviousPayloads(destination) {
+  for (const candidate of previousPayloads(destination)) {
+    const owner = previousPayloadOwner(destination, candidate);
+    if (owner === null || isProcessAlive(owner)) continue;
+    await removePathWithRetry(candidate);
+  }
+}
+
+function provisioningTemporaryPrefix(target) {
+  return `.firelink-engines-${target}-`;
+}
+
+function provisioningTemporaryOwner(target, candidate) {
+  const suffix = path.basename(candidate).slice(provisioningTemporaryPrefix(target).length);
+  const separator = suffix.indexOf('-');
+  const pid = separator >= 0 ? suffix.slice(0, separator) : suffix;
+  return /^\d+$/.test(pid) ? Number(pid) : null;
+}
+
+/**
+ * Removes only staging directories created by a provisioner whose PID is no
+ * longer alive. Legacy directories without an owner PID remain untouched so
+ * a concurrent or ambiguous provisioner can never lose its staging tree.
+ */
+export async function removeOrphanedProvisioningDirectories(destinationParent, target) {
+  const prefix = provisioningTemporaryPrefix(target);
+  for (const entry of fs.readdirSync(destinationParent, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !entry.name.startsWith(prefix)) continue;
+    const candidate = path.join(destinationParent, entry.name);
+    const owner = provisioningTemporaryOwner(target, candidate);
+    if (owner === null || owner === process.pid || isProcessAlive(owner)) continue;
+    await removePathWithRetry(candidate);
+  }
+}
+
+/**
+ * Restores the only previous payload left by a process that died after moving
+ * the destination aside but before publishing its replacement. Multiple
+ * candidates are ambiguous and remain untouched for manual recovery.
+ */
+export function recoverInterruptedPromotion(destination) {
+  if (pathExists(destination)) return;
+
+  const candidates = previousPayloads(destination);
+  if (candidates.length === 0) return;
+  if (candidates.length > 1) {
+    throw new Error(
+      `Cannot recover engine payload at ${destination}: found ${candidates.length} previous payloads`
+    );
+  }
+
+  const candidate = candidates[0];
+  if (!fs.lstatSync(candidate).isDirectory()) {
+    throw new Error(`Cannot recover engine payload from non-directory backup: ${candidate}`);
+  }
+  fs.renameSync(candidate, destination);
+}
+
+function sleep(milliseconds) {
+  return new Promise(resolve => setTimeout(resolve, milliseconds));
+}
+
+export async function removePathWithRetry(value) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      fs.rmSync(value, { recursive: true, force: true });
+      return;
+    } catch (error) {
+      const retryable = process.platform === 'win32'
+        && ['EACCES', 'EBUSY', 'EPERM'].includes(error?.code);
+      if (!retryable || attempt >= RETRY_DELAYS_MS.length) throw error;
+      await sleep(RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
+
+/**
+ * Publishes a fully verified payload without exposing a partially written
+ * directory. The staging directory must share a filesystem with destination.
+ */
+export async function promoteDirectory(staging, destination) {
+  recoverInterruptedPromotion(destination);
+  const stagingStats = fs.lstatSync(staging);
+  if (!stagingStats.isDirectory()) {
+    throw new Error(`Engine payload staging path is not a directory: ${staging}`);
+  }
+
+  const parent = path.dirname(destination);
+  const backup = path.join(
+    parent,
+    `.${path.basename(destination)}.previous-${process.pid}-${process.hrtime.bigint()}`
+  );
+  let movedExisting = false;
+
+  try {
+    if (pathExists(destination)) {
+      fs.renameSync(destination, backup);
+      movedExisting = true;
+    }
+    fs.renameSync(staging, destination);
+  } catch (error) {
+    if (movedExisting && !pathExists(destination) && pathExists(backup)) {
+      try {
+        fs.renameSync(backup, destination);
+      } catch (restoreError) {
+        throw new AggregateError(
+          [error, restoreError],
+          `Failed to publish engine payload and restore the previous payload at ${destination}`
+        );
+      }
+    } else if (movedExisting && pathExists(destination) && pathExists(backup)) {
+      // Another provisioner won the promotion race; discard only our backup.
+      await removePathWithRetry(backup);
+    }
+    throw error;
+  }
+
+  if (movedExisting) await removePathWithRetry(backup);
+  await removeOrphanedPreviousPayloads(destination);
+}

scripts/engine-payload-promotion.node-test.js

@@ -0,0 +1,150 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import {
+  promoteDirectory,
+  recoverInterruptedPromotion,
+  removeOrphanedProvisioningDirectories,
+  removePathWithRetry,
+} from './engine-payload-promotion.js';
+
+function temporaryDirectory() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-payload-promotion-'));
+}
+
+test('promotes a verified staging directory and replaces the previous payload', async () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const staging = path.join(root, 'staging', 'payload');
+    fs.mkdirSync(destination, { recursive: true });
+    fs.writeFileSync(path.join(destination, 'engine'), 'old');
+    fs.mkdirSync(staging, { recursive: true });
+    fs.writeFileSync(path.join(staging, 'engine'), 'new');
+
+    await promoteDirectory(staging, destination);
+
+    assert.equal(fs.readFileSync(path.join(destination, 'engine'), 'utf8'), 'new');
+    assert.equal(fs.existsSync(staging), false);
+    assert.equal(fs.readdirSync(root).some(name => name.includes('.previous-')), false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects an invalid staging path without removing the previous payload', async () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const staging = path.join(root, 'staging-file');
+    fs.mkdirSync(destination, { recursive: true });
+    fs.writeFileSync(path.join(destination, 'engine'), 'old');
+    fs.writeFileSync(staging, 'not a directory');
+
+    await assert.rejects(() => promoteDirectory(staging, destination), /not a directory/);
+    assert.equal(fs.readFileSync(path.join(destination, 'engine'), 'utf8'), 'old');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('recovers one interrupted previous payload before publishing a replacement', async () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const backup = path.join(root, '.target.previous-123-456');
+    const staging = path.join(root, 'staging', 'payload');
+    fs.mkdirSync(backup, { recursive: true });
+    fs.writeFileSync(path.join(backup, 'engine'), 'old');
+    fs.mkdirSync(staging, { recursive: true });
+    fs.writeFileSync(path.join(staging, 'engine'), 'new');
+
+    await promoteDirectory(staging, destination);
+
+    assert.equal(fs.readFileSync(path.join(destination, 'engine'), 'utf8'), 'new');
+    assert.equal(fs.existsSync(backup), false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('fails closed when interrupted recovery has multiple candidates', () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const firstBackup = path.join(root, '.target.previous-123-456');
+    const secondBackup = path.join(root, '.target.previous-789-012');
+    fs.mkdirSync(firstBackup, { recursive: true });
+    fs.mkdirSync(secondBackup, { recursive: true });
+
+    assert.throws(
+      () => recoverInterruptedPromotion(destination),
+      /found 2 previous payloads/
+    );
+    assert.equal(fs.existsSync(destination), false);
+    assert.equal(fs.existsSync(firstBackup), true);
+    assert.equal(fs.existsSync(secondBackup), true);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('removes a temporary payload tree after it becomes disposable', async () => {
+  const root = temporaryDirectory();
+  try {
+    const temporary = path.join(root, 'temporary');
+    fs.mkdirSync(path.join(temporary, 'nested'), { recursive: true });
+    fs.writeFileSync(path.join(temporary, 'nested', 'archive'), 'payload');
+
+    await removePathWithRetry(temporary);
+
+    assert.equal(fs.existsSync(temporary), false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('removes orphaned backups from dead provisioners after a successful publish', async () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const orphanedBackup = path.join(root, '.target.previous-999999999-123456');
+    const staging = path.join(root, 'staging', 'payload');
+    fs.mkdirSync(destination, { recursive: true });
+    fs.writeFileSync(path.join(destination, 'engine'), 'old');
+    fs.mkdirSync(orphanedBackup, { recursive: true });
+    fs.writeFileSync(path.join(orphanedBackup, 'engine'), 'orphaned');
+    fs.mkdirSync(staging, { recursive: true });
+    fs.writeFileSync(path.join(staging, 'engine'), 'new');
+
+    await promoteDirectory(staging, destination);
+
+    assert.equal(fs.existsSync(orphanedBackup), false);
+    assert.equal(fs.readFileSync(path.join(destination, 'engine'), 'utf8'), 'new');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('removes only provisioning staging owned by a dead PID', async () => {
+  const root = temporaryDirectory();
+  try {
+    const target = 'x86_64-unknown-linux-gnu';
+    const orphaned = path.join(root, `.firelink-engines-${target}-999999999-dead`);
+    const live = path.join(root, `.firelink-engines-${target}-${process.pid}-live`);
+    const legacy = path.join(root, `.firelink-engines-${target}-legacy`);
+    fs.mkdirSync(orphaned, { recursive: true });
+    fs.mkdirSync(live, { recursive: true });
+    fs.mkdirSync(legacy, { recursive: true });
+
+    await removeOrphanedProvisioningDirectories(root, target);
+
+    assert.equal(fs.existsSync(orphaned), false);
+    assert.equal(fs.existsSync(live), true);
+    assert.equal(fs.existsSync(legacy), true);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

scripts/provision-engines.js

@@ -1,13 +1,21 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
 import { collectRegularFiles, sha256 } from './engine-payload-integrity.js';
+import { downloadEngineArchive } from './engine-download.js';
+import {
+  promoteDirectory,
+  recoverInterruptedPromotion,
+  removeOrphanedProvisioningDirectories,
+  removePathWithRetry,
+} from './engine-payload-promotion.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, '..');
+const execFileAsync = promisify(execFile);
 const sourceLock = JSON.parse(
   fs.readFileSync(path.join(repoRoot, 'engine-sources.lock.json'), 'utf8')
 );
@@ -32,42 +40,61 @@ if (!targetSources) {
 }
 
 const destination = path.join(repoRoot, 'src-tauri', 'provisioned-engines', target);
-const temporary = fs.mkdtempSync(path.join(os.tmpdir(), `firelink-engines-${target}-`));
 const isWindows = target.includes('windows');
 const executableSuffix = isWindows ? '.exe' : '';
+const provisioningAbortController = new AbortController();
+const signalNames = process.platform === 'win32'
+  ? ['SIGINT', 'SIGTERM']
+  : ['SIGINT', 'SIGTERM', 'SIGHUP'];
+const signalHandlers = new Map();
+for (const signalName of signalNames) {
+  const handler = () => {
+    if (!provisioningAbortController.signal.aborted) {
+      provisioningAbortController.abort(new Error(`Engine provisioning interrupted by ${signalName}`));
+    }
+  };
+  signalHandlers.set(signalName, handler);
+  process.on(signalName, handler);
+}
+
+let temporary;
+let payloadDestination;
+
+function throwIfProvisioningAborted() {
+  if (provisioningAbortController.signal.aborted) {
+    throw provisioningAbortController.signal.reason;
+  }
+}
 
 async function download(name, source) {
+  throwIfProvisioningAborted();
   const sourcePath = new URL(source.url).pathname;
   const archive = path.join(
     temporary,
     `${name}${sourcePath.endsWith('.tar.xz') ? '.tar.xz' : '.zip'}`
   );
-  const response = await fetch(source.url, { redirect: 'follow' });
-  if (!response.ok || !response.body) {
-    throw new Error(`Failed to download ${name}: HTTP ${response.status}`);
-  }
-  const output = fs.createWriteStream(archive);
-  const reader = response.body.getReader();
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    if (!output.write(Buffer.from(value))) {
-      await new Promise(resolve => output.once('drain', resolve));
-    }
-  }
-  await new Promise(resolve => output.end(resolve));
-
-  const actual = sha256(archive);
-  if (actual !== source.sha256) {
-    throw new Error(`Archive checksum mismatch for ${name}. Expected ${source.sha256}, got ${actual}`);
-  }
+  await downloadEngineArchive({
+    name,
+    url: source.url,
+    archive,
+    expectedSha256: source.sha256,
+    signal: provisioningAbortController.signal,
+  });
+  throwIfProvisioningAborted();
   const extracted = path.join(temporary, `${name}-extracted`);
   fs.mkdirSync(extracted);
   if (archive.endsWith('.zip') && process.platform !== 'win32') {
-    execFileSync('unzip', ['-q', archive, '-d', extracted], { stdio: 'inherit' });
+    await execFileAsync('unzip', ['-q', archive, '-d', extracted], {
+      stdio: 'inherit',
+      signal: provisioningAbortController.signal,
+    });
   } else {
-    execFileSync('tar', ['-xf', archive, '-C', extracted], { stdio: 'inherit' });
+    await execFileAsync('tar', ['-xf', archive, '-C', extracted], {
+      stdio: 'inherit',
+      signal: provisioningAbortController.signal,
+    });
   }
+  throwIfProvisioningAborted();
   return extracted;
 }
 
@@ -89,13 +116,13 @@ function findFile(root, names) {
 }
 
 function copyExecutable(source, engine) {
-  const output = path.join(destination, `${engine}-${target}${executableSuffix}`);
+  const output = path.join(payloadDestination, `${engine}-${target}${executableSuffix}`);
   fs.copyFileSync(source, output);
   if (!isWindows) fs.chmodSync(output, 0o755);
 }
 
 function writePayloadManifest() {
-  const files = collectRegularFiles(destination, {
+  const files = collectRegularFiles(payloadDestination, {
     ignoredNames: ['payload-manifest.json'],
   });
   const manifest = {
@@ -113,27 +140,36 @@ function writePayloadManifest() {
     ),
     files: Object.fromEntries(
       files.map(file => [
-        path.relative(destination, file).split(path.sep).join('/'),
+        path.relative(payloadDestination, file).split(path.sep).join('/'),
         sha256(file)
       ])
     )
   };
   fs.writeFileSync(
-    path.join(destination, 'payload-manifest.json'),
+    path.join(payloadDestination, 'payload-manifest.json'),
     `${JSON.stringify(manifest, null, 2)}\n`
   );
 }
 
 try {
-  fs.rmSync(destination, { recursive: true, force: true });
-  fs.mkdirSync(destination, { recursive: true });
+  const destinationParent = path.dirname(destination);
+  fs.mkdirSync(destinationParent, { recursive: true });
+  recoverInterruptedPromotion(destination);
+  await removeOrphanedProvisioningDirectories(destinationParent, target);
+  throwIfProvisioningAborted();
+  // Keep staging on the destination filesystem so the final rename is atomic.
+  temporary = fs.mkdtempSync(
+    path.join(destinationParent, `.firelink-engines-${target}-${process.pid}-`)
+  );
+  payloadDestination = path.join(temporary, 'payload');
+  fs.mkdirSync(payloadDestination, { recursive: true });
 
   const ytdlp = await download('yt-dlp', targetSources['yt-dlp']);
   copyExecutable(
     findFile(ytdlp, isWindows ? ['yt-dlp.exe'] : ['yt-dlp_linux']),
     'yt-dlp'
   );
-  fs.cpSync(path.join(ytdlp, '_internal'), path.join(destination, '_internal'), {
+  fs.cpSync(path.join(ytdlp, '_internal'), path.join(payloadDestination, '_internal'), {
     recursive: true,
     preserveTimestamps: true
   });
@@ -148,7 +184,12 @@ try {
   copyExecutable(findFile(aria2, isWindows ? ['aria2c.exe'] : ['aria2c']), 'aria2c');
 
   writePayloadManifest();
+  throwIfProvisioningAborted();
+  await promoteDirectory(payloadDestination, destination);
   console.log(`Provisioned locked engine payload at ${destination}`);
 } finally {
-  fs.rmSync(temporary, { recursive: true, force: true });
+  if (temporary) await removePathWithRetry(temporary);
+  for (const [signalName, handler] of signalHandlers) {
+    process.removeListener(signalName, handler);
+  }
 }

scripts/release-workflow.node-test.js

@@ -0,0 +1,25 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { test } from 'node:test';
+
+const repositoryRoot = path.resolve(import.meta.dirname, '..');
+const releaseWorkflow = fs.readFileSync(
+  path.join(repositoryRoot, '.github', 'workflows', 'release.yml'),
+  'utf8',
+);
+
+test('release Linux dependency installation is mirror-normalized and bounded', () => {
+  assert.match(releaseWorkflow, /azure\\\.archive\\\.ubuntu\\\.com/);
+  assert.equal((releaseWorkflow.match(/Acquire::Retries=3/g) || []).length, 2);
+  assert.equal((releaseWorkflow.match(/timeout --foreground --signal=TERM --kill-after=30s 10m apt-get/g) || []).length, 2);
+  assert.doesNotMatch(releaseWorkflow, /^\s*sudo apt-get (update|install)/m);
+});
+
+test('macOS release verification uses the app mounted from the final DMG', () => {
+  assert.match(releaseWorkflow, /npm run verify:macos-signing -- --dmg "\$DMG"/);
+  assert.match(releaseWorkflow, /hdiutil attach -nobrowse -readonly -mountpoint "\$MOUNT_POINT" "\$DMG"/);
+  assert.match(releaseWorkflow, /find "\$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink\.app'/);
+  assert.match(releaseWorkflow, /node scripts\/verify-binaries\.js --search-root "\$APP"/);
+  assert.doesNotMatch(releaseWorkflow, /verify:macos-signing -- --app "\$APP" --dmg/);
+});

scripts/smoke-aria2-resolver.js

@@ -0,0 +1,232 @@
+#!/usr/bin/env node
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import http from 'node:http';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const arch = { x64: 'x86_64', arm64: 'aarch64' }[os.arch()];
+const platform = {
+  darwin: 'apple-darwin',
+  linux: 'unknown-linux-gnu',
+  win32: 'pc-windows-msvc',
+}[process.platform];
+if (!arch || !platform) {
+  throw new Error(`Unsupported host: ${os.arch()} / ${process.platform}`);
+}
+const targetTriple = `${arch}-${platform}`;
+const argumentIndex = process.argv.indexOf('--binary');
+const binaryPath = path.resolve(
+  argumentIndex >= 0
+    ? process.argv[argumentIndex + 1]
+    : path.join(
+        repoRoot,
+        'src-tauri',
+        'binaries',
+        `aria2c-${targetTriple}${process.platform === 'win32' ? '.exe' : ''}`,
+      ),
+);
+
+if (!fs.existsSync(binaryPath)) {
+  throw new Error(`Aria2 binary does not exist: ${binaryPath}`);
+}
+
+const wait = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
+
+async function availablePort() {
+  const server = net.createServer();
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen({ host: '127.0.0.1', port: 0 }, resolve);
+  });
+  const address = server.address();
+  const port = address && typeof address !== 'string' ? address.port : undefined;
+  await new Promise(resolve => server.close(resolve));
+  if (!port) throw new Error('Could not reserve a local port');
+  return port;
+}
+
+async function rpc(port, secret, method, params = []) {
+  const response = await fetch(`http://127.0.0.1:${port}/jsonrpc`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      jsonrpc: '2.0',
+      id: crypto.randomUUID(),
+      method,
+      params: [`token:${secret}`, ...params],
+    }),
+    signal: AbortSignal.timeout(3000),
+  });
+  const body = await response.json();
+  if (body.error) throw new Error(`${method}: ${JSON.stringify(body.error)}`);
+  if (!Object.hasOwn(body, 'result')) throw new Error(`${method}: response has no result`);
+  return body.result;
+}
+
+function childExited(child) {
+  return child.exitCode !== null || child.signalCode !== null;
+}
+
+async function waitForChildExit(child, timeoutMs = 3000) {
+  if (childExited(child)) return true;
+  return new Promise(resolve => {
+    let settled = false;
+    let timer;
+    const finish = result => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.off('exit', onExit);
+      resolve(result);
+    };
+    const onExit = () => finish(true);
+    timer = setTimeout(() => finish(false), timeoutMs);
+    child.once('exit', onExit);
+    if (childExited(child)) finish(true);
+  });
+}
+
+async function waitForRpc(port, secret) {
+  const deadline = Date.now() + 10000;
+  let lastError;
+  while (Date.now() < deadline) {
+    try {
+      return await rpc(port, secret, 'aria2.getVersion');
+    } catch (error) {
+      lastError = error;
+      await wait(100);
+    }
+  }
+  throw new Error(`Aria2 RPC did not become ready: ${lastError?.message || 'unknown error'}`);
+}
+
+function bencode(value) {
+  if (Buffer.isBuffer(value)) return Buffer.concat([Buffer.from(`${value.length}:`), value]);
+  if (typeof value === 'string') return bencode(Buffer.from(value));
+  if (typeof value === 'number') return Buffer.from(`i${value}e`);
+  if (value && typeof value === 'object') {
+    const entries = Object.entries(value).sort(([left], [right]) => Buffer.compare(Buffer.from(left), Buffer.from(right)));
+    return Buffer.concat([
+      Buffer.from('d'),
+      ...entries.flatMap(([key, child]) => [bencode(key), bencode(child)]),
+      Buffer.from('e'),
+    ]);
+  }
+  throw new Error(`Unsupported bencode value: ${typeof value}`);
+}
+
+async function stop(child, port, secret) {
+  if (!child || childExited(child)) return;
+  try {
+    await rpc(port, secret, 'aria2.shutdown');
+  } catch {
+    // The process may already have exited.
+  }
+  let exited = await waitForChildExit(child);
+  if (!exited) {
+    if (process.platform === 'win32') {
+      try {
+        execFileSync('taskkill', ['/pid', String(child.pid), '/t', '/f'], {
+          stdio: 'ignore',
+          timeout: 3000,
+        });
+      } catch {
+        // The process may have exited between the timeout and taskkill.
+      }
+    } else {
+      child.kill('SIGTERM');
+    }
+    exited = await waitForChildExit(child);
+  }
+  if (!exited && process.platform !== 'win32') {
+    child.kill('SIGKILL');
+    exited = await waitForChildExit(child);
+  }
+  if (!exited) {
+    throw new Error(`Aria2 process ${child.pid} did not exit after forced cleanup`);
+  }
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-aria2-resolver-'));
+const secret = `firelink-resolver-${crypto.randomUUID()}`;
+const rpcPort = await availablePort();
+const contentServer = http.createServer((_request, response) => {
+  response.writeHead(200, { 'content-length': '1' });
+  response.end('x');
+});
+await new Promise((resolve, reject) => {
+  contentServer.once('error', reject);
+  contentServer.listen({ host: '127.0.0.1', port: 0 }, resolve);
+});
+const contentPort = contentServer.address().port;
+const libraryPath = path.join(path.dirname(binaryPath), 'aria2-libs');
+const environment = fs.existsSync(libraryPath)
+  ? {
+      ...process.env,
+      OPENSSL_MODULES: libraryPath,
+      ...(process.platform === 'darwin' ? { DYLD_LIBRARY_PATH: libraryPath } : {}),
+    }
+  : process.env;
+const child = spawn(binaryPath, [
+  '--enable-rpc=true',
+  `--rpc-listen-port=${rpcPort}`,
+  '--rpc-listen-all=false',
+  `--rpc-secret=${secret}`,
+  `--dir=${tempRoot}`,
+  '--file-allocation=none',
+  '--enable-dht=false',
+  '--console-log-level=error',
+  '--quiet=true',
+], { env: environment, stdio: ['ignore', 'ignore', 'pipe'] });
+let stderr = '';
+child.stderr.on('data', chunk => { stderr += chunk.toString(); });
+
+try {
+  const version = await waitForRpc(rpcPort, secret);
+  const features = Array.isArray(version.enabledFeatures) ? version.enabledFeatures : [];
+  console.log(`[INFO] aria2 ${version.version || 'unknown'}; Async DNS: ${features.includes('Async DNS') ? 'supported' : 'not advertised'}`);
+
+  const uriResult = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${contentPort}/file`], {
+    'async-dns': 'false',
+    out: 'resolver-normal.bin',
+  }]);
+  const uriOptions = await rpc(rpcPort, secret, 'aria2.getOption', [uriResult]);
+  if (uriOptions['async-dns'] !== 'false') {
+    throw new Error(`aria2.addUri did not retain async-dns=false: ${JSON.stringify(uriOptions)}`);
+  }
+
+  const torrent = bencode({
+    info: {
+      length: 1,
+      name: 'resolver-torrent.bin',
+      pieces: Buffer.alloc(20),
+      'piece length': 16384,
+    },
+  }).toString('base64');
+  const torrentResult = await rpc(rpcPort, secret, 'aria2.addTorrent', [torrent, [], {
+    'async-dns': 'false',
+    dir: tempRoot,
+  }]);
+  const torrentOptions = await rpc(rpcPort, secret, 'aria2.getOption', [torrentResult]);
+  if (torrentOptions['async-dns'] !== 'false') {
+    throw new Error(`aria2.addTorrent did not retain async-dns=false: ${JSON.stringify(torrentOptions)}`);
+  }
+
+  console.log('[PASS] Aria2 retained system-resolver mode for normal and Torrent transfers');
+} catch (error) {
+  const detail = stderr.trim();
+  throw new Error(`${error.message}${detail ? `\n${detail}` : ''}`);
+} finally {
+  try {
+    await stop(child, rpcPort, secret);
+  } finally {
+    await new Promise(resolve => contentServer.close(resolve));
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}

scripts/smoke-aria2-transfers.js

@@ -0,0 +1,486 @@
+#!/usr/bin/env node
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import http from 'node:http';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const arch = { x64: 'x86_64', arm64: 'aarch64' }[os.arch()];
+const platform = { darwin: 'apple-darwin', linux: 'unknown-linux-gnu', win32: 'pc-windows-msvc' }[process.platform];
+if (!arch || !platform) throw new Error(`Unsupported host: ${os.arch()} / ${process.platform}`);
+const targetTriple = `${arch}-${platform}`;
+const argumentIndex = process.argv.indexOf('--binary');
+const binaryPath = path.resolve(argumentIndex >= 0
+  ? process.argv[argumentIndex + 1]
+  : path.join(repoRoot, 'src-tauri', 'binaries', `aria2c-${targetTriple}${process.platform === 'win32' ? '.exe' : ''}`));
+if (!fs.existsSync(binaryPath)) throw new Error(`Aria2 binary does not exist: ${binaryPath}`);
+
+const wait = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
+
+async function listen(server) {
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen({ host: '127.0.0.1', port: 0 }, resolve);
+  });
+  const address = server.address();
+  if (!address || typeof address === 'string') throw new Error('Could not allocate local fixture port');
+  return address.port;
+}
+
+async function availablePort() {
+  const server = net.createServer();
+  const port = await listen(server);
+  await new Promise(resolve => server.close(resolve));
+  return port;
+}
+
+async function rpc(port, secret, method, params = []) {
+  const response = await fetch(`http://127.0.0.1:${port}/jsonrpc`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      jsonrpc: '2.0',
+      id: crypto.randomUUID(),
+      method,
+      params: [`token:${secret}`, ...params],
+    }),
+    signal: AbortSignal.timeout(5000),
+  });
+  const body = await response.json();
+  if (body.error) throw new Error(`${method}: ${JSON.stringify(body.error)}`);
+  if (!Object.hasOwn(body, 'result')) throw new Error(`${method}: response has no result`);
+  return body.result;
+}
+
+async function waitForRpc(port, secret) {
+  const deadline = Date.now() + 10000;
+  let lastError;
+  while (Date.now() < deadline) {
+    try {
+      return await rpc(port, secret, 'aria2.getVersion');
+    } catch (error) {
+      lastError = error;
+      await wait(100);
+    }
+  }
+  throw new Error(`Aria2 RPC did not become ready: ${lastError?.message || 'unknown error'}`);
+}
+
+async function waitForTerminal(port, secret, gid, timeoutMs = 20000) {
+  const deadline = Date.now() + timeoutMs;
+  let latest;
+  while (Date.now() < deadline) {
+    latest = await rpc(port, secret, 'aria2.tellStatus', [gid, [
+      'status', 'errorCode', 'errorMessage', 'completedLength', 'totalLength',
+    ]]);
+    if (['complete', 'error', 'removed'].includes(latest.status)) return latest;
+    await wait(100);
+  }
+  throw new Error(`Aria2 gid ${gid} did not become terminal: ${JSON.stringify(latest)}`);
+}
+
+async function waitForProgress(port, secret, gid, timeoutMs = 10000) {
+  const deadline = Date.now() + timeoutMs;
+  let latest;
+  while (Date.now() < deadline) {
+    latest = await rpc(port, secret, 'aria2.tellStatus', [gid, ['status', 'completedLength']]);
+    if (latest.status === 'active' && Number(latest.completedLength) > 0) return latest;
+    await wait(25);
+  }
+  throw new Error(`Aria2 gid ${gid} made no observable progress: ${JSON.stringify(latest)}`);
+}
+
+function serveBuffer(request, response, buffer) {
+  const match = /^bytes=(\d+)-(\d*)$/.exec(request.headers.range || '');
+  if (!match) {
+    response.writeHead(200, { 'content-length': String(buffer.length), 'accept-ranges': 'bytes' });
+    response.end(buffer);
+    return;
+  }
+  const start = Number(match[1]);
+  const requestedEnd = match[2] ? Number(match[2]) : buffer.length - 1;
+  const end = Math.min(requestedEnd, buffer.length - 1);
+  if (!Number.isSafeInteger(start) || start < 0 || start > end) {
+    response.writeHead(416, { 'content-range': `bytes */${buffer.length}` });
+    response.end();
+    return;
+  }
+  const body = buffer.subarray(start, end + 1);
+  response.writeHead(206, {
+    'content-length': String(body.length),
+    'content-range': `bytes ${start}-${end}/${buffer.length}`,
+    'accept-ranges': 'bytes',
+  });
+  response.end(body);
+}
+
+function serveThrottledBuffer(request, response, buffer) {
+  const match = /^bytes=(\d+)-(\d*)$/.exec(request.headers.range || '');
+  const start = match ? Number(match[1]) : 0;
+  const requestedEnd = match && match[2] ? Number(match[2]) : buffer.length - 1;
+  const end = Math.min(requestedEnd, buffer.length - 1);
+  if (!Number.isSafeInteger(start) || start < 0 || start > end) {
+    response.writeHead(416, { 'content-range': `bytes */${buffer.length}` });
+    response.end();
+    return;
+  }
+  const body = buffer.subarray(start, end + 1);
+  response.writeHead(match ? 206 : 200, {
+    'content-length': String(body.length),
+    ...(match ? { 'content-range': `bytes ${start}-${end}/${buffer.length}` } : {}),
+    'accept-ranges': 'bytes',
+  });
+  let offset = 0;
+  const timer = setInterval(() => {
+    if (response.destroyed || offset >= body.length) {
+      clearInterval(timer);
+      if (!response.destroyed) response.end();
+      return;
+    }
+    const next = Math.min(offset + 32 * 1024, body.length);
+    response.write(body.subarray(offset, next));
+    offset = next;
+  }, 20);
+  response.once('close', () => clearInterval(timer));
+}
+
+function childExited(child) {
+  return child.exitCode !== null || child.signalCode !== null;
+}
+
+async function waitForChildExit(child, timeoutMs = 8000) {
+  if (childExited(child)) return true;
+  return new Promise(resolve => {
+    let settled = false;
+    const finish = result => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.off('exit', onExit);
+      resolve(result);
+    };
+    const onExit = () => finish(true);
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    child.once('exit', onExit);
+    if (childExited(child)) finish(true);
+  });
+}
+
+async function stop(child, port, secret) {
+  if (!child || childExited(child)) return;
+  try {
+    await rpc(port, secret, 'aria2.shutdown');
+  } catch {
+    // It may already be stopping.
+  }
+  let exited = await waitForChildExit(child);
+  if (!exited) {
+    if (process.platform === 'win32') {
+      try {
+        execFileSync('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore', timeout: 3000 });
+      } catch {
+        // It may have exited between the timeout and taskkill.
+      }
+    } else {
+      child.kill('SIGTERM');
+    }
+    exited = await waitForChildExit(child);
+  }
+  if (!exited && process.platform !== 'win32') {
+    child.kill('SIGKILL');
+    exited = await waitForChildExit(child);
+  }
+  if (!exited) throw new Error(`Aria2 process ${child.pid} did not exit after cleanup`);
+}
+
+async function removeTempRoot(tempRoot) {
+  let lastError;
+  for (let attempt = 1; attempt <= 10; attempt += 1) {
+    try {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+      return;
+    } catch (error) {
+      lastError = error;
+      await wait(100 * attempt);
+    }
+  }
+  throw lastError;
+}
+
+const payload = Buffer.alloc(4 * 1024 * 1024, 0x5a);
+const checksum = crypto.createHash('sha256').update(payload).digest('hex');
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-aria2-transfers-'));
+const serverStatPath = path.join(tempRoot, 'server-stat.txt');
+fs.writeFileSync(serverStatPath, '', { mode: 0o600 });
+let finalRequests = 0;
+let finalCredentials = [];
+let redirectSourceCredentials;
+let smokePassed = false;
+let smokeFailure;
+
+const targetServer = http.createServer((request, response) => {
+  finalRequests += 1;
+  finalCredentials.push({
+    authorization: request.headers.authorization,
+    cookie: request.headers.cookie,
+    custom: request.headers['x-firelink-secret'],
+  });
+  serveBuffer(request, response, payload);
+});
+const targetPort = await listen(targetServer);
+const fixtureServer = http.createServer((request, response) => {
+  switch (new URL(request.url, 'http://fixture.invalid').pathname) {
+    case '/range':
+      serveBuffer(request, response, payload);
+      break;
+    case '/no-range':
+      response.writeHead(200, { 'content-length': String(payload.length) });
+      response.end(payload);
+      break;
+    case '/throttled':
+      serveThrottledBuffer(request, response, payload);
+      break;
+    case '/authenticated': {
+      const expectedAuthorization = `Basic ${Buffer.from('fixture-user:fixture-password').toString('base64')}`;
+      if (request.headers.authorization !== expectedAuthorization
+        || request.headers.cookie !== 'fixture-cookie=present'
+        || request.headers['x-firelink-auth'] !== 'present') {
+        response.writeHead(401, { 'content-length': '0' });
+        response.end();
+        break;
+      }
+      serveBuffer(request, response, payload);
+      break;
+    }
+    case '/redirect':
+      redirectSourceCredentials = {
+        authorization: request.headers.authorization,
+        cookie: request.headers.cookie,
+        custom: request.headers['x-firelink-secret'],
+      };
+      response.writeHead(302, { location: `http://127.0.0.1:${targetPort}/final` });
+      response.end();
+      break;
+    case '/missing':
+      response.writeHead(404, { 'content-length': '0' });
+      response.end();
+      break;
+    case '/malformed':
+      response.writeHead(200, { 'content-length': String(payload.length * 2) });
+      response.write(payload.subarray(0, 1024));
+      response.destroy();
+      break;
+    case '/slow': {
+      const slowLength = 64 * 1024;
+      let written = 0;
+      response.writeHead(200, { 'content-length': String(slowLength) });
+      const timer = setInterval(() => {
+        if (response.destroyed || written >= slowLength) {
+          clearInterval(timer);
+          if (!response.destroyed) response.end();
+          return;
+        }
+        response.write(Buffer.alloc(1024, 0x73));
+        written += 1024;
+      }, 500);
+      response.once('close', () => clearInterval(timer));
+      break;
+    }
+    default:
+      response.writeHead(404, { 'content-length': '0' });
+      response.end();
+  }
+});
+const fixturePort = await listen(fixtureServer);
+const rpcPort = await availablePort();
+const unavailableProxyPort = await availablePort();
+const secret = `firelink-transfers-${crypto.randomUUID()}`;
+const configPath = path.join(tempRoot, 'aria2.conf');
+fs.writeFileSync(configPath, `rpc-secret=${secret}\n`, { mode: 0o600 });
+const libraryPath = path.join(path.dirname(binaryPath), 'aria2-libs');
+const environment = fs.existsSync(libraryPath)
+  ? {
+      ...process.env,
+      OPENSSL_MODULES: libraryPath,
+      ...(process.platform === 'darwin' ? { DYLD_LIBRARY_PATH: libraryPath } : {}),
+    }
+  : process.env;
+const child = spawn(binaryPath, [
+  '--enable-rpc=true',
+  `--conf-path=${configPath}`,
+  `--rpc-listen-port=${rpcPort}`,
+  '--rpc-listen-all=false',
+  `--dir=${tempRoot}`,
+  '--file-allocation=none',
+  '--enable-dht=false',
+  '--console-log-level=error',
+  '--quiet=true',
+  `--server-stat-if=${serverStatPath}`,
+  `--server-stat-of=${serverStatPath}`,
+], { env: environment, stdio: ['ignore', 'ignore', 'pipe'] });
+let stderr = '';
+child.stderr.on('data', chunk => { stderr += chunk.toString(); });
+
+try {
+  const version = await waitForRpc(rpcPort, secret);
+  console.log(`[INFO] aria2 ${version.version || 'unknown'} normal-transfer smoke`);
+
+  const rangeGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/range`], {
+    out: 'range.bin', split: '4', 'max-connection-per-server': '4', 'min-split-size': '1M',
+  }]);
+  const rangeStatus = await waitForTerminal(rpcPort, secret, rangeGid);
+  if (rangeStatus.status !== 'complete' || !fs.readFileSync(path.join(tempRoot, 'range.bin')).equals(payload)) {
+    throw new Error(`bounded-range transfer failed: ${JSON.stringify(rangeStatus)}`);
+  }
+
+  const noRangeGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/no-range`], {
+    out: 'no-range.bin', split: '1', 'max-connection-per-server': '1',
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, noRangeGid)).status !== 'complete') {
+    throw new Error('single-connection no-range transfer did not complete');
+  }
+
+  const authenticatedGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/authenticated`], {
+    out: 'authenticated.bin', 'http-user': 'fixture-user', 'http-passwd': 'fixture-password',
+    header: ['Cookie: fixture-cookie=present', 'X-Firelink-Auth: present'],
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, authenticatedGid)).status !== 'complete') {
+    throw new Error('authenticated cookie/header transfer did not complete');
+  }
+
+  const resumeGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/throttled`], {
+    out: 'resume.bin', split: '1', continue: 'true',
+  }]);
+  await waitForProgress(rpcPort, secret, resumeGid);
+  await rpc(rpcPort, secret, 'aria2.pause', [resumeGid]);
+  const pausedStatus = await rpc(rpcPort, secret, 'aria2.tellStatus', [resumeGid, ['status', 'completedLength']]);
+  if (pausedStatus.status !== 'paused' || Number(pausedStatus.completedLength) <= 0) {
+    throw new Error(`normal transfer did not pause with resumable progress: ${JSON.stringify(pausedStatus)}`);
+  }
+  await rpc(rpcPort, secret, 'aria2.unpause', [resumeGid]);
+  if ((await waitForTerminal(rpcPort, secret, resumeGid)).status !== 'complete') {
+    throw new Error('paused normal transfer did not resume to completion');
+  }
+
+  const cancelGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/throttled`], {
+    out: 'cancel.bin', split: '1',
+  }]);
+  await waitForProgress(rpcPort, secret, cancelGid);
+  await rpc(rpcPort, secret, 'aria2.remove', [cancelGid]);
+  const cancelStatus = await waitForTerminal(rpcPort, secret, cancelGid);
+  if (cancelStatus.status !== 'removed') {
+    throw new Error(`normal transfer cancellation did not reach removed: ${JSON.stringify(cancelStatus)}`);
+  }
+
+  const mirrorGid = await rpc(rpcPort, secret, 'aria2.addUri', [[
+    `http://127.0.0.1:${fixturePort}/missing`,
+    `http://127.0.0.1:${fixturePort}/range`,
+  ], { out: 'mirror.bin', split: '1', 'max-tries': '1', 'uri-selector': 'adaptive' }]);
+  const mirrorStatus = await waitForTerminal(rpcPort, secret, mirrorGid);
+  if (mirrorStatus.status !== 'complete') throw new Error(`adaptive mirror failover failed: ${JSON.stringify(mirrorStatus)}`);
+
+  const checksumGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/range`], {
+    out: 'checksum.bin', checksum: `sha-256=${checksum}`, 'check-integrity': 'true',
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, checksumGid)).status !== 'complete') {
+    throw new Error('valid checksum transfer did not complete');
+  }
+  const mismatchGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/range`], {
+    out: 'checksum-mismatch.bin', checksum: `sha-256=${'0'.repeat(64)}`, 'check-integrity': 'true',
+  }]);
+  const mismatchStatus = await waitForTerminal(rpcPort, secret, mismatchGid);
+  if (mismatchStatus.status !== 'error') throw new Error(`checksum mismatch was not rejected: ${JSON.stringify(mismatchStatus)}`);
+
+  // Model Firelink's manual preflight: credentials reach the original origin,
+  // the redirect is not followed by the HTTP client, and Aria2 receives only
+  // the resolved cross-origin URL without credential options.
+  const redirectProbe = await fetch(`http://127.0.0.1:${fixturePort}/redirect`, {
+    headers: {
+      Range: 'bytes=0-0',
+      Authorization: 'Bearer fixture-secret',
+      Cookie: 'fixture=secret',
+      'X-Firelink-Secret': 'fixture',
+    },
+    redirect: 'manual',
+    signal: AbortSignal.timeout(5000),
+  });
+  if (redirectProbe.status !== 302) throw new Error(`redirect preflight returned HTTP ${redirectProbe.status}`);
+  if (!redirectSourceCredentials || Object.values(redirectSourceCredentials).some(value => !value)) {
+    throw new Error(`redirect source did not receive its scoped credentials: ${JSON.stringify(redirectSourceCredentials)}`);
+  }
+  const redirectLocation = redirectProbe.headers.get('location');
+  if (!redirectLocation) throw new Error('redirect preflight returned no Location header');
+  const resolvedRedirect = new URL(redirectLocation, redirectProbe.url);
+  const redirectGid = await rpc(rpcPort, secret, 'aria2.addUri', [[resolvedRedirect.toString()], {
+    out: 'redirect.bin',
+  }]);
+  const redirectStatus = await waitForTerminal(rpcPort, secret, redirectGid);
+  if (redirectStatus.status !== 'complete' || finalRequests === 0 || finalCredentials.some(headers => Object.values(headers).some(Boolean))) {
+    throw new Error(`redirect credential boundary failed: ${JSON.stringify({ redirectStatus, finalRequests, finalCredentials })}`);
+  }
+
+  const missingGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/missing`], {
+    out: 'missing.bin', 'max-tries': '1',
+  }]);
+  const missingStatus = await waitForTerminal(rpcPort, secret, missingGid);
+  if (missingStatus.status !== 'error' || !['3', '4'].includes(missingStatus.errorCode)) {
+    throw new Error(`not-found error classification changed: ${JSON.stringify(missingStatus)}`);
+  }
+
+  const lowSpeedGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/slow`], {
+    out: 'low-speed.bin', 'max-tries': '1', 'lowest-speed-limit': '1M', timeout: '20',
+  }]);
+  const lowSpeedStatus = await waitForTerminal(rpcPort, secret, lowSpeedGid, 25000);
+  if (lowSpeedStatus.status !== 'error' || lowSpeedStatus.errorCode !== '5') {
+    throw new Error(`low-speed error classification changed: ${JSON.stringify(lowSpeedStatus)}`);
+  }
+
+  const malformedGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/malformed`], {
+    out: 'malformed.bin', 'max-tries': '1',
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, malformedGid)).status !== 'error') {
+    throw new Error('malformed response unexpectedly completed');
+  }
+
+  const proxyGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/range`], {
+    out: 'proxy.bin', 'all-proxy': `http://127.0.0.1:${unavailableProxyPort}`, 'max-tries': '1',
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, proxyGid)).status !== 'error') {
+    throw new Error('unavailable proxy unexpectedly completed');
+  }
+
+  smokePassed = true;
+} catch (error) {
+  const detail = stderr.trim();
+  smokeFailure = new Error(`${error.message}${detail ? `\n${detail}` : ''}`);
+} finally {
+  try {
+    await stop(child, rpcPort, secret);
+    if (smokePassed) {
+      const stat = fs.readFileSync(serverStatPath, 'utf8');
+      if (!stat.includes('host=127.0.0.1')) {
+        throw new Error(`Aria2 did not persist adaptive mirror statistics: ${JSON.stringify(stat)}`);
+      }
+    }
+  } catch (error) {
+    if (!smokeFailure) smokeFailure = error;
+  } finally {
+    try {
+      await Promise.all([
+        new Promise(resolve => fixtureServer.close(resolve)),
+        new Promise(resolve => targetServer.close(resolve)),
+      ]);
+      await removeTempRoot(tempRoot);
+    } catch (error) {
+      if (!smokeFailure) smokeFailure = error;
+    }
+  }
+}
+
+if (smokeFailure) throw smokeFailure;
+console.log('[PASS] Aria2 normal transfers, auth/cookies, resume/cancel, mirrors, integrity, redirects, low-speed/not-found classification, malformed responses, proxy failures, and server statistics');

scripts/smoke-packaged-app.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { execFileSync, spawn } from 'node:child_process';
+import fs from 'node:fs';
 import path from 'node:path';
 
 function argValue(name) {
@@ -15,6 +16,14 @@ if (!executableArg) {
 
 const executable = path.resolve(executableArg);
 const assertNoVisibleChildWindows = process.argv.includes('--assert-no-visible-child-windows');
+const assertPortableData = process.argv.includes('--assert-portable-data');
+const MAX_STABILITY_MS = 60_000;
+const MAX_CONSECUTIVE_STABILITY_FAILURES = 3;
+const stabilityMsValue = Number.parseInt(argValue('--stability-ms') || '5000', 10);
+const stabilityMs = Number.isFinite(stabilityMsValue) && stabilityMsValue >= 0
+  ? Math.min(stabilityMsValue, MAX_STABILITY_MS)
+  : 5000;
+const READY_PORT_TIMEOUT_MS = 500;
 const child = spawn(executable, [], {
   cwd: process.env.RUNNER_TEMP || process.env.TMPDIR || process.cwd(),
   detached: process.platform !== 'win32',
@@ -30,12 +39,14 @@ const child = spawn(executable, [], {
 let stderr = '';
 let spawnError = null;
 let readyPort = null;
+let childExit = null;
 
 child.on('error', error => {
   spawnError = error;
 });
 
 child.on('exit', (code, signal) => {
+  childExit = { code, signal };
   if (readyPort === null) {
     console.error(`Child exited prematurely with code ${code} signal ${signal}`);
   }
@@ -44,6 +55,7 @@ child.on('exit', (code, signal) => {
 child.stderr.on('data', data => {
   stderr += data.toString();
 });
+child.stdout.on('data', () => {});
 
 function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms));
@@ -51,19 +63,25 @@ function sleep(ms) {
 
 async function findReadyPort() {
   for (let attempt = 0; attempt < 200 && readyPort === null; attempt += 1) {
-    if (spawnError) {
+    if (spawnError || childExit) {
       break;
     }
 
-    for (let port = 6412; port <= 6422; port += 1) {
+    const ports = Array.from({ length: 11 }, (_, index) => 6412 + index);
+    const matches = await Promise.all(ports.map(async port => {
       try {
-        const response = await fetch(`http://127.0.0.1:${port}/ping`);
-        if (response.headers.get('x-firelink-server') === '1') {
-          readyPort = port;
-          break;
-        }
-      } catch {}
-    }
+        const response = await fetch(`http://127.0.0.1:${port}/ping`, {
+          signal: AbortSignal.timeout(READY_PORT_TIMEOUT_MS),
+        });
+        const matchesChild = response.headers.get('x-firelink-server') === '1'
+          && response.headers.get('x-firelink-smoke-process-id') === String(child.pid);
+        await response.body?.cancel();
+        return matchesChild ? port : null;
+      } catch {
+        return null;
+      }
+    }));
+    readyPort = matches.find(port => port !== null) ?? null;
 
     if (readyPort === null) {
       await sleep(250);
@@ -71,6 +89,55 @@ async function findReadyPort() {
   }
 }
 
+async function checkReadyPort() {
+  if (readyPort === null) return false;
+
+  try {
+    const response = await fetch(`http://127.0.0.1:${readyPort}/ping`, {
+      signal: AbortSignal.timeout(READY_PORT_TIMEOUT_MS),
+    });
+    const matchesChild = response.headers.get('x-firelink-server') === '1'
+      && response.headers.get('x-firelink-smoke-process-id') === String(child.pid);
+    await response.body?.cancel();
+    return matchesChild;
+  } catch {
+    return false;
+  }
+}
+
+async function assertStableReady() {
+  const deadline = Date.now() + stabilityMs;
+  let consecutiveFailures = 0;
+  while (Date.now() < deadline) {
+    if (spawnError) {
+      throw new Error(`Packaged Firelink failed during stability check: ${spawnError.message}`);
+    }
+    if (childExit) {
+      throw new Error(
+        `Packaged Firelink exited during stability check with code ${childExit.code} signal ${childExit.signal}.`,
+      );
+    }
+    if (await checkReadyPort()) {
+      consecutiveFailures = 0;
+    } else {
+      consecutiveFailures += 1;
+      if (consecutiveFailures >= MAX_CONSECUTIVE_STABILITY_FAILURES) {
+        throw new Error('Packaged Firelink stopped exposing its extension ping endpoint during stability check.');
+      }
+    }
+    await sleep(Math.min(250, Math.max(1, deadline - Date.now())));
+  }
+
+  if (childExit) {
+    throw new Error(
+      `Packaged Firelink exited during stability check with code ${childExit.code} signal ${childExit.signal}.`,
+    );
+  }
+  if (!await checkReadyPort() && !await checkReadyPort()) {
+    throw new Error('Packaged Firelink was not healthy at the end of its stability check.');
+  }
+}
+
 function assertNoVisibleWindows(rootPid) {
   if (process.platform !== 'win32') {
     return;
@@ -120,43 +187,219 @@ if ($visible.Count -gt 0) {
   }
 }
 
-function terminateChild() {
-  if (!child.pid) {
-    return;
+function waitForChildExit(timeoutMs) {
+  if (childExit) {
+    return Promise.resolve(true);
   }
 
+  return new Promise(resolve => {
+    let timer;
+    const onExit = () => {
+      clearTimeout(timer);
+      child.off('exit', onExit);
+      resolve(true);
+    };
+    timer = setTimeout(() => {
+      child.off('exit', onExit);
+      resolve(false);
+    }, timeoutMs);
+    child.once('exit', onExit);
+  });
+}
+
+function isProcessGroupAlive(rootPid) {
   if (process.platform === 'win32') {
-    spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], {
-      stdio: 'ignore',
-      windowsHide: true,
-    });
-    return;
+    return false;
   }
 
   try {
-    process.kill(-child.pid, 'SIGTERM');
-  } catch {
-    child.kill('SIGTERM');
+    process.kill(-rootPid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== 'ESRCH';
   }
 }
 
-await findReadyPort();
+async function waitForProcessGroupExit(rootPid, timeoutMs) {
+  if (process.platform === 'win32') {
+    return true;
+  }
+
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!isProcessGroupAlive(rootPid)) {
+      return true;
+    }
+    await sleep(100);
+  }
+
+  return !isProcessGroupAlive(rootPid);
+}
+
+function windowsBundleRoot() {
+  return path.dirname(executable).replaceAll("'", "''");
+}
+
+function windowsBundleProcessIds() {
+  const root = windowsBundleRoot();
+  const script = `
+$root = '${root}'
+$rootPrefix = $root.TrimEnd('\\') + '\\'
+Get-CimInstance Win32_Process |
+  Where-Object {
+    $commandLine = $_.CommandLine
+    $commandLine -and $commandLine.TrimStart([char]34).StartsWith($rootPrefix, [System.StringComparison]::OrdinalIgnoreCase)
+  } |
+  Select-Object -ExpandProperty ProcessId
+`;
+  try {
+    const output = execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      windowsHide: true,
+    });
+    return output
+      .split(/\r?\n/)
+      .map(value => Number.parseInt(value.trim(), 10))
+      .filter(Number.isInteger);
+  } catch {
+    return null;
+  }
+}
+
+function terminateWindowsBundleProcesses() {
+  const root = windowsBundleRoot();
+  const script = `
+$root = '${root}'
+$rootPrefix = $root.TrimEnd('\\') + '\\'
+Get-CimInstance Win32_Process |
+  Where-Object {
+    $commandLine = $_.CommandLine
+    $commandLine -and $commandLine.TrimStart([char]34).StartsWith($rootPrefix, [System.StringComparison]::OrdinalIgnoreCase)
+  } |
+  ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+`;
+  try {
+    execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], {
+      stdio: 'ignore',
+      windowsHide: true,
+    });
+  } catch {}
+}
+
+async function waitForWindowsBundleExit(timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const processIds = windowsBundleProcessIds();
+    if (processIds?.length === 0) {
+      return true;
+    }
+    await sleep(100);
+  }
+  return windowsBundleProcessIds()?.length === 0;
+}
+
+async function terminateChild() {
+  if (!child.pid) {
+    return true;
+  }
+
+  const childWasRunning = !childExit;
+  if (process.platform === 'win32') {
+    if (childWasRunning) {
+      try {
+        execFileSync('taskkill', ['/pid', String(child.pid), '/t', '/f'], {
+          stdio: 'ignore',
+          windowsHide: true,
+        });
+      } catch {}
+    }
+    const childExited = await waitForChildExit(10000);
+    const bundleExited = await waitForWindowsBundleExit(5000);
+    if (childExited && bundleExited) {
+      return true;
+    }
+    terminateWindowsBundleProcesses();
+    return await waitForChildExit(5000) && await waitForWindowsBundleExit(5000);
+  }
+
+  if (childWasRunning && !childExit) {
+    try {
+      process.kill(-child.pid, 'SIGTERM');
+    } catch {
+      if (!childExit) {
+        child.kill('SIGTERM');
+      }
+    }
+  }
+  const childExited = await waitForChildExit(5000);
+  const processGroupExited = await waitForProcessGroupExit(child.pid, 5000);
+  if (childExited && processGroupExited) {
+    return true;
+  }
+
+  try {
+    process.kill(-child.pid, 'SIGKILL');
+  } catch {
+    if (!childExited) {
+      child.kill('SIGKILL');
+    }
+  }
+  return await waitForChildExit(5000) && await waitForProcessGroupExit(child.pid, 5000);
+}
+
+async function assertPortableStorage() {
+  const portableRoot = path.dirname(executable);
+  const marker = path.join(portableRoot, 'portable.flag');
+  const database = path.join(portableRoot, 'data', 'firelink.sqlite');
+  const webviewData = path.join(portableRoot, 'data', 'webview');
+
+  for (let attempt = 0; attempt < 40; attempt += 1) {
+    const markerReady = fs.statSync(marker, { throwIfNoEntry: false })?.isFile();
+    const databaseReady = fs.statSync(database, { throwIfNoEntry: false })?.isFile();
+    const webviewReady = fs.statSync(webviewData, { throwIfNoEntry: false })?.isDirectory();
+    if (markerReady && databaseReady && webviewReady) {
+      return;
+    }
+    await sleep(250);
+  }
+
+  throw new Error(
+    `Portable storage was not ready: marker=${marker}, database=${database}, webview=${webviewData}`,
+  );
+}
 
 try {
+  await findReadyPort();
+
   if (readyPort === null) {
     if (spawnError) {
-      console.error(`Packaged Firelink failed to start: ${spawnError.message}`);
+      throw new Error(`Packaged Firelink failed to start: ${spawnError.message}`);
+    } else if (childExit) {
+      throw new Error(
+        `Packaged Firelink exited before exposing extension ping endpoint with code ${childExit.code} signal ${childExit.signal}.`,
+      );
     } else {
-      console.error(`Packaged Firelink did not expose extension ping endpoint. Stderr:\n${stderr.slice(-1000)}`);
+      throw new Error(`Packaged Firelink did not expose extension ping endpoint. Stderr:\n${stderr.slice(-1000)}`);
     }
-    process.exit(1);
   }
 
   if (assertNoVisibleChildWindows) {
     assertNoVisibleWindows(child.pid);
   }
+  if (assertPortableData) {
+    await assertPortableStorage();
+  }
 
-  console.log(`Packaged Firelink smoke passed on 127.0.0.1:${readyPort}`);
+  await assertStableReady();
+
+  console.log(`Packaged Firelink smoke passed on 127.0.0.1:${readyPort} with ${stabilityMs}ms stability`);
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
 } finally {
-  terminateChild();
+  if (!await terminateChild()) {
+    console.error('Packaged Firelink could not be terminated cleanly; refusing to report smoke success.');
+    process.exitCode = 1;
+  }
 }

scripts/verify-binaries.js

@@ -2,6 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+import net from 'node:net';
 import { execFileSync, spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
@@ -44,16 +45,34 @@ const searchRoot = argValue('--search-root');
 function findEngineRoot(root) {
   const expected = `yt-dlp-${targetTriple}${ext}`;
   const matches = [];
+  const resolvedRoot = path.resolve(root);
+  const hasExpectedEngineFile = directory => {
+    try {
+      return fs.lstatSync(path.join(directory, expected)).isFile();
+    } catch (error) {
+      if (error?.code === 'ENOENT') return false;
+      throw new Error(`Unable to inspect packaged engine root '${directory}': ${error.message}`);
+    }
+  };
+  if (hasExpectedEngineFile(resolvedRoot)) {
+    matches.push(resolvedRoot);
+  }
   const walk = directory => {
-    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    let entries;
+    try {
+      entries = fs.readdirSync(directory, { withFileTypes: true });
+    } catch (error) {
+      throw new Error(`Unable to inspect packaged engine directory '${directory}': ${error.message}`);
+    }
+    for (const entry of entries) {
       const candidate = path.join(directory, entry.name);
       if (entry.isDirectory()) {
-        if (fs.existsSync(path.join(candidate, expected))) matches.push(candidate);
+        if (hasExpectedEngineFile(candidate)) matches.push(candidate);
         walk(candidate);
       }
     }
   };
-  walk(path.resolve(root));
+  walk(resolvedRoot);
   if (matches.length !== 1) {
     throw new Error(`Expected exactly one packaged engine root under ${root}, found ${matches.length}`);
   }
@@ -317,6 +336,82 @@ function runEngine(label, engine, args, timeout = 30000) {
   }
 }
 
+function waitForProcessExit(proc, timeoutMs) {
+  if (proc.exitCode !== null || proc.signalCode !== null) {
+    return Promise.resolve(true);
+  }
+
+  return new Promise(resolve => {
+    let settled = false;
+    let timer;
+    const finish = value => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      proc.removeListener('exit', onExit);
+      resolve(value);
+    };
+    const onExit = () => finish(true);
+
+    timer = setTimeout(() => finish(false), timeoutMs);
+    proc.once('exit', onExit);
+    if (proc.exitCode !== null || proc.signalCode !== null) {
+      finish(true);
+    }
+  });
+}
+
+async function terminateProcess(proc, label) {
+  if (proc.exitCode === null && proc.signalCode === null) {
+    try {
+      proc.kill('SIGTERM');
+    } catch {}
+    if (await waitForProcessExit(proc, 2000)) {
+      return true;
+    }
+
+    try {
+      proc.kill('SIGKILL');
+    } catch {}
+    if (await waitForProcessExit(proc, 2000)) {
+      return true;
+    }
+
+    fail(`${label} did not terminate after SIGTERM and SIGKILL.`);
+    return false;
+  }
+
+  return true;
+}
+
+function findAvailablePort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.once('error', reject);
+    server.listen({ host: '127.0.0.1', port: 0 }, () => {
+      const address = server.address();
+      if (!address || typeof address === 'string') {
+        server.close();
+        reject(new Error('Could not determine the verifier RPC port.'));
+        return;
+      }
+
+      const port = address.port;
+      server.close(error => {
+        if (error) {
+          reject(error);
+        } else {
+          resolve(port);
+        }
+      });
+    });
+  });
+}
+
+function isPortBindingFailure(message) {
+  return /address already in use|failed to bind|could not bind|listen failed/i.test(message);
+}
+
 const coldStartTimeout = isMacOS ? 120000 : 30000;
 if (canExecuteTarget) {
   runEngine('yt-dlp cold start', 'yt-dlp', ['--version'], coldStartTimeout);
@@ -345,25 +440,6 @@ if (canExecuteTarget) {
       return;
     }
 
-    const port = 16801 + (process.pid % 1000);
-    const proc = spawn(p, [
-      '--enable-rpc',
-      `--rpc-listen-port=${port}`,
-      '--rpc-max-request-size=1K',
-      '--quiet',
-      '--console-log-level=error',
-      '--rpc-listen-all=false',
-    ], {
-      env: engineEnv('aria2c'),
-      stdio: ['ignore', 'pipe', 'pipe'],
-      timeout: 15000,
-    });
-
-    let rpcStderr = '';
-    proc.stderr.on('data', (d) => {
-      rpcStderr += d.toString();
-    });
-
     const body = JSON.stringify({
       jsonrpc: '2.0',
       id: 'firelink-verify',
@@ -371,39 +447,114 @@ if (canExecuteTarget) {
       params: [],
     });
 
-    const result = await new Promise((resolve) => {
-      const maxAttempts = 20;
-      let attempts = 0;
-
-      function tryFetch() {
-        attempts++;
-        fetch(`http://127.0.0.1:${port}/jsonrpc`, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body,
-        })
-          .then(async (res) => {
-            resolve({ ok: true, data: await res.text() });
-          })
-          .catch(() => {
-            if (attempts >= maxAttempts) {
-              resolve({ ok: false, error: `RPC not ready after ${maxAttempts} attempts` });
-              return;
-            }
-            setTimeout(tryFetch, 300);
-          });
+    let result = { ok: false, error: 'RPC test did not run.' };
+    let rpcStderr = '';
+    const maxPortAttempts = 3;
+    for (let portAttempt = 0; portAttempt < maxPortAttempts; portAttempt += 1) {
+      let port;
+      try {
+        port = await findAvailablePort();
+      } catch (error) {
+        result = { ok: false, error: `Could not reserve an RPC port: ${error.message}` };
+        break;
       }
 
-      tryFetch();
-    });
+      const proc = spawn(p, [
+        '--enable-rpc',
+        `--rpc-listen-port=${port}`,
+        '--rpc-max-request-size=1K',
+        '--quiet',
+        '--console-log-level=error',
+        '--rpc-listen-all=false',
+      ], {
+        env: engineEnv('aria2c'),
+        stdio: ['ignore', 'ignore', 'pipe'],
+        timeout: 15000,
+      });
 
-    // Clean up
-    proc.kill('SIGTERM');
-    setTimeout(() => {
-      try {
-        proc.kill('SIGKILL');
-      } catch {}
-    }, 2000);
+      let spawnError = null;
+      let childExit = null;
+      let attemptStderr = '';
+      proc.once('error', error => {
+        spawnError = error;
+      });
+      proc.once('exit', (code, signal) => {
+        childExit = { code, signal };
+      });
+      proc.stderr.on('data', data => {
+        attemptStderr += data.toString();
+      });
+
+      const attemptResult = await new Promise(resolve => {
+        const maxAttempts = 20;
+        let attempts = 0;
+
+        function resolveProcessFailure() {
+          if (spawnError) {
+            resolve({ ok: false, error: `aria2c failed to spawn: ${spawnError.message}` });
+          } else if (childExit) {
+            resolve({
+              ok: false,
+              error: `aria2c exited before RPC became ready with code ${childExit.code} signal ${childExit.signal}.`,
+            });
+          }
+        }
+
+        function tryFetch() {
+          if (spawnError || childExit) {
+            resolveProcessFailure();
+            return;
+          }
+
+          attempts += 1;
+          fetch(`http://127.0.0.1:${port}/jsonrpc`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body,
+          })
+            .then(async response => {
+              resolve({ ok: true, data: await response.text() });
+            })
+            .catch(() => {
+              if (spawnError || childExit) {
+                resolveProcessFailure();
+              } else if (attempts >= maxAttempts) {
+                resolve({ ok: false, error: `RPC not ready after ${maxAttempts} attempts` });
+              } else {
+                setTimeout(tryFetch, 300);
+              }
+            });
+        }
+
+        tryFetch();
+      });
+
+      const exitedBeforeCleanup = childExit;
+      const terminated = proc.pid
+        ? await terminateProcess(proc, 'aria2 RPC verifier process')
+        : true;
+      rpcStderr = attemptStderr;
+      result = attemptResult;
+
+      if (
+        result.ok
+        && exitedBeforeCleanup
+        && (exitedBeforeCleanup.code !== 0 || exitedBeforeCleanup.signal !== null)
+      ) {
+        result = {
+          ok: false,
+          error: `aria2c exited after responding with code ${exitedBeforeCleanup.code} signal ${exitedBeforeCleanup.signal}.`,
+        };
+      }
+
+      if (!terminated || result.ok || !isPortBindingFailure(`${result.error || ''}\n${rpcStderr}`)) {
+        break;
+      }
+
+      if (portAttempt + 1 < maxPortAttempts) {
+        console.log(`[INFO] RPC port ${port} became unavailable; retrying with a new port.`);
+      }
+    }
 
     if (result.ok) {
       try {

scripts/verify-companion-release.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const scriptDirectory = path.dirname(fileURLToPath(import.meta.url));
+const defaultRepositoryRoot = path.resolve(scriptDirectory, '..');
+const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+function readJson(file) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function exactVersionTag(extensionRoot, expectedTag) {
+  try {
+    const tags = execFileSync(
+      'git',
+      ['-C', extensionRoot, 'tag', '--points-at', 'HEAD', '--list', '--', expectedTag],
+      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+    )
+      .split(/\r?\n/)
+      .map(tag => tag.trim())
+      .find(tag => tag === expectedTag);
+    return tags || null;
+  } catch {
+    return null;
+  }
+}
+
+export function verifyCompanionRelease({
+  repositoryRoot = defaultRepositoryRoot,
+  resolveExactTag = exactVersionTag,
+  requireExactTag = true,
+} = {}) {
+  const extensionRoot = path.join(repositoryRoot, 'Extensions', 'Browser');
+  const packagePath = path.join(extensionRoot, 'package.json');
+  const manifestPath = path.join(extensionRoot, 'manifest.json');
+
+  if (!fs.existsSync(packagePath) || !fs.existsSync(manifestPath)) {
+    throw new Error('Companion package.json and manifest.json must both exist.');
+  }
+
+  const packageVersion = readJson(packagePath).version;
+  const manifestVersion = readJson(manifestPath).version;
+  if (!packageVersion || packageVersion !== manifestVersion) {
+    throw new Error(
+      `Companion versions do not agree: package.json=${packageVersion || 'missing'}, ` +
+      `manifest.json=${manifestVersion || 'missing'}.`
+    );
+  }
+  if (typeof packageVersion !== 'string' || !SEMVER.test(packageVersion)) {
+    throw new Error(`Companion version ${String(packageVersion)} is not a valid semantic version.`);
+  }
+
+  const expectedTag = `v${packageVersion}`;
+  if (!requireExactTag) {
+    return { tag: null, version: packageVersion };
+  }
+  const tag = resolveExactTag(extensionRoot, expectedTag);
+  if (!tag) {
+    throw new Error(
+      `Companion HEAD is not exactly tagged ${expectedTag}; publish the Companion release first.`
+    );
+  }
+  if (tag !== expectedTag) {
+    throw new Error(`Companion HEAD tag ${tag} does not match ${expectedTag}.`);
+  }
+
+  return { tag, version: packageVersion };
+}
+
+function main() {
+  try {
+    const requireExactTag = !process.argv.includes('--allow-untagged');
+    const { tag, version } = verifyCompanionRelease({ requireExactTag });
+    console.log(
+      requireExactTag
+        ? `Companion release ${version} matches exact tag ${tag}.`
+        : `Non-publishing Companion package metadata agrees at version ${version}.`
+    );
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
+
+if (path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) {
+  main();
+}

scripts/verify-companion-release.node-test.js

@@ -0,0 +1,118 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { verifyCompanionRelease } from './verify-companion-release.js';
+
+function createFixture(packageVersion, manifestVersion) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-companion-release-'));
+  const extensionRoot = path.join(root, 'Extensions', 'Browser');
+  fs.mkdirSync(extensionRoot, { recursive: true });
+  fs.writeFileSync(
+    path.join(extensionRoot, 'package.json'),
+    `${JSON.stringify({ version: packageVersion }, null, 2)}\n`
+  );
+  fs.writeFileSync(
+    path.join(extensionRoot, 'manifest.json'),
+    `${JSON.stringify({ version: manifestVersion }, null, 2)}\n`
+  );
+  return root;
+}
+
+test('accepts matching Companion metadata and exact release tag', () => {
+  const root = createFixture('2.0.7', '2.0.7');
+  try {
+    let resolvedExpectedTag;
+    assert.deepEqual(
+      verifyCompanionRelease({
+        repositoryRoot: root,
+        resolveExactTag: (_extensionRoot, expectedTag) => {
+          resolvedExpectedTag = expectedTag;
+          return 'v2.0.7';
+        },
+      }),
+      { tag: 'v2.0.7', version: '2.0.7' }
+    );
+    assert.equal(resolvedExpectedTag, 'v2.0.7');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects mismatched Companion package and manifest versions', () => {
+  const root = createFixture('2.0.7', '2.0.6');
+  try {
+    assert.throws(
+      () => verifyCompanionRelease({ repositoryRoot: root, resolveExactTag: () => 'v2.0.7' }),
+      /versions do not agree/
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects a malformed Companion semantic version before tag lookup', () => {
+  const root = createFixture('--contains=HEAD', '--contains=HEAD');
+  let tagLookupCalled = false;
+  try {
+    assert.throws(
+      () => verifyCompanionRelease({
+        repositoryRoot: root,
+        resolveExactTag: () => {
+          tagLookupCalled = true;
+          return 'v--contains=HEAD';
+        },
+      }),
+      /not a valid semantic version/
+    );
+    assert.equal(tagLookupCalled, false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects an untagged Companion commit', () => {
+  const root = createFixture('2.0.7', '2.0.7');
+  try {
+    assert.throws(
+      () => verifyCompanionRelease({ repositoryRoot: root, resolveExactTag: () => null }),
+      /not exactly tagged v2.0.7/
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('accepts aligned untagged Companion metadata for a non-publishing audit', () => {
+  const root = createFixture('2.0.7', '2.0.7');
+  let tagLookupCalled = false;
+  try {
+    assert.deepEqual(
+      verifyCompanionRelease({
+        repositoryRoot: root,
+        requireExactTag: false,
+        resolveExactTag: () => {
+          tagLookupCalled = true;
+          return null;
+        },
+      }),
+      { tag: null, version: '2.0.7' }
+    );
+    assert.equal(tagLookupCalled, false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects a Companion tag for another version', () => {
+  const root = createFixture('2.0.7', '2.0.7');
+  try {
+    assert.throws(
+      () => verifyCompanionRelease({ repositoryRoot: root, resolveExactTag: () => 'v2.0.6' }),
+      /does not match v2.0.7/
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

scripts/verify-linux-packages.js

@@ -96,6 +96,15 @@ export function parseDebianPackagePath(line) {
   return match[1].replace(/^\.\//, '');
 }
 
+export function isSafePackagePath(packagePath) {
+  if (packagePath === '') {
+    return true;
+  }
+
+  const parts = packagePath.split('/');
+  return !parts.includes('..') && (parts[0] === 'usr' || packagePath === 'usr');
+}
+
 function assertSafePackageListing(listing, packageType) {
   const lines = listing.split('\n').filter(Boolean);
   const paths = packageType === 'deb'
@@ -109,8 +118,7 @@ function assertSafePackageListing(listing, packageType) {
     : lines.map(line => line.replace(/^\/+/, ''));
 
   for (const packagePath of paths) {
-    const parts = packagePath.split('/');
-    if (parts.includes('..') || (parts[0] !== 'usr' && packagePath !== 'usr')) {
+    if (!isSafePackagePath(packagePath)) {
       fail(`${packageType} package contains an unsafe path: ${packagePath}`);
     }
   }

scripts/verify-linux-packages.node-test.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 
-import { parseDebianPackagePath } from './verify-linux-packages.js';
+import { isSafePackagePath, parseDebianPackagePath } from './verify-linux-packages.js';
 
 test('parses current dpkg-deb listings without a ./ prefix', () => {
   assert.equal(
@@ -17,6 +17,19 @@ test('parses legacy dpkg-deb listings with a ./ prefix', () => {
   );
 });
 
+test('accepts the package root in legacy dpkg-deb listings', () => {
+  assert.equal(
+    parseDebianPackagePath('drwxr-xr-x root/root       0 2026-07-12 07:24 ./'),
+    ''
+  );
+  assert.equal(isSafePackagePath(''), true);
+});
+
+test('rejects paths outside the package usr tree', () => {
+  assert.equal(isSafePackagePath('../tmp/firelink'), false);
+  assert.equal(isSafePackagePath('etc/firelink'), false);
+});
+
 test('rejects malformed dpkg-deb listing lines', () => {
   assert.throws(
     () => parseDebianPackagePath('not a dpkg-deb listing'),

scripts/verify-release-version.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const scriptDirectory = path.dirname(fileURLToPath(import.meta.url));
+const repositoryRoot = path.resolve(scriptDirectory, '..');
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function readPackageVersion(root) {
+  return JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
+}
+
+function readTauriVersion(root) {
+  return JSON.parse(
+    fs.readFileSync(path.join(root, 'src-tauri', 'tauri.conf.json'), 'utf8')
+  ).version;
+}
+
+function readCargoVersion(root) {
+  const cargo = fs.readFileSync(path.join(root, 'src-tauri', 'Cargo.toml'), 'utf8');
+  const packageSection = cargo.match(/^\[package\]\s*([\s\S]*?)(?=^\[)/m)?.[1];
+  const version = packageSection?.match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+  if (!version) {
+    throw new Error('Could not read the [package] version from src-tauri/Cargo.toml.');
+  }
+  return version;
+}
+
+function versionFromRef(ref) {
+  if (!ref || !ref.startsWith('v')) {
+    throw new Error(`Expected a semantic version tag such as v1.2.3, received ${ref || 'nothing'}.`);
+  }
+  const version = ref.slice(1);
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`Release tag ${ref} does not contain a valid semantic version.`);
+  }
+  return version;
+}
+
+const versions = {
+  'package.json': readPackageVersion(repositoryRoot),
+  'src-tauri/Cargo.toml': readCargoVersion(repositoryRoot),
+  'src-tauri/tauri.conf.json': readTauriVersion(repositoryRoot),
+};
+const uniqueVersions = new Set(Object.values(versions));
+if (uniqueVersions.size !== 1) {
+  console.error('Application version manifests do not agree:');
+  for (const [file, version] of Object.entries(versions)) console.error(`  ${file}=${version}`);
+  process.exit(1);
+}
+
+const allowUntagged = process.argv.includes('--allow-untagged');
+const tag = argValue('--tag') || process.env.GITHUB_REF_NAME;
+const expected = allowUntagged ? Object.values(versions)[0] : versionFromRef(tag);
+const mismatches = Object.entries(versions)
+  .filter(([, version]) => version !== expected)
+  .map(([file, version]) => `${file}=${version}`);
+
+if (!allowUntagged && mismatches.length > 0) {
+  console.error(`Release tag ${tag} does not match the application manifests (expected ${expected}).`);
+  for (const mismatch of mismatches) console.error(`  ${mismatch}`);
+  process.exit(1);
+}
+
+console.log(
+  allowUntagged
+    ? `Non-publishing package version ${expected} matches ${Object.keys(versions).length} manifests.`
+    : `Release version ${expected} matches ${Object.keys(versions).length} manifests.`
+);

scripts/verify-release-version.node-test.js

@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import test from 'node:test';
+
+const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const verifier = path.join(repositoryRoot, 'scripts', 'verify-release-version.js');
+const currentVersion = JSON.parse(
+  fs.readFileSync(path.join(repositoryRoot, 'package.json'), 'utf8')
+).version;
+
+function runVerifier(tag, ...extraArguments) {
+  return spawnSync(process.execPath, [verifier, '--tag', tag, ...extraArguments], {
+    cwd: repositoryRoot,
+    encoding: 'utf8',
+  });
+}
+
+test('release version verifier accepts the aligned current version', () => {
+  const result = runVerifier(`v${currentVersion}`);
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, new RegExp(`Release version ${currentVersion} matches`));
+});
+
+test('release version verifier rejects the already-published prior tag', () => {
+  const result = runVerifier('v1.1.1');
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /does not match the application manifests/);
+});
+
+test('release version verifier rejects non-semver tag names', () => {
+  const result = runVerifier('release-candidate');
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /semantic version tag/);
+});
+
+test('release version verifier accepts an untagged non-publishing package audit', () => {
+  const result = runVerifier('main', '--allow-untagged');
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, new RegExp(`Non-publishing package version ${currentVersion} matches`));
+});

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "firelink"
-version = "1.0.4"
+version = "1.4.0"
 description = "A fast cross-platform desktop download manager powered by Rust and Tauri"
 authors = ["NimBold"]
 edition = "2021"
@@ -25,14 +25,14 @@ tauri-build = { version = "2", features = [] }
 [dependencies]
 tauri = { version = "2", features = ["macos-private-api", "tray-icon", "image-png", "test"] }
 tauri-plugin-opener = "2"
-tauri-plugin-dialog = "2"
+tauri-plugin-dialog = "2.7.2"
 tauri-plugin-shell = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["fs", "process", "io-util", "rt", "rt-multi-thread", "macros", "sync", "time"] }
 regex = "1.10"
 reqwest = { version = "0.13", default-features = false, features = ["rustls-no-provider", "json", "stream", "socks"] }
-rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
+rustls = { version = "0.23.42", default-features = false, features = ["ring", "std", "tls12"] }
 uuid = { version = "1", features = ["v4"] }
 ts-rs = { version = "12", features = ["serde-compat", "uuid-impl"] }
 tauri-plugin-notification = "2.3.3"
@@ -41,27 +41,27 @@ sysinfo = "0.39.3"
 hmac = "0.13"
 sha2 = "0.11"
 tauri-plugin-deep-link = "2"
-tauri-plugin-single-instance = { version = "2", features = ["deep-link"] }
+tauri-plugin-single-instance = { version = "2.4.3", features = ["deep-link"] }
 tempfile = "3"
-thiserror = "2.0.18"
+thiserror = "2.0.19"
 axum = "0.8.9"
-tower-http = { version = "0.7", features = ["cors"] }
+tower-http = { version = "0.7", features = ["cors", "limit"] }
 sysproxy = "0.3.0"
 semver = "1.0.28"
 keepawake = "0.6.0"
 system_shutdown = "4.1.0"
 tokio-tungstenite = "0.30.0"
-futures-util = { version = "0.3.32", features = ["sink"] }
+futures-util = { version = "0.3.33", features = ["sink"] }
 chrono = "0.4.38"
 url = "2"
 rusqlite = { version = "0.40.1", features = ["bundled"] }
 log = "0.4.32"
-tauri-plugin-log = "2"
+tauri-plugin-log = "2.9.0"
 trash = "5"
 async-trait = "0.1"
 keyring-core = "1.0.0"
 [target.'cfg(target_os = "macos")'.dependencies]
-apple-native-keyring-store = { version = "1.0.0", features = ["keychain"] }
+apple-native-keyring-store = { version = "1.0.1", features = ["keychain"] }
 objc = "0.2.7"
 
 [target.'cfg(target_os = "windows")'.dependencies]

src-tauri/binaries/_internal/certifi/cacert.pem

@@ -717,35 +717,6 @@ g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN
 BSeOE6Fuwg==
 -----END CERTIFICATE-----
 
-# Issuer: CN=Atos TrustedRoot 2011 O=Atos
-# Subject: CN=Atos TrustedRoot 2011 O=Atos
-# Label: "Atos TrustedRoot 2011"
-# Serial: 6643877497813316402
-# MD5 Fingerprint: ae:b9:c4:32:4b:ac:7f:5d:66:cc:77:94:bb:2a:77:56
-# SHA1 Fingerprint: 2b:b1:f5:3e:55:0c:1d:c5:f1:d4:e6:b7:6a:46:4b:55:06:02:ac:21
-# SHA256 Fingerprint: f3:56:be:a2:44:b7:a9:1e:b3:5d:53:ca:9a:d7:86:4a:ce:01:8e:2d:35:d5:f8:f9:6d:df:68:a6:f4:1a:a4:74
------BEGIN CERTIFICATE-----
-MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UE
-AwwVQXRvcyBUcnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQG
-EwJERTAeFw0xMTA3MDcxNDU4MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMM
-FUF0b3MgVHJ1c3RlZFJvb3QgMjAxMTENMAsGA1UECgwEQXRvczELMAkGA1UEBhMC
-REUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCVhTuXbyo7LjvPpvMp
-Nb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI419KkM/IL9bcFyYie96mvr54rM
-VD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+yj5vdHLqqjAqc2K+
-SZFhyBH+DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFsQ/H3NYkQ
-4J7sVaE3IqKHBAUsR320HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0L
-cp2AMBYHlT8oDv3FdU9T1nSatCQujgKRz3bFmx5VdJx4IbHwLfELn8LVlhgf8FQi
-eowHAgMBAAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7Rl+lwrrw7GWzbITAPBgNV
-HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZbNshMBgG
-A1UdIAQRMA8wDQYLKwYBBAGwLQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3
-DQEBCwUAA4IBAQAmdzTblEiGKkGdLD4GkGDEjKwLVLgfuXvTBznk+j57sj1O7Z8j
-vZfza1zv7v1Apt+hk6EKhqzvINB5Ab149xnYJDE0BAGmuhWawyfc2E8PzBhj/5kP
-DpFrdRbhIfzYJsdHt6bPWHJxfrrhTZVHO8mvbaG0weyJ9rQPOLXiZNwlz6bb65pc
-maHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a961qn8FYiqTxlVMYVqL2Gns2D
-lmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G3mB/ufNPRJLv
-KrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed
------END CERTIFICATE-----
-
 # Issuer: CN=QuoVadis Root CA 1 G3 O=QuoVadis Limited
 # Subject: CN=QuoVadis Root CA 1 G3 O=QuoVadis Limited
 # Label: "QuoVadis Root CA 1 G3"
@@ -3861,3 +3832,128 @@ y7Ve7hekm9sEdu4pKeiv+62sUvTXK9Z3hBC9xdIoaDQCQTV2WnXzkoYI9bIeCvZl
 C9p2x1L/Cx6AcCIwwzPbGO2E14vs7dOoY4G1VnxHx1YwlGhza9IuqbnZLBwpvQy6
 uWWL
 -----END CERTIFICATE-----
+
+# Issuer: CN=SECOM TLS RSA Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Subject: CN=SECOM TLS RSA Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Label: "SECOM TLS RSA Root CA 2024"
+# Serial: 17188327524208271538
+# MD5 Fingerprint: d0:a4:db:32:eb:44:98:d2:62:0b:3e:bc:4d:7c:5c:e9
+# SHA1 Fingerprint: fb:97:96:7c:ef:8d:98:63:06:c0:3b:b6:11:f8:e0:13:97:a2:98:d3
+# SHA256 Fingerprint: 14:35:f2:25:c5:d2:52:d7:a2:19:48:cc:3c:e6:2a:ec:fa:88:00:1e:3d:d7:2d:1c:c3:55:51:00:eb:37:2f:93
+-----BEGIN CERTIFICATE-----
+MIIFmjCCA4KgAwIBAgIJAO6JNNDLgOCyMA0GCSqGSIb3DQEBDAUAMFoxCzAJBgNV
+BAYTAkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEj
+MCEGA1UEAxMaU0VDT00gVExTIFJTQSBSb290IENBIDIwMjQwHhcNMjQwMTMxMDUx
+MTU1WhcNNDkwMTE0MDUxMTU1WjBaMQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VD
+T00gVHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMTGlNFQ09NIFRMUyBS
+U0EgUm9vdCBDQSAyMDI0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+4TjizUwzxbInq8Tx11gaFYNk5fO+34y7TyM4neh0UgL5JIZbJNLTz2x//L/B71+5
+m6X6nGIr7d4lFJBGtjO677hXOz93zkcWaUTm3VbOAjBlt4YWxlcccBHXuZ7o3Q+4
+R+ormrBdHeJ1CTUEG8ttQbKIl3G7OZYbnH8/pP8cjPub/0kDVNuMzp7xsVRROOis
+Qt53fMoJLlYgoebbuMphOqMCtjkJ7R6efEMfLp8UAVi9ZaLRn76ET/CJkk925ndu
+uufC4BatS4mnXFmxN0vUXb0ij9B8O/D8gixQEsVSD4GK8FWRPh3bVd/6bzdkHGJj
+y21XI0yejVomZUbRrOfNuz0boPGV1pt18fFC39IHQEth3OFqb5NDO3L+A9bNqTgA
+yUgRmIn4ucgDc/Ri/Km3V51ueZjy1/yk0qwJVadAVVrCt56iNeXOyEvzJADGgDQ8
+E1Pdaqct8Cynz/47ReQM62vFYO08wcQkrjmX/tesiko1V1yyaf6EfPzUFzmaGy9x
+vkCwdbm15EdTolOjE0H2Vb5/APDOyCFEokiYGmXTLdAUl0wKZ4IyjkHGzy0jhpaX
+EXE/GJcEvI6VzEchjaBL03EJ0h9pG4OqeIOycKvAo3A+TbetyfsrgYyHzU0a7/qU
+jGat1AAq1nVljMpKqpinPTsf/d9H39FTUeJL7TpzzjUCAwEAAaNjMGEwHQYDVR0O
+BBYEFCzrchKOWHdkNRVWNQFXB6l9DTbmMB8GA1UdIwQYMBaAFCzrchKOWHdkNRVW
+NQFXB6l9DTbmMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
+SIb3DQEBDAUAA4ICAQAVwsvluSafaez5tFPR/hRTBzRxEyMMQF3XJXCVi3yegZyK
+oec7hmE6jx2ZM8KgM1kn2yJRwFXHX8zUW9nBLEDWc4wuE8LrlZqhGZM9pJQXGmGz
+ResDJV6JgRBna+j4sA1M7yIdlvL0sAfFXFCTRaWTD4E1V99RLrFzWfTcC+e180hD
+uNMpqOEo46+lMeW/Wvh7ifOQs+kiK0O2gHxQDNxslSavnCs4V7l8HRDJ2La10o70
+Bo7VLzf1W8MBvv0VTnxB+NjT5qTAbhGFh9Gvp4BaJpmdUf0C5CEP6dbQlfgxWfzY
+r69yVT6dPQB+GFEaY03IMY+AcBCs+om1fNxrQXt9zoofMBNFbLhvpNH/JsXWdGUz
+fNbO12uswTa5wah8LB18FTQN2/zPHYmvBEoLuyUgZ09VNLJo5YA0kXItVYkLjMe2
+SixzK4scUHv81IK99I91DWx7FwMVKw2xgFp+ZLYB2dnpQQrqwlW64glHUcK2N9BD
+snjLSxeZ+UPECh9RxH4WAcKiZW+cqaKMmhP2WBfR4IcR7NOL32ml11ds87hhV1CZ
+WWFCJAcCidYZz6CZa8exzHojP9SB5RH0/v1KdHAisqhSjtJl/UIAHIQ48elOn8wr
+TdFap4Yb5aHglmMeNx+fAIhDluWVfxTO7H4dTPU+SFVRMLAh+wwKZfqb94nMeQ==
+-----END CERTIFICATE-----
+
+# Issuer: CN=SECOM TLS ECC Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Subject: CN=SECOM TLS ECC Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Label: "SECOM TLS ECC Root CA 2024"
+# Serial: 9329818985461676612
+# MD5 Fingerprint: 99:d3:9d:e4:d2:b1:2d:f0:2a:04:67:85:f3:df:46:d6
+# SHA1 Fingerprint: 7a:1f:22:2d:72:b2:c3:19:87:44:db:61:69:e8:a6:4b:d7:0d:44:0e
+# SHA256 Fingerprint: 6a:b2:ab:75:f5:1c:b4:f4:f0:15:62:03:fb:f6:f6:46:23:2f:51:4b:e0:59:f6:28:33:30:8b:82:b4:d7:2d:b1
+-----BEGIN CERTIFICATE-----
+MIICTDCCAdGgAwIBAgIJAIF6LO+PI3pEMAoGCCqGSM49BAMDMFoxCzAJBgNVBAYT
+AkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEG
+A1UEAxMaU0VDT00gVExTIEVDQyBSb290IENBIDIwMjQwHhcNMjQwMTMxMDU1MjM0
+WhcNNDkwMTE0MDU1MjM0WjBaMQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VDT00g
+VHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMTGlNFQ09NIFRMUyBFQ0Mg
+Um9vdCBDQSAyMDI0MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE7NzFMtu9dzQXSNC1
+2fabk0+GlC5finB3R7XaZonRUd20aFiWObtuNBCLUZSfk6QXAE55BjEXsXQ/NG8y
+UqicXjsu9ksDK3JZBgCwLOVh6+nwJXTvso/dEj/GUYH5mBdoo2MwYTAdBgNVHQ4E
+FgQUO3YReyl04k4GTFaCQNAhL3qzydUwHwYDVR0jBBgwFoAUO3YReyl04k4GTFaC
+QNAhL3qzydUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZI
+zj0EAwMDaQAwZgIxAN3ib8fi1pMYtAPjMilB5e5/H+t5CL0xPL+cZ5oTTZuSCjpA
+n1v7F/VAr8bFxQXAowIxAKsBVO1ACFp7skwzPvdv1EUY5a897WGLT4lb+bjxFAWy
+l8wDcZJdwGZ/pAHxt1AJ1g==
+-----END CERTIFICATE-----
+
+# Issuer: CN=Telia EC TLS Root CA v3 O=Telia Company AB
+# Subject: CN=Telia EC TLS Root CA v3 O=Telia Company AB
+# Label: "Telia EC TLS Root CA v3"
+# Serial: 8028200332079443110287896228123317
+# MD5 Fingerprint: b6:fa:6a:5c:42:fb:c5:67:72:c0:e0:2f:72:fb:5a:44
+# SHA1 Fingerprint: b4:d6:07:c2:a5:95:bc:5b:f4:67:4d:c9:dc:6f:6f:0a:00:7a:a5:35
+# SHA256 Fingerprint: 09:8e:08:a9:1d:bb:f7:74:78:b9:6c:ce:b8:9b:14:13:a5:da:37:b7:c8:62:60:6a:95:5d:eb:07:17:9f:43:26
+-----BEGIN CERTIFICATE-----
+MIICMjCCAbegAwIBAgIPAYvSIlRjTQSLbOVHH9K1MAoGCCqGSM49BAMDMEoxCzAJ
+BgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSAwHgYDVQQDDBdU
+ZWxpYSBFQyBUTFMgUm9vdCBDQSB2MzAeFw0yMzExMTUwODU1MjZaFw00ODA1MjMx
+MTAwMDBaMEoxCzAJBgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFC
+MSAwHgYDVQQDDBdUZWxpYSBFQyBUTFMgUm9vdCBDQSB2MzB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABMHIlhVDLbmFKUpW0iK4dpryT6emYOeS31JPwWnWPmkWRrAkTbPX
+40sQfHI9mpR7Rbktu3ngg6W+BBSXSechtMCnBmWXj/EaVlmV5cY1jD2HoTfhBQ3A
+acpCNMLJK4NpZaNjMGEwHwYDVR0jBBgwFoAU1GToQ4g6cy/QGnGCNgtehd7H3kMw
+HQYDVR0OBBYEFNRk6EOIOnMv0BpxgjYLXoXex95DMA4GA1UdDwEB/wQEAwIBBjAP
+BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA2kAMGYCMQCXAUdS/9bbJ8A1JYaG
+f/bWt/s7Ta0ot5Ulno8OjSNYRWQIlS4tVWldvTAVA7heOFgCMQCvKr8+Z2Rn+OBr
+5UHzlgBObpad1LuwNTRcdNgUJxIWadcki+UBLEi1/AURKV5md2M=
+-----END CERTIFICATE-----
+
+# Issuer: CN=Telia RSA TLS Root CA v3 O=Telia Company AB
+# Subject: CN=Telia RSA TLS Root CA v3 O=Telia Company AB
+# Label: "Telia RSA TLS Root CA v3"
+# Serial: 8028214673410753541795188766939845
+# MD5 Fingerprint: f4:8b:9c:f3:f8:63:cf:dc:25:8f:b4:bb:a2:e9:9d:e2
+# SHA1 Fingerprint: b5:2e:88:4e:40:c1:11:fb:50:c7:e2:4f:ac:18:2b:bd:68:15:d2:34
+# SHA256 Fingerprint: d1:3d:b1:29:4c:45:eb:c6:fc:86:c6:bb:f6:9f:a2:9b:df:e6:92:df:f7:c7:13:c2:43:c7:a9:56:c6:a2:28:4c
+-----BEGIN CERTIFICATE-----
+MIIFgjCCA2qgAwIBAgIPAYvSUKtCVSxHWr2h3BrFMA0GCSqGSIb3DQEBDAUAMEsx
+CzAJBgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSEwHwYDVQQD
+DBhUZWxpYSBSU0EgVExTIFJvb3QgQ0EgdjMwHhcNMjMxMTE1MDk0NzQyWhcNNDgw
+NTIzMTEwMDAwWjBLMQswCQYDVQQGEwJTRTEZMBcGA1UECgwQVGVsaWEgQ29tcGFu
+eSBBQjEhMB8GA1UEAwwYVGVsaWEgUlNBIFRMUyBSb290IENBIHYzMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsV89KG19hCf4S1Fvk8D3TyDERhmcvx8F
+7Kmb4WATx3ije1id3KHxRE0TKmcNCbAQ57bvHFEYa4hR2l20VjVadExqOW+2ld99
+MbEiO+jRVOz+BbxLxJnmGwCqI+BfuTjjVReDxsxjQvjgBsClaO/sm5i70nlZcWGR
+tIkvWDK3NNkT5RtwXc/O8NTFVpbUqT6cRjIj3olAblR+lRf4Ffy5o+Q9fabjYn9Z
+9S4itruElcEFf9Ljk7fwdTycT/rvJW9w/B3G2a3r0f/zXNOVruIBcqE6pkSospAC
+U2bG42fYKrbM/GWnp7u+p9Frz4jaNwpb4YHuEeS8BratNcP8X62jXIvvKHxlsMDJ
+Cnb4U8JzFOLsU6mohVY58BdZrvi0Gk9UOuqmgoG6dskHoksjZTlK61D/InzmEoA1
+yAYJFDVysjRxDUOu9cAwANbqmq77WIFL6BpnZgVqPtMfG6wN8BrTKdapvilVsYR5
+9BFgIsAVBMxrGh+W+QcvmJafUpASvlArKvVG2FI4i6PiLjSBT0+6F6EQLrYqefOQ
+F/fBNEXb+njUQ0SUVrAqtH4Y+OjCI/a4/JJQppxeemZcQ0SUShgiI5AM5xHO5iya
+UrTjYH4zxUz9j+1FEbDH/xpstr1gXBykspup+hRTaJcbA+UbpJqtWZndAPddJmt6
+YJQ+dU3pDu8CAwEAAaNjMGEwHwYDVR0jBBgwFoAUsMep0t2yKFZzBJSMFFxIbzdS
+kqgwHQYDVR0OBBYEFLDHqdLdsihWcwSUjBRcSG83UpKoMA4GA1UdDwEB/wQEAwIB
+BjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQBdYzFsNGDRk7bR
+/AgRKq+5637YuOW+w6uhpoS0VnKMUpyHCwku86hEvqivakPtfmlm4bFwt++sb/8O
+XsWBqtfbXMaBNDTZl8XRMJuLWOW2JrbKkRzgG0eBUcvsadG1rrhbmZqYvFXaAZO7
+o4TdOZzxhBB5GOAWWXB3IeraNP4J63zyo9n8Gqw3sJBG44em5hoYjBffP+npibys
+lnslRi4L6xHsCYj/Pab+OlqbMCB6v+sTCLeEIukRVzoR9aQ45pEK7Z1QBnSsbAKQ
+tss0JKD9d/mX143H1xePjPhTXlv5JCkhrcj+SShz0P9+EHoWe6m9lyUEOIVn0rp+
+yVJWNbmyDv3VkwFxHC1ApSQsgSimjGQ4wtr6cSmordYxkV+Ro8lOIIhRksXPyDk2
+7gW6IjUXCkZKpxFjkL3jiBSc8SkxnwCWtXg8xwNwdFVNBGLCCuJnsneYXjJNqzRq
+UcoGwzsvF3Qi/ZnHUNvISdevlgIAXL4Wvrxaqvoa01wB+GCfs57RTGE4TvAGhKNK
+us8K3hRT1BSpigzMIRzSxtAOrqPN6j//QSmW9f8Jcncri4j2ihSpVrFU0NdNkMhZ
+eAKidTFPsxCVFuW4Aniz7jqiw5sWtjbQrlW035izIEU4sYwQoC1Nx0Svy+mMTRai
+50LqFQ+A1/Hq6xHHDNx7CI83d23Erw==
+-----END CERTIFICATE-----

src-tauri/binaries/_internal/curl_cffi-0.15.0.dist-info/RECORD

@@ -1,60 +0,0 @@
-../../../bin/curl-cffi,sha256=1WNmf_w0emP0-PeIpDGlHiBy4Gdet6ASfQxBOR-BNMA,187
-curl_cffi-0.15.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
-curl_cffi-0.15.0.dist-info/METADATA,sha256=ryYvNCZOl96BIMI2134ZhyRWy7sr-0-xOc0Q_TfaU9A,18405
-curl_cffi-0.15.0.dist-info/RECORD,,
-curl_cffi-0.15.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-curl_cffi-0.15.0.dist-info/WHEEL,sha256=BX73HzL_Z8VmcUg66xwFel1CJ1goP9ZPbeeVSSFaesY,140
-curl_cffi-0.15.0.dist-info/direct_url.json,sha256=ORhsskaIg_jwHIDYD7oRH5nzN3fKYa7xVFg-8WceJ5E,313
-curl_cffi-0.15.0.dist-info/entry_points.txt,sha256=HzTwoUpbiKIo5uJrqnxPk5OdxZ0PhT0dPTSqUP8Js70,49
-curl_cffi-0.15.0.dist-info/licenses/LICENSE,sha256=PoiwKbULav021rGGQs5Mi27uTJA_HPq-9bgR9h4HBQs,1106
-curl_cffi-0.15.0.dist-info/top_level.txt,sha256=b51YB50I_vu6XAbSERmqtgaYciYADCA_baVoZ_T5Lzs,10
-curl_cffi/__init__.py,sha256=fPBkVIThnbk_a7U41V5S3Qwhh1_WxZkMerXQNv1iOpA,1781
-curl_cffi/__main__.py,sha256=L0AH-xyDlgmsPM-HTecPVb1_hV9X35Qf1Mw7h7JVnx0,39
-curl_cffi/__pycache__/__init__.cpython-314.pyc,,
-curl_cffi/__pycache__/__main__.cpython-314.pyc,,
-curl_cffi/__pycache__/__version__.cpython-314.pyc,,
-curl_cffi/__pycache__/_asyncio_selector.cpython-314.pyc,,
-curl_cffi/__pycache__/aio.cpython-314.pyc,,
-curl_cffi/__pycache__/const.cpython-314.pyc,,
-curl_cffi/__pycache__/curl.cpython-314.pyc,,
-curl_cffi/__pycache__/utils.cpython-314.pyc,,
-curl_cffi/__version__.py,sha256=FdOv9cpHIUGkFkcWA4O9gte0sun1QgJI69rIgzUkswo,413
-curl_cffi/_asyncio_selector.py,sha256=dxKOC6B8mlRu3WYi0trSq0L-FsWV6l_pg9TP35OpDI4,13043
-curl_cffi/_wrapper.abi3.so,sha256=4sMTX_Q2WMouO96xfxc3BZjZxnMZnLjZV8nF_FCU_zE,12691712
-curl_cffi/aio.py,sha256=oTiffUFDNfxxSHmCVAsjX0CIOs4IuBQ6mhm4WuY5KZs,11925
-curl_cffi/cli/__init__.py,sha256=y-XQAfYkBDN3ejfVex1aKy5bcqsPUglAvm-i177wM5I,7290
-curl_cffi/cli/__pycache__/__init__.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/doctor.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/output.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/parse.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/request.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/run.cpython-314.pyc,,
-curl_cffi/cli/doctor.py,sha256=4wfyWF44JLxDtoH9YCDdmxrJ-1cWbNwSXcMc9Aopd1c,416
-curl_cffi/cli/output.py,sha256=YzWbYLJ2zowR6G9mJxeTytcPrnSk2WQVwfmv8V404X4,6709
-curl_cffi/cli/parse.py,sha256=OzqGEZPqOrH2nq14UKnaXwKAblAw6V867tDEp9XSLdo,2549
-curl_cffi/cli/request.py,sha256=MJskNMJBIR8oq_fvrPvsi61Wy-bR4-aC8QQJb1YcqRg,3522
-curl_cffi/cli/run.py,sha256=WYaPbX9h85DZQNkDbUUyvp3bryaAuNOxnjU6GpenigQ,7554
-curl_cffi/const.py,sha256=mF3H1kHsqj-dfd7GWHMHyuB2bZ3QZd61tC1iCZgEjyo,18523
-curl_cffi/curl.py,sha256=woBPw1OQk4FH7neNETuj_GwqcQa1jCjd1tA0ZxPSTA8,26928
-curl_cffi/py.typed,sha256=dcrsqJrcYfTX-ckLFJMTaj6mD8aDe2u0tkQG-ZYxnEg,26
-curl_cffi/requests/__init__.py,sha256=3ZO7mC7gNJZydze0VQLEYpEc9dMlf1uRbFS-fxKSQPs,6148
-curl_cffi/requests/__pycache__/__init__.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/cookies.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/errors.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/exceptions.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/headers.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/impersonate.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/models.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/session.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/utils.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/websockets.cpython-314.pyc,,
-curl_cffi/requests/cookies.py,sha256=QDEuhtsSjh6iNAKmp5TnGyyAe8wdDJCADCHY_GWCeCc,11867
-curl_cffi/requests/errors.py,sha256=R6N5lmOTdRukThkNGUihDAQRu8HSh27M8E3zfUJJX74,250
-curl_cffi/requests/exceptions.py,sha256=ViyLx3XHii_s7kjrO3GhVOVXhq2_UsYfAQl8MPwDnEM,6187
-curl_cffi/requests/headers.py,sha256=Q1jrRdJ2YMLOcl5W3WBaKZAdLbPGPPERJ6MYzos3YXk,11535
-curl_cffi/requests/impersonate.py,sha256=dKRpbPTqLCABrCmSKmgXyhA1zmrv0DMuSuqQyhn5-FU,13389
-curl_cffi/requests/models.py,sha256=SaN9QUYyljUDFDQnUrYZRl9KiUe25nb2c2ca-dfq3Nw,11487
-curl_cffi/requests/session.py,sha256=LkfPvAr8BIVzB_K91xwh0wIPRW26mi2VJd1cEYorIho,58871
-curl_cffi/requests/utils.py,sha256=zMKaWoXcAPFNBv6FglE3FSAPNuxYr_leUcWKnhfYecw,26618
-curl_cffi/requests/websockets.py,sha256=RJVNqCDrlLWzQ12Ym9M5_T0SW4EmoqKUYsXXTaQmBRQ,71685
-curl_cffi/utils.py,sha256=gRVzO-vhjf596V6kr_SjwHlwJfDIwTrPbRLJvvNlUNE,307

src-tauri/binaries/_internal/curl_cffi-0.15.0.dist-info/direct_url.json

@@ -1 +0,0 @@
-{"archive_info": {"hash": "sha256=630653d283070b21deca8ee408dcdc98ac4202d80cc9d038db805d45e0b40550", "hashes": {"sha256": "630653d283070b21deca8ee408dcdc98ac4202d80cc9d038db805d45e0b40550"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/universal2/curl_cffi-0.15.0-cp310-abi3-macosx_10_9_universal2.whl"}

src-tauri/binaries/_internal/curl_cffi-0.16.0.dist-info/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: curl_cffi
-Version: 0.15.0
+Version: 0.16.0
 Summary: libcurl ffi bindings for Python, with impersonation support.
 Author-email: lexiforest <infinitesheldon@gmail.com>
 License-Expression: MIT
@@ -19,11 +19,12 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cffi>=2.0.0
 Requires-Dist: certifi>=2024.2.2
-Requires-Dist: rich
 Provides-Extra: extra
 Requires-Dist: readability-lxml>=0.8.1; extra == "extra"
 Requires-Dist: markdownify>=1.1.0; extra == "extra"
 Requires-Dist: lxml_html_clean; extra == "extra"
+Provides-Extra: cli
+Requires-Dist: rich; extra == "cli"
 Provides-Extra: dev
 Requires-Dist: charset_normalizer<4.0,>=3.3.2; extra == "dev"
 Requires-Dist: coverage<7.0,>=6.4.1; extra == "dev"
@@ -90,12 +91,6 @@ Python 3.10 is the minimum supported version since v0.14.
 
 If you’re looking for a meeting recording API, consider checking out [Recall.ai](https://www.recall.ai/?utm_source=github&utm_medium=sponsorship&utm_campaign=lexiforest-curl_cffi), an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and more.
 
-## Residential Proxies
-
-<a href="https://www.thordata.com/?ls=github&lk=curl_" target="_blank"><img src="https://raw.githubusercontent.com/lexiforest/curl_cffi/main/assets/thordata.png" alt="Thordata" height="126" width="240"></a>
-
-Thordata: A reliable and cost-effective proxy service provider. One-click collection of public network data, providing enterprises and developers with stable, efficient, and compliant global proxy IP services. Register for a free trial of [residential proxies](https://www.thordata.com/?ls=github&lk=curl_) and receive 2000 free SERP API calls.
-
 ## Sponsors
 
 Maintenance of this project is made possible by all the <a href="https://github.com/lexiforest/curl_cffi/graphs/contributors">contributors</a> and <a href="https://github.com/sponsors/lexiforest">sponsors</a>. If you'd like to sponsor this project and have your avatar or company logo appear below <a href="https://github.com/sponsors/lexiforest">click here</a>. 💖
@@ -124,6 +119,15 @@ No browser automation. Just simple API calls that return the exact cookies and h
 
 ------
 
+## Impersonate Suite
+
+`curl-cffi` is part of the impersonate suite.
+
+- [curl-impersonate](https://github.com/lexiforest/curl-impersonate). A curl distribution that impersonates browsers.
+- [curl_cffi](https://github.com/lexiforest/curl_cffi). Python binding to curl-impersonate.
+- [impers](https://github.com/lexiforest/impers). Node.js binding to curl-impersonate.
+- [impersonate.pro](https://impersonate.pro). Commercial support, more fingerprints and integrated solutions.
+
 ## Features
 
 - Supports JA3/TLS and http2 fingerprints impersonation, including recent browsers and custom fingerprints.
@@ -163,25 +167,28 @@ replacement for "claws" and "agents".
 |http/2|✅|❌|✅|
 |http/3|☑️<sup>1</sup>|❌|✅|
 |human-friendly|☑️<sup>2</sup>|✅|✅|
-|colorful|❌|✅|✅|
+|colorful|❌|✅|✅<sup>3</sup>|
 |fingerprints|❌|❌|✅|
 
 Notes:
 
 1. You need an http/3 enabled curl build, it's not enabled by default, at leat on my machine.
 2. As a long time command line user, I personally feel very comfortable using `curl -X POST httpbin.org`, but some users may prefer `http GET httpbin.org` syntax. If you prefer the curl syntax, you can keep using `curl-impersonate`.
+3. Install `curl_cffi[cli]` for colorful CLI output. Without `rich`, the CLI uses plain text output.
 
 ## Install
 
     pip install curl_cffi --upgrade
 
 This should work on Linux, macOS and Windows out of the box.
-If it does not work on you platform, you may need to compile and install `curl-impersonate`
-first and set some environment variables like `LD_LIBRARY_PATH`.
 
-Android support, including Termux, is currently in beta, you can install the beta release for testing.
+On macOS, you can also install via Homebrew:
+
+    brew install lexiforest/tap/curl-cffi
+
+<small>Android support, including Termux, is currently in beta, you can install the beta release for testing.
 For BSD systems, we need to get libcurl-impersonate compile first, and then add support in curl_cffi.
-If you are using these OSes, please lend an hand.
+If you are using these OSes, please lend an hand.</small>
 
 To install beta releases:
 
@@ -235,11 +242,6 @@ r = curl_cffi.get(
     impersonate="chrome"
 )
 
-# Randomly choose a browser version based on current market share in real world
-# from: https://caniuse.com/usage-table
-# NOTE: this is a pro feature.
-r = curl_cffi.get("https://example.com", impersonate="realworld")
-
 # To pin a specific version, use version numbers together.
 r = curl_cffi.get("https://tls.browserleaks.com/json", impersonate="chrome124")
 
@@ -273,45 +275,42 @@ print(r.json())
 
 ### Supported impersonate browsers
 
-`curl_cffi` supports the same browser versions as supported by my [fork](https://github.com/lexiforest/curl-impersonate) of [curl-impersonate](https://github.com/lwthiker/curl-impersonate):
+`curl_cffi` supports the same browser versions preset as supported by our [fork](https://github.com/lexiforest/curl-impersonate) of [curl-impersonate](https://github.com/lwthiker/curl-impersonate):
 
-Open source version of curl_cffi includes versions whose fingerprints differ from previous versions.
-If you see a version, e.g. `chrome135`, were skipped, you can simply impersonate it with your own headers and the previous version.
+The open source version of `curl_cffi` includes versions when we are adding new capabilities for impersonating.
+If you see a version, e.g. `chrome135`, was skipped, it's simply because there's nothing new or we were busy at that time. 
+You can simply impersonate it with your own headers and the previous browser target.
 
-If you don't want to look up the headers etc, by yourself, consider buying commercial support from [impersonate.pro](https://impersonate.pro),
-we have comprehensive browser fingerprints database for almost all the browser versions on various platforms.
+For a full list of preset fingerprints, see the [curl-impersonate docs](https://curl-impersonate.readthedocs.io/en/latest/fingerprints.html). 
+We will no longer put duplicated and outdated info here.
 
-If you are trying to impersonate a target other than a browser, use `ja3=...` and `akamai=...`
+If you don't want to look up the headers/etc by yourself, consider buying commercial support from [impersonate.pro](https://impersonate.pro).
+We have comprehensive browser tls, http and JavaScript fingerprints database for almost all the browser versions on various platforms.
+
+Since v0.15.1, you can use `curl-cffi update` to retrieve the latest fingerprints, without updating to a new version.
+We offer the Safari, Chrome, Firefox updates for free and others as part of the [commercial plan](https://impersonate.pro).
+
+The current number of fingerprints:
+
+![Preset](https://img.shields.io/badge/Preset_Fingerprints-37-blue)
+![Free](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fapi.impersonate.pro%2Fv1%2Fcounts&query=%24.free&label=Free%20Fingerprints) 
+![Pro](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fapi.impersonate.pro%2Fv1%2Fcounts&query=%24.all&label=Pro%20Fingerprints)
+
+To see the current list of fingerprints on your device, use the command line:
+
+```sh
+curl-cffi list
+```
+
+To update fingerprints from impersonate.pro, use the command line:
+
+```sh
+curl-cffi update
+```
+
+If you are trying to impersonate a target other than a browser, use `ja3=...`, `akamai=...`, `extra_fp=...`, and `perk=...`
 to specify your own customized fingerprints. See the [docs on impersonation](https://curl-cffi.readthedocs.io/en/latest/impersonate/_index.html) for details.
 
-|Browser|Open Source| Pro version|
-|---|---|---|
-|Chrome|chrome99, chrome100, chrome101, chrome104, chrome107, chrome110, chrome116<sup>[1]</sup>, chrome119<sup>[1]</sup>, chrome120<sup>[1]</sup>, chrome123<sup>[3]</sup>, chrome124<sup>[3]</sup>, chrome131<sup>[4]</sup>, chrome133a<sup>[5][6]</sup>, chrome136<sup>[6]</sup>, chrome142, chrome145<sup>[9]</sup>, chrome146<sup>[9]</sup>|chrome132, chrome134, chrome135|
-|Chrome Android| chrome99_android, chrome131_android <sup>[4]</sup>|chrome132_android, chrome133_android, chrome134_android, chrome135_android|
-|Chrome iOS|N/A|coming soon|
-|Safari <sup>[7]</sup>|safari153 <sup>[2]</sup>, safari155 <sup>[2]</sup>, safari170 <sup>[1]</sup>, safari180 <sup>[4]</sup>, safari184 <sup>[6]</sup>, safari260 <sup>[8]</sup>|coming soon|
-|Safari iOS <sup>[7]</sup>| safari172_ios<sup>[1]</sup>, safari180_ios<sup>[4]</sup>, safari184_ios <sup>[6]</sup>, safari260_ios <sup>[8]</sup>|coming soon|
-|Firefox|firefox133<sup>[5]</sup>, firefox135<sup>[7]</sup>, firefox144, firefox147<sup>[9]</sup>|coming soon|
-|Firefox Android|N/A|firefox135_android|
-|Tor|tor145 <sup>[7]</sup>|coming soon|
-|Edge|edge99, edge101|edge133, edge135|
-|Opera|N/A|coming soon|
-|Brave|N/A|coming soon|
-
-
-Notes:
-
-1. Added in version `0.6.0`.
-2. Fixed in version `0.6.0`, previous http2 fingerprints were [not correct](https://github.com/lwthiker/curl-impersonate/issues/215).
-3. Added in version `0.7.0`.
-4. Added in version `0.8.0`.
-5. Added in version `0.9.0`.
-6. The version postfix `-a`(e.g. `chrome133a`) means that this is an alternative version, i.e. the fingerprint has not been officially updated by browser, but has been observed because of A/B testing.
-5. Added in version `0.10.0`.
-6. Added in version `0.11.0`.
-7. Since `0.11.0`, the format `safari184_ios` is preferred over `safari18_4_ios`, both are supported, but the latter is quite confusing and hard to parse.
-8. Added in  `0.12.0`.
-9. http3 support included.
 
 ### Asyncio
 
@@ -370,11 +369,13 @@ async with AsyncSession() as session:
             print(message)
 ```
 
+See the WebSocket [docs](https://curl-cffi.readthedocs.io/en/latest/websockets.html) for full details and advanced options.
+
 ## Ecosystem
 
 - Integrating with Scrapy: [divtiply/scrapy-curl-cffi](https://github.com/divtiply/scrapy-curl-cffi), [jxlil/scrapy-impersonate](https://github.com/jxlil/scrapy-impersonate) and [tieyongjie/scrapy-fingerprint](https://github.com/tieyongjie/scrapy-fingerprint).
 - Integrating with [requests](https://github.com/el1s7/curl-adapter), [httpx](https://github.com/vgavro/httpx-curl-cffi) as adapter.
-- Integrating with captcha resolvers: [YesCaptcha](https://yescaptcha.atlassian.net/wiki/spaces/YESCAPTCHA/overview). Please see the head area for promo code and link.
+- Integrating with captcha resolvers: [YesCaptcha](https://yescaptcha.com/i/stfnIO).
 
 ## Acknowledgement
 

src-tauri/binaries/_internal/curl_cffi-0.16.0.dist-info/RECORD

@@ -0,0 +1,68 @@
+../../../bin/curl-cffi,sha256=1WNmf_w0emP0-PeIpDGlHiBy4Gdet6ASfQxBOR-BNMA,187
+curl_cffi-0.16.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+curl_cffi-0.16.0.dist-info/METADATA,sha256=2xKv2aRl-HtOcwKKcucrZQ-F51XFo7VpRXQtYLJ0F-c,17463
+curl_cffi-0.16.0.dist-info/RECORD,,
+curl_cffi-0.16.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+curl_cffi-0.16.0.dist-info/WHEEL,sha256=mLbZYCWBc4fJzW1y2K2PE77e-mZLwFI4W61tEVJsa_c,140
+curl_cffi-0.16.0.dist-info/direct_url.json,sha256=foVsUM-Bj-Y-YxcNjF92n-aYB3GyM3Vsbf5rTFvl84g,313
+curl_cffi-0.16.0.dist-info/entry_points.txt,sha256=HzTwoUpbiKIo5uJrqnxPk5OdxZ0PhT0dPTSqUP8Js70,49
+curl_cffi-0.16.0.dist-info/licenses/LICENSE,sha256=PoiwKbULav021rGGQs5Mi27uTJA_HPq-9bgR9h4HBQs,1106
+curl_cffi-0.16.0.dist-info/top_level.txt,sha256=b51YB50I_vu6XAbSERmqtgaYciYADCA_baVoZ_T5Lzs,10
+curl_cffi/__init__.py,sha256=6YJwgd_t8GbuHk2mqe7PWNqmkYVTjhX9gCVxzTIyYdc,1986
+curl_cffi/__main__.py,sha256=L0AH-xyDlgmsPM-HTecPVb1_hV9X35Qf1Mw7h7JVnx0,39
+curl_cffi/__pycache__/__init__.cpython-314.pyc,,
+curl_cffi/__pycache__/__main__.cpython-314.pyc,,
+curl_cffi/__pycache__/__version__.cpython-314.pyc,,
+curl_cffi/__pycache__/_asyncio_selector.cpython-314.pyc,,
+curl_cffi/__pycache__/aio.cpython-314.pyc,,
+curl_cffi/__pycache__/const.cpython-314.pyc,,
+curl_cffi/__pycache__/curl.cpython-314.pyc,,
+curl_cffi/__pycache__/fingerprints.cpython-314.pyc,,
+curl_cffi/__pycache__/utils.cpython-314.pyc,,
+curl_cffi/__version__.py,sha256=FdOv9cpHIUGkFkcWA4O9gte0sun1QgJI69rIgzUkswo,413
+curl_cffi/_asyncio_selector.py,sha256=dxKOC6B8mlRu3WYi0trSq0L-FsWV6l_pg9TP35OpDI4,13043
+curl_cffi/_wrapper.abi3.so,sha256=SGLe3OukfFgEvCILm0yzeoQ2emxeRX0pgLKMjJGQ88M,13622944
+curl_cffi/aio.py,sha256=BxbiWI2ugesL6sHfKk_34A25hzTWAy4mf2G4kRKq29Q,12123
+curl_cffi/cli/__init__.py,sha256=6is7D4E46XsOYGYUnfey9maSG4DrARwEk3I4kJv1d-8,7852
+curl_cffi/cli/__pycache__/__init__.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/doctor.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/output.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/parse.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/pro.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/request.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/run.cpython-314.pyc,,
+curl_cffi/cli/doctor.py,sha256=XduqJ51u99yOZ2njyAIIppTSqZJnd_Z8KnsGOXUkip8,1341
+curl_cffi/cli/output.py,sha256=IGBa2cN4jdSe7EScutghBXe9mcHcj59RsfIzzPLpx-s,7434
+curl_cffi/cli/parse.py,sha256=OzqGEZPqOrH2nq14UKnaXwKAblAw6V867tDEp9XSLdo,2549
+curl_cffi/cli/pro.py,sha256=pu2lnZUD91T0oayJMgPs6w6eLYKM6ZFlhHLE-g75UaM,3575
+curl_cffi/cli/request.py,sha256=ixFJEhHoymZFukc4dqw_AgNuR7fEtSkd3RZaHZdxOnk,3571
+curl_cffi/cli/run.py,sha256=zrxDpPfZPmeY3ADhjR2It2wj3hsOpqaxh88pe11-VMU,7616
+curl_cffi/const.py,sha256=gzF7UzT41jfTF7-GGkKAEhG0CIXmeIZtbNAMEZobuig,19101
+curl_cffi/curl.py,sha256=GmEF9TW0nYZ8PEcvc-Jsn_7vbymJlqGgmV0P5kzgMoY,30648
+curl_cffi/fingerprints.py,sha256=WB25rx-f_ZYdZiEMWF_egnJb8wACZrIncAqu1sHRJf8,20666
+curl_cffi/py.typed,sha256=dcrsqJrcYfTX-ckLFJMTaj6mD8aDe2u0tkQG-ZYxnEg,26
+curl_cffi/requests/__init__.py,sha256=jt8mwSVLOmFgTUOQoxrXEj-qpst8cJbLdVQXVq-U6rw,6449
+curl_cffi/requests/__pycache__/__init__.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/cache.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/cookies.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/errors.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/exceptions.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/headers.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/impersonate.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/models.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/session.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/streams.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/utils.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/websockets.cpython-314.pyc,,
+curl_cffi/requests/cache.py,sha256=sMZB7BA66Ain2VUZ7qWNN-3Fmd2TiPNaxzCybHgnLxY,15629
+curl_cffi/requests/cookies.py,sha256=75TLz2wTcIz7NnETCpVVZUk8lvo02y_WFzwOa7A3aZE,13525
+curl_cffi/requests/errors.py,sha256=R6N5lmOTdRukThkNGUihDAQRu8HSh27M8E3zfUJJX74,250
+curl_cffi/requests/exceptions.py,sha256=WM3EAhADLPf_Kh4nzZOtJplTw9Nwv-vCIyeXx7FVT9g,6225
+curl_cffi/requests/headers.py,sha256=Q1jrRdJ2YMLOcl5W3WBaKZAdLbPGPPERJ6MYzos3YXk,11535
+curl_cffi/requests/impersonate.py,sha256=MIIBJxlk86nPxFyhfseyEuvY17BZTNYMafKNgGf2eXc,11188
+curl_cffi/requests/models.py,sha256=iz5k97OLrOthxAswA9abNQxiWDSQ4lWJrujUAZAMaIo,13173
+curl_cffi/requests/session.py,sha256=Mi7Wduep5maFi8p7KBsxTUfa6KB5ArLz5wWGn4j6cXE,66489
+curl_cffi/requests/streams.py,sha256=un9rtp5GL-U5A5ivyFIDcfXwxk6MMVrO2CGCbzDdpso,7090
+curl_cffi/requests/utils.py,sha256=z2Ee4gBmfUxdv_SOTQrdUtb0uUKaDAxk4kgrcVLqB3Y,37762
+curl_cffi/requests/websockets.py,sha256=Hn2Z6Jqf5SKJ-qyQyisr9Iu4vVHQYr-iT9ws_7jPHDI,72783
+curl_cffi/utils.py,sha256=xiwsOd-5W3IGNvO6yeDboOkw9wLPD2hx_SYD9i4SqVU,390

src-tauri/binaries/_internal/curl_cffi-0.16.0.dist-info/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (82.0.1)
+Generator: setuptools (83.0.0)
 Root-Is-Purelib: false
 Generator: delocate 0.13.0
 Tag: cp310-abi3-macosx_10_9_universal2

src-tauri/binaries/_internal/curl_cffi-0.16.0.dist-info/direct_url.json

@@ -0,0 +1 @@
+{"archive_info": {"hash": "sha256=66b0c44d84b669c513c4798475b5702c2dbd2f061f708bff0b2ee4c9c9563e02", "hashes": {"sha256": "66b0c44d84b669c513c4798475b5702c2dbd2f061f708bff0b2ee4c9c9563e02"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/universal2/curl_cffi-0.16.0-cp310-abi3-macosx_10_9_universal2.whl"}

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/INSTALLER

@@ -1 +0,0 @@
-uv

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/METADATA

@@ -1,133 +0,0 @@
-Metadata-Version: 2.4
-Name: importlib_metadata
-Version: 8.7.1
-Summary: Read metadata from Python packages
-Author-email: "Jason R. Coombs" <jaraco@jaraco.com>
-License-Expression: Apache-2.0
-Project-URL: Source, https://github.com/python/importlib_metadata
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Intended Audience :: Developers
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3 :: Only
-Requires-Python: >=3.9
-Description-Content-Type: text/x-rst
-License-File: LICENSE
-Requires-Dist: zipp>=3.20
-Provides-Extra: test
-Requires-Dist: pytest!=8.1.*,>=6; extra == "test"
-Requires-Dist: packaging; extra == "test"
-Requires-Dist: pyfakefs; extra == "test"
-Requires-Dist: flufl.flake8; extra == "test"
-Requires-Dist: pytest-perf>=0.9.2; extra == "test"
-Requires-Dist: jaraco.test>=5.4; extra == "test"
-Provides-Extra: doc
-Requires-Dist: sphinx>=3.5; extra == "doc"
-Requires-Dist: jaraco.packaging>=9.3; extra == "doc"
-Requires-Dist: rst.linker>=1.9; extra == "doc"
-Requires-Dist: furo; extra == "doc"
-Requires-Dist: sphinx-lint; extra == "doc"
-Requires-Dist: jaraco.tidelift>=1.4; extra == "doc"
-Provides-Extra: perf
-Requires-Dist: ipython; extra == "perf"
-Provides-Extra: check
-Requires-Dist: pytest-checkdocs>=2.4; extra == "check"
-Requires-Dist: pytest-ruff>=0.2.1; sys_platform != "cygwin" and extra == "check"
-Provides-Extra: cover
-Requires-Dist: pytest-cov; extra == "cover"
-Provides-Extra: enabler
-Requires-Dist: pytest-enabler>=3.4; extra == "enabler"
-Provides-Extra: type
-Requires-Dist: pytest-mypy>=1.0.1; extra == "type"
-Requires-Dist: mypy<1.19; platform_python_implementation == "PyPy" and extra == "type"
-Dynamic: license-file
-
-.. image:: https://img.shields.io/pypi/v/importlib_metadata.svg
-   :target: https://pypi.org/project/importlib_metadata
-
-.. image:: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
-
-.. image:: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
-   :target: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
-   :alt: tests
-
-.. image:: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json
-    :target: https://github.com/astral-sh/ruff
-    :alt: Ruff
-
-.. image:: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
-   :target: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
-
-.. image:: https://img.shields.io/badge/skeleton-2025-informational
-   :target: https://blog.jaraco.com/skeleton
-
-.. image:: https://tidelift.com/badges/package/pypi/importlib-metadata
-   :target: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm_medium=readme
-
-Library to access the metadata for a Python package.
-
-This package supplies third-party access to the functionality of
-`importlib.metadata <https://docs.python.org/3/library/importlib.metadata.html>`_
-including improvements added to subsequent Python versions.
-
-
-Compatibility
-=============
-
-New features are introduced in this third-party library and later merged
-into CPython. The following table indicates which versions of this library
-were contributed to different versions in the standard library:
-
-.. list-table::
-   :header-rows: 1
-
-   * - importlib_metadata
-     - stdlib
-   * - 7.0
-     - 3.13
-   * - 6.5
-     - 3.12
-   * - 4.13
-     - 3.11
-   * - 4.6
-     - 3.10
-   * - 1.4
-     - 3.8
-
-
-Usage
-=====
-
-See the `online documentation <https://importlib-metadata.readthedocs.io/>`_
-for usage details.
-
-`Finder authors
-<https://docs.python.org/3/reference/import.html#finders-and-loaders>`_ can
-also add support for custom package installers.  See the above documentation
-for details.
-
-
-Caveats
-=======
-
-This project primarily supports third-party packages installed by PyPA
-tools (or other conforming packages). It does not support:
-
-- Packages in the stdlib.
-- Packages installed without metadata.
-
-Project details
-===============
-
- * Project home: https://github.com/python/importlib_metadata
- * Report bugs at: https://github.com/python/importlib_metadata/issues
- * Code hosting: https://github.com/python/importlib_metadata
- * Documentation: https://importlib-metadata.readthedocs.io/
-
-For Enterprise
-==============
-
-Available as part of the Tidelift Subscription.
-
-This project and the maintainers of thousands of other packages are working with Tidelift to deliver one enterprise subscription that covers all of the open source you use.
-
-`Learn more <https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm_medium=referral&utm_campaign=github>`_.

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/RECORD

@@ -1,21 +0,0 @@
-importlib_metadata-8.7.1.dist-info/INSTALLER,sha256=5hhM4Q4mYTT9z6QB6PGpUAW81PGNFrYrdXMj4oM_6ak,2
-importlib_metadata-8.7.1.dist-info/METADATA,sha256=o-OLnuQyYonUhkcE8w4pnudp4jCc6fSnXw3hpQrQo1Y,4670
-importlib_metadata-8.7.1.dist-info/RECORD,,
-importlib_metadata-8.7.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-importlib_metadata-8.7.1.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-importlib_metadata-8.7.1.dist-info/licenses/LICENSE,sha256=RYUC4S2Xu_ZEOGBqIARKqF6wX7CoqAe7NdvsJT_R_AQ,10278
-importlib_metadata-8.7.1.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19
-importlib_metadata/__init__.py,sha256=u7Ew4-UkpzNY-ka6k-WRkDhQZS1akkLMfWs2eEnUmGo,37734
-importlib_metadata/_adapters.py,sha256=r5i8XLrKT6xmrpoREZhZrfczOYDmrVZeJBW5u0HzIGU,3797
-importlib_metadata/_collections.py,sha256=CxAhzlF3g1rwu_fMiB53JtRQiUFh0RgiMpoOvmK_ocg,760
-importlib_metadata/_compat.py,sha256=VC5ZDLlT-BcshauCShdFJvMNLntJJfZzNK1meGa-enw,1313
-importlib_metadata/_functools.py,sha256=0pA2OoiVK6wnsGq8HvVIzgdkvLiZ0nfnfw7IsndjoHk,3510
-importlib_metadata/_itertools.py,sha256=nMvp9SfHAQ_JYwK4L2i64lr3GRXGlYlikGTVzWbys_E,5351
-importlib_metadata/_meta.py,sha256=EtHyiJ5kGzWFDfKyQ2XQp6Vu113CeadKW1Vf6aGc1B4,1765
-importlib_metadata/_text.py,sha256=HCsFksZpJLeTP3NEk_ngrAeXVRRtTrtyh9eOABoRP4A,2166
-importlib_metadata/_typing.py,sha256=EQKhhsEgz_Sa-FnePI-faC72rNOOQwopjA1i5pG8FDU,367
-importlib_metadata/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-importlib_metadata/compat/py311.py,sha256=uqm-K-uohyj1042TH4a9Er_I5o7667DvulcD-gC_fSA,608
-importlib_metadata/compat/py39.py,sha256=J3W7PUVRPNYMmcvT12RF8ndBU9e8_T0Ac4U87Bsrq70,1187
-importlib_metadata/diagnose.py,sha256=nkSRMiowlmkhLYhKhvCg9glmt_11Cox-EmLzEbqYTa8,379
-importlib_metadata/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/WHEEL

@@ -1,5 +0,0 @@
-Wheel-Version: 1.0
-Generator: setuptools (80.9.0)
-Root-Is-Purelib: true
-Tag: py3-none-any
-

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/licenses/LICENSE

@@ -1,73 +0,0 @@
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
-
-"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
-
-"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
-
-     (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
-
-     (b) You must cause any modified files to carry prominent notices stating that You changed the files; and
-
-     (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
-
-     (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
-
-     You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!)  The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
-
-Copyright 2025 [name of copyright owner]
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/top_level.txt

@@ -1 +0,0 @@
-importlib_metadata

src-tauri/binaries/_internal/setuptools/_vendor/jaraco/text/Lorem ipsum.txt

@@ -1,2 +0,0 @@
-Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
-Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque. Aliquam faucibus, elit ut dictum aliquet, felis nisl adipiscing sapien, sed malesuada diam lacus eget erat. Cras mollis scelerisque nunc. Nullam arcu. Aliquam consequat. Curabitur augue lorem, dapibus quis, laoreet et, pretium ac, nisi. Aenean magna nisl, mollis quis, molestie eu, feugiat in, orci. In hac habitasse platea dictumst.

src-tauri/binaries/_internal/websockets-16.0.dist-info/RECORD

@@ -1,110 +0,0 @@
-../../../bin/websockets,sha256=Aec6LJ-SgqOC29VvGIAfJo3DbDp5-znjkFZaF7aEUTM,188
-websockets-16.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
-websockets-16.0.dist-info/METADATA,sha256=JcDvWo8DVSw5uoDAFbk9N8fJXuRJvnrcLXVBFyBjwN8,6799
-websockets-16.0.dist-info/RECORD,,
-websockets-16.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-websockets-16.0.dist-info/WHEEL,sha256=MzHA8aA11K4m-mjpjTobbWUqTlhv5RdoytLBFWQb_k4,142
-websockets-16.0.dist-info/direct_url.json,sha256=CKQvi9piWBTuZxzuK4J8f71FvL_6alBevkUUKBa4QCg,310
-websockets-16.0.dist-info/entry_points.txt,sha256=Dnhn4dm5EsI4ZMAsHldGF6CwBXZrGXnR7cnK2-XR7zY,51
-websockets-16.0.dist-info/licenses/LICENSE,sha256=PWoMBQ2L7FL6utUC5F-yW9ArytvXDeo01Ee2oP9Obag,1514
-websockets-16.0.dist-info/top_level.txt,sha256=CMpdKklxKsvZgCgyltxUWOHibZXZ1uYIVpca9xsQ8Hk,11
-websockets/__init__.py,sha256=AC2Hq92uSc_WOo9_xvITpGshJ7Dy0Md5m2_ywsdSt_Y,7058
-websockets/__main__.py,sha256=wu5N2wk8mvBgyvr2ghmQf4prezAe0_i-p123VVreyYc,62
-websockets/__pycache__/__init__.cpython-314.pyc,,
-websockets/__pycache__/__main__.cpython-314.pyc,,
-websockets/__pycache__/auth.cpython-314.pyc,,
-websockets/__pycache__/cli.cpython-314.pyc,,
-websockets/__pycache__/client.cpython-314.pyc,,
-websockets/__pycache__/connection.cpython-314.pyc,,
-websockets/__pycache__/datastructures.cpython-314.pyc,,
-websockets/__pycache__/exceptions.cpython-314.pyc,,
-websockets/__pycache__/frames.cpython-314.pyc,,
-websockets/__pycache__/headers.cpython-314.pyc,,
-websockets/__pycache__/http.cpython-314.pyc,,
-websockets/__pycache__/http11.cpython-314.pyc,,
-websockets/__pycache__/imports.cpython-314.pyc,,
-websockets/__pycache__/protocol.cpython-314.pyc,,
-websockets/__pycache__/proxy.cpython-314.pyc,,
-websockets/__pycache__/server.cpython-314.pyc,,
-websockets/__pycache__/streams.cpython-314.pyc,,
-websockets/__pycache__/typing.cpython-314.pyc,,
-websockets/__pycache__/uri.cpython-314.pyc,,
-websockets/__pycache__/utils.cpython-314.pyc,,
-websockets/__pycache__/version.cpython-314.pyc,,
-websockets/asyncio/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-websockets/asyncio/__pycache__/__init__.cpython-314.pyc,,
-websockets/asyncio/__pycache__/async_timeout.cpython-314.pyc,,
-websockets/asyncio/__pycache__/client.cpython-314.pyc,,
-websockets/asyncio/__pycache__/compatibility.cpython-314.pyc,,
-websockets/asyncio/__pycache__/connection.cpython-314.pyc,,
-websockets/asyncio/__pycache__/messages.cpython-314.pyc,,
-websockets/asyncio/__pycache__/router.cpython-314.pyc,,
-websockets/asyncio/__pycache__/server.cpython-314.pyc,,
-websockets/asyncio/async_timeout.py,sha256=N-6Mubyiaoh66PAXGvCzhgxCM-7V2XiRnH32Xi6J6TE,8971
-websockets/asyncio/client.py,sha256=e4xlgtzb3v29M2vN-UDiyoUtThg--d5GqKg3lt2pDdE,30850
-websockets/asyncio/compatibility.py,sha256=gkenDDhzNbm6_iXV5Edvbvp6uHZYdrTvGNjt8P_JtyQ,786
-websockets/asyncio/connection.py,sha256=87RdVURijJk8V-ShWAWfTEyhW5Z1YUXKV8ezUzxt5L0,49099
-websockets/asyncio/messages.py,sha256=u2M5WKY9xPyw8G3nKoXfdO5K41hrTnf4MdizVHzgdM4,11129
-websockets/asyncio/router.py,sha256=S-69vszK-SqUCcZbXXPOnux-eH2fTHYC2JNh7tOtmmA,7520
-websockets/asyncio/server.py,sha256=wQ9oBc0WBOIzbXKDYJ8UhXRTeoXrSfLu6CWCrUl-vck,37941
-websockets/auth.py,sha256=U_Jwmn59ZRQ6EecpOvMizQCG_ZbAvgUf1ik7haZRC3c,568
-websockets/cli.py,sha256=YnegH59z93JxSVIGiXiWhR3ktgI6k1_pf_BRLanxKrQ,5336
-websockets/client.py,sha256=fljI5k5oQ-Sfm53MCoyTlr2jFtOOIuO13H9bbtpBPes,13789
-websockets/connection.py,sha256=OLiMVkNd25_86sB8Q7CrCwBoXy9nA0OCgdgLRA8WUR8,323
-websockets/datastructures.py,sha256=Uq2CpjmXak9_pPWcOqh36rzJMo8eCi2lVPTFWDvK5sA,5518
-websockets/exceptions.py,sha256=bgaMdqQGGZosAEULeCB30XW2YnwomWa3c8YOrEfeOoY,12859
-websockets/extensions/__init__.py,sha256=QkZsxaJVllVSp1uhdD5uPGibdbx_091GrVVfS5LXcpw,98
-websockets/extensions/__pycache__/__init__.cpython-314.pyc,,
-websockets/extensions/__pycache__/base.cpython-314.pyc,,
-websockets/extensions/__pycache__/permessage_deflate.cpython-314.pyc,,
-websockets/extensions/base.py,sha256=JNfyk543C7VuPH0QOobiqKoGrzjJILje6sz5ILvOPl4,2903
-websockets/extensions/permessage_deflate.py,sha256=AkuhkAKFo5lqJQMXnckbSs9b2KBBrOFsE1DHIcbLL3k,25770
-websockets/frames.py,sha256=5IK4GZpl8ukr0bZ_UA_jjjztK09yYQAl9m5NVmGLiK0,12889
-websockets/headers.py,sha256=yQnPljVZwV1_V-pOSRKNLG_u827wFC1h72cciojcQ8M,16046
-websockets/http.py,sha256=T1tNLmbkFCneXQ6qepBmsVVDXyP9i500IVzTJTeBMR4,659
-websockets/http11.py,sha256=T8ai5BcBGkV0n9It63oDeNpmtQMyg8Cpav5rf_yT0r4,15619
-websockets/imports.py,sha256=T_B9TUmHoceKMQ-PNphdQQAH2XdxAxwSQNeQEgqILkE,2795
-websockets/legacy/__init__.py,sha256=wQ5zRIENGUS_5eKNAX9CRE7x1TwKapKimrQFFWN9Sxs,276
-websockets/legacy/__pycache__/__init__.cpython-314.pyc,,
-websockets/legacy/__pycache__/auth.cpython-314.pyc,,
-websockets/legacy/__pycache__/client.cpython-314.pyc,,
-websockets/legacy/__pycache__/exceptions.cpython-314.pyc,,
-websockets/legacy/__pycache__/framing.cpython-314.pyc,,
-websockets/legacy/__pycache__/handshake.cpython-314.pyc,,
-websockets/legacy/__pycache__/http.cpython-314.pyc,,
-websockets/legacy/__pycache__/protocol.cpython-314.pyc,,
-websockets/legacy/__pycache__/server.cpython-314.pyc,,
-websockets/legacy/auth.py,sha256=DcQcCSeVeP93JcH8vFWE0HIJL-X-f23LZ0DsJpav1So,6531
-websockets/legacy/client.py,sha256=fV2mbiU9rciXhJfAEKVSm0GztJDUbDpRQ-K5EMbkuQ0,26815
-websockets/legacy/exceptions.py,sha256=ViEjpoT09fzx_Zqf0aNGDVtRDNjXaOw0gdCta3LkjFc,1924
-websockets/legacy/framing.py,sha256=r9P1wiXv_1XuAVQw8SOPkuE9d4eZ0r_JowAkz9-WV4w,6366
-websockets/legacy/handshake.py,sha256=2Nzr5AN2xvDC5EdNP-kB3lOcrAaUNlYuj_-hr_jv7pM,5285
-websockets/legacy/http.py,sha256=cOCQmDWhIKQmm8UWGXPW7CDZg03wjogCsb0LP9oetNQ,7061
-websockets/legacy/protocol.py,sha256=ajtVXDb-lEm9BN0NF3iEaTI_b1q5fBCKTB9wvUoGOxY,63632
-websockets/legacy/server.py,sha256=7mwY-yD0ljNF93oPYumTWD7OIVbCWtaEOw1FFJBhIAM,45251
-websockets/protocol.py,sha256=vTqjPIg2HmO-bSxsczuEmWMxPTxPXU1hmVUjqnahV44,27247
-websockets/proxy.py,sha256=oFrbEYtasYWv-WDcniObD9nBR5Q5qkHpyCVLngx7WMQ,4969
-websockets/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-websockets/server.py,sha256=E4SWBA8WZRmAOpsUm-oCqacBGZre9e0iDmDIrfpV21Q,21790
-websockets/speedups.c,sha256=u_dncR4M38EX6He_fzb1TY6D3Hke67ZpoHLLhZZ0hvQ,5920
-websockets/speedups.cpython-314-darwin.so,sha256=G3h5TQnbLQ1QpRmDTLznIO5RkWVjFwHMJFy_2-5zXwM,84144
-websockets/speedups.pyi,sha256=unjvBNg-uW4c7z-9OW4WiSzZk_QH2bLEcjYAMuoSgBI,102
-websockets/streams.py,sha256=pXqga7ttjuF6lChWYiWLSfUlt3FCaQpEX1ae_jvcCeQ,4071
-websockets/sync/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-websockets/sync/__pycache__/__init__.cpython-314.pyc,,
-websockets/sync/__pycache__/client.cpython-314.pyc,,
-websockets/sync/__pycache__/connection.cpython-314.pyc,,
-websockets/sync/__pycache__/messages.cpython-314.pyc,,
-websockets/sync/__pycache__/router.cpython-314.pyc,,
-websockets/sync/__pycache__/server.cpython-314.pyc,,
-websockets/sync/__pycache__/utils.cpython-314.pyc,,
-websockets/sync/client.py,sha256=_2Erytw1f3f9O_u2jLtS1oNV4HsHUi_h3lGvT9ZEaDQ,22108
-websockets/sync/connection.py,sha256=1pJYEMRHLWIN7538vJcIeFVnvSXVrD0n1xrfX7wDNSc,41868
-websockets/sync/messages.py,sha256=yZV1zhY07ZD0vRF5b1yDa7ug0rbA5UDOCCCQmWwAcds,12858
-websockets/sync/router.py,sha256=BqKSAKNZYtRWiOxol9qYeyfgyXRrMNJ6FrTTZLNcXMg,7172
-websockets/sync/server.py,sha256=s07HNK_2s1kLN62Uqc77uvND0z7C0YTXGePsCiBtXaE,27655
-websockets/sync/utils.py,sha256=TtW-ncYFvJmiSW2gO86ngE2BVsnnBdL-4H88kWNDYbg,1107
-websockets/typing.py,sha256=A6xh4m65pRzKAbuOs0kFuGhL4DWIIko-ppS4wvJVc0Q,1946
-websockets/uri.py,sha256=2fFMw-AbKJ5HVHNCuw1Rx1MnkCkNWRpogxWhhM30EU4,3125
-websockets/utils.py,sha256=AwhS4UmlbKv7meAaR7WNbUqD5JFoStOP1bAyo9sRMus,1197
-websockets/version.py,sha256=IhaztWxysdY-pd-0nOubnnPduvySSvdoBwrQdJKtZ2g,3202

src-tauri/binaries/_internal/websockets-16.0.dist-info/direct_url.json

@@ -1 +0,0 @@
-{"archive_info": {"hash": "sha256=8cc451a50f2aee53042ac52d2d053d08bf89bcb31ae799cb4487587661c038a0", "hashes": {"sha256": "8cc451a50f2aee53042ac52d2d053d08bf89bcb31ae799cb4487587661c038a0"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/wheels/websockets-16.0-cp314-cp314-macosx_10_15_universal2.whl"}

src-tauri/binaries/_internal/websockets-17.0.1.dist-info/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websockets
-Version: 16.0
+Version: 17.0.1
 Summary: An implementation of the WebSocket Protocol (RFC 6455 & 7692)
 Author-email: Aymeric Augustin <aymeric.augustin@m4x.org>
 License-Expression: BSD-3-Clause
@@ -16,12 +16,12 @@ Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Python: >=3.10
+Classifier: Programming Language :: Python :: 3.15
+Requires-Python: >=3.11
 Description-Content-Type: text/x-rst
 License-File: LICENSE
 Dynamic: description
@@ -32,7 +32,7 @@ Dynamic: license-file
    :width: 480px
    :alt: websockets
 
-|licence| |version| |pyversions| |tests| |docs| |openssf|
+|licence| |version| |pyversions|
 
 .. |licence| image:: https://img.shields.io/pypi/l/websockets.svg
     :target: https://pypi.python.org/pypi/websockets
@@ -43,15 +43,6 @@ Dynamic: license-file
 .. |pyversions| image:: https://img.shields.io/pypi/pyversions/websockets.svg
     :target: https://pypi.python.org/pypi/websockets
 
-.. |tests| image:: https://img.shields.io/github/checks-status/python-websockets/websockets/main?label=tests
-   :target: https://github.com/python-websockets/websockets/actions/workflows/tests.yml
-
-.. |docs| image:: https://img.shields.io/readthedocs/websockets.svg
-   :target: https://websockets.readthedocs.io/
-
-.. |openssf| image:: https://bestpractices.coreinfrastructure.org/projects/6475/badge
-   :target: https://bestpractices.coreinfrastructure.org/projects/6475
-
 What is ``websockets``?
 -----------------------
 
@@ -63,8 +54,8 @@ with a focus on correctness, simplicity, robustness, and performance.
 Built on top of ``asyncio``, Python's standard asynchronous I/O framework, the
 default implementation provides an elegant coroutine-based API.
 
-An implementation on top of ``threading`` and a Sans-I/O implementation are also
-available.
+Implementations on top of ``threading`` and ``trio`` are also provided, as well
+as a Sans-I/O layer for integration in third-party projects.
 
 `Documentation is available on Read the Docs. <https://websockets.readthedocs.io/>`_
 
@@ -84,8 +75,8 @@ Here's an echo server with the ``asyncio`` API:
             await websocket.send(message)
 
     async def main():
-        async with serve(echo, "localhost", 8765) as server:
-            await server.serve_forever()
+        server = await serve(echo, "localhost", 8765)
+        await server.serve_forever()
 
     asyncio.run(main())
 

src-tauri/binaries/_internal/websockets-17.0.1.dist-info/RECORD

@@ -0,0 +1,118 @@
+../../../bin/websockets,sha256=Aec6LJ-SgqOC29VvGIAfJo3DbDp5-znjkFZaF7aEUTM,188
+websockets-17.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+websockets-17.0.1.dist-info/METADATA,sha256=Z_btpoffz0ubiHVmim0rYjFMxNdOn_LhaVusK8CZCIA,6342
+websockets-17.0.1.dist-info/RECORD,,
+websockets-17.0.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets-17.0.1.dist-info/WHEEL,sha256=dgBSXaLX3dDB-DVpHT16BsaK8hj0ZwMOLjJBjWhNK_4,142
+websockets-17.0.1.dist-info/direct_url.json,sha256=tKRa4U_R4U5WX4GMQa3dJ7UPcGjl5stIKOYKaN-F0pw,312
+websockets-17.0.1.dist-info/entry_points.txt,sha256=Dnhn4dm5EsI4ZMAsHldGF6CwBXZrGXnR7cnK2-XR7zY,51
+websockets-17.0.1.dist-info/licenses/LICENSE,sha256=PWoMBQ2L7FL6utUC5F-yW9ArytvXDeo01Ee2oP9Obag,1514
+websockets-17.0.1.dist-info/top_level.txt,sha256=CMpdKklxKsvZgCgyltxUWOHibZXZ1uYIVpca9xsQ8Hk,11
+websockets/__init__.py,sha256=zmBCJj7EIa6ZJEQDp4dIdznfzAJUA8dW41-j7Em-QDQ,7450
+websockets/__main__.py,sha256=wu5N2wk8mvBgyvr2ghmQf4prezAe0_i-p123VVreyYc,62
+websockets/__pycache__/__init__.cpython-314.pyc,,
+websockets/__pycache__/__main__.cpython-314.pyc,,
+websockets/__pycache__/auth.cpython-314.pyc,,
+websockets/__pycache__/cli.cpython-314.pyc,,
+websockets/__pycache__/client.cpython-314.pyc,,
+websockets/__pycache__/connection.cpython-314.pyc,,
+websockets/__pycache__/datastructures.cpython-314.pyc,,
+websockets/__pycache__/exceptions.cpython-314.pyc,,
+websockets/__pycache__/frames.cpython-314.pyc,,
+websockets/__pycache__/headers.cpython-314.pyc,,
+websockets/__pycache__/http11.cpython-314.pyc,,
+websockets/__pycache__/imports.cpython-314.pyc,,
+websockets/__pycache__/protocol.cpython-314.pyc,,
+websockets/__pycache__/proxy.cpython-314.pyc,,
+websockets/__pycache__/server.cpython-314.pyc,,
+websockets/__pycache__/streams.cpython-314.pyc,,
+websockets/__pycache__/typing.cpython-314.pyc,,
+websockets/__pycache__/uri.cpython-314.pyc,,
+websockets/__pycache__/utils.cpython-314.pyc,,
+websockets/__pycache__/version.cpython-314.pyc,,
+websockets/asyncio/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets/asyncio/__pycache__/__init__.cpython-314.pyc,,
+websockets/asyncio/__pycache__/client.cpython-314.pyc,,
+websockets/asyncio/__pycache__/connection.cpython-314.pyc,,
+websockets/asyncio/__pycache__/messages.cpython-314.pyc,,
+websockets/asyncio/__pycache__/router.cpython-314.pyc,,
+websockets/asyncio/__pycache__/server.cpython-314.pyc,,
+websockets/asyncio/client.py,sha256=oAvlgEjRXixmIrttbQZ4AgiA8oetA8EjxmM_36bqoVE,32062
+websockets/asyncio/connection.py,sha256=V3L-PrXG8jZ_6IytI-9ftA-JOlmKXlnI9oCS1gWxsIM,49596
+websockets/asyncio/messages.py,sha256=vBPd93IuL3LE0OSxeaICIjzvyoht53kmh-_Zho-bGzU,11096
+websockets/asyncio/router.py,sha256=gUdYn2dc--kT-kNEFOa_qwo_d5vaX34WyoRNuPOSVrU,7743
+websockets/asyncio/server.py,sha256=6Xop-Re8SqhKsBUEtrpc89etFuQiWPPyc9gz7Acrhmo,34111
+websockets/auth.py,sha256=U_Jwmn59ZRQ6EecpOvMizQCG_ZbAvgUf1ik7haZRC3c,568
+websockets/cli.py,sha256=fYf0YqrWIx_iJDA-RWdczh5vjO9p6ZxZvmE761bUQg0,6892
+websockets/client.py,sha256=Dp4j89uLnzXsItZasDs8hV045YfRpX6fYJVuhmuEDA0,14050
+websockets/connection.py,sha256=OLiMVkNd25_86sB8Q7CrCwBoXy9nA0OCgdgLRA8WUR8,323
+websockets/datastructures.py,sha256=XGTvvgFdZSevNV_T6-Lo-Dxm2VHxJcgKl4l1DNQ6fU8,7238
+websockets/exceptions.py,sha256=tp0_EyqQfd7CYNOHmxAieOH8Ed9PSQFt18e-CuReTOY,14308
+websockets/extensions/__init__.py,sha256=QkZsxaJVllVSp1uhdD5uPGibdbx_091GrVVfS5LXcpw,98
+websockets/extensions/__pycache__/__init__.cpython-314.pyc,,
+websockets/extensions/__pycache__/base.cpython-314.pyc,,
+websockets/extensions/__pycache__/permessage_deflate.cpython-314.pyc,,
+websockets/extensions/base.py,sha256=JNfyk543C7VuPH0QOobiqKoGrzjJILje6sz5ILvOPl4,2903
+websockets/extensions/permessage_deflate.py,sha256=IAXdCGY60zfdjatKd6fDfTMizOeQYsnh0zBtL9vPuzA,25840
+websockets/frames.py,sha256=Twiqn_buvQiblERugcT-MDmnPZ7kt-FMXESe2DhOT9o,16709
+websockets/headers.py,sha256=yQnPljVZwV1_V-pOSRKNLG_u827wFC1h72cciojcQ8M,16046
+websockets/http11.py,sha256=tLVuNvNADwt8d1ui5KMFKZCZMTtJ6CqXZveogLaPbf0,18245
+websockets/imports.py,sha256=T_B9TUmHoceKMQ-PNphdQQAH2XdxAxwSQNeQEgqILkE,2795
+websockets/legacy/__init__.py,sha256=wQ5zRIENGUS_5eKNAX9CRE7x1TwKapKimrQFFWN9Sxs,276
+websockets/legacy/__pycache__/__init__.cpython-314.pyc,,
+websockets/legacy/__pycache__/auth.cpython-314.pyc,,
+websockets/legacy/__pycache__/client.cpython-314.pyc,,
+websockets/legacy/__pycache__/exceptions.cpython-314.pyc,,
+websockets/legacy/__pycache__/framing.cpython-314.pyc,,
+websockets/legacy/__pycache__/handshake.cpython-314.pyc,,
+websockets/legacy/__pycache__/http.cpython-314.pyc,,
+websockets/legacy/__pycache__/protocol.cpython-314.pyc,,
+websockets/legacy/__pycache__/server.cpython-314.pyc,,
+websockets/legacy/auth.py,sha256=DcQcCSeVeP93JcH8vFWE0HIJL-X-f23LZ0DsJpav1So,6531
+websockets/legacy/client.py,sha256=5oJurUczPddXi8Rde5fA2hD3V4pnv__Z64pRRXP6HBs,27226
+websockets/legacy/exceptions.py,sha256=ViEjpoT09fzx_Zqf0aNGDVtRDNjXaOw0gdCta3LkjFc,1924
+websockets/legacy/framing.py,sha256=b0wMx83XTIXVZoO60pl3AibKHbQlDb7rBAyhFEkaMCk,6374
+websockets/legacy/handshake.py,sha256=2Nzr5AN2xvDC5EdNP-kB3lOcrAaUNlYuj_-hr_jv7pM,5285
+websockets/legacy/http.py,sha256=cOCQmDWhIKQmm8UWGXPW7CDZg03wjogCsb0LP9oetNQ,7061
+websockets/legacy/protocol.py,sha256=1WUIzDHBew-NZ1ewhmct_WT0ycdTxT4HDdg-Im71z4Y,63456
+websockets/legacy/server.py,sha256=hSk4nFTsI3eMRbu5JcI4gXei9Ubw07RSrSjtL4eM2gc,44835
+websockets/protocol.py,sha256=3HuCBMLTJMxp9JHd5JMBqtTF84SsY29iuHH0yznuD_Q,27204
+websockets/proxy.py,sha256=oFrbEYtasYWv-WDcniObD9nBR5Q5qkHpyCVLngx7WMQ,4969
+websockets/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets/server.py,sha256=7kEJL1QEFO8pTB90wP4fUbkzYGDcbkTa7jTvdiSZtQk,24679
+websockets/speedups.c,sha256=u_dncR4M38EX6He_fzb1TY6D3Hke67ZpoHLLhZZ0hvQ,5920
+websockets/speedups.cpython-314-darwin.so,sha256=pJidRkiyZA-9quLsUEgjRjs8b8bpobn1FV25pvq38KM,84144
+websockets/speedups.pyi,sha256=unjvBNg-uW4c7z-9OW4WiSzZk_QH2bLEcjYAMuoSgBI,102
+websockets/streams.py,sha256=rJrDNSL9hy3EJYc1PFHjYx4rdd1vELCua0CwdFiHN_8,4610
+websockets/sync/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets/sync/__pycache__/__init__.cpython-314.pyc,,
+websockets/sync/__pycache__/client.cpython-314.pyc,,
+websockets/sync/__pycache__/connection.cpython-314.pyc,,
+websockets/sync/__pycache__/messages.cpython-314.pyc,,
+websockets/sync/__pycache__/router.cpython-314.pyc,,
+websockets/sync/__pycache__/server.cpython-314.pyc,,
+websockets/sync/__pycache__/utils.cpython-314.pyc,,
+websockets/sync/client.py,sha256=j9fvsOwCzJgQnaAyOaVYw6iT_IdPEM70JFLjeqXz2jw,22216
+websockets/sync/connection.py,sha256=xJeJZZZnbILJUhcNg_lBWL26Imv-t2jsnnO5y_ecHf4,48298
+websockets/sync/messages.py,sha256=q8K1vxdrqVk1bvn3zW1Jx09TlakIWSyYcOHC7ueFQmk,12826
+websockets/sync/router.py,sha256=BqKSAKNZYtRWiOxol9qYeyfgyXRrMNJ6FrTTZLNcXMg,7172
+websockets/sync/server.py,sha256=fVZZiaWW8ISoqFcJY5ZNa-MBxtLCYCP4ALJAtncgF3A,34346
+websockets/sync/utils.py,sha256=TtW-ncYFvJmiSW2gO86ngE2BVsnnBdL-4H88kWNDYbg,1107
+websockets/trio/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets/trio/__pycache__/__init__.cpython-314.pyc,,
+websockets/trio/__pycache__/client.cpython-314.pyc,,
+websockets/trio/__pycache__/connection.cpython-314.pyc,,
+websockets/trio/__pycache__/messages.cpython-314.pyc,,
+websockets/trio/__pycache__/router.cpython-314.pyc,,
+websockets/trio/__pycache__/server.cpython-314.pyc,,
+websockets/trio/__pycache__/utils.cpython-314.pyc,,
+websockets/trio/client.py,sha256=VwpJ9bYECIPMrssX7OQ2rriNVjB3LitDqXSHEfEJwQI,29509
+websockets/trio/connection.py,sha256=lalwJYhFNZqYDP7e69oo9KXebFNsbyM8wlmoqsMcf0s,49218
+websockets/trio/messages.py,sha256=goDc5rfINExnvyfETWYYDT3-thgRJd7DPr4ujwJD3P8,10269
+websockets/trio/router.py,sha256=qZL9-44mi9SOOTGU3CLBPuaCNzafQGqZ-fJl9hVpv-s,7196
+websockets/trio/server.py,sha256=jRtrfZf3hHp1aQo6ffNMN7siaWzvZVhqC1iq1_Pj0sA,25805
+websockets/trio/utils.py,sha256=A12NYUPOjQaiGusak43oWzPIcCxhikKTkAJLXtZJvcY,956
+websockets/typing.py,sha256=zL4Pi_pQHJGVlL4cTyFauqxgMBAFI5B6dfvMVn7SFYs,1710
+websockets/uri.py,sha256=2fFMw-AbKJ5HVHNCuw1Rx1MnkCkNWRpogxWhhM30EU4,3125
+websockets/utils.py,sha256=Wdtsh2qQiHLrXUBEnp3LatMLJTZjB2CErbeOFvrdXvE,2022
+websockets/version.py,sha256=TJPgFOcL4xsH8I2KiQu1V3j8kSHbOd_EWKNVnnOu8SE,3204

src-tauri/binaries/_internal/websockets-17.0.1.dist-info/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (80.9.0)
+Generator: setuptools (83.0.0)
 Root-Is-Purelib: false
 Tag: cp314-cp314-macosx_10_15_universal2
 Generator: delocate 0.13.0

src-tauri/binaries/_internal/websockets-17.0.1.dist-info/direct_url.json

@@ -0,0 +1 @@
+{"archive_info": {"hash": "sha256=53b90c00bc6201ab6695c7ff51a04d0e425514c37515e9eeecd2c1b978ac6c0e", "hashes": {"sha256": "53b90c00bc6201ab6695c7ff51a04d0e425514c37515e9eeecd2c1b978ac6c0e"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/wheels/websockets-17.0.1-cp314-cp314-macosx_10_15_universal2.whl"}

src-tauri/src/commands.rs

@@ -61,9 +61,8 @@ fn known_download_paths(app_handle: &tauri::AppHandle) -> Result<Vec<PathBuf>, S
 }
 
 fn authorize_exact_path(requested: &Path, allowed_paths: &[PathBuf]) -> Result<PathBuf, String> {
-    if std::fs::symlink_metadata(requested).is_ok_and(|metadata| metadata.file_type().is_symlink())
-    {
-        return Err("Download path may not be a symlink".to_string());
+    if crate::path_has_symlink_component(requested) {
+        return Err("Download path may not contain symlink components".to_string());
     }
 
     let requested = canonicalize_with_missing_leaf(requested)?;
@@ -74,8 +73,9 @@ fn authorize_exact_path(requested: &Path, allowed_paths: &[PathBuf]) -> Result<P
     }
 
     let authorized = allowed_paths.iter().any(|allowed| {
-        canonicalize_with_missing_leaf(allowed)
-            .is_ok_and(|canonical_allowed| canonical_allowed == requested)
+        !crate::path_has_symlink_component(allowed)
+            && canonicalize_with_missing_leaf(allowed)
+                .is_ok_and(|canonical_allowed| canonical_allowed == requested)
     });
 
     if authorized {
@@ -98,14 +98,30 @@ fn canonicalize_with_missing_leaf(path: &Path) -> Result<PathBuf, String> {
 
     let mut existing = path;
     let mut missing = Vec::new();
-    while !existing.exists() {
-        let name = existing
-            .file_name()
-            .ok_or_else(|| "Download path has no existing ancestor".to_string())?;
-        missing.push(name.to_owned());
-        existing = existing
-            .parent()
-            .ok_or_else(|| "Download path has no existing ancestor".to_string())?;
+    loop {
+        match std::fs::symlink_metadata(existing) {
+            Ok(metadata) => {
+                if metadata.file_type().is_symlink() {
+                    return Err("Download path may not contain symlink components".to_string());
+                }
+                break;
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                let name = existing
+                    .file_name()
+                    .ok_or_else(|| "Download path has no existing ancestor".to_string())?;
+                missing.push(name.to_owned());
+                existing = existing
+                    .parent()
+                    .ok_or_else(|| "Download path has no existing ancestor".to_string())?;
+            }
+            Err(error) => {
+                return Err(format!(
+                    "Failed to inspect download path '{}': {error}",
+                    path.display()
+                ));
+            }
+        }
     }
 
     let mut canonical = std::fs::canonicalize(existing)
@@ -144,7 +160,8 @@ mod tests {
     #[test]
     fn authorizes_only_known_download_files_and_partials() {
         let root = tempfile::tempdir().unwrap();
-        let owned = root.path().join("owned.bin");
+        let root = fs::canonicalize(root.path()).unwrap();
+        let owned = root.join("owned.bin");
         let outside = tempfile::NamedTempFile::new().unwrap();
         fs::write(&owned, b"download").unwrap();
 
@@ -197,4 +214,22 @@ mod tests {
 
         assert!(authorize_exact_path(&escaped, std::slice::from_ref(&escaped)).is_err());
     }
+
+    #[cfg(unix)]
+    #[test]
+    fn rejects_parent_directory_symlink_escape_from_download_location() {
+        use std::os::unix::fs::symlink;
+
+        let root = tempfile::tempdir().unwrap();
+        let root_path = fs::canonicalize(root.path()).unwrap();
+        let outside = tempfile::tempdir().unwrap();
+        let outside_file = outside.path().join("owned.bin");
+        fs::write(&outside_file, b"outside").unwrap();
+
+        let redirected_parent = root_path.join("downloads");
+        symlink(outside.path(), &redirected_parent).unwrap();
+        let escaped = redirected_parent.join("owned.bin");
+
+        assert!(authorize_exact_path(&escaped, std::slice::from_ref(&escaped)).is_err());
+    }
 }

src-tauri/src/download.rs

@@ -46,18 +46,29 @@ impl DownloadCoordinator {
             .map_err(|_| "download coordinator is unavailable".to_string())
     }
 
-    pub async fn register_media(&self, id: String) -> Result<watch::Receiver<bool>, String> {
+    pub async fn register_media(
+        &self,
+        id: String,
+        lifecycle_generation: u64,
+    ) -> Result<watch::Receiver<bool>, String> {
         let (cancel_tx, cancel_rx) = watch::channel(false);
         self.media_tx
-            .send(MediaCmd::Register { id, cancel_tx })
+            .send(MediaCmd::Register {
+                id,
+                lifecycle_generation,
+                cancel_tx,
+            })
             .await
             .map_err(|_| "download coordinator is unavailable".to_string())?;
         Ok(cancel_rx)
     }
 
-    pub async fn pause_media(&self, id: String) -> Result<(), String> {
+    pub async fn pause_media(&self, id: String, lifecycle_generation: u64) -> Result<(), String> {
         self.media_tx
-            .send(MediaCmd::Pause(id))
+            .send(MediaCmd::Pause {
+                id,
+                lifecycle_generation,
+            })
             .await
             .map_err(|_| "download coordinator is unavailable".to_string())
     }
@@ -65,16 +76,27 @@ impl DownloadCoordinator {
     pub async fn pause_media_with_ack(
         &self,
         id: String,
-        ack: tokio::sync::oneshot::Sender<()>,
+        lifecycle_generation: u64,
+        ack: tokio::sync::oneshot::Sender<bool>,
     ) -> Result<(), String> {
         self.media_tx
-            .send(MediaCmd::PauseWithAck(id, ack))
+            .send(MediaCmd::PauseWithAck {
+                id,
+                lifecycle_generation,
+                ack,
+            })
             .await
             .map_err(|_| "download coordinator is unavailable".to_string())
     }
 
-    pub async fn finish_media(&self, id: String) {
-        let _ = self.media_tx.send(MediaCmd::Finished(id)).await;
+    pub async fn finish_media(&self, id: String, lifecycle_generation: u64) {
+        let _ = self
+            .media_tx
+            .send(MediaCmd::Finished {
+                id,
+                lifecycle_generation,
+            })
+            .await;
     }
 }
 
@@ -96,11 +118,22 @@ impl CoordinatorEventSink {
 enum MediaCmd {
     Register {
         id: String,
+        lifecycle_generation: u64,
         cancel_tx: watch::Sender<bool>,
     },
-    Pause(String),
-    PauseWithAck(String, tokio::sync::oneshot::Sender<()>),
-    Finished(String),
+    Pause {
+        id: String,
+        lifecycle_generation: u64,
+    },
+    PauseWithAck {
+        id: String,
+        lifecycle_generation: u64,
+        ack: tokio::sync::oneshot::Sender<bool>,
+    },
+    Finished {
+        id: String,
+        lifecycle_generation: u64,
+    },
 }
 
 async fn run_coordinator(
@@ -108,74 +141,125 @@ async fn run_coordinator(
     mut command_rx: mpsc::Receiver<DownloadCmd>,
     mut media_rx: mpsc::Receiver<MediaCmd>,
 ) {
-    let mut active_media = HashMap::<String, watch::Sender<bool>>::new();
-    let mut pending_media_acks = HashMap::<String, tokio::sync::oneshot::Sender<()>>::new();
+    let mut active_media = HashMap::<String, (u64, watch::Sender<bool>)>::new();
+    let mut cancelled_media_generations = HashMap::<String, u64>::new();
+    let mut pending_media_acks =
+        HashMap::<(String, u64), tokio::sync::oneshot::Sender<bool>>::new();
     let mut pending_captured_urls = Vec::<String>::new();
     let mut frontend_ready = false;
+    let mut command_open = true;
+    let mut media_open = true;
 
-    loop {
+    while command_open || media_open {
         tokio::select! {
-            command = command_rx.recv() => {
-                let Some(command) = command else {
-                    break;
-                };
-
+            command = command_rx.recv(), if command_open => {
                 match command {
-                    DownloadCmd::CaptureUrls(urls) => {
-                        append_unique_urls(&mut pending_captured_urls, urls);
-                        if frontend_ready && !pending_captured_urls.is_empty() {
-                            let payload = pending_captured_urls.join("\n");
-                            if events.emit_captured_urls(payload) {
-                                pending_captured_urls.clear();
+                    Some(command) => match command {
+                        DownloadCmd::CaptureUrls(urls) => {
+                            append_unique_urls(&mut pending_captured_urls, urls);
+                            if frontend_ready && !pending_captured_urls.is_empty() {
+                                let payload = pending_captured_urls.join("\n");
+                                if events.emit_captured_urls(payload) {
+                                    pending_captured_urls.clear();
+                                }
                             }
                         }
-                    }
-                    DownloadCmd::FrontendReady(ready) => {
-                        frontend_ready = ready;
-                        if ready && !pending_captured_urls.is_empty() {
-                            let payload = pending_captured_urls.join("\n");
-                            if events.emit_captured_urls(payload) {
-                                pending_captured_urls.clear();
+                        DownloadCmd::FrontendReady(ready) => {
+                            frontend_ready = ready;
+                            if ready && !pending_captured_urls.is_empty() {
+                                let payload = pending_captured_urls.join("\n");
+                                if events.emit_captured_urls(payload) {
+                                    pending_captured_urls.clear();
+                                }
                             }
                         }
-                    }
+                    },
+                    None => command_open = false,
                 }
             }
-            command = media_rx.recv() => {
-                let Some(command) = command else {
-                    continue;
-                };
+            command = media_rx.recv(), if media_open => {
                 match command {
-                    MediaCmd::Register { id, cancel_tx } => {
-                        if let Some(previous) = active_media.insert(id, cancel_tx) {
+                    Some(command) => match command {
+                    MediaCmd::Register { id, lifecycle_generation, cancel_tx } => {
+                        if active_media
+                            .get(&id)
+                            .is_some_and(|(generation, _)| *generation > lifecycle_generation)
+                        {
+                            let _ = cancel_tx.send(true);
+                            continue;
+                        }
+                        let pending_cancel = cancelled_media_generations.get(&id).copied();
+                        if pending_cancel.is_some_and(|generation| generation < lifecycle_generation) {
+                            cancelled_media_generations.remove(&id);
+                        }
+                        let cancelled = pending_cancel.is_some_and(|generation| generation >= lifecycle_generation);
+                        if let Some((_, previous)) = active_media.insert(id.clone(), (lifecycle_generation, cancel_tx)) {
                             let _ = previous.send(true);
                         }
-                    }
-                    MediaCmd::Pause(id) => {
-                        if let Some(cancel_tx) = active_media.remove(&id) {
-                            let _ = cancel_tx.send(true);
+                        if cancelled {
+                            if let Some((_, cancel_tx)) = active_media.get(&id) {
+                                let _ = cancel_tx.send(true);
+                            }
+                            if pending_cancel == Some(lifecycle_generation) {
+                                cancelled_media_generations.remove(&id);
+                            }
                         }
                     }
-                    MediaCmd::PauseWithAck(id, ack) => {
-                        if let Some(cancel_tx) = active_media.remove(&id) {
-                            let _ = cancel_tx.send(true);
-                            pending_media_acks.insert(id, ack);
+                    MediaCmd::Pause { id, lifecycle_generation } => {
+                        if active_media.get(&id).is_some_and(|(generation, _)| *generation == lifecycle_generation) {
+                            if let Some((_, cancel_tx)) = active_media.remove(&id) {
+                                let _ = cancel_tx.send(true);
+                            }
                         } else {
-                            let _ = ack.send(());
+                            cancelled_media_generations
+                                .entry(id)
+                                .and_modify(|generation| *generation = (*generation).max(lifecycle_generation))
+                                .or_insert(lifecycle_generation);
                         }
                     }
-                    MediaCmd::Finished(id) => {
-                        active_media.remove(&id);
-                        if let Some(ack) = pending_media_acks.remove(&id) {
-                            let _ = ack.send(());
+                    MediaCmd::PauseWithAck { id, lifecycle_generation, ack } => {
+                        if active_media.get(&id).is_some_and(|(generation, _)| *generation == lifecycle_generation) {
+                            if let Some((_, cancel_tx)) = active_media.remove(&id) {
+                                let _ = cancel_tx.send(true);
+                                pending_media_acks.insert((id, lifecycle_generation), ack);
+                            }
+                        } else {
+                            cancelled_media_generations
+                                .entry(id)
+                                .and_modify(|generation| *generation = (*generation).max(lifecycle_generation))
+                                .or_insert(lifecycle_generation);
+                            // No runner was registered for this generation.
+                            // The caller may retire the cancellation tombstone
+                            // while it still owns the per-download lock.
+                            let _ = ack.send(false);
                         }
                     }
+                    MediaCmd::Finished { id, lifecycle_generation } => {
+                        if active_media.get(&id).is_some_and(|(generation, _)| *generation == lifecycle_generation) {
+                            active_media.remove(&id);
+                        }
+                        if let Some(ack) =
+                            pending_media_acks.remove(&(id.clone(), lifecycle_generation))
+                        {
+                            // A pending acknowledgement means the runner was
+                            // registered and has now observed cancellation.
+                            let _ = ack.send(true);
+                        }
+                        if cancelled_media_generations
+                            .get(&id)
+                            .is_some_and(|generation| *generation <= lifecycle_generation)
+                        {
+                            cancelled_media_generations.remove(&id);
+                        }
+                    }
+                    },
+                    None => media_open = false,
                 }
             }
         }
     }
 
-    for (_, cancel_tx) in active_media {
+    for (_, (_, cancel_tx)) in active_media {
         let _ = cancel_tx.send(true);
     }
 }
@@ -219,9 +303,30 @@ pub(crate) fn format_duration(seconds: f64) -> String {
 
 #[cfg(test)]
 mod tests {
-    use super::{DownloadCmd, DownloadCoordinator, DownloadEvent};
+    use super::{CoordinatorEventSink, DownloadCmd, DownloadCoordinator, DownloadEvent};
+    use tokio::sync::mpsc;
     use std::time::Duration;
 
+    #[tokio::test]
+    async fn coordinator_exits_when_both_command_channels_close() {
+        let (event_tx, _event_rx) = mpsc::unbounded_channel();
+        let (command_tx, command_rx) = mpsc::channel(1);
+        let (media_tx, media_rx) = mpsc::channel(1);
+        let coordinator = tokio::spawn(super::run_coordinator(
+            CoordinatorEventSink::Headless(event_tx),
+            command_rx,
+            media_rx,
+        ));
+
+        drop(command_tx);
+        drop(media_tx);
+
+        tokio::time::timeout(Duration::from_secs(1), coordinator)
+            .await
+            .expect("coordinator did not exit after both channels closed")
+            .expect("coordinator task panicked");
+    }
+
     #[tokio::test]
     async fn buffers_captured_urls_until_frontend_is_ready() {
         let (coordinator, mut events) = DownloadCoordinator::spawn_headless();
@@ -251,4 +356,146 @@ mod tests {
             DownloadEvent::CapturedUrls("https://example.com/startup.zip".to_string())
         );
     }
+
+    #[tokio::test]
+    async fn stale_media_finish_cannot_remove_a_newer_lifecycle() {
+        let (coordinator, _events) = DownloadCoordinator::spawn_headless();
+        let mut old_cancel = coordinator.register_media("same-id".to_string(), 1).await.unwrap();
+        let mut new_cancel = coordinator.register_media("same-id".to_string(), 2).await.unwrap();
+
+        tokio::time::timeout(Duration::from_secs(1), old_cancel.changed())
+            .await
+            .unwrap()
+            .unwrap();
+        coordinator.finish_media("same-id".to_string(), 1).await;
+
+        let (ack_tx, ack_rx) = tokio::sync::oneshot::channel();
+        coordinator
+            .pause_media_with_ack("same-id".to_string(), 2, ack_tx)
+            .await
+            .unwrap();
+        coordinator.finish_media("same-id".to_string(), 2).await;
+        tokio::time::timeout(Duration::from_secs(1), ack_rx)
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(*new_cancel.borrow_and_update());
+    }
+
+    #[tokio::test]
+    async fn pause_before_media_registration_cancels_the_late_lifecycle() {
+        let (coordinator, _events) = DownloadCoordinator::spawn_headless();
+        let (ack_tx, ack_rx) = tokio::sync::oneshot::channel();
+
+        coordinator
+            .pause_media_with_ack("late-media".to_string(), 7, ack_tx)
+            .await
+            .unwrap();
+        tokio::time::timeout(Duration::from_secs(1), ack_rx)
+            .await
+            .unwrap()
+            .unwrap();
+
+        let mut cancel_rx = coordinator
+            .register_media("late-media".to_string(), 7)
+            .await
+            .unwrap();
+        tokio::time::timeout(Duration::from_secs(1), async {
+            while !*cancel_rx.borrow_and_update() {
+                cancel_rx.changed().await.unwrap();
+            }
+        })
+        .await
+        .expect("late media registration was not cancelled");
+    }
+
+    #[tokio::test]
+    async fn unregistered_media_pause_tombstone_can_be_reconciled() {
+        let (coordinator, _events) = DownloadCoordinator::spawn_headless();
+        let (ack_tx, ack_rx) = tokio::sync::oneshot::channel();
+
+        coordinator
+            .pause_media_with_ack("abandoned-media".to_string(), 9, ack_tx)
+            .await
+            .unwrap();
+        assert!(!ack_rx.await.unwrap());
+
+        // Once the queue lifecycle is invalidated under its control lock,
+        // it can retire the tombstone without allowing a late runner to
+        // start. A later registration must therefore remain uncancelled.
+        coordinator
+            .finish_media("abandoned-media".to_string(), 9)
+            .await;
+        let cancel_rx = coordinator
+            .register_media("abandoned-media".to_string(), 9)
+            .await
+            .unwrap();
+        assert!(!*cancel_rx.borrow());
+    }
+
+    #[tokio::test]
+    async fn stale_media_registration_cannot_replace_a_newer_lifecycle() {
+        let (coordinator, _events) = DownloadCoordinator::spawn_headless();
+        let mut new_cancel = coordinator
+            .register_media("same-id".to_string(), 2)
+            .await
+            .unwrap();
+        let mut old_cancel = coordinator
+            .register_media("same-id".to_string(), 1)
+            .await
+            .unwrap();
+
+        tokio::time::timeout(Duration::from_secs(1), old_cancel.changed())
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(*old_cancel.borrow_and_update());
+
+        let (ack_tx, ack_rx) = tokio::sync::oneshot::channel();
+        coordinator
+            .pause_media_with_ack("same-id".to_string(), 2, ack_tx)
+            .await
+            .unwrap();
+        coordinator.finish_media("same-id".to_string(), 2).await;
+        tokio::time::timeout(Duration::from_secs(1), ack_rx)
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(*new_cancel.borrow_and_update());
+    }
+
+    #[tokio::test]
+    async fn media_pause_ack_is_preserved_across_lifecycle_replacement() {
+        let (coordinator, _events) = DownloadCoordinator::spawn_headless();
+        let _old_cancel = coordinator
+            .register_media("same-id".to_string(), 1)
+            .await
+            .unwrap();
+        let (old_ack_tx, old_ack_rx) = tokio::sync::oneshot::channel();
+        coordinator
+            .pause_media_with_ack("same-id".to_string(), 1, old_ack_tx)
+            .await
+            .unwrap();
+
+        let _new_cancel = coordinator
+            .register_media("same-id".to_string(), 2)
+            .await
+            .unwrap();
+        let (new_ack_tx, new_ack_rx) = tokio::sync::oneshot::channel();
+        coordinator
+            .pause_media_with_ack("same-id".to_string(), 2, new_ack_tx)
+            .await
+            .unwrap();
+
+        coordinator.finish_media("same-id".to_string(), 1).await;
+        tokio::time::timeout(Duration::from_secs(1), old_ack_rx)
+            .await
+            .unwrap()
+            .unwrap();
+        coordinator.finish_media("same-id".to_string(), 2).await;
+        tokio::time::timeout(Duration::from_secs(1), new_ack_rx)
+            .await
+            .unwrap()
+            .unwrap();
+    }
 }

src-tauri/src/download_ownership.rs

@@ -10,6 +10,9 @@ struct DownloadOwnershipRecord {
 }
 
 pub fn canonical_download_filename(filename: &str) -> String {
+    const MAX_FILENAME_BYTES: usize = 255;
+    const TRUNCATION_MARKER: &str = "…";
+
     let leaf = filename.replace('\\', "/");
     let leaf = Path::new(&leaf)
         .file_name()
@@ -31,7 +34,7 @@ pub fn canonical_download_filename(filename: &str) -> String {
         })
         .collect::<String>();
     let sanitized = sanitized.trim().trim_end_matches(['.', ' ']);
-    if sanitized.is_empty() || matches!(sanitized, "." | "..") {
+    let canonical = if sanitized.is_empty() || matches!(sanitized, "." | "..") {
         "download".to_string()
     } else if crate::platform::is_windows_reserved_filename(sanitized) {
         let path = Path::new(sanitized);
@@ -45,7 +48,46 @@ pub fn canonical_download_filename(filename: &str) -> String {
         }
     } else {
         sanitized.to_string()
+    };
+
+    if canonical.len() <= MAX_FILENAME_BYTES {
+        return canonical;
     }
+
+    let extension = Path::new(&canonical)
+        .extension()
+        .and_then(|value| value.to_str())
+        .map(|value| format!(".{value}"))
+        .unwrap_or_default();
+    let base = canonical
+        .strip_suffix(&extension)
+        .unwrap_or(canonical.as_str());
+    let base_budget = MAX_FILENAME_BYTES
+        .saturating_sub(extension.len())
+        .saturating_sub(TRUNCATION_MARKER.len());
+
+    if base_budget == 0 {
+        return truncate_utf8_to_bytes(&canonical, MAX_FILENAME_BYTES);
+    }
+
+    format!(
+        "{}{}{}",
+        truncate_utf8_to_bytes(base, base_budget),
+        TRUNCATION_MARKER,
+        extension
+    )
+}
+
+fn truncate_utf8_to_bytes(value: &str, max_bytes: usize) -> String {
+    let mut end = 0;
+    for (index, character) in value.char_indices() {
+        let next = index + character.len_utf8();
+        if next > max_bytes {
+            break;
+        }
+        end = next;
+    }
+    value[..end].to_string()
 }
 
 pub fn expected_primary_path(
@@ -59,7 +101,12 @@ pub fn expected_primary_path(
     }
 
     let safe_filename = canonical_download_filename(filename);
-    Ok(resolved_dest.join(safe_filename))
+    let path = resolved_dest.join(safe_filename);
+    if crate::path_has_symlink_component(&path) {
+        return Err("Download path may not contain symlink components".to_string());
+    }
+    crate::canonicalize_with_missing_components(&path)
+        .ok_or_else(|| "Download path could not be canonicalized".to_string())
 }
 
 pub fn register_expected(
@@ -88,13 +135,15 @@ pub fn set_primary_path(
     }) {
         return Err("Download ownership path traversal is not allowed".to_string());
     }
-    if std::fs::symlink_metadata(path).is_ok_and(|metadata| metadata.file_type().is_symlink()) {
-        return Err("Download ownership path may not be a symlink".to_string());
+    if crate::path_has_symlink_component(path) {
+        return Err("Download ownership path may not contain symlink components".to_string());
     }
+    let canonical_path = crate::canonicalize_with_missing_components(path)
+        .ok_or_else(|| "Download ownership path could not be canonicalized".to_string())?;
 
     let database = app_handle.state::<crate::db::DbState>();
     let connection = database.lock()?;
-    crate::db::set_ownership(&connection, id, &path.to_string_lossy())
+    crate::db::set_ownership(&connection, id, &canonical_path.to_string_lossy())
 }
 
 pub fn remove(app_handle: &tauri::AppHandle, id: &str) -> Result<(), String> {
@@ -147,11 +196,7 @@ fn legacy_download_queue_paths(app_handle: &tauri::AppHandle) -> Result<Vec<Path
     let downloads = {
         let database = app_handle.state::<crate::db::DbState>();
         let connection = database.lock()?;
-        crate::db::load_downloads(&connection)?
-            .into_iter()
-            .map(|value| serde_json::from_str::<crate::ipc::DownloadItem>(&value))
-            .collect::<Result<Vec<_>, _>>()
-            .map_err(|error| format!("Invalid download queue ownership data: {error}"))?
+        parse_legacy_download_items(crate::db::load_downloads(&connection)?)
     };
 
     let mut paths = Vec::new();
@@ -223,9 +268,23 @@ fn legacy_download_queue_paths(app_handle: &tauri::AppHandle) -> Result<Vec<Path
     Ok(paths)
 }
 
+fn parse_legacy_download_items(values: Vec<String>) -> Vec<crate::ipc::DownloadItem> {
+    values
+        .into_iter()
+        .filter_map(|value| match serde_json::from_str::<crate::ipc::DownloadItem>(&value) {
+            Ok(download) => Some(download),
+            Err(error) => {
+                log::warn!("Skipping malformed download ownership record: {error}");
+                None
+            }
+        })
+        .collect()
+}
+
 #[cfg(test)]
 mod tests {
-    use super::canonical_download_filename;
+    use super::{canonical_download_filename, parse_legacy_download_items};
+    use serde_json::json;
 
     #[test]
     fn canonicalizes_untrusted_download_filenames() {
@@ -238,4 +297,40 @@ mod tests {
         assert_eq!(canonical_download_filename("CON.txt"), "CON-.txt");
         assert_eq!(canonical_download_filename("lpt9"), "lpt9-");
     }
+
+    #[test]
+    fn truncates_long_filenames_by_utf8_bytes_and_preserves_extension() {
+        let filename = canonical_download_filename(&format!("{}.mp4", "title ".repeat(100)));
+
+        assert!(filename.len() <= 255);
+        assert!(filename.ends_with(".mp4"));
+        assert!(filename.contains('…'));
+    }
+
+    #[test]
+    fn truncates_multibyte_filenames_at_character_boundaries() {
+        let filename = canonical_download_filename(&format!("{}.mkv", "😀".repeat(100)));
+
+        assert!(filename.len() <= 255);
+        assert!(filename.ends_with(".mkv"));
+        assert!(!filename.contains('\u{fffd}'));
+    }
+
+    #[test]
+    fn malformed_legacy_download_does_not_block_valid_ownership_records() {
+        let valid = json!({
+            "id": "download-1",
+            "url": "https://example.com/file",
+            "fileName": "file",
+            "status": "completed",
+            "category": "Other",
+            "dateAdded": ""
+        })
+        .to_string();
+
+        let downloads = parse_legacy_download_items(vec!["not-json".to_string(), valid]);
+
+        assert_eq!(downloads.len(), 1);
+        assert_eq!(downloads[0].id, "download-1");
+    }
 }

src-tauri/src/extension_server.rs

@@ -17,26 +17,34 @@ use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex, RwLock};
 use std::time::{SystemTime, UNIX_EPOCH};
 use tauri::{AppHandle, Emitter, Manager};
-use tokio::sync::watch;
-use tower_http::cors::{Any, CorsLayer};
+use tokio::sync::{oneshot, watch};
+use tower_http::{
+    cors::{Any, CorsLayer},
+    limit::RequestBodyLimitLayer,
+};
 use ts_rs::TS;
 
 pub const EXTENSION_SERVER_PORT: u16 = 6412;
 pub const EXTENSION_SERVER_PORT_RANGE: std::ops::RangeInclusive<u16> = EXTENSION_SERVER_PORT..=6422;
 const MAX_URL_COUNT: usize = 200;
+const MAX_REQUEST_BODY_BYTES: usize = 256 * 1024;
 const SIGNATURE_MAX_AGE_MS: u64 = 60_000;
 const SERVER_HEADER: &str = "x-firelink-server";
 const PROTOCOL_VERSION_HEADER: &str = "x-firelink-protocol-version";
 const CLIENT_NONCE_HEADER: &str = "x-firelink-client-nonce";
 const SERVER_PROOF_HEADER: &str = "x-firelink-server-proof";
 const SERVER_PORT_HEADER: &str = "x-firelink-server-port";
+const SMOKE_PROCESS_ID_HEADER: &str = "x-firelink-smoke-process-id";
 const SERVER_PROOF_PREFIX: &[u8] = b"firelink-server-proof\n";
 const PROTOCOL_VERSION: &str = "4";
+const MAX_PENDING_EXTENSION_ACKS: usize = 64;
+const EXTENSION_ACK_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(2);
 
 type HmacSha256 = Hmac<Sha256>;
 pub type SharedExtensionToken = Arc<RwLock<String>>;
 pub type SharedFrontendReady = Arc<AtomicBool>;
 pub type SharedServerPort = Arc<RwLock<Option<u16>>>;
+pub type SharedExtensionAcks = Arc<Mutex<HashMap<String, oneshot::Sender<()>>>>;
 type ReplayCache = Arc<Mutex<HashMap<String, u64>>>;
 
 #[derive(Clone)]
@@ -44,6 +52,7 @@ pub struct ServerState {
     pub app_handle: AppHandle,
     pub pairing_token: SharedExtensionToken,
     pub frontend_ready: SharedFrontendReady,
+    pub extension_acks: SharedExtensionAcks,
     pub replay_cache: ReplayCache,
     pub bound_port: u16,
 }
@@ -62,25 +71,44 @@ struct ExtensionRequest {
     #[serde(default)]
     cookies: Option<String>,
     #[serde(default)]
+    cookie_scopes: Option<Vec<ExtensionCookieScope>>,
+    #[serde(default)]
     media: bool,
+    #[serde(default)]
+    batch: bool,
+    #[serde(default)]
+    batch_name: Option<String>,
+}
+
+#[derive(Clone, Deserialize, Serialize, TS)]
+#[ts(export, export_to = "../../src/bindings/")]
+pub struct ExtensionCookieScope {
+    pub url: String,
+    pub cookies: String,
 }
 
 #[derive(Clone, Serialize, TS)]
 #[ts(export, export_to = "../../src/bindings/")]
 pub struct ExtensionDownload {
+    #[ts(optional)]
+    request_id: Option<String>,
     urls: Vec<String>,
     referer: Option<String>,
     silent: bool,
     filename: Option<String>,
     headers: Option<String>,
     cookies: Option<String>,
+    cookie_scopes: Option<Vec<ExtensionCookieScope>>,
     media: bool,
+    batch: bool,
+    batch_name: Option<String>,
 }
 
 pub async fn start_server(
     app_handle: AppHandle,
     pairing_token: SharedExtensionToken,
     frontend_ready: SharedFrontendReady,
+    extension_acks: SharedExtensionAcks,
     server_port: SharedServerPort,
     mut shutdown_rx: watch::Receiver<bool>,
 ) -> Result<(), String> {
@@ -89,6 +117,7 @@ pub async fn start_server(
         app_handle,
         pairing_token,
         frontend_ready,
+        extension_acks,
         replay_cache: Arc::new(Mutex::new(HashMap::new())),
         bound_port: port,
     };
@@ -105,6 +134,7 @@ pub async fn start_server(
         .route("/ping", get(ping_handler))
         .route("/download", post(download_handler))
         .layer(cors)
+        .layer(RequestBodyLimitLayer::new(MAX_REQUEST_BODY_BYTES))
         .layer(middleware::from_fn(add_server_identity))
         .with_state(state);
 
@@ -140,6 +170,13 @@ async fn add_server_identity(request: Request<Body>, next: Next) -> Response {
         PROTOCOL_VERSION_HEADER,
         HeaderValue::from_static(PROTOCOL_VERSION),
     );
+    if std::env::var_os("FIRELINK_SMOKE_TEST").is_some() {
+        if let Ok(process_id) = HeaderValue::from_str(&std::process::id().to_string()) {
+            response
+                .headers_mut()
+                .insert(SMOKE_PROCESS_ID_HEADER, process_id);
+        }
+    }
     response
 }
 
@@ -166,6 +203,10 @@ async fn ping_handler(
     headers: HeaderMap,
     body: Bytes,
 ) -> Result<Response, StatusCode> {
+    if !has_allowed_request_origin(&headers) {
+        return Err(StatusCode::FORBIDDEN);
+    }
+
     let signature = match headers
         .get("x-firelink-signature")
         .and_then(|v| v.to_str().ok())
@@ -191,7 +232,15 @@ async fn ping_handler(
         None => return Err(StatusCode::FORBIDDEN),
     };
 
-    if verify_signature(signature, timestamp_str, &body, &state.pairing_token).is_err() {
+    let timestamp = match verify_signature(signature, timestamp_str, &body, &state.pairing_token) {
+        Ok(timestamp) => timestamp,
+        Err(_) => return Err(StatusCode::FORBIDDEN),
+    };
+
+    // Discovery probes are authenticated requests too. Claim the verified
+    // signature before signing a proof so a captured /ping signature cannot
+    // be replayed with arbitrary client nonces during its validity window.
+    if !claim_request(signature, timestamp, &state.replay_cache) {
         return Err(StatusCode::FORBIDDEN);
     }
 
@@ -215,7 +264,12 @@ async fn download_handler(
     State(state): State<ServerState>,
     headers: HeaderMap,
     body: Bytes,
-) -> Result<StatusCode, StatusCode> {
+) -> Result<Response, StatusCode> {
+    let nonce = match required_client_nonce(&headers) {
+        Some(nonce) if has_allowed_request_origin(&headers) => nonce,
+        _ => return Err(StatusCode::FORBIDDEN),
+    };
+
     let signature = match headers
         .get("x-firelink-signature")
         .and_then(|v| v.to_str().ok())
@@ -269,15 +323,45 @@ async fn download_handler(
         return Err(StatusCode::SERVICE_UNAVAILABLE);
     }
 
+    let request_id = uuid::Uuid::new_v4().simple().to_string();
+    let ack_receiver = register_extension_ack(&state.extension_acks, request_id.clone())
+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
+    let mut download = download;
+    download.request_id = Some(request_id.clone());
+
     if state
         .app_handle
         .emit("extension-add-download", download)
         .is_err()
     {
+        remove_extension_ack(&state.extension_acks, &request_id);
         return Err(StatusCode::INTERNAL_SERVER_ERROR);
     }
 
-    Ok(StatusCode::OK)
+    if tokio::time::timeout(EXTENSION_ACK_TIMEOUT, ack_receiver)
+        .await
+        .is_err()
+    {
+        remove_extension_ack(&state.extension_acks, &request_id);
+        // The event may already have reached the frontend even when its
+        // acknowledgement was delayed or lost. Do not return 503 here:
+        // extension callers retry 503 and could create a duplicate modal.
+        return Err(StatusCode::GATEWAY_TIMEOUT);
+    }
+
+    let proof = sign_server_proof(timestamp_str, nonce, state.bound_port, &state.pairing_token)
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    let mut response = Response::new(Body::empty());
+    response.headers_mut().insert(
+        SERVER_PROOF_HEADER,
+        HeaderValue::from_str(&proof).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?,
+    );
+    response.headers_mut().insert(
+        SERVER_PORT_HEADER,
+        HeaderValue::from_str(&state.bound_port.to_string())
+            .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?,
+    );
+    Ok(response)
 }
 
 async fn wait_for_frontend(frontend_ready: &SharedFrontendReady) -> bool {
@@ -290,27 +374,101 @@ async fn wait_for_frontend(frontend_ready: &SharedFrontendReady) -> bool {
     false
 }
 
-fn normalize_download(payload: ExtensionRequest) -> Option<ExtensionDownload> {
+fn register_extension_ack(
+    registry: &SharedExtensionAcks,
+    request_id: String,
+) -> Option<oneshot::Receiver<()>> {
+    let (sender, receiver) = oneshot::channel();
+    let mut pending = registry.lock().ok()?;
+    if pending.len() >= MAX_PENDING_EXTENSION_ACKS {
+        return None;
+    }
+    pending.insert(request_id, sender);
+    Some(receiver)
+}
+
+pub fn acknowledge_extension_download(registry: &SharedExtensionAcks, request_id: &str) -> bool {
+    let Some(sender) = registry
+        .lock()
+        .ok()
+        .and_then(|mut pending| pending.remove(request_id))
+    else {
+        return false;
+    };
+    sender.send(()).is_ok()
+}
+
+fn remove_extension_ack(registry: &SharedExtensionAcks, request_id: &str) {
+    if let Ok(mut pending) = registry.lock() {
+        pending.remove(request_id);
+    }
+}
+
+fn normalize_download(mut payload: ExtensionRequest) -> Option<ExtensionDownload> {
+    if payload.urls.len() > MAX_URL_COUNT {
+        return None;
+    }
+
     let mut seen = HashSet::new();
     let urls = payload
         .urls
         .into_iter()
-        .take(MAX_URL_COUNT)
         .filter_map(|raw_url| normalize_url(&raw_url))
         .filter(|url| seen.insert(url.clone()))
         .collect::<Vec<_>>();
     if urls.is_empty() {
         return None;
     }
+    if payload.media
+        && urls.iter().any(|url| {
+            Url::parse(url)
+                .ok()
+                .is_none_or(|url| !matches!(url.scheme(), "http" | "https"))
+        })
+    {
+        return None;
+    }
 
     let referer = payload.referer.and_then(|value| {
         let url = Url::parse(value.trim()).ok()?;
         matches!(url.scheme(), "http" | "https").then(|| url.to_string())
     });
     let filename = payload.filename.and_then(|value| sanitize_filename(&value));
-    let headers = normalize_headers(payload.headers, payload.media);
+    let batch = payload.batch && urls.len() >= 2;
+    let batch_name = batch
+        .then_some(payload.batch_name)
+        .flatten()
+        .and_then(|value| {
+            let value = value.trim().to_string();
+            (!value.is_empty() && value.chars().count() <= 512).then_some(value)
+        });
+    // A multi-URL handoff has no per-URL cookie scope. Keep ordinary
+    // request headers, but drop credential-bearing headers and the dedicated cookie field
+    // so a legacy or untrusted caller cannot reuse one session across hosts.
+    let headers = normalize_headers(payload.headers, payload.media || urls.len() > 1);
+    let cookie_scopes = if !payload.media && urls.len() == 1 {
+        let mut scopes = payload.cookie_scopes.take().unwrap_or_default();
+        if let Some(cookies) = payload.cookies.take() {
+            if !cookies.trim().is_empty() {
+                scopes.push(ExtensionCookieScope {
+                    url: urls[0].clone(),
+                    cookies,
+                });
+            }
+        }
+        normalize_cookie_scopes(scopes)
+    } else {
+        None
+    };
+    let cookies = cookie_scopes.as_ref().and_then(|scopes| {
+        scopes
+            .iter()
+            .find(|scope| same_origin_url(&scope.url, &urls[0]))
+            .map(|scope| scope.cookies.clone())
+    });
 
     Some(ExtensionDownload {
+        request_id: None,
         urls,
         referer,
         silent: payload.silent,
@@ -321,14 +479,65 @@ fn normalize_download(payload: ExtensionRequest) -> Option<ExtensionDownload> {
         // Cookie header can exceed upstream limits and makes old extension
         // builds pay for a doomed metadata request before retrying. Ordinary
         // captured downloads still need their exact request cookies.
-        cookies: (!payload.media)
-            .then_some(payload.cookies)
-            .flatten()
-            .filter(|value| !value.trim().is_empty()),
+        cookies,
+        cookie_scopes,
         media: payload.media,
+        batch,
+        batch_name,
     })
 }
 
+fn normalize_cookie_scopes(scopes: Vec<ExtensionCookieScope>) -> Option<Vec<ExtensionCookieScope>> {
+    let mut normalized = Vec::new();
+    let mut seen_origins = HashSet::new();
+
+    for scope in scopes {
+        let Ok(url) = Url::parse(scope.url.trim()) else {
+            continue;
+        };
+        if !matches!(url.scheme(), "http" | "https") {
+            continue;
+        }
+        let cookies = scope.cookies.trim();
+        if cookies.is_empty() {
+            continue;
+        }
+        let Some(host) = url.host_str() else {
+            continue;
+        };
+        let origin = format!(
+            "{}://{}:{}",
+            url.scheme(),
+            host,
+            url.port_or_known_default().unwrap_or(443)
+        );
+        if !seen_origins.insert(origin) {
+            continue;
+        }
+        normalized.push(ExtensionCookieScope {
+            url: url.to_string(),
+            cookies: cookies.to_string(),
+        });
+        if normalized.len() >= 16 {
+            break;
+        }
+    }
+
+    (!normalized.is_empty()).then_some(normalized)
+}
+
+fn same_origin_url(left: &str, right: &str) -> bool {
+    let Some(left) = Url::parse(left).ok() else {
+        return false;
+    };
+    let Some(right) = Url::parse(right).ok() else {
+        return false;
+    };
+    left.scheme() == right.scheme()
+        && left.host() == right.host()
+        && left.port_or_known_default() == right.port_or_known_default()
+}
+
 fn normalize_headers(headers: Option<String>, media: bool) -> Option<String> {
     let headers = headers?;
     if !media {
@@ -339,7 +548,17 @@ fn normalize_headers(headers: Option<String>, media: bool) -> Option<String> {
         .lines()
         .filter(|line| {
             line.split_once(':')
-                .map(|(name, _)| !name.trim().eq_ignore_ascii_case("cookie"))
+                .map(|(name, _)| {
+                    !matches!(
+                        name.trim().to_ascii_lowercase().as_str(),
+                        "authorization"
+                            | "cookie"
+                            | "cookie2"
+                            | "proxy-authorization"
+                            | "set-cookie"
+                            | "set-cookie2"
+                    )
+                })
                 .unwrap_or(true)
         })
         .collect::<Vec<_>>()
@@ -390,6 +609,20 @@ fn is_valid_client_nonce(value: &str) -> bool {
     value.len() == 32 && value.bytes().all(|byte| byte.is_ascii_hexdigit())
 }
 
+fn has_allowed_request_origin(headers: &HeaderMap) -> bool {
+    match headers.get("origin") {
+        None => true,
+        Some(origin) => origin.to_str().ok().is_some_and(is_allowed_origin),
+    }
+}
+
+fn required_client_nonce(headers: &HeaderMap) -> Option<&str> {
+    headers
+        .get(CLIENT_NONCE_HEADER)
+        .and_then(|nonce| nonce.to_str().ok())
+        .filter(|nonce| is_valid_client_nonce(nonce))
+}
+
 fn sign_server_proof(
     timestamp_text: &str,
     nonce: &str,
@@ -424,16 +657,22 @@ fn claim_request(signature: &str, timestamp: u64, replay_cache: &ReplayCache) ->
         Some(now) => now,
         None => return false,
     };
+    claim_request_at(signature, timestamp, replay_cache, now)
+}
+
+fn claim_request_at(signature: &str, timestamp: u64, replay_cache: &ReplayCache, now: u64) -> bool {
     let mut cache = match replay_cache.lock() {
         Ok(cache) => cache,
         Err(_) => return false,
     };
-    cache.retain(|_, seen_at| now.saturating_sub(*seen_at) < SIGNATURE_MAX_AGE_MS);
-    if cache.len() > 10_000 {
+    cache.retain(|_, expires_at| now < *expires_at);
+    let key = format!("{timestamp}:{}", signature.to_ascii_lowercase());
+    if cache.len() >= 10_000 && !cache.contains_key(&key) {
         return false;
     }
-    let key = format!("{timestamp}:{}", signature.to_ascii_lowercase());
-    cache.insert(key, now).is_none()
+    cache
+        .insert(key, timestamp.saturating_add(SIGNATURE_MAX_AGE_MS))
+        .is_none()
 }
 
 fn current_time_millis() -> Option<u64> {
@@ -476,13 +715,21 @@ fn is_allowed_origin(origin: &str) -> bool {
 #[cfg(test)]
 mod tests {
     use super::{
-        add_server_identity, is_valid_client_nonce, normalize_download, sign_server_proof,
-        ExtensionRequest, PROTOCOL_VERSION_HEADER, SERVER_HEADER,
+        acknowledge_extension_download, add_server_identity, claim_request_at,
+        has_allowed_request_origin, is_valid_client_nonce, normalize_download,
+        required_client_nonce, sign_server_proof, ExtensionCookieScope, ExtensionRequest,
+        MAX_URL_COUNT, PROTOCOL_VERSION_HEADER, SERVER_HEADER,
+    };
+    use axum::{
+        http::{HeaderMap, HeaderValue, StatusCode},
+        middleware,
+        routing::get,
+        Router,
     };
-    use axum::{http::StatusCode, middleware, routing::get, Router};
     use hmac::{Hmac, KeyInit, Mac};
     use sha2::Sha256;
-    use std::sync::{Arc, RwLock};
+    use std::collections::HashMap;
+    use std::sync::{Arc, Mutex, RwLock};
 
     #[tokio::test]
     async fn identifies_every_extension_server_response() {
@@ -519,6 +766,123 @@ mod tests {
         assert!(!is_valid_client_nonce("0123456789abcdef0123456789abcdeg"));
     }
 
+    #[test]
+    fn rejects_invalid_origins() {
+        let mut headers = HeaderMap::new();
+        assert!(has_allowed_request_origin(&headers));
+
+        headers.insert(
+            "origin",
+            HeaderValue::from_static("https://not-firelink.example"),
+        );
+        assert!(!has_allowed_request_origin(&headers));
+
+        headers.insert(
+            "origin",
+            HeaderValue::from_static("moz-extension://firelink"),
+        );
+        assert!(has_allowed_request_origin(&headers));
+    }
+
+    #[test]
+    fn requires_a_valid_client_nonce_for_downloads() {
+        let mut headers = HeaderMap::new();
+        assert!(required_client_nonce(&headers).is_none());
+
+        headers.insert(
+            "x-firelink-client-nonce",
+            HeaderValue::from_static("not-a-valid-nonce"),
+        );
+        assert!(required_client_nonce(&headers).is_none());
+
+        headers.insert(
+            "x-firelink-client-nonce",
+            HeaderValue::from_static("0123456789abcdef0123456789abcdef"),
+        );
+        assert_eq!(
+            required_client_nonce(&headers),
+            Some("0123456789abcdef0123456789abcdef")
+        );
+    }
+
+    #[test]
+    fn media_handoffs_reject_non_http_page_urls() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec!["ftp://example.com/audio.mp3".to_string()],
+            referer: None,
+            silent: false,
+            filename: None,
+            headers: None,
+            cookies: None,
+            cookie_scopes: None,
+            media: true,
+            batch: false,
+            batch_name: None,
+        });
+
+        assert!(download.is_none());
+    }
+
+    #[test]
+    fn rejects_oversized_url_lists_instead_of_truncating_them() {
+        let download = normalize_download(ExtensionRequest {
+            urls: (0..=MAX_URL_COUNT)
+                .map(|index| format!("https://example.com/file-{index}.bin"))
+                .collect(),
+            referer: None,
+            silent: false,
+            filename: None,
+            headers: None,
+            cookies: None,
+            cookie_scopes: None,
+            media: false,
+            batch: false,
+            batch_name: None,
+        });
+
+        assert!(download.is_none());
+    }
+
+    #[test]
+    fn rejects_replayed_download_signature() {
+        let cache = Arc::new(Mutex::new(HashMap::new()));
+        let signature = "a".repeat(64);
+        let now = 1_000_000;
+
+        assert!(claim_request_at(&signature, now, &cache, now));
+        assert!(!claim_request_at(&signature, now, &cache, now + 1));
+    }
+
+    #[test]
+    fn future_timestamp_replay_claim_survives_cache_pruning_window() {
+        let cache = Arc::new(Mutex::new(HashMap::new()));
+        let signature = "b".repeat(64);
+        let now = 1_000_000;
+        let future_timestamp = now + 30_000;
+
+        assert!(claim_request_at(&signature, future_timestamp, &cache, now));
+        assert!(!claim_request_at(
+            &signature,
+            future_timestamp,
+            &cache,
+            now + 70_000
+        ));
+    }
+
+    #[tokio::test]
+    async fn acknowledges_and_removes_pending_extension_event() {
+        let registry = Arc::new(Mutex::new(HashMap::new()));
+        let (sender, receiver) = tokio::sync::oneshot::channel();
+        registry
+            .lock()
+            .unwrap()
+            .insert("request-1".to_string(), sender);
+
+        assert!(acknowledge_extension_download(&registry, "request-1"));
+        assert!(!acknowledge_extension_download(&registry, "request-1"));
+        assert!(receiver.await.is_ok());
+    }
+
     #[test]
     fn explicit_media_drops_the_extension_cookie_header() {
         let download = normalize_download(ExtensionRequest {
@@ -527,11 +891,14 @@ mod tests {
             silent: false,
             filename: None,
             headers: Some(format!(
-                "Cookie: stale={};\nUser-Agent: Firefox",
+                "Cookie: stale={};\nCookie2: stale=1\nAuthorization: Bearer stale\nProxy-Authorization: Basic stale\nSet-Cookie: stale=1\nSet-Cookie2: stale=1\nUser-Agent: Firefox",
                 "x".repeat(64 * 1024)
             )),
             cookies: Some(format!("large={}", "x".repeat(64 * 1024))),
+            cookie_scopes: None,
             media: true,
+            batch: false,
+            batch_name: None,
         })
         .expect("valid media handoff");
 
@@ -549,7 +916,10 @@ mod tests {
             filename: None,
             headers: None,
             cookies: Some("session=browser-cookie-header".to_string()),
+            cookie_scopes: None,
             media: false,
+            batch: false,
+            batch_name: None,
         })
         .expect("valid download handoff");
 
@@ -560,6 +930,115 @@ mod tests {
         );
     }
 
+    #[test]
+    fn regular_capture_normalizes_host_scoped_cookie_headers() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec!["https://mail.google.com/mail/u/0/?view=att".to_string()],
+            referer: Some("https://mail.google.com/mail/u/0/".to_string()),
+            silent: true,
+            filename: Some("report.zip".to_string()),
+            headers: None,
+            cookies: Some("SID=mail-session".to_string()),
+            cookie_scopes: Some(vec![
+                ExtensionCookieScope {
+                    url: "https://mail.google.com/".to_string(),
+                    cookies: "SID=mail-session".to_string(),
+                },
+                ExtensionCookieScope {
+                    url: "https://accounts.google.com/".to_string(),
+                    cookies: "SID=account-session".to_string(),
+                },
+                ExtensionCookieScope {
+                    url: "https://mail.google.com/another-path".to_string(),
+                    cookies: "duplicate=ignored".to_string(),
+                },
+            ]),
+            media: false,
+            batch: false,
+            batch_name: None,
+        })
+        .expect("valid download handoff");
+
+        assert_eq!(download.cookies.as_deref(), Some("SID=mail-session"));
+        assert_eq!(
+            download.cookie_scopes.as_ref().map(|scopes| scopes.len()),
+            Some(2)
+        );
+        assert_eq!(
+            download.cookie_scopes.as_ref().unwrap()[1].cookies,
+            "SID=account-session"
+        );
+    }
+
+    #[test]
+    fn multi_url_capture_drops_cookie_scope_but_preserves_safe_headers() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec![
+                "https://one.example/private.zip".to_string(),
+                "https://two.example/file.zip".to_string(),
+            ],
+            referer: None,
+            silent: true,
+            filename: None,
+            headers: Some("Cookie: session=secret\nUser-Agent: Firefox".to_string()),
+            cookies: Some("session=secret".to_string()),
+            cookie_scopes: None,
+            media: false,
+            batch: false,
+            batch_name: None,
+        })
+        .expect("valid multi-url handoff");
+
+        assert_eq!(download.cookies, None);
+        assert_eq!(download.headers.as_deref(), Some("User-Agent: Firefox"));
+    }
+
+    #[test]
+    fn selected_link_batches_preserve_context_only_for_two_or_more_urls() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec![
+                "https://example.com/one.zip".to_string(),
+                "https://example.com/two.zip".to_string(),
+            ],
+            referer: Some("https://example.com/gallery".to_string()),
+            silent: false,
+            filename: None,
+            headers: None,
+            cookies: None,
+            cookie_scopes: None,
+            media: false,
+            batch: true,
+            batch_name: Some("Example Gallery / Chapter: 1".to_string()),
+        })
+        .expect("valid selected-link batch");
+
+        assert!(download.batch);
+        assert_eq!(
+            download.batch_name.as_deref(),
+            Some("Example Gallery / Chapter: 1")
+        );
+    }
+
+    #[test]
+    fn selected_link_batch_context_is_dropped_for_single_urls() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec!["https://example.com/one.zip".to_string()],
+            referer: Some("https://example.com/gallery".to_string()),
+            silent: false,
+            filename: None,
+            headers: None,
+            cookies: None,
+            cookie_scopes: None,
+            media: false,
+            batch: true,
+            batch_name: Some("Example Gallery".to_string()),
+        })
+        .expect("valid single-link handoff");
+
+        assert!(!download.batch);
+        assert!(download.batch_name.is_none());
+    }
+
     #[test]
     fn signs_server_proof_with_timestamp_nonce_and_bound_port() {
         let token = Arc::new(RwLock::new("pairing-token".to_string()));

src-tauri/src/ipc.rs

@@ -2,6 +2,18 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use ts_rs::TS;
 
+fn default_speed_limit_unit() -> String {
+    "MB/s".to_string()
+}
+
+fn default_language_preference() -> String {
+    "system".to_string()
+}
+
+fn default_sidebar_position() -> String {
+    "auto".to_string()
+}
+
 #[derive(Clone, Copy, Debug, Serialize, Deserialize, TS)]
 #[serde(rename_all = "lowercase")]
 #[ts(export, export_to = "../../src/bindings/")]
@@ -58,6 +70,18 @@ pub struct Queue {
     pub id: String,
     pub name: String,
     pub is_main: bool,
+    #[serde(default)]
+    #[ts(optional)]
+    pub max_concurrent: Option<usize>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "../../src/bindings/")]
+pub struct QueueConcurrencyConfig {
+    pub id: String,
+    #[serde(default)]
+    pub max_concurrent: Option<usize>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, TS)]
@@ -76,6 +100,12 @@ pub struct DownloadItem {
     pub eta: Option<String>,
     #[ts(optional)]
     pub size: Option<String>,
+    #[ts(optional)]
+    pub downloaded_bytes: Option<f64>,
+    #[ts(optional)]
+    pub total_bytes: Option<f64>,
+    #[ts(optional)]
+    pub total_is_estimate: Option<bool>,
     pub category: DownloadCategory,
     pub date_added: String,
     #[ts(optional)]
@@ -103,6 +133,8 @@ pub struct DownloadItem {
     #[ts(optional)]
     pub media_format_selector: Option<String>,
     #[ts(optional)]
+    pub media_quality: Option<String>,
+    #[ts(optional)]
     pub queue_id: Option<String>,
     #[ts(optional)]
     pub queue_position: Option<i32>,
@@ -110,6 +142,8 @@ pub struct DownloadItem {
     pub has_been_dispatched: Option<bool>,
     #[ts(optional)]
     pub last_error: Option<String>,
+    #[ts(optional)]
+    pub last_try: Option<String>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, TS)]
@@ -180,6 +214,44 @@ pub enum Theme {
     Nord,
 }
 
+#[derive(Clone, Debug, Default, Serialize, Deserialize, TS)]
+#[serde(rename_all = "kebab-case")]
+#[ts(export, export_to = "../../src/bindings/")]
+pub enum FontFamily {
+    #[default]
+    System,
+    Inter,
+    Outfit,
+    Vazirmatn,
+    NotoSansHebrew,
+    NotoSansSc,
+    Roboto,
+    Serif,
+    Monospace,
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize, TS)]
+#[serde(rename_all = "lowercase")]
+#[ts(export, export_to = "../../src/bindings/")]
+pub enum WindowControlStyle {
+    #[default]
+    Auto,
+    Macos,
+    Windows,
+    Gnome,
+    Minimal,
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize, TS)]
+#[serde(rename_all = "lowercase")]
+#[ts(export, export_to = "../../src/bindings/")]
+pub enum CalendarPreference {
+    #[default]
+    Gregorian,
+    Persian,
+    Hebrew,
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize, TS)]
 #[serde(rename_all = "lowercase")]
 #[ts(export, export_to = "../../src/bindings/")]
@@ -245,6 +317,14 @@ pub struct SchedulerSettings {
 #[ts(export, export_to = "../../src/bindings/")]
 pub struct PersistedSettings {
     pub theme: Theme,
+    #[serde(default)]
+    pub font_family: FontFamily,
+    #[serde(default)]
+    pub window_control_style: WindowControlStyle,
+    #[serde(default)]
+    pub calendar_preference: CalendarPreference,
+    #[serde(default = "default_language_preference")]
+    pub language: String,
     pub base_download_folder: String,
     pub category_subfolders_enabled: bool,
     pub category_subfolders: HashMap<String, String>,
@@ -255,6 +335,8 @@ pub struct PersistedSettings {
     pub speed_limit_preset_values: Vec<f64>,
     pub logs_enabled: bool,
     pub is_sidebar_visible: bool,
+    #[serde(default = "default_sidebar_position")]
+    pub sidebar_position: String,
     pub active_settings_tab: SettingsTab,
     pub scheduler: SchedulerSettings,
     pub scheduler_running: bool,
@@ -262,10 +344,14 @@ pub struct PersistedSettings {
     pub scheduler_last_start_key: String,
     pub scheduler_last_stop_key: String,
     pub last_custom_speed_limit_ki_b: u32,
+    #[serde(default = "default_speed_limit_unit")]
+    pub last_custom_speed_limit_unit: String,
     pub per_server_connections: i32,
     pub max_automatic_retries: i32,
     pub show_notifications: bool,
     pub play_completion_sound: bool,
+    #[serde(default)]
+    pub auto_add_clipboard_links: bool,
     pub app_font_size: AppFontSize,
     pub list_row_density: ListRowDensity,
     pub show_dock_badge: bool,
@@ -275,16 +361,12 @@ pub struct PersistedSettings {
     pub proxy_port: u16,
     pub custom_user_agent: String,
     pub ask_where_to_save_each_file: bool,
+    pub remember_last_used_download_directory: bool,
     pub prevents_sleep_while_downloading: bool,
+    #[serde(default)]
+    pub prevents_display_sleep_while_downloading: bool,
     pub media_cookie_source: MediaCookieSource,
     pub site_logins: Vec<SiteLogin>,
-    // HMAC shared secret for the browser extension. It is persisted in the
-    // settings database so startup never needs to touch the OS keychain.
-    // The keychain is still used as defense-in-depth by grant_keychain_access,
-    // but the DB copy is the primary read path, eliminating the OS credential
-    // prompt that macOS shows when the binary signature changes after an update.
-    #[serde(default)]
-    pub extension_pairing_token: String,
     pub auto_check_updates: bool,
     #[serde(default)]
     pub keychain_access_granted: bool,
@@ -297,6 +379,7 @@ pub struct PlatformInfo {
     pub os: String,
     pub arch: String,
     pub target_triple: String,
+    pub portable: bool,
 }
 
 #[derive(Clone, Copy, Debug, Serialize, Deserialize, TS)]
@@ -337,6 +420,15 @@ impl DownloadStateEvent {
         }
     }
 
+    pub fn paused_with_error(id: impl Into<String>, error: impl Into<String>) -> Self {
+        Self {
+            id: id.into(),
+            status: DownloadStatus::Paused.as_str().to_string(),
+            error: Some(error.into()),
+            file_name: None,
+        }
+    }
+
     pub fn completed_with_file(id: impl Into<String>, file_name: impl Into<String>) -> Self {
         Self {
             id: id.into(),

src-tauri/src/parity.rs

@@ -1,4 +1,5 @@
 use serde::{Deserialize, Serialize};
+#[cfg(any(target_os = "macos", target_os = "linux"))]
 use std::process::Command;
 use ts_rs::TS;
 
@@ -83,6 +84,7 @@ fn proxy_from_environment() -> Option<String> {
     })
 }
 
+#[cfg(any(target_os = "macos", target_os = "linux"))]
 fn command_stdout(command: &mut Command) -> std::io::Result<String> {
     let output = command.output()?;
     if !output.status.success() {

src-tauri/src/power.rs

@@ -0,0 +1,419 @@
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::mpsc::{self, Receiver, Sender};
+use std::sync::{Arc, Mutex};
+use std::thread::{self, JoinHandle};
+
+const ASSERTION_REASON: &str = "Firelink active download";
+
+/// Owns the OS power assertions for the whole backend transfer lifecycle.
+///
+/// The frontend may request the policy, but it does not own the assertion:
+/// queue permits are the source of truth for whether a transfer is actually
+/// active. Keeping the two assertions separate also means display sleep can
+/// be opted into without changing the system-sleep policy.
+struct PowerState {
+    runtime_enabled: AtomicBool,
+    prevent_system_sleep: AtomicBool,
+    prevent_display_sleep: AtomicBool,
+    active_transfers: AtomicUsize,
+}
+
+enum PowerCommand {
+    Reconcile(Option<Sender<Result<(), String>>>),
+}
+
+struct PowerWorker {
+    sender: Option<Sender<PowerCommand>>,
+    join_handle: Option<JoinHandle<()>>,
+}
+
+impl PowerWorker {
+    fn start(state: Arc<PowerState>) -> Result<Self, String> {
+        let (sender, receiver) = mpsc::channel();
+        let join_handle = thread::Builder::new()
+            .name("firelink-power".to_string())
+            .spawn(move || run_power_worker(state, receiver))
+            .map_err(|error| format!("failed to start power-management worker: {error}"))?;
+        Ok(Self {
+            sender: Some(sender),
+            join_handle: Some(join_handle),
+        })
+    }
+
+    fn send(&self, command: PowerCommand) -> Result<(), String> {
+        self.sender
+            .as_ref()
+            .ok_or_else(|| "power-management worker is stopping".to_string())?
+            .send(command)
+            .map_err(|_| "power-management worker stopped unexpectedly".to_string())
+    }
+}
+
+impl Drop for PowerWorker {
+    fn drop(&mut self) {
+        // Closing the sender lets the worker drop its OS assertions on the
+        // same thread that created them. This matters on Windows, where
+        // SetThreadExecutionState is thread-local, and avoids calling the
+        // Linux keepawake D-Bus destructor from an arbitrary queue thread.
+        self.sender.take();
+        if let Some(join_handle) = self.join_handle.take() {
+            let _ = join_handle.join();
+        }
+    }
+}
+
+pub struct PowerManager {
+    state: Arc<PowerState>,
+    worker: Mutex<Option<PowerWorker>>,
+}
+
+impl PowerManager {
+    pub fn new() -> Arc<Self> {
+        Arc::new(Self {
+            state: Arc::new(PowerState {
+                runtime_enabled: AtomicBool::new(false),
+                prevent_system_sleep: AtomicBool::new(true),
+                prevent_display_sleep: AtomicBool::new(false),
+                active_transfers: AtomicUsize::new(0),
+            }),
+            worker: Mutex::new(None),
+        })
+    }
+
+    /// Enables OS integration after AppState has been registered. This keeps
+    /// QueueManager tests and pre-window startup work from creating real
+    /// assertions in the test process or during partial initialization.
+    pub fn activate(&self) -> Result<(), String> {
+        self.state.runtime_enabled.store(true, Ordering::Release);
+        self.reconcile()
+    }
+
+    pub fn set_preferences(
+        &self,
+        prevent_system_sleep: bool,
+        prevent_display_sleep: bool,
+    ) -> Result<(), String> {
+        self.state
+            .prevent_system_sleep
+            .store(prevent_system_sleep, Ordering::Release);
+        self.state
+            .prevent_display_sleep
+            .store(prevent_display_sleep, Ordering::Release);
+        self.reconcile()
+    }
+
+    pub fn set_system_prevention(&self, enabled: bool) -> Result<(), String> {
+        self.state
+            .prevent_system_sleep
+            .store(enabled, Ordering::Release);
+        self.reconcile()
+    }
+
+    pub fn set_display_prevention(&self, enabled: bool) -> Result<(), String> {
+        self.state
+            .prevent_display_sleep
+            .store(enabled, Ordering::Release);
+        self.reconcile()
+    }
+
+    pub fn set_active_transfer_count(self: &Arc<Self>, count: usize) {
+        self.state.active_transfers.store(count, Ordering::Release);
+        if self.state.runtime_enabled.load(Ordering::Acquire) {
+            if let Err(error) = self.enqueue_reconcile() {
+                log::error!(
+                    "power: failed to schedule assertion reconciliation for {count} active transfer(s): {error}"
+                );
+            }
+        }
+    }
+
+    pub fn active_transfer_count(&self) -> usize {
+        self.state.active_transfers.load(Ordering::Acquire)
+    }
+
+    fn reconcile(&self) -> Result<(), String> {
+        if !self.state.runtime_enabled.load(Ordering::Acquire) {
+            return Ok(());
+        }
+
+        self.ensure_worker()?;
+        let (response_sender, response_receiver) = mpsc::channel();
+        if let Err(error) = self.send_command(PowerCommand::Reconcile(Some(response_sender))) {
+            self.restart_worker();
+            return Err(error);
+        }
+        match response_receiver.recv() {
+            Ok(result) => result,
+            Err(_) => {
+                self.restart_worker();
+                Err("power-management worker stopped before reporting reconciliation".to_string())
+            }
+        }
+    }
+
+    fn enqueue_reconcile(&self) -> Result<(), String> {
+        self.ensure_worker()?;
+        if let Err(error) = self.send_command(PowerCommand::Reconcile(None)) {
+            self.restart_worker();
+            return Err(error);
+        }
+        Ok(())
+    }
+
+    fn ensure_worker(&self) -> Result<(), String> {
+        let mut worker = self
+            .worker
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        if worker.is_none() {
+            *worker = Some(PowerWorker::start(Arc::clone(&self.state))?);
+        }
+        Ok(())
+    }
+
+    fn send_command(&self, command: PowerCommand) -> Result<(), String> {
+        let worker = self
+            .worker
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        worker
+            .as_ref()
+            .ok_or_else(|| "power-management worker is not running".to_string())?
+            .send(command)
+    }
+
+    fn restart_worker(&self) {
+        let mut worker = self
+            .worker
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        worker.take();
+    }
+}
+
+struct OsPowerAssertions {
+    #[cfg(windows)]
+    assertion: Option<keepawake::KeepAwake>,
+    #[cfg(not(windows))]
+    system: Option<keepawake::KeepAwake>,
+    #[cfg(not(windows))]
+    display: Option<keepawake::KeepAwake>,
+    system_enabled: bool,
+    display_enabled: bool,
+}
+
+impl OsPowerAssertions {
+    fn reconcile(&mut self, state: &PowerState) -> Result<(), String> {
+        let active = state.active_transfers.load(Ordering::Acquire);
+        let desired_system = active > 0 && state.prevent_system_sleep.load(Ordering::Acquire);
+        let desired_display = active > 0 && state.prevent_display_sleep.load(Ordering::Acquire);
+
+        #[cfg(windows)]
+        {
+            return self.reconcile_combined(desired_system, desired_display, active);
+        }
+        #[cfg(not(windows))]
+        self.reconcile_independent(desired_system, desired_display, active)
+    }
+
+    #[cfg(windows)]
+    fn reconcile_combined(
+        &mut self,
+        desired_system: bool,
+        desired_display: bool,
+        active: usize,
+    ) -> Result<(), String> {
+        if self.system_enabled == desired_system && self.display_enabled == desired_display {
+            return Ok(());
+        }
+
+        if let Some(assertion) = self.assertion.take() {
+            drop_assertion(assertion, "combined");
+            if self.system_enabled {
+                log::info!("power: system-sleep prevention released");
+            }
+            if self.display_enabled {
+                log::info!("power: display-sleep prevention released");
+            }
+            self.system_enabled = false;
+            self.display_enabled = false;
+        }
+
+        if desired_system || desired_display {
+            let assertion = create_assertion(|| {
+                keepawake::Builder::default()
+                    .display(desired_display)
+                    .idle(desired_system)
+                    .sleep(desired_system)
+                    .reason(ASSERTION_REASON)
+                    .create()
+            })
+            .map_err(|error| format!("failed to apply power prevention: {error}"))?;
+            self.assertion = Some(assertion);
+            self.system_enabled = desired_system;
+            self.display_enabled = desired_display;
+            if desired_system {
+                log::info!(
+                    "power: system-sleep prevention enabled for {active} active transfer(s)"
+                );
+            }
+            if desired_display {
+                log::info!(
+                    "power: display-sleep prevention enabled for {active} active transfer(s)"
+                );
+            }
+        }
+        Ok(())
+    }
+
+    #[cfg(not(windows))]
+    fn reconcile_independent(
+        &mut self,
+        desired_system: bool,
+        desired_display: bool,
+        active: usize,
+    ) -> Result<(), String> {
+        let mut first_error = None;
+        if desired_system {
+            if self.system.is_none() {
+                match create_assertion(|| {
+                    keepawake::Builder::default()
+                        .idle(true)
+                        .sleep(true)
+                        .reason(ASSERTION_REASON)
+                        .create()
+                }) {
+                    Ok(assertion) => {
+                        self.system = Some(assertion);
+                        self.system_enabled = true;
+                        log::info!(
+                            "power: system-sleep prevention enabled for {active} active transfer(s)"
+                        );
+                    }
+                    Err(error) => {
+                        first_error = Some(format!("failed to prevent system sleep: {error}"))
+                    }
+                }
+            }
+        } else if let Some(assertion) = self.system.take() {
+            drop_assertion(assertion, "system-sleep");
+            self.system_enabled = false;
+            log::info!("power: system-sleep prevention released");
+        }
+
+        if desired_display {
+            if self.display.is_none() {
+                match create_assertion(|| {
+                    keepawake::Builder::default()
+                        .display(true)
+                        .reason(ASSERTION_REASON)
+                        .create()
+                }) {
+                    Ok(assertion) => {
+                        self.display = Some(assertion);
+                        self.display_enabled = true;
+                        log::info!(
+                            "power: display-sleep prevention enabled for {active} active transfer(s)"
+                        );
+                    }
+                    Err(error) => {
+                        let display_error = format!("failed to prevent display sleep: {error}");
+                        if first_error.is_none() {
+                            first_error = Some(display_error);
+                        } else {
+                            log::error!("power: {display_error}");
+                        }
+                    }
+                }
+            }
+        } else if let Some(assertion) = self.display.take() {
+            drop_assertion(assertion, "display-sleep");
+            self.display_enabled = false;
+            log::info!("power: display-sleep prevention released");
+        }
+
+        first_error.map_or(Ok(()), Err)
+    }
+}
+
+fn create_assertion(
+    create: impl FnOnce() -> keepawake::Result<keepawake::KeepAwake>,
+) -> Result<keepawake::KeepAwake, String> {
+    std::panic::catch_unwind(std::panic::AssertUnwindSafe(create))
+        .map_err(|_| "keepawake assertion creation panicked".to_string())?
+        .map_err(|error| error.to_string())
+}
+
+fn drop_assertion(assertion: keepawake::KeepAwake, kind: &str) {
+    if std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| drop(assertion))).is_err() {
+        log::error!("power: keepawake {kind} assertion cleanup panicked");
+    }
+}
+
+fn run_power_worker(state: Arc<PowerState>, receiver: Receiver<PowerCommand>) {
+    let mut assertions = OsPowerAssertions {
+        #[cfg(windows)]
+        assertion: None,
+        #[cfg(not(windows))]
+        system: None,
+        #[cfg(not(windows))]
+        display: None,
+        system_enabled: false,
+        display_enabled: false,
+    };
+    while let Ok(PowerCommand::Reconcile(response)) = receiver.recv() {
+        let result = assertions.reconcile(&state);
+        if let Some(response) = response {
+            let _ = response.send(result);
+        } else if let Err(error) = result {
+            let active = state.active_transfers.load(Ordering::Acquire);
+            log::error!(
+                "power: failed to reconcile assertions for {active} active transfer(s): {error}"
+            );
+        }
+    }
+    #[cfg(windows)]
+    if let Some(assertion) = assertions.assertion.take() {
+        drop_assertion(assertion, "combined");
+    }
+    #[cfg(not(windows))]
+    {
+        if let Some(assertion) = assertions.display.take() {
+            drop_assertion(assertion, "display-sleep");
+        }
+        if let Some(assertion) = assertions.system.take() {
+            drop_assertion(assertion, "system-sleep");
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::PowerManager;
+
+    #[test]
+    fn tracks_transfer_activity_before_runtime_activation() {
+        let manager = PowerManager::new();
+        manager.set_active_transfer_count(2);
+        assert_eq!(manager.active_transfer_count(), 2);
+
+        manager.set_active_transfer_count(0);
+        assert_eq!(manager.active_transfer_count(), 0);
+    }
+
+    #[test]
+    fn preference_changes_are_safe_before_runtime_activation() {
+        let manager = PowerManager::new();
+        assert!(manager.set_preferences(false, true).is_ok());
+        assert!(manager.set_system_prevention(true).is_ok());
+        assert!(manager.set_display_prevention(false).is_ok());
+    }
+
+    #[test]
+    fn runtime_worker_can_activate_without_active_transfers() {
+        let manager = PowerManager::new();
+        assert!(manager.activate().is_ok());
+        manager.set_active_transfer_count(0);
+        assert_eq!(manager.active_transfer_count(), 0);
+    }
+}

src-tauri/src/retry.rs

@@ -76,13 +76,14 @@ pub fn backoff_for(strike: usize) -> Duration {
 /// that also mentions "timeout" in a URL) still fails fast.
 pub fn is_permanent_network_error(message: &str) -> bool {
     let m = message.to_ascii_lowercase();
-    const PERMANENT: [&str; 9] = [
-        "http 401",
-        "http 403",
-        "http 404",
-        "http 404.",
-        "http 410",
-        "http 451",
+    const PERMANENT_HTTP_STATUS: [&str; 5] = ["401", "403", "404", "410", "451"];
+    if PERMANENT_HTTP_STATUS
+        .iter()
+        .any(|status| contains_http_status(&m, status))
+    {
+        return true;
+    }
+    const PERMANENT: [&str; 3] = [
         "404 not found",
         "permission denied",
         "no space left on device",
@@ -90,6 +91,32 @@ pub fn is_permanent_network_error(message: &str) -> bool {
     PERMANENT.iter().any(|p| m.contains(p))
 }
 
+/// Match the HTTP status formats emitted by both clients, including
+/// `HTTP/1.1 403` and `HTTP Error 403`, not only the shorthand `HTTP 403`.
+fn contains_http_status(message: &str, status: &str) -> bool {
+    let tokens = message
+        .split(|character: char| {
+            character.is_ascii_whitespace()
+                || matches!(character, '/' | '.' | ':' | '-' | '_')
+        })
+        .filter(|token| !token.is_empty())
+        .collect::<Vec<_>>();
+
+    tokens.windows(2).any(|window| window[0] == "http" && window[1] == status)
+        || tokens.windows(3).any(|window| {
+            window[0] == "http"
+                && (window[1] == "error"
+                    || window[1].chars().all(|character| character.is_ascii_digit()))
+                && window[2] == status
+        })
+        || tokens.windows(4).any(|window| {
+            window[0] == "http"
+                && window[1].chars().all(|character| character.is_ascii_digit())
+                && window[2].chars().all(|character| character.is_ascii_digit())
+                && window[3] == status
+        })
+}
+
 pub fn is_transient_network_error(message: &str) -> bool {
     if is_permanent_network_error(message) {
         return false;
@@ -97,7 +124,7 @@ pub fn is_transient_network_error(message: &str) -> bool {
 
     let m = message.to_ascii_lowercase();
 
-    const TRANSIENT: [&str; 35] = [
+    const TRANSIENT: [&str; 34] = [
         // socket-layer / HTTP-client phrasing surfaced by aria2 and yt-dlp
         "timed out",
         "timeout",
@@ -113,13 +140,12 @@ pub fn is_transient_network_error(message: &str) -> bool {
         "connection aborted",
         "error sending request", // reqwest wrapper for connect/send failures
         "dns error",             // transient resolver failures
+        "protocol error",        // aria2 read/protocol failures after a link drop
+        "tls handshake failure",
+        "ssl/tls handshake failure",
         // HTTP-level transient
-        "http 408",
         "request timeout",
-        "http 503",
         "503 service unavailable",
-        "http 429",
-        "http error 429",
         "429 too many requests",
         // aria2c HTTP error formats
         "status=408",
@@ -138,7 +164,10 @@ pub fn is_transient_network_error(message: &str) -> bool {
         "timeout.",
         "invalid range header",
     ];
-    TRANSIENT.iter().any(|t| m.contains(t))
+    contains_http_status(&m, "408")
+        || contains_http_status(&m, "429")
+        || contains_http_status(&m, "503")
+        || TRANSIENT.iter().any(|t| m.contains(t))
 }
 
 /// Outcome of a cancel-safe backoff sleep wrapped around a transient retry.
@@ -249,6 +278,7 @@ mod tests {
     #[test]
     fn classifies_http_503_as_transient() {
         assert!(is_transient_network_error("HTTP 503 Service Unavailable"));
+        assert!(is_transient_network_error("HTTP/1.1 503 Service Unavailable"));
         assert!(is_transient_network_error(
             "http://127.0.0.1/file returned HTTP 503 Service Unavailable"
         ));
@@ -275,6 +305,12 @@ mod tests {
         assert!(is_transient_network_error("The response status is not successful. status=503"));
         assert!(is_transient_network_error("The response status is not successful. status=502"));
         assert!(is_transient_network_error("Invalid range header. Request: 106954752-361758719/383882118, Response: 106954752-383882117/383882118"));
+        assert!(is_transient_network_error(
+            "aria2 error code 1: Failed to receive data, cause: protocol error"
+        ));
+        assert!(is_transient_network_error(
+            "SSL/TLS handshake failure: protocol error"
+        ));
     }
 
     // --- transient classification: negative cases -------------------------
@@ -282,6 +318,8 @@ mod tests {
     #[test]
     fn refuses_to_retry_permanent_http_statuses() {
         assert!(!is_transient_network_error("HTTP 404 Not Found"));
+        assert!(!is_transient_network_error("HTTP/1.1 403 Forbidden"));
+        assert!(!is_transient_network_error("HTTP Error 404: Not Found"));
         assert!(!is_transient_network_error("HTTP 403 Forbidden"));
         assert!(!is_transient_network_error("HTTP 410 Gone"));
         assert!(!is_transient_network_error("HTTP 401 Unauthorized"));

src-tauri/src/scheduler.rs

@@ -26,6 +26,39 @@ fn stop_is_due(
         && last_stop_key != stop_key
 }
 
+struct OvernightStopCheck<'a> {
+    stop_time_enabled: bool,
+    start_minute: Option<u32>,
+    stop_minute: Option<u32>,
+    current_minute: u32,
+    previous_day_allowed: bool,
+    last_start_key: &'a str,
+    previous_start_key: &'a str,
+    last_stop_key: &'a str,
+    stop_key: &'a str,
+}
+
+fn overnight_stop_is_due(check: OvernightStopCheck<'_>) -> bool {
+    let OvernightStopCheck {
+        stop_time_enabled,
+        start_minute,
+        stop_minute,
+        current_minute,
+        previous_day_allowed,
+        last_start_key,
+        previous_start_key,
+        last_stop_key,
+        stop_key,
+    } = check;
+    stop_time_enabled
+        && previous_day_allowed
+        && start_minute.zip(stop_minute).is_some_and(|(start, stop)| {
+            stop < start && current_minute >= stop && current_minute < start
+        })
+        && last_start_key == previous_start_key
+        && last_stop_key != stop_key
+}
+
 pub fn spawn_scheduler(
     app_handle: tauri::AppHandle,
     settings_cache: Arc<RwLock<Option<crate::ipc::PersistedSettings>>>,
@@ -56,20 +89,20 @@ pub fn spawn_scheduler(
 
                 let allowed_today =
                     scheduler.everyday || scheduler.selected_days.contains(&current_day);
-                if !allowed_today {
-                    continue;
-                }
-
                 let date_key = now.format("%Y-%m-%d").to_string();
                 let start_key = format!("{date_key}-start");
                 let stop_key = format!("{date_key}-stop");
                 let start_minute = minute_of_day(&scheduler.start_time);
                 let stop_minute = minute_of_day(&scheduler.stop_time);
+                let overnight = start_minute
+                    .zip(stop_minute)
+                    .is_some_and(|(start, stop)| stop < start);
                 let before_stop = !scheduler.stop_time_enabled
                     || stop_minute.is_some_and(|stop| current_minute < stop);
 
-                if start_minute.is_some_and(|start| current_minute >= start)
-                    && before_stop
+                if allowed_today
+                    && start_minute.is_some_and(|start| current_minute >= start)
+                    && (overnight || before_stop)
                     && scheduler_last_start_key != start_key
                     && last_emit
                         .get("start")
@@ -85,17 +118,43 @@ pub fn spawn_scheduler(
                     last_emit.insert("start", std::time::Instant::now());
                 }
 
-                if stop_is_due(
-                    scheduler.stop_time_enabled,
+                let same_day_stop_due = allowed_today
+                    && !overnight
+                    && stop_is_due(
+                        scheduler.stop_time_enabled,
+                        stop_minute,
+                        current_minute,
+                        &scheduler_last_start_key,
+                        &start_key,
+                        &scheduler_last_stop_key,
+                        &stop_key,
+                    );
+                let previous_day = now.date_naive().pred_opt();
+                let previous_day_allowed = previous_day.is_some_and(|day| {
+                    scheduler.everyday
+                        || scheduler
+                            .selected_days
+                            .contains(&day.weekday().num_days_from_sunday())
+                });
+                let previous_start_key = previous_day
+                    .map(|day| format!("{}-start", day.format("%Y-%m-%d")))
+                    .unwrap_or_default();
+                let overnight_stop_due = overnight_stop_is_due(OvernightStopCheck {
+                    stop_time_enabled: scheduler.stop_time_enabled,
+                    start_minute,
                     stop_minute,
                     current_minute,
-                    &scheduler_last_start_key,
-                    &start_key,
-                    &scheduler_last_stop_key,
-                    &stop_key,
-                ) && last_emit
-                    .get("stop")
-                    .is_none_or(|instant| instant.elapsed() >= Duration::from_secs(5))
+                    previous_day_allowed,
+                    last_start_key: &scheduler_last_start_key,
+                    previous_start_key: &previous_start_key,
+                    last_stop_key: &scheduler_last_stop_key,
+                    stop_key: &stop_key,
+                });
+
+                if (same_day_stop_due || overnight_stop_due)
+                    && last_emit
+                        .get("stop")
+                        .is_none_or(|instant| instant.elapsed() >= Duration::from_secs(5))
                 {
                     let _ = app_handle.emit(
                         "schedule-trigger",
@@ -113,7 +172,7 @@ pub fn spawn_scheduler(
 
 #[cfg(test)]
 mod tests {
-    use super::{minute_of_day, stop_is_due};
+    use super::{minute_of_day, overnight_stop_is_due, stop_is_due, OvernightStopCheck};
 
     #[test]
     fn parses_valid_scheduler_times() {
@@ -150,4 +209,41 @@ mod tests {
             "2026-06-22-stop",
         ));
     }
+
+    #[test]
+    fn overnight_stop_uses_the_previous_day_start() {
+        assert!(overnight_stop_is_due(OvernightStopCheck {
+            stop_time_enabled: true,
+            start_minute: Some(1320),
+            stop_minute: Some(360),
+            current_minute: 420,
+            previous_day_allowed: true,
+            last_start_key: "2026-06-22-start",
+            previous_start_key: "2026-06-22-start",
+            last_stop_key: "",
+            stop_key: "2026-06-23-stop",
+        }));
+        assert!(!overnight_stop_is_due(OvernightStopCheck {
+            stop_time_enabled: true,
+            start_minute: Some(1320),
+            stop_minute: Some(360),
+            current_minute: 1380,
+            previous_day_allowed: true,
+            last_start_key: "2026-06-22-start",
+            previous_start_key: "2026-06-22-start",
+            last_stop_key: "",
+            stop_key: "2026-06-22-stop",
+        }));
+        assert!(!overnight_stop_is_due(OvernightStopCheck {
+            stop_time_enabled: true,
+            start_minute: Some(1320),
+            stop_minute: Some(360),
+            current_minute: 420,
+            previous_day_allowed: false,
+            last_start_key: "2026-06-22-start",
+            previous_start_key: "2026-06-22-start",
+            last_stop_key: "",
+            stop_key: "2026-06-23-stop",
+        }));
+    }
 }

src-tauri/src/settings.rs

@@ -1,6 +1,7 @@
 use crate::ipc::{
-    AppFontSize, ListRowDensity, MediaCookieSource, PersistedSettings, PostQueueAction, ProxyMode,
-    SchedulerSettings, SettingsTab, Theme,
+    AppFontSize, CalendarPreference, FontFamily, ListRowDensity, MediaCookieSource,
+    PersistedSettings, PostQueueAction, ProxyMode, SchedulerSettings, SettingsTab, Theme,
+    WindowControlStyle,
 };
 use serde_json::{Map, Value};
 use std::collections::HashMap;
@@ -20,6 +21,7 @@ pub fn decode_stored_settings(stored: &Value) -> Result<PersistedSettings, Strin
     let document = decode_document(stored)?;
     let mut state = settings_state(&document)?.clone();
     migrate_location_settings(&mut state)?;
+    sanitize_persisted_setting_values(&mut state);
     let mut merged = serde_json::to_value(default_settings())
         .map_err(|error| format!("failed to serialize settings defaults: {error}"))?;
     merge_json(&mut merged, &state);
@@ -77,6 +79,41 @@ pub fn preserve_scheduler_runtime_keys(
         .map_err(|error| format!("failed to encode persisted settings: {error}"))
 }
 
+pub fn preserve_portable_pairing_token(
+    existing: Option<&str>,
+    incoming: &str,
+) -> Result<String, String> {
+    let Some(existing) = existing else {
+        return Ok(incoming.to_string());
+    };
+
+    let existing_document = decode_document(&Value::String(existing.to_string()))?;
+    let existing_state = settings_state(&existing_document)?;
+    let Some(token) = existing_state
+        .get("extensionPairingToken")
+        .and_then(Value::as_str)
+        .filter(|value| !value.trim().is_empty())
+    else {
+        return Ok(incoming.to_string());
+    };
+
+    let mut incoming_document = decode_document(&Value::String(incoming.to_string()))?;
+    let incoming_state = settings_state_mut(&mut incoming_document)?;
+    let incoming_token_present = incoming_state
+        .get("extensionPairingToken")
+        .and_then(Value::as_str)
+        .is_some_and(|value| !value.trim().is_empty());
+    if !incoming_token_present {
+        incoming_state.insert(
+            "extensionPairingToken".to_string(),
+            Value::String(token.to_string()),
+        );
+    }
+
+    serde_json::to_string(&incoming_document)
+        .map_err(|error| format!("failed to encode portable settings: {error}"))
+}
+
 fn decode_document(stored: &Value) -> Result<Value, String> {
     match stored {
         Value::String(text) => serde_json::from_str(text)
@@ -118,13 +155,135 @@ fn merge_json(target: &mut Value, source: &Value) {
         (Value::Object(target), Value::Object(source)) => {
             for (key, value) in source {
                 if let Some(target_value) = target.get_mut(key) {
-                    merge_json(target_value, value);
+                    if json_value_types_match(target_value, value) {
+                        merge_json(target_value, value);
+                    }
                 } else {
                     target.insert(key.clone(), value.clone());
                 }
             }
         }
-        (target, source) => *target = source.clone(),
+        (target, source) if json_value_types_match(target, source) => *target = source.clone(),
+        _ => {}
+    }
+}
+
+fn json_value_types_match(left: &Value, right: &Value) -> bool {
+    matches!(
+        (left, right),
+        (Value::Null, Value::Null)
+            | (Value::Bool(_), Value::Bool(_))
+            | (Value::Number(_), Value::Number(_))
+            | (Value::String(_), Value::String(_))
+            | (Value::Array(_), Value::Array(_))
+            | (Value::Object(_), Value::Object(_))
+    )
+}
+
+fn sanitize_persisted_setting_values(state: &mut Value) {
+    let Some(state) = state.as_object_mut() else {
+        return;
+    };
+
+    sanitize_integer_setting(state, "maxConcurrentDownloads", |value| value.as_u64().is_some());
+    sanitize_integer_setting(state, "perServerConnections", |value| value.as_i64().is_some());
+    sanitize_integer_setting(state, "maxAutomaticRetries", |value| value.as_i64().is_some());
+    sanitize_allowed_string(
+        state,
+        "theme",
+        &["system", "light", "dark", "dracula", "nord"],
+    );
+    sanitize_allowed_string(
+        state,
+        "fontFamily",
+        &[
+            "system",
+            "inter",
+            "outfit",
+            "vazirmatn",
+            "noto-sans-hebrew",
+            "noto-sans-sc",
+            "roboto",
+            "serif",
+            "monospace",
+        ],
+    );
+    sanitize_allowed_string(
+        state,
+        "windowControlStyle",
+        &["auto", "macos", "windows", "gnome", "minimal"],
+    );
+    sanitize_allowed_string(
+        state,
+        "language",
+        &["system", "en", "zh-CN", "he", "fa", "uk", "ru"],
+    );
+    sanitize_allowed_string(state, "calendarPreference", &["gregorian", "persian", "hebrew"]);
+    sanitize_allowed_string(state, "sidebarPosition", &["auto", "left", "right"]);
+    sanitize_allowed_string(state, "appFontSize", &["small", "standard", "large"]);
+    sanitize_allowed_string(state, "listRowDensity", &["compact", "standard", "relaxed"]);
+    sanitize_allowed_string(state, "activeSettingsTab", &[
+        "downloads",
+        "lookandfeel",
+        "network",
+        "locations",
+        "sitelogins",
+        "power",
+        "engine",
+        "integrations",
+        "about",
+    ]);
+    sanitize_allowed_string(state, "proxyMode", &["none", "system", "custom"]);
+    sanitize_allowed_string(
+        state,
+        "mediaCookieSource",
+        &[
+            "none", "safari", "chrome", "chromium", "firefox", "edge", "brave", "opera",
+            "vivaldi", "whale",
+        ],
+    );
+
+    if let Some(scheduler) = state.get_mut("scheduler").and_then(Value::as_object_mut) {
+        sanitize_allowed_string(
+            scheduler,
+            "postQueueAction",
+            &["none", "sleep", "restart", "shutdown"],
+        );
+    }
+
+    if let Some(logins) = state.get_mut("siteLogins").and_then(Value::as_array_mut) {
+        logins.retain(|login| {
+            let Some(login) = login.as_object() else {
+                return false;
+            };
+            ["id", "urlPattern", "username"]
+                .into_iter()
+                .all(|key| login.get(key).and_then(Value::as_str).is_some())
+        });
+    }
+}
+
+fn sanitize_integer_setting(
+    state: &mut serde_json::Map<String, Value>,
+    key: &str,
+    is_valid: impl Fn(&Value) -> bool,
+) {
+    if state.get(key).is_some_and(|value| !is_valid(value)) {
+        state.remove(key);
+    }
+}
+
+fn sanitize_allowed_string(
+    state: &mut serde_json::Map<String, Value>,
+    key: &str,
+    allowed: &[&str],
+) {
+    let valid = state
+        .get(key)
+        .and_then(Value::as_str)
+        .is_some_and(|value| allowed.contains(&value));
+    if state.contains_key(key) && !valid {
+        state.remove(key);
     }
 }
 
@@ -132,6 +291,15 @@ fn validate_settings(settings: &mut PersistedSettings) {
     if settings.max_concurrent_downloads == 0 {
         settings.max_concurrent_downloads = default_settings().max_concurrent_downloads;
     }
+    settings.max_concurrent_downloads = settings.max_concurrent_downloads.min(12);
+    settings.per_server_connections = settings.per_server_connections.clamp(1, 16);
+    settings.max_automatic_retries = settings.max_automatic_retries.clamp(0, 10);
+    if !matches!(
+        settings.last_custom_speed_limit_unit.as_str(),
+        "KB/s" | "MB/s"
+    ) {
+        settings.last_custom_speed_limit_unit = default_settings().last_custom_speed_limit_unit;
+    }
 }
 
 fn default_category_subfolders() -> HashMap<String, String> {
@@ -270,6 +438,10 @@ fn derived_location_path(base: &str, subfolder: &str) -> String {
 fn default_settings() -> PersistedSettings {
     PersistedSettings {
         theme: Theme::System,
+        font_family: FontFamily::System,
+        window_control_style: WindowControlStyle::Auto,
+        calendar_preference: CalendarPreference::Gregorian,
+        language: "system".to_string(),
         base_download_folder: "~/Downloads".to_string(),
         category_subfolders_enabled: true,
         category_subfolders: default_category_subfolders(),
@@ -280,6 +452,7 @@ fn default_settings() -> PersistedSettings {
         speed_limit_preset_values: vec![1.0, 5.0, 10.0],
         logs_enabled: false,
         is_sidebar_visible: true,
+        sidebar_position: "auto".to_string(),
         active_settings_tab: SettingsTab::Downloads,
         scheduler: SchedulerSettings {
             enabled: false,
@@ -296,10 +469,12 @@ fn default_settings() -> PersistedSettings {
         scheduler_last_start_key: String::new(),
         scheduler_last_stop_key: String::new(),
         last_custom_speed_limit_ki_b: 1024,
+        last_custom_speed_limit_unit: "MB/s".to_string(),
         per_server_connections: 16,
         max_automatic_retries: 3,
         show_notifications: true,
-        play_completion_sound: true,
+        play_completion_sound: false,
+        auto_add_clipboard_links: false,
         app_font_size: AppFontSize::Standard,
         list_row_density: ListRowDensity::Standard,
         show_dock_badge: true,
@@ -309,10 +484,11 @@ fn default_settings() -> PersistedSettings {
         proxy_port: 8080,
         custom_user_agent: String::new(),
         ask_where_to_save_each_file: false,
+        remember_last_used_download_directory: false,
         prevents_sleep_while_downloading: true,
+        prevents_display_sleep_while_downloading: false,
         media_cookie_source: MediaCookieSource::default(),
         site_logins: Vec::new(),
-        extension_pairing_token: String::new(),
         auto_check_updates: true,
         keychain_access_granted: false,
     }
@@ -320,7 +496,11 @@ fn default_settings() -> PersistedSettings {
 
 #[cfg(test)]
 mod tests {
-    use super::{decode_stored_settings, preserve_scheduler_runtime_keys};
+    use crate::ipc::{FontFamily, WindowControlStyle};
+    use super::{
+        decode_stored_settings, default_settings, preserve_portable_pairing_token,
+        preserve_scheduler_runtime_keys,
+    };
     use serde_json::{json, Value};
 
     #[test]
@@ -355,6 +535,7 @@ mod tests {
             "state": {
                 "maxConcurrentDownloads": 7,
                 "globalSpeedLimit": "2M",
+                "sidebarPosition": "right",
                 "scheduler": {
                     "enabled": true,
                     "startTime": "06:30",
@@ -372,6 +553,7 @@ mod tests {
 
         assert_eq!(settings.max_concurrent_downloads, 7);
         assert_eq!(settings.global_speed_limit, "2M");
+        assert_eq!(settings.sidebar_position, "right");
         assert_eq!(settings.speed_limit_preset_values, vec![1.0, 5.0, 10.0]);
         assert!(!settings.logs_enabled);
         assert!(settings.scheduler.enabled);
@@ -396,6 +578,7 @@ mod tests {
 
         assert_eq!(settings.max_concurrent_downloads, 5);
         assert_eq!(settings.global_speed_limit, "512K");
+        assert_eq!(settings.last_custom_speed_limit_unit, "MB/s");
         assert_eq!(settings.speed_limit_preset_values, vec![1.0, 5.0, 10.0]);
         assert!(!settings.logs_enabled);
         assert!(!settings.scheduler.enabled);
@@ -508,13 +691,140 @@ mod tests {
         assert_eq!(settings.max_concurrent_downloads, 3);
     }
 
+    #[test]
+    fn invalid_sidebar_position_uses_automatic_layout() {
+        let stored = json!({
+            "state": {"sidebarPosition": "diagonal"},
+            "version": 5
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert_eq!(settings.sidebar_position, "auto");
+    }
+
+    #[test]
+    fn invalid_font_family_uses_system_font() {
+        let stored = json!({
+            "state": {"fontFamily": "comic-sans"},
+            "version": 5
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert!(matches!(settings.font_family, FontFamily::System));
+    }
+
+    #[test]
+    fn curated_font_families_are_preserved() {
+        for value in ["vazirmatn", "noto-sans-hebrew", "noto-sans-sc", "roboto"] {
+            let stored = json!({
+                "state": {"fontFamily": value},
+                "version": 5
+            });
+
+            let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+            assert_eq!(serde_json::to_value(settings.font_family).unwrap(), json!(value));
+        }
+    }
+
+    #[test]
+    fn invalid_window_control_style_uses_automatic_layout() {
+        let stored = json!({
+            "state": {"windowControlStyle": "neon"},
+            "version": 5
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert!(matches!(
+            settings.window_control_style,
+            WindowControlStyle::Auto
+        ));
+    }
+
+    #[test]
+    fn clamps_out_of_range_download_settings() {
+        let stored = json!({
+            "state": {
+                "maxConcurrentDownloads": 99,
+                "perServerConnections": -4,
+                "maxAutomaticRetries": 99
+            },
+            "version": 3
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert_eq!(settings.max_concurrent_downloads, 12);
+        assert_eq!(settings.per_server_connections, 1);
+        assert_eq!(settings.max_automatic_retries, 10);
+    }
+
+    #[test]
+    fn ignores_malformed_setting_types_without_dropping_valid_values() {
+        let stored = json!({
+            "state": {
+                "baseDownloadFolder": "/Users/test/Downloads",
+                "maxConcurrentDownloads": "not-a-number",
+                "perServerConnections": 5,
+                "showNotifications": "yes",
+                "theme": "not-a-theme",
+                "calendarPreference": "lunar",
+                "siteLogins": [{"id": "valid", "urlPattern": "example.com", "username": "user"}, {"id": 3}]
+            },
+            "version": 3
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert_eq!(settings.base_download_folder, "/Users/test/Downloads");
+        assert_eq!(settings.max_concurrent_downloads, 3);
+        assert_eq!(settings.per_server_connections, 5);
+        assert!(settings.show_notifications);
+        assert!(matches!(settings.theme, crate::ipc::Theme::System));
+        assert!(matches!(
+            settings.calendar_preference,
+            crate::ipc::CalendarPreference::Gregorian
+        ));
+        assert_eq!(settings.site_logins.len(), 1);
+        assert_eq!(settings.site_logins[0].id, "valid");
+    }
+
+    #[test]
+    fn opt_in_defaults_match_the_frontend_defaults() {
+        assert!(!default_settings().play_completion_sound);
+        assert!(!default_settings().auto_add_clipboard_links);
+    }
+
+    #[test]
+    fn does_not_remember_last_used_download_directory_by_default() {
+        assert!(!default_settings().remember_last_used_download_directory);
+    }
+
+    #[test]
+    fn decodes_disabled_last_used_download_directory_setting() {
+        let stored = json!({
+            "state": {
+                "rememberLastUsedDownloadDirectory": false
+            },
+            "version": 3
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert!(!settings.remember_last_used_download_directory);
+    }
+
     #[test]
     fn ignores_legacy_extension_pairing_token_field() {
-        // Older versions persisted `extensionPairingToken` as plaintext inside
-        // the settings document. It now lives in the OS keychain and is no
-        // longer part of PersistedSettings. serde ignores the unknown field so
-        // existing installs decode without error; the plaintext value is
-        // simply dropped and a fresh token is minted by the frontend.
+        // Older standard installs persisted `extensionPairingToken` as
+        // plaintext inside the settings document. It now lives in the OS
+        // keychain and is no longer part of PersistedSettings; portable mode
+        // deliberately keeps its token in the portable settings document.
+        // serde ignores the unknown field so existing installs decode without
+        // error; standard-mode migration drops the plaintext value.
         let stored = json!({
             "state": {
                 "extensionPairingToken": "plaintext-leaked-secret",
@@ -527,4 +837,32 @@ mod tests {
 
         assert_eq!(settings.max_concurrent_downloads, 5);
     }
+
+    #[test]
+    fn preserves_portable_pairing_token_when_startup_save_races() {
+        let existing = json!({
+            "state": {
+                "extensionPairingToken": "portable-token",
+                "maxConcurrentDownloads": 3
+            },
+            "version": 3
+        })
+        .to_string();
+        let incoming = json!({
+            "state": {
+                "extensionPairingToken": "",
+                "maxConcurrentDownloads": 5
+            },
+            "version": 3
+        })
+        .to_string();
+
+        let merged = preserve_portable_pairing_token(Some(&existing), &incoming).unwrap();
+        let document: Value = serde_json::from_str(&merged).unwrap();
+        assert_eq!(
+            document["state"]["extensionPairingToken"],
+            "portable-token"
+        );
+        assert_eq!(document["state"]["maxConcurrentDownloads"], 5);
+    }
 }

src-tauri/src/storage.rs

@@ -0,0 +1,211 @@
+use std::path::{Path, PathBuf};
+use tauri::{AppHandle, Manager, Runtime};
+
+pub const PORTABLE_MARKER: &str = "portable.flag";
+const PORTABLE_DATA_DIR: &str = "data";
+const PORTABLE_LOG_DIR: &str = "logs";
+const PORTABLE_WEBVIEW_DIR: &str = "webview";
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum StorageMode {
+    Standard,
+    Portable { root: PathBuf },
+}
+
+impl StorageMode {
+    pub fn detect() -> Self {
+        let Some(executable) = std::env::current_exe().ok() else {
+            return Self::Standard;
+        };
+        let Some(root) = executable.parent() else {
+            return Self::Standard;
+        };
+
+        if root.join(PORTABLE_MARKER).is_file() {
+            Self::Portable {
+                root: root.to_path_buf(),
+            }
+        } else {
+            Self::Standard
+        }
+    }
+
+    #[cfg(test)]
+    fn detect_from_root(root: &Path) -> Self {
+        if root.join(PORTABLE_MARKER).is_file() {
+            Self::Portable {
+                root: root.to_path_buf(),
+            }
+        } else {
+            Self::Standard
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct StorageLayout {
+    mode: StorageMode,
+    data_dir: PathBuf,
+    log_dir: PathBuf,
+    webview_dir: PathBuf,
+}
+
+impl StorageLayout {
+    pub fn resolve<R: Runtime>(
+        app_handle: &AppHandle<R>,
+        mode: StorageMode,
+    ) -> Result<Self, String> {
+        let (mode, data_dir, log_dir, webview_dir) = match mode {
+            StorageMode::Standard => (
+                StorageMode::Standard,
+                app_handle
+                    .path()
+                    .app_data_dir()
+                    .map_err(|error| format!("failed to resolve app data directory: {error}"))?,
+                app_handle
+                    .path()
+                    .app_log_dir()
+                    .map_err(|error| format!("failed to resolve app log directory: {error}"))?,
+                app_handle.path().app_local_data_dir().map_err(|error| {
+                    format!("failed to resolve app local data directory: {error}")
+                })?,
+            ),
+            StorageMode::Portable { root } => {
+                let data_dir = root.join(PORTABLE_DATA_DIR);
+                (
+                    StorageMode::Portable { root },
+                    data_dir.clone(),
+                    data_dir.join(PORTABLE_LOG_DIR),
+                    data_dir.join(PORTABLE_WEBVIEW_DIR),
+                )
+            }
+        };
+
+        Ok(Self {
+            mode,
+            data_dir: canonicalize_storage_path(&data_dir)?,
+            log_dir: canonicalize_storage_path(&log_dir)?,
+            webview_dir: canonicalize_storage_path(&webview_dir)?,
+        })
+    }
+
+    pub fn is_portable(&self) -> bool {
+        matches!(self.mode, StorageMode::Portable { .. })
+    }
+
+    pub fn data_dir(&self) -> &Path {
+        &self.data_dir
+    }
+
+    pub fn log_dir(&self) -> &Path {
+        &self.log_dir
+    }
+
+    pub fn webview_dir(&self) -> &Path {
+        &self.webview_dir
+    }
+}
+
+fn canonicalize_storage_path(path: &Path) -> Result<PathBuf, String> {
+    if crate::path_has_symlink_component(path) {
+        return Err(format!(
+            "storage path contains a symlinked component: '{}'",
+            path.display()
+        ));
+    }
+    let mut existing = path;
+    let mut missing = Vec::new();
+    loop {
+        match std::fs::symlink_metadata(existing) {
+            Ok(metadata) => {
+                if metadata.file_type().is_symlink() {
+                    return Err(format!(
+                        "storage path contains a symlinked directory: '{}'",
+                        path.display()
+                    ));
+                }
+                break;
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => {
+                return Err(format!(
+                    "failed to inspect storage path '{}': {error}",
+                    path.display()
+                ));
+            }
+        }
+        missing.push(
+            existing
+                .file_name()
+                .ok_or_else(|| format!("storage path has no existing ancestor: '{}'", path.display()))?
+                .to_owned(),
+        );
+        existing = existing
+            .parent()
+            .ok_or_else(|| format!("storage path has no existing ancestor: '{}'", path.display()))?;
+    }
+    let mut canonical = std::fs::canonicalize(existing)
+        .map_err(|error| format!("failed to canonicalize storage path '{}': {error}", path.display()))?;
+    for component in missing.iter().rev() {
+        canonical.push(component);
+    }
+    Ok(canonical)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{canonicalize_storage_path, StorageMode, PORTABLE_MARKER};
+    use std::fs;
+    use std::path::Path;
+    use tempfile::TempDir;
+
+    #[test]
+    fn marker_selects_portable_mode() {
+        let root = TempDir::new().unwrap();
+        fs::write(root.path().join(PORTABLE_MARKER), b"portable\n").unwrap();
+
+        assert_eq!(
+            StorageMode::detect_from_root(root.path()),
+            StorageMode::Portable {
+                root: root.path().to_path_buf()
+            }
+        );
+    }
+
+    #[test]
+    fn missing_marker_keeps_standard_mode() {
+        let root = TempDir::new().unwrap();
+
+        assert_eq!(
+            StorageMode::detect_from_root(root.path()),
+            StorageMode::Standard
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn rejects_symlinked_storage_directories() {
+        use std::os::unix::fs::symlink;
+
+        let root = TempDir::new().unwrap();
+        let target = TempDir::new().unwrap();
+        let root_path = fs::canonicalize(root.path()).unwrap();
+        let redirected = root_path.join("logs");
+        symlink(target.path(), &redirected).unwrap();
+
+        assert!(canonicalize_storage_path(Path::new(&redirected)).is_err());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn rejects_dangling_symlinked_storage_directories() {
+        use std::os::unix::fs::symlink;
+
+        let root = TempDir::new().unwrap();
+        let root_path = fs::canonicalize(root.path()).unwrap();
+        let redirected = root_path.join("logs");
+        symlink(root_path.join("missing-target"), &redirected).unwrap();
+
+        assert!(canonicalize_storage_path(Path::new(&redirected)).is_err());
+    }
+}

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Firelink",
-  "version": "1.0.4",
+  "version": "1.4.0",
   "identifier": "com.nimbold.firelink",
   "build": {
     "beforeDevCommand": "node scripts/stage-engines.js && npm run dev",
@@ -13,6 +13,7 @@
     "macOSPrivateApi": true,
     "windows": [
       {
+        "create": false,
         "title": "Firelink",
         "width": 1280,
         "height": 760,
@@ -22,7 +23,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; img-src 'self' data: https:; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws://localhost:* http://localhost:* http://127.0.0.1:* ws://127.0.0.1:*"
+      "csp": "default-src 'self'; img-src 'self' data: https:; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self' ws://localhost:* http://localhost:* http://127.0.0.1:* ws://127.0.0.1:*"
     }
   },
   "bundle": {

src-tauri/tauri.linux.conf.json

@@ -2,13 +2,14 @@
   "app": {
     "windows": [
       {
+        "create": false,
         "title": "Firelink",
         "width": 1280,
         "height": 760,
         "minWidth": 960,
         "minHeight": 640,
         "transparent": false,
-        "decorations": true
+        "decorations": false
       }
     ]
   },

src-tauri/tauri.macos.conf.json

@@ -2,22 +2,15 @@
   "app": {
     "windows": [
       {
+        "create": false,
         "title": "Firelink",
         "width": 1280,
         "height": 760,
         "minWidth": 960,
         "minHeight": 640,
-        "titleBarStyle": "Overlay",
-        "trafficLightPosition": {
-          "x": 17,
-          "y": 28
-        },
-        "hiddenTitle": true,
         "transparent": true,
-        "windowEffects": {
-          "effects": ["sidebar"],
-          "state": "active"
-        }
+        "decorations": false,
+        "shadow": false
       }
     ]
   },

src-tauri/tauri.windows.conf.json

@@ -2,16 +2,15 @@
   "app": {
     "windows": [
       {
+        "create": false,
         "title": "Firelink",
         "width": 1280,
         "height": 760,
         "minWidth": 960,
         "minHeight": 640,
         "transparent": true,
-        "windowEffects": {
-          "effects": ["mica"],
-          "state": "active"
-        }
+        "decorations": false,
+        "shadow": false
       }
     ]
   },