test(startup): compare v1.3.1 source (#37)

- Issue #37: compare the pre-1.4.0 application source with the current packaged-app stability workflow.\n- Keep the current workflow and 5-second delayed-crash check so the Windows result is comparable.\n\nRefs #37.

.github/workflows/ci.yml

@@ -27,6 +27,7 @@ jobs:
 
   desktop:
     name: Desktop checks (${{ matrix.target }})
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -52,8 +53,28 @@ jobs:
       - name: Install Linux dependencies
         if: runner.os == 'Linux'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
+          # The hosted Ubuntu image can expose an unreachable Azure mirror in
+          # its apt sources while the public Ubuntu archive is reachable.
+          # Normalize every apt source, including the image's mirror list,
+          # before refreshing indexes so a transient runner-local mirror does
+          # not consume the whole job timeout.
+          sudo find /etc/apt -type f \
+            -exec sed -i \
+              -e 's#http://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              -e 's#https://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              {} +
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            update
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            install -y --no-install-recommends \
             libwebkit2gtk-4.1-dev \
             libappindicator3-dev \
             librsvg2-dev \
@@ -65,12 +86,34 @@ jobs:
         if: runner.os != 'Windows'
         working-directory: src-tauri
         run: cargo test --all-targets --target ${{ matrix.target }}
-      - name: Test Rust backend
+      - name: Test Windows Torrent RPC integration
         if: runner.os == 'Windows'
         working-directory: src-tauri
-        run: |
-          cargo test --tests --target ${{ matrix.target }}
-          cargo test --lib --no-run --target ${{ matrix.target }}
+        run: cargo test --test torrent_rpc --target ${{ matrix.target }} -- --nocapture
+      - name: Compile Windows queue-manager integration
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test queue_manager --no-run --target ${{ matrix.target }}
+      - name: Compile Windows Rust library tests
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --lib --no-run --target ${{ matrix.target }}
+      - name: Run Windows headless production contracts
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test production_contract --target ${{ matrix.target }} -- --nocapture
+      - name: Verify Windows atomic Torrent storage
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test atomic_file --target ${{ matrix.target }} -- --nocapture
+      - name: Verify Windows Torrent cache safety
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test torrent_cache --target ${{ matrix.target }} -- --nocapture
+      - name: Verify Windows Torrent web-seed normalization
+        if: runner.os == 'Windows'
+        working-directory: src-tauri
+        run: cargo test --test torrent_web_seed --target ${{ matrix.target }} -- --nocapture
       - name: Provision locked engines
         if: runner.os != 'macOS'
         run: node scripts/provision-engines.js --target ${{ matrix.target }}
@@ -78,3 +121,9 @@ jobs:
         run: |
           node scripts/stage-engines.js --target ${{ matrix.target }}
           node scripts/verify-binaries.js --staged --target ${{ matrix.target }}
+      - name: Run Torrent process smoke
+        run: node scripts/smoke-torrent.js --binary src-tauri/engine-dist/${{ matrix.target }}/aria2c-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }} --failure-paths
+      - name: Run Aria2 resolver smoke
+        run: node scripts/smoke-aria2-resolver.js --binary src-tauri/engine-dist/${{ matrix.target }}/aria2c-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
+      - name: Run Aria2 normal-transfer smoke
+        run: node scripts/smoke-aria2-transfers.js --binary src-tauri/engine-dist/${{ matrix.target }}/aria2c-${{ matrix.target }}${{ runner.os == 'Windows' && '.exe' || '' }}

.github/workflows/release.yml

@@ -40,18 +40,50 @@ jobs:
       - uses: actions/checkout@v7
         with:
           submodules: recursive
+          fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
+      - name: Verify tagged release version
+        if: github.event_name == 'push' || inputs.publish_release
+        run: node scripts/verify-release-version.js
+      - name: Verify non-publishing package version
+        if: github.event_name == 'workflow_dispatch' && !inputs.publish_release
+        run: node scripts/verify-release-version.js --allow-untagged
+      - name: Verify tagged Companion release identity
+        if: github.event_name == 'push' || inputs.publish_release
+        run: node scripts/verify-companion-release.js
+      - name: Verify non-publishing Companion package metadata
+        if: github.event_name == 'workflow_dispatch' && !inputs.publish_release
+        run: node scripts/verify-companion-release.js --allow-untagged
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
       - name: Install Linux dependencies
         if: runner.os == 'Linux'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
+          # Hosted Ubuntu images can expose an unreachable Azure mirror in
+          # their apt sources while the public Ubuntu archive is reachable.
+          # Keep release jobs bounded and use the same source normalization as
+          # the native CI path so a runner-local mirror cannot hang packaging.
+          sudo find /etc/apt -type f \
+            -exec sed -i \
+              -e 's#http://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              -e 's#https://azure\.archive\.ubuntu\.com#https://archive.ubuntu.com#g' \
+              {} +
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            update
+          sudo env DEBIAN_FRONTEND=noninteractive timeout --foreground --signal=TERM --kill-after=30s 10m apt-get \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=60 \
+            install -y \
             libwebkit2gtk-4.1-dev \
             libappindicator3-dev \
             librsvg2-dev \
@@ -88,12 +120,11 @@ jobs:
           mkdir -p "$RUNNER_TEMP/firelink-native-packages/deb" "$RUNNER_TEMP/firelink-native-packages/rpm"
           cp src-tauri/target/${{ matrix.target }}/release/bundle/deb/*.deb "$RUNNER_TEMP/firelink-native-packages/deb/"
           cp src-tauri/target/${{ matrix.target }}/release/bundle/rpm/*.rpm "$RUNNER_TEMP/firelink-native-packages/rpm/"
-      - name: Build Linux AppImage
+      - name: Build Linux AppImage from existing binary
         if: runner.os == 'Linux'
-        run: npm run tauri build -- -vv --target ${{ matrix.target }} --bundles appimage
+        run: node scripts/build-linux-appimage.js --target ${{ matrix.target }}
         env:
           APPIMAGE_EXTRACT_AND_RUN: 1
-          FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE: '1'
       - name: Install pinned appimagetool (Linux only)
         if: runner.os == 'Linux'
         env:
@@ -109,11 +140,25 @@ jobs:
       - name: Verify macOS packaged engines and launch
         if: runner.os == 'macOS'
         run: |
-          APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app"
+          set -euo pipefail
           DMG="$(find src-tauri/target/${{ matrix.target }}/release/bundle/dmg -name '*.dmg' -print -quit)"
           test -n "$DMG"
-          npm run verify:macos-signing -- --app "$APP" --dmg "$DMG"
+          npm run verify:macos-signing -- --dmg "$DMG"
+          MOUNT_POINT="$(mktemp -d "$RUNNER_TEMP/firelink-dmg-mount.XXXXXX")"
+          cleanup() {
+            hdiutil detach "$MOUNT_POINT" -quiet || hdiutil detach "$MOUNT_POINT" -force -quiet || true
+            rmdir "$MOUNT_POINT" 2>/dev/null || true
+          }
+          trap cleanup EXIT
+          hdiutil attach -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$DMG" >/dev/null
+          APP_COUNT="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' | wc -l | tr -d ' ')"
+          test "$APP_COUNT" -eq 1
+          APP="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' -print -quit)"
+          FIRELINK_MACOS_APP="$APP" node scripts/app-associations.node-test.js
           node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }}
+          ARIA2="$(find "$APP" -type f -name 'aria2c-${{ matrix.target }}' -print -quit)"
+          test -n "$ARIA2"
+          node scripts/smoke-aria2-transfers.js --binary "$ARIA2"
           node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
       - name: Verify Windows installer payload and launch
         if: runner.os == 'Windows'
@@ -123,8 +168,15 @@ jobs:
           if (-not $installer) { throw "Windows NSIS installer artifact was not produced." }
           $extractRoot = "$env:RUNNER_TEMP/firelink-installer"
           Remove-Item -Recurse -Force $extractRoot -ErrorAction SilentlyContinue
-          7z x $installer.FullName "-o$extractRoot" -y
+          & 7z x $installer.FullName "-o$extractRoot" -y
+          if ($LASTEXITCODE -ne 0) { throw "7z failed to extract the Windows installer payload (exit code $LASTEXITCODE)." }
           node scripts/verify-binaries.js --search-root "$extractRoot" --target ${{ matrix.target }}
+          $aria2 = Get-ChildItem $extractRoot -Recurse -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Name -ieq "aria2c-${{ matrix.target }}.exe" } |
+            Sort-Object FullName |
+            Select-Object -First 1
+          if (-not $aria2) { throw "Packaged Aria2 executable was not found in the installer payload." }
+          node scripts/smoke-aria2-transfers.js --binary $aria2.FullName
 
           $portableRoot = "$env:RUNNER_TEMP/firelink-portable-payload"
           $portableArtifactDir = "$env:RUNNER_TEMP/firelink-portable"
@@ -190,6 +242,9 @@ jobs:
           chmod +x "$APPIMAGE"
           (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/$APPIMAGE" --appimage-extract >/dev/null)
           node scripts/verify-binaries.js --search-root "$RUNNER_TEMP/squashfs-root" --target ${{ matrix.target }}
+          ARIA2="$(find "$RUNNER_TEMP/squashfs-root" -type f -name 'aria2c-${{ matrix.target }}' -print -quit)"
+          test -n "$ARIA2"
+          node scripts/smoke-aria2-transfers.js --binary "$ARIA2"
           xvfb-run -a node scripts/smoke-packaged-app.js --executable "$RUNNER_TEMP/squashfs-root/AppRun"
       - uses: actions/upload-artifact@v7
         with:
@@ -249,11 +304,12 @@ jobs:
             local pattern="$1"
             local destination="$2"
             local source
-            source="$(find release-assets -maxdepth 1 -type f -name "$pattern" -print -quit)"
-            if [[ -z "$source" ]]; then
-              echo "::error::Missing release asset matching $pattern"
+            mapfile -d '' -t matches < <(find release-assets -maxdepth 1 -type f -name "$pattern" -print0)
+            if (( ${#matches[@]} != 1 )); then
+              echo "::error::Expected exactly one release asset matching $pattern, found ${#matches[@]}"
               exit 1
             fi
+            source="${matches[0]}"
             mv "$source" "release-assets/$destination"
           }
 

.gitignore

@@ -11,15 +11,24 @@ skills-lock.json
 # Local agent and planning notes
 AGENT.md
 AGENTS.md
+TORRENT_FEATURES.md
+torrent_features.md
+TORRENT_UI_IMPLEMENTATION_PLAN.md
 CLAUDE.md
 GEMINI.md
 implementation_plan.md
 CROSS_PLATFORM_CHECKLIST.md
 Cross-platform-checklist-gemini.MD
+ARIA2_AVERAGE_USER_AUDIT.md
 YouTube_media_download_handoff.md
 Release_checklist.md
+Release Checklist/
+RC Read-only/
+RC Read_only/
 
 # Frontend output and logs
+.agents/
+release_notes.md
 node_modules/
 dist/
 dist-ssr/
@@ -56,6 +65,7 @@ build/
 # Local secrets and signing material
 .env
 .env.*
+implementation_plan.md
 *.key
 *.pem
 !src-tauri/binaries/_internal/certifi/cacert.pem

CHANGELOG.md

@@ -5,6 +5,152 @@ All notable changes to Firelink will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.0] - 2026-08-27
+
+This release adds built-in Torrent downloads and a dedicated Properties window, while making regular downloads, browser handoffs, and cross-platform packages more dependable.
+
+### New features
+
+- **Torrent downloads**
+  - Add `.torrent` files and magnet links from the Add window, file associations, `magnet:` links, and Firelink Companion.
+  - Resolve remote metadata before enqueueing and safely reuse validated Torrent metadata.
+  - Select files, prioritize pieces, preallocate or allocate as needed, verify existing data, remove unselected files safely, and add per-file web seeds.
+  - Manage trackers and exclusions, tracker timing, DHT/IPv6/PEX/LPD discovery, encryption, peer limits, network identity, and resource limits.
+  - View file progress, piece availability, connected and listed peers, seeders, upload totals and speed, and the info hash.
+  - Set upload limits, seed time or ratio, stop timeout, concurrent seed slots, and move Torrent data to a new location.
+  - Use a dedicated Torrents category with pause, resume, retry, redownload, and safe cleanup.
+- **Download and Torrent Properties windows**
+  - Open a selected download in its own window with overview, transfer, and advanced controls.
+  - Use Torrent tabs for file selection, trackers, peers, options, and live diagnostics.
+  - Edit supported settings while a transfer is active, including speed, connections, Torrent upload and peer limits, seeding, verification, allocation, and encryption.
+  - Inspect allocation, exact progress, resume failures, destinations, and current diagnostics; copy long URLs or paths and export magnet links where available.
+  - Keep the window size during the app session while the window follows the current theme and locale.
+- **Adaptive mirror selection**
+  - Optionally use recent transfer performance to choose among multiple mirrors. Mirror statistics stay private on this device.
+- **Transfer and layout visibility**
+  - Show the file-allocation phase while a normal download prepares its destination.
+  - Remember the main-window size and position and the Folders collapse preference between launches.
+
+### Improvements
+
+- Improve normal-download recovery across restarts, stale transfers, redirects, mirrors, connection-pool slowdowns, retries, and resume operations without saved credentials.
+- Improve media recovery and resume messaging, preserve exact progress at the end of a transfer, and restore adaptive YouTube formats. This responds to the interrupted-YouTube-download report in [#36](https://github.com/nimbold/Firelink/issues/36).
+- Make browser and deep-link inputs arrive in order, keep magnet clipboard handoffs usable, and make Add-window destination and metadata validation clearer.
+- Improve the download table, sidebar, Add window, Settings, RTL keyboard navigation, and accessibility behavior at narrow window sizes.
+- Add clear guidance for the macOS first-launch security warning and safe approval steps, responding to [#34](https://github.com/nimbold/Firelink/issues/34).
+- Refresh bundled engines and dependencies, resume interrupted engine downloads safely, and strengthen package, release, and cross-platform verification.
+
+### Fixes
+
+- Retry affected transfers through the system resolver when a VPN or network tunnel leaves aria2 unable to resolve a host, addressing [#35](https://github.com/nimbold/Firelink/issues/35).
+- Prevent late or duplicate lifecycle events from reviving, removing, or misreporting a download after a newer action has already won.
+- Keep replacement, removal, and pre-admission cleanup from leaving stale queue entries, partial files, or misleading progress behind.
+- Keep completed, paused, failed, and retrying downloads authoritative while allocation and progress updates arrive asynchronously.
+- Make scheduled actions, speed limits, logs, persisted settings, and browser credentials safer when several changes happen close together.
+
+### Compatibility
+
+- Use [Firelink Companion `2.2.0`](https://github.com/nimbold/Firelink-Extension/releases/tag/v2.2.0), or the [latest Companion release](https://github.com/nimbold/Firelink-Extension/releases/latest), with Firelink `1.4.0`.
+
+## [1.3.1] - 2026-07-30
+
+This hotfix improves filename handling, localized display details, and release reliability across platforms.
+
+### Fixes
+
+- Prevent filename errors for long downloads and Windows-reserved names such as `CON` and `COM1`. Names are shortened safely while keeping their file extensions, addressing [#29](https://github.com/nimbold/Firelink/issues/29).
+- Correct Persian date formatting in affected settings and timezone cases, while preserving Hebrew locale formatting.
+- Fix remaining light-theme overlay and contrast details reported with the broader appearance and localization work in [#31](https://github.com/nimbold/Firelink/issues/31).
+
+### Improvements
+
+- Make Linux AppImage packaging more reliable and avoid compiling the same Rust release binary twice.
+- Strengthen cross-platform release checks so Windows and Linux test builds handle macOS-only code correctly.
+
+### Compatibility
+
+- Firelink Companion `2.1.0` remains the current compatible extension. No extension update is required for this hotfix; use the [latest Companion release](https://github.com/nimbold/Firelink-Extension/releases/latest).
+
+## [1.3.0] - 2026-07-29
+
+This release focuses on smoother queue control, a more comfortable interface, and safer recovery when downloads or browser handoffs are interrupted.
+
+### New features
+
+- **Live speed limits and connection controls** can be adjusted while a download is active.
+- **Queue reordering and bulk actions** are easier to use, with paused downloads kept behind work that is ready to run.
+- **Appearance preferences** now include a Windows 11-style option, sidebar-aware window controls, curated fonts for supported languages, and optional localized calendar dates. These improvements respond to [#31](https://github.com/nimbold/Firelink/issues/31).
+- **Firelink Companion `2.1.0`** is included in the `Extensions/Browser` submodule. Get the latest extension from the [Firelink-Extension releases](https://github.com/nimbold/Firelink-Extension/releases/latest).
+
+### Improvements
+
+- Resume, retry, pause, and redownload actions now recover more reliably when an earlier attempt has disappeared or a background event arrives late, addressing the failed-resume report in [#28](https://github.com/nimbold/Firelink/issues/28).
+- Browser captures recover more safely when Firelink is starting, the extension restarts, or capture settings change during handoff. Captures remain in the Add window for review.
+- macOS minimize and Dock, Spotlight, and Raycast reopen behavior are more consistent, addressing [#30](https://github.com/nimbold/Firelink/issues/30).
+- The downloads table stays readable at narrow widths: row actions remain contained, columns resize consistently, and controls no longer cover Date Added text, addressing [#32](https://github.com/nimbold/Firelink/issues/32).
+- Add-window metadata, duplicate resolution, playlist selection, floating menus, page navigation, and table interactions provide clearer feedback and better keyboard behavior.
+- Startup consent and keychain access are more predictable, with clearer permission feedback and safer modal focus.
+
+### Fixes
+
+- Prevent stale pause, resume, retry, completion, and remove actions from reviving a download, reporting the wrong result, or leaving a row stuck in a misleading state.
+- Keep queue limits, connection recovery, missing completion events, and retry cleanup from leaving downloads stranded or exceeding the user’s settings.
+- Keep paused work behind pending downloads and make queue controls behave correctly when several actions happen close together.
+- Automatically shorten media filenames that exceed the cross-platform per-file-name limit, addressing [#29](https://github.com/nimbold/Firelink/issues/29).
+- Refresh dependencies and bundled engines, and strengthen release, package, portable-mode, and cross-platform verification.
+
+## [1.2.0] - 2026-07-22
+
+This release makes everyday download management easier to organize, review, and trust across the desktop app and browser extension.
+
+### New features
+
+- **Localized desktop interface** for Persian, Hebrew, Russian, Ukrainian, and Simplified Chinese, responding to the Chinese-language request in [#17](https://github.com/nimbold/Firelink/issues/17). These translations are currently produced with help from LLMs and need user review; please report corrections so they can improve.
+- **Customizable download table** with selectable columns, drag-to-reorder controls, sorting, clearer size alignment, and better bulk actions.
+- **Optional batch folders** for multi-link downloads, addressing [#27](https://github.com/nimbold/Firelink/issues/27). Firelink can suggest an editable folder name from the page title or common filename while keeping the existing category-based behavior as the default.
+- **Remember the last Add-window directory**, with an opt-in setting so users remain in control of where it applies, addressing [#23](https://github.com/nimbold/Firelink/issues/23).
+- **Per-download connection controls** for normal and media transfers, with the active aria2 connection count shown in the download table. This also follows the connection-setting report in [#20](https://github.com/nimbold/Firelink/issues/20).
+- **Latest Firelink Companion 2.0.6** in the `Extensions/Browser` submodule, including selected-link batch context and safer automatic capture recovery.
+
+### Improvements
+
+- Make pause, resume, retry, remove, redownload, queue, scheduler, and settings actions safer when several operations overlap or background events arrive late.
+- Reuse unfinished downloads when their filenames match, addressing [#26](https://github.com/nimbold/Firelink/issues/26), while reducing the chance of stale state creating duplicate or misleading rows.
+- Improve first-open navigation, lazy page loading, table layout, drag interactions, sorting, and window-control placement.
+- Improve RTL behavior while keeping the download table's physical file columns readable.
+- Handle locked browser cookie databases more gracefully and keep browser metadata and authenticated captures on the correct path, addressing the media reports in [#22](https://github.com/nimbold/Firelink/issues/22) and [#24](https://github.com/nimbold/Firelink/issues/24).
+- Enforce startup consent before accessing saved credentials and make keychain-related startup behavior more predictable.
+- Refresh dependencies and bundled engines, and strengthen checks for macOS, Windows portable, Linux packages, release assets, and release version identity.
+- Refine localized wording, including Persian status labels.
+
+### Fixes
+
+- Prevent stale lifecycle work, duplicate terminal events, and overlapping controls from deleting, reviving, or leaving the wrong download in a misleading state.
+- Keep missed completion events and connection-limit updates from leaving a finished or active download visually stuck.
+- Bound backend connection counts so user-selected limits are respected instead of allowing overlapping settings to exceed them.
+- Keep extension handoffs in the Add window and make selected-link batches retain their page context for folder suggestions.
+
+## [1.1.1] - 2026-07-17
+
+This patch release focuses on transfer reliability, browser captures, and easier download control.
+
+### New
+- Add YouTube playlist downloads with smoother queueing and scrolling for large playlists.
+- Add live per-download connection controls, clipboard capture for the Add window, and byte-level progress updates.
+
+### Improved
+- Recover slow or stalled transfers more reliably and apply connection defaults consistently, addressing [#19](https://github.com/nimbold/Firelink/issues/19) and [#20](https://github.com/nimbold/Firelink/issues/20).
+- Make pause, resume, retry, cancel, remove, and completion handling more consistent when actions or background events overlap.
+- Improve playlist state, media size estimates, and large-list performance.
+- Keep clipboard, browser, and deep-link handoffs behind the startup consent explanation, and make that boundary clearer.
+- Refresh bundled engines and dependencies while strengthening cross-platform package and diagnostic checks.
+
+### Fixed
+- Fix Gmail and other authenticated browser downloads that could lose their filename or save a sign-in page after a redirect, including Chrome Incognito, addressing [#21](https://github.com/nimbold/Firelink/issues/21).
+- Keep browser-capture metadata, cookies, and destinations tied to the correct download through redirects.
+- Prevent invalid URLs, late download events, stale progress, and abandoned media work from creating misleading rows or leftover temporary files.
+- Keep sensitive local paths, credentials, and persisted records protected in errors, diagnostics, and download state.
+
 ## [1.1.0] - 2026-07-15
 
 This is a stability-focused release with safer downloads, browser handoffs, settings, and cross-platform packages.

README.md

@@ -1,117 +1,114 @@
-<div align="center">
-  <img src="src/assets/app-icon.png" alt="Firelink" width="112" height="112" />
+<p align="center">
+  <img src="src/assets/app-icon.png" alt="Firelink app icon" width="128" height="128" />
+</p>
 
-  # Firelink
+# Firelink
 
-  **A fast, focused desktop download manager for macOS, Windows, and Linux.**
+> A fast, focused desktop download manager for macOS, Windows, and Linux.
 
-  [![Version](https://img.shields.io/badge/version-1.1.0-6f42c1?style=flat-square)](https://github.com/nimbold/Firelink/releases)
-  [![macOS](https://img.shields.io/badge/macOS-111111?style=flat-square&logo=apple&logoColor=white)](#platforms)
-  [![Windows](.github/badges/windows.svg)](#platforms)
-  [![Linux](https://img.shields.io/badge/Linux-FCC624?style=flat-square&logo=linux&logoColor=black)](#platforms)
-  [![License](https://img.shields.io/github/license/nimbold/Firelink?style=flat-square)](LICENSE)
-  [![CI](https://img.shields.io/github/actions/workflow/status/nimbold/Firelink/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/nimbold/Firelink/actions/workflows/ci.yml)
+[![Latest release](https://img.shields.io/github/v/release/nimbold/Firelink?style=flat-square)](https://github.com/nimbold/Firelink/releases/latest)
+[![CI](https://img.shields.io/github/actions/workflow/status/nimbold/Firelink/ci.yml?branch=main&style=flat-square&label=CI)](https://github.com/nimbold/Firelink/actions/workflows/ci.yml)
+[![License](https://img.shields.io/github/license/nimbold/Firelink?style=flat-square)](LICENSE)
+[![macOS](https://img.shields.io/badge/macOS-Apple%20silicon-111111?style=flat-square&logo=apple&logoColor=white)](#installation)
+[![Windows](.github/badges/windows.svg)](#installation)
+[![Linux](https://img.shields.io/badge/Linux-x64-FCC624?style=flat-square&logo=linux&logoColor=black)](#installation)
 
-  [Features](#features) · [Install](#installation) · [Browser Extension](#browser-extension) · [Development](#development) · [Release Notes](CHANGELOG.md)
-</div>
-
-<br/>
-
-<div align="center">
+<p align="center">
   <img src="Screenshots/Dark%20theme%20-%20main.png" width="24%" alt="Firelink dark theme main window" />
   <img src="Screenshots/Dark%20theme%20-%20add%20window.png" width="24%" alt="Firelink dark theme add window" />
   <img src="Screenshots/Light%20theme%20-%20main.png" width="24%" alt="Firelink light theme main window" />
   <img src="Screenshots/Light%20theme%20-%20add%20window.png" width="24%" alt="Firelink light theme add window" />
+</p>
 
-  <details>
-    <summary><b>View more screenshots</b></summary>
-    <br/>
-    <img src="Screenshots/Dark%20theme%20-%20settings.png" width="32%" alt="Firelink dark theme settings" />
-    <img src="Screenshots/Light%20theme%20-%20settings.png" width="32%" alt="Firelink light theme settings" />
-  </details>
-</div>
+## What is Firelink?
 
-## Why Firelink
+Firelink manages direct downloads, browser captures, media, playlists, queues, and scheduling from one desktop app.
 
-Firelink is a desktop download manager for fast transfers, browser capture, media extraction, scheduling, and clear file placement.
+It uses a Rust and Tauri backend with a React and TypeScript interface. Required download and media engines are bundled with the app.
 
-It is now a cross-platform Rust/Tauri app with a React and TypeScript interface. A native backend coordinates downloads with aria2, yt-dlp, FFmpeg, Deno, and SQLite.
+## Status
 
-The current desktop release is **1.1.0**, paired with Firelink Companion **2.0.4**.
+Firelink `1.4.0` is the latest desktop release.
 
-This stability-focused release adds a secure Windows portable build and strengthens queues, browser handoffs, media metadata, persistence, and packaged release checks.
+Use [the latest Firelink Companion release, `2.2.0`](https://github.com/nimbold/Firelink-Extension/releases/tag/v2.2.0) with Firelink. The Companion is maintained in the [Firelink-Extension repository](https://github.com/nimbold/Firelink-Extension).
+
+The project is actively maintained. See the [changelog](CHANGELOG.md) for release history and current work.
+
+Translations are available for English, Simplified Chinese, Hebrew, Persian, Ukrainian, and Russian. Translation corrections are welcome.
 
 ## Features
 
-- **Segmented downloads** with aria2, retries, speed limits, and connection controls.
-- **Media downloads** with yt-dlp, FFmpeg, Deno, live progress, speed, and ETA.
-- **Add window** for metadata, duplicates, location choices, captured links, and clipboard-prefilled URLs.
-- **Persistent queues** with pause, resume, retry, redownload, sorting, multi-select, and bulk actions.
-- **Scheduling** with start/stop windows, speed rules, and post-queue actions.
-- **File organization** with categories, default folders, a collapsible Folders section, per-download overrides, and reveal/trash actions.
-- **Browser handoff** through local pairing, signed requests, Add window review, replay protection, and server checks.
-- **Desktop integration** with tray controls, notifications, sounds, sleep prevention, and secure credential storage.
-- **Diagnostics** with engine health checks, structured logs, and package verification.
+- Segmented HTTP and HTTPS downloads with retries, speed limits, and connection controls.
+- Media and playlist downloads through yt-dlp, FFmpeg, and Deno.
+- BitTorrent downloads from `.torrent` files, magnet links, and browser handoff, with file selection, web seeds, seeding, and live diagnostics.
+- Standalone Download and Torrent Properties windows with live controls, transfer details, and safe Torrent relocation.
+- Adaptive mirror selection for multi-source downloads.
+- An Add window for metadata, duplicate handling, save locations, and download options.
+- Persistent queues with pause, resume, retry, redownload, and scheduling.
+- Visible allocation and resume status with clearer transfer diagnostics.
+- Live speed and connection controls for active downloads.
+- A customizable download table with sorting, column selection, reordering, and bulk actions.
+- File organization with categories, default folders, and per-download locations.
+- Appearance preferences with window styles, multilingual fonts, and localized calendar dates.
+- Browser handoff through local pairing and signed requests.
+- Tray controls, notifications, sounds, sleep prevention, and secure credential storage.
+- RTL support for Hebrew and Persian.
 
 ## Installation
 
-Download desktop builds from [GitHub Releases](https://github.com/nimbold/Firelink/releases).
+Download the [latest Firelink release](https://github.com/nimbold/Firelink/releases/latest).
 
 | Platform | Package | Notes |
 | --- | --- | --- |
-| **macOS Apple silicon** | `.dmg` | Not notarized. If macOS blocks the first launch, approve Firelink in **System Settings -> Privacy & Security**. |
-| **Windows x64** | NSIS `.exe` installer | Unsigned. Windows SmartScreen may warn until code signing is added. |
-| **Windows x64 portable** | `.zip` archive | Extract to a writable folder and launch `firelink.exe`. App data stays under the archive's `data/` directory. |
-| **Linux x64** | `.deb`, `.rpm`, or `.AppImage` | Use `.deb` for Debian-family systems, `.rpm` for Fedora/RPM-family systems, or AppImage as the self-contained package. AppImage may need executable permission. |
+| macOS Apple silicon | `.dmg` | Ad-hoc signed and not notarized. macOS may require approval in **System Settings -> Privacy & Security**. |
+| Windows x64 | NSIS `.exe` | Unsigned. Windows SmartScreen may display a warning. |
+| Windows x64 portable | `.zip` | Extract to a writable folder and launch `firelink.exe`. |
+| Linux x64 | `.deb`, `.rpm`, or `.AppImage` | Choose the package for your distribution, or use AppImage. |
 
-Bundles include the required engines. Users do not need aria2, yt-dlp, FFmpeg, Deno, Python, Homebrew, or another package manager.
+All packages include aria2, yt-dlp, FFmpeg, Deno, and SQLite support. No separate engine installation is required.
 
-The native packages use the distribution's normal desktop runtime dependencies. AppImage is self-contained but uses the normal per-user application-data locations.
+<details>
+<summary><strong>macOS security warning and first launch</strong></summary>
 
-### Windows portable
+Firelink's macOS release is ad-hoc signed but not notarized by Apple. A paid Apple Developer Program account is required for Apple's Developer ID signing and notarization, so macOS may warn that it cannot verify Firelink or check that it is free of malware. This warning does not by itself mean that the app contains malware.
 
-The portable ZIP is an opt-in secondary distribution:
+Only use these steps for Firelink downloaded from the [official GitHub release page](https://github.com/nimbold/Firelink/releases/latest). After moving `Firelink.app` to Applications, use one of these methods to approve the first launch:
 
-- Keep the extracted folder writable; avoid `Program Files`, read-only media, and folders that block SQLite or WebView writes.
-- Settings, queues, logs, and WebView data stay beside `firelink.exe` under `data/`.
-- Close Firelink before moving or copying the folder, and close the installed app before launching the portable copy.
-- Credentials, browser cookies, and URL query/fragment data are not saved in portable queue records. Active downloads that depend on them must be added again after restart.
-- Saved site passwords remain in the Windows credential store and are not copied into the archive.
-- The folder contains the extension pairing credential, so treat it as sensitive and do not share it.
-- Saved absolute download locations may need to be selected again after moving the folder to another drive.
+1. In Finder, Control-click or right-click `Firelink.app`, choose **Open**, then choose **Open** again.
+2. Try opening Firelink once, then open **System Settings -> Privacy & Security**, scroll down, and choose **Open Anyway** for Firelink.
+3. In Terminal, remove only the downloaded-file quarantine flag:
+
+   ```bash
+   xattr -dr com.apple.quarantine /Applications/Firelink.app
+   ```
+
+   If Firelink is stored somewhere else, replace the path with the actual path to `Firelink.app`. The approval is normally needed only once.
+
+</details>
+
+<details>
+<summary><strong>Windows portable ZIP notes</strong></summary>
+
+- Keep the folder writable. Avoid `Program Files` and read-only media.
+- Settings, queues, logs, and WebView data are stored beside the executable in `data/`.
+- Close Firelink before moving or copying the folder.
+- Treat the folder as sensitive because it contains the extension pairing credential.
 - The installer remains the supported path for `firelink://` browser launch registration.
 
-## Browser Extension
+</details>
 
-<p align="center">
-  <a href="https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/"><img src="https://img.shields.io/badge/Install%20from-Firefox%20Add--ons-FF7139?style=for-the-badge&logo=firefox-browser&logoColor=white" alt="Install Firelink Companion from Firefox Add-ons" /></a>
-  &nbsp;&nbsp;
-  <a href="https://github.com/nimbold/Firelink-Extension#manual-chromium-installation"><img src="https://img.shields.io/badge/Manual%20install-Chromium-4285F4?style=for-the-badge&logo=googlechrome&logoColor=white" alt="Read manual Chromium install instructions" /></a>
+## Browser integration
+
+[Firelink Companion `2.2.0`](https://github.com/nimbold/Firelink-Extension/releases/tag/v2.2.0) connects browser downloads, links, media pages, magnets, and Torrent metadata to Firelink. Use the [latest Companion release](https://github.com/nimbold/Firelink-Extension/releases/latest) with the [latest Firelink release](https://github.com/nimbold/Firelink/releases/latest).
+
+Captured links open Firelink's Add window for review before they are started or queued.
+
+<p>
+  <a href="https://addons.mozilla.org/en-US/firefox/addon/firelink-companion/"><img src="https://img.shields.io/badge/Install%20from-Firefox%20Add--ons-FF7139?style=for-the-badge&logo=firefox-browser&logoColor=white" alt="Install from Firefox Add-ons" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/nimbold/Firelink-Extension#manual-chromium-installation"><img src="https://img.shields.io/badge/Manual%20install-Chromium-4285F4?style=for-the-badge&logo=googlechrome&logoColor=white" alt="Manual install for Chromium browsers" /></a>
 </p>
 
-Firelink Companion sends browser links and downloads to the desktop app.
-
-What it adds:
-
-- Automatic capture for regular browser downloads.
-- Explicit Fetch media actions from the popup and page context menu.
-- Context-menu actions for links and selected text.
-- Firefox and Chromium support.
-- Signed local requests using the token from **Settings -> Integrations**.
-- Fallback to the browser download when Firelink is closed or rejects a handoff.
-- Captured links always open Firelink's Add window before anything is added to the download list.
-
-Install the extension, open Firelink, then pair it from **Settings -> Integrations**. Firefox users can install from Mozilla Add-ons. Chromium users can use the [manual load-unpacked flow](https://github.com/nimbold/Firelink-Extension#manual-chromium-installation) with `firelink-chromium.zip` from the [extension releases](https://github.com/nimbold/Firelink-Extension/releases). Firelink Companion 2.0.4 is the matching extension release for Firelink 1.1.0.
-
-The extension lives in [Firelink-Extension](https://github.com/nimbold/Firelink-Extension). This repo also vendors it as the `Extensions/Browser` submodule.
-
-## Platforms
-
-| Target | Status |
-| --- | --- |
-| **macOS arm64** | Supported. Native build, engine checks, launch smoke test, ad-hoc-signed DMG workflow. |
-| **Windows x64** | Supported. Native build, engine checks, silent installer smoke test, NSIS installer. |
-| **Linux x64** | Supported. Native build, bundled-engine checks, package/AppImage launch smoke tests, `.deb`, `.rpm`, and AppImage. |
+See the [Companion README](https://github.com/nimbold/Firelink-Extension#readme) for browser installation, pairing, and privacy details.
 
 ## Development
 
@@ -122,73 +119,50 @@ The extension lives in [Firelink-Extension](https://github.com/nimbold/Firelink-
 - Rust and Cargo
 - [Tauri 2 platform prerequisites](https://v2.tauri.app/start/prerequisites/)
 
-Clone the repository with its browser-extension submodule:
+### Quick start
 
 ```sh
 git clone --recurse-submodules https://github.com/nimbold/Firelink.git
 cd Firelink
-```
-
-Install dependencies and launch the desktop app:
-
-```sh
 npm install
 npm run tauri dev
 ```
 
-Run the core checks:
+Run the main checks with:
 
 ```sh
 node --test scripts/*.node-test.js
 npm test -- --run
 npm run build
-cd src-tauri
-cargo test --all-targets
+cd src-tauri && cargo test --all-targets
 ```
 
-Create a production bundle:
+See [RELEASE.md](RELEASE.md) for engine provisioning, packaging, and release verification.
 
-```sh
-npm run tauri build
-```
+## Contributing and support
 
-macOS uses locked payloads in `src-tauri/binaries`. Provision Windows and Linux payloads from checksum-pinned archives:
-
-```sh
-node scripts/provision-engines.js --target x86_64-pc-windows-msvc
-node scripts/provision-engines.js --target x86_64-unknown-linux-gnu
-```
-
-Build staging includes only the current target. See `engines.lock.json`, `engine-sources.lock.json`, and [RELEASE.md](RELEASE.md).
-
-## Repository Structure
-
-```text
-.
-├── src/                  React and TypeScript interface
-├── src-tauri/            Rust backend, Tauri config, and native tests
-├── scripts/              Engine provisioning, release, and smoke-test tooling
-└── Extensions/Browser/   Firelink Companion submodule
-```
-
-## Help and Project Status
-
-- Report bugs or request improvements in [GitHub Issues](https://github.com/nimbold/Firelink/issues).
+- Report bugs and request features in [GitHub Issues](https://github.com/nimbold/Firelink/issues).
+- Open focused pull requests with tests for behavior changes.
+- Report translation corrections in an issue or pull request.
 - Read [CHANGELOG.md](CHANGELOG.md) for release history.
-- Review [RELEASE.md](RELEASE.md) for packaging policy and release verification.
 
-## Technology & Credits
+## Credits
 
-Firelink is made possible by these open-source projects:
+Core technologies:
 
-- **[Tauri 2](https://tauri.app/)** for the lightweight desktop runtime
-- **[Rust](https://www.rust-lang.org/)** and **[Tokio](https://tokio.rs/)** for native application logic
-- **[React](https://react.dev/)** and **[TypeScript](https://www.typescriptlang.org/)** for the interface
-- **[Zustand](https://zustand-demo.pmnd.rs/)** for frontend state management
-- **[SQLite](https://www.sqlite.org/)** for persistent local data
-- **[aria2](https://aria2.github.io/)** for segmented downloading
-- **[yt-dlp](https://github.com/yt-dlp/yt-dlp)**, **[FFmpeg](https://ffmpeg.org/)**, and **[Deno](https://deno.com/)** for media extraction and processing
+- [Tauri 2](https://v2.tauri.app/), [Rust](https://www.rust-lang.org/), [Tokio](https://tokio.rs/)
+- [React](https://react.dev/), [TypeScript](https://www.typescriptlang.org/), [Zustand](https://zustand-demo.pmnd.rs/)
+- [SQLite](https://www.sqlite.org/)
+
+Bundled engines:
+
+- [aria2](https://aria2.github.io/)
+- [yt-dlp](https://github.com/yt-dlp/yt-dlp)
+- [FFmpeg](https://ffmpeg.org/)
+- [Deno](https://deno.com/)
+
+Font licenses, engine versions, source references, and third-party notices are documented in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
 
 ## License
 
-Firelink is available under the [MIT License](LICENSE).
+Firelink is available under the [MIT License](LICENSE). Bundled tools and fonts retain their own licenses.

RELEASE.md

@@ -25,7 +25,7 @@ Firelink never falls back to system-installed media tools.
 - `scripts/stage-engines.js` creates one target-specific bundle payload.
 - `scripts/verify-binaries.js` runs architecture, packaging, version, and RPC checks.
 
-Linux `.deb` and `.rpm` packages are built with the complete verified engine payload. The AppImage is built separately with the engine payload temporarily omitted, then repacked from the verified payload because the AppImage tooling can rewrite bundled native binaries.
+Linux `.deb` and `.rpm` packages are built with the complete verified engine payload. The AppImage is bundled separately with the engine resource excluded from the initial Linux packaging pass, then repacked from the verified payload because the AppImage tooling can rewrite bundled native binaries.
 
 yt-dlp must remain its official PyInstaller **onedir** distribution: launcher plus adjacent `_internal` runtime. Onefile builds are rejected because repeated extraction caused roughly 17-second startup latency.
 
@@ -50,10 +50,24 @@ cd ..
 npm run tauri build -- --target aarch64-apple-darwin --bundles dmg
 ```
 
-Verify packaged resources, then launch outside repository working directory:
+Verify the DMG and the app it contains, then launch outside the repository
+working directory. The DMG bundler removes the intermediate app directory, so
+the post-build checks must use the mounted release artifact:
 
 ```bash
-APP="src-tauri/target/aarch64-apple-darwin/release/bundle/macos/Firelink.app"
+DMG="$(find src-tauri/target/aarch64-apple-darwin/release/bundle/dmg -name '*.dmg' -print -quit)"
+test -n "$DMG"
+npm run verify:macos-signing -- --dmg "$DMG"
+MOUNT_POINT="$(mktemp -d -t firelink-dmg)"
+cleanup() {
+  hdiutil detach "$MOUNT_POINT" -quiet || hdiutil detach "$MOUNT_POINT" -force -quiet || true
+  rmdir "$MOUNT_POINT" 2>/dev/null || true
+}
+trap cleanup EXIT
+hdiutil attach -nobrowse -readonly -mountpoint "$MOUNT_POINT" "$DMG" >/dev/null
+APP_COUNT="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' | wc -l | tr -d ' ')"
+test "$APP_COUNT" -eq 1
+APP="$(find "$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink.app' -print -quit)"
 node scripts/verify-binaries.js --search-root "$APP" --target aarch64-apple-darwin
 node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
 ```
@@ -65,6 +79,11 @@ pass. A `workflow_dispatch` on a `v*` tag also publishes when its
 release-certification inputs; clean-machine QA remains a release-owner gate
 before pushing the tag.
 
+For paired releases, publish and verify the Companion release first. The
+desktop release workflow requires `Extensions/Browser` to be at a clean commit
+whose exact tag matches both the Companion `package.json` and `manifest.json`
+versions before building desktop packages.
+
 ## Automated release builds
 
 Push a version tag to build and verify native artifacts:

THIRD_PARTY_NOTICES.md

@@ -4,6 +4,23 @@ Firelink distributes separate executable tools. Firelink's MIT license does not
 
 Exact versions, target hashes, sources, and build descriptions are pinned in `engines.lock.json`.
 
+## Bundled fonts
+
+Firelink bundles variable WOFF2 web fonts through Fontsource. Each font is
+licensed under the SIL Open Font License, Version 1.1. The corresponding
+license and author information are available from the linked project sources.
+
+- Inter: <https://github.com/rsms/inter>
+- Outfit: <https://github.com/Outfitio/Outfit-Fonts>
+- Roboto: <https://github.com/googlefonts/roboto-classic>
+- Vazirmatn: <https://github.com/rastikerdar/vazirmatn>
+- Noto Sans Hebrew: <https://github.com/notofonts/hebrew>
+- Noto Sans SC: <https://github.com/notofonts/noto-cjk>
+
+Fontsource distribution: <https://github.com/fontsource/font-files>
+
+License text: <https://openfontlicense.org/open-font-license-official-text/>
+
 ## aria2
 
 - Project: <https://aria2.github.io/>

engine-sources.lock.json

@@ -3,19 +3,19 @@
   "targets": {
     "x86_64-pc-windows-msvc": {
       "yt-dlp": {
-        "version": "2026.07.04",
-        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.07.04/yt-dlp_win.zip",
-        "sha256": "90254845be5282b1f4d843a873abff04f569f857f64250f833fe152b21eec152"
+        "version": "2026.08.19",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.08.19/yt-dlp_win.zip",
+        "sha256": "30b4c14aafab6082becff7881e41b76df46dc43ea7633479410a91e29da492bf"
       },
       "deno": {
-        "version": "2.9.2",
-        "url": "https://github.com/denoland/deno/releases/download/v2.9.2/deno-x86_64-pc-windows-msvc.zip",
-        "sha256": "5fe194d26ac5ef77fcc5288c2c438c7a0465f3b6180440ebf04092714bf2dcdf"
+        "version": "2.9.5",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.5/deno-x86_64-pc-windows-msvc.zip",
+        "sha256": "171efab55ac6b9881fd53ee4c20f8bf3bb1340ffc618483746909014db12216a"
       },
       "ffmpeg": {
-        "version": "8.1.2-22-g94138f6973",
-        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-07-14-13-19/ffmpeg-n8.1.2-22-g94138f6973-win64-gpl-8.1.zip",
-        "sha256": "fb627ebbf9b16a3142fa48b8acd27cd9196d57aee1f719e1233416e95da7e877"
+        "version": "8.1.2-46-g139afe709a",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-26-13-06/ffmpeg-n8.1.2-46-g139afe709a-win64-gpl-8.1.zip",
+        "sha256": "f966bc2e843bcd680dedd6d1a2c0c895bab859a402c6dd107cbe72a796dfebcf"
       },
       "aria2c": {
         "version": "1.37.0",
@@ -25,19 +25,19 @@
     },
     "x86_64-unknown-linux-gnu": {
       "yt-dlp": {
-        "version": "2026.07.04",
-        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.07.04/yt-dlp_linux.zip",
-        "sha256": "d7d2d09e900b5ae11821b5784b18cf064984a2bd88b1ca5c798d744bcbe3658b"
+        "version": "2026.08.19",
+        "url": "https://github.com/yt-dlp/yt-dlp/releases/download/2026.08.19/yt-dlp_linux.zip",
+        "sha256": "32e72032766bef9199d99d15beb69fd52e46df8f8b06f0d8745db59e04d339e9"
       },
       "deno": {
-        "version": "2.9.2",
-        "url": "https://github.com/denoland/deno/releases/download/v2.9.2/deno-x86_64-unknown-linux-gnu.zip",
-        "sha256": "934d1bd5cb09eaed7f2e4a4fc58208d04a3c5c0fcde9f319d93d735265c67a4a"
+        "version": "2.9.5",
+        "url": "https://github.com/denoland/deno/releases/download/v2.9.5/deno-x86_64-unknown-linux-gnu.zip",
+        "sha256": "8b010a3b1a4a0188a67cdb8a7a27348b2a501af78aec7fc74f2ace167368d530"
       },
       "ffmpeg": {
-        "version": "8.1.2-22-g94138f6973",
-        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-07-14-13-19/ffmpeg-n8.1.2-22-g94138f6973-linux64-gpl-8.1.tar.xz",
-        "sha256": "96cf2585a4b2874044320cbc5d4078af57e266f0c86cca9888507c5faab3aee8"
+        "version": "8.1.2-46-g139afe709a",
+        "url": "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-08-26-13-06/ffmpeg-n8.1.2-46-g139afe709a-linux64-gpl-8.1.tar.xz",
+        "sha256": "0814f4491c2673ea505be8fb65a76c2bfabaa5aad8f33d49b1c5b87a2262e8c5"
       },
       "aria2c": {
         "version": "1.37.0",

engines.lock.json

@@ -4,10 +4,10 @@
     "aarch64-apple-darwin": {
       "engines": {
         "yt-dlp": {
-          "version": "2026.07.04",
+          "version": "2026.08.19",
           "source": "https://github.com/yt-dlp/yt-dlp",
           "build": "PyInstaller onedir distribution with embedded Python and yt_dlp_ejs",
-          "sha256": "ff7d4fc44b8fbf42da021c1bca950da0326cdb0cdb84992fdc7fb7ec215df435"
+          "sha256": "4f54eb67e4e96c7c3ffa49dd5deb81bc348bbb495080889b47d157d5c6d74443"
         },
         "aria2c": {
           "version": "1.37.0",
@@ -16,23 +16,23 @@
           "sha256": "111b2f5ed760f1e1a2ec06117c4e8094fcde336ba16122dda1c5e7209bf1862d"
         },
         "ffmpeg": {
-          "version": "N-125610-g312c830916",
+          "version": "N-125892-g406c5a37aa",
           "source": "https://ffmpeg.org/",
           "build": "GPLv3 build identified by binary as https://www.martin-riedl.de",
-          "url": "https://ffmpeg.martin-riedl.de/download/macos/arm64/1784052810_N-125610-g312c830916/ffmpeg.zip",
-          "sha256": "f65b4ba782b25e9f4374765d421793c6613f692d8e50b2888079657793619034"
+          "url": "https://ffmpeg.martin-riedl.de/download/macos/arm64/1785661721_N-125892-g406c5a37aa/ffmpeg.zip",
+          "sha256": "734e6b72a0c2d0d5e089b5a0094be74fa058c15158f6b0689207a01fedafd8f5"
         },
         "deno": {
-          "version": "2.9.2",
+          "version": "2.9.5",
           "source": "https://github.com/denoland/deno",
           "build": "official aarch64-apple-darwin executable",
-          "sha256": "218ab752ae8f64f0a7822af710886488f15169fdae153a3aada4861f9635b266"
+          "sha256": "b5bd08edab254d42d7b05aa5b6cb4c9b8d4dede4975aff76951ce2cce18866fa"
         }
       },
       "runtimeTrees": {
         "_internal": {
-          "files": 142,
-          "sha256": "769507d9b8d97164ef81ebb449873072697bf82acac8c7d61c7bfd96c551e210"
+          "files": 133,
+          "sha256": "24ac8c7557dbef0ef9e5685365b4620bc441a168daf314b71218276b782dc449"
         },
         "aria2-libs": {
           "files": 7,

index.html

@@ -5,9 +5,6 @@
     <link rel="icon" type="image/png" href="/src/assets/app-icon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Firelink Download Manager</title>
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Outfit:wght@300;400;500;600;700&display=swap" rel="stylesheet">
   </head>
 
   <body>

package.json

@@ -1,7 +1,7 @@
 {
   "name": "firelink",
   "private": true,
-  "version": "1.1.0",
+  "version": "1.4.0",
   "description": "A fast cross-platform desktop download manager powered by Rust, Tauri, React, aria2, and yt-dlp.",
   "license": "MIT",
   "homepage": "https://github.com/nimbold/Firelink",
@@ -31,37 +31,51 @@
     "dev": "vite",
     "bindings": "cd src-tauri && cargo test export_bindings --lib",
     "build": "tsc && vite build",
+    "check:i18n": "vitest run src/i18n/resources.test.ts",
     "check:updates": "node scripts/check-updates.js",
+    "smoke:torrent": "node scripts/smoke-torrent.js",
+    "smoke:torrent:failure-paths": "node scripts/smoke-torrent.js --failure-paths",
+    "smoke:aria2:resolver": "node scripts/smoke-aria2-resolver.js",
+    "smoke:aria2:transfers": "node scripts/smoke-aria2-transfers.js",
+    "test:torrent:rpc": "cd src-tauri && cargo test --test torrent_rpc -- --nocapture",
     "verify:macos-signing": "node scripts/verify-macos-signing.js",
     "preview": "vite preview",
     "tauri": "tauri",
     "test": "vitest"
   },
   "dependencies": {
+    "@fontsource-variable/inter": "^5.3.0",
+    "@fontsource-variable/noto-sans-hebrew": "^5.3.0",
+    "@fontsource-variable/noto-sans-sc": "^5.3.0",
+    "@fontsource-variable/outfit": "^5.3.0",
+    "@fontsource-variable/roboto": "^5.3.0",
+    "@fontsource-variable/vazirmatn": "^5.3.0",
     "@formkit/auto-animate": "^0.10.0",
-    "@tailwindcss/vite": "^4.3.1",
+    "@tailwindcss/vite": "^4.3.3",
     "@tauri-apps/api": "^2.11.1",
     "@tauri-apps/plugin-clipboard-manager": "^2.3.2",
-    "@tauri-apps/plugin-dialog": "^2.7.1",
+    "@tauri-apps/plugin-dialog": "^2.7.2",
     "@tauri-apps/plugin-fs": "^2.5.1",
     "@tauri-apps/plugin-log": "^2.9.0",
     "@tauri-apps/plugin-notification": "^2.3.3",
     "@tauri-apps/plugin-opener": "^2",
-    "lucide-react": "^1.24.0",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0",
-    "zustand": "^5.0.14"
+    "i18next": "^26.4.0",
+    "lucide-react": "^1.34.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-i18next": "^17.0.12",
+    "zustand": "^5.0.15"
   },
   "devDependencies": {
     "@tauri-apps/cli": "^2.11.4",
-    "@types/react": "^19.1.8",
-    "@types/react-dom": "^19.1.6",
-    "@vitejs/plugin-react": "^6.0.3",
-    "autoprefixer": "^10.5.3",
-    "postcss": "^8.5.19",
-    "tailwindcss": "^4.3.1",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.5",
+    "@vitejs/plugin-react": "^6.1.0",
+    "autoprefixer": "^10.5.4",
+    "postcss": "^8.5.26",
+    "tailwindcss": "^4.3.3",
     "typescript": "^7.0.2",
-    "vite": "^8.1.4",
-    "vitest": "^4.1.10"
+    "vite": "^8.2.2",
+    "vitest": "^4.1.11"
   }
 }

scripts/app-associations.node-test.js

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+
+const repositoryRoot = path.resolve(import.meta.dirname, '..');
+const tauriConfig = JSON.parse(
+  fs.readFileSync(path.join(repositoryRoot, 'src-tauri', 'tauri.conf.json'), 'utf8')
+);
+
+const torrentAssociation = tauriConfig.bundle.fileAssociations.find(association =>
+  association.ext?.some(extension => extension.toLowerCase() === 'torrent')
+);
+
+test('declares the native macOS BitTorrent content type', () => {
+  assert.ok(torrentAssociation, 'the bundle must declare a .torrent association');
+  assert.equal(torrentAssociation.mimeType, 'application/x-bittorrent');
+  assert.deepEqual(torrentAssociation.exportedType, {
+    identifier: 'org.bittorrent.torrent',
+    conformsTo: ['public.data', 'public.item']
+  });
+  assert.equal(
+    torrentAssociation.contentTypes,
+    undefined,
+    'the UTI declaration supplies the extension and MIME tags for clean installs'
+  );
+});
+
+test('declares magnet as a desktop deep-link scheme', () => {
+  assert.deepEqual(tauriConfig.plugins['deep-link'].desktop.schemes, ['firelink', 'magnet']);
+});
+
+const packagedAppPath = process.env.FIRELINK_MACOS_APP;
+
+if (packagedAppPath) {
+  test('packaged macOS app exports the Torrent UTI and magnet URL scheme', () => {
+    assert.equal(process.platform, 'darwin', 'packaged macOS association checks require macOS');
+    const infoPlistPath = path.join(packagedAppPath, 'Contents', 'Info.plist');
+    assert.ok(fs.existsSync(infoPlistPath), `missing packaged Info.plist: ${infoPlistPath}`);
+
+    const plist = JSON.parse(execFileSync('plutil', ['-convert', 'json', '-o', '-', infoPlistPath], {
+      encoding: 'utf8'
+    }));
+    const urlTypes = Array.isArray(plist.CFBundleURLTypes) ? plist.CFBundleURLTypes : [];
+    const schemes = urlTypes.flatMap(entry => (
+      entry && typeof entry === 'object' && Array.isArray(entry.CFBundleURLSchemes)
+        ? entry.CFBundleURLSchemes.filter(scheme => typeof scheme === 'string')
+        : []
+    ));
+    assert.ok(schemes.includes('firelink'), 'packaged app must retain the Firelink deep-link scheme');
+    assert.ok(schemes.includes('magnet'), 'packaged app must export the magnet URL scheme');
+
+    const documentTypes = Array.isArray(plist.CFBundleDocumentTypes) ? plist.CFBundleDocumentTypes : [];
+    const torrentDocument = documentTypes.find(entry =>
+      entry
+      && typeof entry === 'object'
+      && Array.isArray(entry.CFBundleTypeExtensions)
+      && entry.CFBundleTypeExtensions.some(extension =>
+        typeof extension === 'string' && extension.toLowerCase() === 'torrent'
+      )
+    );
+    assert.ok(torrentDocument, 'packaged app must claim the .torrent extension');
+    assert.ok(
+      Array.isArray(torrentDocument.LSItemContentTypes)
+      && torrentDocument.LSItemContentTypes.includes('org.bittorrent.torrent'),
+      'packaged app must claim the standard BitTorrent UTI'
+    );
+  });
+}

scripts/audit-aria2-options.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs';
+
+const sourceArgument = process.argv.indexOf('--source');
+const sourceLocation = sourceArgument >= 0
+  ? process.argv[sourceArgument + 1]
+  : 'https://raw.githubusercontent.com/aria2/aria2/release-1.37.0/doc/manual-src/en/aria2c.rst';
+
+if (!sourceLocation) throw new Error('--source requires a path or URL');
+
+const source = /^https:\/\//.test(sourceLocation)
+  ? await fetch(sourceLocation, { signal: AbortSignal.timeout(15000) }).then(response => {
+      if (!response.ok) throw new Error(`Aria2 manual fetch failed with HTTP ${response.status}`);
+      return response.text();
+    })
+  : fs.readFileSync(sourceLocation, 'utf8');
+
+function section(start, end) {
+  const startIndex = source.indexOf(`${start}\n`);
+  const endIndex = source.indexOf(`${end}\n`, startIndex + start.length);
+  if (startIndex < 0 || endIndex < 0) throw new Error(`Could not find manual section ${start} -> ${end}`);
+  return source.slice(startIndex, endIndex);
+}
+
+function options(text) {
+  const names = [...text.matchAll(/^\.\. option:: .*?(--[a-z0-9-]+)/gm)]
+    .map(match => match[1].slice(2));
+  return [...new Set(names)].sort();
+}
+
+const normal = options(section('HTTP/FTP/SFTP Options', 'BitTorrent/Metalink Options'));
+const torrent = options(
+  `${section('BitTorrent/Metalink Options', 'BitTorrent Specific Options')}\n${section('BitTorrent Specific Options', 'Metalink Specific Options')}`,
+);
+
+if (torrent.length !== 46) {
+  throw new Error(`Expected 46 unique Aria2 1.37.0 Torrent options, found ${torrent.length}`);
+}
+
+console.log(JSON.stringify({
+  source: sourceLocation,
+  aria2Version: '1.37.0',
+  normal: { count: normal.length, options: normal },
+  torrent: { count: torrent.length, options: torrent },
+}, null, 2));

scripts/before-tauri-build.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -41,14 +41,15 @@ function runNpmScript(script) {
   run('npm', ['run', script]);
 }
 
+// A packaged Tauri artifact must have its own consent identity. A source or
+// commit fingerprint cannot distinguish two fresh signed/package builds made
+// from the same checkout, which would let an updated binary silently reuse the
+// previous binary's credential-store approval. Keep any configured identity
+// as useful provenance, but always add the artifact nonce.
+const configuredBuildId = process.env.VITE_BUILD_ID?.trim();
+process.env.VITE_BUILD_ID = `${configuredBuildId || 'artifact'}-${randomUUID()}`;
+
 run(process.execPath, ['scripts/stage-engines.js']);
 run(process.execPath, ['scripts/verify-binaries.js', '--staged']);
 
-if (process.env.FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE === '1') {
-  const engineDist = path.join(repoRoot, 'src-tauri', 'engine-dist');
-  fs.rmSync(engineDist, { recursive: true, force: true });
-  fs.mkdirSync(engineDist, { recursive: true });
-  console.log('Omitted engine-dist from the initial Tauri bundle; release packaging will repack verified engines.');
-}
-
 runNpmScript('build');

scripts/build-linux-appimage.js

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+let activeChild;
+let receivedSignal;
+
+export const APPIMAGE_CONFIG = JSON.stringify({
+  bundle: {
+    resources: {
+      // Tauri merges --config values using JSON Merge Patch. An omitted key
+      // would leave the base engine resource enabled; null explicitly removes
+      // it for this first packaging pass. The verified payload is added back
+      // by repack-linux-appimage-engines.js after linuxdeploy finishes.
+      'engine-dist/': null,
+    },
+  },
+});
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function signalExitCode(signal) {
+  return {
+    SIGHUP: 129,
+    SIGINT: 130,
+    SIGTERM: 143,
+  }[signal] ?? 1;
+}
+
+function npmInvocation(args) {
+  if (process.env.npm_execpath) {
+    return [process.execPath, [process.env.npm_execpath, ...args]];
+  }
+
+  if (process.platform === 'win32') {
+    return ['cmd.exe', ['/d', '/s', '/c', 'npm', ...args]];
+  }
+
+  return ['npm', args];
+}
+
+export function appImageBundleArguments(target) {
+  return [
+    'run',
+    'tauri',
+    '--',
+    'bundle',
+    '-vv',
+    '--target',
+    target,
+    '--bundles',
+    'appimage',
+    '--config',
+    APPIMAGE_CONFIG,
+  ];
+}
+
+function run(command, args, options = {}) {
+  const child = spawn(command, args, {
+    cwd: options.cwd ?? repoRoot,
+    env: { ...process.env, ...options.env },
+    stdio: options.stdio ?? 'inherit',
+    windowsHide: true,
+    detached: process.platform !== 'win32',
+  });
+
+  activeChild = child;
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+
+    child.once('error', error => {
+      if (activeChild === child) activeChild = undefined;
+      if (!settled) {
+        settled = true;
+        reject(error);
+      }
+    });
+
+    child.once('close', (code, signal) => {
+      if (activeChild === child) activeChild = undefined;
+      if (!settled) {
+        settled = true;
+        resolve({ code, signal });
+      }
+    });
+  });
+}
+
+async function runChecked(command, args, label = command) {
+  let result;
+  try {
+    result = await run(command, args);
+  } catch (error) {
+    throw new Error(`Failed to run ${label}: ${error.message}`, { cause: error });
+  }
+
+  if (result.signal) {
+    const error = new Error(`${label} was terminated by ${result.signal}.`);
+    error.exitCode = signalExitCode(result.signal);
+    throw error;
+  }
+
+  if (result.code !== 0) {
+    const error = new Error(`${label} exited with status ${result.code}.`);
+    error.exitCode = result.code ?? 1;
+    throw error;
+  }
+
+  return result;
+}
+
+function assertSafeTarget(target) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(target)) {
+    throw new Error(`Invalid target triple: ${target}`);
+  }
+}
+
+async function main() {
+  const target = argValue('--target') || process.env.FIRELINK_TARGET_TRIPLE;
+  if (!target) {
+    throw new Error('Pass --target <triple>.');
+  }
+  assertSafeTarget(target);
+
+  // The native-package build has already staged and verified the engines.
+  // Verify once more before creating the AppImage so a failed preparation
+  // cannot produce an artifact that later appears valid only because its
+  // payload is absent.
+  await runChecked(
+    process.execPath,
+    ['scripts/verify-binaries.js', '--staged', '--target', target],
+    'staged engine verification'
+  );
+
+  if (receivedSignal) {
+    const error = new Error(`Build interrupted by ${receivedSignal}.`);
+    error.exitCode = signalExitCode(receivedSignal);
+    throw error;
+  }
+
+  const [npmCommand, npmArgs] = npmInvocation(appImageBundleArguments(target));
+  await runChecked(npmCommand, npmArgs, 'Tauri AppImage bundling');
+
+  if (receivedSignal) {
+    const error = new Error(`Build interrupted by ${receivedSignal}.`);
+    error.exitCode = signalExitCode(receivedSignal);
+    throw error;
+  }
+
+  console.log(`Built the Linux AppImage from the existing ${target} release binary.`);
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+
+if (isMain) {
+  const handleSignal = signal => {
+    receivedSignal ??= signal;
+
+    // npm and Tauri can have Rust/packaging descendants. On POSIX, the child
+    // is a detached process-group leader, so signal the whole group instead of
+    // leaving descendants running after the wrapper exits.
+    if (activeChild && activeChild.exitCode === null && activeChild.signalCode === null) {
+      try {
+        if (process.platform === 'win32' || !activeChild.pid) {
+          activeChild.kill(signal);
+        } else {
+          process.kill(-activeChild.pid, signal);
+        }
+      } catch (error) {
+        if (error.code !== 'ESRCH') {
+          console.error(`[WARN] Could not terminate the AppImage build process group: ${error.message}`);
+        }
+      }
+    } else {
+      process.exitCode = signalExitCode(signal);
+    }
+  };
+
+  for (const signal of ['SIGHUP', 'SIGINT', 'SIGTERM']) {
+    process.once(signal, () => handleSignal(signal));
+  }
+
+  main()
+    .catch(error => {
+      console.error(`[FAIL] ${error.message}`);
+      process.exitCode = error.exitCode ?? 1;
+    })
+    .finally(() => {
+      for (const signal of ['SIGHUP', 'SIGINT', 'SIGTERM']) {
+        process.removeAllListeners(signal);
+      }
+    });
+}

scripts/build-linux-appimage.node-test.js

@@ -0,0 +1,20 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { APPIMAGE_CONFIG, appImageBundleArguments } from './build-linux-appimage.js';
+
+test('AppImage config explicitly removes the staged engine payload', () => {
+  assert.deepEqual(JSON.parse(APPIMAGE_CONFIG), {
+    bundle: {
+      resources: {
+        'engine-dist/': null,
+      },
+    },
+  });
+});
+
+test('AppImage bundling uses the existing binary instead of tauri build', () => {
+  const args = appImageBundleArguments('x86_64-unknown-linux-gnu');
+  assert.equal(args[3], 'bundle');
+  assert.equal(args.includes('build'), false);
+  assert.deepEqual(args.slice(-2), ['--config', APPIMAGE_CONFIG]);
+});

scripts/check-updates.js

@@ -7,6 +7,14 @@ import { fileURLToPath } from 'node:url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, '..');
 const userAgent = 'firelink-update-check';
+const fetchRetryDelaysMs = [250, 1_000];
+const fetchTimeoutMs = 30_000;
+const retryableHttpStatuses = new Set([408, 425, 429, 500, 502, 503, 504]);
+
+function httpResponseError(response, url) {
+  const status = [response.status, response.statusText].filter(Boolean).join(' ');
+  return new Error(`${status}: ${url}`);
+}
 
 function parseJsonFile(file) {
   return JSON.parse(fs.readFileSync(path.join(repoRoot, file), 'utf8'));
@@ -32,12 +40,46 @@ function compareVersions(left, right) {
   return 0;
 }
 
+function parseSha256Digest(value) {
+  const match = /^sha256:([0-9a-f]{64})$/i.exec(String(value || ''));
+  return match?.[1].toLowerCase();
+}
+
+function releaseAssetHashes(release) {
+  return Object.fromEntries(
+    (release?.assets || [])
+      .map(asset => {
+        const digest = parseSha256Digest(asset.digest);
+        return digest && typeof asset.browser_download_url === 'string'
+          ? [asset.browser_download_url, digest]
+          : undefined;
+      })
+      .filter(Boolean),
+  );
+}
+
+function providerAssetHashes({ ytDlp, deno, aria2 }) {
+  return {
+    ...releaseAssetHashes(ytDlp),
+    ...releaseAssetHashes(deno),
+    ...releaseAssetHashes(aria2),
+  };
+}
+
+function npmExecutable(platform = process.platform) {
+  return platform === 'win32' ? 'npm.cmd' : 'npm';
+}
+
 function npmOutdated(cwd) {
   if (!fs.existsSync(path.join(cwd, 'package.json'))) {
     throw new Error(`npm workspace is missing package.json: ${cwd}`);
   }
   try {
-    execFileSync('npm', ['outdated', '--json'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    execFileSync(npmExecutable(), ['outdated', '--json'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
     return {};
   } catch (error) {
     if (error.status !== 1) {
@@ -50,25 +92,67 @@ function npmOutdated(cwd) {
 }
 
 async function fetchJson(url) {
-  const response = await fetch(url, { headers: { 'User-Agent': userAgent } });
-  if (!response.ok) throw new Error(`${response.status} ${response.statusText}: ${url}`);
-  return response.json();
+  return fetchWithContext(url, response => response.json());
 }
 
 async function fetchText(url) {
-  const response = await fetch(url, { headers: { 'User-Agent': userAgent } });
-  if (!response.ok) throw new Error(`${response.status} ${response.statusText}: ${url}`);
-  return response.text();
+  return fetchWithContext(url, response => response.text());
+}
+
+async function fetchWithContext(url, readResponse) {
+  let lastError;
+  for (let attempt = 0; attempt <= fetchRetryDelaysMs.length; attempt += 1) {
+    let response;
+    try {
+      response = await fetch(url, {
+        headers: { 'User-Agent': userAgent },
+        signal: AbortSignal.timeout(fetchTimeoutMs),
+      });
+    } catch (error) {
+      lastError = error;
+      if (attempt === fetchRetryDelaysMs.length) break;
+      await new Promise(resolve => setTimeout(resolve, fetchRetryDelaysMs[attempt]));
+      continue;
+    }
+
+    if (!response.ok) {
+      const error = httpResponseError(response, url);
+      if (!retryableHttpStatuses.has(response.status) || attempt === fetchRetryDelaysMs.length) {
+        await response.body?.cancel();
+        throw error;
+      }
+      await response.body?.cancel();
+      lastError = error;
+      await new Promise(resolve => setTimeout(resolve, fetchRetryDelaysMs[attempt]));
+      continue;
+    }
+
+    try {
+      return await readResponse(response);
+    } catch (error) {
+      lastError = error;
+      if (attempt === fetchRetryDelaysMs.length) break;
+      await new Promise(resolve => setTimeout(resolve, fetchRetryDelaysMs[attempt]));
+    }
+  }
+  const detail = lastError instanceof Error ? lastError.message : String(lastError);
+  throw new Error(`fetch failed for ${url}: ${detail}`, { cause: lastError });
 }
 
 async function githubLatest(repo) {
-  return fetchJson(`https://api.github.com/repos/${repo}/releases/latest`);
+  const release = await fetchJson(`https://api.github.com/repos/${repo}/releases/latest`);
+  if (!release || Array.isArray(release) || typeof release.tag_name !== 'string' || !release.tag_name.trim()) {
+    throw new Error(`GitHub latest release response for ${repo} has no usable tag_name`);
+  }
+  return release;
 }
 
 async function latestFfmpegStable() {
   const html = await fetchText('https://ffmpeg.org/releases/');
   const versions = [...html.matchAll(/ffmpeg-(\d+\.\d+(?:\.\d+)?)\.tar\.xz/g)].map(match => match[1]);
-  return [...new Set(versions)].sort(compareVersions).at(-1);
+  const latest = [...new Set(versions)].sort(compareVersions).at(-1);
+  if (!latest) throw new Error('FFmpeg release page contained no usable stable release version');
+  return latest;
 }
 
 async function latestMartinRiedlMacArm64Release() {
@@ -105,15 +189,21 @@ async function latestBtbnFfmpegN81Build() {
           target: match[2] === 'win64' ? 'windows' : 'linux',
           version: match[1],
           url: asset.browser_download_url,
+          sha256: parseSha256Digest(asset.digest),
         };
       })
       .filter(Boolean);
     const unique = [...new Set(assets.map(asset => asset.version))];
     const byTarget = Object.fromEntries(assets.map(asset => [asset.target, asset]));
-    if (unique.length === 1 && byTarget.windows && byTarget.linux) {
+    if (
+      unique.length === 1 &&
+      byTarget.windows?.sha256 &&
+      byTarget.linux?.sha256
+    ) {
       return {
         version: unique[0],
         urls: { windows: byTarget.windows.url, linux: byTarget.linux.url },
+        hashes: { windows: byTarget.windows.sha256, linux: byTarget.linux.sha256 },
       };
     }
   }
@@ -137,7 +227,7 @@ function sourceEngineVersions(sourceLock) {
   const rows = [];
   for (const [target, engines] of Object.entries(sourceLock.targets || {})) {
     for (const [engine, meta] of Object.entries(engines)) {
-      rows.push({ target, engine, version: meta.version, url: meta.url });
+      rows.push({ target, engine, version: meta.version, url: meta.url, sha256: meta.sha256 });
     }
   }
   return rows;
@@ -147,26 +237,58 @@ function packagedEngineVersions(engineLock) {
   const rows = [];
   for (const [target, targetLock] of Object.entries(engineLock.targets || {})) {
     for (const [engine, meta] of Object.entries(targetLock.engines || {})) {
-      rows.push({ target, engine, version: meta.version, url: meta.url });
+      rows.push({ target, engine, version: meta.version, url: meta.url, sha256: meta.sha256 });
     }
   }
   return rows;
 }
 
-function checkRows(rows, latestByEngine, latestByTargetEngine = {}, latestUrlsByTargetEngine = {}) {
+function unavailableLatestVersionError(target, engine, targetSpecific) {
+  const error = new Error(
+    `${targetSpecific ? 'Latest provider version' : 'Latest version'} is unavailable for ${target} ${engine}`
+  );
+  error.code = 'LATEST_VERSION_UNAVAILABLE';
+  return error;
+}
+
+function checkRows(
+  rows,
+  latestByEngine,
+  latestByTargetEngine = {},
+  latestUrlsByTargetEngine = {},
+  targetSpecificEngines = new Set(),
+  latestHashesByTargetEngine = {},
+  latestHashesByUrl = {},
+) {
   let outdated = 0;
   for (const row of rows) {
-    const latest = latestByTargetEngine[`${row.target}:${row.engine}`] || latestByEngine[row.engine];
-    if (!latest) continue;
+    const targetSpecific = targetSpecificEngines.has(row.engine);
+    const targetKey = `${row.target}:${row.engine}`;
+    const latest = targetSpecific
+      ? latestByTargetEngine[targetKey]
+      : latestByTargetEngine[targetKey] || latestByEngine[row.engine];
+    if (typeof latest !== 'string' || !latest.trim()) {
+      throw unavailableLatestVersionError(row.target, row.engine, targetSpecific);
+    }
     const current = normalizeVersion(row.version);
     const wanted = normalizeVersion(latest);
-    const latestUrl = latestUrlsByTargetEngine[`${row.target}:${row.engine}`];
+    const latestUrl = latestUrlsByTargetEngine[targetKey];
     const versionOutdated = compareVersions(current, wanted) < 0;
     const sourceOutdated = Boolean(latestUrl && row.url && row.url !== latestUrl);
-    const status = versionOutdated ? 'outdated' : sourceOutdated ? 'source-outdated' : 'current';
+    const latestHash = latestHashesByTargetEngine[targetKey] || latestHashesByUrl[row.url];
+    const currentHash = typeof row.sha256 === 'string' ? row.sha256.toLowerCase() : '';
+    const hashOutdated = Boolean(latestHash && currentHash !== latestHash);
+    const status = versionOutdated
+      ? 'outdated'
+      : sourceOutdated
+        ? 'source-outdated'
+        : hashOutdated
+          ? 'hash-outdated'
+          : 'current';
     if (status !== 'current') outdated += 1;
     console.log(`  ${row.target} ${row.engine}: ${current} -> ${wanted} ${status}`);
     if (sourceOutdated) console.log(`    source: ${row.url} -> ${latestUrl}`);
+    if (hashOutdated) console.log(`    sha256: ${row.sha256 || 'missing'} -> ${latestHash}`);
   }
   return outdated;
 }
@@ -180,72 +302,158 @@ async function main() {
     npmOutdated(path.join(repoRoot, 'Extensions', 'Browser'))
   );
 
-  const [
-    ytDlp,
-    deno,
-    aria2,
-    ffmpeg,
-    martinRiedlMacArm64Ffmpeg,
-    martinRiedlMacArm64Snapshot,
-    btbnFfmpegN81Build,
-  ] = await Promise.all([
-    githubLatest('yt-dlp/yt-dlp'),
-    githubLatest('denoland/deno'),
-    githubLatest('aria2/aria2'),
-    latestFfmpegStable(),
-    latestMartinRiedlMacArm64Release(),
-    latestMartinRiedlMacArm64Snapshot(),
-    latestBtbnFfmpegN81Build(),
-  ]);
+  const providerChecks = [
+    ['yt-dlp latest release', () => githubLatest('yt-dlp/yt-dlp')],
+    ['Deno latest release', () => githubLatest('denoland/deno')],
+    ['aria2 latest release', () => githubLatest('aria2/aria2')],
+    [
+      'FFmpeg stable release',
+      async () => {
+        const version = await latestFfmpegStable();
+        if (!version) throw new Error('FFmpeg release provider response has no usable version');
+        return version;
+      },
+    ],
+    [
+      'Martin Riedl macOS release',
+      async () => {
+        const version = await latestMartinRiedlMacArm64Release();
+        if (!version) throw new Error('Martin Riedl macOS release provider response has no usable version');
+        return version;
+      },
+    ],
+    [
+      'Martin Riedl macOS snapshot',
+      async () => {
+        const build = await latestMartinRiedlMacArm64Snapshot();
+        if (!build?.version || !build.url) {
+          throw new Error('Martin Riedl FFmpeg provider response has no complete macOS arm64 snapshot');
+        }
+        return build;
+      },
+    ],
+    [
+      'BtbN FFmpeg Windows/Linux build',
+      async () => {
+        const build = await latestBtbnFfmpegN81Build();
+        if (
+          !build?.version ||
+          !build.urls?.windows ||
+          !build.urls?.linux ||
+          !build.hashes?.windows ||
+          !build.hashes?.linux
+        ) {
+          throw new Error('BtbN FFmpeg provider response has no complete Windows/Linux build with SHA-256 digests');
+        }
+        return build;
+      },
+    ],
+  ];
+  const providerResults = await Promise.allSettled(providerChecks.map(([, check]) => check()));
+  const providerFailures = [];
+  for (const [index, [label]] of providerChecks.entries()) {
+    const result = providerResults[index];
+    if (result.status === 'rejected') {
+      const detail = result.reason instanceof Error ? result.reason.message : String(result.reason);
+      providerFailures.push(label);
+      console.error(`provider unavailable: ${label}: ${detail}`);
+    }
+  }
+  const providerValue = index =>
+    providerResults[index].status === 'fulfilled' ? providerResults[index].value : undefined;
+  const ytDlp = providerValue(0);
+  const deno = providerValue(1);
+  const aria2 = providerValue(2);
+  const ffmpeg = providerValue(3);
+  const martinRiedlMacArm64Snapshot = providerValue(5);
+  const btbnFfmpegN81Build = providerValue(6);
   const latestByEngine = {
-    'yt-dlp': ytDlp.tag_name,
-    deno: deno.tag_name,
-    aria2c: aria2.tag_name,
+    'yt-dlp': ytDlp?.tag_name,
+    deno: deno?.tag_name,
+    aria2c: aria2?.tag_name,
     ffmpeg,
   };
-  const latestByTargetEngine = {
-    'x86_64-pc-windows-msvc:ffmpeg': btbnFfmpegN81Build?.version || ffmpeg,
-    'x86_64-unknown-linux-gnu:ffmpeg': btbnFfmpegN81Build?.version || ffmpeg,
-    'aarch64-apple-darwin:ffmpeg': martinRiedlMacArm64Snapshot?.version || martinRiedlMacArm64Ffmpeg,
-  };
-  const latestUrlsByTargetEngine = {
-    'x86_64-pc-windows-msvc:ffmpeg': btbnFfmpegN81Build?.urls.windows,
-    'x86_64-unknown-linux-gnu:ffmpeg': btbnFfmpegN81Build?.urls.linux,
-    'aarch64-apple-darwin:ffmpeg': martinRiedlMacArm64Snapshot?.url,
-  };
+  const latestByTargetEngine = {};
+  const latestUrlsByTargetEngine = {};
+  const latestHashesByTargetEngine = {};
+  const latestHashesByUrl = providerAssetHashes({ ytDlp, deno, aria2 });
+  if (btbnFfmpegN81Build?.version && btbnFfmpegN81Build.urls?.windows && btbnFfmpegN81Build.urls?.linux) {
+    latestByTargetEngine['x86_64-pc-windows-msvc:ffmpeg'] = btbnFfmpegN81Build.version;
+    latestByTargetEngine['x86_64-unknown-linux-gnu:ffmpeg'] = btbnFfmpegN81Build.version;
+    latestUrlsByTargetEngine['x86_64-pc-windows-msvc:ffmpeg'] = btbnFfmpegN81Build.urls.windows;
+    latestUrlsByTargetEngine['x86_64-unknown-linux-gnu:ffmpeg'] = btbnFfmpegN81Build.urls.linux;
+    latestHashesByTargetEngine['x86_64-pc-windows-msvc:ffmpeg'] = btbnFfmpegN81Build.hashes?.windows;
+    latestHashesByTargetEngine['x86_64-unknown-linux-gnu:ffmpeg'] = btbnFfmpegN81Build.hashes?.linux;
+  }
+  if (martinRiedlMacArm64Snapshot?.version && martinRiedlMacArm64Snapshot.url) {
+    latestByTargetEngine['aarch64-apple-darwin:ffmpeg'] = martinRiedlMacArm64Snapshot.version;
+    latestUrlsByTargetEngine['aarch64-apple-darwin:ffmpeg'] = martinRiedlMacArm64Snapshot.url;
+  }
+  const displayVersion = value => (value ? normalizeVersion(value) : 'unavailable');
 
   console.log('\nlatest engines:');
   for (const [engine, version] of Object.entries(latestByEngine)) {
-    console.log(`  ${engine}: ${normalizeVersion(version)}`);
+    console.log(`  ${engine}: ${displayVersion(version)}`);
   }
   console.log('\nlatest engine provider builds:');
-  console.log(`  BtbN FFmpeg n8.1 Windows/Linux: ${normalizeVersion(btbnFfmpegN81Build?.version || ffmpeg)}`);
-  console.log(`  Martin Riedl FFmpeg macOS arm64 snapshot: ${normalizeVersion(martinRiedlMacArm64Snapshot?.version || martinRiedlMacArm64Ffmpeg)}`);
+  console.log(`  BtbN FFmpeg n8.1 Windows/Linux: ${displayVersion(btbnFfmpegN81Build?.version)}`);
+  console.log(`  Martin Riedl FFmpeg macOS arm64 snapshot: ${displayVersion(martinRiedlMacArm64Snapshot?.version)}`);
+
+  const targetSpecificEngines = new Set(['ffmpeg']);
+  const engineCheckFailures = [];
+  const runEngineCheck = (label, rows) => {
+    try {
+      return checkRows(
+        rows,
+        latestByEngine,
+        latestByTargetEngine,
+        latestUrlsByTargetEngine,
+        targetSpecificEngines,
+        latestHashesByTargetEngine,
+        latestHashesByUrl,
+      );
+    } catch (error) {
+      if (error?.code !== 'LATEST_VERSION_UNAVAILABLE') throw error;
+      const detail = error instanceof Error ? error.message : String(error);
+      engineCheckFailures.push(label);
+      console.error(`engine provider unavailable: ${label}: ${detail}`);
+      return 0;
+    }
+  };
 
   console.log('\nengine source lock:');
-  outdatedCount += checkRows(
+  outdatedCount += runEngineCheck(
+    'engine source lock',
     sourceEngineVersions(parseJsonFile('engine-sources.lock.json')),
-    latestByEngine,
-    latestByTargetEngine,
-    latestUrlsByTargetEngine
   );
 
   console.log('\npackaged engine lock:');
-  outdatedCount += checkRows(
+  outdatedCount += runEngineCheck(
+    'packaged engine lock',
     packagedEngineVersions(parseJsonFile('engines.lock.json')),
-    latestByEngine,
-    latestByTargetEngine,
-    latestUrlsByTargetEngine
   );
 
   if (outdatedCount > 0) {
     console.error(`\n${outdatedCount} outdated item(s) found.`);
     process.exit(1);
   }
+  if (providerFailures.length > 0) {
+    console.error(`\n${providerFailures.length} provider check(s) unavailable; refusing to claim that all updates are current.`);
+  }
+  if (engineCheckFailures.length > 0) {
+    console.error(`\n${engineCheckFailures.length} engine lock check(s) unavailable; refusing to claim that all engines are current.`);
+  }
+  if (providerFailures.length > 0 || engineCheckFailures.length > 0) {
+    process.exit(1);
+  }
   console.log('\nAll checked packages and engines are current.');
 }
 
-main().catch(error => {
-  console.error(error instanceof Error ? error.message : error);
-  process.exit(1);
-});
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch(error => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+  });
+}
+
+export { checkRows, fetchJson, fetchText, fetchWithContext, npmExecutable, providerAssetHashes };

scripts/check-updates.node-test.js

@@ -0,0 +1,119 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+
+import { checkRows, fetchJson, fetchText, npmExecutable, providerAssetHashes } from './check-updates.js';
+
+async function withMockFetch(mockFetch, callback) {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = mockFetch;
+  try {
+    return await callback();
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+}
+
+test('fetchJson retries transient HTTP responses before succeeding', async () => {
+  let attempts = 0;
+  const result = await withMockFetch(async () => {
+    attempts += 1;
+    if (attempts < 3) return new Response('temporarily unavailable', { status: 503 });
+    return new Response(JSON.stringify({ status: 'ok' }), {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }, () => fetchJson('https://example.test/releases'));
+
+  assert.deepEqual(result, { status: 'ok' });
+  assert.equal(attempts, 3);
+});
+
+test('fetchText does not retry terminal HTTP responses', async () => {
+  let attempts = 0;
+  await assert.rejects(
+    () =>
+      withMockFetch(async () => {
+        attempts += 1;
+        return new Response('not found', { status: 404 });
+      }, () => fetchText('https://example.test/missing')),
+    /404: https:\/\/example\.test\/missing/
+  );
+  assert.equal(attempts, 1);
+});
+
+test('checkRows fails closed when a latest version is unavailable', () => {
+  assert.throws(
+    () =>
+      checkRows(
+        [{ target: 'test-target', engine: 'test-engine', version: '1.0.0', url: 'https://example.test/engine' }],
+        {}
+      ),
+    /Latest version is unavailable for test-target test-engine/
+  );
+});
+
+test('checkRows does not fall back to the generic release for target-specific engines', () => {
+  assert.throws(
+    () =>
+      checkRows(
+        [{ target: 'test-target', engine: 'ffmpeg', version: '8.1.2', url: 'https://example.test/engine' }],
+        { ffmpeg: '9.0.1' },
+        {},
+        {},
+        new Set(['ffmpeg'])
+      ),
+    /Latest provider version is unavailable for test-target ffmpeg/
+  );
+});
+
+test('checkRows detects a provider hash change when version and URL are current', () => {
+  const outdated = checkRows(
+    [{
+      target: 'test-target',
+      engine: 'test-engine',
+      version: '1.0.0',
+      url: 'https://example.test/engine',
+      sha256: 'a'.repeat(64),
+    }],
+    { 'test-engine': '1.0.0' },
+    {},
+    {},
+    new Set(),
+    {},
+    { 'https://example.test/engine': 'b'.repeat(64) },
+  );
+
+  assert.equal(outdated, 1);
+});
+
+test('checkRows detects an aria2 asset digest change when the provider supplies it', () => {
+  const url = 'https://github.com/aria2/aria2/releases/download/release-1.37.0/aria2-1.37.0-win-64bit-build1.zip';
+  const digest = 'b'.repeat(64);
+  const hashes = providerAssetHashes({
+    aria2: { assets: [{ browser_download_url: url, digest: `sha256:${digest}` }] },
+  });
+
+  const outdated = checkRows(
+    [{
+      target: 'x86_64-pc-windows-msvc',
+      engine: 'aria2c',
+      version: '1.37.0',
+      url,
+      sha256: 'a'.repeat(64),
+    }],
+    { aria2c: '1.37.0' },
+    {},
+    {},
+    new Set(),
+    {},
+    hashes,
+  );
+
+  assert.equal(outdated, 1);
+});
+
+test('npm executable selection uses the Windows command shim when needed', () => {
+  assert.equal(npmExecutable('win32'), 'npm.cmd');
+  assert.equal(npmExecutable('darwin'), 'npm');
+  assert.equal(npmExecutable('linux'), 'npm');
+});

scripts/engine-download.js

@@ -0,0 +1,243 @@
+import fs from 'node:fs';
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+import { sha256 } from './engine-payload-integrity.js';
+
+const DEFAULT_ATTEMPTS = 3;
+const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
+const DEFAULT_RETRY_DELAYS_MS = [2_000, 5_000];
+const FILE_RESET_RETRY_DELAYS_MS = [100, 250, 500, 1_000, 2_000];
+
+function parseContentRange(value) {
+  const match = /^bytes (\d+)-(\d+)\/(\d+|\*)$/.exec(value || '');
+  if (!match) return undefined;
+  const start = Number(match[1]);
+  const end = Number(match[2]);
+  const total = match[3] === '*' ? undefined : Number(match[3]);
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || end < start) {
+    return undefined;
+  }
+  if (total !== undefined && (!Number.isSafeInteger(total) || end >= total)) {
+    return undefined;
+  }
+  return { start, end, total };
+}
+
+function responseLength(response) {
+  const value = response.headers.get('content-length');
+  if (!value || !/^\d+$/.test(value)) return undefined;
+  const length = Number(value);
+  return Number.isSafeInteger(length) ? length : undefined;
+}
+
+function createDownloadTimeout(idleTimeoutMs) {
+  const controller = new AbortController();
+  let timer;
+  const refresh = () => {
+    clearTimeout(timer);
+    timer = setTimeout(() => {
+      controller.abort(new Error(`Download idle for ${idleTimeoutMs}ms`));
+    }, idleTimeoutMs);
+  };
+  const dispose = () => clearTimeout(timer);
+  refresh();
+  return { signal: controller.signal, refresh, dispose };
+}
+
+function abortReason(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  return new Error('Engine archive download aborted');
+}
+
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortReason(signal);
+}
+
+function combineAbortSignals(signals) {
+  const activeSignals = signals.filter(Boolean);
+  const controller = new AbortController();
+  const listeners = [];
+  const abort = signal => {
+    if (!controller.signal.aborted) controller.abort(abortReason(signal));
+  };
+
+  for (const signal of activeSignals) {
+    const listener = () => abort(signal);
+    listeners.push([signal, listener]);
+    if (signal.aborted) abort(signal);
+    else signal.addEventListener('abort', listener, { once: true });
+  }
+
+  return {
+    signal: controller.signal,
+    dispose() {
+      for (const [signal, listener] of listeners) {
+        signal.removeEventListener('abort', listener);
+      }
+    },
+  };
+}
+
+function archiveSize(archive) {
+  try {
+    return fs.statSync(archive).size;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return 0;
+    throw error;
+  }
+}
+
+function checksumMismatchError(name, expected, actual) {
+  const error = new Error(`Archive checksum mismatch for ${name}. Expected ${expected}, got ${actual}`);
+  error.code = 'ARCHIVE_CHECKSUM_MISMATCH';
+  return error;
+}
+
+function sleep(milliseconds, signal) {
+  if (!signal) return new Promise(resolve => setTimeout(resolve, milliseconds));
+  return new Promise((resolve, reject) => {
+    let timer;
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal.removeEventListener('abort', onAbort);
+    };
+    const finish = () => {
+      cleanup();
+      resolve();
+    };
+    const onAbort = () => {
+      cleanup();
+      reject(abortReason(signal));
+    };
+    timer = setTimeout(finish, milliseconds);
+    signal.addEventListener('abort', onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+}
+
+async function resetArchive(archive) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      fs.rmSync(archive, { force: true });
+      return;
+    } catch (error) {
+      const retryable = process.platform === 'win32'
+        && ['EACCES', 'EBUSY', 'EPERM'].includes(error?.code);
+      if (!retryable || attempt >= FILE_RESET_RETRY_DELAYS_MS.length) throw error;
+      await sleep(FILE_RESET_RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
+
+/**
+ * Download and checksum an engine archive, resuming an interrupted response
+ * when the provider honors HTTP range requests. A provider that ignores the
+ * range is handled safely by replacing the partial file instead of appending
+ * a second full archive to it.
+ */
+export async function downloadEngineArchive({
+  name,
+  url,
+  archive,
+  expectedSha256,
+  attempts = DEFAULT_ATTEMPTS,
+  idleTimeoutMs = DEFAULT_IDLE_TIMEOUT_MS,
+  retryDelaysMs = DEFAULT_RETRY_DELAYS_MS,
+  signal,
+}) {
+  let lastError;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    throwIfAborted(signal);
+    const partialSize = archiveSize(archive);
+    if (partialSize > 0 && sha256(archive) === expectedSha256) return archive;
+    const downloadTimeout = createDownloadTimeout(idleTimeoutMs);
+    const requestSignal = combineAbortSignals([signal, downloadTimeout.signal]);
+    let resetForRetry = false;
+
+    try {
+      const response = await fetch(url, {
+        headers: partialSize > 0 ? { Range: `bytes=${partialSize}-` } : undefined,
+        redirect: 'follow',
+        signal: requestSignal.signal,
+      });
+
+      if (response.status === 416 && partialSize > 0) {
+        await response.body?.cancel();
+        resetForRetry = true;
+        throw new Error(`Retained partial archive range is not satisfiable for ${name}`);
+      }
+
+      if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        throw new Error(`Failed to download ${name}: HTTP ${response.status}`);
+      }
+
+      const contentRange = response.status === 206
+        ? parseContentRange(response.headers.get('content-range'))
+        : undefined;
+      if (response.status === 206 && (!contentRange || contentRange.start !== partialSize)) {
+        await response.body.cancel();
+        throw new Error(`Invalid Content-Range while downloading ${name}`);
+      }
+
+      const append = response.status === 206 && partialSize > 0;
+      const expectedResponseLength = responseLength(response);
+      if (!append && partialSize > 0) {
+        // The provider ignored Range and returned the complete archive.
+        await resetArchive(archive);
+      }
+
+      await pipeline(
+        Readable.fromWeb(response.body),
+        new Transform({
+          transform(chunk, encoding, callback) {
+            downloadTimeout.refresh();
+            callback(null, chunk, encoding);
+          },
+        }),
+        fs.createWriteStream(archive, { flags: append ? 'a' : 'w' }),
+        { signal: requestSignal.signal },
+      );
+
+      throwIfAborted(signal);
+      const finalSize = archiveSize(archive);
+      const expectedFinalSize = contentRange?.total
+        ?? (expectedResponseLength === undefined
+          ? undefined
+          : (append ? partialSize + expectedResponseLength : expectedResponseLength));
+      if (expectedFinalSize !== undefined && finalSize !== expectedFinalSize) {
+        throw new Error(
+          `Incomplete archive for ${name}: expected ${expectedFinalSize} bytes, got ${finalSize}`,
+        );
+      }
+
+      const actual = sha256(archive);
+      if (actual === expectedSha256) return archive;
+
+      resetForRetry = true;
+      throw checksumMismatchError(name, expectedSha256, actual);
+    } catch (error) {
+      if (signal?.aborted) throw abortReason(signal);
+      lastError = error;
+      if (resetForRetry || error?.code === 'ARCHIVE_CHECKSUM_MISMATCH') {
+        await resetArchive(archive);
+      }
+      if (attempt === attempts) {
+        throw new Error(
+          `Failed to download ${name} after ${attempts} attempts: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+          { cause: error },
+        );
+      }
+      await sleep(retryDelaysMs[attempt - 1] ?? 0, signal);
+    } finally {
+      requestSignal.dispose();
+      downloadTimeout.dispose();
+    }
+  }
+
+  throw lastError;
+}

scripts/engine-download.node-test.js

@@ -0,0 +1,227 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { test } from 'node:test';
+
+import { downloadEngineArchive } from './engine-download.js';
+
+async function withMockFetch(mockFetch, callback) {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = mockFetch;
+  try {
+    return await callback();
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+}
+
+function makeBody(chunks, failure) {
+  return new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) controller.enqueue(Buffer.from(chunk));
+      if (failure) controller.error(failure);
+      else controller.close();
+    },
+  });
+}
+
+function makeArchivePath() {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-engine-download-'));
+  return {
+    directory,
+    archive: path.join(directory, 'engine.zip'),
+  };
+}
+
+function digest(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+test('resumes an interrupted archive response from the retained partial file', async () => {
+  const { directory, archive } = makeArchivePath();
+  const full = Buffer.from('complete archive payload');
+  const prefix = full.subarray(0, 8);
+  const middle = full.subarray(8, 15);
+  const suffix = full.subarray(15);
+  fs.writeFileSync(archive, Buffer.concat([prefix, middle]));
+  const ranges = [];
+  let calls = 0;
+
+  try {
+    await withMockFetch(async (_url, options) => {
+      calls += 1;
+      ranges.push(options.headers?.Range);
+      if (calls === 1) {
+        return new Response(makeBody([], new Error('connection reset')), {
+          status: 206,
+          headers: {
+            'Content-Length': String(suffix.length),
+            'Content-Range': `bytes ${prefix.length + middle.length}-${full.length - 1}/${full.length}`,
+          },
+        });
+      }
+      return new Response(makeBody([suffix]), {
+        status: 206,
+        headers: {
+          'Content-Length': String(suffix.length),
+          'Content-Range': `bytes ${prefix.length + middle.length}-${full.length - 1}/${full.length}`,
+        },
+      });
+    }, async () => {
+      await downloadEngineArchive({
+        name: 'test',
+        url: 'https://example.test/engine.zip',
+        archive,
+        expectedSha256: digest(full),
+        attempts: 2,
+        retryDelaysMs: [0],
+      });
+    });
+
+    assert.deepEqual(
+      ranges,
+      [`bytes=${prefix.length + middle.length}-`, `bytes=${prefix.length + middle.length}-`],
+    );
+    assert.deepEqual(fs.readFileSync(archive), full);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('replaces a partial archive when the provider ignores the Range request', async () => {
+  const { directory, archive } = makeArchivePath();
+  const full = Buffer.from('complete archive after range fallback');
+  fs.writeFileSync(archive, Buffer.from('stale partial bytes'));
+  let requestedRange;
+
+  try {
+    await withMockFetch(async (_url, options) => {
+      requestedRange = options.headers?.Range;
+      return new Response(full, {
+        status: 200,
+        headers: { 'Content-Length': String(full.length) },
+      });
+    }, async () => {
+      await downloadEngineArchive({
+        name: 'test',
+        url: 'https://example.test/engine.zip',
+        archive,
+        expectedSha256: digest(full),
+        attempts: 1,
+      });
+    });
+
+    assert.equal(requestedRange, 'bytes=19-');
+    assert.deepEqual(fs.readFileSync(archive), full);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('accepts a complete retained archive without issuing an unsatisfiable range', async () => {
+  const { directory, archive } = makeArchivePath();
+  const full = Buffer.from('complete archive retained after a late connection reset');
+  fs.writeFileSync(archive, full);
+  let calls = 0;
+
+  try {
+    await withMockFetch(async () => {
+      calls += 1;
+      throw new Error('fetch should not be called for a complete retained archive');
+    }, async () => {
+      await downloadEngineArchive({
+        name: 'test',
+        url: 'https://example.test/engine.zip',
+        archive,
+        expectedSha256: digest(full),
+        attempts: 1,
+      });
+    });
+
+    assert.equal(calls, 0);
+    assert.deepEqual(fs.readFileSync(archive), full);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('restarts from zero after an unsatisfiable retained range', async () => {
+  const { directory, archive } = makeArchivePath();
+  const full = Buffer.from('complete archive after a stale range response');
+  fs.writeFileSync(archive, Buffer.from('stale partial bytes'));
+  const ranges = [];
+  let calls = 0;
+
+  try {
+    await withMockFetch(async (_url, options) => {
+      calls += 1;
+      ranges.push(options.headers?.Range);
+      if (calls === 1) return new Response(null, { status: 416 });
+      return new Response(full, {
+        status: 200,
+        headers: { 'Content-Length': String(full.length) },
+      });
+    }, async () => {
+      await downloadEngineArchive({
+        name: 'test',
+        url: 'https://example.test/engine.zip',
+        archive,
+        expectedSha256: digest(full),
+        attempts: 2,
+        retryDelaysMs: [0],
+      });
+    });
+
+    assert.deepEqual(ranges, ['bytes=19-', undefined]);
+    assert.deepEqual(fs.readFileSync(archive), full);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('propagates external cancellation without retrying an in-flight archive', async () => {
+  const { directory, archive } = makeArchivePath();
+  const abortController = new AbortController();
+  let calls = 0;
+
+  try {
+    await withMockFetch(async (_url, options) => {
+      calls += 1;
+      assert.equal(options.signal.aborted, false);
+      setTimeout(() => {
+        abortController.abort(new Error('provisioning interrupted'));
+      }, 10);
+      return new Response(new ReadableStream({
+        start(controller) {
+          controller.enqueue(Buffer.from('partial archive bytes'));
+        },
+      }), {
+        status: 200,
+        headers: { 'Content-Length': '100' },
+      });
+    }, async () => {
+      await assert.rejects(
+        downloadEngineArchive({
+          name: 'test',
+          url: 'https://example.test/engine.zip',
+          archive,
+          expectedSha256: digest(Buffer.from('never completed')),
+          attempts: 3,
+          retryDelaysMs: [500, 500],
+          signal: abortController.signal,
+        }),
+        error => {
+          assert.match(error.message, /provisioning interrupted/);
+          return true;
+        },
+      );
+    });
+
+    assert.equal(calls, 1);
+    assert.ok(fs.statSync(archive).size > 0);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});

scripts/engine-payload-promotion.js

@@ -0,0 +1,164 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const RETRY_DELAYS_MS = [100, 250, 500, 1_000, 2_000];
+
+function pathExists(value) {
+  try {
+    fs.lstatSync(value);
+    return true;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+function previousPayloadPrefix(destination) {
+  return `.${path.basename(destination)}.previous-`;
+}
+
+function previousPayloads(destination) {
+  const parent = path.dirname(destination);
+  const prefix = previousPayloadPrefix(destination);
+  return fs.readdirSync(parent, { withFileTypes: true })
+    .filter(entry => entry.name.startsWith(prefix))
+    .map(entry => path.join(parent, entry.name));
+}
+
+function previousPayloadOwner(destination, candidate) {
+  const suffix = path.basename(candidate).slice(previousPayloadPrefix(destination).length);
+  const separator = suffix.indexOf('-');
+  const pid = separator >= 0 ? suffix.slice(0, separator) : suffix;
+  return /^\d+$/.test(pid) ? Number(pid) : null;
+}
+
+function isProcessAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === 'EPERM';
+  }
+}
+
+async function removeOrphanedPreviousPayloads(destination) {
+  for (const candidate of previousPayloads(destination)) {
+    const owner = previousPayloadOwner(destination, candidate);
+    if (owner === null || isProcessAlive(owner)) continue;
+    await removePathWithRetry(candidate);
+  }
+}
+
+function provisioningTemporaryPrefix(target) {
+  return `.firelink-engines-${target}-`;
+}
+
+function provisioningTemporaryOwner(target, candidate) {
+  const suffix = path.basename(candidate).slice(provisioningTemporaryPrefix(target).length);
+  const separator = suffix.indexOf('-');
+  const pid = separator >= 0 ? suffix.slice(0, separator) : suffix;
+  return /^\d+$/.test(pid) ? Number(pid) : null;
+}
+
+/**
+ * Removes only staging directories created by a provisioner whose PID is no
+ * longer alive. Legacy directories without an owner PID remain untouched so
+ * a concurrent or ambiguous provisioner can never lose its staging tree.
+ */
+export async function removeOrphanedProvisioningDirectories(destinationParent, target) {
+  const prefix = provisioningTemporaryPrefix(target);
+  for (const entry of fs.readdirSync(destinationParent, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !entry.name.startsWith(prefix)) continue;
+    const candidate = path.join(destinationParent, entry.name);
+    const owner = provisioningTemporaryOwner(target, candidate);
+    if (owner === null || owner === process.pid || isProcessAlive(owner)) continue;
+    await removePathWithRetry(candidate);
+  }
+}
+
+/**
+ * Restores the only previous payload left by a process that died after moving
+ * the destination aside but before publishing its replacement. Multiple
+ * candidates are ambiguous and remain untouched for manual recovery.
+ */
+export function recoverInterruptedPromotion(destination) {
+  if (pathExists(destination)) return;
+
+  const candidates = previousPayloads(destination);
+  if (candidates.length === 0) return;
+  if (candidates.length > 1) {
+    throw new Error(
+      `Cannot recover engine payload at ${destination}: found ${candidates.length} previous payloads`
+    );
+  }
+
+  const candidate = candidates[0];
+  if (!fs.lstatSync(candidate).isDirectory()) {
+    throw new Error(`Cannot recover engine payload from non-directory backup: ${candidate}`);
+  }
+  fs.renameSync(candidate, destination);
+}
+
+function sleep(milliseconds) {
+  return new Promise(resolve => setTimeout(resolve, milliseconds));
+}
+
+export async function removePathWithRetry(value) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      fs.rmSync(value, { recursive: true, force: true });
+      return;
+    } catch (error) {
+      const retryable = process.platform === 'win32'
+        && ['EACCES', 'EBUSY', 'EPERM'].includes(error?.code);
+      if (!retryable || attempt >= RETRY_DELAYS_MS.length) throw error;
+      await sleep(RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
+
+/**
+ * Publishes a fully verified payload without exposing a partially written
+ * directory. The staging directory must share a filesystem with destination.
+ */
+export async function promoteDirectory(staging, destination) {
+  recoverInterruptedPromotion(destination);
+  const stagingStats = fs.lstatSync(staging);
+  if (!stagingStats.isDirectory()) {
+    throw new Error(`Engine payload staging path is not a directory: ${staging}`);
+  }
+
+  const parent = path.dirname(destination);
+  const backup = path.join(
+    parent,
+    `.${path.basename(destination)}.previous-${process.pid}-${process.hrtime.bigint()}`
+  );
+  let movedExisting = false;
+
+  try {
+    if (pathExists(destination)) {
+      fs.renameSync(destination, backup);
+      movedExisting = true;
+    }
+    fs.renameSync(staging, destination);
+  } catch (error) {
+    if (movedExisting && !pathExists(destination) && pathExists(backup)) {
+      try {
+        fs.renameSync(backup, destination);
+      } catch (restoreError) {
+        throw new AggregateError(
+          [error, restoreError],
+          `Failed to publish engine payload and restore the previous payload at ${destination}`
+        );
+      }
+    } else if (movedExisting && pathExists(destination) && pathExists(backup)) {
+      // Another provisioner won the promotion race; discard only our backup.
+      await removePathWithRetry(backup);
+    }
+    throw error;
+  }
+
+  if (movedExisting) await removePathWithRetry(backup);
+  await removeOrphanedPreviousPayloads(destination);
+}

scripts/engine-payload-promotion.node-test.js

@@ -0,0 +1,150 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import {
+  promoteDirectory,
+  recoverInterruptedPromotion,
+  removeOrphanedProvisioningDirectories,
+  removePathWithRetry,
+} from './engine-payload-promotion.js';
+
+function temporaryDirectory() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-payload-promotion-'));
+}
+
+test('promotes a verified staging directory and replaces the previous payload', async () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const staging = path.join(root, 'staging', 'payload');
+    fs.mkdirSync(destination, { recursive: true });
+    fs.writeFileSync(path.join(destination, 'engine'), 'old');
+    fs.mkdirSync(staging, { recursive: true });
+    fs.writeFileSync(path.join(staging, 'engine'), 'new');
+
+    await promoteDirectory(staging, destination);
+
+    assert.equal(fs.readFileSync(path.join(destination, 'engine'), 'utf8'), 'new');
+    assert.equal(fs.existsSync(staging), false);
+    assert.equal(fs.readdirSync(root).some(name => name.includes('.previous-')), false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects an invalid staging path without removing the previous payload', async () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const staging = path.join(root, 'staging-file');
+    fs.mkdirSync(destination, { recursive: true });
+    fs.writeFileSync(path.join(destination, 'engine'), 'old');
+    fs.writeFileSync(staging, 'not a directory');
+
+    await assert.rejects(() => promoteDirectory(staging, destination), /not a directory/);
+    assert.equal(fs.readFileSync(path.join(destination, 'engine'), 'utf8'), 'old');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('recovers one interrupted previous payload before publishing a replacement', async () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const backup = path.join(root, '.target.previous-123-456');
+    const staging = path.join(root, 'staging', 'payload');
+    fs.mkdirSync(backup, { recursive: true });
+    fs.writeFileSync(path.join(backup, 'engine'), 'old');
+    fs.mkdirSync(staging, { recursive: true });
+    fs.writeFileSync(path.join(staging, 'engine'), 'new');
+
+    await promoteDirectory(staging, destination);
+
+    assert.equal(fs.readFileSync(path.join(destination, 'engine'), 'utf8'), 'new');
+    assert.equal(fs.existsSync(backup), false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('fails closed when interrupted recovery has multiple candidates', () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const firstBackup = path.join(root, '.target.previous-123-456');
+    const secondBackup = path.join(root, '.target.previous-789-012');
+    fs.mkdirSync(firstBackup, { recursive: true });
+    fs.mkdirSync(secondBackup, { recursive: true });
+
+    assert.throws(
+      () => recoverInterruptedPromotion(destination),
+      /found 2 previous payloads/
+    );
+    assert.equal(fs.existsSync(destination), false);
+    assert.equal(fs.existsSync(firstBackup), true);
+    assert.equal(fs.existsSync(secondBackup), true);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('removes a temporary payload tree after it becomes disposable', async () => {
+  const root = temporaryDirectory();
+  try {
+    const temporary = path.join(root, 'temporary');
+    fs.mkdirSync(path.join(temporary, 'nested'), { recursive: true });
+    fs.writeFileSync(path.join(temporary, 'nested', 'archive'), 'payload');
+
+    await removePathWithRetry(temporary);
+
+    assert.equal(fs.existsSync(temporary), false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('removes orphaned backups from dead provisioners after a successful publish', async () => {
+  const root = temporaryDirectory();
+  try {
+    const destination = path.join(root, 'target');
+    const orphanedBackup = path.join(root, '.target.previous-999999999-123456');
+    const staging = path.join(root, 'staging', 'payload');
+    fs.mkdirSync(destination, { recursive: true });
+    fs.writeFileSync(path.join(destination, 'engine'), 'old');
+    fs.mkdirSync(orphanedBackup, { recursive: true });
+    fs.writeFileSync(path.join(orphanedBackup, 'engine'), 'orphaned');
+    fs.mkdirSync(staging, { recursive: true });
+    fs.writeFileSync(path.join(staging, 'engine'), 'new');
+
+    await promoteDirectory(staging, destination);
+
+    assert.equal(fs.existsSync(orphanedBackup), false);
+    assert.equal(fs.readFileSync(path.join(destination, 'engine'), 'utf8'), 'new');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('removes only provisioning staging owned by a dead PID', async () => {
+  const root = temporaryDirectory();
+  try {
+    const target = 'x86_64-unknown-linux-gnu';
+    const orphaned = path.join(root, `.firelink-engines-${target}-999999999-dead`);
+    const live = path.join(root, `.firelink-engines-${target}-${process.pid}-live`);
+    const legacy = path.join(root, `.firelink-engines-${target}-legacy`);
+    fs.mkdirSync(orphaned, { recursive: true });
+    fs.mkdirSync(live, { recursive: true });
+    fs.mkdirSync(legacy, { recursive: true });
+
+    await removeOrphanedProvisioningDirectories(root, target);
+
+    assert.equal(fs.existsSync(orphaned), false);
+    assert.equal(fs.existsSync(live), true);
+    assert.equal(fs.existsSync(legacy), true);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

scripts/provision-engines.js

@@ -1,13 +1,21 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
 import { collectRegularFiles, sha256 } from './engine-payload-integrity.js';
+import { downloadEngineArchive } from './engine-download.js';
+import {
+  promoteDirectory,
+  recoverInterruptedPromotion,
+  removeOrphanedProvisioningDirectories,
+  removePathWithRetry,
+} from './engine-payload-promotion.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, '..');
+const execFileAsync = promisify(execFile);
 const sourceLock = JSON.parse(
   fs.readFileSync(path.join(repoRoot, 'engine-sources.lock.json'), 'utf8')
 );
@@ -32,42 +40,61 @@ if (!targetSources) {
 }
 
 const destination = path.join(repoRoot, 'src-tauri', 'provisioned-engines', target);
-const temporary = fs.mkdtempSync(path.join(os.tmpdir(), `firelink-engines-${target}-`));
 const isWindows = target.includes('windows');
 const executableSuffix = isWindows ? '.exe' : '';
+const provisioningAbortController = new AbortController();
+const signalNames = process.platform === 'win32'
+  ? ['SIGINT', 'SIGTERM']
+  : ['SIGINT', 'SIGTERM', 'SIGHUP'];
+const signalHandlers = new Map();
+for (const signalName of signalNames) {
+  const handler = () => {
+    if (!provisioningAbortController.signal.aborted) {
+      provisioningAbortController.abort(new Error(`Engine provisioning interrupted by ${signalName}`));
+    }
+  };
+  signalHandlers.set(signalName, handler);
+  process.on(signalName, handler);
+}
+
+let temporary;
+let payloadDestination;
+
+function throwIfProvisioningAborted() {
+  if (provisioningAbortController.signal.aborted) {
+    throw provisioningAbortController.signal.reason;
+  }
+}
 
 async function download(name, source) {
+  throwIfProvisioningAborted();
   const sourcePath = new URL(source.url).pathname;
   const archive = path.join(
     temporary,
     `${name}${sourcePath.endsWith('.tar.xz') ? '.tar.xz' : '.zip'}`
   );
-  const response = await fetch(source.url, { redirect: 'follow' });
-  if (!response.ok || !response.body) {
-    throw new Error(`Failed to download ${name}: HTTP ${response.status}`);
-  }
-  const output = fs.createWriteStream(archive);
-  const reader = response.body.getReader();
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    if (!output.write(Buffer.from(value))) {
-      await new Promise(resolve => output.once('drain', resolve));
-    }
-  }
-  await new Promise(resolve => output.end(resolve));
-
-  const actual = sha256(archive);
-  if (actual !== source.sha256) {
-    throw new Error(`Archive checksum mismatch for ${name}. Expected ${source.sha256}, got ${actual}`);
-  }
+  await downloadEngineArchive({
+    name,
+    url: source.url,
+    archive,
+    expectedSha256: source.sha256,
+    signal: provisioningAbortController.signal,
+  });
+  throwIfProvisioningAborted();
   const extracted = path.join(temporary, `${name}-extracted`);
   fs.mkdirSync(extracted);
   if (archive.endsWith('.zip') && process.platform !== 'win32') {
-    execFileSync('unzip', ['-q', archive, '-d', extracted], { stdio: 'inherit' });
+    await execFileAsync('unzip', ['-q', archive, '-d', extracted], {
+      stdio: 'inherit',
+      signal: provisioningAbortController.signal,
+    });
   } else {
-    execFileSync('tar', ['-xf', archive, '-C', extracted], { stdio: 'inherit' });
+    await execFileAsync('tar', ['-xf', archive, '-C', extracted], {
+      stdio: 'inherit',
+      signal: provisioningAbortController.signal,
+    });
   }
+  throwIfProvisioningAborted();
   return extracted;
 }
 
@@ -89,13 +116,13 @@ function findFile(root, names) {
 }
 
 function copyExecutable(source, engine) {
-  const output = path.join(destination, `${engine}-${target}${executableSuffix}`);
+  const output = path.join(payloadDestination, `${engine}-${target}${executableSuffix}`);
   fs.copyFileSync(source, output);
   if (!isWindows) fs.chmodSync(output, 0o755);
 }
 
 function writePayloadManifest() {
-  const files = collectRegularFiles(destination, {
+  const files = collectRegularFiles(payloadDestination, {
     ignoredNames: ['payload-manifest.json'],
   });
   const manifest = {
@@ -113,27 +140,36 @@ function writePayloadManifest() {
     ),
     files: Object.fromEntries(
       files.map(file => [
-        path.relative(destination, file).split(path.sep).join('/'),
+        path.relative(payloadDestination, file).split(path.sep).join('/'),
         sha256(file)
       ])
     )
   };
   fs.writeFileSync(
-    path.join(destination, 'payload-manifest.json'),
+    path.join(payloadDestination, 'payload-manifest.json'),
     `${JSON.stringify(manifest, null, 2)}\n`
   );
 }
 
 try {
-  fs.rmSync(destination, { recursive: true, force: true });
-  fs.mkdirSync(destination, { recursive: true });
+  const destinationParent = path.dirname(destination);
+  fs.mkdirSync(destinationParent, { recursive: true });
+  recoverInterruptedPromotion(destination);
+  await removeOrphanedProvisioningDirectories(destinationParent, target);
+  throwIfProvisioningAborted();
+  // Keep staging on the destination filesystem so the final rename is atomic.
+  temporary = fs.mkdtempSync(
+    path.join(destinationParent, `.firelink-engines-${target}-${process.pid}-`)
+  );
+  payloadDestination = path.join(temporary, 'payload');
+  fs.mkdirSync(payloadDestination, { recursive: true });
 
   const ytdlp = await download('yt-dlp', targetSources['yt-dlp']);
   copyExecutable(
     findFile(ytdlp, isWindows ? ['yt-dlp.exe'] : ['yt-dlp_linux']),
     'yt-dlp'
   );
-  fs.cpSync(path.join(ytdlp, '_internal'), path.join(destination, '_internal'), {
+  fs.cpSync(path.join(ytdlp, '_internal'), path.join(payloadDestination, '_internal'), {
     recursive: true,
     preserveTimestamps: true
   });
@@ -148,7 +184,12 @@ try {
   copyExecutable(findFile(aria2, isWindows ? ['aria2c.exe'] : ['aria2c']), 'aria2c');
 
   writePayloadManifest();
+  throwIfProvisioningAborted();
+  await promoteDirectory(payloadDestination, destination);
   console.log(`Provisioned locked engine payload at ${destination}`);
 } finally {
-  fs.rmSync(temporary, { recursive: true, force: true });
+  if (temporary) await removePathWithRetry(temporary);
+  for (const [signalName, handler] of signalHandlers) {
+    process.removeListener(signalName, handler);
+  }
 }

scripts/release-workflow.node-test.js

@@ -0,0 +1,25 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { test } from 'node:test';
+
+const repositoryRoot = path.resolve(import.meta.dirname, '..');
+const releaseWorkflow = fs.readFileSync(
+  path.join(repositoryRoot, '.github', 'workflows', 'release.yml'),
+  'utf8',
+);
+
+test('release Linux dependency installation is mirror-normalized and bounded', () => {
+  assert.match(releaseWorkflow, /azure\\\.archive\\\.ubuntu\\\.com/);
+  assert.equal((releaseWorkflow.match(/Acquire::Retries=3/g) || []).length, 2);
+  assert.equal((releaseWorkflow.match(/timeout --foreground --signal=TERM --kill-after=30s 10m apt-get/g) || []).length, 2);
+  assert.doesNotMatch(releaseWorkflow, /^\s*sudo apt-get (update|install)/m);
+});
+
+test('macOS release verification uses the app mounted from the final DMG', () => {
+  assert.match(releaseWorkflow, /npm run verify:macos-signing -- --dmg "\$DMG"/);
+  assert.match(releaseWorkflow, /hdiutil attach -nobrowse -readonly -mountpoint "\$MOUNT_POINT" "\$DMG"/);
+  assert.match(releaseWorkflow, /find "\$MOUNT_POINT" -maxdepth 1 -type d -name 'Firelink\.app'/);
+  assert.match(releaseWorkflow, /node scripts\/verify-binaries\.js --search-root "\$APP"/);
+  assert.doesNotMatch(releaseWorkflow, /verify:macos-signing -- --app "\$APP" --dmg/);
+});

scripts/smoke-aria2-resolver.js

@@ -0,0 +1,232 @@
+#!/usr/bin/env node
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import http from 'node:http';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const arch = { x64: 'x86_64', arm64: 'aarch64' }[os.arch()];
+const platform = {
+  darwin: 'apple-darwin',
+  linux: 'unknown-linux-gnu',
+  win32: 'pc-windows-msvc',
+}[process.platform];
+if (!arch || !platform) {
+  throw new Error(`Unsupported host: ${os.arch()} / ${process.platform}`);
+}
+const targetTriple = `${arch}-${platform}`;
+const argumentIndex = process.argv.indexOf('--binary');
+const binaryPath = path.resolve(
+  argumentIndex >= 0
+    ? process.argv[argumentIndex + 1]
+    : path.join(
+        repoRoot,
+        'src-tauri',
+        'binaries',
+        `aria2c-${targetTriple}${process.platform === 'win32' ? '.exe' : ''}`,
+      ),
+);
+
+if (!fs.existsSync(binaryPath)) {
+  throw new Error(`Aria2 binary does not exist: ${binaryPath}`);
+}
+
+const wait = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
+
+async function availablePort() {
+  const server = net.createServer();
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen({ host: '127.0.0.1', port: 0 }, resolve);
+  });
+  const address = server.address();
+  const port = address && typeof address !== 'string' ? address.port : undefined;
+  await new Promise(resolve => server.close(resolve));
+  if (!port) throw new Error('Could not reserve a local port');
+  return port;
+}
+
+async function rpc(port, secret, method, params = []) {
+  const response = await fetch(`http://127.0.0.1:${port}/jsonrpc`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      jsonrpc: '2.0',
+      id: crypto.randomUUID(),
+      method,
+      params: [`token:${secret}`, ...params],
+    }),
+    signal: AbortSignal.timeout(3000),
+  });
+  const body = await response.json();
+  if (body.error) throw new Error(`${method}: ${JSON.stringify(body.error)}`);
+  if (!Object.hasOwn(body, 'result')) throw new Error(`${method}: response has no result`);
+  return body.result;
+}
+
+function childExited(child) {
+  return child.exitCode !== null || child.signalCode !== null;
+}
+
+async function waitForChildExit(child, timeoutMs = 3000) {
+  if (childExited(child)) return true;
+  return new Promise(resolve => {
+    let settled = false;
+    let timer;
+    const finish = result => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.off('exit', onExit);
+      resolve(result);
+    };
+    const onExit = () => finish(true);
+    timer = setTimeout(() => finish(false), timeoutMs);
+    child.once('exit', onExit);
+    if (childExited(child)) finish(true);
+  });
+}
+
+async function waitForRpc(port, secret) {
+  const deadline = Date.now() + 10000;
+  let lastError;
+  while (Date.now() < deadline) {
+    try {
+      return await rpc(port, secret, 'aria2.getVersion');
+    } catch (error) {
+      lastError = error;
+      await wait(100);
+    }
+  }
+  throw new Error(`Aria2 RPC did not become ready: ${lastError?.message || 'unknown error'}`);
+}
+
+function bencode(value) {
+  if (Buffer.isBuffer(value)) return Buffer.concat([Buffer.from(`${value.length}:`), value]);
+  if (typeof value === 'string') return bencode(Buffer.from(value));
+  if (typeof value === 'number') return Buffer.from(`i${value}e`);
+  if (value && typeof value === 'object') {
+    const entries = Object.entries(value).sort(([left], [right]) => Buffer.compare(Buffer.from(left), Buffer.from(right)));
+    return Buffer.concat([
+      Buffer.from('d'),
+      ...entries.flatMap(([key, child]) => [bencode(key), bencode(child)]),
+      Buffer.from('e'),
+    ]);
+  }
+  throw new Error(`Unsupported bencode value: ${typeof value}`);
+}
+
+async function stop(child, port, secret) {
+  if (!child || childExited(child)) return;
+  try {
+    await rpc(port, secret, 'aria2.shutdown');
+  } catch {
+    // The process may already have exited.
+  }
+  let exited = await waitForChildExit(child);
+  if (!exited) {
+    if (process.platform === 'win32') {
+      try {
+        execFileSync('taskkill', ['/pid', String(child.pid), '/t', '/f'], {
+          stdio: 'ignore',
+          timeout: 3000,
+        });
+      } catch {
+        // The process may have exited between the timeout and taskkill.
+      }
+    } else {
+      child.kill('SIGTERM');
+    }
+    exited = await waitForChildExit(child);
+  }
+  if (!exited && process.platform !== 'win32') {
+    child.kill('SIGKILL');
+    exited = await waitForChildExit(child);
+  }
+  if (!exited) {
+    throw new Error(`Aria2 process ${child.pid} did not exit after forced cleanup`);
+  }
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-aria2-resolver-'));
+const secret = `firelink-resolver-${crypto.randomUUID()}`;
+const rpcPort = await availablePort();
+const contentServer = http.createServer((_request, response) => {
+  response.writeHead(200, { 'content-length': '1' });
+  response.end('x');
+});
+await new Promise((resolve, reject) => {
+  contentServer.once('error', reject);
+  contentServer.listen({ host: '127.0.0.1', port: 0 }, resolve);
+});
+const contentPort = contentServer.address().port;
+const libraryPath = path.join(path.dirname(binaryPath), 'aria2-libs');
+const environment = fs.existsSync(libraryPath)
+  ? {
+      ...process.env,
+      OPENSSL_MODULES: libraryPath,
+      ...(process.platform === 'darwin' ? { DYLD_LIBRARY_PATH: libraryPath } : {}),
+    }
+  : process.env;
+const child = spawn(binaryPath, [
+  '--enable-rpc=true',
+  `--rpc-listen-port=${rpcPort}`,
+  '--rpc-listen-all=false',
+  `--rpc-secret=${secret}`,
+  `--dir=${tempRoot}`,
+  '--file-allocation=none',
+  '--enable-dht=false',
+  '--console-log-level=error',
+  '--quiet=true',
+], { env: environment, stdio: ['ignore', 'ignore', 'pipe'] });
+let stderr = '';
+child.stderr.on('data', chunk => { stderr += chunk.toString(); });
+
+try {
+  const version = await waitForRpc(rpcPort, secret);
+  const features = Array.isArray(version.enabledFeatures) ? version.enabledFeatures : [];
+  console.log(`[INFO] aria2 ${version.version || 'unknown'}; Async DNS: ${features.includes('Async DNS') ? 'supported' : 'not advertised'}`);
+
+  const uriResult = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${contentPort}/file`], {
+    'async-dns': 'false',
+    out: 'resolver-normal.bin',
+  }]);
+  const uriOptions = await rpc(rpcPort, secret, 'aria2.getOption', [uriResult]);
+  if (uriOptions['async-dns'] !== 'false') {
+    throw new Error(`aria2.addUri did not retain async-dns=false: ${JSON.stringify(uriOptions)}`);
+  }
+
+  const torrent = bencode({
+    info: {
+      length: 1,
+      name: 'resolver-torrent.bin',
+      pieces: Buffer.alloc(20),
+      'piece length': 16384,
+    },
+  }).toString('base64');
+  const torrentResult = await rpc(rpcPort, secret, 'aria2.addTorrent', [torrent, [], {
+    'async-dns': 'false',
+    dir: tempRoot,
+  }]);
+  const torrentOptions = await rpc(rpcPort, secret, 'aria2.getOption', [torrentResult]);
+  if (torrentOptions['async-dns'] !== 'false') {
+    throw new Error(`aria2.addTorrent did not retain async-dns=false: ${JSON.stringify(torrentOptions)}`);
+  }
+
+  console.log('[PASS] Aria2 retained system-resolver mode for normal and Torrent transfers');
+} catch (error) {
+  const detail = stderr.trim();
+  throw new Error(`${error.message}${detail ? `\n${detail}` : ''}`);
+} finally {
+  try {
+    await stop(child, rpcPort, secret);
+  } finally {
+    await new Promise(resolve => contentServer.close(resolve));
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}

scripts/smoke-aria2-transfers.js

@@ -0,0 +1,486 @@
+#!/usr/bin/env node
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import http from 'node:http';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const arch = { x64: 'x86_64', arm64: 'aarch64' }[os.arch()];
+const platform = { darwin: 'apple-darwin', linux: 'unknown-linux-gnu', win32: 'pc-windows-msvc' }[process.platform];
+if (!arch || !platform) throw new Error(`Unsupported host: ${os.arch()} / ${process.platform}`);
+const targetTriple = `${arch}-${platform}`;
+const argumentIndex = process.argv.indexOf('--binary');
+const binaryPath = path.resolve(argumentIndex >= 0
+  ? process.argv[argumentIndex + 1]
+  : path.join(repoRoot, 'src-tauri', 'binaries', `aria2c-${targetTriple}${process.platform === 'win32' ? '.exe' : ''}`));
+if (!fs.existsSync(binaryPath)) throw new Error(`Aria2 binary does not exist: ${binaryPath}`);
+
+const wait = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
+
+async function listen(server) {
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen({ host: '127.0.0.1', port: 0 }, resolve);
+  });
+  const address = server.address();
+  if (!address || typeof address === 'string') throw new Error('Could not allocate local fixture port');
+  return address.port;
+}
+
+async function availablePort() {
+  const server = net.createServer();
+  const port = await listen(server);
+  await new Promise(resolve => server.close(resolve));
+  return port;
+}
+
+async function rpc(port, secret, method, params = []) {
+  const response = await fetch(`http://127.0.0.1:${port}/jsonrpc`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      jsonrpc: '2.0',
+      id: crypto.randomUUID(),
+      method,
+      params: [`token:${secret}`, ...params],
+    }),
+    signal: AbortSignal.timeout(5000),
+  });
+  const body = await response.json();
+  if (body.error) throw new Error(`${method}: ${JSON.stringify(body.error)}`);
+  if (!Object.hasOwn(body, 'result')) throw new Error(`${method}: response has no result`);
+  return body.result;
+}
+
+async function waitForRpc(port, secret) {
+  const deadline = Date.now() + 10000;
+  let lastError;
+  while (Date.now() < deadline) {
+    try {
+      return await rpc(port, secret, 'aria2.getVersion');
+    } catch (error) {
+      lastError = error;
+      await wait(100);
+    }
+  }
+  throw new Error(`Aria2 RPC did not become ready: ${lastError?.message || 'unknown error'}`);
+}
+
+async function waitForTerminal(port, secret, gid, timeoutMs = 20000) {
+  const deadline = Date.now() + timeoutMs;
+  let latest;
+  while (Date.now() < deadline) {
+    latest = await rpc(port, secret, 'aria2.tellStatus', [gid, [
+      'status', 'errorCode', 'errorMessage', 'completedLength', 'totalLength',
+    ]]);
+    if (['complete', 'error', 'removed'].includes(latest.status)) return latest;
+    await wait(100);
+  }
+  throw new Error(`Aria2 gid ${gid} did not become terminal: ${JSON.stringify(latest)}`);
+}
+
+async function waitForProgress(port, secret, gid, timeoutMs = 10000) {
+  const deadline = Date.now() + timeoutMs;
+  let latest;
+  while (Date.now() < deadline) {
+    latest = await rpc(port, secret, 'aria2.tellStatus', [gid, ['status', 'completedLength']]);
+    if (latest.status === 'active' && Number(latest.completedLength) > 0) return latest;
+    await wait(25);
+  }
+  throw new Error(`Aria2 gid ${gid} made no observable progress: ${JSON.stringify(latest)}`);
+}
+
+function serveBuffer(request, response, buffer) {
+  const match = /^bytes=(\d+)-(\d*)$/.exec(request.headers.range || '');
+  if (!match) {
+    response.writeHead(200, { 'content-length': String(buffer.length), 'accept-ranges': 'bytes' });
+    response.end(buffer);
+    return;
+  }
+  const start = Number(match[1]);
+  const requestedEnd = match[2] ? Number(match[2]) : buffer.length - 1;
+  const end = Math.min(requestedEnd, buffer.length - 1);
+  if (!Number.isSafeInteger(start) || start < 0 || start > end) {
+    response.writeHead(416, { 'content-range': `bytes */${buffer.length}` });
+    response.end();
+    return;
+  }
+  const body = buffer.subarray(start, end + 1);
+  response.writeHead(206, {
+    'content-length': String(body.length),
+    'content-range': `bytes ${start}-${end}/${buffer.length}`,
+    'accept-ranges': 'bytes',
+  });
+  response.end(body);
+}
+
+function serveThrottledBuffer(request, response, buffer) {
+  const match = /^bytes=(\d+)-(\d*)$/.exec(request.headers.range || '');
+  const start = match ? Number(match[1]) : 0;
+  const requestedEnd = match && match[2] ? Number(match[2]) : buffer.length - 1;
+  const end = Math.min(requestedEnd, buffer.length - 1);
+  if (!Number.isSafeInteger(start) || start < 0 || start > end) {
+    response.writeHead(416, { 'content-range': `bytes */${buffer.length}` });
+    response.end();
+    return;
+  }
+  const body = buffer.subarray(start, end + 1);
+  response.writeHead(match ? 206 : 200, {
+    'content-length': String(body.length),
+    ...(match ? { 'content-range': `bytes ${start}-${end}/${buffer.length}` } : {}),
+    'accept-ranges': 'bytes',
+  });
+  let offset = 0;
+  const timer = setInterval(() => {
+    if (response.destroyed || offset >= body.length) {
+      clearInterval(timer);
+      if (!response.destroyed) response.end();
+      return;
+    }
+    const next = Math.min(offset + 32 * 1024, body.length);
+    response.write(body.subarray(offset, next));
+    offset = next;
+  }, 20);
+  response.once('close', () => clearInterval(timer));
+}
+
+function childExited(child) {
+  return child.exitCode !== null || child.signalCode !== null;
+}
+
+async function waitForChildExit(child, timeoutMs = 8000) {
+  if (childExited(child)) return true;
+  return new Promise(resolve => {
+    let settled = false;
+    const finish = result => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.off('exit', onExit);
+      resolve(result);
+    };
+    const onExit = () => finish(true);
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    child.once('exit', onExit);
+    if (childExited(child)) finish(true);
+  });
+}
+
+async function stop(child, port, secret) {
+  if (!child || childExited(child)) return;
+  try {
+    await rpc(port, secret, 'aria2.shutdown');
+  } catch {
+    // It may already be stopping.
+  }
+  let exited = await waitForChildExit(child);
+  if (!exited) {
+    if (process.platform === 'win32') {
+      try {
+        execFileSync('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore', timeout: 3000 });
+      } catch {
+        // It may have exited between the timeout and taskkill.
+      }
+    } else {
+      child.kill('SIGTERM');
+    }
+    exited = await waitForChildExit(child);
+  }
+  if (!exited && process.platform !== 'win32') {
+    child.kill('SIGKILL');
+    exited = await waitForChildExit(child);
+  }
+  if (!exited) throw new Error(`Aria2 process ${child.pid} did not exit after cleanup`);
+}
+
+async function removeTempRoot(tempRoot) {
+  let lastError;
+  for (let attempt = 1; attempt <= 10; attempt += 1) {
+    try {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+      return;
+    } catch (error) {
+      lastError = error;
+      await wait(100 * attempt);
+    }
+  }
+  throw lastError;
+}
+
+const payload = Buffer.alloc(4 * 1024 * 1024, 0x5a);
+const checksum = crypto.createHash('sha256').update(payload).digest('hex');
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-aria2-transfers-'));
+const serverStatPath = path.join(tempRoot, 'server-stat.txt');
+fs.writeFileSync(serverStatPath, '', { mode: 0o600 });
+let finalRequests = 0;
+let finalCredentials = [];
+let redirectSourceCredentials;
+let smokePassed = false;
+let smokeFailure;
+
+const targetServer = http.createServer((request, response) => {
+  finalRequests += 1;
+  finalCredentials.push({
+    authorization: request.headers.authorization,
+    cookie: request.headers.cookie,
+    custom: request.headers['x-firelink-secret'],
+  });
+  serveBuffer(request, response, payload);
+});
+const targetPort = await listen(targetServer);
+const fixtureServer = http.createServer((request, response) => {
+  switch (new URL(request.url, 'http://fixture.invalid').pathname) {
+    case '/range':
+      serveBuffer(request, response, payload);
+      break;
+    case '/no-range':
+      response.writeHead(200, { 'content-length': String(payload.length) });
+      response.end(payload);
+      break;
+    case '/throttled':
+      serveThrottledBuffer(request, response, payload);
+      break;
+    case '/authenticated': {
+      const expectedAuthorization = `Basic ${Buffer.from('fixture-user:fixture-password').toString('base64')}`;
+      if (request.headers.authorization !== expectedAuthorization
+        || request.headers.cookie !== 'fixture-cookie=present'
+        || request.headers['x-firelink-auth'] !== 'present') {
+        response.writeHead(401, { 'content-length': '0' });
+        response.end();
+        break;
+      }
+      serveBuffer(request, response, payload);
+      break;
+    }
+    case '/redirect':
+      redirectSourceCredentials = {
+        authorization: request.headers.authorization,
+        cookie: request.headers.cookie,
+        custom: request.headers['x-firelink-secret'],
+      };
+      response.writeHead(302, { location: `http://127.0.0.1:${targetPort}/final` });
+      response.end();
+      break;
+    case '/missing':
+      response.writeHead(404, { 'content-length': '0' });
+      response.end();
+      break;
+    case '/malformed':
+      response.writeHead(200, { 'content-length': String(payload.length * 2) });
+      response.write(payload.subarray(0, 1024));
+      response.destroy();
+      break;
+    case '/slow': {
+      const slowLength = 64 * 1024;
+      let written = 0;
+      response.writeHead(200, { 'content-length': String(slowLength) });
+      const timer = setInterval(() => {
+        if (response.destroyed || written >= slowLength) {
+          clearInterval(timer);
+          if (!response.destroyed) response.end();
+          return;
+        }
+        response.write(Buffer.alloc(1024, 0x73));
+        written += 1024;
+      }, 500);
+      response.once('close', () => clearInterval(timer));
+      break;
+    }
+    default:
+      response.writeHead(404, { 'content-length': '0' });
+      response.end();
+  }
+});
+const fixturePort = await listen(fixtureServer);
+const rpcPort = await availablePort();
+const unavailableProxyPort = await availablePort();
+const secret = `firelink-transfers-${crypto.randomUUID()}`;
+const configPath = path.join(tempRoot, 'aria2.conf');
+fs.writeFileSync(configPath, `rpc-secret=${secret}\n`, { mode: 0o600 });
+const libraryPath = path.join(path.dirname(binaryPath), 'aria2-libs');
+const environment = fs.existsSync(libraryPath)
+  ? {
+      ...process.env,
+      OPENSSL_MODULES: libraryPath,
+      ...(process.platform === 'darwin' ? { DYLD_LIBRARY_PATH: libraryPath } : {}),
+    }
+  : process.env;
+const child = spawn(binaryPath, [
+  '--enable-rpc=true',
+  `--conf-path=${configPath}`,
+  `--rpc-listen-port=${rpcPort}`,
+  '--rpc-listen-all=false',
+  `--dir=${tempRoot}`,
+  '--file-allocation=none',
+  '--enable-dht=false',
+  '--console-log-level=error',
+  '--quiet=true',
+  `--server-stat-if=${serverStatPath}`,
+  `--server-stat-of=${serverStatPath}`,
+], { env: environment, stdio: ['ignore', 'ignore', 'pipe'] });
+let stderr = '';
+child.stderr.on('data', chunk => { stderr += chunk.toString(); });
+
+try {
+  const version = await waitForRpc(rpcPort, secret);
+  console.log(`[INFO] aria2 ${version.version || 'unknown'} normal-transfer smoke`);
+
+  const rangeGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/range`], {
+    out: 'range.bin', split: '4', 'max-connection-per-server': '4', 'min-split-size': '1M',
+  }]);
+  const rangeStatus = await waitForTerminal(rpcPort, secret, rangeGid);
+  if (rangeStatus.status !== 'complete' || !fs.readFileSync(path.join(tempRoot, 'range.bin')).equals(payload)) {
+    throw new Error(`bounded-range transfer failed: ${JSON.stringify(rangeStatus)}`);
+  }
+
+  const noRangeGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/no-range`], {
+    out: 'no-range.bin', split: '1', 'max-connection-per-server': '1',
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, noRangeGid)).status !== 'complete') {
+    throw new Error('single-connection no-range transfer did not complete');
+  }
+
+  const authenticatedGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/authenticated`], {
+    out: 'authenticated.bin', 'http-user': 'fixture-user', 'http-passwd': 'fixture-password',
+    header: ['Cookie: fixture-cookie=present', 'X-Firelink-Auth: present'],
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, authenticatedGid)).status !== 'complete') {
+    throw new Error('authenticated cookie/header transfer did not complete');
+  }
+
+  const resumeGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/throttled`], {
+    out: 'resume.bin', split: '1', continue: 'true',
+  }]);
+  await waitForProgress(rpcPort, secret, resumeGid);
+  await rpc(rpcPort, secret, 'aria2.pause', [resumeGid]);
+  const pausedStatus = await rpc(rpcPort, secret, 'aria2.tellStatus', [resumeGid, ['status', 'completedLength']]);
+  if (pausedStatus.status !== 'paused' || Number(pausedStatus.completedLength) <= 0) {
+    throw new Error(`normal transfer did not pause with resumable progress: ${JSON.stringify(pausedStatus)}`);
+  }
+  await rpc(rpcPort, secret, 'aria2.unpause', [resumeGid]);
+  if ((await waitForTerminal(rpcPort, secret, resumeGid)).status !== 'complete') {
+    throw new Error('paused normal transfer did not resume to completion');
+  }
+
+  const cancelGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/throttled`], {
+    out: 'cancel.bin', split: '1',
+  }]);
+  await waitForProgress(rpcPort, secret, cancelGid);
+  await rpc(rpcPort, secret, 'aria2.remove', [cancelGid]);
+  const cancelStatus = await waitForTerminal(rpcPort, secret, cancelGid);
+  if (cancelStatus.status !== 'removed') {
+    throw new Error(`normal transfer cancellation did not reach removed: ${JSON.stringify(cancelStatus)}`);
+  }
+
+  const mirrorGid = await rpc(rpcPort, secret, 'aria2.addUri', [[
+    `http://127.0.0.1:${fixturePort}/missing`,
+    `http://127.0.0.1:${fixturePort}/range`,
+  ], { out: 'mirror.bin', split: '1', 'max-tries': '1', 'uri-selector': 'adaptive' }]);
+  const mirrorStatus = await waitForTerminal(rpcPort, secret, mirrorGid);
+  if (mirrorStatus.status !== 'complete') throw new Error(`adaptive mirror failover failed: ${JSON.stringify(mirrorStatus)}`);
+
+  const checksumGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/range`], {
+    out: 'checksum.bin', checksum: `sha-256=${checksum}`, 'check-integrity': 'true',
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, checksumGid)).status !== 'complete') {
+    throw new Error('valid checksum transfer did not complete');
+  }
+  const mismatchGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/range`], {
+    out: 'checksum-mismatch.bin', checksum: `sha-256=${'0'.repeat(64)}`, 'check-integrity': 'true',
+  }]);
+  const mismatchStatus = await waitForTerminal(rpcPort, secret, mismatchGid);
+  if (mismatchStatus.status !== 'error') throw new Error(`checksum mismatch was not rejected: ${JSON.stringify(mismatchStatus)}`);
+
+  // Model Firelink's manual preflight: credentials reach the original origin,
+  // the redirect is not followed by the HTTP client, and Aria2 receives only
+  // the resolved cross-origin URL without credential options.
+  const redirectProbe = await fetch(`http://127.0.0.1:${fixturePort}/redirect`, {
+    headers: {
+      Range: 'bytes=0-0',
+      Authorization: 'Bearer fixture-secret',
+      Cookie: 'fixture=secret',
+      'X-Firelink-Secret': 'fixture',
+    },
+    redirect: 'manual',
+    signal: AbortSignal.timeout(5000),
+  });
+  if (redirectProbe.status !== 302) throw new Error(`redirect preflight returned HTTP ${redirectProbe.status}`);
+  if (!redirectSourceCredentials || Object.values(redirectSourceCredentials).some(value => !value)) {
+    throw new Error(`redirect source did not receive its scoped credentials: ${JSON.stringify(redirectSourceCredentials)}`);
+  }
+  const redirectLocation = redirectProbe.headers.get('location');
+  if (!redirectLocation) throw new Error('redirect preflight returned no Location header');
+  const resolvedRedirect = new URL(redirectLocation, redirectProbe.url);
+  const redirectGid = await rpc(rpcPort, secret, 'aria2.addUri', [[resolvedRedirect.toString()], {
+    out: 'redirect.bin',
+  }]);
+  const redirectStatus = await waitForTerminal(rpcPort, secret, redirectGid);
+  if (redirectStatus.status !== 'complete' || finalRequests === 0 || finalCredentials.some(headers => Object.values(headers).some(Boolean))) {
+    throw new Error(`redirect credential boundary failed: ${JSON.stringify({ redirectStatus, finalRequests, finalCredentials })}`);
+  }
+
+  const missingGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/missing`], {
+    out: 'missing.bin', 'max-tries': '1',
+  }]);
+  const missingStatus = await waitForTerminal(rpcPort, secret, missingGid);
+  if (missingStatus.status !== 'error' || !['3', '4'].includes(missingStatus.errorCode)) {
+    throw new Error(`not-found error classification changed: ${JSON.stringify(missingStatus)}`);
+  }
+
+  const lowSpeedGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/slow`], {
+    out: 'low-speed.bin', 'max-tries': '1', 'lowest-speed-limit': '1M', timeout: '20',
+  }]);
+  const lowSpeedStatus = await waitForTerminal(rpcPort, secret, lowSpeedGid, 25000);
+  if (lowSpeedStatus.status !== 'error' || lowSpeedStatus.errorCode !== '5') {
+    throw new Error(`low-speed error classification changed: ${JSON.stringify(lowSpeedStatus)}`);
+  }
+
+  const malformedGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/malformed`], {
+    out: 'malformed.bin', 'max-tries': '1',
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, malformedGid)).status !== 'error') {
+    throw new Error('malformed response unexpectedly completed');
+  }
+
+  const proxyGid = await rpc(rpcPort, secret, 'aria2.addUri', [[`http://127.0.0.1:${fixturePort}/range`], {
+    out: 'proxy.bin', 'all-proxy': `http://127.0.0.1:${unavailableProxyPort}`, 'max-tries': '1',
+  }]);
+  if ((await waitForTerminal(rpcPort, secret, proxyGid)).status !== 'error') {
+    throw new Error('unavailable proxy unexpectedly completed');
+  }
+
+  smokePassed = true;
+} catch (error) {
+  const detail = stderr.trim();
+  smokeFailure = new Error(`${error.message}${detail ? `\n${detail}` : ''}`);
+} finally {
+  try {
+    await stop(child, rpcPort, secret);
+    if (smokePassed) {
+      const stat = fs.readFileSync(serverStatPath, 'utf8');
+      if (!stat.includes('host=127.0.0.1')) {
+        throw new Error(`Aria2 did not persist adaptive mirror statistics: ${JSON.stringify(stat)}`);
+      }
+    }
+  } catch (error) {
+    if (!smokeFailure) smokeFailure = error;
+  } finally {
+    try {
+      await Promise.all([
+        new Promise(resolve => fixtureServer.close(resolve)),
+        new Promise(resolve => targetServer.close(resolve)),
+      ]);
+      await removeTempRoot(tempRoot);
+    } catch (error) {
+      if (!smokeFailure) smokeFailure = error;
+    }
+  }
+}
+
+if (smokeFailure) throw smokeFailure;
+console.log('[PASS] Aria2 normal transfers, auth/cookies, resume/cancel, mirrors, integrity, redirects, low-speed/not-found classification, malformed responses, proxy failures, and server statistics');

scripts/smoke-packaged-app.js

@@ -17,6 +17,13 @@ if (!executableArg) {
 const executable = path.resolve(executableArg);
 const assertNoVisibleChildWindows = process.argv.includes('--assert-no-visible-child-windows');
 const assertPortableData = process.argv.includes('--assert-portable-data');
+const MAX_STABILITY_MS = 60_000;
+const MAX_CONSECUTIVE_STABILITY_FAILURES = 3;
+const stabilityMsValue = Number.parseInt(argValue('--stability-ms') || '5000', 10);
+const stabilityMs = Number.isFinite(stabilityMsValue) && stabilityMsValue >= 0
+  ? Math.min(stabilityMsValue, MAX_STABILITY_MS)
+  : 5000;
+const READY_PORT_TIMEOUT_MS = 500;
 const child = spawn(executable, [], {
   cwd: process.env.RUNNER_TEMP || process.env.TMPDIR || process.cwd(),
   detached: process.platform !== 'win32',
@@ -60,18 +67,21 @@ async function findReadyPort() {
       break;
     }
 
-    for (let port = 6412; port <= 6422; port += 1) {
+    const ports = Array.from({ length: 11 }, (_, index) => 6412 + index);
+    const matches = await Promise.all(ports.map(async port => {
       try {
-        const response = await fetch(`http://127.0.0.1:${port}/ping`);
-        if (
-          response.headers.get('x-firelink-server') === '1'
-          && response.headers.get('x-firelink-smoke-process-id') === String(child.pid)
-        ) {
-          readyPort = port;
-          break;
-        }
-      } catch {}
-    }
+        const response = await fetch(`http://127.0.0.1:${port}/ping`, {
+          signal: AbortSignal.timeout(READY_PORT_TIMEOUT_MS),
+        });
+        const matchesChild = response.headers.get('x-firelink-server') === '1'
+          && response.headers.get('x-firelink-smoke-process-id') === String(child.pid);
+        await response.body?.cancel();
+        return matchesChild ? port : null;
+      } catch {
+        return null;
+      }
+    }));
+    readyPort = matches.find(port => port !== null) ?? null;
 
     if (readyPort === null) {
       await sleep(250);
@@ -79,6 +89,55 @@ async function findReadyPort() {
   }
 }
 
+async function checkReadyPort() {
+  if (readyPort === null) return false;
+
+  try {
+    const response = await fetch(`http://127.0.0.1:${readyPort}/ping`, {
+      signal: AbortSignal.timeout(READY_PORT_TIMEOUT_MS),
+    });
+    const matchesChild = response.headers.get('x-firelink-server') === '1'
+      && response.headers.get('x-firelink-smoke-process-id') === String(child.pid);
+    await response.body?.cancel();
+    return matchesChild;
+  } catch {
+    return false;
+  }
+}
+
+async function assertStableReady() {
+  const deadline = Date.now() + stabilityMs;
+  let consecutiveFailures = 0;
+  while (Date.now() < deadline) {
+    if (spawnError) {
+      throw new Error(`Packaged Firelink failed during stability check: ${spawnError.message}`);
+    }
+    if (childExit) {
+      throw new Error(
+        `Packaged Firelink exited during stability check with code ${childExit.code} signal ${childExit.signal}.`,
+      );
+    }
+    if (await checkReadyPort()) {
+      consecutiveFailures = 0;
+    } else {
+      consecutiveFailures += 1;
+      if (consecutiveFailures >= MAX_CONSECUTIVE_STABILITY_FAILURES) {
+        throw new Error('Packaged Firelink stopped exposing its extension ping endpoint during stability check.');
+      }
+    }
+    await sleep(Math.min(250, Math.max(1, deadline - Date.now())));
+  }
+
+  if (childExit) {
+    throw new Error(
+      `Packaged Firelink exited during stability check with code ${childExit.code} signal ${childExit.signal}.`,
+    );
+  }
+  if (!await checkReadyPort() && !await checkReadyPort()) {
+    throw new Error('Packaged Firelink was not healthy at the end of its stability check.');
+  }
+}
+
 function assertNoVisibleWindows(rootPid) {
   if (process.platform !== 'win32') {
     return;
@@ -134,46 +193,159 @@ function waitForChildExit(timeoutMs) {
   }
 
   return new Promise(resolve => {
-    const timer = setTimeout(() => {
+    let timer;
+    const onExit = () => {
+      clearTimeout(timer);
+      child.off('exit', onExit);
+      resolve(true);
+    };
+    timer = setTimeout(() => {
+      child.off('exit', onExit);
       resolve(false);
     }, timeoutMs);
-    child.once('exit', () => {
-      clearTimeout(timer);
-      resolve(true);
-    });
+    child.once('exit', onExit);
   });
 }
 
-async function terminateChild() {
-  if (!child.pid || childExit) {
-    return true;
-  }
-
+function isProcessGroupAlive(rootPid) {
   if (process.platform === 'win32') {
-    try {
-      execFileSync('taskkill', ['/pid', String(child.pid), '/t', '/f'], {
-        stdio: 'ignore',
-        windowsHide: true,
-      });
-    } catch {}
-    return waitForChildExit(10000);
+    return false;
   }
 
   try {
-    process.kill(-child.pid, 'SIGTERM');
-  } catch {
-    child.kill('SIGTERM');
+    process.kill(-rootPid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== 'ESRCH';
   }
-  if (await waitForChildExit(5000)) {
+}
+
+async function waitForProcessGroupExit(rootPid, timeoutMs) {
+  if (process.platform === 'win32') {
+    return true;
+  }
+
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!isProcessGroupAlive(rootPid)) {
+      return true;
+    }
+    await sleep(100);
+  }
+
+  return !isProcessGroupAlive(rootPid);
+}
+
+function windowsBundleRoot() {
+  return path.dirname(executable).replaceAll("'", "''");
+}
+
+function windowsBundleProcessIds() {
+  const root = windowsBundleRoot();
+  const script = `
+$root = '${root}'
+$rootPrefix = $root.TrimEnd('\\') + '\\'
+Get-CimInstance Win32_Process |
+  Where-Object {
+    $commandLine = $_.CommandLine
+    $commandLine -and $commandLine.TrimStart([char]34).StartsWith($rootPrefix, [System.StringComparison]::OrdinalIgnoreCase)
+  } |
+  Select-Object -ExpandProperty ProcessId
+`;
+  try {
+    const output = execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      windowsHide: true,
+    });
+    return output
+      .split(/\r?\n/)
+      .map(value => Number.parseInt(value.trim(), 10))
+      .filter(Number.isInteger);
+  } catch {
+    return null;
+  }
+}
+
+function terminateWindowsBundleProcesses() {
+  const root = windowsBundleRoot();
+  const script = `
+$root = '${root}'
+$rootPrefix = $root.TrimEnd('\\') + '\\'
+Get-CimInstance Win32_Process |
+  Where-Object {
+    $commandLine = $_.CommandLine
+    $commandLine -and $commandLine.TrimStart([char]34).StartsWith($rootPrefix, [System.StringComparison]::OrdinalIgnoreCase)
+  } |
+  ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+`;
+  try {
+    execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], {
+      stdio: 'ignore',
+      windowsHide: true,
+    });
+  } catch {}
+}
+
+async function waitForWindowsBundleExit(timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const processIds = windowsBundleProcessIds();
+    if (processIds?.length === 0) {
+      return true;
+    }
+    await sleep(100);
+  }
+  return windowsBundleProcessIds()?.length === 0;
+}
+
+async function terminateChild() {
+  if (!child.pid) {
+    return true;
+  }
+
+  const childWasRunning = !childExit;
+  if (process.platform === 'win32') {
+    if (childWasRunning) {
+      try {
+        execFileSync('taskkill', ['/pid', String(child.pid), '/t', '/f'], {
+          stdio: 'ignore',
+          windowsHide: true,
+        });
+      } catch {}
+    }
+    const childExited = await waitForChildExit(10000);
+    const bundleExited = await waitForWindowsBundleExit(5000);
+    if (childExited && bundleExited) {
+      return true;
+    }
+    terminateWindowsBundleProcesses();
+    return await waitForChildExit(5000) && await waitForWindowsBundleExit(5000);
+  }
+
+  if (childWasRunning && !childExit) {
+    try {
+      process.kill(-child.pid, 'SIGTERM');
+    } catch {
+      if (!childExit) {
+        child.kill('SIGTERM');
+      }
+    }
+  }
+  const childExited = await waitForChildExit(5000);
+  const processGroupExited = await waitForProcessGroupExit(child.pid, 5000);
+  if (childExited && processGroupExited) {
     return true;
   }
 
   try {
     process.kill(-child.pid, 'SIGKILL');
   } catch {
-    child.kill('SIGKILL');
+    if (!childExited) {
+      child.kill('SIGKILL');
+    }
   }
-  return waitForChildExit(5000);
+  return await waitForChildExit(5000) && await waitForProcessGroupExit(child.pid, 5000);
 }
 
 async function assertPortableStorage() {
@@ -219,11 +391,9 @@ try {
     await assertPortableStorage();
   }
 
-  if (childExit) {
-    throw new Error(`Packaged Firelink exited after exposing extension ping endpoint with code ${childExit.code} signal ${childExit.signal}.`);
-  }
+  await assertStableReady();
 
-  console.log(`Packaged Firelink smoke passed on 127.0.0.1:${readyPort}`);
+  console.log(`Packaged Firelink smoke passed on 127.0.0.1:${readyPort} with ${stabilityMs}ms stability`);
 } catch (error) {
   console.error(error instanceof Error ? error.message : String(error));
   process.exitCode = 1;

scripts/verify-binaries.js

@@ -45,16 +45,34 @@ const searchRoot = argValue('--search-root');
 function findEngineRoot(root) {
   const expected = `yt-dlp-${targetTriple}${ext}`;
   const matches = [];
+  const resolvedRoot = path.resolve(root);
+  const hasExpectedEngineFile = directory => {
+    try {
+      return fs.lstatSync(path.join(directory, expected)).isFile();
+    } catch (error) {
+      if (error?.code === 'ENOENT') return false;
+      throw new Error(`Unable to inspect packaged engine root '${directory}': ${error.message}`);
+    }
+  };
+  if (hasExpectedEngineFile(resolvedRoot)) {
+    matches.push(resolvedRoot);
+  }
   const walk = directory => {
-    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    let entries;
+    try {
+      entries = fs.readdirSync(directory, { withFileTypes: true });
+    } catch (error) {
+      throw new Error(`Unable to inspect packaged engine directory '${directory}': ${error.message}`);
+    }
+    for (const entry of entries) {
       const candidate = path.join(directory, entry.name);
       if (entry.isDirectory()) {
-        if (fs.existsSync(path.join(candidate, expected))) matches.push(candidate);
+        if (hasExpectedEngineFile(candidate)) matches.push(candidate);
         walk(candidate);
       }
     }
   };
-  walk(path.resolve(root));
+  walk(resolvedRoot);
   if (matches.length !== 1) {
     throw new Error(`Expected exactly one packaged engine root under ${root}, found ${matches.length}`);
   }

scripts/verify-companion-release.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const scriptDirectory = path.dirname(fileURLToPath(import.meta.url));
+const defaultRepositoryRoot = path.resolve(scriptDirectory, '..');
+const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+function readJson(file) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function exactVersionTag(extensionRoot, expectedTag) {
+  try {
+    const tags = execFileSync(
+      'git',
+      ['-C', extensionRoot, 'tag', '--points-at', 'HEAD', '--list', '--', expectedTag],
+      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+    )
+      .split(/\r?\n/)
+      .map(tag => tag.trim())
+      .find(tag => tag === expectedTag);
+    return tags || null;
+  } catch {
+    return null;
+  }
+}
+
+export function verifyCompanionRelease({
+  repositoryRoot = defaultRepositoryRoot,
+  resolveExactTag = exactVersionTag,
+  requireExactTag = true,
+} = {}) {
+  const extensionRoot = path.join(repositoryRoot, 'Extensions', 'Browser');
+  const packagePath = path.join(extensionRoot, 'package.json');
+  const manifestPath = path.join(extensionRoot, 'manifest.json');
+
+  if (!fs.existsSync(packagePath) || !fs.existsSync(manifestPath)) {
+    throw new Error('Companion package.json and manifest.json must both exist.');
+  }
+
+  const packageVersion = readJson(packagePath).version;
+  const manifestVersion = readJson(manifestPath).version;
+  if (!packageVersion || packageVersion !== manifestVersion) {
+    throw new Error(
+      `Companion versions do not agree: package.json=${packageVersion || 'missing'}, ` +
+      `manifest.json=${manifestVersion || 'missing'}.`
+    );
+  }
+  if (typeof packageVersion !== 'string' || !SEMVER.test(packageVersion)) {
+    throw new Error(`Companion version ${String(packageVersion)} is not a valid semantic version.`);
+  }
+
+  const expectedTag = `v${packageVersion}`;
+  if (!requireExactTag) {
+    return { tag: null, version: packageVersion };
+  }
+  const tag = resolveExactTag(extensionRoot, expectedTag);
+  if (!tag) {
+    throw new Error(
+      `Companion HEAD is not exactly tagged ${expectedTag}; publish the Companion release first.`
+    );
+  }
+  if (tag !== expectedTag) {
+    throw new Error(`Companion HEAD tag ${tag} does not match ${expectedTag}.`);
+  }
+
+  return { tag, version: packageVersion };
+}
+
+function main() {
+  try {
+    const requireExactTag = !process.argv.includes('--allow-untagged');
+    const { tag, version } = verifyCompanionRelease({ requireExactTag });
+    console.log(
+      requireExactTag
+        ? `Companion release ${version} matches exact tag ${tag}.`
+        : `Non-publishing Companion package metadata agrees at version ${version}.`
+    );
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
+
+if (path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) {
+  main();
+}

scripts/verify-companion-release.node-test.js

@@ -0,0 +1,118 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { verifyCompanionRelease } from './verify-companion-release.js';
+
+function createFixture(packageVersion, manifestVersion) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-companion-release-'));
+  const extensionRoot = path.join(root, 'Extensions', 'Browser');
+  fs.mkdirSync(extensionRoot, { recursive: true });
+  fs.writeFileSync(
+    path.join(extensionRoot, 'package.json'),
+    `${JSON.stringify({ version: packageVersion }, null, 2)}\n`
+  );
+  fs.writeFileSync(
+    path.join(extensionRoot, 'manifest.json'),
+    `${JSON.stringify({ version: manifestVersion }, null, 2)}\n`
+  );
+  return root;
+}
+
+test('accepts matching Companion metadata and exact release tag', () => {
+  const root = createFixture('2.0.7', '2.0.7');
+  try {
+    let resolvedExpectedTag;
+    assert.deepEqual(
+      verifyCompanionRelease({
+        repositoryRoot: root,
+        resolveExactTag: (_extensionRoot, expectedTag) => {
+          resolvedExpectedTag = expectedTag;
+          return 'v2.0.7';
+        },
+      }),
+      { tag: 'v2.0.7', version: '2.0.7' }
+    );
+    assert.equal(resolvedExpectedTag, 'v2.0.7');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects mismatched Companion package and manifest versions', () => {
+  const root = createFixture('2.0.7', '2.0.6');
+  try {
+    assert.throws(
+      () => verifyCompanionRelease({ repositoryRoot: root, resolveExactTag: () => 'v2.0.7' }),
+      /versions do not agree/
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects a malformed Companion semantic version before tag lookup', () => {
+  const root = createFixture('--contains=HEAD', '--contains=HEAD');
+  let tagLookupCalled = false;
+  try {
+    assert.throws(
+      () => verifyCompanionRelease({
+        repositoryRoot: root,
+        resolveExactTag: () => {
+          tagLookupCalled = true;
+          return 'v--contains=HEAD';
+        },
+      }),
+      /not a valid semantic version/
+    );
+    assert.equal(tagLookupCalled, false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects an untagged Companion commit', () => {
+  const root = createFixture('2.0.7', '2.0.7');
+  try {
+    assert.throws(
+      () => verifyCompanionRelease({ repositoryRoot: root, resolveExactTag: () => null }),
+      /not exactly tagged v2.0.7/
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('accepts aligned untagged Companion metadata for a non-publishing audit', () => {
+  const root = createFixture('2.0.7', '2.0.7');
+  let tagLookupCalled = false;
+  try {
+    assert.deepEqual(
+      verifyCompanionRelease({
+        repositoryRoot: root,
+        requireExactTag: false,
+        resolveExactTag: () => {
+          tagLookupCalled = true;
+          return null;
+        },
+      }),
+      { tag: null, version: '2.0.7' }
+    );
+    assert.equal(tagLookupCalled, false);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('rejects a Companion tag for another version', () => {
+  const root = createFixture('2.0.7', '2.0.7');
+  try {
+    assert.throws(
+      () => verifyCompanionRelease({ repositoryRoot: root, resolveExactTag: () => 'v2.0.6' }),
+      /does not match v2.0.7/
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

scripts/verify-release-version.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const scriptDirectory = path.dirname(fileURLToPath(import.meta.url));
+const repositoryRoot = path.resolve(scriptDirectory, '..');
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function readPackageVersion(root) {
+  return JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
+}
+
+function readTauriVersion(root) {
+  return JSON.parse(
+    fs.readFileSync(path.join(root, 'src-tauri', 'tauri.conf.json'), 'utf8')
+  ).version;
+}
+
+function readCargoVersion(root) {
+  const cargo = fs.readFileSync(path.join(root, 'src-tauri', 'Cargo.toml'), 'utf8');
+  const packageSection = cargo.match(/^\[package\]\s*([\s\S]*?)(?=^\[)/m)?.[1];
+  const version = packageSection?.match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+  if (!version) {
+    throw new Error('Could not read the [package] version from src-tauri/Cargo.toml.');
+  }
+  return version;
+}
+
+function versionFromRef(ref) {
+  if (!ref || !ref.startsWith('v')) {
+    throw new Error(`Expected a semantic version tag such as v1.2.3, received ${ref || 'nothing'}.`);
+  }
+  const version = ref.slice(1);
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`Release tag ${ref} does not contain a valid semantic version.`);
+  }
+  return version;
+}
+
+const versions = {
+  'package.json': readPackageVersion(repositoryRoot),
+  'src-tauri/Cargo.toml': readCargoVersion(repositoryRoot),
+  'src-tauri/tauri.conf.json': readTauriVersion(repositoryRoot),
+};
+const uniqueVersions = new Set(Object.values(versions));
+if (uniqueVersions.size !== 1) {
+  console.error('Application version manifests do not agree:');
+  for (const [file, version] of Object.entries(versions)) console.error(`  ${file}=${version}`);
+  process.exit(1);
+}
+
+const allowUntagged = process.argv.includes('--allow-untagged');
+const tag = argValue('--tag') || process.env.GITHUB_REF_NAME;
+const expected = allowUntagged ? Object.values(versions)[0] : versionFromRef(tag);
+const mismatches = Object.entries(versions)
+  .filter(([, version]) => version !== expected)
+  .map(([file, version]) => `${file}=${version}`);
+
+if (!allowUntagged && mismatches.length > 0) {
+  console.error(`Release tag ${tag} does not match the application manifests (expected ${expected}).`);
+  for (const mismatch of mismatches) console.error(`  ${mismatch}`);
+  process.exit(1);
+}
+
+console.log(
+  allowUntagged
+    ? `Non-publishing package version ${expected} matches ${Object.keys(versions).length} manifests.`
+    : `Release version ${expected} matches ${Object.keys(versions).length} manifests.`
+);

scripts/verify-release-version.node-test.js

@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import test from 'node:test';
+
+const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const verifier = path.join(repositoryRoot, 'scripts', 'verify-release-version.js');
+const currentVersion = JSON.parse(
+  fs.readFileSync(path.join(repositoryRoot, 'package.json'), 'utf8')
+).version;
+
+function runVerifier(tag, ...extraArguments) {
+  return spawnSync(process.execPath, [verifier, '--tag', tag, ...extraArguments], {
+    cwd: repositoryRoot,
+    encoding: 'utf8',
+  });
+}
+
+test('release version verifier accepts the aligned current version', () => {
+  const result = runVerifier(`v${currentVersion}`);
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, new RegExp(`Release version ${currentVersion} matches`));
+});
+
+test('release version verifier rejects the already-published prior tag', () => {
+  const result = runVerifier('v1.1.1');
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /does not match the application manifests/);
+});
+
+test('release version verifier rejects non-semver tag names', () => {
+  const result = runVerifier('release-candidate');
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /semantic version tag/);
+});
+
+test('release version verifier accepts an untagged non-publishing package audit', () => {
+  const result = runVerifier('main', '--allow-untagged');
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, new RegExp(`Non-publishing package version ${currentVersion} matches`));
+});

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "firelink"
-version = "1.1.0"
+version = "1.4.0"
 description = "A fast cross-platform desktop download manager powered by Rust and Tauri"
 authors = ["NimBold"]
 edition = "2021"
@@ -25,7 +25,7 @@ tauri-build = { version = "2", features = [] }
 [dependencies]
 tauri = { version = "2", features = ["macos-private-api", "tray-icon", "image-png", "test"] }
 tauri-plugin-opener = "2"
-tauri-plugin-dialog = "2"
+tauri-plugin-dialog = "2.7.2"
 tauri-plugin-shell = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
@@ -43,15 +43,15 @@ sha2 = "0.11"
 tauri-plugin-deep-link = "2"
 tauri-plugin-single-instance = { version = "2.4.3", features = ["deep-link"] }
 tempfile = "3"
-thiserror = "2.0.18"
+thiserror = "2.0.19"
 axum = "0.8.9"
-tower-http = { version = "0.7", features = ["cors"] }
+tower-http = { version = "0.7", features = ["cors", "limit"] }
 sysproxy = "0.3.0"
 semver = "1.0.28"
 keepawake = "0.6.0"
 system_shutdown = "4.1.0"
 tokio-tungstenite = "0.30.0"
-futures-util = { version = "0.3.32", features = ["sink"] }
+futures-util = { version = "0.3.33", features = ["sink"] }
 chrono = "0.4.38"
 url = "2"
 rusqlite = { version = "0.40.1", features = ["bundled"] }

src-tauri/binaries/_internal/certifi/cacert.pem

@@ -717,35 +717,6 @@ g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN
 BSeOE6Fuwg==
 -----END CERTIFICATE-----
 
-# Issuer: CN=Atos TrustedRoot 2011 O=Atos
-# Subject: CN=Atos TrustedRoot 2011 O=Atos
-# Label: "Atos TrustedRoot 2011"
-# Serial: 6643877497813316402
-# MD5 Fingerprint: ae:b9:c4:32:4b:ac:7f:5d:66:cc:77:94:bb:2a:77:56
-# SHA1 Fingerprint: 2b:b1:f5:3e:55:0c:1d:c5:f1:d4:e6:b7:6a:46:4b:55:06:02:ac:21
-# SHA256 Fingerprint: f3:56:be:a2:44:b7:a9:1e:b3:5d:53:ca:9a:d7:86:4a:ce:01:8e:2d:35:d5:f8:f9:6d:df:68:a6:f4:1a:a4:74
------BEGIN CERTIFICATE-----
-MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UE
-AwwVQXRvcyBUcnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQG
-EwJERTAeFw0xMTA3MDcxNDU4MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMM
-FUF0b3MgVHJ1c3RlZFJvb3QgMjAxMTENMAsGA1UECgwEQXRvczELMAkGA1UEBhMC
-REUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCVhTuXbyo7LjvPpvMp
-Nb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI419KkM/IL9bcFyYie96mvr54rM
-VD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+yj5vdHLqqjAqc2K+
-SZFhyBH+DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFsQ/H3NYkQ
-4J7sVaE3IqKHBAUsR320HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0L
-cp2AMBYHlT8oDv3FdU9T1nSatCQujgKRz3bFmx5VdJx4IbHwLfELn8LVlhgf8FQi
-eowHAgMBAAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7Rl+lwrrw7GWzbITAPBgNV
-HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZbNshMBgG
-A1UdIAQRMA8wDQYLKwYBBAGwLQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3
-DQEBCwUAA4IBAQAmdzTblEiGKkGdLD4GkGDEjKwLVLgfuXvTBznk+j57sj1O7Z8j
-vZfza1zv7v1Apt+hk6EKhqzvINB5Ab149xnYJDE0BAGmuhWawyfc2E8PzBhj/5kP
-DpFrdRbhIfzYJsdHt6bPWHJxfrrhTZVHO8mvbaG0weyJ9rQPOLXiZNwlz6bb65pc
-maHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a961qn8FYiqTxlVMYVqL2Gns2D
-lmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G3mB/ufNPRJLv
-KrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed
------END CERTIFICATE-----
-
 # Issuer: CN=QuoVadis Root CA 1 G3 O=QuoVadis Limited
 # Subject: CN=QuoVadis Root CA 1 G3 O=QuoVadis Limited
 # Label: "QuoVadis Root CA 1 G3"
@@ -3861,3 +3832,128 @@ y7Ve7hekm9sEdu4pKeiv+62sUvTXK9Z3hBC9xdIoaDQCQTV2WnXzkoYI9bIeCvZl
 C9p2x1L/Cx6AcCIwwzPbGO2E14vs7dOoY4G1VnxHx1YwlGhza9IuqbnZLBwpvQy6
 uWWL
 -----END CERTIFICATE-----
+
+# Issuer: CN=SECOM TLS RSA Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Subject: CN=SECOM TLS RSA Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Label: "SECOM TLS RSA Root CA 2024"
+# Serial: 17188327524208271538
+# MD5 Fingerprint: d0:a4:db:32:eb:44:98:d2:62:0b:3e:bc:4d:7c:5c:e9
+# SHA1 Fingerprint: fb:97:96:7c:ef:8d:98:63:06:c0:3b:b6:11:f8:e0:13:97:a2:98:d3
+# SHA256 Fingerprint: 14:35:f2:25:c5:d2:52:d7:a2:19:48:cc:3c:e6:2a:ec:fa:88:00:1e:3d:d7:2d:1c:c3:55:51:00:eb:37:2f:93
+-----BEGIN CERTIFICATE-----
+MIIFmjCCA4KgAwIBAgIJAO6JNNDLgOCyMA0GCSqGSIb3DQEBDAUAMFoxCzAJBgNV
+BAYTAkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEj
+MCEGA1UEAxMaU0VDT00gVExTIFJTQSBSb290IENBIDIwMjQwHhcNMjQwMTMxMDUx
+MTU1WhcNNDkwMTE0MDUxMTU1WjBaMQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VD
+T00gVHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMTGlNFQ09NIFRMUyBS
+U0EgUm9vdCBDQSAyMDI0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+4TjizUwzxbInq8Tx11gaFYNk5fO+34y7TyM4neh0UgL5JIZbJNLTz2x//L/B71+5
+m6X6nGIr7d4lFJBGtjO677hXOz93zkcWaUTm3VbOAjBlt4YWxlcccBHXuZ7o3Q+4
+R+ormrBdHeJ1CTUEG8ttQbKIl3G7OZYbnH8/pP8cjPub/0kDVNuMzp7xsVRROOis
+Qt53fMoJLlYgoebbuMphOqMCtjkJ7R6efEMfLp8UAVi9ZaLRn76ET/CJkk925ndu
+uufC4BatS4mnXFmxN0vUXb0ij9B8O/D8gixQEsVSD4GK8FWRPh3bVd/6bzdkHGJj
+y21XI0yejVomZUbRrOfNuz0boPGV1pt18fFC39IHQEth3OFqb5NDO3L+A9bNqTgA
+yUgRmIn4ucgDc/Ri/Km3V51ueZjy1/yk0qwJVadAVVrCt56iNeXOyEvzJADGgDQ8
+E1Pdaqct8Cynz/47ReQM62vFYO08wcQkrjmX/tesiko1V1yyaf6EfPzUFzmaGy9x
+vkCwdbm15EdTolOjE0H2Vb5/APDOyCFEokiYGmXTLdAUl0wKZ4IyjkHGzy0jhpaX
+EXE/GJcEvI6VzEchjaBL03EJ0h9pG4OqeIOycKvAo3A+TbetyfsrgYyHzU0a7/qU
+jGat1AAq1nVljMpKqpinPTsf/d9H39FTUeJL7TpzzjUCAwEAAaNjMGEwHQYDVR0O
+BBYEFCzrchKOWHdkNRVWNQFXB6l9DTbmMB8GA1UdIwQYMBaAFCzrchKOWHdkNRVW
+NQFXB6l9DTbmMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
+SIb3DQEBDAUAA4ICAQAVwsvluSafaez5tFPR/hRTBzRxEyMMQF3XJXCVi3yegZyK
+oec7hmE6jx2ZM8KgM1kn2yJRwFXHX8zUW9nBLEDWc4wuE8LrlZqhGZM9pJQXGmGz
+ResDJV6JgRBna+j4sA1M7yIdlvL0sAfFXFCTRaWTD4E1V99RLrFzWfTcC+e180hD
+uNMpqOEo46+lMeW/Wvh7ifOQs+kiK0O2gHxQDNxslSavnCs4V7l8HRDJ2La10o70
+Bo7VLzf1W8MBvv0VTnxB+NjT5qTAbhGFh9Gvp4BaJpmdUf0C5CEP6dbQlfgxWfzY
+r69yVT6dPQB+GFEaY03IMY+AcBCs+om1fNxrQXt9zoofMBNFbLhvpNH/JsXWdGUz
+fNbO12uswTa5wah8LB18FTQN2/zPHYmvBEoLuyUgZ09VNLJo5YA0kXItVYkLjMe2
+SixzK4scUHv81IK99I91DWx7FwMVKw2xgFp+ZLYB2dnpQQrqwlW64glHUcK2N9BD
+snjLSxeZ+UPECh9RxH4WAcKiZW+cqaKMmhP2WBfR4IcR7NOL32ml11ds87hhV1CZ
+WWFCJAcCidYZz6CZa8exzHojP9SB5RH0/v1KdHAisqhSjtJl/UIAHIQ48elOn8wr
+TdFap4Yb5aHglmMeNx+fAIhDluWVfxTO7H4dTPU+SFVRMLAh+wwKZfqb94nMeQ==
+-----END CERTIFICATE-----
+
+# Issuer: CN=SECOM TLS ECC Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Subject: CN=SECOM TLS ECC Root CA 2024 O=SECOM Trust Systems Co., Ltd.
+# Label: "SECOM TLS ECC Root CA 2024"
+# Serial: 9329818985461676612
+# MD5 Fingerprint: 99:d3:9d:e4:d2:b1:2d:f0:2a:04:67:85:f3:df:46:d6
+# SHA1 Fingerprint: 7a:1f:22:2d:72:b2:c3:19:87:44:db:61:69:e8:a6:4b:d7:0d:44:0e
+# SHA256 Fingerprint: 6a:b2:ab:75:f5:1c:b4:f4:f0:15:62:03:fb:f6:f6:46:23:2f:51:4b:e0:59:f6:28:33:30:8b:82:b4:d7:2d:b1
+-----BEGIN CERTIFICATE-----
+MIICTDCCAdGgAwIBAgIJAIF6LO+PI3pEMAoGCCqGSM49BAMDMFoxCzAJBgNVBAYT
+AkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEG
+A1UEAxMaU0VDT00gVExTIEVDQyBSb290IENBIDIwMjQwHhcNMjQwMTMxMDU1MjM0
+WhcNNDkwMTE0MDU1MjM0WjBaMQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VDT00g
+VHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMTGlNFQ09NIFRMUyBFQ0Mg
+Um9vdCBDQSAyMDI0MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE7NzFMtu9dzQXSNC1
+2fabk0+GlC5finB3R7XaZonRUd20aFiWObtuNBCLUZSfk6QXAE55BjEXsXQ/NG8y
+UqicXjsu9ksDK3JZBgCwLOVh6+nwJXTvso/dEj/GUYH5mBdoo2MwYTAdBgNVHQ4E
+FgQUO3YReyl04k4GTFaCQNAhL3qzydUwHwYDVR0jBBgwFoAUO3YReyl04k4GTFaC
+QNAhL3qzydUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZI
+zj0EAwMDaQAwZgIxAN3ib8fi1pMYtAPjMilB5e5/H+t5CL0xPL+cZ5oTTZuSCjpA
+n1v7F/VAr8bFxQXAowIxAKsBVO1ACFp7skwzPvdv1EUY5a897WGLT4lb+bjxFAWy
+l8wDcZJdwGZ/pAHxt1AJ1g==
+-----END CERTIFICATE-----
+
+# Issuer: CN=Telia EC TLS Root CA v3 O=Telia Company AB
+# Subject: CN=Telia EC TLS Root CA v3 O=Telia Company AB
+# Label: "Telia EC TLS Root CA v3"
+# Serial: 8028200332079443110287896228123317
+# MD5 Fingerprint: b6:fa:6a:5c:42:fb:c5:67:72:c0:e0:2f:72:fb:5a:44
+# SHA1 Fingerprint: b4:d6:07:c2:a5:95:bc:5b:f4:67:4d:c9:dc:6f:6f:0a:00:7a:a5:35
+# SHA256 Fingerprint: 09:8e:08:a9:1d:bb:f7:74:78:b9:6c:ce:b8:9b:14:13:a5:da:37:b7:c8:62:60:6a:95:5d:eb:07:17:9f:43:26
+-----BEGIN CERTIFICATE-----
+MIICMjCCAbegAwIBAgIPAYvSIlRjTQSLbOVHH9K1MAoGCCqGSM49BAMDMEoxCzAJ
+BgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSAwHgYDVQQDDBdU
+ZWxpYSBFQyBUTFMgUm9vdCBDQSB2MzAeFw0yMzExMTUwODU1MjZaFw00ODA1MjMx
+MTAwMDBaMEoxCzAJBgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFC
+MSAwHgYDVQQDDBdUZWxpYSBFQyBUTFMgUm9vdCBDQSB2MzB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABMHIlhVDLbmFKUpW0iK4dpryT6emYOeS31JPwWnWPmkWRrAkTbPX
+40sQfHI9mpR7Rbktu3ngg6W+BBSXSechtMCnBmWXj/EaVlmV5cY1jD2HoTfhBQ3A
+acpCNMLJK4NpZaNjMGEwHwYDVR0jBBgwFoAU1GToQ4g6cy/QGnGCNgtehd7H3kMw
+HQYDVR0OBBYEFNRk6EOIOnMv0BpxgjYLXoXex95DMA4GA1UdDwEB/wQEAwIBBjAP
+BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA2kAMGYCMQCXAUdS/9bbJ8A1JYaG
+f/bWt/s7Ta0ot5Ulno8OjSNYRWQIlS4tVWldvTAVA7heOFgCMQCvKr8+Z2Rn+OBr
+5UHzlgBObpad1LuwNTRcdNgUJxIWadcki+UBLEi1/AURKV5md2M=
+-----END CERTIFICATE-----
+
+# Issuer: CN=Telia RSA TLS Root CA v3 O=Telia Company AB
+# Subject: CN=Telia RSA TLS Root CA v3 O=Telia Company AB
+# Label: "Telia RSA TLS Root CA v3"
+# Serial: 8028214673410753541795188766939845
+# MD5 Fingerprint: f4:8b:9c:f3:f8:63:cf:dc:25:8f:b4:bb:a2:e9:9d:e2
+# SHA1 Fingerprint: b5:2e:88:4e:40:c1:11:fb:50:c7:e2:4f:ac:18:2b:bd:68:15:d2:34
+# SHA256 Fingerprint: d1:3d:b1:29:4c:45:eb:c6:fc:86:c6:bb:f6:9f:a2:9b:df:e6:92:df:f7:c7:13:c2:43:c7:a9:56:c6:a2:28:4c
+-----BEGIN CERTIFICATE-----
+MIIFgjCCA2qgAwIBAgIPAYvSUKtCVSxHWr2h3BrFMA0GCSqGSIb3DQEBDAUAMEsx
+CzAJBgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSEwHwYDVQQD
+DBhUZWxpYSBSU0EgVExTIFJvb3QgQ0EgdjMwHhcNMjMxMTE1MDk0NzQyWhcNNDgw
+NTIzMTEwMDAwWjBLMQswCQYDVQQGEwJTRTEZMBcGA1UECgwQVGVsaWEgQ29tcGFu
+eSBBQjEhMB8GA1UEAwwYVGVsaWEgUlNBIFRMUyBSb290IENBIHYzMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsV89KG19hCf4S1Fvk8D3TyDERhmcvx8F
+7Kmb4WATx3ije1id3KHxRE0TKmcNCbAQ57bvHFEYa4hR2l20VjVadExqOW+2ld99
+MbEiO+jRVOz+BbxLxJnmGwCqI+BfuTjjVReDxsxjQvjgBsClaO/sm5i70nlZcWGR
+tIkvWDK3NNkT5RtwXc/O8NTFVpbUqT6cRjIj3olAblR+lRf4Ffy5o+Q9fabjYn9Z
+9S4itruElcEFf9Ljk7fwdTycT/rvJW9w/B3G2a3r0f/zXNOVruIBcqE6pkSospAC
+U2bG42fYKrbM/GWnp7u+p9Frz4jaNwpb4YHuEeS8BratNcP8X62jXIvvKHxlsMDJ
+Cnb4U8JzFOLsU6mohVY58BdZrvi0Gk9UOuqmgoG6dskHoksjZTlK61D/InzmEoA1
+yAYJFDVysjRxDUOu9cAwANbqmq77WIFL6BpnZgVqPtMfG6wN8BrTKdapvilVsYR5
+9BFgIsAVBMxrGh+W+QcvmJafUpASvlArKvVG2FI4i6PiLjSBT0+6F6EQLrYqefOQ
+F/fBNEXb+njUQ0SUVrAqtH4Y+OjCI/a4/JJQppxeemZcQ0SUShgiI5AM5xHO5iya
+UrTjYH4zxUz9j+1FEbDH/xpstr1gXBykspup+hRTaJcbA+UbpJqtWZndAPddJmt6
+YJQ+dU3pDu8CAwEAAaNjMGEwHwYDVR0jBBgwFoAUsMep0t2yKFZzBJSMFFxIbzdS
+kqgwHQYDVR0OBBYEFLDHqdLdsihWcwSUjBRcSG83UpKoMA4GA1UdDwEB/wQEAwIB
+BjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQBdYzFsNGDRk7bR
+/AgRKq+5637YuOW+w6uhpoS0VnKMUpyHCwku86hEvqivakPtfmlm4bFwt++sb/8O
+XsWBqtfbXMaBNDTZl8XRMJuLWOW2JrbKkRzgG0eBUcvsadG1rrhbmZqYvFXaAZO7
+o4TdOZzxhBB5GOAWWXB3IeraNP4J63zyo9n8Gqw3sJBG44em5hoYjBffP+npibys
+lnslRi4L6xHsCYj/Pab+OlqbMCB6v+sTCLeEIukRVzoR9aQ45pEK7Z1QBnSsbAKQ
+tss0JKD9d/mX143H1xePjPhTXlv5JCkhrcj+SShz0P9+EHoWe6m9lyUEOIVn0rp+
+yVJWNbmyDv3VkwFxHC1ApSQsgSimjGQ4wtr6cSmordYxkV+Ro8lOIIhRksXPyDk2
+7gW6IjUXCkZKpxFjkL3jiBSc8SkxnwCWtXg8xwNwdFVNBGLCCuJnsneYXjJNqzRq
+UcoGwzsvF3Qi/ZnHUNvISdevlgIAXL4Wvrxaqvoa01wB+GCfs57RTGE4TvAGhKNK
+us8K3hRT1BSpigzMIRzSxtAOrqPN6j//QSmW9f8Jcncri4j2ihSpVrFU0NdNkMhZ
+eAKidTFPsxCVFuW4Aniz7jqiw5sWtjbQrlW035izIEU4sYwQoC1Nx0Svy+mMTRai
+50LqFQ+A1/Hq6xHHDNx7CI83d23Erw==
+-----END CERTIFICATE-----

src-tauri/binaries/_internal/curl_cffi-0.15.0.dist-info/RECORD

@@ -1,60 +0,0 @@
-../../../bin/curl-cffi,sha256=1WNmf_w0emP0-PeIpDGlHiBy4Gdet6ASfQxBOR-BNMA,187
-curl_cffi-0.15.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
-curl_cffi-0.15.0.dist-info/METADATA,sha256=ryYvNCZOl96BIMI2134ZhyRWy7sr-0-xOc0Q_TfaU9A,18405
-curl_cffi-0.15.0.dist-info/RECORD,,
-curl_cffi-0.15.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-curl_cffi-0.15.0.dist-info/WHEEL,sha256=BX73HzL_Z8VmcUg66xwFel1CJ1goP9ZPbeeVSSFaesY,140
-curl_cffi-0.15.0.dist-info/direct_url.json,sha256=ORhsskaIg_jwHIDYD7oRH5nzN3fKYa7xVFg-8WceJ5E,313
-curl_cffi-0.15.0.dist-info/entry_points.txt,sha256=HzTwoUpbiKIo5uJrqnxPk5OdxZ0PhT0dPTSqUP8Js70,49
-curl_cffi-0.15.0.dist-info/licenses/LICENSE,sha256=PoiwKbULav021rGGQs5Mi27uTJA_HPq-9bgR9h4HBQs,1106
-curl_cffi-0.15.0.dist-info/top_level.txt,sha256=b51YB50I_vu6XAbSERmqtgaYciYADCA_baVoZ_T5Lzs,10
-curl_cffi/__init__.py,sha256=fPBkVIThnbk_a7U41V5S3Qwhh1_WxZkMerXQNv1iOpA,1781
-curl_cffi/__main__.py,sha256=L0AH-xyDlgmsPM-HTecPVb1_hV9X35Qf1Mw7h7JVnx0,39
-curl_cffi/__pycache__/__init__.cpython-314.pyc,,
-curl_cffi/__pycache__/__main__.cpython-314.pyc,,
-curl_cffi/__pycache__/__version__.cpython-314.pyc,,
-curl_cffi/__pycache__/_asyncio_selector.cpython-314.pyc,,
-curl_cffi/__pycache__/aio.cpython-314.pyc,,
-curl_cffi/__pycache__/const.cpython-314.pyc,,
-curl_cffi/__pycache__/curl.cpython-314.pyc,,
-curl_cffi/__pycache__/utils.cpython-314.pyc,,
-curl_cffi/__version__.py,sha256=FdOv9cpHIUGkFkcWA4O9gte0sun1QgJI69rIgzUkswo,413
-curl_cffi/_asyncio_selector.py,sha256=dxKOC6B8mlRu3WYi0trSq0L-FsWV6l_pg9TP35OpDI4,13043
-curl_cffi/_wrapper.abi3.so,sha256=4sMTX_Q2WMouO96xfxc3BZjZxnMZnLjZV8nF_FCU_zE,12691712
-curl_cffi/aio.py,sha256=oTiffUFDNfxxSHmCVAsjX0CIOs4IuBQ6mhm4WuY5KZs,11925
-curl_cffi/cli/__init__.py,sha256=y-XQAfYkBDN3ejfVex1aKy5bcqsPUglAvm-i177wM5I,7290
-curl_cffi/cli/__pycache__/__init__.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/doctor.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/output.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/parse.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/request.cpython-314.pyc,,
-curl_cffi/cli/__pycache__/run.cpython-314.pyc,,
-curl_cffi/cli/doctor.py,sha256=4wfyWF44JLxDtoH9YCDdmxrJ-1cWbNwSXcMc9Aopd1c,416
-curl_cffi/cli/output.py,sha256=YzWbYLJ2zowR6G9mJxeTytcPrnSk2WQVwfmv8V404X4,6709
-curl_cffi/cli/parse.py,sha256=OzqGEZPqOrH2nq14UKnaXwKAblAw6V867tDEp9XSLdo,2549
-curl_cffi/cli/request.py,sha256=MJskNMJBIR8oq_fvrPvsi61Wy-bR4-aC8QQJb1YcqRg,3522
-curl_cffi/cli/run.py,sha256=WYaPbX9h85DZQNkDbUUyvp3bryaAuNOxnjU6GpenigQ,7554
-curl_cffi/const.py,sha256=mF3H1kHsqj-dfd7GWHMHyuB2bZ3QZd61tC1iCZgEjyo,18523
-curl_cffi/curl.py,sha256=woBPw1OQk4FH7neNETuj_GwqcQa1jCjd1tA0ZxPSTA8,26928
-curl_cffi/py.typed,sha256=dcrsqJrcYfTX-ckLFJMTaj6mD8aDe2u0tkQG-ZYxnEg,26
-curl_cffi/requests/__init__.py,sha256=3ZO7mC7gNJZydze0VQLEYpEc9dMlf1uRbFS-fxKSQPs,6148
-curl_cffi/requests/__pycache__/__init__.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/cookies.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/errors.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/exceptions.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/headers.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/impersonate.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/models.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/session.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/utils.cpython-314.pyc,,
-curl_cffi/requests/__pycache__/websockets.cpython-314.pyc,,
-curl_cffi/requests/cookies.py,sha256=QDEuhtsSjh6iNAKmp5TnGyyAe8wdDJCADCHY_GWCeCc,11867
-curl_cffi/requests/errors.py,sha256=R6N5lmOTdRukThkNGUihDAQRu8HSh27M8E3zfUJJX74,250
-curl_cffi/requests/exceptions.py,sha256=ViyLx3XHii_s7kjrO3GhVOVXhq2_UsYfAQl8MPwDnEM,6187
-curl_cffi/requests/headers.py,sha256=Q1jrRdJ2YMLOcl5W3WBaKZAdLbPGPPERJ6MYzos3YXk,11535
-curl_cffi/requests/impersonate.py,sha256=dKRpbPTqLCABrCmSKmgXyhA1zmrv0DMuSuqQyhn5-FU,13389
-curl_cffi/requests/models.py,sha256=SaN9QUYyljUDFDQnUrYZRl9KiUe25nb2c2ca-dfq3Nw,11487
-curl_cffi/requests/session.py,sha256=LkfPvAr8BIVzB_K91xwh0wIPRW26mi2VJd1cEYorIho,58871
-curl_cffi/requests/utils.py,sha256=zMKaWoXcAPFNBv6FglE3FSAPNuxYr_leUcWKnhfYecw,26618
-curl_cffi/requests/websockets.py,sha256=RJVNqCDrlLWzQ12Ym9M5_T0SW4EmoqKUYsXXTaQmBRQ,71685
-curl_cffi/utils.py,sha256=gRVzO-vhjf596V6kr_SjwHlwJfDIwTrPbRLJvvNlUNE,307

src-tauri/binaries/_internal/curl_cffi-0.15.0.dist-info/direct_url.json

@@ -1 +0,0 @@
-{"archive_info": {"hash": "sha256=630653d283070b21deca8ee408dcdc98ac4202d80cc9d038db805d45e0b40550", "hashes": {"sha256": "630653d283070b21deca8ee408dcdc98ac4202d80cc9d038db805d45e0b40550"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/universal2/curl_cffi-0.15.0-cp310-abi3-macosx_10_9_universal2.whl"}

src-tauri/binaries/_internal/curl_cffi-0.16.0.dist-info/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: curl_cffi
-Version: 0.15.0
+Version: 0.16.0
 Summary: libcurl ffi bindings for Python, with impersonation support.
 Author-email: lexiforest <infinitesheldon@gmail.com>
 License-Expression: MIT
@@ -19,11 +19,12 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cffi>=2.0.0
 Requires-Dist: certifi>=2024.2.2
-Requires-Dist: rich
 Provides-Extra: extra
 Requires-Dist: readability-lxml>=0.8.1; extra == "extra"
 Requires-Dist: markdownify>=1.1.0; extra == "extra"
 Requires-Dist: lxml_html_clean; extra == "extra"
+Provides-Extra: cli
+Requires-Dist: rich; extra == "cli"
 Provides-Extra: dev
 Requires-Dist: charset_normalizer<4.0,>=3.3.2; extra == "dev"
 Requires-Dist: coverage<7.0,>=6.4.1; extra == "dev"
@@ -90,12 +91,6 @@ Python 3.10 is the minimum supported version since v0.14.
 
 If you’re looking for a meeting recording API, consider checking out [Recall.ai](https://www.recall.ai/?utm_source=github&utm_medium=sponsorship&utm_campaign=lexiforest-curl_cffi), an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and more.
 
-## Residential Proxies
-
-<a href="https://www.thordata.com/?ls=github&lk=curl_" target="_blank"><img src="https://raw.githubusercontent.com/lexiforest/curl_cffi/main/assets/thordata.png" alt="Thordata" height="126" width="240"></a>
-
-Thordata: A reliable and cost-effective proxy service provider. One-click collection of public network data, providing enterprises and developers with stable, efficient, and compliant global proxy IP services. Register for a free trial of [residential proxies](https://www.thordata.com/?ls=github&lk=curl_) and receive 2000 free SERP API calls.
-
 ## Sponsors
 
 Maintenance of this project is made possible by all the <a href="https://github.com/lexiforest/curl_cffi/graphs/contributors">contributors</a> and <a href="https://github.com/sponsors/lexiforest">sponsors</a>. If you'd like to sponsor this project and have your avatar or company logo appear below <a href="https://github.com/sponsors/lexiforest">click here</a>. 💖
@@ -124,6 +119,15 @@ No browser automation. Just simple API calls that return the exact cookies and h
 
 ------
 
+## Impersonate Suite
+
+`curl-cffi` is part of the impersonate suite.
+
+- [curl-impersonate](https://github.com/lexiforest/curl-impersonate). A curl distribution that impersonates browsers.
+- [curl_cffi](https://github.com/lexiforest/curl_cffi). Python binding to curl-impersonate.
+- [impers](https://github.com/lexiforest/impers). Node.js binding to curl-impersonate.
+- [impersonate.pro](https://impersonate.pro). Commercial support, more fingerprints and integrated solutions.
+
 ## Features
 
 - Supports JA3/TLS and http2 fingerprints impersonation, including recent browsers and custom fingerprints.
@@ -163,25 +167,28 @@ replacement for "claws" and "agents".
 |http/2|✅|❌|✅|
 |http/3|☑️<sup>1</sup>|❌|✅|
 |human-friendly|☑️<sup>2</sup>|✅|✅|
-|colorful|❌|✅|✅|
+|colorful|❌|✅|✅<sup>3</sup>|
 |fingerprints|❌|❌|✅|
 
 Notes:
 
 1. You need an http/3 enabled curl build, it's not enabled by default, at leat on my machine.
 2. As a long time command line user, I personally feel very comfortable using `curl -X POST httpbin.org`, but some users may prefer `http GET httpbin.org` syntax. If you prefer the curl syntax, you can keep using `curl-impersonate`.
+3. Install `curl_cffi[cli]` for colorful CLI output. Without `rich`, the CLI uses plain text output.
 
 ## Install
 
     pip install curl_cffi --upgrade
 
 This should work on Linux, macOS and Windows out of the box.
-If it does not work on you platform, you may need to compile and install `curl-impersonate`
-first and set some environment variables like `LD_LIBRARY_PATH`.
 
-Android support, including Termux, is currently in beta, you can install the beta release for testing.
+On macOS, you can also install via Homebrew:
+
+    brew install lexiforest/tap/curl-cffi
+
+<small>Android support, including Termux, is currently in beta, you can install the beta release for testing.
 For BSD systems, we need to get libcurl-impersonate compile first, and then add support in curl_cffi.
-If you are using these OSes, please lend an hand.
+If you are using these OSes, please lend an hand.</small>
 
 To install beta releases:
 
@@ -235,11 +242,6 @@ r = curl_cffi.get(
     impersonate="chrome"
 )
 
-# Randomly choose a browser version based on current market share in real world
-# from: https://caniuse.com/usage-table
-# NOTE: this is a pro feature.
-r = curl_cffi.get("https://example.com", impersonate="realworld")
-
 # To pin a specific version, use version numbers together.
 r = curl_cffi.get("https://tls.browserleaks.com/json", impersonate="chrome124")
 
@@ -273,45 +275,42 @@ print(r.json())
 
 ### Supported impersonate browsers
 
-`curl_cffi` supports the same browser versions as supported by my [fork](https://github.com/lexiforest/curl-impersonate) of [curl-impersonate](https://github.com/lwthiker/curl-impersonate):
+`curl_cffi` supports the same browser versions preset as supported by our [fork](https://github.com/lexiforest/curl-impersonate) of [curl-impersonate](https://github.com/lwthiker/curl-impersonate):
 
-Open source version of curl_cffi includes versions whose fingerprints differ from previous versions.
-If you see a version, e.g. `chrome135`, were skipped, you can simply impersonate it with your own headers and the previous version.
+The open source version of `curl_cffi` includes versions when we are adding new capabilities for impersonating.
+If you see a version, e.g. `chrome135`, was skipped, it's simply because there's nothing new or we were busy at that time. 
+You can simply impersonate it with your own headers and the previous browser target.
 
-If you don't want to look up the headers etc, by yourself, consider buying commercial support from [impersonate.pro](https://impersonate.pro),
-we have comprehensive browser fingerprints database for almost all the browser versions on various platforms.
+For a full list of preset fingerprints, see the [curl-impersonate docs](https://curl-impersonate.readthedocs.io/en/latest/fingerprints.html). 
+We will no longer put duplicated and outdated info here.
 
-If you are trying to impersonate a target other than a browser, use `ja3=...` and `akamai=...`
+If you don't want to look up the headers/etc by yourself, consider buying commercial support from [impersonate.pro](https://impersonate.pro).
+We have comprehensive browser tls, http and JavaScript fingerprints database for almost all the browser versions on various platforms.
+
+Since v0.15.1, you can use `curl-cffi update` to retrieve the latest fingerprints, without updating to a new version.
+We offer the Safari, Chrome, Firefox updates for free and others as part of the [commercial plan](https://impersonate.pro).
+
+The current number of fingerprints:
+
+![Preset](https://img.shields.io/badge/Preset_Fingerprints-37-blue)
+![Free](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fapi.impersonate.pro%2Fv1%2Fcounts&query=%24.free&label=Free%20Fingerprints) 
+![Pro](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fapi.impersonate.pro%2Fv1%2Fcounts&query=%24.all&label=Pro%20Fingerprints)
+
+To see the current list of fingerprints on your device, use the command line:
+
+```sh
+curl-cffi list
+```
+
+To update fingerprints from impersonate.pro, use the command line:
+
+```sh
+curl-cffi update
+```
+
+If you are trying to impersonate a target other than a browser, use `ja3=...`, `akamai=...`, `extra_fp=...`, and `perk=...`
 to specify your own customized fingerprints. See the [docs on impersonation](https://curl-cffi.readthedocs.io/en/latest/impersonate/_index.html) for details.
 
-|Browser|Open Source| Pro version|
-|---|---|---|
-|Chrome|chrome99, chrome100, chrome101, chrome104, chrome107, chrome110, chrome116<sup>[1]</sup>, chrome119<sup>[1]</sup>, chrome120<sup>[1]</sup>, chrome123<sup>[3]</sup>, chrome124<sup>[3]</sup>, chrome131<sup>[4]</sup>, chrome133a<sup>[5][6]</sup>, chrome136<sup>[6]</sup>, chrome142, chrome145<sup>[9]</sup>, chrome146<sup>[9]</sup>|chrome132, chrome134, chrome135|
-|Chrome Android| chrome99_android, chrome131_android <sup>[4]</sup>|chrome132_android, chrome133_android, chrome134_android, chrome135_android|
-|Chrome iOS|N/A|coming soon|
-|Safari <sup>[7]</sup>|safari153 <sup>[2]</sup>, safari155 <sup>[2]</sup>, safari170 <sup>[1]</sup>, safari180 <sup>[4]</sup>, safari184 <sup>[6]</sup>, safari260 <sup>[8]</sup>|coming soon|
-|Safari iOS <sup>[7]</sup>| safari172_ios<sup>[1]</sup>, safari180_ios<sup>[4]</sup>, safari184_ios <sup>[6]</sup>, safari260_ios <sup>[8]</sup>|coming soon|
-|Firefox|firefox133<sup>[5]</sup>, firefox135<sup>[7]</sup>, firefox144, firefox147<sup>[9]</sup>|coming soon|
-|Firefox Android|N/A|firefox135_android|
-|Tor|tor145 <sup>[7]</sup>|coming soon|
-|Edge|edge99, edge101|edge133, edge135|
-|Opera|N/A|coming soon|
-|Brave|N/A|coming soon|
-
-
-Notes:
-
-1. Added in version `0.6.0`.
-2. Fixed in version `0.6.0`, previous http2 fingerprints were [not correct](https://github.com/lwthiker/curl-impersonate/issues/215).
-3. Added in version `0.7.0`.
-4. Added in version `0.8.0`.
-5. Added in version `0.9.0`.
-6. The version postfix `-a`(e.g. `chrome133a`) means that this is an alternative version, i.e. the fingerprint has not been officially updated by browser, but has been observed because of A/B testing.
-5. Added in version `0.10.0`.
-6. Added in version `0.11.0`.
-7. Since `0.11.0`, the format `safari184_ios` is preferred over `safari18_4_ios`, both are supported, but the latter is quite confusing and hard to parse.
-8. Added in  `0.12.0`.
-9. http3 support included.
 
 ### Asyncio
 
@@ -370,11 +369,13 @@ async with AsyncSession() as session:
             print(message)
 ```
 
+See the WebSocket [docs](https://curl-cffi.readthedocs.io/en/latest/websockets.html) for full details and advanced options.
+
 ## Ecosystem
 
 - Integrating with Scrapy: [divtiply/scrapy-curl-cffi](https://github.com/divtiply/scrapy-curl-cffi), [jxlil/scrapy-impersonate](https://github.com/jxlil/scrapy-impersonate) and [tieyongjie/scrapy-fingerprint](https://github.com/tieyongjie/scrapy-fingerprint).
 - Integrating with [requests](https://github.com/el1s7/curl-adapter), [httpx](https://github.com/vgavro/httpx-curl-cffi) as adapter.
-- Integrating with captcha resolvers: [YesCaptcha](https://yescaptcha.atlassian.net/wiki/spaces/YESCAPTCHA/overview). Please see the head area for promo code and link.
+- Integrating with captcha resolvers: [YesCaptcha](https://yescaptcha.com/i/stfnIO).
 
 ## Acknowledgement
 

src-tauri/binaries/_internal/curl_cffi-0.16.0.dist-info/RECORD

@@ -0,0 +1,68 @@
+../../../bin/curl-cffi,sha256=1WNmf_w0emP0-PeIpDGlHiBy4Gdet6ASfQxBOR-BNMA,187
+curl_cffi-0.16.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+curl_cffi-0.16.0.dist-info/METADATA,sha256=2xKv2aRl-HtOcwKKcucrZQ-F51XFo7VpRXQtYLJ0F-c,17463
+curl_cffi-0.16.0.dist-info/RECORD,,
+curl_cffi-0.16.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+curl_cffi-0.16.0.dist-info/WHEEL,sha256=mLbZYCWBc4fJzW1y2K2PE77e-mZLwFI4W61tEVJsa_c,140
+curl_cffi-0.16.0.dist-info/direct_url.json,sha256=foVsUM-Bj-Y-YxcNjF92n-aYB3GyM3Vsbf5rTFvl84g,313
+curl_cffi-0.16.0.dist-info/entry_points.txt,sha256=HzTwoUpbiKIo5uJrqnxPk5OdxZ0PhT0dPTSqUP8Js70,49
+curl_cffi-0.16.0.dist-info/licenses/LICENSE,sha256=PoiwKbULav021rGGQs5Mi27uTJA_HPq-9bgR9h4HBQs,1106
+curl_cffi-0.16.0.dist-info/top_level.txt,sha256=b51YB50I_vu6XAbSERmqtgaYciYADCA_baVoZ_T5Lzs,10
+curl_cffi/__init__.py,sha256=6YJwgd_t8GbuHk2mqe7PWNqmkYVTjhX9gCVxzTIyYdc,1986
+curl_cffi/__main__.py,sha256=L0AH-xyDlgmsPM-HTecPVb1_hV9X35Qf1Mw7h7JVnx0,39
+curl_cffi/__pycache__/__init__.cpython-314.pyc,,
+curl_cffi/__pycache__/__main__.cpython-314.pyc,,
+curl_cffi/__pycache__/__version__.cpython-314.pyc,,
+curl_cffi/__pycache__/_asyncio_selector.cpython-314.pyc,,
+curl_cffi/__pycache__/aio.cpython-314.pyc,,
+curl_cffi/__pycache__/const.cpython-314.pyc,,
+curl_cffi/__pycache__/curl.cpython-314.pyc,,
+curl_cffi/__pycache__/fingerprints.cpython-314.pyc,,
+curl_cffi/__pycache__/utils.cpython-314.pyc,,
+curl_cffi/__version__.py,sha256=FdOv9cpHIUGkFkcWA4O9gte0sun1QgJI69rIgzUkswo,413
+curl_cffi/_asyncio_selector.py,sha256=dxKOC6B8mlRu3WYi0trSq0L-FsWV6l_pg9TP35OpDI4,13043
+curl_cffi/_wrapper.abi3.so,sha256=SGLe3OukfFgEvCILm0yzeoQ2emxeRX0pgLKMjJGQ88M,13622944
+curl_cffi/aio.py,sha256=BxbiWI2ugesL6sHfKk_34A25hzTWAy4mf2G4kRKq29Q,12123
+curl_cffi/cli/__init__.py,sha256=6is7D4E46XsOYGYUnfey9maSG4DrARwEk3I4kJv1d-8,7852
+curl_cffi/cli/__pycache__/__init__.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/doctor.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/output.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/parse.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/pro.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/request.cpython-314.pyc,,
+curl_cffi/cli/__pycache__/run.cpython-314.pyc,,
+curl_cffi/cli/doctor.py,sha256=XduqJ51u99yOZ2njyAIIppTSqZJnd_Z8KnsGOXUkip8,1341
+curl_cffi/cli/output.py,sha256=IGBa2cN4jdSe7EScutghBXe9mcHcj59RsfIzzPLpx-s,7434
+curl_cffi/cli/parse.py,sha256=OzqGEZPqOrH2nq14UKnaXwKAblAw6V867tDEp9XSLdo,2549
+curl_cffi/cli/pro.py,sha256=pu2lnZUD91T0oayJMgPs6w6eLYKM6ZFlhHLE-g75UaM,3575
+curl_cffi/cli/request.py,sha256=ixFJEhHoymZFukc4dqw_AgNuR7fEtSkd3RZaHZdxOnk,3571
+curl_cffi/cli/run.py,sha256=zrxDpPfZPmeY3ADhjR2It2wj3hsOpqaxh88pe11-VMU,7616
+curl_cffi/const.py,sha256=gzF7UzT41jfTF7-GGkKAEhG0CIXmeIZtbNAMEZobuig,19101
+curl_cffi/curl.py,sha256=GmEF9TW0nYZ8PEcvc-Jsn_7vbymJlqGgmV0P5kzgMoY,30648
+curl_cffi/fingerprints.py,sha256=WB25rx-f_ZYdZiEMWF_egnJb8wACZrIncAqu1sHRJf8,20666
+curl_cffi/py.typed,sha256=dcrsqJrcYfTX-ckLFJMTaj6mD8aDe2u0tkQG-ZYxnEg,26
+curl_cffi/requests/__init__.py,sha256=jt8mwSVLOmFgTUOQoxrXEj-qpst8cJbLdVQXVq-U6rw,6449
+curl_cffi/requests/__pycache__/__init__.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/cache.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/cookies.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/errors.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/exceptions.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/headers.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/impersonate.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/models.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/session.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/streams.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/utils.cpython-314.pyc,,
+curl_cffi/requests/__pycache__/websockets.cpython-314.pyc,,
+curl_cffi/requests/cache.py,sha256=sMZB7BA66Ain2VUZ7qWNN-3Fmd2TiPNaxzCybHgnLxY,15629
+curl_cffi/requests/cookies.py,sha256=75TLz2wTcIz7NnETCpVVZUk8lvo02y_WFzwOa7A3aZE,13525
+curl_cffi/requests/errors.py,sha256=R6N5lmOTdRukThkNGUihDAQRu8HSh27M8E3zfUJJX74,250
+curl_cffi/requests/exceptions.py,sha256=WM3EAhADLPf_Kh4nzZOtJplTw9Nwv-vCIyeXx7FVT9g,6225
+curl_cffi/requests/headers.py,sha256=Q1jrRdJ2YMLOcl5W3WBaKZAdLbPGPPERJ6MYzos3YXk,11535
+curl_cffi/requests/impersonate.py,sha256=MIIBJxlk86nPxFyhfseyEuvY17BZTNYMafKNgGf2eXc,11188
+curl_cffi/requests/models.py,sha256=iz5k97OLrOthxAswA9abNQxiWDSQ4lWJrujUAZAMaIo,13173
+curl_cffi/requests/session.py,sha256=Mi7Wduep5maFi8p7KBsxTUfa6KB5ArLz5wWGn4j6cXE,66489
+curl_cffi/requests/streams.py,sha256=un9rtp5GL-U5A5ivyFIDcfXwxk6MMVrO2CGCbzDdpso,7090
+curl_cffi/requests/utils.py,sha256=z2Ee4gBmfUxdv_SOTQrdUtb0uUKaDAxk4kgrcVLqB3Y,37762
+curl_cffi/requests/websockets.py,sha256=Hn2Z6Jqf5SKJ-qyQyisr9Iu4vVHQYr-iT9ws_7jPHDI,72783
+curl_cffi/utils.py,sha256=xiwsOd-5W3IGNvO6yeDboOkw9wLPD2hx_SYD9i4SqVU,390

src-tauri/binaries/_internal/curl_cffi-0.16.0.dist-info/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (82.0.1)
+Generator: setuptools (83.0.0)
 Root-Is-Purelib: false
 Generator: delocate 0.13.0
 Tag: cp310-abi3-macosx_10_9_universal2

src-tauri/binaries/_internal/curl_cffi-0.16.0.dist-info/direct_url.json

@@ -0,0 +1 @@
+{"archive_info": {"hash": "sha256=66b0c44d84b669c513c4798475b5702c2dbd2f061f708bff0b2ee4c9c9563e02", "hashes": {"sha256": "66b0c44d84b669c513c4798475b5702c2dbd2f061f708bff0b2ee4c9c9563e02"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/universal2/curl_cffi-0.16.0-cp310-abi3-macosx_10_9_universal2.whl"}

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/INSTALLER

@@ -1 +0,0 @@
-uv

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/METADATA

@@ -1,133 +0,0 @@
-Metadata-Version: 2.4
-Name: importlib_metadata
-Version: 8.7.1
-Summary: Read metadata from Python packages
-Author-email: "Jason R. Coombs" <jaraco@jaraco.com>
-License-Expression: Apache-2.0
-Project-URL: Source, https://github.com/python/importlib_metadata
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Intended Audience :: Developers
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3 :: Only
-Requires-Python: >=3.9
-Description-Content-Type: text/x-rst
-License-File: LICENSE
-Requires-Dist: zipp>=3.20
-Provides-Extra: test
-Requires-Dist: pytest!=8.1.*,>=6; extra == "test"
-Requires-Dist: packaging; extra == "test"
-Requires-Dist: pyfakefs; extra == "test"
-Requires-Dist: flufl.flake8; extra == "test"
-Requires-Dist: pytest-perf>=0.9.2; extra == "test"
-Requires-Dist: jaraco.test>=5.4; extra == "test"
-Provides-Extra: doc
-Requires-Dist: sphinx>=3.5; extra == "doc"
-Requires-Dist: jaraco.packaging>=9.3; extra == "doc"
-Requires-Dist: rst.linker>=1.9; extra == "doc"
-Requires-Dist: furo; extra == "doc"
-Requires-Dist: sphinx-lint; extra == "doc"
-Requires-Dist: jaraco.tidelift>=1.4; extra == "doc"
-Provides-Extra: perf
-Requires-Dist: ipython; extra == "perf"
-Provides-Extra: check
-Requires-Dist: pytest-checkdocs>=2.4; extra == "check"
-Requires-Dist: pytest-ruff>=0.2.1; sys_platform != "cygwin" and extra == "check"
-Provides-Extra: cover
-Requires-Dist: pytest-cov; extra == "cover"
-Provides-Extra: enabler
-Requires-Dist: pytest-enabler>=3.4; extra == "enabler"
-Provides-Extra: type
-Requires-Dist: pytest-mypy>=1.0.1; extra == "type"
-Requires-Dist: mypy<1.19; platform_python_implementation == "PyPy" and extra == "type"
-Dynamic: license-file
-
-.. image:: https://img.shields.io/pypi/v/importlib_metadata.svg
-   :target: https://pypi.org/project/importlib_metadata
-
-.. image:: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
-
-.. image:: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
-   :target: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
-   :alt: tests
-
-.. image:: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json
-    :target: https://github.com/astral-sh/ruff
-    :alt: Ruff
-
-.. image:: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
-   :target: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
-
-.. image:: https://img.shields.io/badge/skeleton-2025-informational
-   :target: https://blog.jaraco.com/skeleton
-
-.. image:: https://tidelift.com/badges/package/pypi/importlib-metadata
-   :target: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm_medium=readme
-
-Library to access the metadata for a Python package.
-
-This package supplies third-party access to the functionality of
-`importlib.metadata <https://docs.python.org/3/library/importlib.metadata.html>`_
-including improvements added to subsequent Python versions.
-
-
-Compatibility
-=============
-
-New features are introduced in this third-party library and later merged
-into CPython. The following table indicates which versions of this library
-were contributed to different versions in the standard library:
-
-.. list-table::
-   :header-rows: 1
-
-   * - importlib_metadata
-     - stdlib
-   * - 7.0
-     - 3.13
-   * - 6.5
-     - 3.12
-   * - 4.13
-     - 3.11
-   * - 4.6
-     - 3.10
-   * - 1.4
-     - 3.8
-
-
-Usage
-=====
-
-See the `online documentation <https://importlib-metadata.readthedocs.io/>`_
-for usage details.
-
-`Finder authors
-<https://docs.python.org/3/reference/import.html#finders-and-loaders>`_ can
-also add support for custom package installers.  See the above documentation
-for details.
-
-
-Caveats
-=======
-
-This project primarily supports third-party packages installed by PyPA
-tools (or other conforming packages). It does not support:
-
-- Packages in the stdlib.
-- Packages installed without metadata.
-
-Project details
-===============
-
- * Project home: https://github.com/python/importlib_metadata
- * Report bugs at: https://github.com/python/importlib_metadata/issues
- * Code hosting: https://github.com/python/importlib_metadata
- * Documentation: https://importlib-metadata.readthedocs.io/
-
-For Enterprise
-==============
-
-Available as part of the Tidelift Subscription.
-
-This project and the maintainers of thousands of other packages are working with Tidelift to deliver one enterprise subscription that covers all of the open source you use.
-
-`Learn more <https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm_medium=referral&utm_campaign=github>`_.

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/RECORD

@@ -1,21 +0,0 @@
-importlib_metadata-8.7.1.dist-info/INSTALLER,sha256=5hhM4Q4mYTT9z6QB6PGpUAW81PGNFrYrdXMj4oM_6ak,2
-importlib_metadata-8.7.1.dist-info/METADATA,sha256=o-OLnuQyYonUhkcE8w4pnudp4jCc6fSnXw3hpQrQo1Y,4670
-importlib_metadata-8.7.1.dist-info/RECORD,,
-importlib_metadata-8.7.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-importlib_metadata-8.7.1.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-importlib_metadata-8.7.1.dist-info/licenses/LICENSE,sha256=RYUC4S2Xu_ZEOGBqIARKqF6wX7CoqAe7NdvsJT_R_AQ,10278
-importlib_metadata-8.7.1.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19
-importlib_metadata/__init__.py,sha256=u7Ew4-UkpzNY-ka6k-WRkDhQZS1akkLMfWs2eEnUmGo,37734
-importlib_metadata/_adapters.py,sha256=r5i8XLrKT6xmrpoREZhZrfczOYDmrVZeJBW5u0HzIGU,3797
-importlib_metadata/_collections.py,sha256=CxAhzlF3g1rwu_fMiB53JtRQiUFh0RgiMpoOvmK_ocg,760
-importlib_metadata/_compat.py,sha256=VC5ZDLlT-BcshauCShdFJvMNLntJJfZzNK1meGa-enw,1313
-importlib_metadata/_functools.py,sha256=0pA2OoiVK6wnsGq8HvVIzgdkvLiZ0nfnfw7IsndjoHk,3510
-importlib_metadata/_itertools.py,sha256=nMvp9SfHAQ_JYwK4L2i64lr3GRXGlYlikGTVzWbys_E,5351
-importlib_metadata/_meta.py,sha256=EtHyiJ5kGzWFDfKyQ2XQp6Vu113CeadKW1Vf6aGc1B4,1765
-importlib_metadata/_text.py,sha256=HCsFksZpJLeTP3NEk_ngrAeXVRRtTrtyh9eOABoRP4A,2166
-importlib_metadata/_typing.py,sha256=EQKhhsEgz_Sa-FnePI-faC72rNOOQwopjA1i5pG8FDU,367
-importlib_metadata/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-importlib_metadata/compat/py311.py,sha256=uqm-K-uohyj1042TH4a9Er_I5o7667DvulcD-gC_fSA,608
-importlib_metadata/compat/py39.py,sha256=J3W7PUVRPNYMmcvT12RF8ndBU9e8_T0Ac4U87Bsrq70,1187
-importlib_metadata/diagnose.py,sha256=nkSRMiowlmkhLYhKhvCg9glmt_11Cox-EmLzEbqYTa8,379
-importlib_metadata/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/WHEEL

@@ -1,5 +0,0 @@
-Wheel-Version: 1.0
-Generator: setuptools (80.9.0)
-Root-Is-Purelib: true
-Tag: py3-none-any
-

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/licenses/LICENSE

@@ -1,73 +0,0 @@
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
-
-"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
-
-"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
-
-     (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
-
-     (b) You must cause any modified files to carry prominent notices stating that You changed the files; and
-
-     (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
-
-     (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
-
-     You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!)  The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
-
-Copyright 2025 [name of copyright owner]
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.

src-tauri/binaries/_internal/setuptools/_vendor/importlib_metadata-8.7.1.dist-info/top_level.txt

@@ -1 +0,0 @@
-importlib_metadata

src-tauri/binaries/_internal/setuptools/_vendor/jaraco/text/Lorem ipsum.txt

@@ -1,2 +0,0 @@
-Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
-Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque. Aliquam faucibus, elit ut dictum aliquet, felis nisl adipiscing sapien, sed malesuada diam lacus eget erat. Cras mollis scelerisque nunc. Nullam arcu. Aliquam consequat. Curabitur augue lorem, dapibus quis, laoreet et, pretium ac, nisi. Aenean magna nisl, mollis quis, molestie eu, feugiat in, orci. In hac habitasse platea dictumst.

src-tauri/binaries/_internal/websockets-16.0.dist-info/RECORD

@@ -1,110 +0,0 @@
-../../../bin/websockets,sha256=Aec6LJ-SgqOC29VvGIAfJo3DbDp5-znjkFZaF7aEUTM,188
-websockets-16.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
-websockets-16.0.dist-info/METADATA,sha256=JcDvWo8DVSw5uoDAFbk9N8fJXuRJvnrcLXVBFyBjwN8,6799
-websockets-16.0.dist-info/RECORD,,
-websockets-16.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-websockets-16.0.dist-info/WHEEL,sha256=MzHA8aA11K4m-mjpjTobbWUqTlhv5RdoytLBFWQb_k4,142
-websockets-16.0.dist-info/direct_url.json,sha256=CKQvi9piWBTuZxzuK4J8f71FvL_6alBevkUUKBa4QCg,310
-websockets-16.0.dist-info/entry_points.txt,sha256=Dnhn4dm5EsI4ZMAsHldGF6CwBXZrGXnR7cnK2-XR7zY,51
-websockets-16.0.dist-info/licenses/LICENSE,sha256=PWoMBQ2L7FL6utUC5F-yW9ArytvXDeo01Ee2oP9Obag,1514
-websockets-16.0.dist-info/top_level.txt,sha256=CMpdKklxKsvZgCgyltxUWOHibZXZ1uYIVpca9xsQ8Hk,11
-websockets/__init__.py,sha256=AC2Hq92uSc_WOo9_xvITpGshJ7Dy0Md5m2_ywsdSt_Y,7058
-websockets/__main__.py,sha256=wu5N2wk8mvBgyvr2ghmQf4prezAe0_i-p123VVreyYc,62
-websockets/__pycache__/__init__.cpython-314.pyc,,
-websockets/__pycache__/__main__.cpython-314.pyc,,
-websockets/__pycache__/auth.cpython-314.pyc,,
-websockets/__pycache__/cli.cpython-314.pyc,,
-websockets/__pycache__/client.cpython-314.pyc,,
-websockets/__pycache__/connection.cpython-314.pyc,,
-websockets/__pycache__/datastructures.cpython-314.pyc,,
-websockets/__pycache__/exceptions.cpython-314.pyc,,
-websockets/__pycache__/frames.cpython-314.pyc,,
-websockets/__pycache__/headers.cpython-314.pyc,,
-websockets/__pycache__/http.cpython-314.pyc,,
-websockets/__pycache__/http11.cpython-314.pyc,,
-websockets/__pycache__/imports.cpython-314.pyc,,
-websockets/__pycache__/protocol.cpython-314.pyc,,
-websockets/__pycache__/proxy.cpython-314.pyc,,
-websockets/__pycache__/server.cpython-314.pyc,,
-websockets/__pycache__/streams.cpython-314.pyc,,
-websockets/__pycache__/typing.cpython-314.pyc,,
-websockets/__pycache__/uri.cpython-314.pyc,,
-websockets/__pycache__/utils.cpython-314.pyc,,
-websockets/__pycache__/version.cpython-314.pyc,,
-websockets/asyncio/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-websockets/asyncio/__pycache__/__init__.cpython-314.pyc,,
-websockets/asyncio/__pycache__/async_timeout.cpython-314.pyc,,
-websockets/asyncio/__pycache__/client.cpython-314.pyc,,
-websockets/asyncio/__pycache__/compatibility.cpython-314.pyc,,
-websockets/asyncio/__pycache__/connection.cpython-314.pyc,,
-websockets/asyncio/__pycache__/messages.cpython-314.pyc,,
-websockets/asyncio/__pycache__/router.cpython-314.pyc,,
-websockets/asyncio/__pycache__/server.cpython-314.pyc,,
-websockets/asyncio/async_timeout.py,sha256=N-6Mubyiaoh66PAXGvCzhgxCM-7V2XiRnH32Xi6J6TE,8971
-websockets/asyncio/client.py,sha256=e4xlgtzb3v29M2vN-UDiyoUtThg--d5GqKg3lt2pDdE,30850
-websockets/asyncio/compatibility.py,sha256=gkenDDhzNbm6_iXV5Edvbvp6uHZYdrTvGNjt8P_JtyQ,786
-websockets/asyncio/connection.py,sha256=87RdVURijJk8V-ShWAWfTEyhW5Z1YUXKV8ezUzxt5L0,49099
-websockets/asyncio/messages.py,sha256=u2M5WKY9xPyw8G3nKoXfdO5K41hrTnf4MdizVHzgdM4,11129
-websockets/asyncio/router.py,sha256=S-69vszK-SqUCcZbXXPOnux-eH2fTHYC2JNh7tOtmmA,7520
-websockets/asyncio/server.py,sha256=wQ9oBc0WBOIzbXKDYJ8UhXRTeoXrSfLu6CWCrUl-vck,37941
-websockets/auth.py,sha256=U_Jwmn59ZRQ6EecpOvMizQCG_ZbAvgUf1ik7haZRC3c,568
-websockets/cli.py,sha256=YnegH59z93JxSVIGiXiWhR3ktgI6k1_pf_BRLanxKrQ,5336
-websockets/client.py,sha256=fljI5k5oQ-Sfm53MCoyTlr2jFtOOIuO13H9bbtpBPes,13789
-websockets/connection.py,sha256=OLiMVkNd25_86sB8Q7CrCwBoXy9nA0OCgdgLRA8WUR8,323
-websockets/datastructures.py,sha256=Uq2CpjmXak9_pPWcOqh36rzJMo8eCi2lVPTFWDvK5sA,5518
-websockets/exceptions.py,sha256=bgaMdqQGGZosAEULeCB30XW2YnwomWa3c8YOrEfeOoY,12859
-websockets/extensions/__init__.py,sha256=QkZsxaJVllVSp1uhdD5uPGibdbx_091GrVVfS5LXcpw,98
-websockets/extensions/__pycache__/__init__.cpython-314.pyc,,
-websockets/extensions/__pycache__/base.cpython-314.pyc,,
-websockets/extensions/__pycache__/permessage_deflate.cpython-314.pyc,,
-websockets/extensions/base.py,sha256=JNfyk543C7VuPH0QOobiqKoGrzjJILje6sz5ILvOPl4,2903
-websockets/extensions/permessage_deflate.py,sha256=AkuhkAKFo5lqJQMXnckbSs9b2KBBrOFsE1DHIcbLL3k,25770
-websockets/frames.py,sha256=5IK4GZpl8ukr0bZ_UA_jjjztK09yYQAl9m5NVmGLiK0,12889
-websockets/headers.py,sha256=yQnPljVZwV1_V-pOSRKNLG_u827wFC1h72cciojcQ8M,16046
-websockets/http.py,sha256=T1tNLmbkFCneXQ6qepBmsVVDXyP9i500IVzTJTeBMR4,659
-websockets/http11.py,sha256=T8ai5BcBGkV0n9It63oDeNpmtQMyg8Cpav5rf_yT0r4,15619
-websockets/imports.py,sha256=T_B9TUmHoceKMQ-PNphdQQAH2XdxAxwSQNeQEgqILkE,2795
-websockets/legacy/__init__.py,sha256=wQ5zRIENGUS_5eKNAX9CRE7x1TwKapKimrQFFWN9Sxs,276
-websockets/legacy/__pycache__/__init__.cpython-314.pyc,,
-websockets/legacy/__pycache__/auth.cpython-314.pyc,,
-websockets/legacy/__pycache__/client.cpython-314.pyc,,
-websockets/legacy/__pycache__/exceptions.cpython-314.pyc,,
-websockets/legacy/__pycache__/framing.cpython-314.pyc,,
-websockets/legacy/__pycache__/handshake.cpython-314.pyc,,
-websockets/legacy/__pycache__/http.cpython-314.pyc,,
-websockets/legacy/__pycache__/protocol.cpython-314.pyc,,
-websockets/legacy/__pycache__/server.cpython-314.pyc,,
-websockets/legacy/auth.py,sha256=DcQcCSeVeP93JcH8vFWE0HIJL-X-f23LZ0DsJpav1So,6531
-websockets/legacy/client.py,sha256=fV2mbiU9rciXhJfAEKVSm0GztJDUbDpRQ-K5EMbkuQ0,26815
-websockets/legacy/exceptions.py,sha256=ViEjpoT09fzx_Zqf0aNGDVtRDNjXaOw0gdCta3LkjFc,1924
-websockets/legacy/framing.py,sha256=r9P1wiXv_1XuAVQw8SOPkuE9d4eZ0r_JowAkz9-WV4w,6366
-websockets/legacy/handshake.py,sha256=2Nzr5AN2xvDC5EdNP-kB3lOcrAaUNlYuj_-hr_jv7pM,5285
-websockets/legacy/http.py,sha256=cOCQmDWhIKQmm8UWGXPW7CDZg03wjogCsb0LP9oetNQ,7061
-websockets/legacy/protocol.py,sha256=ajtVXDb-lEm9BN0NF3iEaTI_b1q5fBCKTB9wvUoGOxY,63632
-websockets/legacy/server.py,sha256=7mwY-yD0ljNF93oPYumTWD7OIVbCWtaEOw1FFJBhIAM,45251
-websockets/protocol.py,sha256=vTqjPIg2HmO-bSxsczuEmWMxPTxPXU1hmVUjqnahV44,27247
-websockets/proxy.py,sha256=oFrbEYtasYWv-WDcniObD9nBR5Q5qkHpyCVLngx7WMQ,4969
-websockets/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-websockets/server.py,sha256=E4SWBA8WZRmAOpsUm-oCqacBGZre9e0iDmDIrfpV21Q,21790
-websockets/speedups.c,sha256=u_dncR4M38EX6He_fzb1TY6D3Hke67ZpoHLLhZZ0hvQ,5920
-websockets/speedups.cpython-314-darwin.so,sha256=G3h5TQnbLQ1QpRmDTLznIO5RkWVjFwHMJFy_2-5zXwM,84144
-websockets/speedups.pyi,sha256=unjvBNg-uW4c7z-9OW4WiSzZk_QH2bLEcjYAMuoSgBI,102
-websockets/streams.py,sha256=pXqga7ttjuF6lChWYiWLSfUlt3FCaQpEX1ae_jvcCeQ,4071
-websockets/sync/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-websockets/sync/__pycache__/__init__.cpython-314.pyc,,
-websockets/sync/__pycache__/client.cpython-314.pyc,,
-websockets/sync/__pycache__/connection.cpython-314.pyc,,
-websockets/sync/__pycache__/messages.cpython-314.pyc,,
-websockets/sync/__pycache__/router.cpython-314.pyc,,
-websockets/sync/__pycache__/server.cpython-314.pyc,,
-websockets/sync/__pycache__/utils.cpython-314.pyc,,
-websockets/sync/client.py,sha256=_2Erytw1f3f9O_u2jLtS1oNV4HsHUi_h3lGvT9ZEaDQ,22108
-websockets/sync/connection.py,sha256=1pJYEMRHLWIN7538vJcIeFVnvSXVrD0n1xrfX7wDNSc,41868
-websockets/sync/messages.py,sha256=yZV1zhY07ZD0vRF5b1yDa7ug0rbA5UDOCCCQmWwAcds,12858
-websockets/sync/router.py,sha256=BqKSAKNZYtRWiOxol9qYeyfgyXRrMNJ6FrTTZLNcXMg,7172
-websockets/sync/server.py,sha256=s07HNK_2s1kLN62Uqc77uvND0z7C0YTXGePsCiBtXaE,27655
-websockets/sync/utils.py,sha256=TtW-ncYFvJmiSW2gO86ngE2BVsnnBdL-4H88kWNDYbg,1107
-websockets/typing.py,sha256=A6xh4m65pRzKAbuOs0kFuGhL4DWIIko-ppS4wvJVc0Q,1946
-websockets/uri.py,sha256=2fFMw-AbKJ5HVHNCuw1Rx1MnkCkNWRpogxWhhM30EU4,3125
-websockets/utils.py,sha256=AwhS4UmlbKv7meAaR7WNbUqD5JFoStOP1bAyo9sRMus,1197
-websockets/version.py,sha256=IhaztWxysdY-pd-0nOubnnPduvySSvdoBwrQdJKtZ2g,3202

src-tauri/binaries/_internal/websockets-16.0.dist-info/direct_url.json

@@ -1 +0,0 @@
-{"archive_info": {"hash": "sha256=8cc451a50f2aee53042ac52d2d053d08bf89bcb31ae799cb4487587661c038a0", "hashes": {"sha256": "8cc451a50f2aee53042ac52d2d053d08bf89bcb31ae799cb4487587661c038a0"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/wheels/websockets-16.0-cp314-cp314-macosx_10_15_universal2.whl"}

src-tauri/binaries/_internal/websockets-17.0.1.dist-info/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websockets
-Version: 16.0
+Version: 17.0.1
 Summary: An implementation of the WebSocket Protocol (RFC 6455 & 7692)
 Author-email: Aymeric Augustin <aymeric.augustin@m4x.org>
 License-Expression: BSD-3-Clause
@@ -16,12 +16,12 @@ Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Python: >=3.10
+Classifier: Programming Language :: Python :: 3.15
+Requires-Python: >=3.11
 Description-Content-Type: text/x-rst
 License-File: LICENSE
 Dynamic: description
@@ -32,7 +32,7 @@ Dynamic: license-file
    :width: 480px
    :alt: websockets
 
-|licence| |version| |pyversions| |tests| |docs| |openssf|
+|licence| |version| |pyversions|
 
 .. |licence| image:: https://img.shields.io/pypi/l/websockets.svg
     :target: https://pypi.python.org/pypi/websockets
@@ -43,15 +43,6 @@ Dynamic: license-file
 .. |pyversions| image:: https://img.shields.io/pypi/pyversions/websockets.svg
     :target: https://pypi.python.org/pypi/websockets
 
-.. |tests| image:: https://img.shields.io/github/checks-status/python-websockets/websockets/main?label=tests
-   :target: https://github.com/python-websockets/websockets/actions/workflows/tests.yml
-
-.. |docs| image:: https://img.shields.io/readthedocs/websockets.svg
-   :target: https://websockets.readthedocs.io/
-
-.. |openssf| image:: https://bestpractices.coreinfrastructure.org/projects/6475/badge
-   :target: https://bestpractices.coreinfrastructure.org/projects/6475
-
 What is ``websockets``?
 -----------------------
 
@@ -63,8 +54,8 @@ with a focus on correctness, simplicity, robustness, and performance.
 Built on top of ``asyncio``, Python's standard asynchronous I/O framework, the
 default implementation provides an elegant coroutine-based API.
 
-An implementation on top of ``threading`` and a Sans-I/O implementation are also
-available.
+Implementations on top of ``threading`` and ``trio`` are also provided, as well
+as a Sans-I/O layer for integration in third-party projects.
 
 `Documentation is available on Read the Docs. <https://websockets.readthedocs.io/>`_
 
@@ -84,8 +75,8 @@ Here's an echo server with the ``asyncio`` API:
             await websocket.send(message)
 
     async def main():
-        async with serve(echo, "localhost", 8765) as server:
-            await server.serve_forever()
+        server = await serve(echo, "localhost", 8765)
+        await server.serve_forever()
 
     asyncio.run(main())
 

src-tauri/binaries/_internal/websockets-17.0.1.dist-info/RECORD

@@ -0,0 +1,118 @@
+../../../bin/websockets,sha256=Aec6LJ-SgqOC29VvGIAfJo3DbDp5-znjkFZaF7aEUTM,188
+websockets-17.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+websockets-17.0.1.dist-info/METADATA,sha256=Z_btpoffz0ubiHVmim0rYjFMxNdOn_LhaVusK8CZCIA,6342
+websockets-17.0.1.dist-info/RECORD,,
+websockets-17.0.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets-17.0.1.dist-info/WHEEL,sha256=dgBSXaLX3dDB-DVpHT16BsaK8hj0ZwMOLjJBjWhNK_4,142
+websockets-17.0.1.dist-info/direct_url.json,sha256=tKRa4U_R4U5WX4GMQa3dJ7UPcGjl5stIKOYKaN-F0pw,312
+websockets-17.0.1.dist-info/entry_points.txt,sha256=Dnhn4dm5EsI4ZMAsHldGF6CwBXZrGXnR7cnK2-XR7zY,51
+websockets-17.0.1.dist-info/licenses/LICENSE,sha256=PWoMBQ2L7FL6utUC5F-yW9ArytvXDeo01Ee2oP9Obag,1514
+websockets-17.0.1.dist-info/top_level.txt,sha256=CMpdKklxKsvZgCgyltxUWOHibZXZ1uYIVpca9xsQ8Hk,11
+websockets/__init__.py,sha256=zmBCJj7EIa6ZJEQDp4dIdznfzAJUA8dW41-j7Em-QDQ,7450
+websockets/__main__.py,sha256=wu5N2wk8mvBgyvr2ghmQf4prezAe0_i-p123VVreyYc,62
+websockets/__pycache__/__init__.cpython-314.pyc,,
+websockets/__pycache__/__main__.cpython-314.pyc,,
+websockets/__pycache__/auth.cpython-314.pyc,,
+websockets/__pycache__/cli.cpython-314.pyc,,
+websockets/__pycache__/client.cpython-314.pyc,,
+websockets/__pycache__/connection.cpython-314.pyc,,
+websockets/__pycache__/datastructures.cpython-314.pyc,,
+websockets/__pycache__/exceptions.cpython-314.pyc,,
+websockets/__pycache__/frames.cpython-314.pyc,,
+websockets/__pycache__/headers.cpython-314.pyc,,
+websockets/__pycache__/http11.cpython-314.pyc,,
+websockets/__pycache__/imports.cpython-314.pyc,,
+websockets/__pycache__/protocol.cpython-314.pyc,,
+websockets/__pycache__/proxy.cpython-314.pyc,,
+websockets/__pycache__/server.cpython-314.pyc,,
+websockets/__pycache__/streams.cpython-314.pyc,,
+websockets/__pycache__/typing.cpython-314.pyc,,
+websockets/__pycache__/uri.cpython-314.pyc,,
+websockets/__pycache__/utils.cpython-314.pyc,,
+websockets/__pycache__/version.cpython-314.pyc,,
+websockets/asyncio/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets/asyncio/__pycache__/__init__.cpython-314.pyc,,
+websockets/asyncio/__pycache__/client.cpython-314.pyc,,
+websockets/asyncio/__pycache__/connection.cpython-314.pyc,,
+websockets/asyncio/__pycache__/messages.cpython-314.pyc,,
+websockets/asyncio/__pycache__/router.cpython-314.pyc,,
+websockets/asyncio/__pycache__/server.cpython-314.pyc,,
+websockets/asyncio/client.py,sha256=oAvlgEjRXixmIrttbQZ4AgiA8oetA8EjxmM_36bqoVE,32062
+websockets/asyncio/connection.py,sha256=V3L-PrXG8jZ_6IytI-9ftA-JOlmKXlnI9oCS1gWxsIM,49596
+websockets/asyncio/messages.py,sha256=vBPd93IuL3LE0OSxeaICIjzvyoht53kmh-_Zho-bGzU,11096
+websockets/asyncio/router.py,sha256=gUdYn2dc--kT-kNEFOa_qwo_d5vaX34WyoRNuPOSVrU,7743
+websockets/asyncio/server.py,sha256=6Xop-Re8SqhKsBUEtrpc89etFuQiWPPyc9gz7Acrhmo,34111
+websockets/auth.py,sha256=U_Jwmn59ZRQ6EecpOvMizQCG_ZbAvgUf1ik7haZRC3c,568
+websockets/cli.py,sha256=fYf0YqrWIx_iJDA-RWdczh5vjO9p6ZxZvmE761bUQg0,6892
+websockets/client.py,sha256=Dp4j89uLnzXsItZasDs8hV045YfRpX6fYJVuhmuEDA0,14050
+websockets/connection.py,sha256=OLiMVkNd25_86sB8Q7CrCwBoXy9nA0OCgdgLRA8WUR8,323
+websockets/datastructures.py,sha256=XGTvvgFdZSevNV_T6-Lo-Dxm2VHxJcgKl4l1DNQ6fU8,7238
+websockets/exceptions.py,sha256=tp0_EyqQfd7CYNOHmxAieOH8Ed9PSQFt18e-CuReTOY,14308
+websockets/extensions/__init__.py,sha256=QkZsxaJVllVSp1uhdD5uPGibdbx_091GrVVfS5LXcpw,98
+websockets/extensions/__pycache__/__init__.cpython-314.pyc,,
+websockets/extensions/__pycache__/base.cpython-314.pyc,,
+websockets/extensions/__pycache__/permessage_deflate.cpython-314.pyc,,
+websockets/extensions/base.py,sha256=JNfyk543C7VuPH0QOobiqKoGrzjJILje6sz5ILvOPl4,2903
+websockets/extensions/permessage_deflate.py,sha256=IAXdCGY60zfdjatKd6fDfTMizOeQYsnh0zBtL9vPuzA,25840
+websockets/frames.py,sha256=Twiqn_buvQiblERugcT-MDmnPZ7kt-FMXESe2DhOT9o,16709
+websockets/headers.py,sha256=yQnPljVZwV1_V-pOSRKNLG_u827wFC1h72cciojcQ8M,16046
+websockets/http11.py,sha256=tLVuNvNADwt8d1ui5KMFKZCZMTtJ6CqXZveogLaPbf0,18245
+websockets/imports.py,sha256=T_B9TUmHoceKMQ-PNphdQQAH2XdxAxwSQNeQEgqILkE,2795
+websockets/legacy/__init__.py,sha256=wQ5zRIENGUS_5eKNAX9CRE7x1TwKapKimrQFFWN9Sxs,276
+websockets/legacy/__pycache__/__init__.cpython-314.pyc,,
+websockets/legacy/__pycache__/auth.cpython-314.pyc,,
+websockets/legacy/__pycache__/client.cpython-314.pyc,,
+websockets/legacy/__pycache__/exceptions.cpython-314.pyc,,
+websockets/legacy/__pycache__/framing.cpython-314.pyc,,
+websockets/legacy/__pycache__/handshake.cpython-314.pyc,,
+websockets/legacy/__pycache__/http.cpython-314.pyc,,
+websockets/legacy/__pycache__/protocol.cpython-314.pyc,,
+websockets/legacy/__pycache__/server.cpython-314.pyc,,
+websockets/legacy/auth.py,sha256=DcQcCSeVeP93JcH8vFWE0HIJL-X-f23LZ0DsJpav1So,6531
+websockets/legacy/client.py,sha256=5oJurUczPddXi8Rde5fA2hD3V4pnv__Z64pRRXP6HBs,27226
+websockets/legacy/exceptions.py,sha256=ViEjpoT09fzx_Zqf0aNGDVtRDNjXaOw0gdCta3LkjFc,1924
+websockets/legacy/framing.py,sha256=b0wMx83XTIXVZoO60pl3AibKHbQlDb7rBAyhFEkaMCk,6374
+websockets/legacy/handshake.py,sha256=2Nzr5AN2xvDC5EdNP-kB3lOcrAaUNlYuj_-hr_jv7pM,5285
+websockets/legacy/http.py,sha256=cOCQmDWhIKQmm8UWGXPW7CDZg03wjogCsb0LP9oetNQ,7061
+websockets/legacy/protocol.py,sha256=1WUIzDHBew-NZ1ewhmct_WT0ycdTxT4HDdg-Im71z4Y,63456
+websockets/legacy/server.py,sha256=hSk4nFTsI3eMRbu5JcI4gXei9Ubw07RSrSjtL4eM2gc,44835
+websockets/protocol.py,sha256=3HuCBMLTJMxp9JHd5JMBqtTF84SsY29iuHH0yznuD_Q,27204
+websockets/proxy.py,sha256=oFrbEYtasYWv-WDcniObD9nBR5Q5qkHpyCVLngx7WMQ,4969
+websockets/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets/server.py,sha256=7kEJL1QEFO8pTB90wP4fUbkzYGDcbkTa7jTvdiSZtQk,24679
+websockets/speedups.c,sha256=u_dncR4M38EX6He_fzb1TY6D3Hke67ZpoHLLhZZ0hvQ,5920
+websockets/speedups.cpython-314-darwin.so,sha256=pJidRkiyZA-9quLsUEgjRjs8b8bpobn1FV25pvq38KM,84144
+websockets/speedups.pyi,sha256=unjvBNg-uW4c7z-9OW4WiSzZk_QH2bLEcjYAMuoSgBI,102
+websockets/streams.py,sha256=rJrDNSL9hy3EJYc1PFHjYx4rdd1vELCua0CwdFiHN_8,4610
+websockets/sync/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets/sync/__pycache__/__init__.cpython-314.pyc,,
+websockets/sync/__pycache__/client.cpython-314.pyc,,
+websockets/sync/__pycache__/connection.cpython-314.pyc,,
+websockets/sync/__pycache__/messages.cpython-314.pyc,,
+websockets/sync/__pycache__/router.cpython-314.pyc,,
+websockets/sync/__pycache__/server.cpython-314.pyc,,
+websockets/sync/__pycache__/utils.cpython-314.pyc,,
+websockets/sync/client.py,sha256=j9fvsOwCzJgQnaAyOaVYw6iT_IdPEM70JFLjeqXz2jw,22216
+websockets/sync/connection.py,sha256=xJeJZZZnbILJUhcNg_lBWL26Imv-t2jsnnO5y_ecHf4,48298
+websockets/sync/messages.py,sha256=q8K1vxdrqVk1bvn3zW1Jx09TlakIWSyYcOHC7ueFQmk,12826
+websockets/sync/router.py,sha256=BqKSAKNZYtRWiOxol9qYeyfgyXRrMNJ6FrTTZLNcXMg,7172
+websockets/sync/server.py,sha256=fVZZiaWW8ISoqFcJY5ZNa-MBxtLCYCP4ALJAtncgF3A,34346
+websockets/sync/utils.py,sha256=TtW-ncYFvJmiSW2gO86ngE2BVsnnBdL-4H88kWNDYbg,1107
+websockets/trio/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+websockets/trio/__pycache__/__init__.cpython-314.pyc,,
+websockets/trio/__pycache__/client.cpython-314.pyc,,
+websockets/trio/__pycache__/connection.cpython-314.pyc,,
+websockets/trio/__pycache__/messages.cpython-314.pyc,,
+websockets/trio/__pycache__/router.cpython-314.pyc,,
+websockets/trio/__pycache__/server.cpython-314.pyc,,
+websockets/trio/__pycache__/utils.cpython-314.pyc,,
+websockets/trio/client.py,sha256=VwpJ9bYECIPMrssX7OQ2rriNVjB3LitDqXSHEfEJwQI,29509
+websockets/trio/connection.py,sha256=lalwJYhFNZqYDP7e69oo9KXebFNsbyM8wlmoqsMcf0s,49218
+websockets/trio/messages.py,sha256=goDc5rfINExnvyfETWYYDT3-thgRJd7DPr4ujwJD3P8,10269
+websockets/trio/router.py,sha256=qZL9-44mi9SOOTGU3CLBPuaCNzafQGqZ-fJl9hVpv-s,7196
+websockets/trio/server.py,sha256=jRtrfZf3hHp1aQo6ffNMN7siaWzvZVhqC1iq1_Pj0sA,25805
+websockets/trio/utils.py,sha256=A12NYUPOjQaiGusak43oWzPIcCxhikKTkAJLXtZJvcY,956
+websockets/typing.py,sha256=zL4Pi_pQHJGVlL4cTyFauqxgMBAFI5B6dfvMVn7SFYs,1710
+websockets/uri.py,sha256=2fFMw-AbKJ5HVHNCuw1Rx1MnkCkNWRpogxWhhM30EU4,3125
+websockets/utils.py,sha256=Wdtsh2qQiHLrXUBEnp3LatMLJTZjB2CErbeOFvrdXvE,2022
+websockets/version.py,sha256=TJPgFOcL4xsH8I2KiQu1V3j8kSHbOd_EWKNVnnOu8SE,3204

src-tauri/binaries/_internal/websockets-17.0.1.dist-info/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (80.9.0)
+Generator: setuptools (83.0.0)
 Root-Is-Purelib: false
 Tag: cp314-cp314-macosx_10_15_universal2
 Generator: delocate 0.13.0

src-tauri/binaries/_internal/websockets-17.0.1.dist-info/direct_url.json

@@ -0,0 +1 @@
+{"archive_info": {"hash": "sha256=53b90c00bc6201ab6695c7ff51a04d0e425514c37515e9eeecd2c1b978ac6c0e", "hashes": {"sha256": "53b90c00bc6201ab6695c7ff51a04d0e425514c37515e9eeecd2c1b978ac6c0e"}}, "url": "file:///Users/runner/work/yt-dlp/yt-dlp/build/wheels/websockets-17.0.1-cp314-cp314-macosx_10_15_universal2.whl"}

src-tauri/src/db.rs

@@ -10,6 +10,12 @@ const LEGACY_BUNDLE_IDENTIFIER: &str = "com.nima.tauri-app";
 const CURRENT_SCHEMA_VERSION: i64 = 1;
 pub(crate) const TOKEN_CHANGED_NOTICE: &str = "pairing-token-changed";
 pub const PAIRING_TOKEN_KEYCHAIN_ID: &str = "extension-pairing-token";
+// Development builds are a different executable identity from the packaged
+// app. Keep their credentials separate so a debug binary cannot trigger an
+// access prompt for, or reuse, the release app's Keychain item.
+#[cfg(debug_assertions)]
+const KEYCHAIN_SERVICE: &str = "com.firelink.app.dev";
+#[cfg(not(debug_assertions))]
 const KEYCHAIN_SERVICE: &str = "com.firelink.app";
 static KEYRING_OPERATION_LOCK: Mutex<()> = Mutex::new(());
 
@@ -45,18 +51,17 @@ struct LegacyData {
 }
 
 pub fn init(storage_layout: &crate::storage::StorageLayout) -> Result<DbState, String> {
-    init_at_path_internal(storage_layout.data_dir(), storage_layout.is_portable(), false)
+    init_at_path_internal(storage_layout.data_dir(), storage_layout.is_portable())
 }
 
 #[cfg(test)]
 fn init_at_path(app_data_dir: &Path) -> Result<DbState, String> {
-    init_at_path_internal(app_data_dir, false, false)
+    init_at_path_internal(app_data_dir, false)
 }
 
 fn init_at_path_internal(
     app_data_dir: &Path,
     portable: bool,
-    migrate_legacy_keychain: bool,
 ) -> Result<DbState, String> {
     fs::create_dir_all(app_data_dir)
         .map_err(|error| format!("failed to create app data directory: {error}"))?;
@@ -78,12 +83,7 @@ fn init_at_path_internal(
     }
     migrate_schema(&mut connection, version)?;
 
-    import_legacy_data(
-        &mut connection,
-        app_data_dir,
-        portable,
-        migrate_legacy_keychain,
-    )?;
+    import_legacy_data(&mut connection, app_data_dir, portable)?;
     if portable {
         sanitize_persisted_downloads(&mut connection)?;
     }
@@ -188,7 +188,6 @@ fn import_legacy_data(
     connection: &mut Connection,
     app_data_dir: &Path,
     portable: bool,
-    migrate_keychain: bool,
 ) -> Result<(), String> {
     let legacy_app_dir = app_data_dir
         .parent()
@@ -226,31 +225,10 @@ fn import_legacy_data(
         let mut pending_pairing_token = None;
         if !portable {
             if let Some(token) = legacy.pairing_token.take() {
-                let migrated = if migrate_keychain {
-                    let keychain_has_token = get_keychain_password(PAIRING_TOKEN_KEYCHAIN_ID)
-                        .ok()
-                        .is_some_and(|value| !value.trim().is_empty());
-                    if !keychain_has_token {
-                        if let Err(error) =
-                            set_keychain_password(PAIRING_TOKEN_KEYCHAIN_ID, &token)
-                        {
-                            log::warn!(
-                                "Legacy pairing token could not be migrated to the credential store; it will remain pending in the current database: {}",
-                                error
-                            );
-                            false
-                        } else {
-                            true
-                        }
-                    } else {
-                        true
-                    }
-                } else {
-                    false
-                };
-                if !migrated {
-                    pending_pairing_token = Some(token);
-                }
+                // Legacy migration is deliberately deferred until the
+                // explicit frontend consent action. Database initialization
+                // must never touch the OS credential store.
+                pending_pairing_token = Some(token);
             }
         }
         if portable {
@@ -707,6 +685,188 @@ pub fn save_settings(connection: &Connection, data: &str) -> Result<(), String>
     Ok(())
 }
 
+fn settings_state_mut(
+    document: &mut Value,
+) -> Result<&mut serde_json::Map<String, Value>, String> {
+    if document.get("state").is_some() {
+        document
+            .get_mut("state")
+            .and_then(Value::as_object_mut)
+            .ok_or_else(|| "persisted settings state must be an object".to_string())
+    } else {
+        document
+            .as_object_mut()
+            .ok_or_else(|| "persisted settings must be an object".to_string())
+    }
+}
+
+fn add_site_login_to_settings(
+    data: &str,
+    id: &str,
+    url_pattern: &str,
+    username: &str,
+) -> Result<String, String> {
+    let mut document: Value = serde_json::from_str(data)
+        .map_err(|error| format!("failed to decode settings: {error}"))?;
+    let state = settings_state_mut(&mut document)?;
+    let logins = state
+        .entry("siteLogins")
+        .or_insert_with(|| Value::Array(Vec::new()));
+    let logins = logins
+        .as_array_mut()
+        .ok_or_else(|| "persisted site logins must be an array".to_string())?;
+    if logins.iter().any(|login| {
+        login
+            .get("id")
+            .and_then(Value::as_str)
+            .is_some_and(|existing_id| existing_id == id)
+    }) {
+        return Err("site login already exists".to_string());
+    }
+    logins.push(serde_json::json!({
+        "id": id,
+        "urlPattern": url_pattern,
+        "username": username,
+    }));
+    serde_json::to_string(&document)
+        .map_err(|error| format!("failed to encode settings: {error}"))
+}
+
+fn remove_site_login_from_settings(
+    data: &str,
+    id: &str,
+) -> Result<(String, bool), String> {
+    let mut document: Value = serde_json::from_str(data)
+        .map_err(|error| format!("failed to decode settings: {error}"))?;
+    let state = settings_state_mut(&mut document)?;
+    let Some(logins) = state.get_mut("siteLogins") else {
+        return Ok((data.to_string(), false));
+    };
+    let logins = logins
+        .as_array_mut()
+        .ok_or_else(|| "persisted site logins must be an array".to_string())?;
+    let original_len = logins.len();
+    logins.retain(|login| {
+        login
+            .get("id")
+            .and_then(Value::as_str)
+            .is_none_or(|existing_id| existing_id != id)
+    });
+    if logins.len() == original_len {
+        return Ok((data.to_string(), false));
+    }
+    let updated = serde_json::to_string(&document)
+        .map_err(|error| format!("failed to encode settings: {error}"))?;
+    Ok((updated, true))
+}
+
+fn validate_site_login_id(id: &str) -> Result<&str, String> {
+    let trimmed = id.trim();
+    if trimmed.is_empty()
+        || trimmed != id
+        || trimmed == PAIRING_TOKEN_KEYCHAIN_ID
+    {
+        return Err("invalid site login identifier".to_string());
+    }
+    Ok(trimmed)
+}
+
+fn validate_site_login_input(
+    id: &str,
+    url_pattern: &str,
+    username: &str,
+    password: &str,
+) -> Result<(), String> {
+    validate_site_login_id(id)?;
+    if url_pattern.trim().is_empty() || url_pattern.chars().any(char::is_whitespace) {
+        return Err("site login URL pattern must be non-empty and contain no whitespace".to_string());
+    }
+    if username.trim().is_empty() {
+        return Err("site login username must be non-empty".to_string());
+    }
+    if password.is_empty() {
+        return Err("site login password must be non-empty".to_string());
+    }
+    Ok(())
+}
+
+pub fn save_site_login(
+    connection: &Connection,
+    id: &str,
+    url_pattern: &str,
+    username: &str,
+    password: &str,
+) -> Result<(), String> {
+    validate_site_login_input(id, url_pattern, username, password)?;
+    let id = validate_site_login_id(id)?;
+    let _keyring_guard = lock_keyring_operations()?;
+    let original = load_settings(connection)?.unwrap_or_else(|| {
+        // A first-run standard-mode install can grant keychain access before
+        // any frontend setting has been persisted. Start with a valid
+        // Zustand envelope so the first site login is not rejected.
+        serde_json::json!({ "state": {}, "version": 3 }).to_string()
+    });
+    if get_keychain_password_if_present_unlocked(id)?.is_some() {
+        return Err("a credential already exists for this site login".to_string());
+    }
+    let updated = add_site_login_to_settings(&original, id, url_pattern, username)?;
+
+    // Persist metadata before creating the secret. If the credential-store
+    // write fails, restore the exact previous settings document so a failed
+    // add cannot leave an orphaned keychain entry or a visible login row.
+    save_settings(connection, &updated)?;
+    if let Err(error) = set_keychain_password_unlocked(id, password) {
+        let keychain_rollback = delete_keychain_password_unlocked(id);
+        let settings_rollback = save_settings(connection, &original);
+        if let Err(rollback_error) = keychain_rollback {
+            return Err(format!(
+                "failed to save site login credential: {error}; credential rollback also failed: {rollback_error}"
+            ));
+        }
+        if let Err(rollback_error) = settings_rollback {
+            return Err(format!(
+                "failed to save site login credential: {error}; settings rollback also failed: {rollback_error}"
+            ));
+        }
+        return Err(format!("failed to save site login credential: {error}"));
+    }
+    Ok(())
+}
+
+pub fn delete_site_login(connection: &Connection, id: &str) -> Result<(), String> {
+    let id = validate_site_login_id(id)?;
+    let _keyring_guard = lock_keyring_operations()?;
+    let Some(original) = load_settings(connection)? else {
+        return Err("settings are not persisted yet".to_string());
+    };
+    let (updated, removed) = remove_site_login_from_settings(&original, id)?;
+    if !removed {
+        return Err("site login was not found".to_string());
+    }
+    let _existing_password = get_keychain_password_if_present_unlocked(id)?;
+
+    // Remove the metadata first only after the keychain has been checked. If
+    // deleting the secret fails, restore the metadata so the UI cannot lose a
+    // credential that still exists.
+    save_settings(connection, &updated)?;
+    if let Err(error) = delete_keychain_password_unlocked(id) {
+        if matches!(
+            get_keychain_password_if_present_unlocked(id),
+            Ok(None)
+        ) {
+            return Ok(());
+        }
+        if let Err(rollback_error) = save_settings(connection, &original) {
+            return Err(format!(
+                "failed to delete site login credential: {error}; settings rollback also failed: {rollback_error}"
+            ));
+        }
+        return Err(format!("failed to delete site login credential: {error}"));
+    }
+
+    Ok(())
+}
+
 fn save_settings_tx(transaction: &Transaction<'_>, data: &str) -> Result<(), String> {
     transaction
         .execute(
@@ -1355,22 +1515,25 @@ pub fn set_keychain_password(id: &str, password: &str) -> Result<(), String> {
     set_keychain_password_unlocked(id, password)
 }
 
-fn get_keychain_password_unlocked(id: &str) -> Result<String, String> {
+fn get_keychain_password_if_present_unlocked(id: &str) -> Result<Option<String>, String> {
     let entry = keychain_entry(id)?;
     match entry.get_password() {
-        Ok(password) => Ok(password),
+        Ok(password) => Ok(Some(password)),
         #[cfg(target_os = "linux")]
         Err(keyring_core::Error::NoEntry) => unique_legacy_linux_keychain_entry(id)?
-            .ok_or_else(|| keyring_core::Error::NoEntry.to_string())?
-            .get_password()
-            .map_err(|error| error.to_string()),
-        #[cfg(target_os = "linux")]
-        Err(error) => Err(error.to_string()),
+            .map(|legacy| legacy.get_password().map_err(|error| error.to_string()))
+            .transpose(),
         #[cfg(not(target_os = "linux"))]
+        Err(keyring_core::Error::NoEntry) => Ok(None),
         Err(error) => Err(error.to_string()),
     }
 }
 
+fn get_keychain_password_unlocked(id: &str) -> Result<String, String> {
+    get_keychain_password_if_present_unlocked(id)?
+        .ok_or_else(|| keyring_core::Error::NoEntry.to_string())
+}
+
 pub fn get_keychain_password(id: &str) -> Result<String, String> {
     let _guard = lock_keyring_operations()?;
     get_keychain_password_unlocked(id)
@@ -1405,6 +1568,88 @@ mod tests {
     use serde_json::json;
     use tempfile::TempDir;
 
+    #[test]
+    fn site_login_settings_update_preserves_envelope_without_password() {
+        let original = json!({
+            "state": {
+                "theme": "dark",
+                "siteLogins": []
+            },
+            "version": 3
+        })
+        .to_string();
+
+        let updated = add_site_login_to_settings(
+            &original,
+            "login-1",
+            "https://example.com/*",
+            "nima",
+        )
+        .unwrap();
+        let document: Value = serde_json::from_str(&updated).unwrap();
+        assert_eq!(document["state"]["theme"], "dark");
+        assert_eq!(document["version"], 3);
+        assert_eq!(document["state"]["siteLogins"][0]["id"], "login-1");
+        assert_eq!(document["state"]["siteLogins"][0]["username"], "nima");
+        assert!(!updated.contains("password"));
+    }
+
+    #[test]
+    fn site_login_settings_update_rejects_duplicate_ids() {
+        let original = json!({
+            "state": {
+                "siteLogins": [{
+                    "id": "login-1",
+                    "urlPattern": "https://example.com/*",
+                    "username": "old-user"
+                }]
+            },
+            "version": 3
+        })
+        .to_string();
+
+        let error = add_site_login_to_settings(
+            &original,
+            "login-1",
+            "https://example.com/*",
+            "new-user",
+        )
+        .unwrap_err();
+        assert_eq!(error, "site login already exists");
+    }
+
+    #[test]
+    fn site_login_settings_removal_reports_whether_metadata_changed() {
+        let original = json!({
+            "state": {
+                "siteLogins": [{
+                    "id": "login-1",
+                    "urlPattern": "https://example.com/*",
+                    "username": "nima"
+                }]
+            },
+            "version": 3
+        })
+        .to_string();
+
+        let (updated, removed) = remove_site_login_from_settings(&original, "login-1").unwrap();
+        assert!(removed);
+        let document: Value = serde_json::from_str(&updated).unwrap();
+        assert!(document["state"]["siteLogins"].as_array().unwrap().is_empty());
+
+        let (unchanged, removed) = remove_site_login_from_settings(&updated, "missing").unwrap();
+        assert!(!removed);
+        assert_eq!(unchanged, updated);
+    }
+
+    #[test]
+    fn site_login_ids_cannot_alias_the_pairing_token_or_hide_whitespace() {
+        assert_eq!(validate_site_login_id("login-1").unwrap(), "login-1");
+        assert!(validate_site_login_id(" extension-pairing-token").is_err());
+        assert!(validate_site_login_id("extension-pairing-token ").is_err());
+        assert!(validate_site_login_id(" login-1").is_err());
+    }
+
     #[test]
     fn migrates_v0_database_and_creates_backup() {
         let temp = TempDir::new().unwrap();
@@ -1471,7 +1716,7 @@ mod tests {
             .unwrap();
         drop(connection);
 
-        let state = init_at_path_internal(temp.path(), true, true).unwrap();
+        let state = init_at_path_internal(temp.path(), true).unwrap();
         let connection = state.lock().unwrap();
         let saved: Value = serde_json::from_str(&load_downloads(&connection).unwrap()[0]).unwrap();
         assert!(saved.get("password").is_none());
@@ -1561,7 +1806,7 @@ mod tests {
         });
         fs::write(&store_path, serde_json::to_vec(&store).unwrap()).unwrap();
 
-        let state = init_at_path_internal(&current, true, true).unwrap();
+        let state = init_at_path_internal(&current, true).unwrap();
         let connection = state.lock().unwrap();
         let saved: Value = serde_json::from_str(&load_downloads(&connection).unwrap()[0]).unwrap();
         assert!(saved.get("password").is_none());
@@ -1837,7 +2082,7 @@ mod tests {
         drop(connection);
         drop(state);
 
-        let state = init_at_path_internal(temp.path(), true, true).unwrap();
+        let state = init_at_path_internal(temp.path(), true).unwrap();
         let connection = state.lock().unwrap();
         let saved: Value = serde_json::from_str(&load_downloads(&connection).unwrap()[0]).unwrap();
         assert!(saved.get("password").is_none());

src-tauri/src/download.rs

@@ -77,7 +77,7 @@ impl DownloadCoordinator {
         &self,
         id: String,
         lifecycle_generation: u64,
-        ack: tokio::sync::oneshot::Sender<()>,
+        ack: tokio::sync::oneshot::Sender<bool>,
     ) -> Result<(), String> {
         self.media_tx
             .send(MediaCmd::PauseWithAck {
@@ -128,7 +128,7 @@ enum MediaCmd {
     PauseWithAck {
         id: String,
         lifecycle_generation: u64,
-        ack: tokio::sync::oneshot::Sender<()>,
+        ack: tokio::sync::oneshot::Sender<bool>,
     },
     Finished {
         id: String,
@@ -144,7 +144,7 @@ async fn run_coordinator(
     let mut active_media = HashMap::<String, (u64, watch::Sender<bool>)>::new();
     let mut cancelled_media_generations = HashMap::<String, u64>::new();
     let mut pending_media_acks =
-        HashMap::<(String, u64), tokio::sync::oneshot::Sender<()>>::new();
+        HashMap::<(String, u64), tokio::sync::oneshot::Sender<bool>>::new();
     let mut pending_captured_urls = Vec::<String>::new();
     let mut frontend_ready = false;
     let mut command_open = true;
@@ -228,7 +228,10 @@ async fn run_coordinator(
                                 .entry(id)
                                 .and_modify(|generation| *generation = (*generation).max(lifecycle_generation))
                                 .or_insert(lifecycle_generation);
-                            let _ = ack.send(());
+                            // No runner was registered for this generation.
+                            // The caller may retire the cancellation tombstone
+                            // while it still owns the per-download lock.
+                            let _ = ack.send(false);
                         }
                     }
                     MediaCmd::Finished { id, lifecycle_generation } => {
@@ -238,7 +241,9 @@ async fn run_coordinator(
                         if let Some(ack) =
                             pending_media_acks.remove(&(id.clone(), lifecycle_generation))
                         {
-                            let _ = ack.send(());
+                            // A pending acknowledgement means the runner was
+                            // registered and has now observed cancellation.
+                            let _ = ack.send(true);
                         }
                         if cancelled_media_generations
                             .get(&id)
@@ -404,6 +409,30 @@ mod tests {
         .expect("late media registration was not cancelled");
     }
 
+    #[tokio::test]
+    async fn unregistered_media_pause_tombstone_can_be_reconciled() {
+        let (coordinator, _events) = DownloadCoordinator::spawn_headless();
+        let (ack_tx, ack_rx) = tokio::sync::oneshot::channel();
+
+        coordinator
+            .pause_media_with_ack("abandoned-media".to_string(), 9, ack_tx)
+            .await
+            .unwrap();
+        assert!(!ack_rx.await.unwrap());
+
+        // Once the queue lifecycle is invalidated under its control lock,
+        // it can retire the tombstone without allowing a late runner to
+        // start. A later registration must therefore remain uncancelled.
+        coordinator
+            .finish_media("abandoned-media".to_string(), 9)
+            .await;
+        let cancel_rx = coordinator
+            .register_media("abandoned-media".to_string(), 9)
+            .await
+            .unwrap();
+        assert!(!*cancel_rx.borrow());
+    }
+
     #[tokio::test]
     async fn stale_media_registration_cannot_replace_a_newer_lifecycle() {
         let (coordinator, _events) = DownloadCoordinator::spawn_headless();

src-tauri/src/download_ownership.rs

@@ -10,6 +10,9 @@ struct DownloadOwnershipRecord {
 }
 
 pub fn canonical_download_filename(filename: &str) -> String {
+    const MAX_FILENAME_BYTES: usize = 255;
+    const TRUNCATION_MARKER: &str = "…";
+
     let leaf = filename.replace('\\', "/");
     let leaf = Path::new(&leaf)
         .file_name()
@@ -31,7 +34,7 @@ pub fn canonical_download_filename(filename: &str) -> String {
         })
         .collect::<String>();
     let sanitized = sanitized.trim().trim_end_matches(['.', ' ']);
-    if sanitized.is_empty() || matches!(sanitized, "." | "..") {
+    let canonical = if sanitized.is_empty() || matches!(sanitized, "." | "..") {
         "download".to_string()
     } else if crate::platform::is_windows_reserved_filename(sanitized) {
         let path = Path::new(sanitized);
@@ -45,7 +48,46 @@ pub fn canonical_download_filename(filename: &str) -> String {
         }
     } else {
         sanitized.to_string()
+    };
+
+    if canonical.len() <= MAX_FILENAME_BYTES {
+        return canonical;
     }
+
+    let extension = Path::new(&canonical)
+        .extension()
+        .and_then(|value| value.to_str())
+        .map(|value| format!(".{value}"))
+        .unwrap_or_default();
+    let base = canonical
+        .strip_suffix(&extension)
+        .unwrap_or(canonical.as_str());
+    let base_budget = MAX_FILENAME_BYTES
+        .saturating_sub(extension.len())
+        .saturating_sub(TRUNCATION_MARKER.len());
+
+    if base_budget == 0 {
+        return truncate_utf8_to_bytes(&canonical, MAX_FILENAME_BYTES);
+    }
+
+    format!(
+        "{}{}{}",
+        truncate_utf8_to_bytes(base, base_budget),
+        TRUNCATION_MARKER,
+        extension
+    )
+}
+
+fn truncate_utf8_to_bytes(value: &str, max_bytes: usize) -> String {
+    let mut end = 0;
+    for (index, character) in value.char_indices() {
+        let next = index + character.len_utf8();
+        if next > max_bytes {
+            break;
+        }
+        end = next;
+    }
+    value[..end].to_string()
 }
 
 pub fn expected_primary_path(
@@ -256,6 +298,24 @@ mod tests {
         assert_eq!(canonical_download_filename("lpt9"), "lpt9-");
     }
 
+    #[test]
+    fn truncates_long_filenames_by_utf8_bytes_and_preserves_extension() {
+        let filename = canonical_download_filename(&format!("{}.mp4", "title ".repeat(100)));
+
+        assert!(filename.len() <= 255);
+        assert!(filename.ends_with(".mp4"));
+        assert!(filename.contains('…'));
+    }
+
+    #[test]
+    fn truncates_multibyte_filenames_at_character_boundaries() {
+        let filename = canonical_download_filename(&format!("{}.mkv", "😀".repeat(100)));
+
+        assert!(filename.len() <= 255);
+        assert!(filename.ends_with(".mkv"));
+        assert!(!filename.contains('\u{fffd}'));
+    }
+
     #[test]
     fn malformed_legacy_download_does_not_block_valid_ownership_records() {
         let valid = json!({

src-tauri/src/extension_server.rs

@@ -17,13 +17,17 @@ use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex, RwLock};
 use std::time::{SystemTime, UNIX_EPOCH};
 use tauri::{AppHandle, Emitter, Manager};
-use tokio::sync::watch;
-use tower_http::cors::{Any, CorsLayer};
+use tokio::sync::{oneshot, watch};
+use tower_http::{
+    cors::{Any, CorsLayer},
+    limit::RequestBodyLimitLayer,
+};
 use ts_rs::TS;
 
 pub const EXTENSION_SERVER_PORT: u16 = 6412;
 pub const EXTENSION_SERVER_PORT_RANGE: std::ops::RangeInclusive<u16> = EXTENSION_SERVER_PORT..=6422;
 const MAX_URL_COUNT: usize = 200;
+const MAX_REQUEST_BODY_BYTES: usize = 256 * 1024;
 const SIGNATURE_MAX_AGE_MS: u64 = 60_000;
 const SERVER_HEADER: &str = "x-firelink-server";
 const PROTOCOL_VERSION_HEADER: &str = "x-firelink-protocol-version";
@@ -33,11 +37,14 @@ const SERVER_PORT_HEADER: &str = "x-firelink-server-port";
 const SMOKE_PROCESS_ID_HEADER: &str = "x-firelink-smoke-process-id";
 const SERVER_PROOF_PREFIX: &[u8] = b"firelink-server-proof\n";
 const PROTOCOL_VERSION: &str = "4";
+const MAX_PENDING_EXTENSION_ACKS: usize = 64;
+const EXTENSION_ACK_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(2);
 
 type HmacSha256 = Hmac<Sha256>;
 pub type SharedExtensionToken = Arc<RwLock<String>>;
 pub type SharedFrontendReady = Arc<AtomicBool>;
 pub type SharedServerPort = Arc<RwLock<Option<u16>>>;
+pub type SharedExtensionAcks = Arc<Mutex<HashMap<String, oneshot::Sender<()>>>>;
 type ReplayCache = Arc<Mutex<HashMap<String, u64>>>;
 
 #[derive(Clone)]
@@ -45,6 +52,7 @@ pub struct ServerState {
     pub app_handle: AppHandle,
     pub pairing_token: SharedExtensionToken,
     pub frontend_ready: SharedFrontendReady,
+    pub extension_acks: SharedExtensionAcks,
     pub replay_cache: ReplayCache,
     pub bound_port: u16,
 }
@@ -63,25 +71,44 @@ struct ExtensionRequest {
     #[serde(default)]
     cookies: Option<String>,
     #[serde(default)]
+    cookie_scopes: Option<Vec<ExtensionCookieScope>>,
+    #[serde(default)]
     media: bool,
+    #[serde(default)]
+    batch: bool,
+    #[serde(default)]
+    batch_name: Option<String>,
+}
+
+#[derive(Clone, Deserialize, Serialize, TS)]
+#[ts(export, export_to = "../../src/bindings/")]
+pub struct ExtensionCookieScope {
+    pub url: String,
+    pub cookies: String,
 }
 
 #[derive(Clone, Serialize, TS)]
 #[ts(export, export_to = "../../src/bindings/")]
 pub struct ExtensionDownload {
+    #[ts(optional)]
+    request_id: Option<String>,
     urls: Vec<String>,
     referer: Option<String>,
     silent: bool,
     filename: Option<String>,
     headers: Option<String>,
     cookies: Option<String>,
+    cookie_scopes: Option<Vec<ExtensionCookieScope>>,
     media: bool,
+    batch: bool,
+    batch_name: Option<String>,
 }
 
 pub async fn start_server(
     app_handle: AppHandle,
     pairing_token: SharedExtensionToken,
     frontend_ready: SharedFrontendReady,
+    extension_acks: SharedExtensionAcks,
     server_port: SharedServerPort,
     mut shutdown_rx: watch::Receiver<bool>,
 ) -> Result<(), String> {
@@ -90,6 +117,7 @@ pub async fn start_server(
         app_handle,
         pairing_token,
         frontend_ready,
+        extension_acks,
         replay_cache: Arc::new(Mutex::new(HashMap::new())),
         bound_port: port,
     };
@@ -106,6 +134,7 @@ pub async fn start_server(
         .route("/ping", get(ping_handler))
         .route("/download", post(download_handler))
         .layer(cors)
+        .layer(RequestBodyLimitLayer::new(MAX_REQUEST_BODY_BYTES))
         .layer(middleware::from_fn(add_server_identity))
         .with_state(state);
 
@@ -235,10 +264,11 @@ async fn download_handler(
     State(state): State<ServerState>,
     headers: HeaderMap,
     body: Bytes,
-) -> Result<StatusCode, StatusCode> {
-    if !has_allowed_request_origin(&headers) || !has_valid_optional_nonce(&headers) {
-        return Err(StatusCode::FORBIDDEN);
-    }
+) -> Result<Response, StatusCode> {
+    let nonce = match required_client_nonce(&headers) {
+        Some(nonce) if has_allowed_request_origin(&headers) => nonce,
+        _ => return Err(StatusCode::FORBIDDEN),
+    };
 
     let signature = match headers
         .get("x-firelink-signature")
@@ -293,15 +323,45 @@ async fn download_handler(
         return Err(StatusCode::SERVICE_UNAVAILABLE);
     }
 
+    let request_id = uuid::Uuid::new_v4().simple().to_string();
+    let ack_receiver = register_extension_ack(&state.extension_acks, request_id.clone())
+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
+    let mut download = download;
+    download.request_id = Some(request_id.clone());
+
     if state
         .app_handle
         .emit("extension-add-download", download)
         .is_err()
     {
+        remove_extension_ack(&state.extension_acks, &request_id);
         return Err(StatusCode::INTERNAL_SERVER_ERROR);
     }
 
-    Ok(StatusCode::OK)
+    if tokio::time::timeout(EXTENSION_ACK_TIMEOUT, ack_receiver)
+        .await
+        .is_err()
+    {
+        remove_extension_ack(&state.extension_acks, &request_id);
+        // The event may already have reached the frontend even when its
+        // acknowledgement was delayed or lost. Do not return 503 here:
+        // extension callers retry 503 and could create a duplicate modal.
+        return Err(StatusCode::GATEWAY_TIMEOUT);
+    }
+
+    let proof = sign_server_proof(timestamp_str, nonce, state.bound_port, &state.pairing_token)
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    let mut response = Response::new(Body::empty());
+    response.headers_mut().insert(
+        SERVER_PROOF_HEADER,
+        HeaderValue::from_str(&proof).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?,
+    );
+    response.headers_mut().insert(
+        SERVER_PORT_HEADER,
+        HeaderValue::from_str(&state.bound_port.to_string())
+            .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?,
+    );
+    Ok(response)
 }
 
 async fn wait_for_frontend(frontend_ready: &SharedFrontendReady) -> bool {
@@ -314,12 +374,45 @@ async fn wait_for_frontend(frontend_ready: &SharedFrontendReady) -> bool {
     false
 }
 
-fn normalize_download(payload: ExtensionRequest) -> Option<ExtensionDownload> {
+fn register_extension_ack(
+    registry: &SharedExtensionAcks,
+    request_id: String,
+) -> Option<oneshot::Receiver<()>> {
+    let (sender, receiver) = oneshot::channel();
+    let mut pending = registry.lock().ok()?;
+    if pending.len() >= MAX_PENDING_EXTENSION_ACKS {
+        return None;
+    }
+    pending.insert(request_id, sender);
+    Some(receiver)
+}
+
+pub fn acknowledge_extension_download(registry: &SharedExtensionAcks, request_id: &str) -> bool {
+    let Some(sender) = registry
+        .lock()
+        .ok()
+        .and_then(|mut pending| pending.remove(request_id))
+    else {
+        return false;
+    };
+    sender.send(()).is_ok()
+}
+
+fn remove_extension_ack(registry: &SharedExtensionAcks, request_id: &str) {
+    if let Ok(mut pending) = registry.lock() {
+        pending.remove(request_id);
+    }
+}
+
+fn normalize_download(mut payload: ExtensionRequest) -> Option<ExtensionDownload> {
+    if payload.urls.len() > MAX_URL_COUNT {
+        return None;
+    }
+
     let mut seen = HashSet::new();
     let urls = payload
         .urls
         .into_iter()
-        .take(MAX_URL_COUNT)
         .filter_map(|raw_url| normalize_url(&raw_url))
         .filter(|url| seen.insert(url.clone()))
         .collect::<Vec<_>>();
@@ -341,19 +434,41 @@ fn normalize_download(payload: ExtensionRequest) -> Option<ExtensionDownload> {
         matches!(url.scheme(), "http" | "https").then(|| url.to_string())
     });
     let filename = payload.filename.and_then(|value| sanitize_filename(&value));
+    let batch = payload.batch && urls.len() >= 2;
+    let batch_name = batch
+        .then_some(payload.batch_name)
+        .flatten()
+        .and_then(|value| {
+            let value = value.trim().to_string();
+            (!value.is_empty() && value.chars().count() <= 512).then_some(value)
+        });
     // A multi-URL handoff has no per-URL cookie scope. Keep ordinary
-    // request headers, but drop Cookie headers and the dedicated cookie field
+    // request headers, but drop credential-bearing headers and the dedicated cookie field
     // so a legacy or untrusted caller cannot reuse one session across hosts.
     let headers = normalize_headers(payload.headers, payload.media || urls.len() > 1);
-    let cookies = if !payload.media && urls.len() == 1 {
-        payload
-            .cookies
-            .filter(|value| !value.trim().is_empty())
+    let cookie_scopes = if !payload.media && urls.len() == 1 {
+        let mut scopes = payload.cookie_scopes.take().unwrap_or_default();
+        if let Some(cookies) = payload.cookies.take() {
+            if !cookies.trim().is_empty() {
+                scopes.push(ExtensionCookieScope {
+                    url: urls[0].clone(),
+                    cookies,
+                });
+            }
+        }
+        normalize_cookie_scopes(scopes)
     } else {
         None
     };
+    let cookies = cookie_scopes.as_ref().and_then(|scopes| {
+        scopes
+            .iter()
+            .find(|scope| same_origin_url(&scope.url, &urls[0]))
+            .map(|scope| scope.cookies.clone())
+    });
 
     Some(ExtensionDownload {
+        request_id: None,
         urls,
         referer,
         silent: payload.silent,
@@ -365,10 +480,64 @@ fn normalize_download(payload: ExtensionRequest) -> Option<ExtensionDownload> {
         // builds pay for a doomed metadata request before retrying. Ordinary
         // captured downloads still need their exact request cookies.
         cookies,
+        cookie_scopes,
         media: payload.media,
+        batch,
+        batch_name,
     })
 }
 
+fn normalize_cookie_scopes(scopes: Vec<ExtensionCookieScope>) -> Option<Vec<ExtensionCookieScope>> {
+    let mut normalized = Vec::new();
+    let mut seen_origins = HashSet::new();
+
+    for scope in scopes {
+        let Ok(url) = Url::parse(scope.url.trim()) else {
+            continue;
+        };
+        if !matches!(url.scheme(), "http" | "https") {
+            continue;
+        }
+        let cookies = scope.cookies.trim();
+        if cookies.is_empty() {
+            continue;
+        }
+        let Some(host) = url.host_str() else {
+            continue;
+        };
+        let origin = format!(
+            "{}://{}:{}",
+            url.scheme(),
+            host,
+            url.port_or_known_default().unwrap_or(443)
+        );
+        if !seen_origins.insert(origin) {
+            continue;
+        }
+        normalized.push(ExtensionCookieScope {
+            url: url.to_string(),
+            cookies: cookies.to_string(),
+        });
+        if normalized.len() >= 16 {
+            break;
+        }
+    }
+
+    (!normalized.is_empty()).then_some(normalized)
+}
+
+fn same_origin_url(left: &str, right: &str) -> bool {
+    let Some(left) = Url::parse(left).ok() else {
+        return false;
+    };
+    let Some(right) = Url::parse(right).ok() else {
+        return false;
+    };
+    left.scheme() == right.scheme()
+        && left.host() == right.host()
+        && left.port_or_known_default() == right.port_or_known_default()
+}
+
 fn normalize_headers(headers: Option<String>, media: bool) -> Option<String> {
     let headers = headers?;
     if !media {
@@ -379,7 +548,17 @@ fn normalize_headers(headers: Option<String>, media: bool) -> Option<String> {
         .lines()
         .filter(|line| {
             line.split_once(':')
-                .map(|(name, _)| !name.trim().eq_ignore_ascii_case("cookie"))
+                .map(|(name, _)| {
+                    !matches!(
+                        name.trim().to_ascii_lowercase().as_str(),
+                        "authorization"
+                            | "cookie"
+                            | "cookie2"
+                            | "proxy-authorization"
+                            | "set-cookie"
+                            | "set-cookie2"
+                    )
+                })
                 .unwrap_or(true)
         })
         .collect::<Vec<_>>()
@@ -437,11 +616,11 @@ fn has_allowed_request_origin(headers: &HeaderMap) -> bool {
     }
 }
 
-fn has_valid_optional_nonce(headers: &HeaderMap) -> bool {
-    match headers.get(CLIENT_NONCE_HEADER) {
-        None => true,
-        Some(nonce) => nonce.to_str().ok().is_some_and(is_valid_client_nonce),
-    }
+fn required_client_nonce(headers: &HeaderMap) -> Option<&str> {
+    headers
+        .get(CLIENT_NONCE_HEADER)
+        .and_then(|nonce| nonce.to_str().ok())
+        .filter(|nonce| is_valid_client_nonce(nonce))
 }
 
 fn sign_server_proof(
@@ -478,16 +657,22 @@ fn claim_request(signature: &str, timestamp: u64, replay_cache: &ReplayCache) ->
         Some(now) => now,
         None => return false,
     };
+    claim_request_at(signature, timestamp, replay_cache, now)
+}
+
+fn claim_request_at(signature: &str, timestamp: u64, replay_cache: &ReplayCache, now: u64) -> bool {
     let mut cache = match replay_cache.lock() {
         Ok(cache) => cache,
         Err(_) => return false,
     };
-    cache.retain(|_, seen_at| now.saturating_sub(*seen_at) < SIGNATURE_MAX_AGE_MS);
-    if cache.len() > 10_000 {
+    cache.retain(|_, expires_at| now < *expires_at);
+    let key = format!("{timestamp}:{}", signature.to_ascii_lowercase());
+    if cache.len() >= 10_000 && !cache.contains_key(&key) {
         return false;
     }
-    let key = format!("{timestamp}:{}", signature.to_ascii_lowercase());
-    cache.insert(key, now).is_none()
+    cache
+        .insert(key, timestamp.saturating_add(SIGNATURE_MAX_AGE_MS))
+        .is_none()
 }
 
 fn current_time_millis() -> Option<u64> {
@@ -530,9 +715,10 @@ fn is_allowed_origin(origin: &str) -> bool {
 #[cfg(test)]
 mod tests {
     use super::{
-        add_server_identity, claim_request, has_allowed_request_origin, has_valid_optional_nonce,
-        is_valid_client_nonce, normalize_download, sign_server_proof, ExtensionRequest,
-        PROTOCOL_VERSION_HEADER, SERVER_HEADER,
+        acknowledge_extension_download, add_server_identity, claim_request_at,
+        has_allowed_request_origin, is_valid_client_nonce, normalize_download,
+        required_client_nonce, sign_server_proof, ExtensionCookieScope, ExtensionRequest,
+        MAX_URL_COUNT, PROTOCOL_VERSION_HEADER, SERVER_HEADER,
     };
     use axum::{
         http::{HeaderMap, HeaderValue, StatusCode},
@@ -581,10 +767,9 @@ mod tests {
     }
 
     #[test]
-    fn rejects_invalid_origins_and_malformed_optional_nonces() {
+    fn rejects_invalid_origins() {
         let mut headers = HeaderMap::new();
         assert!(has_allowed_request_origin(&headers));
-        assert!(has_valid_optional_nonce(&headers));
 
         headers.insert(
             "origin",
@@ -596,12 +781,28 @@ mod tests {
             "origin",
             HeaderValue::from_static("moz-extension://firelink"),
         );
+        assert!(has_allowed_request_origin(&headers));
+    }
+
+    #[test]
+    fn requires_a_valid_client_nonce_for_downloads() {
+        let mut headers = HeaderMap::new();
+        assert!(required_client_nonce(&headers).is_none());
+
         headers.insert(
             "x-firelink-client-nonce",
             HeaderValue::from_static("not-a-valid-nonce"),
         );
-        assert!(has_allowed_request_origin(&headers));
-        assert!(!has_valid_optional_nonce(&headers));
+        assert!(required_client_nonce(&headers).is_none());
+
+        headers.insert(
+            "x-firelink-client-nonce",
+            HeaderValue::from_static("0123456789abcdef0123456789abcdef"),
+        );
+        assert_eq!(
+            required_client_nonce(&headers),
+            Some("0123456789abcdef0123456789abcdef")
+        );
     }
 
     #[test]
@@ -613,7 +814,30 @@ mod tests {
             filename: None,
             headers: None,
             cookies: None,
+            cookie_scopes: None,
             media: true,
+            batch: false,
+            batch_name: None,
+        });
+
+        assert!(download.is_none());
+    }
+
+    #[test]
+    fn rejects_oversized_url_lists_instead_of_truncating_them() {
+        let download = normalize_download(ExtensionRequest {
+            urls: (0..=MAX_URL_COUNT)
+                .map(|index| format!("https://example.com/file-{index}.bin"))
+                .collect(),
+            referer: None,
+            silent: false,
+            filename: None,
+            headers: None,
+            cookies: None,
+            cookie_scopes: None,
+            media: false,
+            batch: false,
+            batch_name: None,
         });
 
         assert!(download.is_none());
@@ -623,9 +847,40 @@ mod tests {
     fn rejects_replayed_download_signature() {
         let cache = Arc::new(Mutex::new(HashMap::new()));
         let signature = "a".repeat(64);
+        let now = 1_000_000;
 
-        assert!(claim_request(&signature, 42, &cache));
-        assert!(!claim_request(&signature, 42, &cache));
+        assert!(claim_request_at(&signature, now, &cache, now));
+        assert!(!claim_request_at(&signature, now, &cache, now + 1));
+    }
+
+    #[test]
+    fn future_timestamp_replay_claim_survives_cache_pruning_window() {
+        let cache = Arc::new(Mutex::new(HashMap::new()));
+        let signature = "b".repeat(64);
+        let now = 1_000_000;
+        let future_timestamp = now + 30_000;
+
+        assert!(claim_request_at(&signature, future_timestamp, &cache, now));
+        assert!(!claim_request_at(
+            &signature,
+            future_timestamp,
+            &cache,
+            now + 70_000
+        ));
+    }
+
+    #[tokio::test]
+    async fn acknowledges_and_removes_pending_extension_event() {
+        let registry = Arc::new(Mutex::new(HashMap::new()));
+        let (sender, receiver) = tokio::sync::oneshot::channel();
+        registry
+            .lock()
+            .unwrap()
+            .insert("request-1".to_string(), sender);
+
+        assert!(acknowledge_extension_download(&registry, "request-1"));
+        assert!(!acknowledge_extension_download(&registry, "request-1"));
+        assert!(receiver.await.is_ok());
     }
 
     #[test]
@@ -636,11 +891,14 @@ mod tests {
             silent: false,
             filename: None,
             headers: Some(format!(
-                "Cookie: stale={};\nUser-Agent: Firefox",
+                "Cookie: stale={};\nCookie2: stale=1\nAuthorization: Bearer stale\nProxy-Authorization: Basic stale\nSet-Cookie: stale=1\nSet-Cookie2: stale=1\nUser-Agent: Firefox",
                 "x".repeat(64 * 1024)
             )),
             cookies: Some(format!("large={}", "x".repeat(64 * 1024))),
+            cookie_scopes: None,
             media: true,
+            batch: false,
+            batch_name: None,
         })
         .expect("valid media handoff");
 
@@ -658,7 +916,10 @@ mod tests {
             filename: None,
             headers: None,
             cookies: Some("session=browser-cookie-header".to_string()),
+            cookie_scopes: None,
             media: false,
+            batch: false,
+            batch_name: None,
         })
         .expect("valid download handoff");
 
@@ -669,6 +930,46 @@ mod tests {
         );
     }
 
+    #[test]
+    fn regular_capture_normalizes_host_scoped_cookie_headers() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec!["https://mail.google.com/mail/u/0/?view=att".to_string()],
+            referer: Some("https://mail.google.com/mail/u/0/".to_string()),
+            silent: true,
+            filename: Some("report.zip".to_string()),
+            headers: None,
+            cookies: Some("SID=mail-session".to_string()),
+            cookie_scopes: Some(vec![
+                ExtensionCookieScope {
+                    url: "https://mail.google.com/".to_string(),
+                    cookies: "SID=mail-session".to_string(),
+                },
+                ExtensionCookieScope {
+                    url: "https://accounts.google.com/".to_string(),
+                    cookies: "SID=account-session".to_string(),
+                },
+                ExtensionCookieScope {
+                    url: "https://mail.google.com/another-path".to_string(),
+                    cookies: "duplicate=ignored".to_string(),
+                },
+            ]),
+            media: false,
+            batch: false,
+            batch_name: None,
+        })
+        .expect("valid download handoff");
+
+        assert_eq!(download.cookies.as_deref(), Some("SID=mail-session"));
+        assert_eq!(
+            download.cookie_scopes.as_ref().map(|scopes| scopes.len()),
+            Some(2)
+        );
+        assert_eq!(
+            download.cookie_scopes.as_ref().unwrap()[1].cookies,
+            "SID=account-session"
+        );
+    }
+
     #[test]
     fn multi_url_capture_drops_cookie_scope_but_preserves_safe_headers() {
         let download = normalize_download(ExtensionRequest {
@@ -681,7 +982,10 @@ mod tests {
             filename: None,
             headers: Some("Cookie: session=secret\nUser-Agent: Firefox".to_string()),
             cookies: Some("session=secret".to_string()),
+            cookie_scopes: None,
             media: false,
+            batch: false,
+            batch_name: None,
         })
         .expect("valid multi-url handoff");
 
@@ -689,6 +993,52 @@ mod tests {
         assert_eq!(download.headers.as_deref(), Some("User-Agent: Firefox"));
     }
 
+    #[test]
+    fn selected_link_batches_preserve_context_only_for_two_or_more_urls() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec![
+                "https://example.com/one.zip".to_string(),
+                "https://example.com/two.zip".to_string(),
+            ],
+            referer: Some("https://example.com/gallery".to_string()),
+            silent: false,
+            filename: None,
+            headers: None,
+            cookies: None,
+            cookie_scopes: None,
+            media: false,
+            batch: true,
+            batch_name: Some("Example Gallery / Chapter: 1".to_string()),
+        })
+        .expect("valid selected-link batch");
+
+        assert!(download.batch);
+        assert_eq!(
+            download.batch_name.as_deref(),
+            Some("Example Gallery / Chapter: 1")
+        );
+    }
+
+    #[test]
+    fn selected_link_batch_context_is_dropped_for_single_urls() {
+        let download = normalize_download(ExtensionRequest {
+            urls: vec!["https://example.com/one.zip".to_string()],
+            referer: Some("https://example.com/gallery".to_string()),
+            silent: false,
+            filename: None,
+            headers: None,
+            cookies: None,
+            cookie_scopes: None,
+            media: false,
+            batch: true,
+            batch_name: Some("Example Gallery".to_string()),
+        })
+        .expect("valid single-link handoff");
+
+        assert!(!download.batch);
+        assert!(download.batch_name.is_none());
+    }
+
     #[test]
     fn signs_server_proof_with_timestamp_nonce_and_bound_port() {
         let token = Arc::new(RwLock::new("pairing-token".to_string()));

src-tauri/src/ipc.rs

@@ -6,6 +6,14 @@ fn default_speed_limit_unit() -> String {
     "MB/s".to_string()
 }
 
+fn default_language_preference() -> String {
+    "system".to_string()
+}
+
+fn default_sidebar_position() -> String {
+    "auto".to_string()
+}
+
 #[derive(Clone, Copy, Debug, Serialize, Deserialize, TS)]
 #[serde(rename_all = "lowercase")]
 #[ts(export, export_to = "../../src/bindings/")]
@@ -62,6 +70,18 @@ pub struct Queue {
     pub id: String,
     pub name: String,
     pub is_main: bool,
+    #[serde(default)]
+    #[ts(optional)]
+    pub max_concurrent: Option<usize>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "../../src/bindings/")]
+pub struct QueueConcurrencyConfig {
+    pub id: String,
+    #[serde(default)]
+    pub max_concurrent: Option<usize>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, TS)]
@@ -80,6 +100,12 @@ pub struct DownloadItem {
     pub eta: Option<String>,
     #[ts(optional)]
     pub size: Option<String>,
+    #[ts(optional)]
+    pub downloaded_bytes: Option<f64>,
+    #[ts(optional)]
+    pub total_bytes: Option<f64>,
+    #[ts(optional)]
+    pub total_is_estimate: Option<bool>,
     pub category: DownloadCategory,
     pub date_added: String,
     #[ts(optional)]
@@ -107,6 +133,8 @@ pub struct DownloadItem {
     #[ts(optional)]
     pub media_format_selector: Option<String>,
     #[ts(optional)]
+    pub media_quality: Option<String>,
+    #[ts(optional)]
     pub queue_id: Option<String>,
     #[ts(optional)]
     pub queue_position: Option<i32>,
@@ -186,6 +214,44 @@ pub enum Theme {
     Nord,
 }
 
+#[derive(Clone, Debug, Default, Serialize, Deserialize, TS)]
+#[serde(rename_all = "kebab-case")]
+#[ts(export, export_to = "../../src/bindings/")]
+pub enum FontFamily {
+    #[default]
+    System,
+    Inter,
+    Outfit,
+    Vazirmatn,
+    NotoSansHebrew,
+    NotoSansSc,
+    Roboto,
+    Serif,
+    Monospace,
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize, TS)]
+#[serde(rename_all = "lowercase")]
+#[ts(export, export_to = "../../src/bindings/")]
+pub enum WindowControlStyle {
+    #[default]
+    Auto,
+    Macos,
+    Windows,
+    Gnome,
+    Minimal,
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize, TS)]
+#[serde(rename_all = "lowercase")]
+#[ts(export, export_to = "../../src/bindings/")]
+pub enum CalendarPreference {
+    #[default]
+    Gregorian,
+    Persian,
+    Hebrew,
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize, TS)]
 #[serde(rename_all = "lowercase")]
 #[ts(export, export_to = "../../src/bindings/")]
@@ -251,6 +317,14 @@ pub struct SchedulerSettings {
 #[ts(export, export_to = "../../src/bindings/")]
 pub struct PersistedSettings {
     pub theme: Theme,
+    #[serde(default)]
+    pub font_family: FontFamily,
+    #[serde(default)]
+    pub window_control_style: WindowControlStyle,
+    #[serde(default)]
+    pub calendar_preference: CalendarPreference,
+    #[serde(default = "default_language_preference")]
+    pub language: String,
     pub base_download_folder: String,
     pub category_subfolders_enabled: bool,
     pub category_subfolders: HashMap<String, String>,
@@ -261,6 +335,8 @@ pub struct PersistedSettings {
     pub speed_limit_preset_values: Vec<f64>,
     pub logs_enabled: bool,
     pub is_sidebar_visible: bool,
+    #[serde(default = "default_sidebar_position")]
+    pub sidebar_position: String,
     pub active_settings_tab: SettingsTab,
     pub scheduler: SchedulerSettings,
     pub scheduler_running: bool,
@@ -274,6 +350,8 @@ pub struct PersistedSettings {
     pub max_automatic_retries: i32,
     pub show_notifications: bool,
     pub play_completion_sound: bool,
+    #[serde(default)]
+    pub auto_add_clipboard_links: bool,
     pub app_font_size: AppFontSize,
     pub list_row_density: ListRowDensity,
     pub show_dock_badge: bool,
@@ -283,7 +361,10 @@ pub struct PersistedSettings {
     pub proxy_port: u16,
     pub custom_user_agent: String,
     pub ask_where_to_save_each_file: bool,
+    pub remember_last_used_download_directory: bool,
     pub prevents_sleep_while_downloading: bool,
+    #[serde(default)]
+    pub prevents_display_sleep_while_downloading: bool,
     pub media_cookie_source: MediaCookieSource,
     pub site_logins: Vec<SiteLogin>,
     pub auto_check_updates: bool,
@@ -339,6 +420,15 @@ impl DownloadStateEvent {
         }
     }
 
+    pub fn paused_with_error(id: impl Into<String>, error: impl Into<String>) -> Self {
+        Self {
+            id: id.into(),
+            status: DownloadStatus::Paused.as_str().to_string(),
+            error: Some(error.into()),
+            file_name: None,
+        }
+    }
+
     pub fn completed_with_file(id: impl Into<String>, file_name: impl Into<String>) -> Self {
         Self {
             id: id.into(),

src-tauri/src/parity.rs

@@ -1,4 +1,5 @@
 use serde::{Deserialize, Serialize};
+#[cfg(any(target_os = "macos", target_os = "linux"))]
 use std::process::Command;
 use ts_rs::TS;
 
@@ -83,6 +84,7 @@ fn proxy_from_environment() -> Option<String> {
     })
 }
 
+#[cfg(any(target_os = "macos", target_os = "linux"))]
 fn command_stdout(command: &mut Command) -> std::io::Result<String> {
     let output = command.output()?;
     if !output.status.success() {

src-tauri/src/power.rs

@@ -0,0 +1,419 @@
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::mpsc::{self, Receiver, Sender};
+use std::sync::{Arc, Mutex};
+use std::thread::{self, JoinHandle};
+
+const ASSERTION_REASON: &str = "Firelink active download";
+
+/// Owns the OS power assertions for the whole backend transfer lifecycle.
+///
+/// The frontend may request the policy, but it does not own the assertion:
+/// queue permits are the source of truth for whether a transfer is actually
+/// active. Keeping the two assertions separate also means display sleep can
+/// be opted into without changing the system-sleep policy.
+struct PowerState {
+    runtime_enabled: AtomicBool,
+    prevent_system_sleep: AtomicBool,
+    prevent_display_sleep: AtomicBool,
+    active_transfers: AtomicUsize,
+}
+
+enum PowerCommand {
+    Reconcile(Option<Sender<Result<(), String>>>),
+}
+
+struct PowerWorker {
+    sender: Option<Sender<PowerCommand>>,
+    join_handle: Option<JoinHandle<()>>,
+}
+
+impl PowerWorker {
+    fn start(state: Arc<PowerState>) -> Result<Self, String> {
+        let (sender, receiver) = mpsc::channel();
+        let join_handle = thread::Builder::new()
+            .name("firelink-power".to_string())
+            .spawn(move || run_power_worker(state, receiver))
+            .map_err(|error| format!("failed to start power-management worker: {error}"))?;
+        Ok(Self {
+            sender: Some(sender),
+            join_handle: Some(join_handle),
+        })
+    }
+
+    fn send(&self, command: PowerCommand) -> Result<(), String> {
+        self.sender
+            .as_ref()
+            .ok_or_else(|| "power-management worker is stopping".to_string())?
+            .send(command)
+            .map_err(|_| "power-management worker stopped unexpectedly".to_string())
+    }
+}
+
+impl Drop for PowerWorker {
+    fn drop(&mut self) {
+        // Closing the sender lets the worker drop its OS assertions on the
+        // same thread that created them. This matters on Windows, where
+        // SetThreadExecutionState is thread-local, and avoids calling the
+        // Linux keepawake D-Bus destructor from an arbitrary queue thread.
+        self.sender.take();
+        if let Some(join_handle) = self.join_handle.take() {
+            let _ = join_handle.join();
+        }
+    }
+}
+
+pub struct PowerManager {
+    state: Arc<PowerState>,
+    worker: Mutex<Option<PowerWorker>>,
+}
+
+impl PowerManager {
+    pub fn new() -> Arc<Self> {
+        Arc::new(Self {
+            state: Arc::new(PowerState {
+                runtime_enabled: AtomicBool::new(false),
+                prevent_system_sleep: AtomicBool::new(true),
+                prevent_display_sleep: AtomicBool::new(false),
+                active_transfers: AtomicUsize::new(0),
+            }),
+            worker: Mutex::new(None),
+        })
+    }
+
+    /// Enables OS integration after AppState has been registered. This keeps
+    /// QueueManager tests and pre-window startup work from creating real
+    /// assertions in the test process or during partial initialization.
+    pub fn activate(&self) -> Result<(), String> {
+        self.state.runtime_enabled.store(true, Ordering::Release);
+        self.reconcile()
+    }
+
+    pub fn set_preferences(
+        &self,
+        prevent_system_sleep: bool,
+        prevent_display_sleep: bool,
+    ) -> Result<(), String> {
+        self.state
+            .prevent_system_sleep
+            .store(prevent_system_sleep, Ordering::Release);
+        self.state
+            .prevent_display_sleep
+            .store(prevent_display_sleep, Ordering::Release);
+        self.reconcile()
+    }
+
+    pub fn set_system_prevention(&self, enabled: bool) -> Result<(), String> {
+        self.state
+            .prevent_system_sleep
+            .store(enabled, Ordering::Release);
+        self.reconcile()
+    }
+
+    pub fn set_display_prevention(&self, enabled: bool) -> Result<(), String> {
+        self.state
+            .prevent_display_sleep
+            .store(enabled, Ordering::Release);
+        self.reconcile()
+    }
+
+    pub fn set_active_transfer_count(self: &Arc<Self>, count: usize) {
+        self.state.active_transfers.store(count, Ordering::Release);
+        if self.state.runtime_enabled.load(Ordering::Acquire) {
+            if let Err(error) = self.enqueue_reconcile() {
+                log::error!(
+                    "power: failed to schedule assertion reconciliation for {count} active transfer(s): {error}"
+                );
+            }
+        }
+    }
+
+    pub fn active_transfer_count(&self) -> usize {
+        self.state.active_transfers.load(Ordering::Acquire)
+    }
+
+    fn reconcile(&self) -> Result<(), String> {
+        if !self.state.runtime_enabled.load(Ordering::Acquire) {
+            return Ok(());
+        }
+
+        self.ensure_worker()?;
+        let (response_sender, response_receiver) = mpsc::channel();
+        if let Err(error) = self.send_command(PowerCommand::Reconcile(Some(response_sender))) {
+            self.restart_worker();
+            return Err(error);
+        }
+        match response_receiver.recv() {
+            Ok(result) => result,
+            Err(_) => {
+                self.restart_worker();
+                Err("power-management worker stopped before reporting reconciliation".to_string())
+            }
+        }
+    }
+
+    fn enqueue_reconcile(&self) -> Result<(), String> {
+        self.ensure_worker()?;
+        if let Err(error) = self.send_command(PowerCommand::Reconcile(None)) {
+            self.restart_worker();
+            return Err(error);
+        }
+        Ok(())
+    }
+
+    fn ensure_worker(&self) -> Result<(), String> {
+        let mut worker = self
+            .worker
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        if worker.is_none() {
+            *worker = Some(PowerWorker::start(Arc::clone(&self.state))?);
+        }
+        Ok(())
+    }
+
+    fn send_command(&self, command: PowerCommand) -> Result<(), String> {
+        let worker = self
+            .worker
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        worker
+            .as_ref()
+            .ok_or_else(|| "power-management worker is not running".to_string())?
+            .send(command)
+    }
+
+    fn restart_worker(&self) {
+        let mut worker = self
+            .worker
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        worker.take();
+    }
+}
+
+struct OsPowerAssertions {
+    #[cfg(windows)]
+    assertion: Option<keepawake::KeepAwake>,
+    #[cfg(not(windows))]
+    system: Option<keepawake::KeepAwake>,
+    #[cfg(not(windows))]
+    display: Option<keepawake::KeepAwake>,
+    system_enabled: bool,
+    display_enabled: bool,
+}
+
+impl OsPowerAssertions {
+    fn reconcile(&mut self, state: &PowerState) -> Result<(), String> {
+        let active = state.active_transfers.load(Ordering::Acquire);
+        let desired_system = active > 0 && state.prevent_system_sleep.load(Ordering::Acquire);
+        let desired_display = active > 0 && state.prevent_display_sleep.load(Ordering::Acquire);
+
+        #[cfg(windows)]
+        {
+            return self.reconcile_combined(desired_system, desired_display, active);
+        }
+        #[cfg(not(windows))]
+        self.reconcile_independent(desired_system, desired_display, active)
+    }
+
+    #[cfg(windows)]
+    fn reconcile_combined(
+        &mut self,
+        desired_system: bool,
+        desired_display: bool,
+        active: usize,
+    ) -> Result<(), String> {
+        if self.system_enabled == desired_system && self.display_enabled == desired_display {
+            return Ok(());
+        }
+
+        if let Some(assertion) = self.assertion.take() {
+            drop_assertion(assertion, "combined");
+            if self.system_enabled {
+                log::info!("power: system-sleep prevention released");
+            }
+            if self.display_enabled {
+                log::info!("power: display-sleep prevention released");
+            }
+            self.system_enabled = false;
+            self.display_enabled = false;
+        }
+
+        if desired_system || desired_display {
+            let assertion = create_assertion(|| {
+                keepawake::Builder::default()
+                    .display(desired_display)
+                    .idle(desired_system)
+                    .sleep(desired_system)
+                    .reason(ASSERTION_REASON)
+                    .create()
+            })
+            .map_err(|error| format!("failed to apply power prevention: {error}"))?;
+            self.assertion = Some(assertion);
+            self.system_enabled = desired_system;
+            self.display_enabled = desired_display;
+            if desired_system {
+                log::info!(
+                    "power: system-sleep prevention enabled for {active} active transfer(s)"
+                );
+            }
+            if desired_display {
+                log::info!(
+                    "power: display-sleep prevention enabled for {active} active transfer(s)"
+                );
+            }
+        }
+        Ok(())
+    }
+
+    #[cfg(not(windows))]
+    fn reconcile_independent(
+        &mut self,
+        desired_system: bool,
+        desired_display: bool,
+        active: usize,
+    ) -> Result<(), String> {
+        let mut first_error = None;
+        if desired_system {
+            if self.system.is_none() {
+                match create_assertion(|| {
+                    keepawake::Builder::default()
+                        .idle(true)
+                        .sleep(true)
+                        .reason(ASSERTION_REASON)
+                        .create()
+                }) {
+                    Ok(assertion) => {
+                        self.system = Some(assertion);
+                        self.system_enabled = true;
+                        log::info!(
+                            "power: system-sleep prevention enabled for {active} active transfer(s)"
+                        );
+                    }
+                    Err(error) => {
+                        first_error = Some(format!("failed to prevent system sleep: {error}"))
+                    }
+                }
+            }
+        } else if let Some(assertion) = self.system.take() {
+            drop_assertion(assertion, "system-sleep");
+            self.system_enabled = false;
+            log::info!("power: system-sleep prevention released");
+        }
+
+        if desired_display {
+            if self.display.is_none() {
+                match create_assertion(|| {
+                    keepawake::Builder::default()
+                        .display(true)
+                        .reason(ASSERTION_REASON)
+                        .create()
+                }) {
+                    Ok(assertion) => {
+                        self.display = Some(assertion);
+                        self.display_enabled = true;
+                        log::info!(
+                            "power: display-sleep prevention enabled for {active} active transfer(s)"
+                        );
+                    }
+                    Err(error) => {
+                        let display_error = format!("failed to prevent display sleep: {error}");
+                        if first_error.is_none() {
+                            first_error = Some(display_error);
+                        } else {
+                            log::error!("power: {display_error}");
+                        }
+                    }
+                }
+            }
+        } else if let Some(assertion) = self.display.take() {
+            drop_assertion(assertion, "display-sleep");
+            self.display_enabled = false;
+            log::info!("power: display-sleep prevention released");
+        }
+
+        first_error.map_or(Ok(()), Err)
+    }
+}
+
+fn create_assertion(
+    create: impl FnOnce() -> keepawake::Result<keepawake::KeepAwake>,
+) -> Result<keepawake::KeepAwake, String> {
+    std::panic::catch_unwind(std::panic::AssertUnwindSafe(create))
+        .map_err(|_| "keepawake assertion creation panicked".to_string())?
+        .map_err(|error| error.to_string())
+}
+
+fn drop_assertion(assertion: keepawake::KeepAwake, kind: &str) {
+    if std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| drop(assertion))).is_err() {
+        log::error!("power: keepawake {kind} assertion cleanup panicked");
+    }
+}
+
+fn run_power_worker(state: Arc<PowerState>, receiver: Receiver<PowerCommand>) {
+    let mut assertions = OsPowerAssertions {
+        #[cfg(windows)]
+        assertion: None,
+        #[cfg(not(windows))]
+        system: None,
+        #[cfg(not(windows))]
+        display: None,
+        system_enabled: false,
+        display_enabled: false,
+    };
+    while let Ok(PowerCommand::Reconcile(response)) = receiver.recv() {
+        let result = assertions.reconcile(&state);
+        if let Some(response) = response {
+            let _ = response.send(result);
+        } else if let Err(error) = result {
+            let active = state.active_transfers.load(Ordering::Acquire);
+            log::error!(
+                "power: failed to reconcile assertions for {active} active transfer(s): {error}"
+            );
+        }
+    }
+    #[cfg(windows)]
+    if let Some(assertion) = assertions.assertion.take() {
+        drop_assertion(assertion, "combined");
+    }
+    #[cfg(not(windows))]
+    {
+        if let Some(assertion) = assertions.display.take() {
+            drop_assertion(assertion, "display-sleep");
+        }
+        if let Some(assertion) = assertions.system.take() {
+            drop_assertion(assertion, "system-sleep");
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::PowerManager;
+
+    #[test]
+    fn tracks_transfer_activity_before_runtime_activation() {
+        let manager = PowerManager::new();
+        manager.set_active_transfer_count(2);
+        assert_eq!(manager.active_transfer_count(), 2);
+
+        manager.set_active_transfer_count(0);
+        assert_eq!(manager.active_transfer_count(), 0);
+    }
+
+    #[test]
+    fn preference_changes_are_safe_before_runtime_activation() {
+        let manager = PowerManager::new();
+        assert!(manager.set_preferences(false, true).is_ok());
+        assert!(manager.set_system_prevention(true).is_ok());
+        assert!(manager.set_display_prevention(false).is_ok());
+    }
+
+    #[test]
+    fn runtime_worker_can_activate_without_active_transfers() {
+        let manager = PowerManager::new();
+        assert!(manager.activate().is_ok());
+        manager.set_active_transfer_count(0);
+        assert_eq!(manager.active_transfer_count(), 0);
+    }
+}

src-tauri/src/scheduler.rs

@@ -26,6 +26,39 @@ fn stop_is_due(
         && last_stop_key != stop_key
 }
 
+struct OvernightStopCheck<'a> {
+    stop_time_enabled: bool,
+    start_minute: Option<u32>,
+    stop_minute: Option<u32>,
+    current_minute: u32,
+    previous_day_allowed: bool,
+    last_start_key: &'a str,
+    previous_start_key: &'a str,
+    last_stop_key: &'a str,
+    stop_key: &'a str,
+}
+
+fn overnight_stop_is_due(check: OvernightStopCheck<'_>) -> bool {
+    let OvernightStopCheck {
+        stop_time_enabled,
+        start_minute,
+        stop_minute,
+        current_minute,
+        previous_day_allowed,
+        last_start_key,
+        previous_start_key,
+        last_stop_key,
+        stop_key,
+    } = check;
+    stop_time_enabled
+        && previous_day_allowed
+        && start_minute.zip(stop_minute).is_some_and(|(start, stop)| {
+            stop < start && current_minute >= stop && current_minute < start
+        })
+        && last_start_key == previous_start_key
+        && last_stop_key != stop_key
+}
+
 pub fn spawn_scheduler(
     app_handle: tauri::AppHandle,
     settings_cache: Arc<RwLock<Option<crate::ipc::PersistedSettings>>>,
@@ -56,20 +89,20 @@ pub fn spawn_scheduler(
 
                 let allowed_today =
                     scheduler.everyday || scheduler.selected_days.contains(&current_day);
-                if !allowed_today {
-                    continue;
-                }
-
                 let date_key = now.format("%Y-%m-%d").to_string();
                 let start_key = format!("{date_key}-start");
                 let stop_key = format!("{date_key}-stop");
                 let start_minute = minute_of_day(&scheduler.start_time);
                 let stop_minute = minute_of_day(&scheduler.stop_time);
+                let overnight = start_minute
+                    .zip(stop_minute)
+                    .is_some_and(|(start, stop)| stop < start);
                 let before_stop = !scheduler.stop_time_enabled
                     || stop_minute.is_some_and(|stop| current_minute < stop);
 
-                if start_minute.is_some_and(|start| current_minute >= start)
-                    && before_stop
+                if allowed_today
+                    && start_minute.is_some_and(|start| current_minute >= start)
+                    && (overnight || before_stop)
                     && scheduler_last_start_key != start_key
                     && last_emit
                         .get("start")
@@ -85,17 +118,43 @@ pub fn spawn_scheduler(
                     last_emit.insert("start", std::time::Instant::now());
                 }
 
-                if stop_is_due(
-                    scheduler.stop_time_enabled,
+                let same_day_stop_due = allowed_today
+                    && !overnight
+                    && stop_is_due(
+                        scheduler.stop_time_enabled,
+                        stop_minute,
+                        current_minute,
+                        &scheduler_last_start_key,
+                        &start_key,
+                        &scheduler_last_stop_key,
+                        &stop_key,
+                    );
+                let previous_day = now.date_naive().pred_opt();
+                let previous_day_allowed = previous_day.is_some_and(|day| {
+                    scheduler.everyday
+                        || scheduler
+                            .selected_days
+                            .contains(&day.weekday().num_days_from_sunday())
+                });
+                let previous_start_key = previous_day
+                    .map(|day| format!("{}-start", day.format("%Y-%m-%d")))
+                    .unwrap_or_default();
+                let overnight_stop_due = overnight_stop_is_due(OvernightStopCheck {
+                    stop_time_enabled: scheduler.stop_time_enabled,
+                    start_minute,
                     stop_minute,
                     current_minute,
-                    &scheduler_last_start_key,
-                    &start_key,
-                    &scheduler_last_stop_key,
-                    &stop_key,
-                ) && last_emit
-                    .get("stop")
-                    .is_none_or(|instant| instant.elapsed() >= Duration::from_secs(5))
+                    previous_day_allowed,
+                    last_start_key: &scheduler_last_start_key,
+                    previous_start_key: &previous_start_key,
+                    last_stop_key: &scheduler_last_stop_key,
+                    stop_key: &stop_key,
+                });
+
+                if (same_day_stop_due || overnight_stop_due)
+                    && last_emit
+                        .get("stop")
+                        .is_none_or(|instant| instant.elapsed() >= Duration::from_secs(5))
                 {
                     let _ = app_handle.emit(
                         "schedule-trigger",
@@ -113,7 +172,7 @@ pub fn spawn_scheduler(
 
 #[cfg(test)]
 mod tests {
-    use super::{minute_of_day, stop_is_due};
+    use super::{minute_of_day, overnight_stop_is_due, stop_is_due, OvernightStopCheck};
 
     #[test]
     fn parses_valid_scheduler_times() {
@@ -150,4 +209,41 @@ mod tests {
             "2026-06-22-stop",
         ));
     }
+
+    #[test]
+    fn overnight_stop_uses_the_previous_day_start() {
+        assert!(overnight_stop_is_due(OvernightStopCheck {
+            stop_time_enabled: true,
+            start_minute: Some(1320),
+            stop_minute: Some(360),
+            current_minute: 420,
+            previous_day_allowed: true,
+            last_start_key: "2026-06-22-start",
+            previous_start_key: "2026-06-22-start",
+            last_stop_key: "",
+            stop_key: "2026-06-23-stop",
+        }));
+        assert!(!overnight_stop_is_due(OvernightStopCheck {
+            stop_time_enabled: true,
+            start_minute: Some(1320),
+            stop_minute: Some(360),
+            current_minute: 1380,
+            previous_day_allowed: true,
+            last_start_key: "2026-06-22-start",
+            previous_start_key: "2026-06-22-start",
+            last_stop_key: "",
+            stop_key: "2026-06-22-stop",
+        }));
+        assert!(!overnight_stop_is_due(OvernightStopCheck {
+            stop_time_enabled: true,
+            start_minute: Some(1320),
+            stop_minute: Some(360),
+            current_minute: 420,
+            previous_day_allowed: false,
+            last_start_key: "2026-06-22-start",
+            previous_start_key: "2026-06-22-start",
+            last_stop_key: "",
+            stop_key: "2026-06-23-stop",
+        }));
+    }
 }

src-tauri/src/settings.rs

@@ -1,6 +1,7 @@
 use crate::ipc::{
-    AppFontSize, ListRowDensity, MediaCookieSource, PersistedSettings, PostQueueAction, ProxyMode,
-    SchedulerSettings, SettingsTab, Theme,
+    AppFontSize, CalendarPreference, FontFamily, ListRowDensity, MediaCookieSource,
+    PersistedSettings, PostQueueAction, ProxyMode, SchedulerSettings, SettingsTab, Theme,
+    WindowControlStyle,
 };
 use serde_json::{Map, Value};
 use std::collections::HashMap;
@@ -192,6 +193,33 @@ fn sanitize_persisted_setting_values(state: &mut Value) {
         "theme",
         &["system", "light", "dark", "dracula", "nord"],
     );
+    sanitize_allowed_string(
+        state,
+        "fontFamily",
+        &[
+            "system",
+            "inter",
+            "outfit",
+            "vazirmatn",
+            "noto-sans-hebrew",
+            "noto-sans-sc",
+            "roboto",
+            "serif",
+            "monospace",
+        ],
+    );
+    sanitize_allowed_string(
+        state,
+        "windowControlStyle",
+        &["auto", "macos", "windows", "gnome", "minimal"],
+    );
+    sanitize_allowed_string(
+        state,
+        "language",
+        &["system", "en", "zh-CN", "he", "fa", "uk", "ru"],
+    );
+    sanitize_allowed_string(state, "calendarPreference", &["gregorian", "persian", "hebrew"]);
+    sanitize_allowed_string(state, "sidebarPosition", &["auto", "left", "right"]);
     sanitize_allowed_string(state, "appFontSize", &["small", "standard", "large"]);
     sanitize_allowed_string(state, "listRowDensity", &["compact", "standard", "relaxed"]);
     sanitize_allowed_string(state, "activeSettingsTab", &[
@@ -410,6 +438,10 @@ fn derived_location_path(base: &str, subfolder: &str) -> String {
 fn default_settings() -> PersistedSettings {
     PersistedSettings {
         theme: Theme::System,
+        font_family: FontFamily::System,
+        window_control_style: WindowControlStyle::Auto,
+        calendar_preference: CalendarPreference::Gregorian,
+        language: "system".to_string(),
         base_download_folder: "~/Downloads".to_string(),
         category_subfolders_enabled: true,
         category_subfolders: default_category_subfolders(),
@@ -420,6 +452,7 @@ fn default_settings() -> PersistedSettings {
         speed_limit_preset_values: vec![1.0, 5.0, 10.0],
         logs_enabled: false,
         is_sidebar_visible: true,
+        sidebar_position: "auto".to_string(),
         active_settings_tab: SettingsTab::Downloads,
         scheduler: SchedulerSettings {
             enabled: false,
@@ -441,6 +474,7 @@ fn default_settings() -> PersistedSettings {
         max_automatic_retries: 3,
         show_notifications: true,
         play_completion_sound: false,
+        auto_add_clipboard_links: false,
         app_font_size: AppFontSize::Standard,
         list_row_density: ListRowDensity::Standard,
         show_dock_badge: true,
@@ -450,7 +484,9 @@ fn default_settings() -> PersistedSettings {
         proxy_port: 8080,
         custom_user_agent: String::new(),
         ask_where_to_save_each_file: false,
+        remember_last_used_download_directory: false,
         prevents_sleep_while_downloading: true,
+        prevents_display_sleep_while_downloading: false,
         media_cookie_source: MediaCookieSource::default(),
         site_logins: Vec::new(),
         auto_check_updates: true,
@@ -460,6 +496,7 @@ fn default_settings() -> PersistedSettings {
 
 #[cfg(test)]
 mod tests {
+    use crate::ipc::{FontFamily, WindowControlStyle};
     use super::{
         decode_stored_settings, default_settings, preserve_portable_pairing_token,
         preserve_scheduler_runtime_keys,
@@ -498,6 +535,7 @@ mod tests {
             "state": {
                 "maxConcurrentDownloads": 7,
                 "globalSpeedLimit": "2M",
+                "sidebarPosition": "right",
                 "scheduler": {
                     "enabled": true,
                     "startTime": "06:30",
@@ -515,6 +553,7 @@ mod tests {
 
         assert_eq!(settings.max_concurrent_downloads, 7);
         assert_eq!(settings.global_speed_limit, "2M");
+        assert_eq!(settings.sidebar_position, "right");
         assert_eq!(settings.speed_limit_preset_values, vec![1.0, 5.0, 10.0]);
         assert!(!settings.logs_enabled);
         assert!(settings.scheduler.enabled);
@@ -652,6 +691,59 @@ mod tests {
         assert_eq!(settings.max_concurrent_downloads, 3);
     }
 
+    #[test]
+    fn invalid_sidebar_position_uses_automatic_layout() {
+        let stored = json!({
+            "state": {"sidebarPosition": "diagonal"},
+            "version": 5
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert_eq!(settings.sidebar_position, "auto");
+    }
+
+    #[test]
+    fn invalid_font_family_uses_system_font() {
+        let stored = json!({
+            "state": {"fontFamily": "comic-sans"},
+            "version": 5
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert!(matches!(settings.font_family, FontFamily::System));
+    }
+
+    #[test]
+    fn curated_font_families_are_preserved() {
+        for value in ["vazirmatn", "noto-sans-hebrew", "noto-sans-sc", "roboto"] {
+            let stored = json!({
+                "state": {"fontFamily": value},
+                "version": 5
+            });
+
+            let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+            assert_eq!(serde_json::to_value(settings.font_family).unwrap(), json!(value));
+        }
+    }
+
+    #[test]
+    fn invalid_window_control_style_uses_automatic_layout() {
+        let stored = json!({
+            "state": {"windowControlStyle": "neon"},
+            "version": 5
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert!(matches!(
+            settings.window_control_style,
+            WindowControlStyle::Auto
+        ));
+    }
+
     #[test]
     fn clamps_out_of_range_download_settings() {
         let stored = json!({
@@ -679,6 +771,7 @@ mod tests {
                 "perServerConnections": 5,
                 "showNotifications": "yes",
                 "theme": "not-a-theme",
+                "calendarPreference": "lunar",
                 "siteLogins": [{"id": "valid", "urlPattern": "example.com", "username": "user"}, {"id": 3}]
             },
             "version": 3
@@ -691,13 +784,37 @@ mod tests {
         assert_eq!(settings.per_server_connections, 5);
         assert!(settings.show_notifications);
         assert!(matches!(settings.theme, crate::ipc::Theme::System));
+        assert!(matches!(
+            settings.calendar_preference,
+            crate::ipc::CalendarPreference::Gregorian
+        ));
         assert_eq!(settings.site_logins.len(), 1);
         assert_eq!(settings.site_logins[0].id, "valid");
     }
 
     #[test]
-    fn completion_sound_default_matches_the_frontend_default() {
+    fn opt_in_defaults_match_the_frontend_defaults() {
         assert!(!default_settings().play_completion_sound);
+        assert!(!default_settings().auto_add_clipboard_links);
+    }
+
+    #[test]
+    fn does_not_remember_last_used_download_directory_by_default() {
+        assert!(!default_settings().remember_last_used_download_directory);
+    }
+
+    #[test]
+    fn decodes_disabled_last_used_download_directory_setting() {
+        let stored = json!({
+            "state": {
+                "rememberLastUsedDownloadDirectory": false
+            },
+            "version": 3
+        });
+
+        let settings = decode_stored_settings(&Value::String(stored.to_string())).unwrap();
+
+        assert!(!settings.remember_last_used_download_directory);
     }
 
     #[test]

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Firelink",
-  "version": "1.1.0",
+  "version": "1.4.0",
   "identifier": "com.nimbold.firelink",
   "build": {
     "beforeDevCommand": "node scripts/stage-engines.js && npm run dev",
@@ -23,7 +23,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; img-src 'self' data: https:; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws://localhost:* http://localhost:* http://127.0.0.1:* ws://127.0.0.1:*"
+      "csp": "default-src 'self'; img-src 'self' data: https:; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self' ws://localhost:* http://localhost:* http://127.0.0.1:* ws://127.0.0.1:*"
     }
   },
   "bundle": {

src-tauri/tauri.macos.conf.json

@@ -8,17 +8,9 @@
         "height": 760,
         "minWidth": 960,
         "minHeight": 640,
-        "titleBarStyle": "Overlay",
-        "trafficLightPosition": {
-          "x": 17,
-          "y": 28
-        },
-        "hiddenTitle": true,
         "transparent": true,
-        "windowEffects": {
-          "effects": ["sidebar"],
-          "state": "active"
-        }
+        "decorations": false,
+        "shadow": false
       }
     ]
   },

src-tauri/tauri.windows.conf.json

@@ -9,10 +9,8 @@
         "minWidth": 960,
         "minHeight": 640,
         "transparent": true,
-        "windowEffects": {
-          "effects": ["mica"],
-          "state": "active"
-        }
+        "decorations": false,
+        "shadow": false
       }
     ]
   },

src-tauri/tests/README.md

@@ -23,3 +23,38 @@ cd src-tauri
 FIRELINK_LIVE_YOUTUBE_URL='https://www.youtube.com/watch?v=dQw4w9WgXcQ' \
   cargo test filters_live_youtube_metadata_from_env --lib -- --ignored --nocapture
 ```
+
+Run the real local Torrent runtime smoke test against the host bundled Aria2
+binary. It starts a local tracker and two Aria2 daemons, then covers magnet
+metadata resolution, saved-metadata hash validation, selected-file output,
+pause/resume, ownership reporting, and cancel/remove:
+
+```sh
+npm run smoke:torrent
+```
+
+Use `node scripts/smoke-torrent.js --binary /path/to/aria2c` when validating a
+packaged or target-specific Aria2 binary.
+
+Run the HTTP-boundary Torrent RPC integration test. It drives the production
+Aria2 RPC client through a local JSON-RPC server and verifies successful
+requests plus HTTP gateway errors:
+
+```sh
+npm run test:torrent:rpc
+```
+
+Run the deterministic unavailable-tracker and Aria2-daemon-exit checks with:
+
+```sh
+npm run smoke:torrent:failure-paths
+```
+
+Native CI runs this failure-path smoke after staging the target-specific
+bundled engines on macOS, Windows, and Linux. Windows executes the Torrent RPC,
+atomic-storage, canonical-cache, and web-seed normalization targets, while
+compiling (but not executing) the queue-manager and library test binaries;
+the Tauri mock harness exits before running on the Windows runner. The
+headless `production_contract` target still executes queue admission,
+normalization, credential-boundary, and retry contracts on Windows without
+constructing a Tauri mock application.

src-tauri/tests/atomic_file.rs

@@ -0,0 +1,102 @@
+use firelink_lib::atomic_write_replace;
+use std::fs;
+use tempfile::tempdir;
+#[cfg(target_os = "macos")]
+use tempfile::tempdir_in;
+
+#[tokio::test]
+async fn atomic_replacement_replaces_existing_file_repeatedly() {
+    let directory = tempdir().expect("temporary directory should be created");
+    let root = fs::canonicalize(directory.path()).expect("temporary directory should canonicalize");
+    let destination = root.join("download.torrent");
+
+    for value in [
+        b"reserved".as_slice(),
+        b"copied".as_slice(),
+        b"databaseCommitted".as_slice(),
+        b"sourceCleanupPending".as_slice(),
+    ] {
+        atomic_write_replace(&destination, value)
+            .await
+            .expect("atomic replacement should succeed");
+        assert_eq!(
+            fs::read(&destination).expect("destination should exist"),
+            value
+        );
+    }
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn atomic_replacement_rejects_symbolic_link_destinations() {
+    use std::os::unix::fs::symlink;
+
+    let directory = tempdir().expect("temporary directory should be created");
+    let root = fs::canonicalize(directory.path()).expect("temporary directory should canonicalize");
+    let target = root.join("target");
+    let destination = root.join("download.torrent");
+    fs::write(&target, b"protected").expect("target should be written");
+    symlink(&target, &destination).expect("symbolic link should be created");
+
+    assert!(atomic_write_replace(&destination, b"replacement")
+        .await
+        .is_err());
+    assert_eq!(
+        fs::read(&target).expect("target should remain readable"),
+        b"protected"
+    );
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn atomic_replacement_rejects_symbolic_link_parent_components() {
+    use std::os::unix::fs::symlink;
+
+    let directory = tempdir().expect("temporary directory should be created");
+    let root = fs::canonicalize(directory.path()).expect("temporary directory should canonicalize");
+    let target_directory = root.join("target");
+    let linked_directory = root.join("linked");
+    let target_child = target_directory.join("child");
+    std::fs::create_dir(&target_directory).expect("target directory should be created");
+    std::fs::create_dir(&target_child).expect("target child directory should be created");
+    symlink(&target_directory, &linked_directory).expect("symbolic link should be created");
+    let destination = linked_directory.join("child/download.torrent");
+
+    assert!(atomic_write_replace(&destination, b"replacement")
+        .await
+        .is_err());
+    assert!(!target_child.join("download.torrent").exists());
+}
+
+#[cfg(target_os = "macos")]
+#[tokio::test]
+async fn atomic_replacement_accepts_macos_system_path_aliases() {
+    let directory = tempdir_in("/tmp").expect("temporary directory should be created");
+    let destination = directory.path().join("download.torrent");
+
+    atomic_write_replace(&destination, b"replacement")
+        .await
+        .expect("the fixed macOS /tmp alias should be accepted");
+    assert_eq!(fs::read(&destination).unwrap(), b"replacement");
+}
+
+#[tokio::test]
+async fn atomic_replacement_recovers_after_non_regular_destination_failure() {
+    let directory = tempdir().expect("temporary directory should be created");
+    let root = fs::canonicalize(directory.path()).expect("temporary directory should canonicalize");
+    let destination = root.join("download.torrent");
+    fs::create_dir(&destination).expect("non-regular destination should be created");
+
+    assert!(atomic_write_replace(&destination, b"replacement")
+        .await
+        .is_err());
+    fs::remove_dir(&destination).expect("failed destination should be removable");
+
+    atomic_write_replace(&destination, b"recovered")
+        .await
+        .expect("atomic replacement should recover after the failed attempt");
+    assert_eq!(
+        fs::read(&destination).expect("destination should exist"),
+        b"recovered"
+    );
+}

src-tauri/tests/production_contract.rs

@@ -0,0 +1,125 @@
+use firelink_lib::ipc::{TorrentFile, TorrentWebSeed};
+use firelink_lib::queue::{
+    clamp_download_connections, normalize_aria2_disk_cache, normalize_torrent_bind_address,
+    normalize_torrent_dht_message_timeout, normalize_torrent_file_allocation,
+    normalize_torrent_web_seeds, EnqueueItem, QueueManager, SpawnPayload,
+};
+use firelink_lib::retry::{backoff_for, is_permanent_network_error, network_error_class};
+use std::time::Duration;
+
+#[test]
+fn headless_queue_contracts_reject_unsafe_inputs_and_preserve_bounds() {
+    assert_eq!(clamp_download_connections(0), 1);
+    assert_eq!(clamp_download_connections(99), 16);
+    assert_eq!(normalize_aria2_disk_cache(Some(" 32m ")).unwrap(), "32M");
+    assert!(normalize_aria2_disk_cache(Some("0K")).is_err());
+    assert_eq!(
+        normalize_torrent_bind_address(Some(" 2001:db8::1 ")).unwrap(),
+        Some("2001:db8::1".to_string())
+    );
+    assert!(normalize_torrent_bind_address(Some("not-an-ip")).is_err());
+    assert_eq!(normalize_torrent_dht_message_timeout(60).unwrap(), 60);
+    assert!(normalize_torrent_dht_message_timeout(61).is_err());
+    assert_eq!(normalize_torrent_file_allocation(None).unwrap(), "prealloc");
+    assert!(normalize_torrent_file_allocation(Some("sparse")).is_err());
+}
+
+#[test]
+fn headless_torrent_web_seed_contract_deduplicates_and_expands_per_file() {
+    let files = vec![
+        TorrentFile {
+            index: 1,
+            path: "folder/one.bin".to_string(),
+            length: 10,
+        },
+        TorrentFile {
+            index: 2,
+            path: "two.bin".to_string(),
+            length: 20,
+        },
+    ];
+    let seeds = vec![
+        TorrentWebSeed {
+            file_index: 1,
+            uri: "https://mirror.example/base".to_string(),
+        },
+        TorrentWebSeed {
+            file_index: 1,
+            uri: "https://mirror.example/base".to_string(),
+        },
+    ];
+    let normalized = normalize_torrent_web_seeds(Some(&seeds), &files).unwrap();
+    assert_eq!(normalized.len(), 1);
+    let expanded = firelink_lib::queue::expand_torrent_web_seeds(&normalized, &files).unwrap();
+    assert_eq!(
+        expanded,
+        vec![(1, "https://mirror.example/base/folder/one.bin".to_string())]
+    );
+
+    let credentialed = [TorrentWebSeed {
+        file_index: 1,
+        uri: "https://user:pass@mirror.example/file".to_string(),
+    }];
+    assert!(normalize_torrent_web_seeds(Some(&credentialed), &files).is_err());
+    let unknown_file = [TorrentWebSeed {
+        file_index: 3,
+        uri: "https://mirror.example/file".to_string(),
+    }];
+    assert!(normalize_torrent_web_seeds(Some(&unknown_file), &files).is_err());
+}
+
+#[test]
+fn headless_enqueue_contract_strips_torrent_credentials_before_task_creation() {
+    let item = EnqueueItem {
+        id: "torrent".to_string(),
+        queue_id: "main".to_string(),
+        url: "https://example.test/file.torrent".to_string(),
+        destination: "/tmp".to_string(),
+        filename: "file.torrent".to_string(),
+        username: Some("user".to_string()),
+        password: Some("secret".to_string()),
+        headers: Some("Cookie: session=secret".to_string()),
+        cookies: Some("session=secret".to_string()),
+        is_torrent: Some(true),
+        ..EnqueueItem::default()
+    };
+    let task = item.into_task();
+    assert!(task.payload.username.is_none());
+    assert!(task.payload.password.is_none());
+    assert!(task.payload.headers.is_none());
+    assert!(task.payload.cookies.is_none());
+}
+
+#[test]
+fn headless_queue_lifecycle_eligibility_and_retry_contracts_hold() {
+    assert!(QueueManager::<tauri::Wry>::aria2_allocation_phase_eligible(
+        &SpawnPayload::default()
+    ));
+    assert!(
+        !QueueManager::<tauri::Wry>::aria2_allocation_phase_eligible(&SpawnPayload {
+            is_media: true,
+            ..SpawnPayload::default()
+        })
+    );
+    assert!(
+        !QueueManager::<tauri::Wry>::aria2_allocation_phase_eligible(&SpawnPayload {
+            is_torrent: true,
+            torrent_file_allocation: Some("none".to_string()),
+            ..SpawnPayload::default()
+        })
+    );
+    assert!(
+        !QueueManager::<tauri::Wry>::aria2_allocation_phase_eligible(&SpawnPayload {
+            is_torrent: true,
+            torrent_file_allocation: Some("prealloc".to_string()),
+            ..SpawnPayload::default()
+        })
+    );
+    assert_eq!(backoff_for(0), Duration::from_secs(2));
+    assert_eq!(backoff_for(usize::MAX), Duration::from_secs(10));
+    assert_eq!(
+        network_error_class("HTTP/1.1 503 Service Unavailable"),
+        "http"
+    );
+    assert!(is_permanent_network_error("HTTP 403 Forbidden"));
+}

src-tauri/tests/torrent_cache.rs

@@ -0,0 +1,61 @@
+use firelink_lib::torrent::{
+    cache_torrent_info_hash_at, parse_torrent_bytes, read_cached_torrent_by_info_hash_at,
+};
+use tempfile::tempdir;
+
+#[tokio::test]
+async fn canonical_cache_round_trip_rejects_invalid_bytes_and_source_metadata() {
+    let directory = tempdir().expect("temporary directory should be created");
+    let root = directory.path().join("torrents");
+    let bytes = b"d4:infod6:lengthi5e4:name4:testee";
+    let parsed = parse_torrent_bytes(bytes).expect("test torrent should parse");
+
+    let path = cache_torrent_info_hash_at(&root, bytes)
+        .await
+        .expect("canonical cache write should succeed")
+        .expect("canonical cache path should be returned");
+    let path = std::path::PathBuf::from(path);
+    assert_eq!(
+        read_cached_torrent_by_info_hash_at(&root, &parsed.info_hash)
+            .await
+            .expect("canonical cache read should succeed"),
+        Some(bytes.to_vec())
+    );
+
+    tokio::fs::write(&path, b"not a torrent")
+        .await
+        .expect("invalid cache fixture should be writable");
+    assert!(
+        read_cached_torrent_by_info_hash_at(&root, &parsed.info_hash)
+            .await
+            .expect("invalid cache should be handled")
+            .is_none()
+    );
+    assert!(!path.exists());
+
+    let tracker_bytes =
+        b"d8:announce32:https://tracker.example/announce4:infod6:lengthi5e4:name4:testee";
+    let tracker_hash = parse_torrent_bytes(tracker_bytes)
+        .expect("tracker-bearing torrent should parse")
+        .info_hash;
+    let tracker_path = cache_torrent_info_hash_at(&root, tracker_bytes)
+        .await
+        .expect("tracker metadata should be reusable")
+        .expect("tracker cache path should be returned");
+    let tracker_path = std::path::PathBuf::from(tracker_path);
+    assert_eq!(
+        read_cached_torrent_by_info_hash_at(&root, &tracker_hash)
+            .await
+            .expect("tracker cache should be readable"),
+        Some(tracker_bytes.to_vec())
+    );
+    assert!(cache_torrent_info_hash_at(
+        &root,
+        b"d4:infod6:lengthi5e4:name4:teste8:url-list22:https://example.test/ae"
+    )
+    .await
+    .expect("web-seed metadata should be handled")
+    .is_none());
+
+    let _ = tokio::fs::remove_file(&tracker_path).await;
+}

src-tauri/tests/torrent_rpc.rs

@@ -0,0 +1,96 @@
+use axum::{extract::Json, http::StatusCode, response::IntoResponse, routing::post, Router};
+use firelink_lib::rpc_call;
+use serde_json::{json, Value};
+use std::net::SocketAddr;
+use tokio::sync::oneshot;
+
+async fn start_server(
+    app: Router,
+) -> (SocketAddr, oneshot::Sender<()>, tokio::task::JoinHandle<()>) {
+    let listener = tokio::net::TcpListener::bind(("127.0.0.1", 0))
+        .await
+        .expect("RPC test server should bind");
+    let address = listener
+        .local_addr()
+        .expect("RPC test server should have an address");
+    let (shutdown, shutdown_signal) = oneshot::channel();
+    let task = tokio::spawn(async move {
+        axum::serve(listener, app)
+            .with_graceful_shutdown(async {
+                let _ = shutdown_signal.await;
+            })
+            .await
+            .expect("RPC test server should stop cleanly");
+    });
+    (address, shutdown, task)
+}
+
+struct TestResponse(StatusCode, Value);
+
+impl IntoResponse for TestResponse {
+    fn into_response(self) -> axum::response::Response {
+        (self.0, Json(self.1)).into_response()
+    }
+}
+
+async fn successful_rpc(Json(request): Json<Value>) -> TestResponse {
+    assert_eq!(request.get("jsonrpc"), Some(&json!("2.0")));
+    assert_eq!(request.get("id"), Some(&json!("1")));
+    assert_eq!(request.get("method"), Some(&json!("aria2.getVersion")));
+    assert_eq!(
+        request.get("params"),
+        Some(&json!(["token:test-secret", {"include": "version"}]))
+    );
+    TestResponse(
+        StatusCode::OK,
+        json!({"jsonrpc": "2.0", "id": "1", "result": {"version": "test"}}),
+    )
+}
+
+async fn gateway_error(Json(_request): Json<Value>) -> TestResponse {
+    TestResponse(
+        StatusCode::BAD_GATEWAY,
+        json!({"jsonrpc": "2.0", "id": "1", "error": {"code": 1, "message": "backend unavailable"}}),
+    )
+}
+
+async fn stop_server(shutdown: oneshot::Sender<()>, task: tokio::task::JoinHandle<()>) {
+    let _ = shutdown.send(());
+    task.await.expect("RPC test server task should join");
+}
+
+#[tokio::test]
+async fn production_rpc_client_sends_authenticated_json_rpc() {
+    let app = Router::new().route("/jsonrpc", post(successful_rpc));
+    let (address, shutdown, task) = start_server(app).await;
+    let result = rpc_call(
+        address.port(),
+        "test-secret",
+        "aria2.getVersion",
+        json!([{"include": "version"}]),
+    )
+    .await
+    .expect("successful RPC response should decode");
+
+    assert_eq!(result, json!({"version": "test"}));
+    stop_server(shutdown, task).await;
+}
+
+#[tokio::test]
+async fn production_rpc_client_preserves_http_gateway_context() {
+    let app = Router::new().route("/jsonrpc", post(gateway_error));
+    let (address, shutdown, task) = start_server(app).await;
+    let error = rpc_call(address.port(), "test-secret", "aria2.getVersion", json!([]))
+        .await
+        .expect_err("gateway response should fail");
+
+    assert!(
+        error.contains("HTTP 502 Bad Gateway"),
+        "unexpected error: {error}"
+    );
+    assert!(
+        error.contains("backend unavailable"),
+        "unexpected error: {error}"
+    );
+    stop_server(shutdown, task).await;
+}