fix: security hardening, macOS aria2 lookup, aria2 stability and UI bugs

.github/workflows/ci.yml

@@ -36,6 +36,12 @@ jobs:
           workspaces: src-tauri -> target
           key: quality
 
+      - name: Cache aria2 sidecar
+        uses: actions/cache@v6
+        with:
+          path: src-tauri/binaries
+          key: aria2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/prepare-aria2.mjs') }}
+
       - name: Install npm dependencies
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -98,6 +104,12 @@ jobs:
           workspaces: src-tauri -> target
           key: ${{ matrix.label }}
 
+      - name: Cache aria2 sidecar
+        uses: actions/cache@v6
+        with:
+          path: src-tauri/binaries
+          key: aria2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/prepare-aria2.mjs') }}
+
       - name: Install npm dependencies
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-please.yml

@@ -2,7 +2,7 @@ name: Release Please
 
 on:
   push:
-    branches: [dev]
+    branches: [main]
   workflow_dispatch:
 
 permissions:
@@ -12,11 +12,23 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - name: Run release-please
+        id: release
         uses: googleapis/release-please-action@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          target-branch: dev
+          target-branch: main
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+
+  build:
+    name: Build release artifacts
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    uses: ./.github/workflows/release.yml
+    with:
+      tag: ${{ needs.release-please.outputs.tag_name }}

.github/workflows/release.yml

@@ -10,12 +10,20 @@ on:
         description: "Release tag (e.g. v0.1.0)"
         required: true
         type: string
+  # Called by release-please after it publishes a release: tags created with
+  # GITHUB_TOKEN do not trigger the `push: tags` event above.
+  workflow_call:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v0.1.0)"
+        required: true
+        type: string
 
 permissions:
   contents: write
 
 concurrency:
-  group: release-${{ github.ref }}
+  group: release-${{ inputs.tag || github.ref }}
   cancel-in-progress: false
 
 jobs:
@@ -43,6 +51,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag || github.ref }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v6

README.md

@@ -126,7 +126,7 @@ You can also right-click the app and choose **Open**.
 # Install dependencies
 npm install
 
-# Re-download aria2c if needed
+# Re-prepare aria2c if needed (delete src-tauri/binaries/aria2c-* first)
 npm run prepare:aria2
 
 # Start Vite + Tauri
@@ -136,7 +136,7 @@ npm run tauri dev
 npm run tauri build
 ```
 
-`npm install` automatically downloads the required `aria2c` sidecar into `src-tauri/binaries/` for supported Windows and macOS targets.
+`npm install` automatically prepares the required `aria2c` sidecar in `src-tauri/binaries/` from the pinned official aria2 release: on Windows it downloads the official build, and on macOS it compiles aria2 from source, which needs the Xcode Command Line Tools and takes a few minutes the first time. To use your own binary instead, set `ARIA2C_PATH` before running `npm run prepare:aria2`.
 
 Useful checks:
 

README.zh-CN.md

@@ -126,7 +126,7 @@ xattr -dr com.apple.quarantine /Applications/ComfyDownloader.app
 # 安装依赖
 npm install
 
-# 如有需要，重新下载 aria2c
+# 如有需要，重新准备 aria2c（需先删除 src-tauri/binaries/aria2c-*）
 npm run prepare:aria2
 
 # 启动 Vite + Tauri
@@ -136,7 +136,7 @@ npm run tauri dev
 npm run tauri build
 ```
 
-`npm install` 会自动将对应平台所需的 `aria2c` sidecar 下载到 `src-tauri/binaries/`。目前自动准备仅覆盖 Windows 和 macOS。
+`npm install` 会基于固定版本的 aria2 官方发布，自动在 `src-tauri/binaries/` 下准备所需的 `aria2c` sidecar：Windows 直接下载官方构建；macOS 从官方源码编译，需要先安装 Xcode Command Line Tools，首次约需几分钟。如需使用自己的二进制，可在运行 `npm run prepare:aria2` 前设置 `ARIA2C_PATH`。目前自动准备仅覆盖 Windows 和 macOS。
 
 常用检查命令：
 

THIRD_PARTY_NOTICES.md

@@ -13,9 +13,10 @@ or runtime-required third-party components.
 ## aria2
 
 ComfyDownloader ships the [`aria2c`](https://github.com/aria2/aria2)
-binary as a Tauri sidecar. The binary is downloaded at install time by
-[`scripts/prepare-aria2.mjs`](scripts/prepare-aria2.mjs) and embedded into
-release artifacts (`.dmg` / `.msi` / `.exe`).
+binary as a Tauri sidecar. The binary is prepared at install time by
+[`scripts/prepare-aria2.mjs`](scripts/prepare-aria2.mjs) from the pinned
+official aria2 release (currently 1.37.0, verified by SHA256) and embedded
+into release artifacts (`.dmg` / `.msi` / `.exe`).
 
 - **Project**: aria2 — <https://aria2.github.io/>
 - **Source code**: <https://github.com/aria2/aria2>
@@ -34,12 +35,14 @@ satisfies this requirement for unmodified builds).
 
 ---
 
-## macOS aria2 builds (`AnInsomniacy/aria2-builder`)
+## How the bundled aria2 is built
 
-On macOS, `prepare-aria2.mjs` downloads pre-built `aria2c` binaries from
-the [`AnInsomniacy/aria2-builder`](https://github.com/AnInsomniacy/aria2-builder)
-release feed. Those binaries are themselves builds of upstream aria2 and
-remain under GPL-2.0-or-later as described above.
+- **Windows**: the official upstream `aria2-<version>-win-64bit-build1.zip`
+  release asset, unmodified.
+- **macOS**: upstream publishes no macOS binaries, so `prepare-aria2.mjs`
+  compiles the official, unmodified source tarball, configured to use only
+  system frameworks (AppleTLS). The corresponding source is the upstream
+  release tarball linked above.
 
 ---
 

index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>temp_scaffold</title>
+    <title>ComfyDownloader</title>
   </head>
   <body>
     <div id="root"></div>