Background running for downloads/auto-download, library clipboard detect, updater auth + token

Closing the window no longer kills in-progress downloads, the library gains the
same copied-link suggestion the downloads tab has, and the in-app updater can now
authenticate to a sign-in-required Gitea.

Background / tray:
- The window's close handler now hides to the tray (instead of quitting) whenever
  a download is in flight, even if "Keep running in the tray" is off — quitting
  was killing the spawned yt-dlp processes. A one-time notification explains the
  app is still running. (download.ts exposes hasActiveDownloads().)
- tray.ts now falls back to an embedded icon when no build/icon.ico ships, so the
  tray actually appears — previously an empty icon meant the tray was skipped and
  a minimized window could be stranded with no way back.
- New "Start with Windows" setting (launchAtStartup) wired to
  app.setLoginItemSettings, synced at startup and on toggle. Useful with
  auto-download so watched channels stay current in the background.
- The "Keep running in the tray" hint now explains it also enables background
  auto-download of new uploads.

Library clipboard detection:
- Extracted the downloads tab's clipboard watcher into a shared useClipboardLink
  hook and used it in the library's add-source field, so a copied channel/playlist
  link is offered there too.

Updater fix (works on a private / sign-in-required instance):
- Added an optional updateToken setting. When set, the updater sends it as a Gitea
  Authorization header on the release check, the checksum fetch, and the installer
  download — so "Check for updates" works where anonymous access is blocked (the
  previous "could not reach the update server" case). Blank = anonymous, unchanged.
  No token is ever shipped; it's only ever sent to the host-pinned update host.
  Settings gains a masked "Update access token" field.

Typecheck clean; 187 tests pass; electron-vite build clean. New UI verified in the
browser preview (tray/startup toggles, token field, library copied-link banner).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/download.ts

@@ -43,6 +43,15 @@ interface ActiveDownload {
 
 const active = new Map<string, ActiveDownload>()
 
+/**
+ * Whether any yt-dlp download is currently running. Used by the window's close
+ * handler to keep the app alive in the tray (instead of quitting and killing the
+ * spawned processes) when the user closes the window mid-download.
+ */
+export function hasActiveDownloads(): boolean {
+  return active.size > 0
+}
+
 // --- Formatting helpers (raw yt-dlp numbers → human strings) ----------------
 
 function num(s?: string): number | undefined {

src/main/index.ts

@@ -1,4 +1,4 @@
-import { app, shell, BrowserWindow, ipcMain, dialog, clipboard, nativeTheme } from 'electron'
+import { app, shell, BrowserWindow, ipcMain, dialog, clipboard, nativeTheme, Notification } from 'electron'
 import { join, resolve } from 'path'
 import { electronApp, optimizer, is } from '@electron-toolkit/utils'
 import {
@@ -15,9 +15,15 @@ import { getYtdlpVersion, updateYtdlp, runStartupYtdlpAutoUpdate } from './ytdlp
 import { getFfmpegVersions } from './ffmpeg'
 import { checkForAppUpdate, downloadAppUpdate, runAppUpdate } from './updater'
 import { probeMedia } from './probe'
-import { startDownload, cancelDownload, pauseDownload, previewCommand } from './download'
+import {
+  startDownload,
+  cancelDownload,
+  pauseDownload,
+  previewCommand,
+  hasActiveDownloads
+} from './download'
 import { runTerminal, cancelTerminal } from './terminal'
-import { getSettings, setSettings, ensureMediaDirs } from './settings'
+import { getSettings, setSettings, ensureMediaDirs, applyLaunchAtStartup } from './settings'
 import { listHistory, addHistory, removeHistory, removeManyHistory, clearHistory } from './history'
 import { listTemplates, saveTemplate, removeTemplate } from './templates'
 import { setupPortableData } from './portable'
@@ -95,6 +101,19 @@ function getSystemThemeInfo(): SystemThemeInfo {
   }
 }
 
+// Tell the user (once per run) that closing the window left AeroFetch running so
+// an in-progress download could finish — shown only when they haven't already
+// opted into tray mode, so a window that "won't close" doesn't read as a bug.
+let notifiedBackground = false
+function notifyBackgroundOnce(): void {
+  if (notifiedBackground || !Notification.isSupported()) return
+  notifiedBackground = true
+  new Notification({
+    title: 'AeroFetch is still running',
+    body: 'Your download is finishing in the background. Use the tray icon to reopen or quit.'
+  }).show()
+}
+
 // Web permissions a download manager never needs. They're denied for the app
 // window as defence-in-depth (audit T6): even if the renderer were compromised
 // (e.g. XSS via remote video metadata) it can't open the camera/mic, read
@@ -137,12 +156,20 @@ function createWindow(): void {
     else win.show()
   })
 
-  // Minimize-to-tray: when enabled, closing the window hides it to the tray
-  // instead of quitting. A real quit (tray menu / before-quit) sets isQuitting().
+  // Closing the window hides to the tray (instead of quitting) when either the
+  // user opted into background mode, OR a download is in flight — quitting would
+  // kill the spawned yt-dlp processes and lose the download. A real quit (tray
+  // menu / before-quit) sets isQuitting() so this lets the close through.
   win.on('close', (e) => {
-    if (getSettings().minimizeToTray && !isQuitting()) {
+    if (isQuitting()) return
+    const downloadsRunning = hasActiveDownloads()
+    if (getSettings().minimizeToTray || downloadsRunning) {
       e.preventDefault()
       win.hide()
+      // If we're only staying alive because a download is running (the user
+      // didn't opt into tray mode), tell them once — otherwise a window that
+      // won't close looks like a bug.
+      if (downloadsRunning && !getSettings().minimizeToTray) notifyBackgroundOnce()
     }
   })
 
@@ -371,6 +398,10 @@ if (isPrimaryInstance) {
     // exist from first launch (downloads are routed into them by kind).
     ensureMediaDirs()
 
+    // Sync the Windows "run at sign-in" entry with the persisted setting, so it
+    // reflects the user's choice even if they changed it on another install.
+    applyLaunchAtStartup(getSettings().launchAtStartup)
+
     app.on('browser-window-created', (_, window) => {
       optimizer.watchWindowShortcuts(window)
     })

src/main/settings.ts

@@ -50,7 +50,23 @@ const DEFAULTS: Settings = {
   notifyOnComplete: true,
   autoDownloadNew: true,
   hasCompletedOnboarding: false,
-  minimizeToTray: false
+  minimizeToTray: false,
+  launchAtStartup: false,
+  updateToken: ''
+}
+
+/**
+ * Sync the OS "run at sign-in" entry with the launchAtStartup setting. Called at
+ * startup and whenever the toggle changes. On Windows this writes/removes a
+ * per-user registry Run entry — no admin needed, matching the app's no-elevation
+ * stance. Best-effort: a failure here just means the toggle didn't take effect.
+ */
+export function applyLaunchAtStartup(enabled: boolean): void {
+  try {
+    app.setLoginItemSettings({ openAtLogin: enabled })
+  } catch {
+    /* non-fatal — e.g. unsupported platform */
+  }
 }
 
 /** Fixed path for the --download-archive file; not user-configurable. */
@@ -212,6 +228,12 @@ export function setSettings(partial: Partial<Settings>): Settings {
       case 'minimizeToTray':
         if (typeof value === 'boolean') s.set(key, value)
         break
+      case 'launchAtStartup':
+        if (typeof value === 'boolean') {
+          s.set('launchAtStartup', value)
+          applyLaunchAtStartup(value)
+        }
+        break
       case 'ytdlpChannel':
         // Same allowlist that guards the `--update-to` flag (audit F1).
         if (isYtdlpUpdateChannel(value)) s.set('ytdlpChannel', value)
@@ -262,6 +284,10 @@ export function setSettings(partial: Partial<Settings>): Settings {
       case 'youtubePoToken':
         if (typeof value === 'string') s.set(key, value)
         break
+      case 'updateToken':
+        // A Gitea token has no spaces; trim and store as-is (like proxy creds).
+        if (typeof value === 'string') s.set('updateToken', value.trim())
+        break
     }
   }
   return getSettings()

src/main/tray.ts

@@ -7,6 +7,16 @@
 import { app, Tray, Menu, nativeImage, type BrowserWindow } from 'electron'
 import { getAppIconPath } from './binaries'
 
+// Fallback tray glyph (32×32 teal disc + white download arrow) used when no
+// build/icon.ico is present. Without this the tray is skipped (an empty image
+// makes an invisible/unclickable Windows tray entry), which would strand a
+// minimized-to-tray window with no way back. Embedded as base64 so it needs no
+// asset-bundling step.
+const FALLBACK_TRAY_PNG =
+  'iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAl0lEQVR4nO3TQQ6AIAxEUU7giV17bd0i' +
+  'aaDTmdqY0ISl/peirf11jvO6+/N5cHXKwlIIG6cQqngIoY5DiKy4C4G8aBwJohSArpIBmIgNKAWgDys' +
+  'AL8QGlANmCHZc8dUW1HEYEEFA6/d+B6q4CVAhwnHkb2DiUwCDkMRRBHpccQsRnXB8RLCAULxHMAAqbm0j5b4VoPRg1jzWxpzrS/JA7QAAAABJRU5ErkJggg=='
+
 let tray: Tray | null = null
 // True once the user has chosen to really quit (tray menu, or app.quit from the
 // updater) — lets the window 'close' handler tell "hide to tray" from "exit".
@@ -31,9 +41,10 @@ function show(getWindow: () => BrowserWindow | null): void {
 /** Create the tray icon + menu once. No-op if it already exists or the icon is missing. */
 export function createTray(getWindow: () => BrowserWindow | null): void {
   if (tray) return
-  const icon = nativeImage.createFromPath(getAppIconPath())
-  // Without a usable icon a Windows tray entry is invisible/unclickable, which is
-  // worse than no tray — so skip it rather than ship a dead tray.
+  // Prefer the real app icon; fall back to the embedded glyph when no icon.ico
+  // ships, so minimize-to-tray always has a tray to restore from.
+  let icon = nativeImage.createFromPath(getAppIconPath())
+  if (icon.isEmpty()) icon = nativeImage.createFromDataURL(`data:image/png;base64,${FALLBACK_TRAY_PNG}`)
   if (icon.isEmpty()) return
 
   tray = new Tray(icon)

src/main/updater.ts

@@ -3,6 +3,7 @@ import { createWriteStream, type WriteStream } from 'fs'
 import { stat, unlink } from 'fs/promises'
 import { join, normalize, dirname } from 'path'
 import { createHash } from 'crypto'
+import { getSettings } from './settings'
 import {
   IpcChannels,
   type AppUpdateInfo,
@@ -10,6 +11,18 @@ import {
   type AppUpdateProgress
 } from '@shared/ipc'
 
+/**
+ * Authorization header for the update host. Empty unless the user has set an
+ * updateToken in Settings — needed when the release repo is private or the Gitea
+ * instance requires sign-in for anonymous access (the default on this instance).
+ * Only ever sent to the host-pinned UPDATE_HOST (see isTrustedDownloadUrl), so a
+ * redirect can never leak the token to another origin.
+ */
+function authHeader(): Record<string, string> {
+  const tok = getSettings().updateToken?.trim()
+  return tok ? { Authorization: `token ${tok}` } : {}
+}
+
 // --- Update source -----------------------------------------------------------
 // The Gitea repo whose Releases host the AeroFetch installers. The updater reads
 // the repo's latest release over the public REST API and downloads the installer
@@ -109,7 +122,7 @@ export async function checkForAppUpdate(): Promise<AppUpdateInfo> {
   const timer = setTimeout(() => controller.abort(), 15_000)
   try {
     const res = await fetch(RELEASE_API, {
-      headers: { Accept: 'application/json' },
+      headers: { Accept: 'application/json', ...authHeader() },
       signal: controller.signal
     })
     if (!res.ok) {
@@ -187,6 +200,7 @@ function fetchTrustedText(
       resolve(r)
     }
     const request = net.request({ url, redirect: 'manual' })
+    for (const [k, v] of Object.entries(authHeader())) request.setHeader(k, v)
     const timer = setTimeout(() => done({ ok: false, error: 'timed out' }), timeoutMs)
     request.on('redirect', (_s, _m, redirectUrl) => {
       if (!isTrustedDownloadUrl(redirectUrl)) {
@@ -279,6 +293,7 @@ export async function downloadAppUpdate(url: string, wc: WebContents): Promise<A
     // fetch hides the Location header under redirect:'manual', so it can't gate
     // hops. 'manual' here means a hop only proceeds if we call followRedirect().
     const request = net.request({ url, redirect: 'manual' })
+    for (const [k, v] of Object.entries(authHeader())) request.setHeader(k, v)
 
     const armIdle = (): void => {
       if (idle) clearTimeout(idle)