debont80
701c73a889
Incognito lived only in the renderer (history skip), so a "private" download still leaked in main: errorlog entries (title+URL), OS toasts showing the title, and the signed-in cookies attached — the UI promised "no logging, no history, no cookies" but only history held. Plumb `incognito` through StartDownloadOptions and enforce it in main: - logFailure skips the errorlog write (and the pre-spawn errorlog in ipc.ts). - notify uses a generic outcome title and drops the detail body, so no title/URL lands in the Windows Action Center. - both cookie sources (--cookies login jar, --cookies-from-browser) are withheld, so a private download can't be tied to the user's identity. typecheck + 262 tests + eslint + prettier green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>