refactor: don't allow portable build to be set as the default browser

chore: linting
feat: portable build
2026-06-11 17:27:54 +02:00 · 2026-03-29 15:47:53 +04:00 · 2026-03-29 15:01:26 +04:00 · 2026-03-29 14:55:20 +04:00 · 2026-03-29 13:03:17 +04:00 · 2026-03-29 13:02:41 +04:00
135 changed files with 4930 additions and 2750 deletions
@@ -197,6 +197,7 @@ These are frequently overlooked issues that make UI look unprofessional:
 Before delivering UI code, verify these items:

 ### Visual Quality
+
 - [ ] No emojis used as icons (use SVG instead)
 - [ ] All icons from consistent icon set (Heroicons/Lucide)
 - [ ] Brand logos are correct (verified from Simple Icons)
@@ -204,24 +205,28 @@ Before delivering UI code, verify these items:
 - [ ] Use theme colors directly (bg-primary) not var() wrapper

 ### Interaction
+
 - [ ] All clickable elements have `cursor-pointer`
 - [ ] Hover states provide clear visual feedback
 - [ ] Transitions are smooth (150-300ms)
 - [ ] Focus states visible for keyboard navigation

 ### Light/Dark Mode
+
 - [ ] Light mode text has sufficient contrast (4.5:1 minimum)
 - [ ] Glass/transparent elements visible in light mode
 - [ ] Borders visible in both modes
 - [ ] Test both modes before delivery

 ### Layout
+
 - [ ] Floating elements have proper spacing from edges
 - [ ] No content hidden behind fixed navbars
 - [ ] Responsive at 320px, 768px, 1024px, 1440px
 - [ ] No horizontal scroll on mobile

 ### Accessibility
+
 - [ ] All images have alt text
 - [ ] Form inputs have labels
 - [ ] Color is not the only indicator
@@ -1,42 +0,0 @@
---
-name: "Bug report"
-about: Report a bug
---
-
-<!--
-Hi there! To expedite issue processing please search open and closed issues before submitting a new one. Existing issues often contain information about workarounds, resolution, or progress updates.
-->
-
-# Bug Report
-
-## Description
-
-<!-- A clear and concise description of the problem. -->
-
-## Is this a regression?
-
-<!-- Did this behavior use to work in the previous version? -->
-
-## Minimal Reproduction
-
-<!-- Clear steps to re-produce the issue. -->
-
-1.
-2.
-3.
-
-## Your Environment
-
-<!-- Please provide as much information as you feel comfortable to help the maintainers understand the issue better -->
-
-## Exception or Error or Screenshot
-
-<!-- Please provide any error messages, stack traces, or screenshots that might help -->
-
-<pre><code>
-<!-- Paste error logs here -->
-</code></pre>
-
-## Additional Context
-
-<!-- Add any other context about the problem here. -->
@@ -1,34 +0,0 @@
---
-name: "Feature request"
-about: Suggest a feature
---
-
-# Feature Request
-
-## Description
-
-<!-- A clear and concise description of the problem or missing capability. -->
-
-## Describe the solution you'd like
-
-<!-- If you have a solution in mind, please describe it. -->
-
-## Describe alternatives you've considered
-
-<!-- Have you considered any alternative solutions or workarounds? -->
-
-## Use Case
-
-<!-- Describe the specific use case and how this feature would benefit users. -->
-
-## Priority
-
-<!-- How important is this feature to you? -->
-
- [ ] Low - Nice to have
- [ ] Medium - Would improve my workflow
- [ ] High - Critical for my use case
-
-## Additional Context
-
-<!-- Add any other context, mockups, or examples about the feature request here. -->
@@ -0,0 +1,63 @@
+name: Bug Report
+description: Something isn't working
+labels: ["bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      placeholder: Describe the bug. What did you expect vs what actually happened?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Go to ...
+        2. Click on ...
+        3. See error
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating System
+      options:
+        - macOS (Apple Silicon)
+        - macOS (Intel)
+        - Windows
+        - Linux
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Donut Browser version
+      placeholder: e.g. 0.17.6 or nightly-2026-03-21
+    validations:
+      required: true
+
+  - type: dropdown
+    id: browser
+    attributes:
+      label: Which browser is affected?
+      options:
+        - Wayfern
+        - Camoufox
+        - Both
+        - Not browser-specific
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Error logs or screenshots
+      description: Run from terminal to get logs. Paste errors, screenshots, or screen recordings.
+      placeholder: Paste logs here or drag screenshots
+    validations:
+      required: false
@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions & Discussion
+    url: https://github.com/zhom/donutbrowser/discussions
+    about: Ask questions or discuss ideas here instead of opening an issue.
@@ -0,0 +1,30 @@
+name: Feature Request
+description: Suggest a new feature
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: What do you want?
+      placeholder: Describe the feature and why you need it.
+    validations:
+      required: true
+
+  - type: textarea
+    id: use-case
+    attributes:
+      label: Use case
+      placeholder: How would you use this feature? What problem does it solve?
+    validations:
+      required: true
+
+  - type: dropdown
+    id: priority
+    attributes:
+      label: How important is this to you?
+      options:
+        - Nice to have
+        - Would improve my workflow
+        - Critical for my use case
+    validations:
+      required: true
@@ -1,54 +1,20 @@
-# ✨ Pull Request
+## Which issue does this PR fix?

-## 📓 Referenced Issue
+<!-- Link the issue. #123 -->

-<!-- Please link the related issue. Use # before the issue number and use the verbs 'fixes', 'resolves' to auto-link it, for eg, Fixes: #<issue-number> -->
+## How to test

-## ℹ️ About the PR
+<!-- Steps for the reviewer to verify your changes work -->

-<!-- Please provide a description of your solution if it is not clear in the related issue or if the PR has a breaking change. If there is an interesting topic to discuss or you have questions or there is an issue with Tauri, Rust, or another library that you have used. -->
+## Checklist

-## 🔄 Type of Change
+- [ ] Read [CONTRIBUTING.md](https://github.com/zhom/donutbrowser/blob/main/CONTRIBUTING.md)
+- [ ] Ran `pnpm format && pnpm lint && pnpm test` locally and it passes
+- [ ] I tested the changes myself by running the app locally
+- [ ] Updated translations in all locale files (if UI text changed)

-<!-- Mark the relevant option with an "x". -->
+## AI usage

- [ ] 🐛 Bug fix (non-breaking change which fixes an issue)
- [ ] ✨ New feature (non-breaking change which adds functionality)
- [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] 📚 Documentation update
- [ ] 🧹 Code cleanup/refactoring
- [ ] ⚡ Performance improvement
+- [ ] I used AI to help write this PR

-## 🖼️ Testing Scenarios / Screenshots
-
-<!-- Please include screenshots or gif to showcase the final output. Also, try to explain the testing you did to validate your change. -->
-
-## ✅ Checklist
-
-<!-- Mark completed items with an "x". -->
-
- [ ] My code follows the style guidelines of this project
- [ ] I have performed a self-review of my own code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published
-
-## 🧪 How Has This Been Tested?
-
-<!-- Please describe the tests that you ran to verify your changes. -->
-
-## 📱 Platform Testing
-
-<!-- Which platforms have you tested on? -->
-
- [ ] macOS (Intel)
- [ ] macOS (Apple Silicon)
- [ ] Windows (if applicable)
- [ ] Linux (if applicable)
-
-## 📋 Additional Notes
-
-<!-- Any additional information that reviewers should know about this PR. -->
+<!-- If you checked the box above, briefly explain how AI was used (e.g. "generated the test", "wrote the initial implementation", "full PR"). -->
@@ -27,9 +27,11 @@ jobs:
            build-mode: none
          - language: javascript-typescript
            build-mode: none
+          - language: rust
+            build-mode: none
    steps:
      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Set up pnpm package manager
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 #v4.4.0
@@ -14,6 +14,7 @@ permissions:

 jobs:
  contrib-readme-job:
+    if: github.repository == 'zhom/donutbrowser'
    runs-on: ubuntu-latest
    name: Automatically update the contributors list in the README
    permissions:
@@ -21,7 +22,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
      - name: Contribute List
        uses: akhilmhdh/contributors-readme-action@83ea0b4f1ac928fbfe88b9e8460a932a528eb79f #v2.3.11
        env:
@@ -12,8 +12,8 @@ permissions:
 jobs:
  security-scan:
    name: Security Vulnerability Scan
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3
+    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5
    with:
      scan-args: |-
        -r
@@ -28,7 +28,7 @@ jobs:

  lint-js:
    name: Lint JavaScript/TypeScript
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
    uses: ./.github/workflows/lint-js.yml
    secrets: inherit
    permissions:
@@ -36,7 +36,7 @@ jobs:

  lint-rust:
    name: Lint Rust
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
    uses: ./.github/workflows/lint-rs.yml
    secrets: inherit
    permissions:
@@ -44,7 +44,7 @@ jobs:

  codeql:
    name: CodeQL
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
    uses: ./.github/workflows/codeql.yml
    secrets: inherit
    permissions:
@@ -55,7 +55,7 @@ jobs:

  spellcheck:
    name: Spell Check
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
    uses: ./.github/workflows/spellcheck.yml
    secrets: inherit
    permissions:
@@ -63,13 +63,13 @@ jobs:

  dependabot-automerge:
    name: Dependabot Automerge
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
    needs: [security-scan, lint-js, lint-rust, codeql, spellcheck]
    runs-on: ubuntu-latest
    steps:
      - name: Dependabot metadata
        id: metadata
-        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a #v2.5.0
+        uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 #v3.0.0
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Enable auto-merge for minor and patch updates
@@ -0,0 +1,73 @@
+name: Build and Push donut-sync Docker Image
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "donut-sync/**"
+  workflow_call:
+    inputs:
+      tag:
+        description: "Docker tag (e.g., v1.0.0)"
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Docker tag (e.g., v1.0.0, latest)"
+        required: true
+        default: "latest"
+
+permissions:
+  contents: read
+
+env:
+  REGISTRY: docker.io
+  IMAGE_NAME: donutbrowser/donut-sync
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 #v4.0.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Determine tags
+        id: tags
+        run: |
+          TAGS=""
+          INPUT_TAG="${{ inputs.tag }}"
+
+          if [ -n "$INPUT_TAG" ]; then
+            # Called from release workflow or manual dispatch
+            TAGS="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${INPUT_TAG}"
+            TAGS="${TAGS},${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
+          elif [ "${{ github.event_name }}" = "push" ]; then
+            # Push to main (nightly): tag with nightly and commit SHA
+            SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+            TAGS="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:nightly"
+            TAGS="${TAGS},${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:nightly-${SHORT_SHA}"
+          fi
+
+          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
+          echo "Tags: ${TAGS}"
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 #v7.0.0
+        with:
+          context: .
+          file: ./donut-sync/Dockerfile
+          push: true
+          tags: ${{ steps.tags.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64
@@ -0,0 +1,49 @@
+name: Flake Test
+
+on:
+  pull_request:
+    paths:
+      - "flake.nix"
+      - "flake.lock"
+      - ".github/workflows/flake-test.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "flake.nix"
+      - "flake.lock"
+      - ".github/workflows/flake-test.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  flake:
+    name: validate-flake
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@a6f7623b2e2401f485f1eead77ced45bd99b09b0 #v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: Evaluate flake outputs
+        run: nix flake show --all-systems
+
+      - name: Check setup app is exposed
+        run: nix eval .#apps.x86_64-linux.setup.program --raw
+
+      - name: Run flake setup app
+        env:
+          CI: "true"
+        run: nix run .#setup
+
+      - name: Run flake info app
+        run: nix run .#info
@@ -14,16 +14,15 @@ permissions:
  contents: read
  issues: write
  pull-requests: write
-  models: read
  id-token: write

 jobs:
  analyze-issue:
-    if: github.event_name == 'issues'
+    if: github.repository == 'zhom/donutbrowser' && github.event_name == 'issues'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Check if first-time contributor
        id: check-first-time
@@ -31,9 +30,9 @@ jobs:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ISSUE_AUTHOR: ${{ github.event.issue.user.login }}
        run: |
-          ISSUE_COUNT=$(gh api "/repos/${{ github.repository }}/issues" \
-            --jq "map(select(.user.login == \"$ISSUE_AUTHOR\" and .number != ${{ github.event.issue.number }})) | length" \
-            --paginate || echo "0")
+          ISSUE_COUNT=$(gh api "/repos/${{ github.repository }}/issues?state=all&creator=$ISSUE_AUTHOR&per_page=100" \
+            --jq "[.[] | select(.number != ${{ github.event.issue.number }}) ] | length" \
+            || echo "0")

          if [ "$ISSUE_COUNT" = "0" ]; then
            echo "is_first_time=true" >> $GITHUB_OUTPUT
@@ -41,39 +40,148 @@ jobs:
            echo "is_first_time=false" >> $GITHUB_OUTPUT
          fi

-      - name: Analyze issue
-        uses: anomalyco/opencode/github@4ee426ba549131c4903a71dfb6259200467aca81 #v1.2.27
+      - name: Build repo context and find related files
        env:
-          ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          model: zai-coding-plan/glm-4.7
-          prompt: |
-            You are a triage bot for Donut Browser (open-source anti-detect browser, Tauri + Next.js + Rust).
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
+        run: |
+          # Read project guidelines (contains repo structure)
+          cp CLAUDE.md /tmp/repo-context.txt

-            ${{ steps.check-first-time.outputs.is_first_time == 'true' && 'This is a first-time contributor. Start your comment with: "Thanks for opening your first issue!"' || '' }}
+          printf '%s' "$ISSUE_TITLE" > /tmp/issue-title.txt
+          printf '%s' "${ISSUE_BODY:-}" > /tmp/issue-body.txt

-            Analyze this issue and post a single concise comment. Format:
+          # List all source files for the AI to pick from
+          find . -type f \( -name "*.rs" -o -name "*.ts" -o -name "*.tsx" \) \
+            ! -path "*/node_modules/*" ! -path "*/target/*" ! -path "*/.next/*" ! -path "*/dist/*" \
+            ! -path "*/.git/*" ! -path "*/gen/*" ! -path "*/data/*" \
+            | sed 's|^\./||' | sort > /tmp/all-source-files.txt

-            1. One sentence acknowledging what the user wants.
-            2. A short **Action items** list — what specific info is missing or what the user should do next. Only include items that are actually missing. If the issue is complete, say so and skip this section.
-            3. Label the issue: add "bug" label for bug reports, "enhancement" label for feature requests.
+      - name: Select relevant files with AI
+        env:
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+        run: |
+          PAYLOAD=$(jq -n \
+            --rawfile title /tmp/issue-title.txt \
+            --rawfile body /tmp/issue-body.txt \
+            --rawfile files /tmp/all-source-files.txt \
+            '{
+              model: "anthropic/claude-opus-4.6",
+              messages: [
+                {
+                  role: "system",
+                  content: "You are a file selector for Donut Browser (Tauri + Next.js + Rust anti-detect browser). Given an issue and a list of source files, output ONLY the 10 most likely relevant file paths, one per line. No explanations, no numbering, just paths."
+                },
+                {
+                  role: "user",
+                  content: ("Issue: " + $title + "\n\n" + $body + "\n\nFiles:\n" + $files)
+                }
+              ]
+            }')

-            Rules:
-            - Be brief. No filler, no generic tips, no templates.
-            - If it's a bug report, check for: reproduction steps, OS/version, error messages. Only ask for what's actually missing.
-            - If it's a feature request, check for: clear description of desired behavior, use case. Only ask for what's actually missing.
-            - If the issue already has everything needed, just acknowledge it and label it.
-            - Never exceed 6 items total.
+          RESPONSE=$(curl -fsSL https://openrouter.ai/api/v1/chat/completions \
+            -H "Authorization: Bearer $OPENROUTER_API_KEY" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD")
+
+          jq -r '.choices[0].message.content // empty' <<< "$RESPONSE" > /tmp/selected-files.txt
+
+          # Read the selected files in full (skip binary files)
+          echo "" > /tmp/file-contents.txt
+          while IFS= read -r filepath; do
+            filepath=$(echo "$filepath" | xargs)
+            [ -z "$filepath" ] && continue
+            if [ -f "$filepath" ] && file --mime "$filepath" | grep -q "text/"; then
+              echo "=== $filepath ===" >> /tmp/file-contents.txt
+              cat "$filepath" >> /tmp/file-contents.txt
+              echo "" >> /tmp/file-contents.txt
+            fi
+          done < /tmp/selected-files.txt
+
+          # Cap total context at 100KB
+          head -c 100000 /tmp/file-contents.txt > /tmp/file-context.txt
+
+      - name: Analyze issue with AI
+        env:
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
+          ISSUE_AUTHOR: ${{ github.event.issue.user.login }}
+          IS_FIRST_TIME: ${{ steps.check-first-time.outputs.is_first_time }}
+        run: |
+          GREETING=""
+          if [ "$IS_FIRST_TIME" = "true" ]; then
+            GREETING='This is a first-time contributor. Start your comment with: "Thanks for opening your first issue!"'
+          fi
+
+          printf '%s' "$ISSUE_TITLE" > /tmp/issue-title.txt
+          printf '%s' "${ISSUE_BODY:-}" > /tmp/issue-body.txt
+          printf '%s' "$ISSUE_AUTHOR" > /tmp/issue-author.txt
+          printf '%s' "$GREETING" > /tmp/greeting.txt
+
+          PAYLOAD=$(jq -n \
+            --rawfile title /tmp/issue-title.txt \
+            --rawfile body /tmp/issue-body.txt \
+            --rawfile author /tmp/issue-author.txt \
+            --rawfile greeting /tmp/greeting.txt \
+            --rawfile repo_context /tmp/repo-context.txt \
+            --rawfile context /tmp/file-context.txt \
+            '{
+              model: "anthropic/claude-opus-4.6",
+              messages: [
+                {
+                  role: "system",
+                  content: ("You are a triage bot for Donut Browser, an open-source anti-detect browser (Tauri desktop app: Rust backend + Next.js frontend).\n\nProject guidelines and structure:\n" + $repo_context + "\n\nYou have access to relevant source files for context.\n\nAnalyze the issue and produce a single comment. Your job is to collect missing information needed to diagnose the issue, NOT to guess the cause.\n\nFormat:\n\n1. One sentence acknowledging the issue.\n2. **Missing information** - Ask specific questions about what is missing from the report. Focus on reproducing the issue. Do NOT speculate about root causes or mention internal code/files — you will almost certainly be wrong without logs. Instead, ask for:\n   - Exact steps to reproduce (if not provided)\n   - Expected vs actual behavior (if unclear)\n   - Error messages or screenshots (if not provided)\n   - OS and app version (if not provided)\n   - For bug reports: if logs are needed, tell the user EXACTLY how to get them:\n     - macOS app logs: `~/Library/Logs/Donut Browser/`\n     - Linux app logs: `~/.local/share/DonutBrowser/logs/`\n     - Windows app logs: `%APPDATA%\\DonutBrowser\\logs\\`\n     - Sync server logs: `docker logs <container>` or check the server console\n     - Provide a ready-to-run shell command when possible.\n   - For self-hosted sync issues: check if the user is using the latest Docker image (`docker pull donutbrowser/donut-sync:latest`).\n   - Only ask for information that is actually missing. If the issue is already detailed, just acknowledge it.\n3. Suggest a label: `Label: bug` or `Label: enhancement` on its own line.\n\nRules:\n- Do NOT include a \"Possible cause\" section. Do not speculate about what code might be causing the issue.\n- Be brief and focused on collecting actionable information from the reporter.\n- If the issue already has everything needed (steps to reproduce, logs, version, OS), just acknowledge it.\n- Never exceed 15 lines.")
+                },
+                {
+                  role: "user",
+                  content: (
+                    (if ($greeting | length) > 0 then $greeting + "\n\n" else "" end) +
+                    "Analyze this issue:\n\nTitle: " + $title +
+                    "\nAuthor: " + $author +
+                    "\n\nBody:\n" + $body +
+                    "\n\nRelevant source files:\n" + $context
+                  )
+                }
+              ]
+            }')
+
+          RESPONSE=$(curl -fsSL https://openrouter.ai/api/v1/chat/completions \
+            -H "Authorization: Bearer $OPENROUTER_API_KEY" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD")
+
+          jq -r '.choices[0].message.content // empty' <<< "$RESPONSE" > /tmp/ai-comment.txt
+
+          if [ ! -s /tmp/ai-comment.txt ]; then
+            echo "::error::AI response was empty"
+            echo "Raw response:"
+            echo "$RESPONSE"
+            exit 1
+          fi
+
+      - name: Post comment and label
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          LABEL=$(grep -oP '^Label:\s*\K.*' /tmp/ai-comment.txt | tail -1 | tr '[:upper:]' '[:lower:]' | xargs)
+          sed -i '/^Label:/d' /tmp/ai-comment.txt
+
+          gh issue comment "$ISSUE_NUMBER" --repo "$GITHUB_REPOSITORY" --body-file /tmp/ai-comment.txt
+
+          if [ "$LABEL" = "bug" ]; then
+            gh issue edit "$ISSUE_NUMBER" --repo "$GITHUB_REPOSITORY" --add-label "bug" 2>/dev/null || true
+          elif [ "$LABEL" = "enhancement" ]; then
+            gh issue edit "$ISSUE_NUMBER" --repo "$GITHUB_REPOSITORY" --add-label "enhancement" 2>/dev/null || true
+          fi

  analyze-pr:
-    if: github.event_name == 'pull_request_target' && github.actor != 'dependabot[bot]'
+    if: github.repository == 'zhom/donutbrowser' && github.event_name == 'pull_request_target' && github.actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
-        with:
-          fetch-depth: 0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Check if first-time contributor
        id: check-first-time
@@ -91,33 +199,123 @@ jobs:
            echo "is_first_time=false" >> $GITHUB_OUTPUT
          fi

-      - name: Analyze PR
-        uses: anomalyco/opencode/github@4ee426ba549131c4903a71dfb6259200467aca81 #v1.2.27
+      - name: Gather PR context
        env:
-          ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          model: zai-coding-plan/glm-4.7
-          prompt: |
-            You are a review bot for Donut Browser (open-source anti-detect browser, Tauri + Next.js + Rust).
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          # Get changed files list
+          gh api "/repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files" \
+            --jq '.[] | "- \(.filename) (\(.status)) +\(.additions)/-\(.deletions)"' \
+            > /tmp/pr-files.txt

-            ${{ steps.check-first-time.outputs.is_first_time == 'true' && 'This is a first-time contributor. Start your comment with: "Thanks for your first PR!"' || '' }}
+          # Get the actual diff
+          gh api "/repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" \
+            --header "Accept: application/vnd.github.diff" \
+            > /tmp/pr-diff-full.txt 2>/dev/null || true
+          head -c 20000 /tmp/pr-diff-full.txt > /tmp/pr-diff.txt

-            Review this PR and post a single concise comment. Format:
+          # Get CONTRIBUTING.md and README.md for context
+          cat CONTRIBUTING.md > /tmp/contributing.txt 2>/dev/null || echo "Not found" > /tmp/contributing.txt
+          head -50 README.md > /tmp/readme.txt 2>/dev/null || echo "Not found" > /tmp/readme.txt

-            1. One sentence summarizing what this PR does.
-            2. **Action items** — only list things that actually need to be fixed or addressed. If the PR looks good, say so and skip this section.
+          # Read project guidelines (contains repo structure)
+          cp CLAUDE.md /tmp/repo-context.txt

-            Rules:
-            - Be brief. No filler, no praise padding.
-            - Focus on: bugs, security issues, missing edge cases, breaking changes.
-            - If the PR touches UI text or adds new strings, remind to update translation files in src/i18n/locales/.
-            - If the PR modifies Tauri commands, remind to check the unused-commands test.
-            - Do not nitpick style or formatting — the project has automated linting.
-            - Never exceed 8 lines total.
+          # Read full contents of all changed files (skip binary)
+          echo "" > /tmp/related-file-contents.txt
+          gh api "/repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files" --jq '.[].filename' | while IFS= read -r filepath; do
+            if [ -f "$filepath" ] && file --mime "$filepath" | grep -q "text/"; then
+              echo "=== $filepath (full file) ===" >> /tmp/related-file-contents.txt
+              cat "$filepath" >> /tmp/related-file-contents.txt
+              echo "" >> /tmp/related-file-contents.txt
+            fi
+          done
+          head -c 100000 /tmp/related-file-contents.txt > /tmp/pr-file-context.txt
+
+      - name: Analyze PR with AI
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          PR_BASE: ${{ github.event.pull_request.base.ref }}
+          PR_HEAD: ${{ github.event.pull_request.head.ref }}
+          IS_FIRST_TIME: ${{ steps.check-first-time.outputs.is_first_time }}
+        run: |
+          GREETING=""
+          if [ "$IS_FIRST_TIME" = "true" ]; then
+            GREETING='This is a first-time contributor. Start your comment with: "Thanks for your first PR!"'
+          fi
+
+          printf '%s' "$PR_TITLE" > /tmp/pr-title.txt
+          printf '%s' "${PR_BODY:-}" > /tmp/pr-body.txt
+          printf '%s' "$PR_AUTHOR" > /tmp/pr-author.txt
+          printf '%s' "$PR_BASE" > /tmp/pr-base.txt
+          printf '%s' "$PR_HEAD" > /tmp/pr-head.txt
+          printf '%s' "$GREETING" > /tmp/greeting.txt
+
+          PAYLOAD=$(jq -n \
+            --rawfile title /tmp/pr-title.txt \
+            --rawfile body /tmp/pr-body.txt \
+            --rawfile author /tmp/pr-author.txt \
+            --rawfile base /tmp/pr-base.txt \
+            --rawfile head /tmp/pr-head.txt \
+            --rawfile files /tmp/pr-files.txt \
+            --rawfile diff /tmp/pr-diff.txt \
+            --rawfile greeting /tmp/greeting.txt \
+            --rawfile repo_context /tmp/repo-context.txt \
+            --rawfile contributing /tmp/contributing.txt \
+            --rawfile file_context /tmp/pr-file-context.txt \
+            '{
+              model: "anthropic/claude-opus-4.6",
+              messages: [
+                {
+                  role: "system",
+                  content: ("You are a code review bot for Donut Browser, an open-source anti-detect browser (Tauri desktop app: Rust backend + Next.js frontend).\n\nProject guidelines and structure:\n" + $repo_context + "\n\nContributing guidelines:\n" + $contributing + "\n\nYou have access to the full changed files and the diff. Use them to give a substantive review.\n\nReview this PR and produce a single comment. Format:\n\n1. One sentence summarizing what this PR does and whether the approach is sound.\n2. **Code review** - Specific observations about the actual code changes. Mention file names and what you see in the diff. Look for:\n   - Bugs or logic errors in the changed code\n   - Security issues (SQL injection, path traversal, XSS, command injection)\n   - Missing error handling or edge cases\n   - Breaking changes to existing APIs or behavior\n   - If UI text was added/changed, check if all 7 translation files (en, es, fr, ja, pt, ru, zh) in src/i18n/locales/ were updated\n   - If Tauri commands were added/removed, the unused-commands test in lib.rs needs updating\n3. **Suggestions** - Concrete improvements if any. Skip if the PR looks good.\n\nRules:\n- Be substantive. Review the actual diff, not just the description.\n- Do NOT nitpick formatting or style — the project has automated linting (biome + clippy + rustfmt).\n- Do NOT just summarize the PR description back to the user — they wrote it, they know what it says.\n- If the PR is good, say so briefly.\n- Never exceed 20 lines.")
+                },
+                {
+                  role: "user",
+                  content: (
+                    (if ($greeting | length) > 0 then $greeting + "\n\n" else "" end) +
+                    "Review this PR:\n\nTitle: " + $title +
+                    "\nAuthor: " + $author +
+                    "\nBase: " + $base + " <- Head: " + $head +
+                    "\n\nDescription:\n" + $body +
+                    "\n\nChanged files:\n" + $files +
+                    "\n\nDiff:\n" + $diff +
+                    "\n\nFull file contents:\n" + $file_context
+                  )
+                }
+              ]
+            }')
+
+          RESPONSE=$(curl -fsSL https://openrouter.ai/api/v1/chat/completions \
+            -H "Authorization: Bearer $OPENROUTER_API_KEY" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD")
+
+          jq -r '.choices[0].message.content // empty' <<< "$RESPONSE" > /tmp/ai-comment.txt
+
+          if [ ! -s /tmp/ai-comment.txt ]; then
+            echo "::error::AI response was empty"
+            echo "Raw response:"
+            echo "$RESPONSE"
+            exit 1
+          fi
+
+      - name: Post comment
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr comment "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --body-file /tmp/ai-comment.txt

  opencode-command:
    if: |
+      github.repository == 'zhom/donutbrowser' &&
      (github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment') &&
      (contains(github.event.comment.body, ' /oc') ||
       startsWith(github.event.comment.body, '/oc') ||
@@ -126,10 +324,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Run opencode
-        uses: anomalyco/opencode/github@4ee426ba549131c4903a71dfb6259200467aca81 #v1.2.27
+        uses: anomalyco/opencode/github@54443bfb7e090ec3130dc972e689a3e5cc55a7f9 #v1.3.3
        env:
          ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -34,7 +34,7 @@ jobs:
        run: git config --global core.autocrlf false

      - name: Checkout repository code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Set up pnpm package manager
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 #v4.4.0
@@ -41,7 +41,7 @@ jobs:
        run: git config --global core.autocrlf false

      - name: Checkout repository code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Set up pnpm package manager
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 #v4.4.0
@@ -46,7 +46,7 @@ jobs:
  scan-scheduled:
    name: Scheduled Security Scan
    if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5
    with:
      scan-args: |-
        -r
@@ -58,7 +58,7 @@ jobs:
  scan-pr:
    name: PR Security Scan
    if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5
    with:
      scan-args: |-
        -r
@@ -29,7 +29,7 @@ jobs:
  security-scan:
    name: Security Vulnerability Scan
    if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5
    with:
      scan-args: |-
        -r
@@ -13,11 +13,11 @@ permissions:
 jobs:
  generate-release-notes:
    runs-on: ubuntu-latest
-    if: github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'v')
+    if: github.repository == 'zhom/donutbrowser' && github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'v')

    steps:
      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          fetch-depth: 0

@@ -18,8 +18,9 @@ env:

 jobs:
  security-scan:
+    if: github.repository == 'zhom/donutbrowser'
    name: Security Vulnerability Scan
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5
    with:
      scan-args: |-
        -r
@@ -33,6 +34,7 @@ jobs:
      actions: read

  lint-js:
+    if: github.repository == 'zhom/donutbrowser'
    name: Lint JavaScript/TypeScript
    uses: ./.github/workflows/lint-js.yml
    secrets: inherit
@@ -40,6 +42,7 @@ jobs:
      contents: read

  lint-rust:
+    if: github.repository == 'zhom/donutbrowser'
    name: Lint Rust
    uses: ./.github/workflows/lint-rs.yml
    secrets: inherit
@@ -47,6 +50,7 @@ jobs:
      contents: read

  codeql:
+    if: github.repository == 'zhom/donutbrowser'
    name: CodeQL
    uses: ./.github/workflows/codeql.yml
    secrets: inherit
@@ -57,6 +61,7 @@ jobs:
      actions: read

  spellcheck:
+    if: github.repository == 'zhom/donutbrowser'
    name: Spell Check
    uses: ./.github/workflows/spellcheck.yml
    secrets: inherit
@@ -64,6 +69,7 @@ jobs:
      contents: read

  release:
+    if: github.repository == 'zhom/donutbrowser'
    needs: [security-scan, lint-js, lint-rust, codeql, spellcheck]
    permissions:
      contents: write
@@ -99,7 +105,7 @@ jobs:

    runs-on: ${{ matrix.platform }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 #v4.4.0
@@ -219,104 +225,389 @@ jobs:
          prerelease: false
          args: ${{ matrix.args }}

+      - name: Create portable Windows ZIP
+        if: matrix.platform == 'windows-latest'
+        shell: bash
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          PORTABLE_DIR="Donut-Portable"
+          mkdir -p "$PORTABLE_DIR"
+
+          # Copy main executable
+          cp "src-tauri/target/${{ matrix.target }}/release/Donut.exe" "$PORTABLE_DIR/"
+
+          # Copy sidecar binaries
+          cp "src-tauri/target/${{ matrix.target }}/release/donut-proxy.exe" "$PORTABLE_DIR/"
+          cp "src-tauri/target/${{ matrix.target }}/release/donut-daemon.exe" "$PORTABLE_DIR/"
+
+          # Copy WebView2Loader if present
+          if [ -f "src-tauri/target/${{ matrix.target }}/release/WebView2Loader.dll" ]; then
+            cp "src-tauri/target/${{ matrix.target }}/release/WebView2Loader.dll" "$PORTABLE_DIR/"
+          fi
+
+          # Create .portable marker
+          touch "$PORTABLE_DIR/.portable"
+
+          # Create ZIP
+          7z a "Donut_${VERSION}_x64-portable.zip" "$PORTABLE_DIR"
+
+      - name: Upload portable ZIP to release
+        if: matrix.platform == 'windows-latest'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          gh release upload "$TAG" "Donut_${VERSION}_x64-portable.zip" --clobber
+
      - name: Clean up Apple certificate
        if: matrix.platform == 'macos-latest' && always()
        run: |
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true
          rm -f $RUNNER_TEMP/build_certificate.p12 || true

-#      - name: Commit CHANGELOG.md
-#        uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 #v6.0.1
-#        with:
-#          branch: main
-#          commit_message: "docs: update CHANGELOG.md for ${{ github.ref_name }} [skip ci]"
-
-  publish-repos:
+  changelog:
+    if: github.repository == 'zhom/donutbrowser'
    needs: [release]
    runs-on: ubuntu-latest
    permissions:
-      contents: read
+      contents: write
+      pull-requests: write
    steps:
-      - name: Download Linux packages from release
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Generate changelog
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          PREV_TAG=$(git tag --sort=-version:refname \
+            | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
+            | grep -v "^${TAG}$" \
+            | head -n 1)
+
+          if [ -z "$PREV_TAG" ]; then
+            PREV_TAG=$(git rev-list --max-parents=0 HEAD)
+          fi
+
+          echo "Generating changelog: ${PREV_TAG}..${TAG}"
+
+          features=""
+          fixes=""
+          refactors=""
+          perf=""
+          docs=""
+          maintenance=""
+          other=""
+
+          strip_prefix() { echo "$1" | sed -E 's/^[a-z]+(\([^)]*\))?: //'; }
+
+          while IFS= read -r msg; do
+            [ -z "$msg" ] && continue
+            case "$msg" in
+              feat\(*\):*|feat:*)
+                features="${features}- $(strip_prefix "$msg")"$'\n' ;;
+              fix\(*\):*|fix:*)
+                fixes="${fixes}- $(strip_prefix "$msg")"$'\n' ;;
+              refactor\(*\):*|refactor:*)
+                refactors="${refactors}- $(strip_prefix "$msg")"$'\n' ;;
+              perf\(*\):*|perf:*)
+                perf="${perf}- $(strip_prefix "$msg")"$'\n' ;;
+              docs\(*\):*|docs:*)
+                docs="${docs}- $(strip_prefix "$msg")"$'\n' ;;
+              build*|ci*|chore*|test*)
+                maintenance="${maintenance}- ${msg}"$'\n' ;;
+              *)
+                other="${other}- ${msg}"$'\n' ;;
+            esac
+          done < <(git log --pretty=format:"%s" "${PREV_TAG}..${TAG}" --no-merges)
+
+          {
+            echo "## ${TAG} ($(date -u +%Y-%m-%d))"
+            echo ""
+            [ -n "$features" ]    && printf "### Features\n\n%s\n" "$features"
+            [ -n "$fixes" ]       && printf "### Bug Fixes\n\n%s\n" "$fixes"
+            [ -n "$refactors" ]   && printf "### Refactoring\n\n%s\n" "$refactors"
+            [ -n "$perf" ]        && printf "### Performance\n\n%s\n" "$perf"
+            [ -n "$docs" ]        && printf "### Documentation\n\n%s\n" "$docs"
+            [ -n "$maintenance" ] && printf "### Maintenance\n\n%s\n" "$maintenance"
+            [ -n "$other" ]       && printf "### Other\n\n%s\n" "$other"
+          } > /tmp/release-changelog.md
+
+          echo "Generated changelog:"
+          cat /tmp/release-changelog.md
+
+      - name: Update CHANGELOG.md
+        run: |
+          if [ -f CHANGELOG.md ]; then
+            # Insert new entry after the "# Changelog" header (first 2 lines)
+            {
+              head -n 2 CHANGELOG.md
+              echo ""
+              cat /tmp/release-changelog.md
+              tail -n +3 CHANGELOG.md
+            } > CHANGELOG.tmp
+            mv CHANGELOG.tmp CHANGELOG.md
+          else
+            {
+              echo "# Changelog"
+              echo ""
+              cat /tmp/release-changelog.md
+            } > CHANGELOG.md
+          fi
+
+      - name: Update README download links
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          BASE="https://github.com/zhom/donutbrowser/releases/download/${TAG}"
+
+          # Generate the new install section between markers
+          cat > /tmp/install-links.md << LINKS
+          ### macOS
+
+          | | Apple Silicon | Intel |
+          |---|---|---|
+          | **DMG** | [Download](${BASE}/Donut_${VERSION}_aarch64.dmg) | [Download](${BASE}/Donut_${VERSION}_x64.dmg) |
+
+          Or install via Homebrew:
+
+          \`\`\`bash
+          brew install --cask donut
+          \`\`\`
+
+          ### Windows
+
+          [Download Windows Installer (x64)](${BASE}/Donut_${VERSION}_x64-setup.exe) · [Portable (x64)](${BASE}/Donut_${VERSION}_x64-portable.zip)
+
+          ### Linux
+
+          | Format | x86_64 | ARM64 |
+          |---|---|---|
+          | **deb** | [Download](${BASE}/Donut_${VERSION}_amd64.deb) | [Download](${BASE}/Donut_${VERSION}_arm64.deb) |
+          | **rpm** | [Download](${BASE}/Donut-${VERSION}-1.x86_64.rpm) | [Download](${BASE}/Donut-${VERSION}-1.aarch64.rpm) |
+          | **AppImage** | [Download](${BASE}/Donut_${VERSION}_amd64.AppImage) | [Download](${BASE}/Donut_${VERSION}_aarch64.AppImage) |
+          LINKS
+
+          # Strip leading whitespace from heredoc
+          sed -i 's/^          //' /tmp/install-links.md
+
+          # Replace content between markers in README
+          sed -i '/<!-- install-links-start -->/,/<!-- install-links-end -->/{
+            /<!-- install-links-start -->/{
+              p
+              r /tmp/install-links.md
+            }
+            /<!-- install-links-end -->/!d
+          }' README.md
+
+      - name: Create release docs PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          BRANCH="docs/release-${VERSION}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH"
+          git add CHANGELOG.md README.md
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "docs: update CHANGELOG.md and README.md for ${TAG} [skip ci]"
+            git push origin "$BRANCH"
+            gh pr create \
+              --title "docs: release notes for ${TAG}" \
+              --body "Automated update of CHANGELOG.md and README.md download links for ${TAG}." \
+              --base main \
+              --head "$BRANCH"
+            gh pr merge "$BRANCH" --squash --admin
+          fi
+
+      - name: Update release notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          gh release edit "$TAG" --notes-file /tmp/release-changelog.md
+
+  notify-discord:
+    if: github.repository == 'zhom/donutbrowser'
+    needs: [release, changelog]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Generate changelog summary
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          PREV_TAG=$(git tag --sort=-version:refname \
+            | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
+            | grep -v "^${TAG}$" \
+            | head -n 1)
+          if [ -z "$PREV_TAG" ]; then
+            PREV_TAG=$(git rev-list --max-parents=0 HEAD)
+          fi
+
+          strip_prefix() { echo "$1" | sed -E 's/^[a-z]+(\([^)]*\))?: //'; }
+
+          CHANGES=""
+          while IFS= read -r msg; do
+            [ -z "$msg" ] && continue
+            case "$msg" in
+              feat\(*\):*|feat:*)   CHANGES="${CHANGES}• $(strip_prefix "$msg")\n" ;;
+              fix\(*\):*|fix:*)     CHANGES="${CHANGES}• $(strip_prefix "$msg")\n" ;;
+              refactor\(*\):*|refactor:*) CHANGES="${CHANGES}• $(strip_prefix "$msg")\n" ;;
+              perf\(*\):*|perf:*)   CHANGES="${CHANGES}• $(strip_prefix "$msg")\n" ;;
+            esac
+          done < <(git log --pretty=format:"%s" "${PREV_TAG}..${TAG}" --no-merges)
+
+          # Truncate to fit Discord embed (max 4096 chars)
+          if [ ${#CHANGES} -gt 3900 ]; then
+            CHANGES="${CHANGES:0:3900}\n..."
+          fi
+
+          if [ -z "$CHANGES" ]; then
+            CHANGES="See the full changelog on GitHub."
+          fi
+
+          printf '%s' "$CHANGES" > /tmp/discord-changes.txt
+
+      - name: Send Discord notification
+        env:
+          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_STABLE_WEBHOOK_URL }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          VERSION="${TAG}"
+          RELEASE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/tag/${VERSION}"
+          CHANGES=$(cat /tmp/discord-changes.txt)
+
+          # Build JSON with jq to handle escaping
+          PAYLOAD=$(jq -n \
+            --arg title "Donut Browser ${VERSION} Released" \
+            --arg url "$RELEASE_URL" \
+            --arg changes "$CHANGES" \
+            --arg dl_mac_arm "https://github.com/'"${GITHUB_REPOSITORY}"'/releases/download/'"${VERSION}"'/Donut_'"${VERSION#v}"'_aarch64.dmg" \
+            --arg dl_mac_intel "https://github.com/'"${GITHUB_REPOSITORY}"'/releases/download/'"${VERSION}"'/Donut_'"${VERSION#v}"'_x64.dmg" \
+            --arg dl_win "https://github.com/'"${GITHUB_REPOSITORY}"'/releases/download/'"${VERSION}"'/Donut_'"${VERSION#v}"'_x64-setup.exe" \
+            --arg dl_linux "https://github.com/'"${GITHUB_REPOSITORY}"'/releases/download/'"${VERSION}"'/Donut_'"${VERSION#v}"'_amd64.AppImage" \
+            '{
+              embeds: [{
+                title: $title,
+                url: $url,
+                description: $changes,
+                color: 5814783,
+                fields: [
+                  { name: "Download", value: ("[macOS (Apple Silicon)](" + $dl_mac_arm + ") · [macOS (Intel)](" + $dl_mac_intel + ")\n[Windows x64](" + $dl_win + ") · [Linux x64](" + $dl_linux + ")"), inline: false }
+                ],
+                footer: { text: "donutbrowser.com" }
+              }]
+            }')
+
+          curl -fsSL -H "Content-Type: application/json" -d "$PAYLOAD" "$DISCORD_WEBHOOK_URL"
+
+  deploy-website:
+    if: github.repository == 'zhom/donutbrowser'
+    needs: [release]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Cloudflare Pages deployment
+        run: curl -fsSL -X POST "${{ secrets.CLOUDFLARE_WEB_DEPLOYMENT_HOOK }}"
+
+  docker:
+    if: github.repository == 'zhom/donutbrowser'
+    needs: [release]
+    uses: ./.github/workflows/docker-sync.yml
+    with:
+      tag: ${{ github.ref_name }}
+    secrets: inherit
+
+  update-flake:
+    if: github.repository == 'zhom/donutbrowser'
+    needs: [release]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+        with:
+          ref: main
+
+      - name: Compute AppImage hashes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
+
+          AMD64_URL="https://github.com/zhom/donutbrowser/releases/download/${TAG}/Donut_${VERSION}_amd64.AppImage"
+          AARCH64_URL="https://github.com/zhom/donutbrowser/releases/download/${TAG}/Donut_${VERSION}_aarch64.AppImage"
+
+          echo "Downloading x86_64 AppImage..."
+          curl -fsSL -o /tmp/amd64.AppImage "$AMD64_URL" || { echo "x86_64 AppImage not found"; exit 1; }
+
+          echo "Downloading aarch64 AppImage..."
+          curl -fsSL -o /tmp/aarch64.AppImage "$AARCH64_URL" || { echo "aarch64 AppImage not found"; exit 1; }
+
+          # Compute SRI hashes (sha256-<base64>)
+          AMD64_HASH="sha256-$(sha256sum /tmp/amd64.AppImage | awk '{print $1}' | xxd -r -p | base64 | tr -d '\n')"
+          AARCH64_HASH="sha256-$(sha256sum /tmp/aarch64.AppImage | awk '{print $1}' | xxd -r -p | base64 | tr -d '\n')"
+
+          echo "AMD64_HASH=${AMD64_HASH}" >> "$GITHUB_ENV"
+          echo "AARCH64_HASH=${AARCH64_HASH}" >> "$GITHUB_ENV"
+          echo "AMD64_URL=${AMD64_URL}" >> "$GITHUB_ENV"
+          echo "AARCH64_URL=${AARCH64_URL}" >> "$GITHUB_ENV"
+
+          echo "x86_64 hash: ${AMD64_HASH}"
+          echo "aarch64 hash: ${AARCH64_HASH}"
+
+      - name: Update flake.nix
+        run: |
+          # Update releaseVersion
+          sed -i "s/releaseVersion = \"[^\"]*\"/releaseVersion = \"${VERSION}\"/" flake.nix
+
+          # Update x86_64 URL and hash
+          sed -i "s|url = \"https://github.com/zhom/donutbrowser/releases/download/v[^\"]*_amd64.AppImage\"|url = \"${AMD64_URL}\"|" flake.nix
+          sed -i "/amd64.AppImage/{ n; s|hash = \"[^\"]*\"|hash = \"${AMD64_HASH}\"|; }" flake.nix
+
+          # Update aarch64 URL and hash
+          sed -i "s|url = \"https://github.com/zhom/donutbrowser/releases/download/v[^\"]*_aarch64.AppImage\"|url = \"${AARCH64_URL}\"|" flake.nix
+          sed -i "/aarch64.AppImage/{ n; s|hash = \"[^\"]*\"|hash = \"${AARCH64_HASH}\"|; }" flake.nix
+
+          echo "Updated flake.nix:"
+          grep -n "releaseVersion\|AppImage\|hash = " flake.nix
+
+      - name: Create pull request
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
-          mkdir -p /tmp/packages
-          gh release download "$GITHUB_REF_NAME" \
-            --repo "$GITHUB_REPOSITORY" \
-            --pattern "*.deb" \
-            --dir /tmp/packages
-          gh release download "$GITHUB_REF_NAME" \
-            --repo "$GITHUB_REPOSITORY" \
-            --pattern "*.rpm" \
-            --dir /tmp/packages
-          echo "Downloaded packages:"
-          ls -la /tmp/packages/
-
-      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0
-        with:
-          go-version: "1.23"
-          cache: false
-
-      - name: Install repogen
-        run: |
-          go install github.com/ralt/repogen/cmd/repogen@latest
-          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
-
-      - name: Sync existing repo metadata from R2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          R2_ENDPOINT: "https://${{ secrets.R2_ENDPOINT_URL }}"
-          R2_BUCKET: ${{ secrets.R2_BUCKET_NAME }}
-        run: |
-          mkdir -p /tmp/repo
-          aws s3 cp "s3://${R2_BUCKET}/dists" /tmp/repo/dists \
-            --endpoint-url "${R2_ENDPOINT}" --recursive 2>/dev/null || true
-          aws s3 cp "s3://${R2_BUCKET}/repodata" /tmp/repo/repodata \
-            --endpoint-url "${R2_ENDPOINT}" --recursive 2>/dev/null || true
-
-      - name: Generate repository with repogen
-        run: |
-          repogen generate \
-            --input-dir /tmp/packages \
-            --output-dir /tmp/repo \
-            --incremental \
-            --arch amd64,arm64 \
-            --origin "Donut Browser" \
-            --label "Donut Browser" \
-            --codename stable \
-            --components main \
-            --verbose
-
-      - name: Upload repository to R2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          R2_ENDPOINT: "https://${{ secrets.R2_ENDPOINT_URL }}"
-          R2_BUCKET: ${{ secrets.R2_BUCKET_NAME }}
-        run: |
-          aws s3 cp /tmp/repo/dists "s3://${R2_BUCKET}/dists" \
-            --endpoint-url "${R2_ENDPOINT}" --recursive
-          aws s3 cp /tmp/repo/pool "s3://${R2_BUCKET}/pool" \
-            --endpoint-url "${R2_ENDPOINT}" --recursive
-          aws s3 cp /tmp/repo/repodata "s3://${R2_BUCKET}/repodata" \
-            --endpoint-url "${R2_ENDPOINT}" --recursive
-          aws s3 cp /tmp/repo/Packages "s3://${R2_BUCKET}/Packages" \
-            --endpoint-url "${R2_ENDPOINT}" --recursive
-
-      - name: Verify upload
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          R2_ENDPOINT: "https://${{ secrets.R2_ENDPOINT_URL }}"
-          R2_BUCKET: ${{ secrets.R2_BUCKET_NAME }}
-        run: |
-          echo "DEB repo:"
-          aws s3 ls "s3://${R2_BUCKET}/dists/stable/" --endpoint-url "${R2_ENDPOINT}" || echo "  (listing not available)"
-          echo "RPM repo:"
-          aws s3 ls "s3://${R2_BUCKET}/repodata/" --endpoint-url "${R2_ENDPOINT}" || echo "  (listing not available)"
+          BRANCH="chore/update-flake-${VERSION}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH"
+          git add flake.nix
+          if git diff --cached --quiet; then
+            echo "No flake changes needed"
+            exit 0
+          fi
+          git commit -m "chore: update flake.nix for v${VERSION} [skip ci]"
+          git push origin "$BRANCH"
+          gh pr create \
+            --title "chore: update flake.nix for v${VERSION}" \
+            --body "Automated update of flake.nix with new AppImage hashes for v${VERSION}." \
+            --base main \
+            --head "$BRANCH"
+          gh pr merge "$BRANCH" --squash --admin
@@ -17,8 +17,9 @@ env:

 jobs:
  security-scan:
+    if: github.repository == 'zhom/donutbrowser'
    name: Security Vulnerability Scan
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730" # v2.3.3
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c51854704019a247608d928f370c98740469d4b5" # v2.3.5
    with:
      scan-args: |-
        -r
@@ -32,6 +33,7 @@ jobs:
      actions: read

  lint-js:
+    if: github.repository == 'zhom/donutbrowser'
    name: Lint JavaScript/TypeScript
    uses: ./.github/workflows/lint-js.yml
    secrets: inherit
@@ -39,6 +41,7 @@ jobs:
      contents: read

  lint-rust:
+    if: github.repository == 'zhom/donutbrowser'
    name: Lint Rust
    uses: ./.github/workflows/lint-rs.yml
    secrets: inherit
@@ -46,6 +49,7 @@ jobs:
      contents: read

  codeql:
+    if: github.repository == 'zhom/donutbrowser'
    name: CodeQL
    uses: ./.github/workflows/codeql.yml
    secrets: inherit
@@ -56,6 +60,7 @@ jobs:
      actions: read

  spellcheck:
+    if: github.repository == 'zhom/donutbrowser'
    name: Spell Check
    uses: ./.github/workflows/spellcheck.yml
    secrets: inherit
@@ -63,6 +68,7 @@ jobs:
      contents: read

  rolling-release:
+    if: github.repository == 'zhom/donutbrowser'
    needs: [security-scan, lint-js, lint-rust, codeql, spellcheck]
    permissions:
      contents: write
@@ -98,7 +104,7 @@ jobs:

    runs-on: ${{ matrix.platform }}
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 #v4.4.0
@@ -229,6 +235,34 @@ jobs:
          prerelease: true
          args: ${{ matrix.args }}

+      - name: Create portable Windows ZIP
+        if: matrix.platform == 'windows-latest'
+        shell: bash
+        run: |
+          PORTABLE_DIR="Donut-Portable"
+          mkdir -p "$PORTABLE_DIR"
+
+          cp "src-tauri/target/${{ matrix.target }}/release/Donut.exe" "$PORTABLE_DIR/"
+          cp "src-tauri/target/${{ matrix.target }}/release/donut-proxy.exe" "$PORTABLE_DIR/"
+          cp "src-tauri/target/${{ matrix.target }}/release/donut-daemon.exe" "$PORTABLE_DIR/"
+
+          if [ -f "src-tauri/target/${{ matrix.target }}/release/WebView2Loader.dll" ]; then
+            cp "src-tauri/target/${{ matrix.target }}/release/WebView2Loader.dll" "$PORTABLE_DIR/"
+          fi
+
+          touch "$PORTABLE_DIR/.portable"
+
+          7z a "Donut_x64-portable.zip" "$PORTABLE_DIR"
+
+      - name: Upload portable ZIP to release
+        if: matrix.platform == 'windows-latest'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NIGHTLY_TAG: "nightly-${{ steps.timestamp.outputs.timestamp }}"
+        run: |
+          gh release upload "$NIGHTLY_TAG" "Donut_x64-portable.zip" --clobber
+
      - name: Clean up Apple certificate
        if: matrix.platform == 'macos-latest' && always()
        run: |
@@ -236,12 +270,13 @@ jobs:
          rm -f $RUNNER_TEMP/build_certificate.p12 || true

  update-nightly-release:
+    if: github.repository == 'zhom/donutbrowser'
    needs: [rolling-release]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Generate nightly tag
        id: tag
@@ -250,6 +285,57 @@ jobs:
          COMMIT_HASH=$(echo "${GITHUB_SHA}" | cut -c1-7)
          echo "nightly_tag=nightly-${TIMESTAMP}-${COMMIT_HASH}" >> $GITHUB_OUTPUT

+      - name: Generate nightly changelog
+        id: nightly-changelog
+        run: |
+          LAST_STABLE=$(git tag --sort=-version:refname \
+            | grep -E "^v[0-9]+\.[0-9]+\.[0-9]+\$" \
+            | head -n 1)
+
+          if [ -z "$LAST_STABLE" ]; then
+            LAST_STABLE=$(git rev-list --max-parents=0 HEAD)
+          fi
+
+          COMMIT_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
+          {
+            echo "**Nightly build from main branch**"
+            echo ""
+            echo "Commit: ${GITHUB_SHA}"
+            echo "Changes since ${LAST_STABLE}:"
+            echo ""
+          } > /tmp/nightly-notes.md
+
+          strip_prefix() { echo "$1" | sed -E 's/^[a-z]+(\([^)]*\))?: //'; }
+
+          features=""
+          fixes=""
+          refactors=""
+          other=""
+
+          while IFS= read -r msg; do
+            [ -z "$msg" ] && continue
+            case "$msg" in
+              feat\(*\):*|feat:*)
+                features="${features}- $(strip_prefix "$msg")"$'\n' ;;
+              fix\(*\):*|fix:*)
+                fixes="${fixes}- $(strip_prefix "$msg")"$'\n' ;;
+              refactor\(*\):*|refactor:*)
+                refactors="${refactors}- $(strip_prefix "$msg")"$'\n' ;;
+              build*|ci*|chore*|test*|docs*|perf*)
+                ;; # skip maintenance commits from nightly notes
+              *)
+                other="${other}- ${msg}"$'\n' ;;
+            esac
+          done < <(git log --pretty=format:"%s" "${LAST_STABLE}..HEAD" --no-merges)
+
+          {
+            [ -n "$features" ]  && printf "### Features\n\n%s\n" "$features"
+            [ -n "$fixes" ]     && printf "### Bug Fixes\n\n%s\n" "$fixes"
+            [ -n "$refactors" ] && printf "### Refactoring\n\n%s\n" "$refactors"
+            [ -n "$other" ]     && printf "### Other\n\n%s\n" "$other"
+            true
+          } >> /tmp/nightly-notes.md
+
      - name: Update rolling nightly release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -284,5 +370,46 @@ jobs:
            "$ASSETS_DIR"/Donut_aarch64.app.tar.gz \
            "$ASSETS_DIR"/Donut_x64.app.tar.gz \
            --title "Donut Browser Nightly" \
-            --notes "Automatically updated nightly build from the latest main branch.\n\nCommit: ${GITHUB_SHA}" \
+            --notes-file /tmp/nightly-notes.md \
            --prerelease
+
+  deploy-website:
+    if: github.repository == 'zhom/donutbrowser'
+    needs: [update-nightly-release]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Cloudflare Pages deployment
+        run: curl -fsSL -X POST "${{ secrets.CLOUDFLARE_WEB_DEPLOYMENT_HOOK }}"
+
+  notify-discord:
+    if: github.repository == 'zhom/donutbrowser'
+    needs: [update-nightly-release]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Discord notification
+        env:
+          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_NIGHTLY_WEBHOOK_URL }}
+        run: |
+          COMMIT_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
+          RELEASE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/tag/nightly"
+          COMMIT_URL="https://github.com/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}"
+
+          PAYLOAD=$(jq -n \
+            --arg title "Donut Browser Nightly (${COMMIT_SHORT})" \
+            --arg url "$RELEASE_URL" \
+            --arg commit_url "$COMMIT_URL" \
+            --arg commit_short "$COMMIT_SHORT" \
+            '{
+              embeds: [{
+                title: $title,
+                url: $url,
+                color: 16752128,
+                fields: [
+                  { name: "Commit", value: ("[" + $commit_short + "](" + $commit_url + ")"), inline: true },
+                  { name: "Download", value: ("[Nightly Release](" + $url + ")"), inline: true }
+                ],
+                footer: { text: "donutbrowser.com" }
+              }]
+            }')
+
+          curl -fsSL -H "Content-Type: application/json" -d "$PAYLOAD" "$DISCORD_WEBHOOK_URL"
@@ -21,6 +21,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Actions Repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
      - name: Spell Check Repo
        uses: crate-ci/typos@631208b7aac2daa8b707f55e7331f9112b0e062d #v1.44.0
@@ -6,6 +6,7 @@ on:

 jobs:
  stale:
+    if: github.repository == 'zhom/donutbrowser'
    runs-on: ubuntu-latest
    permissions:
      issues: write
@@ -15,7 +16,9 @@ jobs:
      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          stale-issue-message: "This issue has been inactive for 60 days. Please respond to keep it open."
-          stale-pr-message: "This pull request has been inactive for 60 days. Please respond to keep it open."
+          stale-issue-message: "This issue has been inactive for 30 days. Please respond to keep it open."
+          stale-pr-message: "This pull request has been inactive for 30 days. Please respond to keep it open."
          stale-issue-label: "stale"
          stale-pr-label: "stale"
+          days-before-stale: 30
+          days-before-close: 7
@@ -32,7 +32,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2

      - name: Install pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 #v4.4.0
@@ -73,7 +73,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2

      - name: Start MinIO
        run: |
@@ -10,12 +10,15 @@
    "appindicator",
    "applescript",
    "asyncio",
+    "autocheckpoint",
    "autoconfig",
    "autologin",
+    "bintools",
    "biomejs",
    "boringtun",
    "breezedark",
    "browserforge",
+    "Buildx",
    "busctl",
    "CAMOU",
    "camoufox",
@@ -34,6 +37,7 @@
    "codesign",
    "codesigning",
    "commitish",
+    "coreutils",
    "Crashpad",
    "CTYPE",
    "daijro",
@@ -41,47 +45,64 @@
    "datareporting",
    "datas",
    "DBAPI",
+    "dbus",
    "dconf",
    "debuginfo",
    "desynced",
    "devedition",
    "direnv",
+    "diskutil",
    "distro",
    "dists",
    "DMABUF",
+    "DOCKERHUB",
    "doctest",
    "doesn",
    "domcontentloaded",
+    "dont",
    "donutbrowser",
    "doorhanger",
    "dpkg",
    "dtolnay",
    "dyld",
    "elif",
+    "erasevolume",
    "errorlevel",
    "esac",
    "esbuild",
    "etree",
+    "fetchurl",
+    "findutils",
    "firstrun",
    "flate",
+    "fontconfig",
+    "freetype",
+    "fribidi",
    "frontmost",
+    "fsprogs",
    "geoip",
    "getcwd",
    "gettimezone",
    "gifs",
    "globset",
+    "gnugrep",
+    "gnumake",
+    "gnused",
    "GOPATH",
    "gsettings",
+    "harfbuzz",
    "healthreport",
    "hiddenimports",
    "hkcu",
    "hooksconfig",
    "hookspath",
+    "hostable",
    "Hoverable",
    "icns",
    "idlelib",
    "idletime",
    "idna",
+    "imdisk",
    "infobars",
    "inkey",
    "Inno",
@@ -95,18 +116,39 @@
    "langpack",
    "launchservices",
    "letterboxing",
+    "leveldb",
    "libappindicator",
    "libatk",
    "libayatana",
    "libc",
    "libcairo",
+    "libdrm",
    "libfuse",
+    "libgbm",
    "libgdk",
    "libglib",
+    "libglvnd",
+    "libgpg",
    "libpango",
    "librsvg",
+    "libsoup",
    "libwebkit",
+    "libx",
+    "libxcb",
+    "libxcomposite",
+    "libxcursor",
+    "libxdamage",
    "libxdo",
+    "libxext",
+    "libxfixes",
+    "libxi",
+    "libxinerama",
+    "libxkbcommon",
+    "libxrandr",
+    "libxrender",
+    "libxscrnsaver",
+    "libxshmfence",
+    "libxtst",
    "localtime",
    "lpdw",
    "lxml",
@@ -114,6 +156,7 @@
    "macchiato",
    "Matchalk",
    "maxminddb",
+    "minidumps",
    "minioadmin",
    "mmdb",
    "mountpoint",
@@ -123,25 +166,33 @@
    "msys",
    "muda",
    "mypy",
+    "nixos",
+    "nixpkgs",
    "noarchive",
    "nobrowse",
    "noconfirm",
    "nodecar",
    "NODELAY",
    "nodemon",
+    "nomount",
    "norestart",
    "NSIS",
+    "nspr",
+    "ntfs",
    "ntlm",
    "numpy",
+    "numtide",
    "objc",
    "oneshot",
    "opencode",
+    "OPENROUTER",
    "orhun",
    "orjson",
    "osascript",
    "oscpu",
    "outpath",
    "OVPN",
+    "pango",
    "passout",
    "patchelf",
    "pathex",
@@ -149,12 +200,16 @@
    "peerconnection",
    "PHANDLER",
    "pids",
+    "pipefail",
    "pixbuf",
    "pkexec",
+    "pkgs",
    "pkill",
    "plasmohq",
    "platformdirs",
+    "pname",
    "prefs",
+    "presign",
    "PRIO",
    "propertylist",
    "psutil",
@@ -168,6 +223,7 @@
    "quic",
    "ralt",
    "ramdisk",
+    "rawfile",
    "repodata",
    "repogen",
    "reportingpolicy",
@@ -179,7 +235,9 @@
    "rusqlite",
    "rustc",
    "rwxr",
+    "safebrowsing",
    "SARIF",
+    "sarifv",
    "scipy",
    "screeninfo",
    "selectables",
@@ -202,6 +260,7 @@
    "splitn",
    "sspi",
    "staticlib",
+    "stdenv",
    "stefanzweifel",
    "subdirs",
    "subkey",
@@ -222,6 +281,7 @@
    "titlebar",
    "tkinter",
    "tmpfs",
+    "tombstoned",
    "tqdm",
    "trackingprotection",
    "trailhead",
@@ -1,5 +1,53 @@
 # Project Guidelines

+> **NOTE**: CLAUDE.md is a symlink to AGENTS.md — editing either file updates both.
+> After significant changes (new modules, renamed files, new directories), re-evaluate the Repository Structure below and update it if needed.
+
+## Repository Structure
+
+```
+donutbrowser/
+├── src/                              # Next.js frontend
+│   ├── app/                          # App router (page.tsx, layout.tsx)
+│   ├── components/                   # 50+ React components (dialogs, tables, UI)
+│   ├── hooks/                        # Event-driven React hooks
+│   ├── i18n/locales/                 # Translations (en, es, fr, ja, pt, ru, zh)
+│   ├── lib/                          # Utilities (themes, toast, browser-utils)
+│   └── types.ts                      # Shared TypeScript interfaces
+├── src-tauri/                        # Rust backend (Tauri)
+│   ├── src/
+│   │   ├── lib.rs                    # Tauri command registration (100+ commands)
+│   │   ├── browser_runner.rs         # Profile launch/kill orchestration
+│   │   ├── browser.rs               # Browser trait & launch logic
+│   │   ├── profile/                  # Profile CRUD (manager.rs, types.rs)
+│   │   ├── proxy_manager.rs         # Proxy lifecycle & connection testing
+│   │   ├── proxy_server.rs          # Local proxy binary (donut-proxy)
+│   │   ├── proxy_storage.rs         # Proxy config persistence (JSON files)
+│   │   ├── api_server.rs            # REST API (utoipa + axum)
+│   │   ├── mcp_server.rs            # MCP protocol server
+│   │   ├── sync/                    # Cloud sync (engine, encryption, manifest, scheduler)
+│   │   ├── vpn/                     # WireGuard & OpenVPN tunnels
+│   │   ├── camoufox/                # Camoufox fingerprint engine (Bayesian network)
+│   │   ├── wayfern_manager.rs       # Wayfern (Chromium) browser management
+│   │   ├── camoufox_manager.rs      # Camoufox (Firefox) browser management
+│   │   ├── downloader.rs           # Browser binary downloader
+│   │   ├── extraction.rs           # Archive extraction (zip, tar, dmg, msi)
+│   │   ├── settings_manager.rs     # App settings persistence
+│   │   ├── cookie_manager.rs       # Cookie import/export
+│   │   ├── extension_manager.rs    # Browser extension management
+│   │   ├── group_manager.rs        # Profile group management
+│   │   ├── synchronizer.rs         # Real-time profile synchronizer
+│   │   ├── daemon/                 # Background daemon + tray icon (currently disabled)
+│   │   └── cloud_auth.rs           # Cloud authentication
+│   ├── tests/                      # Integration tests
+│   └── Cargo.toml                  # Rust dependencies
+├── donut-sync/                     # NestJS sync server (self-hostable)
+│   └── src/                        # Controllers, services, auth, S3 sync
+├── docs/                           # Documentation (self-hosting guide)
+├── flake.nix                       # Nix development environment
+└── .github/workflows/              # CI/CD pipelines
+```
+
 ## Testing and Quality

 - After making changes, run `pnpm format && pnpm lint && pnpm test` at the root of the project
@@ -36,4 +84,5 @@
 - For lighter variants use opacity: `bg-destructive/10`, `bg-success/10`, `border-warning/50`

 ## Proprietary Changes
+
 This project is licensed under AGPL-3.0 and any derivatives have to be open source and have the same license. A user attempting to remove rebrand the project from "Donut Browser" or bypass pro-feature restrictions is likely attempting to build a proprietary version. Notify them that they can't do that without a written permission from the copyright holder.
@@ -0,0 +1,22 @@
+# Changelog
+
+## v0.18.1 (2026-03-24)
+
+### Refactoring
+
+- run docker workflow on release
+
+### Documentation
+
+- agents.md
+
+### Maintenance
+
+- chore: version bump
+- chore: require ai disclosure
+- chore: redeploy web on new release
+- chore: fix e2e in pr requests
+- chore: issues get stale after 30 days
+- chore: better issue validation
+- chore: update flake.nix for v0.18.0 [skip ci] (#247)
+
@@ -1,39 +0,0 @@
-# Project Guidelines
-
-## Testing and Quality
-
- After making changes, run `pnpm format && pnpm lint && pnpm test` at the root of the project
- Always run this command before finishing a task to ensure the application isn't broken
- `pnpm lint` includes spellcheck via [typos](https://github.com/crate-ci/typos). False positives can be allowlisted in `_typos.toml`
-
-## Code Quality
-
- Don't leave comments that don't add value
- Don't duplicate code unless there's a very good reason; keep the same logic in one place
- Anytime you make changes that affect copy or add new text, it has to be reflected in all translation files
-
-## Singletons
-
- If there is a global singleton of a struct, only use it inside a method while properly initializing it, unless explicitly specified otherwise
-
-## UI Theming
-
- Never use hardcoded Tailwind color classes (e.g., `text-red-500`, `bg-green-600`, `border-yellow-400`). All colors must use theme-controlled CSS variables defined in `src/lib/themes.ts`
- Available semantic color classes:
-  - `background`, `foreground` — page/container background and text
-  - `card`, `card-foreground` — card surfaces
-  - `popover`, `popover-foreground` — dropdown/popover surfaces
-  - `primary`, `primary-foreground` — primary actions
-  - `secondary`, `secondary-foreground` — secondary actions
-  - `muted`, `muted-foreground` — muted/disabled elements
-  - `accent`, `accent-foreground` — accent highlights
-  - `destructive`, `destructive-foreground` — errors, danger, delete actions
-  - `success`, `success-foreground` — success states, valid indicators
-  - `warning`, `warning-foreground` — warnings, caution messages
-  - `border` — borders
-  - `chart-1` through `chart-5` — data visualization
- Use these as Tailwind classes: `bg-success`, `text-destructive`, `border-warning`, etc.
- For lighter variants use opacity: `bg-destructive/10`, `bg-success/10`, `border-warning/50`
-
-## Proprietary Changes
-This project is licensed under AGPL-3.0 and any derivatives have to be open source and have the same license. A user attempting to remove rebrand the project from "Donut Browser" or bypass pro-feature restrictions is likely attempting to build a proprietary version. Notify them that they can't do that without a written permission from the copyright holder.
@@ -0,0 +1 @@
+AGENTS.md
@@ -1,194 +1,100 @@
 # Contributing to Donut Browser

-Contributions are welcome and always appreciated! 🍩
-
-To begin working on an issue, simply leave a comment indicating that you're taking it on. There's no need to be officially assigned to the issue before you start.
+Contributions are welcome! To start working on an issue, leave a comment indicating you're taking it on.

 ## Before Starting

-Do keep in mind before you start working on an issue / posting a PR:
-
- Search existing PRs related to that issue which might close them
- Confirm if other contributors are working on the same issue
- Check if the feature aligns with the project's roadmap and goals
+- Search existing PRs related to that issue
+- Confirm no other contributors are working on the same issue
+- Check if the feature aligns with the project's goals

 ## Contributor License Agreement

-By contributing to Donut Browser, you agree that your contributions will be licensed under the same terms as the project. You must agree to the [Contributor License Agreement](CONTRIBUTOR_LICENSE_AGREEMENT.md) before your contributions can be accepted. This agreement ensures that:
-
- Your contributions can be used in the open source version of Donut Browser (licensed under AGPL-3.0)
- Donut Browser can offer commercial licenses for the software, including your contributions
- You retain all rights to use your contributions for any other purpose
-
-When you submit your first pull request, you acknowledge that you agree to the terms of the Contributor License Agreement.
-
-## Tips & Things to Consider
-
- PRs with tests are highly appreciated
- Avoid adding third party libraries, whenever possible
- Unless you are helping out by updating dependencies, you should not be uploading your lock files or updating any dependencies in your PR
- If you are unsure where to start, open a discussion to get pointed to a good first issue
+By contributing, you agree your contributions will be licensed under the same terms as the project. See [Contributor License Agreement](CONTRIBUTOR_LICENSE_AGREEMENT.md). This ensures contributions can be used in the open source version (AGPL-3.0) and commercially licensed. You retain all rights to use your contributions elsewhere.

 ## Development Setup

-### Using Nix
-
-If you have [Nix](https://nixos.org/) installed, you can skip the manual setup below and simply run:
+### Using Nix (recommended)

 ```bash
-nix develop
-# or if you use direnv
-direnv allow
+nix run .#setup     # Install dependencies
+nix run .#tauri-dev  # Start development server
+nix run .#test       # Run all checks
 ```

-This will provide Node.js, Rust, and all necessary system libraries.
+Or enter the dev shell: `nix develop`

 ### Manual Setup

-Ensure you have the following dependencies installed:
+Requirements:

- Node.js (see `.node-version` for exact version)
- pnpm package manager
- Latest Rust and Cargo toolchain
- [Tauri prerequisites guide](https://v2.tauri.app/start/prerequisites/).
-
-## Run Locally
-
-After having the above dependencies installed, proceed through the following steps to setup the codebase locally:
-
-1. **Fork the project** & [clone](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository) it locally.
-
-2. **Create a new separate branch.**
-
-   ```bash
-   git checkout -b feature/my-feature-name
-   ```
-
-3. **Install frontend dependencies**
-
-   ```bash
-   pnpm install
-   ```
-
-4. **Start the development server**
-
-   ```bash
-   pnpm tauri dev
-   ```
-
-This will start the app for local development with live reloading.
-
-## Code Style & Quality
-
-The project uses several tools to maintain code quality:
-
- **Biome** for JavaScript/TypeScript linting and formatting
- **Clippy** for Rust linting
- **rustfmt** for Rust formatting
-
-### Before Committing
-
-Run these commands to ensure your code meets the project's standards:
+- Node.js (see `.node-version`)
+- pnpm
+- Rust + Cargo (latest stable)
+- [Tauri v2 prerequisites](https://v2.tauri.app/start/prerequisites/)

 ```bash
-# Format and lint frontend code
-pnpm format:js
-
-# Format and lint Rust code
-pnpm format:rust
-
-# Run all linting
-pnpm lint
+git checkout -b feature/my-feature-name
+pnpm install
+pnpm tauri dev
 ```

-## Building
+## Quality Checks

-It is crucial to test your code before submitting a pull request. Please ensure that you can make a complete production build before you submit your code for merging.
+Run before every commit:

 ```bash
-# Build the frontend
-pnpm build
-
-# Build the backend
-cd src-tauri && cargo build
-
-# Build the Tauri application
-pnpm tauri build
+pnpm format && pnpm lint && pnpm test
 ```

-Make sure the build completes successfully without errors.
+This runs:

-## Testing
+- **Biome** — JS/TS linting and formatting
+- **Clippy + rustfmt** — Rust linting and formatting
+- **typos** — Spellcheck (allowlist in `_typos.toml`)
+- **CodeQL** — Security analysis (JS, Actions, Rust) — runs in CI
+- **Unit tests** — 330+ Rust tests
+- **Integration tests** — proxy, sync e2e

- Always test your changes on the target platform
- Verify that existing functionality still works
- Add tests for new features when possible
+### Running CodeQL locally
+
+```bash
+# Install: brew install codeql
+codeql pack download codeql/javascript-queries codeql/rust-queries
+
+# JavaScript
+codeql database create /tmp/codeql-js --language=javascript --source-root=.
+codeql database analyze /tmp/codeql-js --format=sarifv2.1.0 --output=/tmp/js.sarif codeql/javascript-queries
+
+# Rust
+codeql database create /tmp/codeql-rust --language=rust --source-root=.
+codeql database analyze /tmp/codeql-rust --format=sarifv2.1.0 --output=/tmp/rust.sarif codeql/rust-queries
+```
+
+## Key Rules
+
+- **Translations**: Any UI text changes must be reflected in all 7 locale files (`src/i18n/locales/`)
+- **Tauri commands**: If you modify Tauri commands, the `test_no_unused_tauri_commands` test will catch unused ones
+- **No hardcoded colors**: Use theme CSS variables (see `src/lib/themes.ts`), never Tailwind color classes like `text-red-500`
+- **No lock file changes**: Don't update `pnpm-lock.yaml` or `Cargo.lock` unless updating dependencies is the purpose of the PR
+- **AGPL-3.0**: This project is AGPL-licensed. Derivatives must be open source with the same license

 ## Pull Request Guidelines

-🎉 Now that you're ready to submit your code for merging, there are some points to keep in mind:
+- Fill the PR description template
+- Reference related issues (`Fixes #123` or `Refs #123`)
+- Include screenshots/videos for UI changes
+- Ensure "Allow edits from maintainers" is checked

-### PR Description
+## Architecture

- Fill your PR description template accordingly
- Have an appropriate title and description
- Include relevant screenshots for UI changes. If you can include video/gifs, it is even better.
- Reference related issues
-
-### Linking Issues
-
-If your PR fixes an issue, add this line **in the body** of the Pull Request description:
-
-```text
-Fixes #00000
-```
-
-If your PR is referencing an issue:
-
-```text
-Refs #00000
-```
-
-### PR Checklist
-
- [ ] Code follows the project's style guidelines
- [ ] I have performed a self-review of my code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published
-
-### Options
-
- Ensure that "Allow edits from maintainers" option is checked
-
-## Architecture Overview
-
-Donut Browser is built with:
-
- **Frontend**: Next.js React application
- **Backend**: Tauri (Rust) for native functionality
- **Node.js Sidecar**: `nodecar` binary for access to JavaScript ecosystem
- **Build System**: GitHub Actions for CI/CD
-
-Understanding this architecture will help you contribute more effectively.
+- **Frontend**: Next.js (React) — `src/`
+- **Backend**: Tauri (Rust) — `src-tauri/src/`
+- **Proxy Worker**: Detached process for proxy tunneling — `src-tauri/src/bin/proxy_server.rs`
+- **Sync**: Cloud sync via S3-compatible storage — `src-tauri/src/sync/`, `donut-sync/`
+- **Browsers**: Camoufox (Firefox-based) and Wayfern (Chromium-based)

 ## Getting Help

- **Issues**: Use for bug reports and feature requests
- **Discussions**: Use for questions and general discussion
- **Pull Requests**: Use for code contributions
-
-## Code of Conduct
-
-Please note that this project is released with a [Contributor Code of Conduct](CODE_OF_CONDUCT.md). By participating in this project you agree to abide by its terms.
-
-## Recognition
-
-All contributors will be recognized! The project uses the all-contributors specification to acknowledge everyone who contributes.
-
---
-
-Thank you for contributing to Donut Browser! 🍩✨
+- **Issues**: Bug reports and feature requests
+- **Discussions**: Questions and general discussion
@@ -1,7 +1,9 @@
 <div align="center">
  <img src="assets/logo.png" alt="Donut Browser Logo" width="150">
  <h1>Donut Browser</h1>
-  <strong>A powerful anti-detect browser that puts you in control of your browsing experience. 🍩</strong>
+  <strong>Open Source Anti-Detect Browser</strong>
+  <br>
+  <a href="https://donutbrowser.com">donutbrowser.com</a>
 </div>
 <br>

@@ -15,13 +17,16 @@
    <img src="https://img.shields.io/badge/license-AGPL--3.0-blue.svg" alt="License">
  </a>
  <a href="https://app.codacy.com/gh/zhom/donutbrowser/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade">
-    <img src="https://app.codacy.com/project/badge/Grade/b9c9beafc92d4bc8bc7c5b42c6c4ba81"/>
+    <img src="https://app.codacy.com/project/badge/Grade/b9c9beafc92d4bc8bc7c5b42c6c4ba81" alt="Codacy Grade"/>
  </a>
  <a href="https://app.fossa.com/projects/git%2Bgithub.com%2Fzhom%2Fdonutbrowser?ref=badge_shield&issueType=security" alt="FOSSA Status">
-    <img src="https://app.fossa.com/api/projects/git%2Bgithub.com%2Fzhom%2Fdonutbrowser.svg?type=shield&issueType=security"/>
+    <img src="https://app.fossa.com/api/projects/git%2Bgithub.com%2Fzhom%2Fdonutbrowser.svg?type=shield&issueType=security" alt="FOSSA Security Status"/>
  </a>
-  <a style="text-decoration: none;" href="https://github.com/zhom/donutbrowser/stargazers" target="_blank">
-    <img src="https://img.shields.io/github/stars/zhom/donutbrowser?style=social" alt="GitHub stars">
+  <a style="text-decoration: none;" href="https://github.com/zhom/donutbrowser/network/members" target="_blank">
+    <img src="https://img.shields.io/github/forks/zhom/donutbrowser?style=social" alt="GitHub forks">
+  </a>
+  <a style="text-decoration: none;" href="https://github.com/zhom/donutbrowser/releases" target="_blank">
+    <img src="https://img.shields.io/github/downloads/zhom/donutbrowser/total" alt="Downloads">
  </a>
 </p>

@@ -29,21 +34,55 @@

 ## Features

- Create unlimited number of local browser profiles completely isolated from each other
- Safely use multiple accounts on one device by using anti-detect browser profiles, powered by [Camoufox](https://camoufox.com)
- Proxy support with basic auth for all browsers
- Import profiles from your existing browsers
- Automatic updates for browsers
- Set Donut Browser as your default browser to control in which profile to open links
+- **Unlimited browser profiles** — each fully isolated with its own fingerprint, cookies, extensions, and data
+- **Chromium & Firefox engines** — Chromium powered by [Wayfern](https://wayfern.com), Firefox powered by [Camoufox](https://camoufox.com), both with advanced fingerprint spoofing
+- **Proxy support** — HTTP, HTTPS, SOCKS4, SOCKS5 per profile, with dynamic proxy URLs
+- **VPN support** — WireGuard and OpenVPN configs per profile
+- **Local API & MCP** — REST API and [Model Context Protocol](https://modelcontextprotocol.io) server for integration with Claude, automation tools, and custom workflows
+- **Profile groups** — organize profiles and apply bulk settings
+- **Import profiles** — migrate from Chrome, Firefox, Edge, Brave, or other Chromium browsers
+- **Cookie & extension management** — import/export cookies, manage extensions per profile
+- **Default browser** — set Donut as your default browser and choose which profile opens each link
+- **Cloud sync** — sync profiles, proxies, and groups across devices (self-hostable)
+- **E2E encryption** — optional end-to-end encrypted sync with a password only you know
+- **Zero telemetry** — no tracking or device fingerprinting

-## Download
+## Install

-> For Linux, .deb and .rpm packages are available as well as standalone .AppImage files.
+<!-- install-links-start -->
+### macOS

-The app can be downloaded from the [releases page](https://github.com/zhom/donutbrowser/releases/latest).
+| | Apple Silicon | Intel |
+|---|---|---|
+| **DMG** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut_0.18.1_aarch64.dmg) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut_0.18.1_x64.dmg) |
+
+Or install via Homebrew:
+
+```bash
+brew install --cask donut
+```
+
+### Windows
+
+[Download Windows Installer (x64)](https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut_0.18.1_x64-setup.exe)
+
+### Linux
+
+| Format | x86_64 | ARM64 |
+|---|---|---|
+| **deb** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut_0.18.1_amd64.deb) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut_0.18.1_arm64.deb) |
+| **rpm** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut-0.18.1-1.x86_64.rpm) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut-0.18.1-1.aarch64.rpm) |
+| **AppImage** | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut_0.18.1_amd64.AppImage) | [Download](https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut_0.18.1_aarch64.AppImage) |
+<!-- install-links-end -->
+
+Or install via package manager:
+
+```bash
+curl -fsSL https://donutbrowser.com/install.sh | sh
+```

 <details>
-<summary>Troubleshooting AppImage on Linux</summary>
+<summary>Troubleshooting AppImage</summary>

 If the AppImage segfaults on launch, install **libfuse2** (`sudo apt install libfuse2` / `yay -S libfuse2` / `sudo dnf install fuse-libs`), or bypass FUSE entirely:

@@ -55,40 +94,32 @@ If that gives an EGL display error, try adding `WEBKIT_DISABLE_DMABUF_RENDERER=1

 </details>

-<!-- ## Supported Platforms
+### Nix

- ✅ **macOS** (Apple Silicon)
- ✅ **Linux** (x64)
- ✅ **Windows** (x64) -->
-
-## Development
-
-### Contributing
-
-See [CONTRIBUTING.md](CONTRIBUTING.md).
-
-## Issues
-
-If you face any problems while using the application, please [open an issue](https://github.com/zhom/donutbrowser/issues).
+```bash
+nix run github:zhom/donutbrowser#release-start
+```

 ## Self-Hosting Sync

 Donut Browser supports syncing profiles, proxies, and groups across devices via a self-hosted sync server. See the [Self-Hosting Guide](docs/self-hosting-donut-sync.md) for Docker-based setup instructions.

-## Community
+## Development

-Have questions or want to contribute? The team would love to hear from you!
+See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Community

 - **Issues**: [GitHub Issues](https://github.com/zhom/donutbrowser/issues)
 - **Discussions**: [GitHub Discussions](https://github.com/zhom/donutbrowser/discussions)

 ## Star History

-<a href="https://www.star-history.com/#zhom/donutbrowser&Date">
+<a href="https://www.star-history.com/?repos=zhom%2Fdonutbrowser&type=date&legend=top-left">
 <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=zhom/donutbrowser&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=zhom/donutbrowser&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=zhom/donutbrowser&type=Date" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=zhom/donutbrowser&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/image?repos=zhom/donutbrowser&type=date&legend=top-left" />
+   <img alt="Star History Chart" src="https://api.star-history.com/image?repos=zhom/donutbrowser&type=date&legend=top-left" />
 </picture>
 </a>

@@ -112,6 +143,20 @@ Have questions or want to contribute? The team would love to hear from you!
                    <sub><b>Hassiy</b></sub>
                </a>
            </td>
+            <td align="center">
+                <a href="https://github.com/yb403">
+                    <img src="https://avatars.githubusercontent.com/u/87396571?v=4" width="100;" alt="yb403"/>
+                    <br />
+                    <sub><b>yb403</b></sub>
+                </a>
+            </td>
+            <td align="center">
+                <a href="https://github.com/drunkod">
+                    <img src="https://avatars.githubusercontent.com/u/9677471?v=4" width="100;" alt="drunkod"/>
+                    <br />
+                    <sub><b>drunkod</b></sub>
+                </a>
+            </td>
            <td align="center">
                <a href="https://github.com/JorySeverijnse">
                    <img src="https://avatars.githubusercontent.com/u/117462355?v=4" width="100;" alt="JorySeverijnse"/>
@@ -126,7 +171,7 @@ Have questions or want to contribute? The team would love to hear from you!

 ## Contact

-Have an urgent question or want to report a security vulnerability? Send an email to [contact@donutbrowser.com](mailto:contact@donutbrowser.com) and the team will get back to you as fast as possible.
+Have an urgent question or want to report a security vulnerability? Send an email to [contact@donutbrowser.com](mailto:contact@donutbrowser.com).

 ## License

@@ -4,13 +4,13 @@

 Thanks for helping make Donut Browser safe for everyone! ❤️

-We take the security of Donut Browser seriously. If you believe you have found a security vulnerability in Donut Browser, please report it to us through coordinated disclosure.
+I take the security of Donut Browser seriously. If you believe you have found a security vulnerability in Donut Browser, please report it to me through coordinated disclosure.

 **Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**

 Instead, please send an email to **[contact@donutbrowser.com](mailto:contact@donutbrowser.com)** with the subject line "Security Vulnerability Report".

-Please include as much of the information listed below as you can to help us better understand and resolve the issue:
+Please include as much of the information listed below as you can to help me better understand and resolve the issue:

 - The type of issue (e.g., buffer overflow, injection attack, privilege escalation, or cross-site scripting)
 - Full paths of source file(s) related to the manifestation of the issue
@@ -21,18 +21,18 @@ Please include as much of the information listed below as you can to help us bet
 - Impact of the issue, including how an attacker might exploit the issue
 - Your assessment of the severity level

-This information will help us triage your report more quickly.
+This information will help me triage your report more quickly.

 ## What to Expect

- **Response Time**: We will acknowledge receipt of your vulnerability report within 72 hours.
- **Investigation**: We will investigate the issue and provide you with updates on our progress.
- **Resolution**: We aim to resolve critical security issues as fast as possible, but no longer than in 30 days after the initial report.
- **Disclosure**: We will coordinate with you on the timing of any public disclosure.
+- **Response Time**: I will acknowledge receipt of your vulnerability report within 72 hours.
+- **Investigation**: I will investigate the issue and provide you with updates on my progress.
+- **Resolution**: I aim to resolve critical security issues as fast as possible, but no longer than in 30 days after the initial report.
+- **Disclosure**: I will coordinate with you on the timing of any public disclosure.

 ## Contact

-For urgent security matters, please contact us at **[contact@donutbrowser.com](mailto:contact@donutbrowser.com)**.
+For urgent security matters, please contact me at **[contact@donutbrowser.com](mailto:contact@donutbrowser.com)**.

 For general questions about this security policy, you can also reach out through:

@@ -1,12 +1,21 @@
+FROM node:22-alpine AS builder
+
+WORKDIR /build
+COPY donut-sync/package.json donut-sync/tsconfig.json donut-sync/tsconfig.build.json ./
+COPY donut-sync/src/ src/
+RUN npm install
+RUN npm run build
+RUN npm prune --omit=dev
+
 FROM node:22-alpine

 WORKDIR /app
-
-COPY package.json .
-COPY dist/ dist/
-COPY node_modules/ node_modules/
+COPY --from=builder /build/package.json .
+COPY --from=builder /build/dist/ dist/
+COPY --from=builder /build/node_modules/ node_modules/

 ENV NODE_ENV=production
 EXPOSE 12342

+USER node
 CMD ["node", "dist/main"]
@@ -2,8 +2,6 @@
  <a href="http://nestjs.com/" target="blank"><img src="https://nestjs.com/img/logo-small.svg" width="120" alt="Nest Logo" /></a>
 </p>

-[circleci-image]: https://img.shields.io/circleci/build/github/nestjs/nest/master?token=abc123def456
-[circleci-url]: https://circleci.com/gh/nestjs/nest

  <p align="center">A progressive <a href="http://nodejs.org" target="_blank">Node.js</a> framework for building efficient and scalable server-side applications.</p>
    <p align="center">
@@ -28,33 +26,33 @@
 ## Project setup

 ```bash
-$ pnpm install
+pnpm install
 ```

 ## Compile and run the project

 ```bash
 # development
-$ pnpm run start
+pnpm run start

 # watch mode
-$ pnpm run start:dev
+pnpm run start:dev

 # production mode
-$ pnpm run start:prod
+pnpm run start:prod
 ```

 ## Run tests

 ```bash
 # unit tests
-$ pnpm run test
+pnpm run test

 # e2e tests
-$ pnpm run test:e2e
+pnpm run test:e2e

 # test coverage
-$ pnpm run test:cov
+pnpm run test:cov
 ```

 ## Deployment
@@ -64,8 +62,8 @@ When you're ready to deploy your NestJS application to production, there are som
 If you are looking for a cloud-based platform to deploy your NestJS application, check out [Mau](https://mau.nestjs.com), our official platform for deploying NestJS applications on AWS. Mau makes deployment straightforward and fast, requiring just a few simple steps:

 ```bash
-$ pnpm install -g @nestjs/mau
-$ mau deploy
+pnpm install -g @nestjs/mau
+mau deploy
 ```

 With Mau, you can deploy your application in just a few clicks, allowing you to focus on building features rather than managing infrastructure.
@@ -15,11 +15,11 @@
    "test:watch": "jest --watch",
    "test:cov": "jest --coverage",
    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
-    "test:e2e": "jest --config ./test/jest-e2e.json"
+    "test:e2e": "NODE_OPTIONS='--experimental-vm-modules' jest --config ./test/jest-e2e.json"
  },
  "dependencies": {
-    "@aws-sdk/client-s3": "^3.1014.0",
-    "@aws-sdk/s3-request-presigner": "^3.1014.0",
+    "@aws-sdk/client-s3": "^3.1019.0",
+    "@aws-sdk/s3-request-presigner": "^3.1019.0",
    "@nestjs/common": "^11.1.17",
    "@nestjs/config": "^4.0.3",
    "@nestjs/core": "^11.1.17",
@@ -27,7 +27,7 @@ export class AuthGuard implements CanActivate {
    const request = context.switchToHttp().getRequest<Request>();
    const authHeader = request.headers.authorization;

-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    if (!authHeader?.startsWith("Bearer ")) {
      throw new UnauthorizedException(
        "Missing or invalid authorization header",
      );
@@ -38,7 +38,7 @@ export class AuthGuard implements CanActivate {
    // Try SYNC_TOKEN first (self-hosted mode)
    const expectedToken = this.configService.get<string>("SYNC_TOKEN");
    if (expectedToken && token === expectedToken) {
-      (request as any).user = {
+      (request as unknown as Record<string, unknown>).user = {
        mode: "self-hosted",
        prefix: "",
        teamPrefix: null,
@@ -55,7 +55,7 @@ export class AuthGuard implements CanActivate {
          algorithms: ["RS256"],
        }) as jwt.JwtPayload;

-        (request as any).user = {
+        (request as unknown as Record<string, unknown>).user = {
          mode: "cloud",
          prefix: decoded.prefix || `users/${decoded.sub}/`,
          teamPrefix: decoded.teamPrefix || null,
@@ -39,7 +39,7 @@ export class SyncController {
  constructor(private readonly syncService: SyncService) {}

  private getUserContext(req: Request): UserContext {
-    return (req as any).user as UserContext;
+    return (req as unknown as Record<string, unknown>).user as UserContext;
  }

  @Post("stat")
@@ -13,10 +13,11 @@
    "target": "ES2023",
    "sourceMap": true,
    "outDir": "./dist",
-    "baseUrl": "./",
    "incremental": true,
    "skipLibCheck": true,
    "strictNullChecks": true,
+    "strictPropertyInitialization": false,
+    "types": ["jest", "node"],
    "forceConsistentCasingInFileNames": true,
    "noImplicitAny": false,
    "strictBindCallApply": false,
@@ -37,28 +37,7 @@
    "root": {
      "inputs": {
        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs",
-        "rust-overlay": "rust-overlay"
-      }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1767926800,
-        "narHash": "sha256-x0n73J6ufD/EhDlVdcoAmF0OQHZ+b0a2cKDc8RZyt+o=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "499e9eed88ff9494b6604205b42847e847dfeb91",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
+        "nixpkgs": "nixpkgs"
      }
    },
    "systems": {
@@ -1,66 +1,341 @@
 {
-  description = "Donut Browser Development Environment";
+  description = "Donut Browser development environment and quick-start commands";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
-    rust-overlay = {
-      url = "github:oxalica/rust-overlay";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
  };

-  outputs = { self, nixpkgs, flake-utils, rust-overlay, ... }:
+  outputs = { self, nixpkgs, flake-utils, ... }:
    flake-utils.lib.eachDefaultSystem (system:
      let
-        overlays = [ (import rust-overlay) ];
        pkgs = import nixpkgs {
-          inherit system overlays;
+          inherit system;
+          config.allowUnfree = true;
        };
+        lib = pkgs.lib;

-        # Rust toolchain
-        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
-          extensions = [ "rust-src" "rust-analyzer" "clippy" "rustfmt" ];
-        };
+        nodejs =
+          if pkgs ? nodejs_23 then
+            pkgs.nodejs_23
+          else
+            pkgs.nodejs_22;

-        # System dependencies for Tauri on Linux
-        libraries = with pkgs; [
+        rustPackages = with pkgs; [
+          cargo
+          clippy
+          rust-analyzer
+          rustc
+          rustfmt
+        ];
+
+        commonLibs = with pkgs; [
          webkitgtk_4_1
+          libsoup_3
+          glib
          gtk3
          cairo
          gdk-pixbuf
-          glib
+          pango
+          atk
+          at-spi2-atk
+          at-spi2-core
          dbus
-          librsvg
-          libsoup_3
+          nss
+          nspr
+          libdrm
+          libgbm
+          libxkbcommon
+          libx11
+          libxcomposite
+          libxdamage
+          libxext
+          libxfixes
+          libxrandr
+          libxcb
+          libxshmfence
+          libxtst
+          libxi
+          xdotool
+          libxrender
+          libxinerama
+          libxcursor
+          libxscrnsaver
+          fontconfig
+          freetype
+          fribidi
+          harfbuzz
+          expat
+          libglvnd
+          libgpg-error
+          e2fsprogs
+          gmp
+          zlib
+          stdenv.cc.cc.lib
        ];

-        packages = with pkgs; [
-          rustToolchain
-          nodejs_22
-          pnpm
-          pkg-config
-          cargo-tauri
-          openssl
-          # App specific tools
-          biome
-        ] ++ libraries;
+        runtimeLibPath = lib.makeLibraryPath commonLibs;
+        nixLd = pkgs.stdenv.cc.bintools.dynamicLinker;
+        pkgConfigLibs = [
+          pkgs.at-spi2-atk
+          pkgs.at-spi2-core
+          pkgs.cairo
+          pkgs.dbus
+          pkgs.gdk-pixbuf
+          pkgs.glib
+          pkgs.gtk3
+          pkgs.libsoup_3
+          pkgs.libxkbcommon
+          pkgs.openssl
+          pkgs.pango
+          pkgs.harfbuzz
+          pkgs.webkitgtk_4_1
+        ];
+        pkgConfigPath = lib.makeSearchPath "lib/pkgconfig" (
+          pkgConfigLibs ++ map lib.getDev pkgConfigLibs
+        );
+        releaseVersion = "0.18.1";
+        releaseAppImage =
+          if system == "x86_64-linux" then
+            pkgs.fetchurl {
+              url = "https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut_0.18.1_amd64.AppImage";
+              hash = "sha256-+twOKfcM5qdV3+415/PecdQUgTTe+9xwL7/qu4kCxQI=";
+            }
+          else if system == "aarch64-linux" then
+            pkgs.fetchurl {
+              url = "https://github.com/zhom/donutbrowser/releases/download/v0.18.1/Donut_0.18.1_aarch64.AppImage";
+              hash = "sha256-/Fj2euuxKzP6DxcV7sqShsNr6sy7Ck1iERtYcMt2hZQ=";
+            }
+          else
+            null;
+        releaseUnpacked =
+          if releaseAppImage != null then
+            pkgs.stdenvNoCC.mkDerivation {
+              pname = "donut-release-unpacked";
+              version = releaseVersion;
+              src = releaseAppImage;
+              dontUnpack = true;
+              nativeBuildInputs = [ pkgs.xz ];
+              installPhase = ''
+                runHook preInstall

+                cp "$src" ./donut.AppImage
+                chmod +x ./donut.AppImage
+                ./donut.AppImage --appimage-extract >/dev/null
+
+                mkdir -p "$out"
+                cp -a ./squashfs-root "$out/"
+
+                runHook postInstall
+              '';
+            }
+          else
+            null;
+        releaseWrapped =
+          if releaseAppImage != null then
+            pkgs.appimageTools.wrapType2 {
+              pname = "donut";
+              version = releaseVersion;
+              src = releaseAppImage;
+              extraPkgs = _: commonLibs;
+              extraInstallCommands = ''
+                for bin in "$out"/bin/*; do
+                  if [ -f "$bin" ]; then
+                    mv "$bin" "$out/bin/donut-release"
+                    break
+                  fi
+                done
+              '';
+            }
+          else
+            null;
+        releaseLauncher =
+          if releaseUnpacked != null then
+            pkgs.writeShellApplication {
+              name = "donut-release-start";
+              runtimeInputs = with pkgs; [
+                coreutils
+                xdg-utils
+              ];
+              text = ''
+                set -euo pipefail
+
+                if [ -x "${releaseWrapped}/bin/donut-release" ]; then
+                  if "${releaseWrapped}/bin/donut-release" "$@"; then
+                    exit 0
+                  fi
+                  echo "Wrapped AppImage failed, retrying with direct AppRun..." >&2
+                fi
+
+                export LD_LIBRARY_PATH="${releaseUnpacked}/squashfs-root/usr/lib:${releaseUnpacked}/squashfs-root/usr/lib64:${runtimeLibPath}:''${LD_LIBRARY_PATH:-}"
+                export NIX_LD_LIBRARY_PATH="$LD_LIBRARY_PATH"
+                export LIBRARY_PATH="$LD_LIBRARY_PATH"
+                export XDG_DATA_DIRS="${releaseUnpacked}/squashfs-root/usr/share:''${XDG_DATA_DIRS:-}"
+                exec "${releaseUnpacked}/squashfs-root/AppRun" "$@"
+              '';
+            }
+          else
+            pkgs.writeShellApplication {
+              name = "donut-release-start";
+              text = ''
+                echo "Release launcher is supported only on Linux (x86_64/aarch64)."
+                exit 1
+              '';
+            };
+
+        mkApp = name: text:
+          let
+            app = pkgs.writeShellApplication {
+              inherit name;
+              runtimeInputs = with pkgs; [
+                bash
+                coreutils
+                findutils
+                git
+                gnugrep
+                gnused
+                curl
+                gcc
+                pkg-config
+                openssl
+                cargo
+                clippy
+                rustc
+                rustfmt
+                nodejs
+                pnpm
+                cargo-tauri
+              ];
+              text = ''
+                export NODE_ENV=development
+                export NIX_LD="${nixLd}"
+                export NIX_LD_LIBRARY_PATH="${runtimeLibPath}:''${NIX_LD_LIBRARY_PATH:-}"
+                export LD_LIBRARY_PATH="${runtimeLibPath}:''${LD_LIBRARY_PATH:-}"
+                export LIBRARY_PATH="${runtimeLibPath}:''${LIBRARY_PATH:-}"
+                export PKG_CONFIG_PATH="${pkgConfigPath}:''${PKG_CONFIG_PATH:-}"
+                export RUST_SRC_PATH="${pkgs.rustPlatform.rustLibSrc}"
+                ${text}
+              '';
+            };
+          in
+          {
+            type = "app";
+            program = "${app}/bin/${name}";
+          };
      in
      {
        devShells.default = pkgs.mkShell {
-          buildInputs = packages;
+          packages = with pkgs; [
+            nodejs
+            pnpm
+            cargo-tauri
+            pkg-config
+            openssl
+            git
+            bashInteractive
+            gnumake
+            clang
+            llvmPackages.bintools
+            python3
+            curl
+            wget
+            unzip
+            zip
+            xz
+            biome
+            docker
+          ] ++ rustPackages ++ commonLibs;

          shellHook = ''
-            export LD_LIBRARY_PATH=${pkgs.lib.makeLibraryPath libraries}:$LD_LIBRARY_PATH
-            export XDG_DATA_DIRS=${pkgs.gsettings-desktop-schemas}/share/gsettings-schemas/${pkgs.gsettings-desktop-schemas.name}:${pkgs.gtk3}/share/gsettings-schemas/${pkgs.gtk3.name}:$XDG_DATA_DIRS
-            
-            echo "🍩 Donut Browser Dev Environment Loaded!"
-            echo "Node: $(node --version)"
-            echo "Rust: $(rustc --version)"
-            echo "Tauri CLI: $(cargo-tauri --version)"
+            export NODE_ENV=development
+            export NIX_LD="${nixLd}"
+            export NIX_LD_LIBRARY_PATH="${runtimeLibPath}:''${NIX_LD_LIBRARY_PATH:-}"
+            export LD_LIBRARY_PATH="${runtimeLibPath}:''${LD_LIBRARY_PATH:-}"
+            export LIBRARY_PATH="${runtimeLibPath}:''${LIBRARY_PATH:-}"
+            export PKG_CONFIG_PATH="${pkgConfigPath}:''${PKG_CONFIG_PATH:-}"
+            export RUST_SRC_PATH="${pkgs.rustPlatform.rustLibSrc}"
+            export XDG_DATA_DIRS="${pkgs.gsettings-desktop-schemas}/share:${pkgs.gtk3}/share:''${XDG_DATA_DIRS:-}"
+
+            echo "Donut Browser dev shell ready."
+            echo "Quick start:"
+            echo "  nix run .#setup"
+            echo "  nix run .#tauri-dev"
+            echo "  nix run .#full-dev"
+            echo "  nix run .#build"
+            echo "  nix run .#test"
+            echo "  nix run .#release-start"
          '';
        };
-      }
-    );
+
+        apps.info = mkApp "donut-info" ''
+          set -euo pipefail
+          echo "Node: $(node --version)"
+          echo "pnpm: $(pnpm --version)"
+          echo "Rust: $(rustc --version)"
+          echo "Cargo: $(cargo --version)"
+          echo "Tauri CLI: $(cargo-tauri --version)"
+        '';
+
+        apps.deps = mkApp "donut-deps" ''
+          set -euo pipefail
+          pnpm install
+        '';
+
+        apps.dev = mkApp "donut-dev" ''
+          set -euo pipefail
+          pnpm dev
+        '';
+
+        apps."tauri-dev" = mkApp "donut-tauri-dev" ''
+          set -euo pipefail
+          pnpm tauri dev
+        '';
+
+        apps."full-dev" = mkApp "donut-full-dev" ''
+          set -euo pipefail
+          chmod +x ./scripts/dev.sh
+          ./scripts/dev.sh
+        '';
+
+        apps.build = mkApp "donut-build" ''
+          set -euo pipefail
+          pnpm build
+          (cd src-tauri && cargo build)
+        '';
+
+        apps.start = mkApp "donut-start" ''
+          set -euo pipefail
+          pnpm start
+        '';
+
+        apps.test = mkApp "donut-test" ''
+          set -euo pipefail
+          pnpm format && pnpm lint && pnpm test
+        '';
+
+        apps.setup = mkApp "donut-setup" ''
+          set -euo pipefail
+
+          if [ ! -f "package.json" ]; then
+            echo "package.json not found. Run this from the donutbrowser repo root."
+            exit 1
+          fi
+
+          pnpm install
+          pnpm copy-proxy-binary
+
+          echo "Setup complete."
+          echo "Run the app with:"
+          echo "  nix run .#tauri-dev"
+          echo "Or run full local stack (sync + minio + tauri):"
+          echo "  nix run .#full-dev"
+        '';
+
+        apps."release-start" = {
+          type = "app";
+          program = "${releaseLauncher}/bin/donut-release-start";
+        };
+
+        apps.default = self.apps.${system}.setup;
+      });
 }
@@ -2,7 +2,7 @@
  "name": "donutbrowser",
  "private": true,
  "license": "AGPL-3.0",
-  "version": "0.17.6",
+  "version": "0.18.1",
  "type": "module",
  "scripts": {
    "dev": "next dev --turbopack -p 12341",
@@ -51,29 +51,29 @@
    "@tauri-apps/plugin-fs": "~2.4.5",
    "@tauri-apps/plugin-log": "^2.8.0",
    "@tauri-apps/plugin-opener": "^2.5.3",
-    "ahooks": "^3.9.6",
+    "ahooks": "^3.9.7",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
    "cmdk": "^1.1.1",
    "color": "^5.0.3",
    "flag-icons": "^7.5.0",
-    "i18next": "^25.9.0",
-    "lucide-react": "^0.577.0",
+    "i18next": "^26.0.0",
+    "lucide-react": "^1.7.0",
    "motion": "^12.38.0",
    "next": "^16.2.1",
    "next-themes": "^0.4.6",
    "radix-ui": "^1.4.3",
    "react": "^19.2.4",
    "react-dom": "^19.2.4",
-    "react-i18next": "^16.5.8",
+    "react-i18next": "^17.0.0",
    "react-icons": "^5.6.0",
-    "recharts": "3.8.0",
+    "recharts": "3.8.1",
    "sonner": "^2.0.7",
    "tailwind-merge": "^3.5.0",
    "tauri-plugin-macos-permissions-api": "^2.3.0"
  },
  "devDependencies": {
-    "@biomejs/biome": "2.4.8",
+    "@biomejs/biome": "2.4.9",
    "@tailwindcss/postcss": "^4.2.2",
    "@tauri-apps/cli": "~2.10.1",
    "@types/color": "^4.2.1",
@@ -86,7 +86,7 @@
    "tailwindcss": "^4.2.2",
    "ts-unused-exports": "^11.0.1",
    "tw-animate-css": "^1.4.0",
-    "typescript": "~5.9.3"
+    "typescript": "~6.0.2"
  },
  "packageManager": "pnpm@10.30.1",
  "lint-staged": {
@@ -122,21 +122,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "anstream"
-version = "0.6.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
-dependencies = [
- "anstyle",
- "anstyle-parse 0.2.7",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
 [[package]]
 name = "anstream"
 version = "1.0.0"
@@ -144,7 +129,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
 dependencies = [
 "anstyle",
- "anstyle-parse 1.0.0",
+ "anstyle-parse",
 "anstyle-query",
 "anstyle-wincon",
 "colorchoice",
@@ -158,15 +143,6 @@ version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"

-[[package]]
-name = "anstyle-parse"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
-dependencies = [
- "utf8parse",
-]
-
 [[package]]
 name = "anstyle-parse"
 version = "1.0.0"
@@ -953,9 +929,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.2.57"
+version = "1.2.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a0dd1ca384932ff3641c8718a02769f1698e7563dc6974ffd03346116310423"
+checksum = "e1e928d4b69e3077709075a938a05ffbedfa53a84c8f766efbf8220bb1ff60e1"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -1099,7 +1075,7 @@ version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
 dependencies = [
- "anstream 1.0.0",
+ "anstream",
 "anstyle",
 "clap_lex",
 "strsim",
@@ -1494,6 +1470,17 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be1e0bca6c3637f992fc1cc7cbc52a78c1ef6db076dbf1059c4323d6a2048376"

+[[package]]
+name = "dbus"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b3aa68d7e7abee336255bd7248ea965cc393f3e70411135a6f6a4b651345d4"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "deadpool"
 version = "0.12.3"
@@ -1514,9 +1501,9 @@ checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b"

 [[package]]
 name = "deflate64"
-version = "0.1.11"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "807800ff3288b621186fe0a8f3392c4652068257302709c24efd918c3dffcdc2"
+checksum = "ac6b926516df9c60bfa16e107b21086399f8285a44ca9711344b9e553c5146e2"

 [[package]]
 name = "defmt"
@@ -1727,7 +1714,7 @@ dependencies = [

 [[package]]
 name = "donutbrowser"
-version = "0.17.6"
+version = "0.18.1"
 dependencies = [
 "aes",
 "aes-gcm",
@@ -1783,7 +1770,7 @@ dependencies = [
 "smoltcp",
 "sys-locale",
 "sysinfo",
- "tao",
+ "tao 0.35.0",
 "tar",
 "tauri",
 "tauri-build",
@@ -1811,7 +1798,7 @@ dependencies = [
 "windows 0.62.2",
 "winreg 0.56.0",
 "wiremock",
- "zip 8.3.0",
+ "zip 8.4.0",
 ]

 [[package]]
@@ -1858,9 +1845,9 @@ checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"

 [[package]]
 name = "embed-resource"
-version = "3.0.7"
+version = "3.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47ec73ddcf6b7f23173d5c3c5a32b5507dc0a734de7730aa14abc5d5e296bb5f"
+checksum = "63a1d0de4f2249aa0ff5884d7080814f446bb241a559af6c170a41e878ed2d45"
 dependencies = [
 "cc",
 "memchr",
@@ -1924,9 +1911,9 @@ dependencies = [

 [[package]]
 name = "env_filter"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a1c3cc8e57274ec99de65301228b537f1e4eedc1b8e0f9411c6caac8ae7308f"
+checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
 dependencies = [
 "log",
 "regex",
@@ -1934,13 +1921,13 @@ dependencies = [

 [[package]]
 name = "env_logger"
-version = "0.11.9"
+version = "0.11.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2daee4ea451f429a58296525ddf28b45a3b64f1acf6587e2067437bb11e218d"
+checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
 dependencies = [
- "anstream 0.6.21",
+ "anstream",
 "anstyle",
- "env_filter 1.0.0",
+ "env_filter 1.0.1",
 "jiff",
 "log",
 ]
@@ -3261,9 +3248,9 @@ checksum = "cf370abdafd54d13e54a620e8c3e1145f28e46cc9d704bc6d94414559df41763"

 [[package]]
 name = "iri-string"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+checksum = "d8e7418f59cc01c88316161279a7f665217ae316b388e58a0d10e29f54f1e5eb"
 dependencies = [
 "memchr",
 "serde",
@@ -3365,7 +3352,7 @@ dependencies = [
 "cesu8",
 "cfg-if",
 "combine",
- "jni-sys",
+ "jni-sys 0.3.1",
 "log",
 "thiserror 1.0.69",
 "walkdir",
@@ -3374,9 +3361,31 @@ dependencies = [

 [[package]]
 name = "jni-sys"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.117",
+]

 [[package]]
 name = "jobserver"
@@ -3508,6 +3517,15 @@ version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"

+[[package]]
+name = "libdbus-sys"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
+dependencies = [
+ "pkg-config",
+]
+
 [[package]]
 name = "libfuzzer-sys"
 version = "0.4.12"
@@ -3536,9 +3554,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"

 [[package]]
 name = "libredox"
-version = "0.1.14"
+version = "0.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1744e39d1d6a9948f4f388969627434e31128196de472883b39f148769bfe30a"
+checksum = "7ddbf48fd451246b1f8c2610bd3b4ac0cc6e149d89832867093ab69a17194f08"
 dependencies = [
 "bitflags 2.11.0",
 "libc",
@@ -3787,9 +3805,9 @@ dependencies = [

 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
 "libc",
 "wasi 0.11.1+wasi-snapshot-preview1",
@@ -3876,7 +3894,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
 dependencies = [
 "bitflags 2.11.0",
- "jni-sys",
+ "jni-sys 0.3.1",
 "log",
 "ndk-sys",
 "num_enum",
@@ -3896,7 +3914,7 @@ version = "0.6.0+11769913"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
 dependencies = [
- "jni-sys",
+ "jni-sys 0.3.1",
 ]

 [[package]]
@@ -3971,9 +3989,9 @@ dependencies = [

 [[package]]
 name = "num-conv"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"

 [[package]]
 name = "num-derive"
@@ -4041,7 +4059,7 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
 dependencies = [
- "proc-macro-crate 3.5.0",
+ "proc-macro-crate 1.3.1",
 "proc-macro2",
 "quote",
 "syn 2.0.117",
@@ -4143,6 +4161,16 @@ dependencies = [
 "objc2-foundation",
 ]

+[[package]]
+name = "objc2-core-location"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca347214e24bc973fc025fd0d36ebb179ff30536ed1f80252706db19ee452009"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
 [[package]]
 name = "objc2-core-text"
 version = "0.3.2"
@@ -4236,8 +4264,27 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
 dependencies = [
 "bitflags 2.11.0",
+ "block2",
 "objc2",
+ "objc2-cloud-kit",
+ "objc2-core-data",
 "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-core-image",
+ "objc2-core-location",
+ "objc2-core-text",
+ "objc2-foundation",
+ "objc2-quartz-core",
+ "objc2-user-notifications",
+]
+
+[[package]]
+name = "objc2-user-notifications"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9df9128cbbfef73cda168416ccf7f837b62737d748333bfe9ab71c245d76613e"
+dependencies = [
+ "objc2",
 "objc2-foundation",
 ]

@@ -4362,7 +4409,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.45.0",
 ]

 [[package]]
@@ -4890,7 +4937,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.4+spec-1.1.0",
+ "toml_edit 0.25.8+spec-1.1.0",
 ]

 [[package]]
@@ -5585,9 +5632,9 @@ dependencies = [

 [[package]]
 name = "rust_decimal"
-version = "1.40.0"
+version = "1.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61f703d19852dbf87cbc513643fa81428361eb6940f1ac14fd58155d295a3eb0"
+checksum = "2ce901f9a19d251159075a4c37af514c3b8ef99c22e02dd8c19161cf397ee94a"
 dependencies = [
 "arrayvec",
 "borsh",
@@ -5597,6 +5644,7 @@ dependencies = [
 "rkyv",
 "serde",
 "serde_json",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -5955,9 +6003,9 @@ dependencies = [

 [[package]]
 name = "serde_spanned"
-version = "1.0.4"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+checksum = "876ac351060d4f882bb1032b6369eb0aef79ad9df1ea8bc404874d8cc3d0cd98"
 dependencies = [
 "serde_core",
 ]
@@ -6157,9 +6205,9 @@ dependencies = [

 [[package]]
 name = "simd-adler32"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"

 [[package]]
 name = "simd_helpers"
@@ -6509,9 +6557,9 @@ dependencies = [

 [[package]]
 name = "tao"
-version = "0.34.6"
+version = "0.34.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d52c379e63da659a483a958110bbde891695a0ecb53e48cc7786d5eda7bb"
+checksum = "9103edf55f2da3c82aea4c7fab7c4241032bfeea0e71fa557d98e00e7ce7cc20"
 dependencies = [
 "bitflags 2.11.0",
 "block2",
@@ -6545,6 +6593,46 @@ dependencies = [
 "x11-dl",
 ]

+[[package]]
+name = "tao"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cf65722394c2ac443e80120064987f8914ee1d4e4e36e63cdf10f2990f01159"
+dependencies = [
+ "bitflags 2.11.0",
+ "block2",
+ "core-foundation 0.10.1",
+ "core-graphics",
+ "crossbeam-channel",
+ "dbus",
+ "dispatch2",
+ "dlopen2",
+ "dpi",
+ "gdkwayland-sys",
+ "gdkx11-sys",
+ "gtk",
+ "jni",
+ "libc",
+ "log",
+ "ndk",
+ "ndk-sys",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "once_cell",
+ "parking_lot",
+ "percent-encoding",
+ "raw-window-handle",
+ "tao-macros",
+ "unicode-segmentation",
+ "url",
+ "windows 0.61.3",
+ "windows-core 0.61.2",
+ "windows-version",
+ "x11-dl",
+]
+
 [[package]]
 name = "tao-macros"
 version = "0.1.3"
@@ -6907,7 +6995,7 @@ dependencies = [
 "percent-encoding",
 "raw-window-handle",
 "softbuffer",
- "tao",
+ "tao 0.34.8",
 "tauri-runtime",
 "tauri-utils",
 "url",
@@ -6973,7 +7061,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.4.2",
+ "getrandom 0.3.4",
 "once_cell",
 "rustix",
 "windows-sys 0.52.0",
@@ -7266,7 +7354,7 @@ checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
 dependencies = [
 "indexmap 2.13.0",
 "serde_core",
- "serde_spanned 1.0.4",
+ "serde_spanned 1.1.0",
 "toml_datetime 0.7.5+spec-1.1.0",
 "toml_parser",
 "toml_writer",
@@ -7293,9 +7381,9 @@ dependencies = [

 [[package]]
 name = "toml_datetime"
-version = "1.0.0+spec-1.1.0"
+version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32c2555c699578a4f59f0cc68e5116c8d7cabbd45e1409b989d4be085b53f13e"
+checksum = "97251a7c317e03ad83774a8752a7e81fb6067740609f75ea2b585b569a59198f"
 dependencies = [
 "serde_core",
 ]
@@ -7326,30 +7414,30 @@ dependencies = [

 [[package]]
 name = "toml_edit"
-version = "0.25.4+spec-1.1.0"
+version = "0.25.8+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7193cbd0ce53dc966037f54351dbbcf0d5a642c7f0038c382ef9e677ce8c13f2"
+checksum = "16bff38f1d86c47f9ff0647e6838d7bb362522bdf44006c7068c2b1e606f1f3c"
 dependencies = [
 "indexmap 2.13.0",
- "toml_datetime 1.0.0+spec-1.1.0",
+ "toml_datetime 1.1.0+spec-1.1.0",
 "toml_parser",
- "winnow 0.7.15",
+ "winnow 1.0.0",
 ]

 [[package]]
 name = "toml_parser"
-version = "1.0.10+spec-1.1.0"
+version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7df25b4befd31c4816df190124375d5a20c6b6921e2cad937316de3fccd63420"
+checksum = "2334f11ee363607eb04df9b8fc8a13ca1715a72ba8662a26ac285c98aabb4011"
 dependencies = [
 "winnow 1.0.0",
 ]

 [[package]]
 name = "toml_writer"
-version = "1.0.7+spec-1.1.0"
+version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17aaa1c6e3dc22b1da4b6bba97d066e354c7945cac2f7852d4e4e7ca7a6b56d"
+checksum = "d282ade6016312faf3e41e57ebbba0c073e4056dab1232ab1cb624199648f8ed"

 [[package]]
 name = "tower"
@@ -7624,9 +7712,9 @@ checksum = "383ad40bb927465ec0ce7720e033cb4ca06912855fc35db31b5755d0de75b1ee"

 [[package]]
 name = "unicode-segmentation"
-version = "1.12.0"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"

 [[package]]
 name = "unicode-vo"
@@ -7784,9 +7872,9 @@ dependencies = [

 [[package]]
 name = "uuid"
-version = "1.22.0"
+version = "1.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
+checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
 dependencies = [
 "getrandom 0.4.2",
 "js-sys",
@@ -8642,6 +8730,9 @@ name = "winnow"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a90e88e4667264a994d34e6d1ab2d26d398dcdca8b7f52bec8668957517fc7d8"
+dependencies = [
+ "memchr",
+]

 [[package]]
 name = "winreg"
@@ -9107,9 +9198,9 @@ dependencies = [

 [[package]]
 name = "zip"
-version = "8.3.0"
+version = "8.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a243cfad17427fc077f529da5a95abe4e94fd2bfdb601611870a6557cc67657"
+checksum = "7756d0206d058333667493c4014f545f4b9603c4330ccd6d9b3f86dcab59f7d9"
 dependencies = [
 "crc32fast",
 "flate2",
@@ -9181,9 +9272,9 @@ dependencies = [

 [[package]]
 name = "zune-jpeg"
-version = "0.5.13"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec5f41c76397b7da451efd19915684f727d7e1d516384ca6bd0ec43ec94de23c"
+checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
 dependencies = [
 "zune-core",
 ]
@@ -1,6 +1,6 @@
 [package]
 name = "donutbrowser"
-version = "0.17.6"
+version = "0.18.1"
 description = "Simple Yet Powerful Anti-Detect Browser"
 authors = ["zhom@github"]
 edition = "2021"
@@ -64,7 +64,7 @@ flate2 = "1"
 lzma-rs = "0"
 msi-extract = "0"

-uuid = { version = "1.20", features = ["v4", "serde"] }
+uuid = { version = "1.23", features = ["v4", "serde"] }
 url = "2.5"
 blake3 = "1"
 globset = "0.4"
@@ -111,7 +111,7 @@ smoltcp = { version = "0.13", default-features = false, features = ["std", "medi
 # Daemon dependencies (tray icon)
 tray-icon = "0.21"
 muda = "0.17"
-tao = "0.34"
+tao = "0.35"
 image = "0.25"
 dirs = "6"
 crossbeam-channel = "0.5"
@@ -1604,6 +1604,10 @@ rm "{}"

 #[tauri::command]
 pub async fn check_for_app_updates() -> Result<Option<AppUpdateInfo>, String> {
+  if crate::app_dirs::is_portable() {
+    log::info!("App auto-updates disabled in portable mode");
+    return Ok(None);
+  }
  // The disable_auto_updates setting controls app self-updates only
  let disabled = crate::settings_manager::SettingsManager::instance()
    .load_settings()
@@ -3,11 +3,29 @@ use std::path::PathBuf;
 use std::sync::OnceLock;

 static BASE_DIRS: OnceLock<BaseDirs> = OnceLock::new();
+static PORTABLE_DIR: OnceLock<Option<PathBuf>> = OnceLock::new();

 fn base_dirs() -> &'static BaseDirs {
  BASE_DIRS.get_or_init(|| BaseDirs::new().expect("Failed to get base directories"))
 }

+/// Returns the portable base directory if a `.portable` marker exists next to the executable.
+fn portable_dir() -> Option<&'static PathBuf> {
+  PORTABLE_DIR
+    .get_or_init(|| {
+      std::env::current_exe()
+        .ok()
+        .and_then(|exe| exe.parent().map(|p| p.to_path_buf()))
+        .filter(|dir| dir.join(".portable").exists())
+    })
+    .as_ref()
+}
+
+/// Returns true if the app is running in portable mode.
+pub fn is_portable() -> bool {
+  portable_dir().is_some()
+}
+
 pub fn app_name() -> &'static str {
  if cfg!(debug_assertions) {
    "DonutBrowserDev"
@@ -28,6 +46,10 @@ pub fn data_dir() -> PathBuf {
    return PathBuf::from(dir);
  }

+  if let Some(dir) = portable_dir() {
+    return dir.join("data");
+  }
+
  base_dirs().data_local_dir().join(app_name())
 }

@@ -43,6 +65,10 @@ pub fn cache_dir() -> PathBuf {
    return PathBuf::from(dir);
  }

+  if let Some(dir) = portable_dir() {
+    return dir.join("cache");
+  }
+
  base_dirs().cache_dir().join(app_name())
 }

@@ -195,6 +195,15 @@ async fn main() {
        )
        .arg(Arg::new("action").required(true).help("Action (start)")),
    )
+    .subcommand(
+      Command::new("mcp-bridge")
+        .about("Bridge stdio MCP to a local HTTP MCP server")
+        .arg(
+          Arg::new("url")
+            .required(true)
+            .help("HTTP MCP server URL (e.g. http://127.0.0.1:51080/mcp/TOKEN)"),
+        ),
+    )
    .get_matches();

  if let Some(proxy_matches) = matches.subcommand_matches("proxy") {
@@ -461,6 +470,81 @@ async fn main() {
      log::error!("Invalid action for vpn-worker. Use 'start'");
      process::exit(1);
    }
+  } else if let Some(bridge_matches) = matches.subcommand_matches("mcp-bridge") {
+    let url = bridge_matches
+      .get_one::<String>("url")
+      .expect("url is required")
+      .clone();
+
+    // Suppress debug logging for bridge mode — stderr noise confuses MCP clients
+    log::set_max_level(log::LevelFilter::Warn);
+
+    // stdio↔HTTP MCP bridge: translates stdio JSON-RPC to Streamable HTTP transport
+    let client = reqwest::Client::new();
+    let stdin = tokio::io::stdin();
+    let reader = tokio::io::BufReader::new(stdin);
+    let mut session_id: Option<String> = None;
+
+    use tokio::io::{AsyncBufReadExt, AsyncWriteExt};
+    let mut lines = reader.lines();
+    let mut stdout = tokio::io::stdout();
+
+    while let Ok(Some(line)) = lines.next_line().await {
+      if line.trim().is_empty() {
+        continue;
+      }
+
+      // Check if this is a notification (no "id" field) to handle 202 responses
+      let is_notification = serde_json::from_str::<serde_json::Value>(&line)
+        .ok()
+        .map(|v| v.get("id").is_none() || v["id"].is_null())
+        .unwrap_or(false);
+
+      let mut req = client
+        .post(&url)
+        .header("Content-Type", "application/json")
+        .header("Accept", "application/json");
+
+      if let Some(sid) = &session_id {
+        req = req.header("mcp-session-id", sid);
+      }
+
+      match req.body(line).send().await {
+        Ok(resp) => {
+          // Capture session ID from initialize response
+          if let Some(sid) = resp.headers().get("mcp-session-id") {
+            if let Ok(s) = sid.to_str() {
+              session_id = Some(s.to_string());
+            }
+          }
+
+          // Notifications return 202 with no body — don't write anything
+          if is_notification {
+            continue;
+          }
+
+          if let Ok(body) = resp.text().await {
+            if !body.is_empty() {
+              let _ = stdout.write_all(body.as_bytes()).await;
+              let _ = stdout.write_all(b"\n").await;
+              let _ = stdout.flush().await;
+            }
+          }
+        }
+        Err(e) => {
+          if !is_notification {
+            let err = serde_json::json!({
+              "jsonrpc": "2.0",
+              "id": null,
+              "error": {"code": -32000, "message": format!("HTTP error: {e}")},
+            });
+            let _ = stdout.write_all(err.to_string().as_bytes()).await;
+            let _ = stdout.write_all(b"\n").await;
+            let _ = stdout.flush().await;
+          }
+        }
+      }
+    }
  } else {
    log::error!("No command specified");
    process::exit(1);
@@ -689,7 +689,6 @@ impl Browser for WayfernBrowser {
      "--disable-session-crashed-bubble".to_string(),
      "--hide-crash-restore-bubble".to_string(),
      "--disable-infobars".to_string(),
-      "--disable-quic".to_string(),
      // Wayfern-specific args for automation
      "--disable-features=DialMediaRouteProvider".to_string(),
      "--use-mock-keychain".to_string(),
@@ -1166,6 +1165,67 @@ mod tests {
    assert_eq!(deserialized.host, proxy.host, "Host should match");
    assert_eq!(deserialized.port, proxy.port, "Port should match");
  }
+
+  #[test]
+  fn test_wayfern_config_has_no_executable_path() {
+    // Verify WayfernConfig does not store executable_path
+    let config = crate::wayfern_manager::WayfernConfig::default();
+    let json = serde_json::to_value(&config).unwrap();
+    assert!(
+      json.get("executable_path").is_none(),
+      "WayfernConfig should not have executable_path field"
+    );
+  }
+
+  #[test]
+  fn test_camoufox_config_has_no_executable_path() {
+    // Verify CamoufoxConfig does not store executable_path
+    let config = crate::camoufox_manager::CamoufoxConfig::default();
+    let json = serde_json::to_value(&config).unwrap();
+    assert!(
+      json.get("executable_path").is_none(),
+      "CamoufoxConfig should not have executable_path field"
+    );
+  }
+
+  #[test]
+  fn test_profile_data_path_is_dynamic() {
+    use crate::profile::BrowserProfile;
+    let profiles_dir = std::path::PathBuf::from("/fake/profiles");
+    let profile = BrowserProfile {
+      id: uuid::Uuid::parse_str("12345678-1234-1234-1234-123456789abc").unwrap(),
+      name: "test".to_string(),
+      browser: "wayfern".to_string(),
+      version: "1.0.0".to_string(),
+      proxy_id: None,
+      vpn_id: None,
+      process_id: None,
+      last_launch: None,
+      release_type: "stable".to_string(),
+      camoufox_config: None,
+      wayfern_config: None,
+      group_id: None,
+      tags: Vec::new(),
+      note: None,
+      sync_mode: crate::profile::types::SyncMode::Disabled,
+      encryption_salt: None,
+      last_sync: None,
+      host_os: None,
+      ephemeral: false,
+      extension_group_id: None,
+      proxy_bypass_rules: Vec::new(),
+      created_by_id: None,
+      created_by_email: None,
+    };
+
+    let path = profile.get_profile_data_path(&profiles_dir);
+    assert_eq!(
+      path,
+      profiles_dir
+        .join("12345678-1234-1234-1234-123456789abc")
+        .join("profile")
+    );
+  }
 }

 // Global singleton instance
@@ -2204,11 +2204,13 @@ pub async fn launch_browser_profile(
  // Team lock check: if profile is sync-enabled and user is on a team, acquire lock
  crate::team_lock::acquire_team_lock_if_needed(&profile).await?;

-  // Notify sync scheduler that profile is now running
+  // Notify sync scheduler that profile is now running and queue sync for when it stops
  if let Some(scheduler) = crate::sync::get_global_scheduler() {
-    scheduler
-      .mark_profile_running(&profile.id.to_string())
-      .await;
+    let pid = profile.id.to_string();
+    scheduler.mark_profile_running(&pid).await;
+    if profile.is_sync_enabled() {
+      scheduler.queue_profile_sync(pid).await;
+    }
  }

  let browser_runner = BrowserRunner::instance();
@@ -2421,14 +2423,11 @@ pub async fn kill_browser_profile(
      // Release team lock if applicable
      crate::team_lock::release_team_lock_if_needed(&profile).await;

-      // Notify sync scheduler that profile stopped and queue sync
+      // Notify sync scheduler that profile stopped (sync was queued at launch)
      if let Some(scheduler) = crate::sync::get_global_scheduler() {
-        let pid = profile.id.to_string();
-        scheduler.mark_profile_stopped(&pid).await;
-        if profile.is_sync_enabled() {
-          log::info!("Profile '{}' killed, queuing sync", profile.name);
-          scheduler.queue_profile_sync(pid).await;
-        }
+        scheduler
+          .mark_profile_stopped(&profile.id.to_string())
+          .await;
      }

      // Auto-update non-running profiles and cleanup unused binaries
@@ -21,7 +21,6 @@ pub struct CamoufoxConfig {
  pub block_images: Option<bool>,
  pub block_webrtc: Option<bool>,
  pub block_webgl: Option<bool>,
-  pub executable_path: Option<String>,
  pub fingerprint: Option<String>, // JSON string of the complete fingerprint config
  pub randomize_fingerprint_on_launch: Option<bool>, // Generate new fingerprint on every launch
  pub os: Option<String>, // Operating system for fingerprint generation: "windows", "macos", or "linux"
@@ -39,7 +38,6 @@ impl Default for CamoufoxConfig {
      block_images: None,
      block_webrtc: None,
      block_webgl: None,
-      executable_path: None,
      fingerprint: None,
      randomize_fingerprint_on_launch: None,
      os: None,
@@ -129,21 +127,9 @@ impl CamoufoxManager {
    config: &CamoufoxConfig,
  ) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
    // Get executable path
-    let executable_path = if let Some(path) = &config.executable_path {
-      let p = PathBuf::from(path);
-      if p.exists() {
-        p
-      } else {
-        log::warn!("Stored Camoufox executable path does not exist: {path}, falling back to dynamic resolution");
-        BrowserRunner::instance()
-          .get_browser_executable_path(profile)
-          .map_err(|e| format!("Failed to get Camoufox executable path: {e}"))?
-      }
-    } else {
-      BrowserRunner::instance()
-        .get_browser_executable_path(profile)
-        .map_err(|e| format!("Failed to get Camoufox executable path: {e}"))?
-    };
+    let executable_path = BrowserRunner::instance()
+      .get_browser_executable_path(profile)
+      .map_err(|e| format!("Failed to get Camoufox executable path: {e}"))?;

    // Build the config using CamoufoxConfigBuilder
    let mut builder = CamoufoxConfigBuilder::new()
@@ -230,21 +216,9 @@ impl CamoufoxManager {
    };

    // Get executable path
-    let executable_path = if let Some(path) = &config.executable_path {
-      let p = PathBuf::from(path);
-      if p.exists() {
-        p
-      } else {
-        log::warn!("Stored Camoufox executable path does not exist: {path}, falling back to dynamic resolution");
-        BrowserRunner::instance()
-          .get_browser_executable_path(profile)
-          .map_err(|e| format!("Failed to get Camoufox executable path: {e}"))?
-      }
-    } else {
-      BrowserRunner::instance()
-        .get_browser_executable_path(profile)
-        .map_err(|e| format!("Failed to get Camoufox executable path: {e}"))?
-    };
+    let executable_path = BrowserRunner::instance()
+      .get_browser_executable_path(profile)
+      .map_err(|e| format!("Failed to get Camoufox executable path: {e}"))?;

    // Parse the fingerprint config JSON
    let fingerprint_config: HashMap<String, serde_json::Value> =
@@ -10,7 +10,7 @@ use tauri::AppHandle;
 /// Chromium cookie encryption/decryption support.
 /// On macOS: uses "Chromium Safe Storage" key from Keychain with PBKDF2 + AES-128-CBC.
 /// On Linux: uses os_crypt_key file from profile directory with PBKDF2 + AES-128-CBC.
-mod chrome_decrypt {
+pub mod chrome_decrypt {
  use aes::cipher::{block_padding::Pkcs7, BlockDecryptMut, BlockEncryptMut, KeyIvInit};
  use std::path::Path;

@@ -340,6 +340,9 @@ pub fn is_autostart_enabled() -> bool {
 }

 pub fn get_data_dir() -> Option<PathBuf> {
+  if crate::app_dirs::is_portable() {
+    return Some(crate::app_dirs::data_dir());
+  }
  if let Some(proj_dirs) = ProjectDirs::from("com", "donutbrowser", "Donut Browser") {
    Some(proj_dirs.data_dir().to_path_buf())
  } else {
@@ -1,4 +1,5 @@
 // Daemon Spawn - Start the daemon from the GUI
+// Currently disabled; will be re-enabled in the future

 use serde::Deserialize;
 use std::fs;
@@ -323,9 +323,10 @@ impl Downloader {
      existing_size = meta.len();
    }

-    // Build request, add Range only if we have bytes. If the server responds with 416 (Range Not
-    // Satisfiable), delete the partial file and retry once without the Range header.
-    let response = {
+    // Build request with retry logic for transient network errors.
+    let max_retries = 3u32;
+    let mut response: Option<reqwest::Response> = None;
+    for attempt in 0..=max_retries {
      let mut request = self
        .client
        .get(&download_url)
@@ -338,33 +339,43 @@ impl Downloader {
        request = request.header("Range", format!("bytes={existing_size}-"));
      }

-      log::info!("Sending download request...");
-      let first = request.send().await?;
-      log::info!(
-        "Download response received: status={}, content-length={:?}",
-        first.status(),
-        first.content_length()
-      );
-
-      if first.status().as_u16() == 416 && existing_size > 0 {
-        // Partial file on disk is not acceptable to the server — remove it and retry from scratch
-        let _ = std::fs::remove_file(&file_path);
-        existing_size = 0;
-
-        let retry = self
-          .client
-          .get(&download_url)
-          .header(
-            "User-Agent",
-            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
-          )
-          .send()
-          .await?;
-        retry
-      } else {
-        first
+      log::info!("Sending download request (attempt {})...", attempt + 1);
+      match request.send().await {
+        Ok(resp) => {
+          log::info!(
+            "Download response received: status={}, content-length={:?}",
+            resp.status(),
+            resp.content_length()
+          );
+          if resp.status().as_u16() == 416 && existing_size > 0 {
+            let _ = std::fs::remove_file(&file_path);
+            existing_size = 0;
+            log::warn!("Download returned 416, retrying without Range header");
+            continue;
+          }
+          response = Some(resp);
+          break;
+        }
+        Err(e) => {
+          let is_retryable = e.is_connect() || e.is_timeout() || e.is_request();
+          if is_retryable && attempt < max_retries {
+            let delay = 2u64.pow(attempt);
+            log::warn!(
+              "Download attempt {} failed ({}), retrying in {}s...",
+              attempt + 1,
+              e,
+              delay
+            );
+            tokio::time::sleep(std::time::Duration::from_secs(delay)).await;
+          } else {
+            return Err(format!("Download failed after {} attempts: {}", attempt + 1, e).into());
+          }
+        }
      }
-    };
+    }
+    let response = response.ok_or_else(|| -> Box<dyn std::error::Error + Send + Sync> {
+      "Download failed: no response received".into()
+    })?;

    // Check if the response is successful (200 OK or 206 Partial Content)
    if !(response.status().is_success() || response.status().as_u16() == 206) {
@@ -283,6 +283,9 @@ mod tests {
  #[test]
  #[serial_test::serial]
  fn test_ephemeral_dir_lifecycle() {
+    // Clear global state to avoid interference from other tests
+    EPHEMERAL_DIRS.lock().unwrap().clear();
+
    let profile_id = uuid::Uuid::new_v4();
    let id_str = profile_id.to_string();

@@ -1091,12 +1091,6 @@ lazy_static::lazy_static! {

 #[tauri::command]
 pub async fn list_extensions() -> Result<Vec<Extension>, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .list_extensions()
@@ -1115,12 +1109,6 @@ pub async fn add_extension(
  file_name: String,
  file_data: Vec<u8>,
 ) -> Result<Extension, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .add_extension(name, file_name, file_data)
@@ -1134,12 +1122,6 @@ pub async fn update_extension(
  file_name: Option<String>,
  file_data: Option<Vec<u8>>,
 ) -> Result<Extension, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .update_extension(&extension_id, name, file_name, file_data)
@@ -1151,12 +1133,6 @@ pub async fn delete_extension(
  app_handle: tauri::AppHandle,
  extension_id: String,
 ) -> Result<(), String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .delete_extension(&app_handle, &extension_id)
@@ -1165,12 +1141,6 @@ pub async fn delete_extension(

 #[tauri::command]
 pub async fn list_extension_groups() -> Result<Vec<ExtensionGroup>, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .list_groups()
@@ -1179,12 +1149,6 @@ pub async fn list_extension_groups() -> Result<Vec<ExtensionGroup>, String> {

 #[tauri::command]
 pub async fn create_extension_group(name: String) -> Result<ExtensionGroup, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .create_group(name)
@@ -1197,12 +1161,6 @@ pub async fn update_extension_group(
  name: Option<String>,
  extension_ids: Option<Vec<String>>,
 ) -> Result<ExtensionGroup, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .update_group(&group_id, name, extension_ids)
@@ -1214,12 +1172,6 @@ pub async fn delete_extension_group(
  app_handle: tauri::AppHandle,
  group_id: String,
 ) -> Result<(), String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .delete_group(&app_handle, &group_id)
@@ -1231,12 +1183,6 @@ pub async fn add_extension_to_group(
  group_id: String,
  extension_id: String,
 ) -> Result<ExtensionGroup, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .add_extension_to_group(&group_id, &extension_id)
@@ -1248,12 +1194,6 @@ pub async fn remove_extension_from_group(
  group_id: String,
  extension_id: String,
 ) -> Result<ExtensionGroup, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
  let mgr = EXTENSION_MANAGER.lock().unwrap();
  mgr
    .remove_extension_from_group(&group_id, &extension_id)
@@ -1265,13 +1205,6 @@ pub async fn assign_extension_group_to_profile(
  profile_id: String,
  extension_group_id: Option<String>,
 ) -> Result<crate::profile::BrowserProfile, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Extension management requires an active Pro subscription".to_string());
-  }
-
  // Validate compatibility if assigning a group
  if let Some(ref group_id) = extension_group_id {
    let profile_manager = crate::profile::ProfileManager::instance();
@@ -207,6 +207,20 @@ impl Extractor {

    match extraction_result {
      Ok(path) => {
+        // Remove quarantine attributes on macOS to prevent
+        // "app was prevented from modifying data" prompts
+        #[cfg(target_os = "macos")]
+        {
+          let _ = tokio::process::Command::new("xattr")
+            .args([
+              "-dr",
+              "com.apple.quarantine",
+              dest_dir.to_str().unwrap_or("."),
+            ])
+            .output()
+            .await;
+        }
+
        log::info!(
          "Successfully extracted {} {} to: {}",
          browser_type.as_str(),
@@ -47,6 +47,7 @@ mod commercial_license;
 mod cookie_manager;
 pub mod daemon;
 pub mod daemon_client;
+#[allow(dead_code)]
 mod daemon_spawn;
 pub mod daemon_ws;
 pub mod events;
@@ -84,7 +85,7 @@ use downloader::{cancel_download, download_browser};

 use settings_manager::{
  decline_launch_on_login, dismiss_window_resize_warning, enable_launch_on_login, get_app_settings,
-  get_sync_settings, get_system_language, get_table_sorting_settings,
+  get_sync_settings, get_system_info, get_system_language, get_table_sorting_settings,
  get_window_resize_warning_dismissed, save_app_settings, save_sync_settings,
  save_table_sorting_settings, should_show_launch_on_login_prompt,
 };
@@ -356,12 +357,6 @@ async fn copy_profile_cookies(
  app_handle: tauri::AppHandle,
  request: cookie_manager::CookieCopyRequest,
 ) -> Result<Vec<cookie_manager::CookieCopyResult>, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Cookie copying requires an active Pro subscription".to_string());
-  }
  let target_ids = request.target_profile_ids.clone();
  let results = cookie_manager::CookieManager::copy_cookies(&app_handle, request).await?;

@@ -397,12 +392,6 @@ async fn import_cookies_from_file(
  profile_id: String,
  content: String,
 ) -> Result<cookie_manager::CookieImportResult, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Cookie import requires an active Pro subscription".to_string());
-  }
  let result =
    cookie_manager::CookieManager::import_cookies(&app_handle, &profile_id, &content).await?;

@@ -426,12 +415,6 @@ async fn import_cookies_from_file(

 #[tauri::command]
 async fn export_profile_cookies(profile_id: String, format: String) -> Result<String, String> {
-  if !crate::cloud_auth::CLOUD_AUTH
-    .has_active_paid_subscription()
-    .await
-  {
-    return Err("Cookie export requires an active Pro subscription".to_string());
-  }
  cookie_manager::CookieManager::export_cookies(&profile_id, &format)
 }

@@ -492,7 +475,6 @@ fn get_mcp_server_status() -> bool {
 struct McpConfig {
  port: u16,
  token: String,
-  config_json: String,
 }

 #[tauri::command]
@@ -513,23 +495,283 @@ async fn get_mcp_config(app_handle: tauri::AppHandle) -> Result<Option<McpConfig
    .map_err(|e| format!("Failed to get MCP token: {e}"))?
    .ok_or("MCP token not found")?;

-  let config_json = serde_json::json!({
-    "mcpServers": {
-      "donut-browser": {
-        "url": format!("http://127.0.0.1:{}/mcp", port),
-        "headers": {
-          "Authorization": format!("Bearer {}", token)
-        }
+  Ok(Some(McpConfig { port, token }))
+}
+
+fn claude_desktop_extension_dir() -> Option<std::path::PathBuf> {
+  #[cfg(target_os = "macos")]
+  {
+    dirs::home_dir().map(|h| {
+      h.join("Library")
+        .join("Application Support")
+        .join("Claude")
+        .join("Claude Extensions")
+        .join("local.mcpb.donut-browser.donut-browser")
+    })
+  }
+  #[cfg(target_os = "windows")]
+  {
+    std::env::var("APPDATA").ok().map(|appdata| {
+      std::path::PathBuf::from(appdata)
+        .join("Claude")
+        .join("Claude Extensions")
+        .join("local.mcpb.donut-browser.donut-browser")
+    })
+  }
+  #[cfg(target_os = "linux")]
+  {
+    dirs::config_dir().map(|c| {
+      c.join("Claude")
+        .join("Claude Extensions")
+        .join("local.mcpb.donut-browser.donut-browser")
+    })
+  }
+}
+
+#[tauri::command]
+fn is_mcp_in_claude_desktop() -> Result<bool, String> {
+  let dir = claude_desktop_extension_dir().ok_or("Unsupported platform")?;
+  Ok(dir.join("manifest.json").exists())
+}
+
+#[tauri::command]
+async fn add_mcp_to_claude_desktop(app_handle: tauri::AppHandle) -> Result<(), String> {
+  let mcp_server = mcp_server::McpServer::instance();
+  let port = mcp_server.get_port().ok_or("MCP server is not running")?;
+
+  let settings_manager = settings_manager::SettingsManager::instance();
+  let token = settings_manager
+    .get_mcp_token(&app_handle)
+    .await
+    .map_err(|e| format!("Failed to get MCP token: {e}"))?
+    .ok_or("MCP token not found")?;
+
+  let ext_dir = claude_desktop_extension_dir().ok_or("Unsupported platform")?;
+  let server_dir = ext_dir.join("server");
+  std::fs::create_dir_all(&server_dir)
+    .map_err(|e| format!("Failed to create extension directory: {e}"))?;
+
+  let mcp_url = format!("http://127.0.0.1:{port}/mcp/{token}");
+
+  let manifest = serde_json::json!({
+    "manifest_version": "0.3",
+    "name": "donut-browser",
+    "display_name": "Donut Browser",
+    "version": env!("CARGO_PKG_VERSION"),
+    "description": "Control Donut Browser profiles, proxies, and automation via MCP",
+    "author": { "name": "Donut Browser" },
+    "tools_generated": true,
+    "server": {
+      "type": "node",
+      "entry_point": "server/index.js",
+      "mcp_config": {
+        "command": "node",
+        "args": ["${__dirname}/server/index.js"],
+        "env": {}
+      }
+    },
+    "license": "AGPL-3.0"
+  });
+  std::fs::write(
+    ext_dir.join("manifest.json"),
+    serde_json::to_string_pretty(&manifest)
+      .map_err(|e| format!("Failed to serialize manifest: {e}"))?,
+  )
+  .map_err(|e| format!("Failed to write manifest: {e}"))?;
+
+  let bridge_js = format!(
+    r#"#!/usr/bin/env node
+const http = require("http");
+const readline = require("readline");
+const MCP_URL = "{mcp_url}";
+let sid = null;
+function post(line) {{
+  return new Promise((resolve, reject) => {{
+    const u = new URL(MCP_URL);
+    const o = {{
+      hostname: u.hostname, port: u.port, path: u.pathname, method: "POST",
+      headers: {{ "Content-Type": "application/json", Accept: "application/json" }},
+    }};
+    if (sid) o.headers["mcp-session-id"] = sid;
+    const r = http.request(o, (res) => {{
+      const s = res.headers["mcp-session-id"];
+      if (s) sid = s;
+      let b = "";
+      res.on("data", (c) => (b += c));
+      res.on("end", () => resolve(b));
+    }});
+    r.on("error", reject);
+    r.write(line);
+    r.end();
+  }});
+}}
+const rl = readline.createInterface({{ input: process.stdin, crlfDelay: Infinity }});
+rl.on("line", (line) => {{
+  if (!line.trim()) return;
+  let notif = false;
+  try {{ notif = JSON.parse(line).id == null; }} catch {{}}
+  post(line).then((b) => {{
+    if (!notif && b.trim()) process.stdout.write(b.trim() + "\n");
+  }}).catch((e) => {{
+    if (!notif) process.stdout.write(JSON.stringify({{
+      jsonrpc: "2.0", id: null, error: {{ code: -32000, message: "HTTP error: " + e.message }}
+    }}) + "\n");
+  }});
+}});
+rl.on("close", () => setTimeout(() => process.exit(0), 500));
+"#
+  );
+  std::fs::write(server_dir.join("index.js"), bridge_js)
+    .map_err(|e| format!("Failed to write bridge script: {e}"))?;
+
+  // Update the extensions-installations.json registry so Claude Desktop picks it up
+  update_claude_extensions_registry("local.mcpb.donut-browser.donut-browser", Some(manifest))?;
+
+  Ok(())
+}
+
+#[tauri::command]
+fn remove_mcp_from_claude_desktop() -> Result<(), String> {
+  let ext_dir = claude_desktop_extension_dir().ok_or("Unsupported platform")?;
+  if ext_dir.exists() {
+    std::fs::remove_dir_all(&ext_dir).map_err(|e| format!("Failed to remove extension: {e}"))?;
+  }
+  update_claude_extensions_registry("local.mcpb.donut-browser.donut-browser", None)?;
+  Ok(())
+}
+
+fn update_claude_extensions_registry(
+  ext_id: &str,
+  manifest: Option<serde_json::Value>,
+) -> Result<(), String> {
+  let registry_path = claude_desktop_extension_dir()
+    .ok_or("Unsupported platform")?
+    .parent()
+    .and_then(|p| p.parent())
+    .map(|p| p.join("extensions-installations.json"))
+    .ok_or("Failed to resolve registry path")?;
+
+  let mut registry: serde_json::Value = if registry_path.exists() {
+    let content = std::fs::read_to_string(&registry_path)
+      .map_err(|e| format!("Failed to read registry: {e}"))?;
+    serde_json::from_str(&content).unwrap_or(serde_json::json!({"extensions": {}}))
+  } else {
+    serde_json::json!({"extensions": {}})
+  };
+
+  if registry.get("extensions").is_none() {
+    registry["extensions"] = serde_json::json!({});
+  }
+
+  match manifest {
+    Some(m) => {
+      registry["extensions"][ext_id] = serde_json::json!({
+        "id": ext_id,
+        "version": m.get("version").and_then(|v| v.as_str()).unwrap_or("0.0.0"),
+        "hash": "",
+        "installedAt": chrono::Utc::now().to_rfc3339(),
+        "manifest": m,
+        "signatureInfo": { "status": "unsigned" },
+        "source": "local"
+      });
+    }
+    None => {
+      if let Some(exts) = registry
+        .get_mut("extensions")
+        .and_then(|e| e.as_object_mut())
+      {
+        exts.remove(ext_id);
      }
    }
-  })
-  .to_string();
+  }

-  Ok(Some(McpConfig {
-    port,
-    token,
-    config_json,
-  }))
+  let output =
+    serde_json::to_string(&registry).map_err(|e| format!("Failed to serialize registry: {e}"))?;
+  let tmp = registry_path.with_extension("json.tmp");
+  std::fs::write(&tmp, &output).map_err(|e| format!("Failed to write registry: {e}"))?;
+  std::fs::rename(&tmp, &registry_path).map_err(|e| format!("Failed to save registry: {e}"))?;
+  Ok(())
+}
+
+fn find_claude_cli() -> Option<std::path::PathBuf> {
+  let mut candidates: Vec<std::path::PathBuf> = vec![
+    std::path::PathBuf::from("/usr/local/bin/claude"),
+    std::path::PathBuf::from("/opt/homebrew/bin/claude"),
+  ];
+  if let Some(home) = dirs::home_dir() {
+    candidates.insert(0, home.join(".local/bin/claude"));
+    candidates.push(home.join(".claude/local/claude"));
+  }
+  #[cfg(windows)]
+  if let Ok(appdata) = std::env::var("APPDATA") {
+    candidates.insert(
+      0,
+      std::path::PathBuf::from(appdata).join("Claude/claude.exe"),
+    );
+  }
+  for p in &candidates {
+    if p.exists() {
+      return Some(p.clone());
+    }
+  }
+  None
+}
+
+#[tauri::command]
+fn is_mcp_in_claude_code() -> Result<bool, String> {
+  let cli = find_claude_cli().ok_or("Claude Code CLI not found")?;
+  let output = std::process::Command::new(&cli)
+    .args(["mcp", "list"])
+    .output()
+    .map_err(|e| format!("Failed to run claude: {e}"))?;
+  let stdout = String::from_utf8_lossy(&output.stdout);
+  Ok(stdout.contains("donut-browser"))
+}
+
+#[tauri::command]
+async fn add_mcp_to_claude_code(app_handle: tauri::AppHandle) -> Result<(), String> {
+  let cli = find_claude_cli().ok_or("Claude Code CLI not found")?;
+
+  let mcp_server = mcp_server::McpServer::instance();
+  let port = mcp_server.get_port().ok_or("MCP server is not running")?;
+
+  let settings_manager = settings_manager::SettingsManager::instance();
+  let token = settings_manager
+    .get_mcp_token(&app_handle)
+    .await
+    .map_err(|e| format!("Failed to get MCP token: {e}"))?
+    .ok_or("MCP token not found")?;
+
+  let url = format!("http://127.0.0.1:{port}/mcp/{token}");
+
+  let _ = std::process::Command::new(&cli)
+    .args(["mcp", "remove", "donut-browser"])
+    .output();
+
+  let output = std::process::Command::new(&cli)
+    .args(["mcp", "add", "--transport", "http", "donut-browser", &url])
+    .output()
+    .map_err(|e| format!("Failed to run claude: {e}"))?;
+
+  if !output.status.success() {
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    return Err(format!("Failed to add MCP to Claude Code: {stderr}"));
+  }
+  Ok(())
+}
+
+#[tauri::command]
+fn remove_mcp_from_claude_code() -> Result<(), String> {
+  let cli = find_claude_cli().ok_or("Claude Code CLI not found")?;
+  let output = std::process::Command::new(&cli)
+    .args(["mcp", "remove", "donut-browser"])
+    .output()
+    .map_err(|e| format!("Failed to run claude: {e}"))?;
+  if !output.status.success() {
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    return Err(format!("Failed to remove MCP from Claude Code: {stderr}"));
+  }
+  Ok(())
 }

 #[tauri::command]
@@ -983,38 +1225,13 @@ pub fn run() {
        mgr.ensure_icons_extracted();
      }

-      // Start the daemon for tray icon
-      if let Err(e) = daemon_spawn::ensure_daemon_running() {
-        log::warn!("Failed to start daemon: {e}");
-      }
-
-      // Register this GUI's PID in daemon state so the daemon can kill us directly
-      daemon_spawn::register_gui_pid();
-
-      // Monitor daemon health - quit GUI if daemon dies
-      tauri::async_runtime::spawn(async move {
-        // Give the daemon time to fully start
-        tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
-
-        let mut interval = tokio::time::interval(tokio::time::Duration::from_secs(1));
-        interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
-
-        loop {
-          interval.tick().await;
-
-          let is_running = tokio::task::spawn_blocking(daemon_spawn::is_daemon_running)
-            .await
-            .unwrap_or(false);
-
-          if !is_running {
-            log::warn!("Daemon is no longer running, quitting GUI immediately");
-            // Use process::exit for immediate termination. Tauri's exit()
-            // triggers a slow graceful shutdown that can take over a minute
-            // waiting for async tasks (sync, version updater, etc.) to finish.
-            std::process::exit(0);
-          }
+      // Daemon (tray icon) is currently disabled — clean up any existing autostart
+      if daemon::autostart::is_autostart_enabled() {
+        log::info!("Removing daemon autostart (daemon is disabled)");
+        if let Err(e) = daemon::autostart::disable_autostart() {
+          log::warn!("Failed to remove daemon autostart: {e}");
        }
-      });
+      }

      // Create the main window programmatically
      #[allow(unused_variables)]
@@ -1421,12 +1638,8 @@ pub fn run() {
                    if is_running {
                      scheduler.mark_profile_running(&profile_id).await;
                    } else {
+                      // Sync was queued at launch; mark_profile_stopped triggers it
                      scheduler.mark_profile_stopped(&profile_id).await;
-                      // Queue sync after profile stops (if sync is enabled)
-                      if profile.is_sync_enabled() {
-                        log::info!("Profile '{}' stopped, queuing sync", profile.name);
-                        scheduler.queue_profile_sync(profile_id.clone()).await;
-                      }
                    }
                  }

@@ -1603,6 +1816,7 @@ pub fn run() {
      get_table_sorting_settings,
      save_table_sorting_settings,
      get_system_language,
+      get_system_info,
      dismiss_window_resize_warning,
      get_window_resize_warning_dismissed,
      clear_all_version_cache_and_refetch,
@@ -1697,6 +1911,12 @@ pub fn run() {
      stop_mcp_server,
      get_mcp_server_status,
      get_mcp_config,
+      is_mcp_in_claude_desktop,
+      add_mcp_to_claude_desktop,
+      remove_mcp_from_claude_desktop,
+      is_mcp_in_claude_code,
+      add_mcp_to_claude_code,
+      remove_mcp_from_claude_code,
      // VPN commands
      import_vpn_config,
      list_vpn_configs,
@@ -41,7 +41,7 @@ pub struct McpRequest {
  params: Option<serde_json::Value>,
 }

-const PROTOCOL_VERSION: &str = "2025-03-26";
+const PROTOCOL_VERSION: &str = "2025-11-25";
 const SERVER_NAME: &str = "donut-browser";
 const SERVER_VERSION: &str = env!("CARGO_PKG_VERSION");

@@ -202,7 +202,6 @@ impl McpServer {
      return Ok(preferred);
    }

-    // Try random ports in 51000-51999 range
    for _ in 0..10 {
      let port = 51000 + (rand::random::<u16>() % 1000);
      let addr = SocketAddr::from(([127, 0, 0, 1], port));
@@ -220,6 +219,12 @@ impl McpServer {
    shutdown_rx: tokio::sync::oneshot::Receiver<()>,
  ) {
    let app = Router::new()
+      .route(
+        "/mcp/{token}",
+        post(Self::handle_mcp_post)
+          .get(Self::handle_mcp_get)
+          .delete(Self::handle_mcp_delete),
+      )
      .route(
        "/mcp",
        post(Self::handle_mcp_post)
@@ -234,26 +239,26 @@ impl McpServer {
      .with_state(state);

    let addr = SocketAddr::from(([127, 0, 0, 1], port));
-    let listener = match TcpListener::bind(addr).await {
-      Ok(l) => l,
-      Err(e) => {
-        log::error!("[mcp] Failed to bind to port {}: {}", port, e);
-        return;
+
+    let server = async {
+      match TcpListener::bind(addr).await {
+        Ok(listener) => {
+          log::info!("[mcp] Server listening on http://127.0.0.1:{}/mcp", port);
+          if let Err(e) = axum::serve(listener, app).await {
+            log::error!("[mcp] Server error: {}", e);
+          }
+        }
+        Err(e) => {
+          log::error!("[mcp] Failed to bind on port {}: {}", port, e);
+        }
      }
    };

-    log::info!(
-      "[mcp] HTTP server listening on http://127.0.0.1:{}/mcp",
-      port
-    );
-
-    let server = axum::serve(listener, app).with_graceful_shutdown(async {
-      let _ = shutdown_rx.await;
-      log::info!("[mcp] HTTP server shutting down");
-    });
-
-    if let Err(e) = server.await {
-      log::error!("[mcp] HTTP server error: {}", e);
+    tokio::select! {
+      _ = server => {},
+      _ = shutdown_rx => {
+        log::info!("[mcp] Server shutting down");
+      },
    }
  }

@@ -262,19 +267,28 @@ impl McpServer {
    req: Request<Body>,
    next: Next,
  ) -> Result<Response, StatusCode> {
-    // Health endpoint is public
-    if req.uri().path() == "/health" {
+    let path = req.uri().path();
+
+    if path == "/health" {
      return Ok(next.run(req).await);
    }

-    let auth_header = req
+    // Check token from URL path: /mcp/{token}
+    let path_token = path
+      .strip_prefix("/mcp/")
+      .filter(|t| !t.is_empty() && !t.contains('/'));
+
+    // Check token from Authorization header
+    let header_token = req
      .headers()
      .get(header::AUTHORIZATION)
-      .and_then(|h| h.to_str().ok());
+      .and_then(|h| h.to_str().ok())
+      .and_then(|h| h.strip_prefix("Bearer "));

-    let token = auth_header.and_then(|h| h.strip_prefix("Bearer "));
+    let valid =
+      path_token == Some(state.token.as_str()) || header_token == Some(state.token.as_str());

-    if token != Some(&state.token) {
+    if !valid {
      return Err(StatusCode::UNAUTHORIZED);
    }

@@ -94,29 +94,6 @@ impl ProfileManager {
        crate::camoufox_manager::CamoufoxConfig::default()
      });

-      // Always ensure executable_path is set to the user's binary location
-      if config.executable_path.is_none() {
-        let mut browser_dir = self.get_binaries_dir();
-        browser_dir.push(browser);
-        browser_dir.push(version);
-
-        #[cfg(target_os = "macos")]
-        let binary_path = browser_dir
-          .join("Camoufox.app")
-          .join("Contents")
-          .join("MacOS")
-          .join("camoufox");
-
-        #[cfg(target_os = "windows")]
-        let binary_path = browser_dir.join("camoufox.exe");
-
-        #[cfg(target_os = "linux")]
-        let binary_path = browser_dir.join("camoufox");
-
-        config.executable_path = Some(binary_path.to_string_lossy().to_string());
-        log::info!("Set Camoufox executable path: {:?}", config.executable_path);
-      }
-
      // Pass upstream proxy information to config for fingerprint generation
      if let Some(proxy_id_ref) = &proxy_id {
        if let Some(proxy_settings) = PROXY_MANAGER.get_proxy_settings_by_id(proxy_id_ref) {
@@ -219,28 +196,6 @@ impl ProfileManager {
      });

      // Always ensure executable_path is set to the user's binary location
-      if config.executable_path.is_none() {
-        let mut browser_dir = self.get_binaries_dir();
-        browser_dir.push(browser);
-        browser_dir.push(version);
-
-        #[cfg(target_os = "macos")]
-        let binary_path = browser_dir
-          .join("Chromium.app")
-          .join("Contents")
-          .join("MacOS")
-          .join("Chromium");
-
-        #[cfg(target_os = "windows")]
-        let binary_path = browser_dir.join("chrome.exe");
-
-        #[cfg(target_os = "linux")]
-        let binary_path = browser_dir.join("chrome");
-
-        config.executable_path = Some(binary_path.to_string_lossy().to_string());
-        log::info!("Set Wayfern executable path: {:?}", config.executable_path);
-      }
-
      // Pass upstream proxy information to config for fingerprint generation
      if let Some(proxy_id_ref) = &proxy_id {
        if let Some(proxy_settings) = PROXY_MANAGER.get_proxy_settings_by_id(proxy_id_ref) {
@@ -21,7 +21,7 @@ pub enum SyncMode {
  Encrypted,
 }

-#[derive(Debug, Serialize, Deserialize, Clone)]
+#[derive(Debug, Serialize, Deserialize, Clone, Default)]
 pub struct BrowserProfile {
  pub id: uuid::Uuid,
  pub name: String,
@@ -532,27 +532,6 @@ impl ProfileImporter {
    let final_camoufox_config = if mapped == "camoufox" {
      let mut config = camoufox_config.unwrap_or_default();

-      if config.executable_path.is_none() {
-        let mut browser_dir = self.profile_manager.get_binaries_dir();
-        browser_dir.push(mapped);
-        browser_dir.push(&version);
-
-        #[cfg(target_os = "macos")]
-        let binary_path = browser_dir
-          .join("Camoufox.app")
-          .join("Contents")
-          .join("MacOS")
-          .join("camoufox");
-
-        #[cfg(target_os = "windows")]
-        let binary_path = browser_dir.join("camoufox.exe");
-
-        #[cfg(target_os = "linux")]
-        let binary_path = browser_dir.join("camoufox");
-
-        config.executable_path = Some(binary_path.to_string_lossy().to_string());
-      }
-
      if let Some(ref proxy_id_val) = proxy_id {
        if let Some(proxy_settings) = PROXY_MANAGER.get_proxy_settings_by_id(proxy_id_val) {
          let proxy_url = if let (Some(username), Some(password)) =
@@ -631,27 +610,6 @@ impl ProfileImporter {
    let final_wayfern_config = if mapped == "wayfern" {
      let mut config = wayfern_config.unwrap_or_default();

-      if config.executable_path.is_none() {
-        let mut browser_dir = self.profile_manager.get_binaries_dir();
-        browser_dir.push(mapped);
-        browser_dir.push(&version);
-
-        #[cfg(target_os = "macos")]
-        let binary_path = browser_dir
-          .join("Chromium.app")
-          .join("Contents")
-          .join("MacOS")
-          .join("Chromium");
-
-        #[cfg(target_os = "windows")]
-        let binary_path = browser_dir.join("chrome.exe");
-
-        #[cfg(target_os = "linux")]
-        let binary_path = browser_dir.join("chrome");
-
-        config.executable_path = Some(binary_path.to_string_lossy().to_string());
-      }
-
      if let Some(ref proxy_id_val) = proxy_id {
        if let Some(proxy_settings) = PROXY_MANAGER.get_proxy_settings_by_id(proxy_id_val) {
          let proxy_url = if let (Some(username), Some(password)) =
@@ -178,10 +178,8 @@ impl SettingsManager {
  }

  pub fn should_show_launch_on_login_prompt(&self) -> Result<bool, Box<dyn std::error::Error>> {
-    let settings = self.load_settings()?;
-    // Show if: user has NOT declined AND autostart is NOT enabled
-    let autostart_enabled = crate::daemon::autostart::is_autostart_enabled();
-    Ok(!settings.launch_on_login_declined && !autostart_enabled)
+    // Daemon is currently disabled, never show this prompt
+    Ok(false)
  }

  pub fn decline_launch_on_login(&self) -> Result<(), Box<dyn std::error::Error>> {
@@ -947,6 +945,42 @@ pub fn get_system_language() -> String {
    .unwrap_or_else(|| "en".to_string())
 }

+#[derive(Debug, Serialize, Clone)]
+pub struct SystemInfo {
+  pub app_version: String,
+  pub os: String,
+  pub arch: String,
+  pub portable: bool,
+}
+
+#[tauri::command]
+pub fn get_system_info() -> SystemInfo {
+  let os = if cfg!(target_os = "macos") {
+    "macOS"
+  } else if cfg!(target_os = "windows") {
+    "Windows"
+  } else if cfg!(target_os = "linux") {
+    "Linux"
+  } else {
+    "Unknown"
+  };
+
+  let arch = if cfg!(target_arch = "x86_64") {
+    "x86_64"
+  } else if cfg!(target_arch = "aarch64") {
+    "aarch64"
+  } else {
+    "unknown"
+  };
+
+  SystemInfo {
+    app_version: crate::app_auto_updater::AppAutoUpdater::get_current_version(),
+    os: os.to_string(),
+    arch: arch.to_string(),
+    portable: crate::app_dirs::is_portable(),
+  }
+}
+
 // Global singleton instance
 lazy_static::lazy_static! {
  static ref SETTINGS_MANAGER: SettingsManager = SettingsManager::new();
@@ -332,11 +332,11 @@ impl SyncEngine {
  ) -> SyncResult<()> {
    if profile.is_cross_os() {
      log::info!(
-        "Skipping file sync for cross-OS profile: {} ({})",
+        "Cross-OS profile: {} ({}) — syncing metadata only",
        profile.name,
        profile.id
      );
-      return Ok(());
+      return self.sync_cross_os_metadata(app_handle, profile).await;
    }

    // Skip team profiles for self-hosted sync
@@ -727,6 +727,63 @@ impl SyncEngine {
    Ok(profile)
  }

+  /// Sync only metadata for cross-OS profiles (tags, notes, proxies, groups).
+  /// No browser files are synced.
+  async fn sync_cross_os_metadata(
+    &self,
+    app_handle: &tauri::AppHandle,
+    profile: &BrowserProfile,
+  ) -> SyncResult<()> {
+    let profile_id = profile.id.to_string();
+    let key_prefix = Self::get_team_key_prefix(profile).await;
+    let profile_manager = ProfileManager::instance();
+
+    // Upload our metadata
+    self
+      .upload_profile_metadata(&profile_id, profile, &key_prefix)
+      .await?;
+
+    // Download remote metadata and merge if remote has changes
+    let remote_metadata_key = format!("{}profiles/{}/metadata.json", key_prefix, profile_id);
+    if let Ok(remote_meta) = self.download_profile_metadata(&remote_metadata_key).await {
+      let mut updated = profile.clone();
+      updated.name = remote_meta.name;
+      updated.tags = remote_meta.tags;
+      updated.note = remote_meta.note;
+      updated.proxy_id = remote_meta.proxy_id;
+      updated.vpn_id = remote_meta.vpn_id;
+      updated.group_id = remote_meta.group_id;
+      updated.last_sync = Some(
+        std::time::SystemTime::now()
+          .duration_since(std::time::UNIX_EPOCH)
+          .unwrap()
+          .as_secs(),
+      );
+      let _ = profile_manager.save_profile(&updated);
+    }
+
+    // Sync associated entities
+    if let Some(proxy_id) = &profile.proxy_id {
+      let _ = self.sync_proxy(proxy_id, Some(app_handle)).await;
+    }
+    if let Some(group_id) = &profile.group_id {
+      let _ = self.sync_group(group_id, Some(app_handle)).await;
+    }
+
+    let _ = events::emit("profiles-changed", ());
+    let _ = events::emit(
+      "profile-sync-status",
+      serde_json::json!({
+        "profile_id": profile_id,
+        "profile_name": profile.name,
+        "status": "synced"
+      }),
+    );
+
+    log::info!("Cross-OS profile {} metadata synced", profile_id);
+    Ok(())
+  }
+
  async fn upload_profile_metadata(
    &self,
    profile_id: &str,
@@ -736,6 +793,7 @@ impl SyncEngine {
    let mut sanitized = profile.clone();
    sanitized.process_id = None;
    sanitized.last_launch = None;
+    sanitized.last_sync = None; // Avoid triggering sync loop on timestamp change

    let json = serde_json::to_string_pretty(&sanitized)
      .map_err(|e| SyncError::SerializationError(format!("Failed to serialize profile: {e}")))?;
@@ -2284,6 +2342,42 @@ impl SyncEngine {
        .await?;
    }

+    // Verify critical files after download
+    let os_crypt_key_path = profile_dir.join("profile").join("os_crypt_key");
+    let cookies_path = profile_dir.join("profile").join("Default").join("Cookies");
+    if os_crypt_key_path.exists() {
+      let key_data = fs::read(&os_crypt_key_path).unwrap_or_default();
+      log::info!(
+        "Profile {} sync: os_crypt_key present ({} bytes, sha256: {:x})",
+        profile_id,
+        key_data.len(),
+        {
+          use std::hash::{Hash, Hasher};
+          let mut h = std::collections::hash_map::DefaultHasher::new();
+          key_data.hash(&mut h);
+          h.finish()
+        }
+      );
+    } else {
+      log::warn!(
+        "Profile {} sync: os_crypt_key NOT FOUND after download",
+        profile_id
+      );
+    }
+    if cookies_path.exists() {
+      let cookies_meta = fs::metadata(&cookies_path).unwrap_or_else(|_| fs::metadata(".").unwrap());
+      log::info!(
+        "Profile {} sync: Cookies present ({} bytes)",
+        profile_id,
+        cookies_meta.len()
+      );
+    } else {
+      log::warn!(
+        "Profile {} sync: Cookies NOT FOUND after download",
+        profile_id
+      );
+    }
+
    // Set sync mode and save profile
    if profile.sync_mode == SyncMode::Disabled {
      profile.sync_mode = if manifest.encrypted {
@@ -2815,15 +2909,8 @@ pub async fn set_profile_sync_mode(
    }
  }

-  // If switching to Encrypted, verify eligibility, password, and generate salt
+  // If switching to Encrypted, verify password is set and generate salt
  if new_mode == SyncMode::Encrypted {
-    // Only pro users and team owners can enable encryption
-    if let Some(state) = crate::cloud_auth::CLOUD_AUTH.get_user().await {
-      if state.user.plan == "team" && state.user.team_role.as_deref() != Some("owner") {
-        return Err("Profile encryption is available for Pro users and team owners.".to_string());
-      }
-    }
-
    if !encryption::has_e2e_password() {
      return Err("E2E password not set. Please set a password in Settings first.".to_string());
    }
@@ -8,12 +8,12 @@ use std::path::Path;
 use std::time::SystemTime;

 use super::types::{SyncError, SyncResult};
+use crate::profile::types::BrowserProfile;

 /// Default exclude patterns for volatile browser profile files.
 /// Patterns use `**/` prefix to match at any directory depth, since the sync
 /// engine scans from `profiles/{uuid}/` which contains `profile/Default/...`.
 pub const DEFAULT_EXCLUDE_PATTERNS: &[&str] = &[
-  // Chromium caches (re-downloadable / re-generated)
  "**/Cache/**",
  "**/Code Cache/**",
  "**/GPUCache/**",
@@ -23,7 +23,6 @@ pub const DEFAULT_EXCLUDE_PATTERNS: &[&str] = &[
  "**/DawnGraphiteCache/**",
  "**/Service Worker/CacheStorage/**",
  "**/Service Worker/ScriptCache/**",
-  // Chromium transient / volatile data
  "**/Session Storage/**",
  "**/blob_storage/**",
  "**/Crashpad/**",
@@ -32,21 +31,26 @@ pub const DEFAULT_EXCLUDE_PATTERNS: &[&str] = &[
  "**/optimization_guide_model_store/**",
  "**/Safe Browsing/**",
  "**/component_crx_cache/**",
-  // Firefox/Camoufox caches (re-downloadable / re-generated)
  "**/cache2/**",
  "**/startupCache/**",
  "**/safebrowsing/**",
  "**/storage/temporary/**",
  "**/crashes/**",
  "**/minidumps/**",
-  // Common volatile files
-  "*.log",
  "*.tmp",
  "**/LOG",
  "**/LOG.old",
  "**/LOCK",
  "**/*-journal",
  "**/*-wal",
+  "**/SingletonLock",
+  "**/SingletonSocket",
+  "**/SingletonCookie",
+  "**/Secure Preferences",
+  "**/GraphiteDawnCache/**",
+  "**/DawnWebGPUCache/**",
+  "**/BrowserMetrics*",
+  "**/.DS_Store",
  ".donut-sync/**",
 ];

@@ -206,6 +210,39 @@ fn hash_file(path: &Path) -> Result<Option<String>, SyncError> {
  Ok(Some(hasher.finalize().to_hex().to_string()))
 }

+/// Compute blake3 hash of metadata.json after sanitizing volatile fields.
+/// This prevents infinite sync loops where updating last_sync triggers a new sync.
+fn hash_sanitized_metadata(path: &Path) -> Result<Option<String>, SyncError> {
+  let content = match fs::read_to_string(path) {
+    Ok(c) => c,
+    Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+    Err(e) => {
+      return Err(SyncError::IoError(format!(
+        "Failed to read metadata at {}: {e}",
+        path.display()
+      )));
+    }
+  };
+
+  let mut profile: BrowserProfile = serde_json::from_str(&content).map_err(|e| {
+    SyncError::SerializationError(format!("Failed to parse metadata for hashing: {e}"))
+  })?;
+
+  // Sanitize volatile fields that should not trigger a re-sync
+  profile.last_sync = None;
+  profile.process_id = None;
+  profile.last_launch = None;
+
+  let sanitized_json = serde_json::to_string(&profile).map_err(|e| {
+    SyncError::SerializationError(format!("Failed to serialize sanitized metadata: {e}"))
+  })?;
+
+  let mut hasher = blake3::Hasher::new();
+  hasher.update(sanitized_json.as_bytes());
+
+  Ok(Some(hasher.finalize().to_hex().to_string()))
+}
+
 /// Get mtime as unix timestamp
 /// Returns None if the file doesn't exist (was deleted)
 fn get_mtime(path: &Path) -> Result<Option<i64>, SyncError> {
@@ -321,7 +358,19 @@ pub fn generate_manifest(
        *max_mtime = (*max_mtime).max(mtime);

        // Check cache for existing hash
-        let hash = if let Some(cached_hash) = cache.get(&relative_path, size, mtime) {
+        let hash = if relative_path == "metadata.json" {
+          // Special case: sanitize metadata.json before hashing to prevent sync loops
+          match hash_sanitized_metadata(&path)? {
+            Some(computed_hash) => computed_hash,
+            None => {
+              log::debug!(
+                "File disappeared during manifest generation, skipping: {}",
+                path.display()
+              );
+              continue;
+            }
+          }
+        } else if let Some(cached_hash) = cache.get(&relative_path, size, mtime) {
          cached_hash.to_string()
        } else {
          match hash_file(&path)? {
@@ -589,7 +638,12 @@ mod tests {
    fs::write(profile_dir.join("profile/Crashpad/report"), "exclude").unwrap();

    // metadata.json at root
-    fs::write(profile_dir.join("metadata.json"), "keep").unwrap();
+    let profile = BrowserProfile::default();
+    fs::write(
+      profile_dir.join("metadata.json"),
+      serde_json::to_string(&profile).unwrap(),
+    )
+    .unwrap();

    let mut cache = HashCache::default();
    let manifest = generate_manifest("test-profile", &profile_dir, &mut cache).unwrap();
@@ -797,4 +851,85 @@ mod tests {
    assert!(diff.files_to_delete_remote.is_empty());
    assert!(diff.files_to_delete_local.is_empty());
  }
+
+  #[test]
+  fn test_generate_manifest_sanitizes_metadata() {
+    let temp_dir = TempDir::new().unwrap();
+    let profile_dir = temp_dir.path().join("profile");
+    fs::create_dir_all(&profile_dir).unwrap();
+
+    let profile_id = uuid::Uuid::new_v4();
+    let metadata_path = profile_dir.join("metadata.json");
+
+    let profile = BrowserProfile {
+      id: profile_id,
+      name: "test-profile".to_string(),
+      last_sync: Some(100),
+      process_id: Some(1234),
+      ..Default::default()
+    };
+
+    fs::write(&metadata_path, serde_json::to_string(&profile).unwrap()).unwrap();
+
+    let mut cache = HashCache::default();
+    let manifest1 = generate_manifest(&profile_id.to_string(), &profile_dir, &mut cache).unwrap();
+    let hash1 = manifest1
+      .files
+      .iter()
+      .find(|f| f.path == "metadata.json")
+      .unwrap()
+      .hash
+      .clone();
+
+    // Update volatile fields
+    let profile2 = BrowserProfile {
+      id: profile_id,
+      name: "test-profile".to_string(),
+      last_sync: Some(200),
+      process_id: Some(5678),
+      ..Default::default()
+    };
+
+    fs::write(&metadata_path, serde_json::to_string(&profile2).unwrap()).unwrap();
+
+    let manifest2 = generate_manifest(&profile_id.to_string(), &profile_dir, &mut cache).unwrap();
+    let hash2 = manifest2
+      .files
+      .iter()
+      .find(|f| f.path == "metadata.json")
+      .unwrap()
+      .hash
+      .clone();
+
+    // Hash should be identical because volatile fields are sanitized
+    assert_eq!(
+      hash1, hash2,
+      "Metadata hash should be stable across last_sync/process_id updates"
+    );
+
+    // Change a non-volatile field
+    let profile3 = BrowserProfile {
+      id: profile_id,
+      name: "changed-name".to_string(),
+      last_sync: Some(200),
+      ..Default::default()
+    };
+
+    fs::write(&metadata_path, serde_json::to_string(&profile3).unwrap()).unwrap();
+
+    let manifest3 = generate_manifest(&profile_id.to_string(), &profile_dir, &mut cache).unwrap();
+    let hash3 = manifest3
+      .files
+      .iter()
+      .find(|f| f.path == "metadata.json")
+      .unwrap()
+      .hash
+      .clone();
+
+    // Hash should be different because name changed
+    assert_ne!(
+      hash1, hash3,
+      "Metadata hash should change when non-volatile fields change"
+    );
+  }
 }
@@ -264,7 +264,7 @@ impl SyncScheduler {

    let sync_enabled_profiles: Vec<_> = profiles
      .into_iter()
-      .filter(|p| p.is_sync_enabled() && !p.is_cross_os())
+      .filter(|p| p.is_sync_enabled())
      .collect();

    if sync_enabled_profiles.is_empty() {
@@ -418,7 +418,7 @@ impl SyncScheduler {
          profile_manager.list_profiles().ok().and_then(|profiles| {
            profiles
              .into_iter()
-              .find(|p| p.id.to_string() == profile_id && p.is_sync_enabled() && !p.is_cross_os())
+              .find(|p| p.id.to_string() == profile_id && p.is_sync_enabled())
          })
        };

@@ -37,8 +37,6 @@ pub struct WayfernConfig {
  pub block_webrtc: Option<bool>,
  #[serde(default)]
  pub block_webgl: Option<bool>,
-  #[serde(default)]
-  pub executable_path: Option<String>,
  #[serde(default, skip_serializing)]
  pub proxy: Option<String>,
 }
@@ -138,8 +136,10 @@ impl WayfernManager {
    port: u16,
  ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    let url = format!("http://127.0.0.1:{port}/json/version");
-    let max_attempts = 50;
-    let delay = Duration::from_millis(100);
+    // On first launch, macOS Gatekeeper verifies the binary which can take 30+ seconds.
+    // Use a generous timeout (60s) to handle this.
+    let max_attempts = 120;
+    let delay = Duration::from_millis(500);

    for attempt in 0..max_attempts {
      match self.http_client.get(&url).send().await {
@@ -212,21 +212,9 @@ impl WayfernManager {
    profile: &BrowserProfile,
    config: &WayfernConfig,
  ) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
-    let executable_path = if let Some(path) = &config.executable_path {
-      let p = PathBuf::from(path);
-      if p.exists() {
-        p
-      } else {
-        log::warn!("Stored Wayfern executable path does not exist: {path}, falling back to dynamic resolution");
-        BrowserRunner::instance()
-          .get_browser_executable_path(profile)
-          .map_err(|e| format!("Failed to get Wayfern executable path: {e}"))?
-      }
-    } else {
-      BrowserRunner::instance()
-        .get_browser_executable_path(profile)
-        .map_err(|e| format!("Failed to get Wayfern executable path: {e}"))?
-    };
+    let executable_path = BrowserRunner::instance()
+      .get_browser_executable_path(profile)
+      .map_err(|e| format!("Failed to get Wayfern executable path: {e}"))?;

    let port = Self::find_free_port().await?;
    log::info!("Launching headless Wayfern on port {port} for fingerprint generation");
@@ -247,9 +235,15 @@ impl WayfernManager {
      .arg("--disable-background-mode")
      .arg("--use-mock-keychain")
      .arg("--password-store=basic")
-      .arg("--disable-features=DialMediaRouteProvider")
-      .stdout(Stdio::null())
-      .stderr(Stdio::null());
+      .arg("--disable-features=DialMediaRouteProvider");
+
+    #[cfg(target_os = "linux")]
+    cmd
+      .arg("--no-sandbox")
+      .arg("--disable-setuid-sandbox")
+      .arg("--disable-dev-shm-usage");
+
+    cmd.stdout(Stdio::null()).stderr(Stdio::null());

    let child = cmd.spawn()?;
    let child_id = child.id();
@@ -456,21 +450,9 @@ impl WayfernManager {
    extension_paths: &[String],
    remote_debugging_port: Option<u16>,
  ) -> Result<WayfernLaunchResult, Box<dyn std::error::Error + Send + Sync>> {
-    let executable_path = if let Some(path) = &config.executable_path {
-      let p = PathBuf::from(path);
-      if p.exists() {
-        p
-      } else {
-        log::warn!("Stored Wayfern executable path does not exist: {path}, falling back to dynamic resolution");
-        BrowserRunner::instance()
-          .get_browser_executable_path(profile)
-          .map_err(|e| format!("Failed to get Wayfern executable path: {e}"))?
-      }
-    } else {
-      BrowserRunner::instance()
-        .get_browser_executable_path(profile)
-        .map_err(|e| format!("Failed to get Wayfern executable path: {e}"))?
-    };
+    let executable_path = BrowserRunner::instance()
+      .get_browser_executable_path(profile)
+      .map_err(|e| format!("Failed to get Wayfern executable path: {e}"))?;

    let port = match remote_debugging_port {
      Some(p) => p,
@@ -478,6 +460,84 @@ impl WayfernManager {
    };
    log::info!("Launching Wayfern on CDP port {port}");

+    // Diagnostic: verify critical profile files and test cookie decryption
+    {
+      let profile_path_buf = std::path::PathBuf::from(profile_path);
+      let key_path = profile_path_buf.join("os_crypt_key");
+      let cookies_path = profile_path_buf.join("Default").join("Cookies");
+
+      if key_path.exists() {
+        let key_text = std::fs::read_to_string(&key_path).unwrap_or_default();
+        log::info!(
+          "Pre-launch: os_crypt_key present ({} bytes, content: '{}')",
+          key_text.len(),
+          key_text.trim()
+        );
+      } else {
+        log::warn!("Pre-launch: os_crypt_key NOT FOUND");
+      }
+
+      if cookies_path.exists() {
+        // Try to open Cookies DB and check if encrypted cookies can be decrypted
+        if let Ok(conn) = rusqlite::Connection::open_with_flags(
+          &cookies_path,
+          rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY,
+        ) {
+          let cookie_count: i64 = conn
+            .query_row(
+              "SELECT COUNT(*) FROM cookies WHERE length(encrypted_value) > 0",
+              [],
+              |r| r.get(0),
+            )
+            .unwrap_or(0);
+          let total_count: i64 = conn
+            .query_row("SELECT COUNT(*) FROM cookies", [], |r| r.get(0))
+            .unwrap_or(0);
+          log::info!(
+            "Pre-launch: Cookies DB has {} total cookies, {} encrypted",
+            total_count,
+            cookie_count
+          );
+
+          // Try decrypting one cookie using the cookie_manager
+          if let Some(encryption_key) =
+            crate::cookie_manager::chrome_decrypt::get_encryption_key(&profile_path_buf)
+          {
+            if let Ok(mut stmt) = conn.prepare(
+              "SELECT name, host_key, encrypted_value FROM cookies WHERE length(encrypted_value) > 0 LIMIT 1",
+            ) {
+              if let Ok(mut rows) = stmt.query([]) {
+                if let Ok(Some(row)) = rows.next() {
+                  let name: String = row.get(0).unwrap_or_default();
+                  let host: String = row.get(1).unwrap_or_default();
+                  let encrypted: Vec<u8> = row.get(2).unwrap_or_default();
+                  let decrypted =
+                    crate::cookie_manager::chrome_decrypt::decrypt(
+                      &encrypted,
+                      &encryption_key,
+                    );
+                  match decrypted {
+                    Some(val) => log::info!(
+                      "Pre-launch: Cookie decryption SUCCEEDED for '{}' (host: {}, decrypted {} bytes)",
+                      name, host, val.len()
+                    ),
+                    None => log::error!(
+                      "Pre-launch: Cookie decryption FAILED for '{}' (host: {}, encrypted {} bytes)",
+                      name, host, encrypted.len()
+                    ),
+                  }
+                }
+              }
+            }
+          } else {
+            log::error!("Pre-launch: Failed to derive encryption key from os_crypt_key");
+          }
+        }
+      } else {
+        log::warn!("Pre-launch: Cookies NOT FOUND");
+      }
+    }
+
    let mut args = vec![
      format!("--remote-debugging-port={port}"),
      "--remote-debugging-address=127.0.0.1".to_string(),
@@ -492,12 +552,18 @@ impl WayfernManager {
      "--disable-session-crashed-bubble".to_string(),
      "--hide-crash-restore-bubble".to_string(),
      "--disable-infobars".to_string(),
-      "--disable-quic".to_string(),
      "--disable-features=DialMediaRouteProvider".to_string(),
      "--use-mock-keychain".to_string(),
      "--password-store=basic".to_string(),
    ];

+    #[cfg(target_os = "linux")]
+    {
+      args.push("--no-sandbox".to_string());
+      args.push("--disable-setuid-sandbox".to_string());
+      args.push("--disable-dev-shm-usage".to_string());
+    }
+
    if let Some(proxy) = proxy_url {
      args.push(format!("--proxy-server={proxy}"));
    }
@@ -1,7 +1,7 @@
 {
  "$schema": "https://schema.tauri.app/config/2",
  "productName": "Donut",
-  "version": "0.17.6",
+  "version": "0.18.1",
  "identifier": "com.donutbrowser",
  "build": {
    "beforeDevCommand": "pnpm copy-proxy-binary && pnpm dev",
@@ -280,7 +280,7 @@ export default function Home() {
  const [processingUrls, setProcessingUrls] = useState<Set<string>>(new Set());

  const handleUrlOpen = useCallback(
-    async (url: string) => {
+    (url: string) => {
      // Prevent duplicate processing of the same URL
      if (processingUrls.has(url)) {
        console.log("URL already being processed:", url);
@@ -324,7 +324,7 @@ export default function Home() {
      const currentUrl = await getCurrent();
      if (currentUrl && currentUrl.length > 0) {
        console.log("Startup URL detected:", currentUrl[0]);
-        void handleUrlOpen(currentUrl[0]);
+        handleUrlOpen(currentUrl[0]);
      }
    } catch (error) {
      console.error("Failed to check current URL:", error);
@@ -372,7 +372,7 @@ export default function Home() {
    }
  }, [proxiesError]);

-  const checkAllPermissions = useCallback(async () => {
+  const checkAllPermissions = useCallback(() => {
    try {
      // Wait for permissions to be initialized before checking
      if (!isInitialized) {
@@ -413,13 +413,13 @@ export default function Home() {
      // Listen for URL open events from the deep link handler (when app is already running)
      await listen<string>("url-open-request", (event) => {
        console.log("Received URL open request:", event.payload);
-        void handleUrlOpen(event.payload);
+        handleUrlOpen(event.payload);
      });

      // Listen for show profile selector events
      await listen<string>("show-profile-selector", (event) => {
        console.log("Received show profile selector request:", event.payload);
-        void handleUrlOpen(event.payload);
+        handleUrlOpen(event.payload);
      });

      // Listen for show create profile dialog events
@@ -437,7 +437,7 @@ export default function Home() {
      // Listen for custom logo click events
      const handleLogoUrlEvent = (event: CustomEvent) => {
        console.log("Received logo URL event:", event.detail);
-        void handleUrlOpen(event.detail);
+        handleUrlOpen(event.detail);
      };

      window.addEventListener(
@@ -529,7 +529,7 @@ export default function Home() {
            camoufoxConfig: profileData.camoufoxConfig,
            wayfernConfig: profileData.wayfernConfig,
            groupId:
-              profileData.groupId ||
+              profileData.groupId ??
              (selectedGroupId !== "default" ? selectedGroupId : undefined),
            ephemeral: profileData.ephemeral,
          },
@@ -764,13 +764,13 @@ export default function Home() {
    setCookieManagementDialogOpen(true);
  }, []);

-  const handleGroupAssignmentComplete = useCallback(async () => {
+  const handleGroupAssignmentComplete = useCallback(() => {
    // No need to manually reload - useProfileEvents will handle the update
    setGroupAssignmentDialogOpen(false);
    setSelectedProfilesForGroup([]);
  }, []);

-  const handleProxyAssignmentComplete = useCallback(async () => {
+  const handleProxyAssignmentComplete = useCallback(() => {
    // No need to manually reload - useProfileEvents will handle the update
    setProxyAssignmentDialogOpen(false);
    setSelectedProfilesForProxy([]);
@@ -810,7 +810,7 @@ export default function Home() {
    let unlistenStatus: (() => void) | undefined;
    let unlistenProgress: (() => void) | undefined;
    const profilesWithTransfer = new Set<string>();
-    (async () => {
+    void (async () => {
      try {
        unlistenStatus = await listen<{
          profile_id: string;
@@ -898,7 +898,7 @@ export default function Home() {
    };

    let cleanup: (() => void) | undefined;
-    setupListeners().then((cleanupFn) => {
+    void setupListeners().then((cleanupFn) => {
      cleanup = cleanupFn;
    });

@@ -995,7 +995,7 @@ export default function Home() {
  // Check permissions when they are initialized
  useEffect(() => {
    if (isInitialized) {
-      void checkAllPermissions();
+      checkAllPermissions();
    }
  }, [isInitialized, checkAllPermissions]);

@@ -1056,7 +1056,6 @@ export default function Home() {
            onExtensionManagementDialogOpen={setExtensionManagementDialogOpen}
            searchQuery={searchQuery}
            onSearchQueryChange={setSearchQuery}
-            crossOsUnlocked={crossOsUnlocked}
          />
        </div>
        <div className="w-full mt-2.5">
@@ -1094,7 +1093,9 @@ export default function Home() {
            crossOsUnlocked={crossOsUnlocked}
            syncUnlocked={syncUnlocked}
            getProfileSyncInfo={getProfileSyncInfo}
-            onLaunchWithSync={(profile) => setSyncLeaderProfile(profile)}
+            onLaunchWithSync={(profile) => {
+              setSyncLeaderProfile(profile);
+            }}
          />
        </div>
      </main>
@@ -1168,7 +1169,9 @@ export default function Home() {

      <CloneProfileDialog
        isOpen={!!cloneProfile}
-        onClose={() => setCloneProfile(null)}
+        onClose={() => {
+          setCloneProfile(null);
+        }}
        profile={cloneProfile}
      />

@@ -1198,7 +1201,9 @@ export default function Home() {

      <ExtensionManagementDialog
        isOpen={extensionManagementDialogOpen}
-        onClose={() => setExtensionManagementDialogOpen(false)}
+        onClose={() => {
+          setExtensionManagementDialogOpen(false);
+        }}
        limitedMode={!crossOsUnlocked}
      />

@@ -1243,7 +1248,9 @@ export default function Home() {
        selectedProfiles={selectedProfilesForCookies}
        profiles={profiles}
        runningProfiles={runningProfiles}
-        onCopyComplete={() => setSelectedProfilesForCookies([])}
+        onCopyComplete={() => {
+          setSelectedProfilesForCookies([]);
+        }}
      />

      <CookieManagementDialog
@@ -1257,7 +1264,9 @@ export default function Home() {

      <DeleteConfirmationDialog
        isOpen={showBulkDeleteConfirmation}
-        onClose={() => setShowBulkDeleteConfirmation(false)}
+        onClose={() => {
+          setShowBulkDeleteConfirmation(false);
+        }}
        onConfirm={confirmBulkDelete}
        title="Delete Selected Profiles"
        description={`This action cannot be undone. This will permanently delete ${selectedProfiles.length} profile${selectedProfiles.length !== 1 ? "s" : ""} and all associated data.`}
@@ -1280,7 +1289,9 @@ export default function Home() {

      <SyncAllDialog
        isOpen={syncAllDialogOpen}
-        onClose={() => setSyncAllDialogOpen(false)}
+        onClose={() => {
+          setSyncAllDialogOpen(false);
+        }}
      />

      <ProfileSyncDialog
@@ -1290,7 +1301,9 @@ export default function Home() {
          setCurrentProfileForSync(null);
        }}
        profile={currentProfileForSync}
-        onSyncConfigOpen={() => setSyncConfigDialogOpen(true)}
+        onSyncConfigOpen={() => {
+          setSyncConfigDialogOpen(true);
+        }}
      />

      {/* Wayfern Terms and Conditions Dialog - shown if terms not accepted */}
@@ -1314,7 +1327,9 @@ export default function Home() {
      {/* Launch on Login Dialog - shown on every startup until enabled or declined */}
      <LaunchOnLoginDialog
        isOpen={launchOnLoginDialogOpen}
-        onClose={() => setLaunchOnLoginDialogOpen(false)}
+        onClose={() => {
+          setLaunchOnLoginDialogOpen(false);
+        }}
      />

      <WindowResizeWarningDialog
@@ -1329,7 +1344,9 @@ export default function Home() {

      <SyncFollowerDialog
        isOpen={syncLeaderProfile !== null}
-        onClose={() => setSyncLeaderProfile(null)}
+        onClose={() => {
+          setSyncLeaderProfile(null);
+        }}
        leaderProfile={syncLeaderProfile}
        allProfiles={profiles}
        runningProfiles={runningProfiles}
@@ -46,12 +46,6 @@ export function BandwidthMiniChart({
    return result;
  }, [data]);

-  // Find max value for scaling
-  const _maxBandwidth = React.useMemo(() => {
-    const max = Math.max(...chartData.map((d) => d.bandwidth), 1);
-    return max;
-  }, [chartData]);
-
  // Use external bandwidth if provided, otherwise calculate from last data point
  const currentBandwidth =
    externalBandwidth ?? chartData[chartData.length - 1]?.bandwidth ?? 0;
@@ -69,7 +69,12 @@ export function CloneProfileDialog({
  };

  return (
-    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) onClose();
+      }}
+    >
      <DialogContent>
        <DialogHeader>
          <DialogTitle>{t("profileInfo.clone.title")}</DialogTitle>
@@ -80,7 +85,9 @@ export function CloneProfileDialog({
        <Input
          ref={inputRef}
          value={name}
-          onChange={(e) => setName(e.target.value)}
+          onChange={(e) => {
+            setName(e.target.value);
+          }}
          onKeyDown={(e) => {
            if (e.key === "Enter") void handleClone();
          }}
@@ -44,9 +44,15 @@ export function CommercialTrialModal({
    <Dialog open={isOpen}>
      <DialogContent
        className="sm:max-w-md"
-        onEscapeKeyDown={(e) => e.preventDefault()}
-        onPointerDownOutside={(e) => e.preventDefault()}
-        onInteractOutside={(e) => e.preventDefault()}
+        onEscapeKeyDown={(e) => {
+          e.preventDefault();
+        }}
+        onPointerDownOutside={(e) => {
+          e.preventDefault();
+        }}
+        onInteractOutside={(e) => {
+          e.preventDefault();
+        }}
      >
        <DialogHeader>
          <DialogTitle>Commercial Trial Expired</DialogTitle>
@@ -50,12 +50,13 @@ interface CookieCopyDialogProps {
  onCopyComplete?: () => void;
 }

-type SelectionState = {
-  [domain: string]: {
+type SelectionState = Record<
+  string,
+  {
    allSelected: boolean;
    cookies: Set<string>;
-  };
-};
+  }
+>;

 export function CookieCopyDialog({
  isOpen,
@@ -109,7 +110,7 @@ export function CookieCopyDialog({
      const domainSelection = selection[domain];
      if (domainSelection.allSelected) {
        const domainData = cookieData?.domains.find((d) => d.domain === domain);
-        count += domainData?.cookie_count || 0;
+        count += domainData?.cookie_count ?? 0;
      } else {
        count += domainSelection.cookies.size;
      }
@@ -148,7 +149,7 @@ export function CookieCopyDialog({
    (domain: string, cookies: UnifiedCookie[]) => {
      setSelection((prev) => {
        const current = prev[domain];
-        const allSelected = current?.allSelected || false;
+        const allSelected = current.allSelected;

        if (allSelected) {
          const newSelection = { ...prev };
@@ -171,7 +172,7 @@ export function CookieCopyDialog({
  const toggleCookie = useCallback(
    (domain: string, cookieName: string, totalCookies: number) => {
      setSelection((prev) => {
-        const current = prev[domain] || {
+        const current = prev[domain] ?? {
          allSelected: false,
          cookies: new Set<string>(),
        };
@@ -412,7 +413,9 @@ export function CookieCopyDialog({
                <Input
                  placeholder="Search domains or cookies..."
                  value={searchQuery}
-                  onChange={(e) => setSearchQuery(e.target.value)}
+                  onChange={(e) => {
+                    setSearchQuery(e.target.value);
+                  }}
                  className="pl-8"
                />
              </div>
@@ -501,8 +504,8 @@ function DomainRow({
  onToggleExpand,
 }: DomainRowProps) {
  const domainSelection = selection[domain.domain];
-  const isAllSelected = domainSelection?.allSelected || false;
-  const selectedCount = domainSelection?.cookies.size || 0;
+  const isAllSelected = domainSelection.allSelected;
+  const selectedCount = domainSelection.cookies.size;
  const isPartial =
    selectedCount > 0 && selectedCount < domain.cookie_count && !isAllSelected;

@@ -511,13 +514,17 @@ function DomainRow({
      <div className="flex items-center gap-2 p-2 hover:bg-accent/50 rounded">
        <Checkbox
          checked={isAllSelected || isPartial}
-          onCheckedChange={() => onToggleDomain(domain.domain, domain.cookies)}
+          onCheckedChange={() => {
+            onToggleDomain(domain.domain, domain.cookies);
+          }}
          className={isPartial ? "opacity-70" : ""}
        />
        <button
          type="button"
          className="flex items-center gap-1 flex-1 text-left bg-transparent border-none cursor-pointer"
-          onClick={() => onToggleExpand(domain.domain)}
+          onClick={() => {
+            onToggleExpand(domain.domain);
+          }}
        >
          {isExpanded ? (
            <LuChevronDown className="w-4 h-4" />
@@ -533,8 +540,7 @@ function DomainRow({
      {isExpanded && (
        <div className="ml-8 pl-2 border-l space-y-1">
          {domain.cookies.map((cookie) => {
-            const isSelected =
-              domainSelection?.cookies.has(cookie.name) || false;
+            const isSelected = domainSelection.cookies.has(cookie.name);
            return (
              <div
                key={`${domain.domain}-${cookie.name}`}
@@ -542,13 +548,13 @@ function DomainRow({
              >
                <Checkbox
                  checked={isSelected || isAllSelected}
-                  onCheckedChange={() =>
+                  onCheckedChange={() => {
                    onToggleCookie(
                      domain.domain,
                      cookie.name,
                      domain.cookie_count,
-                    )
-                  }
+                    );
+                  }}
                />
                <span className="truncate">{cookie.name}</span>
              </div>
@@ -45,12 +45,13 @@ interface CookieManagementDialogProps {
  initialTab?: "import" | "export";
 }

-type SelectionState = {
-  [domain: string]: {
+type SelectionState = Record<
+  string,
+  {
    allSelected: boolean;
    cookies: Set<string>;
-  };
-};
+  }
+>;

 const countCookies = (content: string): number => {
  const trimmed = content.trim();
@@ -150,7 +151,7 @@ export function CookieManagementDialog({
        const domainData = exportCookieData?.domains.find(
          (d) => d.domain === domain,
        );
-        count += domainData?.cookie_count || 0;
+        count += domainData?.cookie_count ?? 0;
      } else {
        count += ds.cookies.size;
      }
@@ -309,7 +310,7 @@ export function CookieManagementDialog({
    (domain: string, cookies: UnifiedCookie[]) => {
      setExportSelection((prev) => {
        const current = prev[domain];
-        if (current?.allSelected) {
+        if (current.allSelected) {
          const next = { ...prev };
          delete next[domain];
          return next;
@@ -329,7 +330,7 @@ export function CookieManagementDialog({
  const toggleCookie = useCallback(
    (domain: string, cookieName: string, totalCookies: number) => {
      setExportSelection((prev) => {
-        const current = prev[domain] || {
+        const current = prev[domain] ?? {
          allSelected: false,
          cookies: new Set<string>(),
        };
@@ -485,7 +486,9 @@ export function CookieManagementDialog({
              <Label>Format</Label>
              <Select
                value={format}
-                onValueChange={(v) => setFormat(v as "netscape" | "json")}
+                onValueChange={(v) => {
+                  setFormat(v as "netscape" | "json");
+                }}
              >
                <SelectTrigger>
                  <SelectValue />
@@ -589,8 +592,8 @@ function ExportDomainRow({
  onToggleExpand,
 }: ExportDomainRowProps) {
  const domainSelection = selection[domain.domain];
-  const isAllSelected = domainSelection?.allSelected || false;
-  const selectedCount = domainSelection?.cookies.size || 0;
+  const isAllSelected = domainSelection.allSelected;
+  const selectedCount = domainSelection.cookies.size;
  const isPartial =
    selectedCount > 0 && selectedCount < domain.cookie_count && !isAllSelected;

@@ -599,13 +602,17 @@ function ExportDomainRow({
      <div className="flex items-center gap-2 p-1.5 hover:bg-accent/50 rounded">
        <Checkbox
          checked={isAllSelected || isPartial}
-          onCheckedChange={() => onToggleDomain(domain.domain, domain.cookies)}
+          onCheckedChange={() => {
+            onToggleDomain(domain.domain, domain.cookies);
+          }}
          className={isPartial ? "opacity-70" : ""}
        />
        <button
          type="button"
          className="flex items-center gap-1 flex-1 text-left text-sm bg-transparent border-none cursor-pointer"
-          onClick={() => onToggleExpand(domain.domain)}
+          onClick={() => {
+            onToggleExpand(domain.domain);
+          }}
        >
          {isExpanded ? (
            <LuChevronDown className="w-3.5 h-3.5" />
@@ -621,8 +628,7 @@ function ExportDomainRow({
      {isExpanded && (
        <div className="ml-7 pl-2 border-l space-y-0.5">
          {domain.cookies.map((cookie) => {
-            const isSelected =
-              domainSelection?.cookies.has(cookie.name) || false;
+            const isSelected = domainSelection.cookies.has(cookie.name);
            return (
              <div
                key={`${domain.domain}-${cookie.name}`}
@@ -630,13 +636,13 @@ function ExportDomainRow({
              >
                <Checkbox
                  checked={isSelected || isAllSelected}
-                  onCheckedChange={() =>
+                  onCheckedChange={() => {
                    onToggleCookie(
                      domain.domain,
                      cookie.name,
                      domain.cookie_count,
-                    )
-                  }
+                    );
+                  }}
                />
                <span className="truncate">{cookie.name}</span>
              </div>
@@ -80,7 +80,9 @@ export function CreateGroupDialog({
              id="group-name"
              placeholder="Enter group name..."
              value={groupName}
-              onChange={(e) => setGroupName(e.target.value)}
+              onChange={(e) => {
+                setGroupName(e.target.value);
+              }}
              onKeyDown={(e) => {
                if (e.key === "Enter" && groupName.trim()) {
                  void handleCreate();
@@ -172,11 +172,13 @@ export function CreateProfileDialog({

  useEffect(() => {
    if (isOpen) {
-      invoke<{ id: string; name: string; extension_ids: string[] }[]>(
+      void invoke<{ id: string; name: string; extension_ids: string[] }[]>(
        "list_extension_groups",
      )
        .then(setExtensionGroups)
-        .catch(() => setExtensionGroups([]));
+        .catch(() => {
+          setExtensionGroups([]);
+        });
    }
  }, [isOpen]);
  const [releaseTypes, setReleaseTypes] = useState<BrowserReleaseTypes>();
@@ -553,7 +555,9 @@ export function CreateProfileDialog({
                      <div className="space-y-3 pt-8">
                        {/* Wayfern (Chromium) - First */}
                        <Button
-                          onClick={() => handleBrowserSelect("wayfern")}
+                          onClick={() => {
+                            handleBrowserSelect("wayfern");
+                          }}
                          className="flex gap-3 justify-start items-center p-4 w-full h-16 border-2 transition-colors hover:border-primary/50"
                          variant="outline"
                        >
@@ -577,7 +581,9 @@ export function CreateProfileDialog({

                        {/* Camoufox (Firefox) - Second */}
                        <Button
-                          onClick={() => handleBrowserSelect("camoufox")}
+                          onClick={() => {
+                            handleBrowserSelect("camoufox");
+                          }}
                          className="flex gap-3 justify-start items-center p-4 w-full h-16 border-2 transition-colors hover:border-primary/50"
                          variant="outline"
                        >
@@ -620,9 +626,9 @@ export function CreateProfileDialog({
                            return (
                              <Button
                                key={browser.value}
-                                onClick={() =>
-                                  handleBrowserSelect(browser.value)
-                                }
+                                onClick={() => {
+                                  handleBrowserSelect(browser.value);
+                                }}
                                className="flex gap-3 justify-start items-center p-4 w-full h-16 border-2 transition-colors hover:border-primary/50"
                                variant="outline"
                              >
@@ -657,14 +663,16 @@ export function CreateProfileDialog({
                          <Input
                            id="profile-name"
                            value={profileName}
-                            onChange={(e) => setProfileName(e.target.value)}
+                            onChange={(e) => {
+                              setProfileName(e.target.value);
+                            }}
                            onKeyDown={(e) => {
                              if (
                                e.key === "Enter" &&
                                !isCreateDisabled &&
                                !isCreating
                              ) {
-                                handleCreate();
+                                void handleCreate();
                              }
                            }}
                            placeholder="Enter profile name"
@@ -677,9 +685,9 @@ export function CreateProfileDialog({
                            <Checkbox
                              id="ephemeral"
                              checked={ephemeral}
-                              onCheckedChange={(checked) =>
-                                setEphemeral(checked === true)
-                              }
+                              onCheckedChange={(checked) => {
+                                setEphemeral(checked === true);
+                              }}
                            />
                            <Label htmlFor="ephemeral" className="font-medium">
                              {t("profiles.ephemeral")}
@@ -746,7 +754,9 @@ export function CreateProfileDialog({
                                    })()}
                                  </p>
                                  <LoadingButton
-                                    onClick={() => handleDownload("wayfern")}
+                                    onClick={() => {
+                                      void handleDownload("wayfern");
+                                    }}
                                    isLoading={isBrowserCurrentlyDownloading(
                                      "wayfern",
                                    )}
@@ -848,7 +858,9 @@ export function CreateProfileDialog({
                                    })()}
                                  </p>
                                  <LoadingButton
-                                    onClick={() => handleDownload("camoufox")}
+                                    onClick={() => {
+                                      void handleDownload("camoufox");
+                                    }}
                                    isLoading={isBrowserCurrentlyDownloading(
                                      "camoufox",
                                    )}
@@ -955,9 +967,9 @@ export function CreateProfileDialog({
                                        })()}
                                      </p>
                                      <LoadingButton
-                                        onClick={() =>
-                                          handleDownload(selectedBrowser)
-                                        }
+                                        onClick={() => {
+                                          void handleDownload(selectedBrowser);
+                                        }}
                                        isLoading={isBrowserCurrentlyDownloading(
                                          selectedBrowser,
                                        )}
@@ -1014,7 +1026,9 @@ export function CreateProfileDialog({
                            <RippleButton
                              size="sm"
                              variant="outline"
-                              onClick={() => setShowProxyForm(true)}
+                              onClick={() => {
+                                setShowProxyForm(true);
+                              }}
                              className="px-2 h-7 text-xs"
                            >
                              <GoPlus className="mr-1 w-3 h-3" /> Add Proxy
@@ -1153,12 +1167,12 @@ export function CreateProfileDialog({
                          <div className="space-y-2">
                            <Label>{t("extensions.extensionGroup")}</Label>
                            <Select
-                              value={selectedExtensionGroupId || "none"}
-                              onValueChange={(val) =>
+                              value={selectedExtensionGroupId ?? "none"}
+                              onValueChange={(val) => {
                                setSelectedExtensionGroupId(
                                  val === "none" ? undefined : val,
-                                )
-                              }
+                                );
+                              }}
                            >
                              <SelectTrigger>
                                <SelectValue
@@ -1190,14 +1204,16 @@ export function CreateProfileDialog({
                          <Input
                            id="profile-name"
                            value={profileName}
-                            onChange={(e) => setProfileName(e.target.value)}
+                            onChange={(e) => {
+                              setProfileName(e.target.value);
+                            }}
                            onKeyDown={(e) => {
                              if (
                                e.key === "Enter" &&
                                !isCreateDisabled &&
                                !isCreating
                              ) {
-                                handleCreate();
+                                void handleCreate();
                              }
                            }}
                            placeholder="Enter profile name"
@@ -1251,9 +1267,9 @@ export function CreateProfileDialog({
                                      })()}
                                    </p>
                                    <LoadingButton
-                                      onClick={() =>
-                                        handleDownload(selectedBrowser)
-                                      }
+                                      onClick={() => {
+                                        void handleDownload(selectedBrowser);
+                                      }}
                                      isLoading={isBrowserCurrentlyDownloading(
                                        selectedBrowser,
                                      )}
@@ -1305,7 +1321,9 @@ export function CreateProfileDialog({
                            <RippleButton
                              size="sm"
                              variant="outline"
-                              onClick={() => setShowProxyForm(true)}
+                              onClick={() => {
+                                setShowProxyForm(true);
+                              }}
                              className="px-2 h-7 text-xs"
                            >
                              <GoPlus className="mr-1 w-3 h-3" /> Add Proxy
@@ -1470,7 +1488,9 @@ export function CreateProfileDialog({
      </DialogContent>
      <ProxyFormDialog
        isOpen={showProxyForm}
-        onClose={() => setShowProxyForm(false)}
+        onClose={() => {
+          setShowProxyForm(false);
+        }}
      />
    </Dialog>
  );
@@ -363,15 +363,17 @@ export function UnifiedToast(props: ToastProps) {
          </>
        )}
        {action &&
-          "onClick" in (action as any) &&
-          "label" in (action as any) && (
+          "onClick" in (action as { onClick?: () => void; label?: string }) &&
+          "label" in (action as { onClick?: () => void; label?: string }) && (
            <div className="mt-2 w-full">
              <RippleButton
                size="sm"
                className="ml-auto"
-                onClick={(action as any).onClick}
+                onClick={
+                  (action as { onClick: () => void; label: string }).onClick
+                }
              >
-                {(action as any).label}
+                {(action as { onClick: () => void; label: string }).label}
              </RippleButton>
            </div>
          )}
@@ -40,11 +40,13 @@ function DataTableActionBar<TData>({
      }
    }
    window.addEventListener("keydown", onKeyDown);
-    return () => window.removeEventListener("keydown", onKeyDown);
+    return () => {
+      window.removeEventListener("keydown", onKeyDown);
+    };
  }, [table]);

  const portalContainer =
-    portalContainerProp ?? (mounted ? globalThis.document?.body : null);
+    portalContainerProp ?? (mounted ? globalThis.document.body : null);

  if (!portalContainer) return null;

@@ -148,9 +148,9 @@ export function DeleteGroupDialog({
                    <Label>What should happen to these profiles?</Label>
                    <RadioGroup
                      value={deleteAction}
-                      onValueChange={(value) =>
-                        setDeleteAction(value as "move" | "delete")
-                      }
+                      onValueChange={(value) => {
+                        setDeleteAction(value as "move" | "delete");
+                      }}
                    >
                      <div className="flex items-center space-x-2">
                        <RadioGroupItem value="move" id="move" />
@@ -90,7 +90,9 @@ export function EditGroupDialog({
              id="group-name"
              placeholder="Enter group name..."
              value={groupName}
-              onChange={(e) => setGroupName(e.target.value)}
+              onChange={(e) => {
+                setGroupName(e.target.value);
+              }}
              onKeyDown={(e) => {
                if (e.key === "Enter" && groupName.trim()) {
                  void handleUpdate();
@@ -137,7 +137,7 @@ export function ExtensionGroupAssignmentDialog({
              </div>
            ) : (
              <Select
-                value={selectedGroupId || "none"}
+                value={selectedGroupId ?? "none"}
                onValueChange={(value) => {
                  setSelectedGroupId(value === "none" ? null : value);
                }}
@@ -197,9 +197,7 @@ export function ExtensionManagementDialog({

  useEffect(() => {
    if (isOpen) {
-      void loadData().then(() => {
-        // Icons will be loaded after extensions are set
-      });
+      void loadData();
    }
  }, [isOpen, loadData]);

@@ -562,7 +560,9 @@ export function ExtensionManagementDialog({
                        ? "border-primary text-foreground"
                        : "border-transparent text-muted-foreground hover:text-foreground"
                    }`}
-                    onClick={() => setActiveTab("extensions")}
+                    onClick={() => {
+                      setActiveTab("extensions");
+                    }}
                    disabled={limitedMode}
                  >
                    {t("extensions.extensionsTab")}
@@ -574,7 +574,9 @@ export function ExtensionManagementDialog({
                        ? "border-primary text-foreground"
                        : "border-transparent text-muted-foreground hover:text-foreground"
                    }`}
-                    onClick={() => setActiveTab("groups")}
+                    onClick={() => {
+                      setActiveTab("groups");
+                    }}
                    disabled={limitedMode}
                  >
                    {t("extensions.groupsTab")}
@@ -627,13 +629,15 @@ export function ExtensionManagementDialog({
                        <div className="flex gap-2">
                          <Input
                            value={extensionName}
-                            onChange={(e) => setExtensionName(e.target.value)}
+                            onChange={(e) => {
+                              setExtensionName(e.target.value);
+                            }}
                            placeholder={t("extensions.namePlaceholder")}
                            className="flex-1"
                          />
                          <RippleButton
                            size="sm"
-                            onClick={handleUpload}
+                            onClick={() => void handleUpload()}
                            disabled={isUploading || !extensionName.trim()}
                          >
                            {isUploading
@@ -705,7 +709,7 @@ export function ExtensionManagementDialog({
                                    <Checkbox
                                      checked={ext.sync_enabled}
                                      onCheckedChange={() =>
-                                        handleToggleExtSync(ext)
+                                        void handleToggleExtSync(ext)
                                      }
                                      disabled={isTogglingExtSync[ext.id]}
                                    />
@@ -745,7 +749,9 @@ export function ExtensionManagementDialog({
                                      variant="ghost"
                                      size="sm"
                                      className="h-7 w-7 p-0"
-                                      onClick={() => setExtensionToDelete(ext)}
+                                      onClick={() => {
+                                        setExtensionToDelete(ext);
+                                      }}
                                    >
                                      <LuTrash2 className="w-3.5 h-3.5" />
                                    </Button>
@@ -769,7 +775,9 @@ export function ExtensionManagementDialog({
                      <Label>{t("extensions.groupsTab")}</Label>
                      <RippleButton
                        size="sm"
-                        onClick={() => setShowCreateGroup(true)}
+                        onClick={() => {
+                          setShowCreateGroup(true);
+                        }}
                        className="flex gap-2 items-center"
                        disabled={limitedMode}
                      >
@@ -783,7 +791,9 @@ export function ExtensionManagementDialog({
                      <div className="flex gap-2 items-center">
                        <Input
                          value={newGroupName}
-                          onChange={(e) => setNewGroupName(e.target.value)}
+                          onChange={(e) => {
+                            setNewGroupName(e.target.value);
+                          }}
                          placeholder={t("extensions.groupNamePlaceholder")}
                          className="flex-1"
                          onKeyDown={(e) => {
@@ -792,7 +802,7 @@ export function ExtensionManagementDialog({
                        />
                        <RippleButton
                          size="sm"
-                          onClick={handleCreateGroup}
+                          onClick={() => void handleCreateGroup()}
                          disabled={!newGroupName.trim()}
                        >
                          {t("common.buttons.create")}
@@ -902,7 +912,7 @@ export function ExtensionManagementDialog({
                                    <Checkbox
                                      checked={group.sync_enabled}
                                      onCheckedChange={() =>
-                                        handleToggleGroupSync(group)
+                                        void handleToggleGroupSync(group)
                                      }
                                      disabled={isTogglingGroupSync[group.id]}
                                    />
@@ -943,7 +953,9 @@ export function ExtensionManagementDialog({
                                    <Button
                                      variant="ghost"
                                      size="sm"
-                                      onClick={() => setGroupToDelete(group)}
+                                      onClick={() => {
+                                        setGroupToDelete(group);
+                                      }}
                                    >
                                      <LuTrash2 className="w-4 h-4" />
                                    </Button>
@@ -996,7 +1008,9 @@ export function ExtensionManagementDialog({
              <Label>{t("common.labels.name")}</Label>
              <Input
                value={editGroupName}
-                onChange={(e) => setEditGroupName(e.target.value)}
+                onChange={(e) => {
+                  setEditGroupName(e.target.value);
+                }}
                placeholder={t("extensions.groupNamePlaceholder")}
              />
            </div>
@@ -1007,9 +1021,9 @@ export function ExtensionManagementDialog({
                <Label>{t("extensions.addToGroup")}</Label>
                <Select
                  value=""
-                  onValueChange={(extId) =>
-                    setEditGroupExtensionIds((prev) => [...prev, extId])
-                  }
+                  onValueChange={(extId) => {
+                    setEditGroupExtensionIds((prev) => [...prev, extId]);
+                  }}
                >
                  <SelectTrigger>
                    <SelectValue placeholder={t("extensions.addToGroup")} />
@@ -1055,11 +1069,11 @@ export function ExtensionManagementDialog({
                          variant="ghost"
                          size="sm"
                          className="h-6 w-6 p-0 shrink-0"
-                          onClick={() =>
+                          onClick={() => {
                            setEditGroupExtensionIds((prev) =>
                              prev.filter((id) => id !== extId),
-                            )
-                          }
+                            );
+                          }}
                        >
                          <LuTrash2 className="w-3 h-3" />
                        </Button>
@@ -1083,7 +1097,7 @@ export function ExtensionManagementDialog({
              {t("common.buttons.cancel")}
            </Button>
            <RippleButton
-              onClick={handleSaveGroupEdits}
+              onClick={() => void handleSaveGroupEdits()}
              disabled={!editGroupName.trim()}
            >
              {t("common.buttons.save")}
@@ -1117,7 +1131,9 @@ export function ExtensionManagementDialog({
                <Label>{t("common.labels.name")}</Label>
                <Input
                  value={editExtensionName}
-                  onChange={(e) => setEditExtensionName(e.target.value)}
+                  onChange={(e) => {
+                    setEditExtensionName(e.target.value);
+                  }}
                  placeholder={t("extensions.namePlaceholder")}
                  onKeyDown={(e) => {
                    if (e.key === "Enter") void handleUpdateExtension();
@@ -1239,7 +1255,7 @@ export function ExtensionManagementDialog({
              {t("common.buttons.cancel")}
            </Button>
            <RippleButton
-              onClick={handleUpdateExtension}
+              onClick={() => void handleUpdateExtension()}
              disabled={!editExtensionName.trim()}
            >
              {t("common.buttons.save")}
@@ -1251,7 +1267,9 @@ export function ExtensionManagementDialog({
      {/* Delete extension confirmation */}
      <DeleteConfirmationDialog
        isOpen={extensionToDelete !== null}
-        onClose={() => setExtensionToDelete(null)}
+        onClose={() => {
+          setExtensionToDelete(null);
+        }}
        onConfirm={handleDeleteExtension}
        title={t("extensions.deleteConfirmTitle")}
        description={t("extensions.deleteConfirmDescription", {
@@ -1263,7 +1281,9 @@ export function ExtensionManagementDialog({
      {/* Delete group confirmation */}
      <DeleteConfirmationDialog
        isOpen={groupToDelete !== null}
-        onClose={() => setGroupToDelete(null)}
+        onClose={() => {
+          setGroupToDelete(null);
+        }}
        onConfirm={handleDeleteGroup}
        title={t("extensions.deleteGroupConfirmTitle")}
        description={t("extensions.deleteGroupConfirmDescription", {
@@ -144,7 +144,9 @@ export function GroupAssignmentDialog({
                size="sm"
                variant="outline"
                className="h-7 px-2 text-xs"
-                onClick={() => setCreateDialogOpen(true)}
+                onClick={() => {
+                  setCreateDialogOpen(true);
+                }}
              >
                <GoPlus className="mr-1 w-3 h-3" /> Create Group
              </RippleButton>
@@ -155,7 +157,7 @@ export function GroupAssignmentDialog({
              </div>
            ) : (
              <Select
-                value={selectedGroupId || "default"}
+                value={selectedGroupId ?? "default"}
                onValueChange={(value) => {
                  setSelectedGroupId(value === "default" ? null : value);
                }}
@@ -201,7 +203,9 @@ export function GroupAssignmentDialog({
      </DialogContent>
      <CreateGroupDialog
        isOpen={createDialogOpen}
-        onClose={() => setCreateDialogOpen(false)}
+        onClose={() => {
+          setCreateDialogOpen(false);
+        }}
        onGroupCreated={(group) => {
          setGroups((prev) => [...prev, group]);
          setSelectedGroupId(group.id);
@@ -246,7 +246,9 @@ export function GroupManagementDialog({
              <Label>Groups</Label>
              <RippleButton
                size="sm"
-                onClick={() => setCreateDialogOpen(true)}
+                onClick={() => {
+                  setCreateDialogOpen(true);
+                }}
                className="flex gap-2 items-center"
              >
                <GoPlus className="w-4 h-4" />
@@ -350,7 +352,9 @@ export function GroupManagementDialog({
                                    <Button
                                      variant="ghost"
                                      size="sm"
-                                      onClick={() => handleEditGroup(group)}
+                                      onClick={() => {
+                                        handleEditGroup(group);
+                                      }}
                                    >
                                      <LuPencil className="w-4 h-4" />
                                    </Button>
@@ -364,7 +368,9 @@ export function GroupManagementDialog({
                                    <Button
                                      variant="ghost"
                                      size="sm"
-                                      onClick={() => handleDeleteGroup(group)}
+                                      onClick={() => {
+                                        handleDeleteGroup(group);
+                                      }}
                                    >
                                      <LuTrash2 className="w-4 h-4" />
                                    </Button>
@@ -395,20 +401,26 @@ export function GroupManagementDialog({

      <CreateGroupDialog
        isOpen={createDialogOpen}
-        onClose={() => setCreateDialogOpen(false)}
+        onClose={() => {
+          setCreateDialogOpen(false);
+        }}
        onGroupCreated={handleGroupCreated}
      />

      <EditGroupDialog
        isOpen={editDialogOpen}
-        onClose={() => setEditDialogOpen(false)}
+        onClose={() => {
+          setEditDialogOpen(false);
+        }}
        group={selectedGroup}
        onGroupUpdated={handleGroupUpdated}
      />

      <DeleteGroupDialog
        isOpen={deleteDialogOpen}
-        onClose={() => setDeleteDialogOpen(false)}
+        onClose={() => {
+          setDeleteDialogOpen(false);
+        }}
        group={selectedGroup}
        onGroupDeleted={handleGroupDeleted}
      />
@@ -22,7 +22,6 @@ import {
  DropdownMenuTrigger,
 } from "./ui/dropdown-menu";
 import { Input } from "./ui/input";
-import { ProBadge } from "./ui/pro-badge";
 import { Tooltip, TooltipContent, TooltipTrigger } from "./ui/tooltip";

 const CLICK_THRESHOLD = 5;
@@ -167,7 +166,7 @@ function useLogoEasterEgg() {
  };
 }

-type Props = {
+interface Props {
  onSettingsDialogOpen: (open: boolean) => void;
  onProxyManagementDialogOpen: (open: boolean) => void;
  onGroupManagementDialogOpen: (open: boolean) => void;
@@ -178,8 +177,7 @@ type Props = {
  onExtensionManagementDialogOpen: (open: boolean) => void;
  searchQuery: string;
  onSearchQueryChange: (query: string) => void;
-  crossOsUnlocked?: boolean;
-};
+}

 const HomeHeader = ({
  onSettingsDialogOpen,
@@ -192,7 +190,6 @@ const HomeHeader = ({
  onExtensionManagementDialogOpen,
  searchQuery,
  onSearchQueryChange,
-  crossOsUnlocked = false,
 }: Props) => {
  const { t } = useTranslation();
  const {
@@ -214,9 +211,15 @@ const HomeHeader = ({
            type="button"
            className="p-1 cursor-pointer select-none"
            onClick={handleClick}
-            onPointerDown={() => setIsPressed(true)}
-            onPointerUp={() => setIsPressed(false)}
-            onPointerLeave={() => setIsPressed(false)}
+            onPointerDown={() => {
+              setIsPressed(true);
+            }}
+            onPointerUp={() => {
+              setIsPressed(false);
+            }}
+            onPointerLeave={() => {
+              setIsPressed(false);
+            }}
          >
            <Logo
              key={wobbleKey}
@@ -241,14 +244,18 @@ const HomeHeader = ({
            type="text"
            placeholder={t("header.searchPlaceholder")}
            value={searchQuery}
-            onChange={(e) => onSearchQueryChange(e.target.value)}
+            onChange={(e) => {
+              onSearchQueryChange(e.target.value);
+            }}
            className="pr-8 pl-10 w-48"
          />
          <LuSearch className="absolute left-3 top-1/2 w-4 h-4 transform -translate-y-1/2 text-muted-foreground" />
          {searchQuery && (
            <button
              type="button"
-              onClick={() => onSearchQueryChange("")}
+              onClick={() => {
+                onSearchQueryChange("");
+              }}
              className="absolute right-2 top-1/2 p-1 rounded-sm transition-colors transform -translate-y-1/2 hover:bg-accent"
              aria-label={t("header.clearSearch")}
            >
@@ -301,15 +308,12 @@ const HomeHeader = ({
              {t("header.menu.groups")}
            </DropdownMenuItem>
            <DropdownMenuItem
-              disabled={!crossOsUnlocked}
-              className={cn(!crossOsUnlocked && "opacity-50")}
              onClick={() => {
                onExtensionManagementDialogOpen(true);
              }}
            >
              <LuPuzzle className="mr-2 w-4 h-4" />
              {t("header.menu.extensions")}
-              {!crossOsUnlocked && <ProBadge className="ml-auto" />}
            </DropdownMenuItem>
            <DropdownMenuItem
              onClick={() => {
@@ -31,7 +31,6 @@ interface AppSettings {
 interface McpConfig {
  port: number;
  token: string;
-  config_json: string;
 }

 interface IntegrationsDialogProps {
@@ -54,11 +53,13 @@ export function IntegrationsDialog({
  });
  const [apiServerPort, setApiServerPort] = useState<number | null>(null);
  const [mcpConfig, setMcpConfig] = useState<McpConfig | null>(null);
-  const [_mcpRunning, setMcpRunning] = useState(false);
+  const [, setMcpRunning] = useState(false);
  const [showApiToken, setShowApiToken] = useState(false);
  const [showMcpToken, setShowMcpToken] = useState(false);
  const [isApiStarting, setIsApiStarting] = useState(false);
  const [isMcpStarting, setIsMcpStarting] = useState(false);
+  const [mcpInClaudeDesktop, setMcpInClaudeDesktop] = useState(false);
+  const [mcpInClaudeCode, setMcpInClaudeCode] = useState(false);

  const { termsAccepted } = useWayfernTerms();

@@ -98,12 +99,32 @@ export function IntegrationsDialog({
    }
  }, []);

+  const loadClaudeDesktopStatus = useCallback(async () => {
+    try {
+      const exists = await invoke<boolean>("is_mcp_in_claude_desktop");
+      setMcpInClaudeDesktop(exists);
+    } catch {
+      // Not critical
+    }
+  }, []);
+
+  const loadClaudeCodeStatus = useCallback(async () => {
+    try {
+      const exists = await invoke<boolean>("is_mcp_in_claude_code");
+      setMcpInClaudeCode(exists);
+    } catch {
+      // Claude CLI may not be installed
+    }
+  }, []);
+
  useEffect(() => {
    if (isOpen) {
-      loadSettings();
-      loadApiServerStatus();
-      loadMcpConfig();
-      loadMcpServerStatus();
+      void loadSettings();
+      void loadApiServerStatus();
+      void loadMcpConfig();
+      void loadMcpServerStatus();
+      void loadClaudeDesktopStatus();
+      void loadClaudeCodeStatus();
    }
  }, [
    isOpen,
@@ -111,6 +132,8 @@ export function IntegrationsDialog({
    loadApiServerStatus,
    loadMcpConfig,
    loadMcpServerStatus,
+    loadClaudeDesktopStatus,
+    loadClaudeCodeStatus,
  ]);

  const handleApiToggle = async (enabled: boolean) => {
@@ -154,7 +177,7 @@ export function IntegrationsDialog({
          settings: { ...settings, mcp_enabled: true, mcp_port: port },
        });
        setSettings(next);
-        loadMcpConfig();
+        void loadMcpConfig();
        showSuccessToast(`MCP server started on port ${port}`);
      } else {
        await invoke("stop_mcp_server");
@@ -175,47 +198,13 @@ export function IntegrationsDialog({
    }
  };

-  const obfuscateToken = (token: string) =>
-    "•".repeat(Math.min(token.length, 32));
-
-  const getFormattedMcpConfig = () => {
-    if (!mcpConfig) return "";
-    return JSON.stringify(
-      {
-        mcpServers: {
-          "donut-browser": {
-            url: `http://127.0.0.1:${mcpConfig.port}/mcp`,
-            headers: {
-              Authorization: `Bearer ${mcpConfig.token}`,
-            },
-          },
-        },
-      },
-      null,
-      2,
-    );
-  };
-
-  const getObfuscatedMcpConfig = () => {
-    if (!mcpConfig) return "";
-    return JSON.stringify(
-      {
-        mcpServers: {
-          "donut-browser": {
-            url: `http://127.0.0.1:${mcpConfig.port}/mcp`,
-            headers: {
-              Authorization: `Bearer ${obfuscateToken(mcpConfig.token)}`,
-            },
-          },
-        },
-      },
-      null,
-      2,
-    );
-  };
-
  return (
-    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) onClose();
+      }}
+    >
      <DialogContent className="max-w-xl max-h-[80vh] my-8 flex flex-col">
        <DialogHeader className="shrink-0">
          <DialogTitle>Integrations</DialogTitle>
@@ -234,7 +223,7 @@ export function IntegrationsDialog({
                  id="api-enabled"
                  checked={apiServerPort !== null}
                  disabled={isApiStarting}
-                  onCheckedChange={handleApiToggle}
+                  onCheckedChange={(checked) => void handleApiToggle(!!checked)}
                />
                <div className="grid gap-1.5 leading-none">
                  <Label
@@ -282,7 +271,9 @@ export function IntegrationsDialog({
                          variant="ghost"
                          size="sm"
                          className="absolute right-0 top-0 h-full px-3 hover:bg-transparent"
-                          onClick={() => setShowApiToken(!showApiToken)}
+                          onClick={() => {
+                            setShowApiToken(!showApiToken);
+                          }}
                        >
                          {showApiToken ? (
                            <EyeOff className="h-4 w-4" />
@@ -310,7 +301,7 @@ export function IntegrationsDialog({
                  id="mcp-enabled"
                  checked={settings.mcp_enabled && mcpConfig !== null}
                  disabled={!termsAccepted || isMcpStarting}
-                  onCheckedChange={handleMcpToggle}
+                  onCheckedChange={(checked) => void handleMcpToggle(!!checked)}
                />
                <div className="grid gap-1.5 leading-none">
                  <Label
@@ -331,39 +322,131 @@ export function IntegrationsDialog({
              </div>

              {mcpConfig && (
-                <div className="space-y-3 p-4 rounded-md border bg-muted/40">
-                  <div className="relative">
-                    <pre className="p-3 text-xs font-mono rounded-md bg-background border overflow-x-auto whitespace-pre">
-                      {showMcpToken
-                        ? getFormattedMcpConfig()
-                        : getObfuscatedMcpConfig()}
-                    </pre>
-                    <div className="absolute top-2 right-2 flex items-center space-x-1">
-                      <Button
-                        type="button"
-                        variant="ghost"
-                        size="sm"
-                        className="h-7 w-7 p-0"
-                        onClick={() => setShowMcpToken(!showMcpToken)}
-                      >
-                        {showMcpToken ? (
-                          <EyeOff className="h-3.5 w-3.5" />
-                        ) : (
-                          <Eye className="h-3.5 w-3.5" />
-                        )}
-                      </Button>
+                <div className="space-y-4 p-4 rounded-md border bg-muted/40">
+                  <div className="space-y-2">
+                    <Label className="text-sm font-medium">
+                      {t("integrations.mcp.url")}
+                    </Label>
+                    <div className="flex items-center space-x-2">
+                      <div className="relative flex-1">
+                        <Input
+                          type={showMcpToken ? "text" : "password"}
+                          value={`http://127.0.0.1:${mcpConfig.port}/mcp/${mcpConfig.token}`}
+                          readOnly
+                          className="font-mono text-xs pr-10"
+                        />
+                        <Button
+                          type="button"
+                          variant="ghost"
+                          size="sm"
+                          className="absolute right-0 top-0 h-full px-3 hover:bg-transparent"
+                          onClick={() => {
+                            setShowMcpToken(!showMcpToken);
+                          }}
+                        >
+                          {showMcpToken ? (
+                            <EyeOff className="h-4 w-4" />
+                          ) : (
+                            <Eye className="h-4 w-4" />
+                          )}
+                        </Button>
+                      </div>
                      <CopyToClipboard
-                        text={getFormattedMcpConfig()}
-                        successMessage="Configuration copied"
+                        text={`http://127.0.0.1:${mcpConfig.port}/mcp/${mcpConfig.token}`}
+                        successMessage={t("integrations.mcp.urlCopied")}
                      />
                    </div>
                  </div>
-                  <p className="text-xs text-muted-foreground">
-                    {t("integrations.mcpCopyHint")}
-                  </p>
-                  <p className="text-xs text-muted-foreground">
-                    {t("integrations.mcpConfigPath")}
-                  </p>
+
+                  <div className="space-y-2 pt-1 border-t">
+                    <p className="text-xs font-medium text-muted-foreground">
+                      {t("integrations.mcp.claudeDesktopTitle")}
+                    </p>
+                    {mcpInClaudeDesktop ? (
+                      <Button
+                        variant="outline"
+                        size="sm"
+                        className="w-full"
+                        onClick={async () => {
+                          try {
+                            await invoke("remove_mcp_from_claude_desktop");
+                            setMcpInClaudeDesktop(false);
+                            showSuccessToast(
+                              t("integrations.mcp.removedFromClaudeDesktop"),
+                            );
+                          } catch (e) {
+                            showErrorToast(String(e));
+                          }
+                        }}
+                      >
+                        {t("integrations.mcp.removeFromClaudeDesktop")}
+                      </Button>
+                    ) : (
+                      <Button
+                        variant="outline"
+                        size="sm"
+                        className="w-full"
+                        onClick={async () => {
+                          try {
+                            await invoke("add_mcp_to_claude_desktop");
+                            setMcpInClaudeDesktop(true);
+                            showSuccessToast(
+                              t("integrations.mcp.addedToClaudeDesktop"),
+                            );
+                          } catch (e) {
+                            showErrorToast(String(e));
+                          }
+                        }}
+                      >
+                        {t("integrations.mcp.addToClaudeDesktop")}
+                      </Button>
+                    )}
+                  </div>
+
+                  <div className="space-y-2 pt-1 border-t">
+                    <p className="text-xs font-medium text-muted-foreground">
+                      {t("integrations.mcp.claudeCodeTitle")}
+                    </p>
+                    {mcpInClaudeCode ? (
+                      <Button
+                        variant="outline"
+                        size="sm"
+                        className="w-full"
+                        onClick={async () => {
+                          try {
+                            await invoke("remove_mcp_from_claude_code");
+                            setMcpInClaudeCode(false);
+                            showSuccessToast(
+                              t("integrations.mcp.removedFromClaudeCode"),
+                            );
+                          } catch (e) {
+                            showErrorToast(String(e));
+                          }
+                        }}
+                      >
+                        {t("integrations.mcp.removeFromClaudeCode")}
+                      </Button>
+                    ) : (
+                      <Button
+                        variant="outline"
+                        size="sm"
+                        className="w-full"
+                        onClick={async () => {
+                          try {
+                            await invoke("add_mcp_to_claude_code");
+                            setMcpInClaudeCode(true);
+                            showSuccessToast(
+                              t("integrations.mcp.addedToClaudeCode"),
+                            );
+                          } catch (e) {
+                            showErrorToast(String(e));
+                          }
+                        }}
+                      >
+                        {t("integrations.mcp.addToClaudeCode")}
+                      </Button>
+                    )}
+                  </div>
                </div>
              )}
            </TabsContent>
@@ -62,9 +62,15 @@ export function LaunchOnLoginDialog({
    <Dialog open={isOpen}>
      <DialogContent
        className="sm:max-w-sm"
-        onEscapeKeyDown={(e) => e.preventDefault()}
-        onPointerDownOutside={(e) => e.preventDefault()}
-        onInteractOutside={(e) => e.preventDefault()}
+        onEscapeKeyDown={(e) => {
+          e.preventDefault();
+        }}
+        onPointerDownOutside={(e) => {
+          e.preventDefault();
+        }}
+        onInteractOutside={(e) => {
+          e.preventDefault();
+        }}
      >
        <DialogHeader>
          <DialogTitle>Enable Launch on Login?</DialogTitle>
@@ -62,13 +62,17 @@ export function LocationProxyDialog({
  useEffect(() => {
    if (!isOpen) return;
    setIsLoadingCountries(true);
-    invoke<LocationItem[]>("cloud_get_countries")
-      .then((data) => setCountries(data))
+    void invoke<LocationItem[]>("cloud_get_countries")
+      .then((data) => {
+        setCountries(data);
+      })
      .catch((err) => {
        console.error("Failed to fetch countries:", err);
        toast.error("Failed to load countries");
      })
-      .finally(() => setIsLoadingCountries(false));
+      .finally(() => {
+        setIsLoadingCountries(false);
+      });
  }, [isOpen]);

  // Fetch regions when country changes
@@ -83,10 +87,18 @@ export function LocationProxyDialog({
    setSelectedIsp("");
    setCities([]);
    setIsps([]);
-    invoke<LocationItem[]>("cloud_get_regions", { country: selectedCountry })
-      .then((data) => setRegions(data))
-      .catch((err) => console.error("Failed to fetch regions:", err))
-      .finally(() => setIsLoadingRegions(false));
+    void invoke<LocationItem[]>("cloud_get_regions", {
+      country: selectedCountry,
+    })
+      .then((data) => {
+        setRegions(data);
+      })
+      .catch((err) => {
+        console.error("Failed to fetch regions:", err);
+      })
+      .finally(() => {
+        setIsLoadingRegions(false);
+      });
  }, [selectedCountry]);

  // Fetch cities when country or region changes (cities can be loaded without region)
@@ -103,10 +115,16 @@ export function LocationProxyDialog({
    if (selectedRegion) {
      args.region = selectedRegion;
    }
-    invoke<LocationItem[]>("cloud_get_cities", args)
-      .then((data) => setCities(data))
-      .catch((err) => console.error("Failed to fetch cities:", err))
-      .finally(() => setIsLoadingCities(false));
+    void invoke<LocationItem[]>("cloud_get_cities", args)
+      .then((data) => {
+        setCities(data);
+      })
+      .catch((err) => {
+        console.error("Failed to fetch cities:", err);
+      })
+      .finally(() => {
+        setIsLoadingCities(false);
+      });
  }, [selectedCountry, selectedRegion]);

  // Fetch ISPs when country/region/city changes
@@ -122,10 +140,16 @@ export function LocationProxyDialog({
    };
    if (selectedRegion) args.region = selectedRegion;
    if (selectedCity) args.city = selectedCity;
-    invoke<LocationItem[]>("cloud_get_isps", args)
-      .then((data) => setIsps(data))
-      .catch((err) => console.error("Failed to fetch ISPs:", err))
-      .finally(() => setIsLoadingIsps(false));
+    void invoke<LocationItem[]>("cloud_get_isps", args)
+      .then((data) => {
+        setIsps(data);
+      })
+      .catch((err) => {
+        console.error("Failed to fetch ISPs:", err);
+      })
+      .finally(() => {
+        setIsLoadingIsps(false);
+      });
  }, [selectedCountry, selectedRegion, selectedCity]);

  // Auto-generate name from selections
@@ -302,7 +326,9 @@ export function LocationProxyDialog({
            <Label>Name</Label>
            <Input
              value={proxyName}
-              onChange={(e) => setProxyName(e.target.value)}
+              onChange={(e) => {
+                setProxyName(e.target.value);
+              }}
              placeholder="Proxy name"
            />
          </div>
@@ -19,9 +19,7 @@ export interface Option {
  /** Group the options by providing key. */
  [key: string]: string | boolean | undefined;
 }
-interface GroupOption {
-  [key: string]: Option[];
-}
+type GroupOption = Record<string, Option[]>;

 interface MultipleSelectorProps {
  value?: Option[];
@@ -77,12 +75,13 @@ export interface MultipleSelectorRef {
  input: HTMLInputElement;
 }

-// eslint-disable-next-line react-refresh/only-export-components
 export function useDebounce<T>(value: T, delay?: number): T {
  const [debouncedValue, setDebouncedValue] = React.useState<T>(value);

  useEffect(() => {
-    const timer = setTimeout(() => setDebouncedValue(value), delay || 500);
+    const timer = setTimeout(() => {
+      setDebouncedValue(value);
+    }, delay ?? 500);

    return () => {
      clearTimeout(timer);
@@ -104,11 +103,11 @@ function transToGroupOption(options: Option[], groupBy?: string) {

  const groupOption: GroupOption = {};
  options.forEach((option) => {
-    const key = (option[groupBy] as string) || "";
+    const key = (option[groupBy] as string) ?? "";
    if (!groupOption[key]) {
      groupOption[key] = [option];
    } else {
-      groupOption[key]?.push(option);
+      groupOption[key].push(option);
    }
  });
  return groupOption;
@@ -197,12 +196,12 @@ const MultipleSelector = React.forwardRef<
    const [open, setOpen] = React.useState(false);
    const [isLoading, setIsLoading] = React.useState(false);

-    const [selected, setSelected] = React.useState<Option[]>(value || []);
+    const [selected, setSelected] = React.useState<Option[]>(value ?? []);
    const [options, setOptions] = React.useState<GroupOption>(
      transToGroupOption(arrayDefaultOptions, groupBy),
    );
    const [inputValue, setInputValue] = React.useState("");
-    const debouncedSearchTerm = useDebounce(inputValue, delay || 500);
+    const debouncedSearchTerm = useDebounce(inputValue, delay ?? 500);

    React.useImperativeHandle(
      ref,
@@ -231,7 +230,7 @@ const MultipleSelector = React.forwardRef<
            if (input.value === "" && selected.length > 0) {
              const lastSelectOption = selected[selected.length - 1];
              // If last item is fixed, we should not remove it.
-              if (!lastSelectOption?.fixed) {
+              if (!lastSelectOption.fixed) {
                // biome-ignore lint/style/noNonNullAssertion: false positive
                handleUnselect(selected.at(-1)!);
              }
@@ -257,7 +256,7 @@ const MultipleSelector = React.forwardRef<
      if (!arrayOptions || onSearch) {
        return;
      }
-      const newOption = transToGroupOption(arrayOptions || [], groupBy);
+      const newOption = transToGroupOption(arrayOptions, groupBy);
      if (JSON.stringify(newOption) !== JSON.stringify(options)) {
        setOptions(newOption);
      }
@@ -267,7 +266,7 @@ const MultipleSelector = React.forwardRef<
      const doSearch = async () => {
        setIsLoading(true);
        const res = await onSearch?.(debouncedSearchTerm);
-        setOptions(transToGroupOption(res || [], groupBy));
+        setOptions(transToGroupOption(res ?? [], groupBy));
        setIsLoading(false);
      };

@@ -284,7 +283,6 @@ const MultipleSelector = React.forwardRef<
      };

      void exec();
-      // eslint-disable-next-line react-hooks/exhaustive-deps
    }, [debouncedSearchTerm, groupBy, open, triggerSearchOnFocus, onSearch]);

    const CreatableItem = () => {
@@ -414,14 +412,14 @@ const MultipleSelector = React.forwardRef<
                    badgeClassName,
                  )}
                  data-fixed={option.fixed}
-                  data-disabled={disabled || undefined}
+                  data-disabled={disabled ?? undefined}
                >
                  {option.label ?? option.value}
                  <button
                    type="button"
                    className={cn(
                      "cursor-pointer ml-1 rounded-full outline-none ring-offset-background focus:ring-2 focus:ring-ring focus:ring-offset-2",
-                      (disabled || option.fixed) && "hidden",
+                      (disabled ?? option.fixed) && "hidden",
                    )}
                    onKeyDown={(e) => {
                      if (e.key === "Enter") {
@@ -432,7 +430,9 @@ const MultipleSelector = React.forwardRef<
                      e.preventDefault();
                      e.stopPropagation();
                    }}
-                    onClick={() => handleUnselect(option)}
+                    onClick={() => {
+                      handleUnselect(option);
+                    }}
                  >
                    <LuX className="w-3 h-3 text-muted-foreground hover:text-foreground" />
                  </button>
@@ -490,7 +490,7 @@ const MultipleSelector = React.forwardRef<
              onFocus={(event) => {
                setOpen(true);
                if (triggerSearchOnFocus && onSearch) {
-                  onSearch(debouncedSearchTerm);
+                  void onSearch(debouncedSearchTerm);
                }
                inputProps?.onFocus?.(event);
              }}
@@ -156,7 +156,9 @@ export function PermissionDialog({
            <LoadingButton
              isLoading={isRequesting}
              onClick={() => {
-                handleRequestPermission().catch(console.error);
+                handleRequestPermission().catch((err: unknown) => {
+                  console.error(err);
+                });
              }}
              className="min-w-24"
            >
@@ -102,7 +102,7 @@ import { RippleButton } from "./ui/ripple";

 // Stable table meta type to pass volatile state/handlers into TanStack Table without
 // causing column definitions to be recreated on every render.
-type TableMeta = {
+interface TableMeta {
  t: (key: string, options?: Record<string, unknown>) => string;
  selectedProfiles: string[];
  selectableCount: number;
@@ -216,14 +216,14 @@ type TableMeta = {
      }
    | undefined;
  onLaunchWithSync: (profile: BrowserProfile) => void;
-};
+}

-type SyncStatusDot = {
+interface SyncStatusDot {
  color: string;
  tooltip: string;
  animate: boolean;
  encrypted: boolean;
-};
+}

 function getProfileSyncStatusDot(
  profile: BrowserProfile,
@@ -436,7 +436,9 @@ const TagsCell = React.memo<{
        }
      };
      document.addEventListener("mousedown", handleClick);
-      return () => document.removeEventListener("mousedown", handleClick);
+      return () => {
+        document.removeEventListener("mousedown", handleClick);
+      };
    }, [openTagsEditorFor, profile.id, setOpenTagsEditorFor]);

    React.useEffect(() => {
@@ -444,7 +446,7 @@ const TagsCell = React.memo<{
        // Focus the inner input of MultipleSelector on open
        const inputEl = editorRef.current.querySelector("input");
        if (inputEl) {
-          (inputEl as HTMLInputElement).focus();
+          inputEl.focus();
        }
      }
    }, [openTagsEditorFor, profile.id]);
@@ -537,8 +539,12 @@ const TagsCell = React.memo<{
              onKeyDown: (e) => {
                if (e.key === "Escape") setOpenTagsEditorFor(null);
              },
-              onFocus: () => setIsFocused(true),
-              onBlur: () => setIsFocused(false),
+              onFocus: () => {
+                setIsFocused(true);
+              },
+              onBlur: () => {
+                setIsFocused(false);
+              },
            }}
          />
        </div>
@@ -569,8 +575,12 @@ const NonHoverableTooltip = React.memo<{
      <Tooltip open={isOpen} onOpenChange={setIsOpen}>
        <TooltipTrigger
          asChild
-          onMouseEnter={() => setIsOpen(true)}
-          onMouseLeave={() => setIsOpen(false)}
+          onMouseEnter={() => {
+            setIsOpen(true);
+          }}
+          onMouseLeave={() => {
+            setIsOpen(false);
+          }}
        >
          {children}
        </TooltipTrigger>
@@ -578,8 +588,12 @@ const NonHoverableTooltip = React.memo<{
          sideOffset={sideOffset}
          alignOffset={alignOffset}
          arrowOffset={horizontalOffset}
-          onPointerEnter={(e) => e.preventDefault()}
-          onPointerLeave={() => setIsOpen(false)}
+          onPointerEnter={(e) => {
+            e.preventDefault();
+          }}
+          onPointerLeave={() => {
+            setIsOpen(false);
+          }}
          className="pointer-events-none"
          style={
            horizontalOffset !== 0
@@ -623,7 +637,7 @@ const NoteCell = React.memo<{

    const onNoteChange = React.useCallback(
      async (newNote: string | null) => {
-        const trimmedNote = newNote?.trim() || null;
+        const trimmedNote = newNote?.trim() ?? null;
        setNoteOverrides((prev) => ({ ...prev, [profile.id]: trimmedNote }));
        try {
          await invoke<BrowserProfile>("update_profile_note", {
@@ -639,12 +653,12 @@ const NoteCell = React.memo<{

    const editorRef = React.useRef<HTMLDivElement | null>(null);
    const textareaRef = React.useRef<HTMLTextAreaElement | null>(null);
-    const [noteValue, setNoteValue] = React.useState(effectiveNote || "");
+    const [noteValue, setNoteValue] = React.useState(effectiveNote ?? "");

    // Update local state when effective note changes (from outside)
    React.useEffect(() => {
      if (openNoteEditorFor !== profile.id) {
-        setNoteValue(effectiveNote || "");
+        setNoteValue(effectiveNote ?? "");
      }
    }, [effectiveNote, openNoteEditorFor, profile.id]);

@@ -678,13 +692,15 @@ const NoteCell = React.memo<{
          target &&
          !editorRef.current.contains(target)
        ) {
-          const currentValue = textareaRef.current?.value || "";
+          const currentValue = textareaRef.current?.value ?? "";
          void onNoteChange(currentValue);
          setOpenNoteEditorFor(null);
        }
      };
      document.addEventListener("mousedown", handleClick);
-      return () => document.removeEventListener("mousedown", handleClick);
+      return () => {
+        document.removeEventListener("mousedown", handleClick);
+      };
    }, [openNoteEditorFor, profile.id, setOpenNoteEditorFor, onNoteChange]);

    React.useEffect(() => {
@@ -696,7 +712,7 @@ const NoteCell = React.memo<{
      }
    }, [openNoteEditorFor, profile.id]);

-    const displayNote = effectiveNote || "";
+    const displayNote = effectiveNote ?? "";
    const trimmedNote =
      displayNote.length > 12 ? `${displayNote.slice(0, 12)}...` : displayNote;
    const showTooltip = displayNote.length > 12 || displayNote.length > 0;
@@ -716,7 +732,7 @@ const NoteCell = React.memo<{
                )}
                onClick={() => {
                  if (!isDisabled) {
-                    setNoteValue(effectiveNote || "");
+                    setNoteValue(effectiveNote ?? "");
                    setOpenNoteEditorFor(profile.id);
                  }
                }}
@@ -734,7 +750,7 @@ const NoteCell = React.memo<{
            {showTooltip && (
              <TooltipContent className="max-w-[320px]">
                <p className="whitespace-pre-wrap wrap-break-word">
-                  {effectiveNote || "No Note"}
+                  {effectiveNote ?? "No Note"}
                </p>
              </TooltipContent>
            )}
@@ -760,7 +776,7 @@ const NoteCell = React.memo<{
            onChange={handleTextareaChange}
            onKeyDown={(e) => {
              if (e.key === "Escape") {
-                setNoteValue(effectiveNote || "");
+                setNoteValue(effectiveNote ?? "");
                setOpenNoteEditorFor(null);
              } else if (e.key === "Enter" && (e.metaKey || e.ctrlKey)) {
                void onNoteChange(noteValue);
@@ -1100,14 +1116,13 @@ export function ProfilesDataTable({
    isUpdating,
    launchingProfiles,
    stoppingProfiles,
-    crossOsUnlocked,
  );

  // Listen for sync status events
  React.useEffect(() => {
    if (!browserState.isClient) return;
    let unlisten: (() => void) | undefined;
-    (async () => {
+    void (async () => {
      try {
        unlisten = await listen<{
          profile_id: string;
@@ -1168,8 +1183,12 @@ export function ProfilesDataTable({
    };

    void fetchTrafficSnapshots();
-    const interval = setInterval(fetchTrafficSnapshots, 1000);
-    return () => clearInterval(interval);
+    const interval = setInterval(() => {
+      void fetchTrafficSnapshots();
+    }, 1000);
+    return () => {
+      clearInterval(interval);
+    };
  }, [browserState.isClient, runningCount, runningProfileIds]);

  // Clean up snapshots for profiles that are no longer running
@@ -1196,7 +1215,7 @@ export function ProfilesDataTable({
  React.useEffect(() => {
    if (!browserState.isClient) return;
    let unlisten: (() => void) | undefined;
-    (async () => {
+    void (async () => {
      try {
        unlisten = await listen<{ id: string; is_running: boolean }>(
          "profile-running-changed",
@@ -1231,7 +1250,7 @@ export function ProfilesDataTable({
  React.useEffect(() => {
    if (!browserState.isClient) return;
    let unlisten: (() => void) | undefined;
-    (async () => {
+    void (async () => {
      try {
        unlisten = await listen("stored-proxies-changed", () => {
          // Also refresh tags on profile updates
@@ -1521,7 +1540,11 @@ export function ProfilesDataTable({

      // Overflow actions
      onAssignProfilesToGroup,
-      onCloneProfile,
+      onCloneProfile: onCloneProfile
+        ? (profile: BrowserProfile) => {
+            void onCloneProfile(profile);
+          }
+        : undefined,
      onConfigureCamoufox,
      onCopyCookiesToProfile,
      onOpenCookieManagement,
@@ -1553,7 +1576,11 @@ export function ProfilesDataTable({

      // Synchronizer
      getProfileSyncInfo: getProfileSyncInfo ?? (() => undefined),
-      onLaunchWithSync: onLaunchWithSync ?? (() => {}),
+      onLaunchWithSync:
+        onLaunchWithSync ??
+        (() => {
+          /* empty */
+        }),
    }),
    [
      t,
@@ -1625,7 +1652,9 @@ export function ProfilesDataTable({
                  meta.selectedProfiles.length === meta.selectableCount &&
                  meta.selectableCount !== 0
                }
-                onCheckedChange={(value) => meta.handleToggleAll(!!value)}
+                onCheckedChange={(value) => {
+                  meta.handleToggleAll(!!value);
+                }}
                aria-label="Select all"
                className="cursor-pointer"
              />
@@ -1669,7 +1698,9 @@ export function ProfilesDataTable({
                    <button
                      type="button"
                      className="flex justify-center items-center p-0 border-none cursor-pointer"
-                      onClick={() => meta.handleIconClick(profile.id)}
+                      onClick={() => {
+                        meta.handleIconClick(profile.id);
+                      }}
                      aria-label="Select profile"
                    >
                      <span className="w-4 h-4 group">
@@ -1705,9 +1736,9 @@ export function ProfilesDataTable({
                <span className="flex justify-center items-center w-4 h-4">
                  <Checkbox
                    checked={isSelected}
-                    onCheckedChange={(value) =>
-                      meta.handleCheckboxChange(profile.id, !!value)
-                    }
+                    onCheckedChange={(value) => {
+                      meta.handleCheckboxChange(profile.id, !!value);
+                    }}
                    aria-label="Select row"
                    className="w-4 h-4"
                  />
@@ -1753,9 +1784,9 @@ export function ProfilesDataTable({
                <span className="flex justify-center items-center w-4 h-4">
                  <Checkbox
                    checked={isSelected}
-                    onCheckedChange={(value) =>
-                      meta.handleCheckboxChange(profile.id, !!value)
-                    }
+                    onCheckedChange={(value) => {
+                      meta.handleCheckboxChange(profile.id, !!value);
+                    }}
                    aria-label="Select row"
                    className="w-4 h-4"
                  />
@@ -1774,7 +1805,9 @@ export function ProfilesDataTable({
                <button
                  type="button"
                  className="flex justify-center items-center p-0 border-none cursor-pointer"
-                  onClick={() => meta.handleIconClick(profile.id)}
+                  onClick={() => {
+                    meta.handleIconClick(profile.id);
+                  }}
                  aria-label="Select profile"
                >
                  <span className="w-4 h-4 group">
@@ -1802,8 +1835,11 @@ export function ProfilesDataTable({
          const isLaunching = meta.launchingProfiles.has(profile.id);
          const isStopping = meta.stoppingProfiles.has(profile.id);
          const isLockedByAnother = meta.isProfileLockedByAnother(profile.id);
+          const isSyncing = meta.syncStatuses[profile.id]?.status === "syncing";
          const canLaunch =
-            meta.browserState.canLaunchProfile(profile) && !isLockedByAnother;
+            meta.browserState.canLaunchProfile(profile) &&
+            !isLockedByAnother &&
+            !isSyncing;
          const lockEmail = meta.getProfileLockEmail(profile.id);
          const tooltipContent = isLockedByAnother
            ? meta.t("sync.team.cannotLaunchLocked", { email: lockEmail })
@@ -1831,25 +1867,26 @@ export function ProfilesDataTable({
            );
            try {
              await meta.onLaunchProfile(profile);
-            } catch (error) {
+            } finally {
+              // Always clear launching state — the running state is tracked
+              // separately via profile-running-changed events
              meta.setLaunchingProfiles((prev: Set<string>) => {
                const next = new Set(prev);
                next.delete(profile.id);
                return next;
              });
-              throw error;
            }
          };

          const syncInfo = meta.getProfileSyncInfo(profile.id);
          const isLeader = syncInfo?.isLeader === true;
          const isFollower = syncInfo?.isLeader === false;
-          const isDesynced = isFollower && syncInfo?.failedAtUrl != null;
+          const isDesynced = isFollower && syncInfo.failedAtUrl != null;
          const stopTooltip = isLeader
            ? meta.t("profiles.synchronizer.stopLeader")
            : isFollower
              ? meta.t("profiles.synchronizer.stopFollower", {
-                  leaderName: syncInfo?.session.leader_profile_name ?? "",
+                  leaderName: syncInfo.session.leader_profile_name ?? "",
                })
              : tooltipContent;

@@ -1916,7 +1953,7 @@ export function ProfilesDataTable({
                      onClick={() =>
                        isRunning
                          ? void handleStop()
-                          : handleProfileLaunch(profile)
+                          : void handleProfileLaunch(profile)
                      }
                    >
                      {isLaunching || isStopping ? (
@@ -1947,9 +1984,9 @@ export function ProfilesDataTable({
          return (
            <Button
              variant="ghost"
-              onClick={() =>
-                column.toggleSorting(column.getIsSorted() === "asc")
-              }
+              onClick={() => {
+                column.toggleSorting(column.getIsSorted() === "asc");
+              }}
              className="justify-start p-0 h-auto font-semibold text-left cursor-pointer"
            >
              Name
@@ -2098,10 +2135,10 @@ export function ProfilesDataTable({
            <TagsCell
              profile={profile}
              isDisabled={isDisabled}
-              tagsOverrides={meta.tagsOverrides || {}}
-              allTags={meta.allTags || []}
+              tagsOverrides={meta.tagsOverrides ?? {}}
+              allTags={meta.allTags ?? []}
              setAllTags={meta.setAllTags}
-              openTagsEditorFor={meta.openTagsEditorFor || null}
+              openTagsEditorFor={meta.openTagsEditorFor ?? null}
              setOpenTagsEditorFor={meta.setOpenTagsEditorFor}
              setTagsOverrides={meta.setTagsOverrides}
            />
@@ -2127,8 +2164,8 @@ export function ProfilesDataTable({
            <NoteCell
              profile={profile}
              isDisabled={isDisabled}
-              noteOverrides={meta.noteOverrides || {}}
-              openNoteEditorFor={meta.openNoteEditorFor || null}
+              noteOverrides={meta.noteOverrides ?? {}}
+              openNoteEditorFor={meta.openNoteEditorFor ?? null}
              setOpenNoteEditorFor={meta.setOpenNoteEditorFor}
              setNoteOverrides={meta.setNoteOverrides}
            />
@@ -2192,12 +2229,12 @@ export function ProfilesDataTable({
              ? [...snapshot.recent_bandwidth]
              : [];
            const currentBandwidth =
-              (snapshot?.current_bytes_sent || 0) +
-              (snapshot?.current_bytes_received || 0);
+              (snapshot?.current_bytes_sent ?? 0) +
+              (snapshot?.current_bytes_received ?? 0);

            return (
              <BandwidthMiniChart
-                key={`${profile.id}-${snapshot?.last_update || 0}-${bandwidthData.length}`}
+                key={`${profile.id}-${snapshot?.last_update ?? 0}-${bandwidthData.length}`}
                data={bandwidthData}
                currentBandwidth={currentBandwidth}
                onClick={() => meta.onOpenTrafficDialog?.(profile.id)}
@@ -2209,9 +2246,9 @@ export function ProfilesDataTable({
            <div className="flex gap-2 items-center">
              <Popover
                open={isSelectorOpen}
-                onOpenChange={(open) =>
-                  meta.setOpenProxySelectorFor(open ? profile.id : null)
-                }
+                onOpenChange={(open) => {
+                  meta.setOpenProxySelectorFor(open ? profile.id : null);
+                }}
              >
                <Tooltip>
                  <TooltipTrigger asChild>
@@ -2464,7 +2501,9 @@ export function ProfilesDataTable({
                variant="ghost"
                className="p-0 w-8 h-8"
                disabled={!meta.isClient}
-                onClick={() => setProfileForInfoDialog(profile)}
+                onClick={() => {
+                  setProfileForInfoDialog(profile);
+                }}
              >
                <span className="sr-only">Profile info</span>
                <LuInfo className="w-4 h-4" />
@@ -2594,7 +2633,9 @@ export function ProfilesDataTable({
      </ScrollArea>
      <DeleteConfirmationDialog
        isOpen={profileToDelete !== null}
-        onClose={() => setProfileToDelete(null)}
+        onClose={() => {
+          setProfileToDelete(null);
+        }}
        onConfirm={handleDelete}
        title="Delete Profile"
        description={`This action cannot be undone. This will permanently delete the profile "${profileToDelete?.name}" and all its associated data.`}
@@ -2614,7 +2655,9 @@ export function ProfilesDataTable({
          return (
            <ProfileInfoDialog
              isOpen={profileForInfoDialog !== null}
-              onClose={() => setProfileForInfoDialog(null)}
+              onClose={() => {
+                setProfileForInfoDialog(null);
+              }}
              profile={infoProfile}
              storedProxies={storedProxies}
              vpnConfigs={vpnConfigs}
@@ -2628,7 +2671,9 @@ export function ProfilesDataTable({
              onCopyCookiesToProfile={onCopyCookiesToProfile}
              onOpenCookieManagement={onOpenCookieManagement}
              onAssignExtensionGroup={onAssignExtensionGroup}
-              onOpenBypassRules={(profile) => setBypassRulesProfile(profile)}
+              onOpenBypassRules={(profile) => {
+                setBypassRulesProfile(profile);
+              }}
              onCloneProfile={onCloneProfile}
              onLaunchWithSync={onLaunchWithSync}
              onDeleteProfile={(profile) => {
@@ -2665,40 +2710,20 @@ export function ProfilesDataTable({
        )}
        {onBulkExtensionGroupAssignment && (
          <DataTableActionBarAction
-            tooltip={
-              crossOsUnlocked
-                ? "Assign Extension Group"
-                : "Assign Extension Group (Pro)"
-            }
+            tooltip="Assign Extension Group"
            onClick={onBulkExtensionGroupAssignment}
            size="icon"
-            disabled={!crossOsUnlocked}
          >
-            <span className="relative">
-              <LuPuzzle />
-              {!crossOsUnlocked && (
-                <span className="absolute -bottom-1.5 left-1/2 -translate-x-1/2 text-[6px] font-bold leading-none bg-primary text-primary-foreground px-0.5 rounded-sm">
-                  PRO
-                </span>
-              )}
-            </span>
+            <LuPuzzle />
          </DataTableActionBarAction>
        )}
        {onBulkCopyCookies && (
          <DataTableActionBarAction
-            tooltip={crossOsUnlocked ? "Copy Cookies" : "Copy Cookies (Pro)"}
+            tooltip="Copy Cookies"
            onClick={onBulkCopyCookies}
            size="icon"
-            disabled={!crossOsUnlocked}
          >
-            <span className="relative">
-              <LuCookie />
-              {!crossOsUnlocked && (
-                <span className="absolute -bottom-1.5 left-1/2 -translate-x-1/2 text-[6px] font-bold leading-none bg-primary text-primary-foreground px-0.5 rounded-sm">
-                  PRO
-                </span>
-              )}
-            </span>
+            <LuCookie />
          </DataTableActionBarAction>
        )}
        {onBulkDelete && (
@@ -2716,14 +2741,18 @@ export function ProfilesDataTable({
      {trafficDialogProfile && (
        <TrafficDetailsDialog
          isOpen={trafficDialogProfile !== null}
-          onClose={() => setTrafficDialogProfile(null)}
+          onClose={() => {
+            setTrafficDialogProfile(null);
+          }}
          profileId={trafficDialogProfile.id}
          profileName={trafficDialogProfile.name}
        />
      )}
      <ProfileBypassRulesDialog
        isOpen={bypassRulesProfile !== null}
-        onClose={() => setBypassRulesProfile(null)}
+        onClose={() => {
+          setBypassRulesProfile(null);
+        }}
        profileId={bypassRulesProfile?.id ?? null}
        initialRules={bypassRulesProfile?.proxy_bypass_rules ?? []}
      />
@@ -131,7 +131,7 @@ export function ProfileInfoDialog({
      setGroupName(null);
      return;
    }
-    (async () => {
+    void (async () => {
      try {
        const groups = await invoke<ProfileGroup[]>("get_groups");
        const group = groups.find((g) => g.id === profile.group_id);
@@ -147,7 +147,7 @@ export function ProfileInfoDialog({
      setExtensionGroupName(null);
      return;
    }
-    (async () => {
+    void (async () => {
      try {
        const group = await invoke<{ name: string } | null>(
          "get_extension_group_for_profile",
@@ -195,7 +195,9 @@ export function ProfileInfoDialog({
    try {
      await navigator.clipboard.writeText(profile.id);
      setCopied(true);
-      setTimeout(() => setCopied(false), 2000);
+      setTimeout(() => {
+        setCopied(false);
+      }, 2000);
    } catch {
      // ignore
    }
@@ -213,7 +215,7 @@ export function ProfileInfoDialog({
  const hasNote = !!profile.note;
  const showCrossOs = isCrossOsProfile(profile);

-  type ActionItem = {
+  interface ActionItem {
    icon: React.ReactNode;
    label: string;
    onClick: () => void;
@@ -222,34 +224,41 @@ export function ProfileInfoDialog({
    proBadge?: boolean;
    runningBadge?: boolean;
    hidden?: boolean;
-  };
+  }

  const actions: ActionItem[] = [
    {
      icon: <LuGlobe className="w-4 h-4" />,
      label: t("profiles.actions.viewNetwork"),
-      onClick: () => handleAction(() => onOpenTrafficDialog?.(profile.id)),
+      onClick: () => {
+        handleAction(() => onOpenTrafficDialog?.(profile.id));
+      },
      disabled: isCrossOs,
    },
    {
      icon: <LuRefreshCw className="w-4 h-4" />,
      label: t("profiles.actions.syncSettings"),
-      onClick: () => handleAction(() => onOpenProfileSyncDialog?.(profile)),
+      onClick: () => {
+        handleAction(() => onOpenProfileSyncDialog?.(profile));
+      },
      disabled: isCrossOs,
      hidden: profile.ephemeral === true,
    },
    {
      icon: <LuGroup className="w-4 h-4" />,
      label: t("profiles.actions.assignToGroup"),
-      onClick: () =>
-        handleAction(() => onAssignProfilesToGroup?.([profile.id])),
+      onClick: () => {
+        handleAction(() => onAssignProfilesToGroup?.([profile.id]));
+      },
      disabled: isDisabled,
      runningBadge: isRunning,
    },
    {
      icon: <LuFingerprint className="w-4 h-4" />,
      label: t("profiles.actions.changeFingerprint"),
-      onClick: () => handleAction(() => onConfigureCamoufox?.(profile)),
+      onClick: () => {
+        handleAction(() => onConfigureCamoufox?.(profile));
+      },
      disabled: isDisabled,
      runningBadge: isRunning,
      hidden: !isCamoufoxOrWayfern || !onConfigureCamoufox,
@@ -257,7 +266,9 @@ export function ProfileInfoDialog({
    {
      icon: <LuUsers className="w-4 h-4" />,
      label: t("profiles.synchronizer.launchWithSync"),
-      onClick: () => handleAction(() => onLaunchWithSync?.(profile)),
+      onClick: () => {
+        handleAction(() => onLaunchWithSync?.(profile));
+      },
      disabled: isDisabled || isRunning || !crossOsUnlocked,
      proBadge: !crossOsUnlocked,
      hidden: profile.browser !== "wayfern" || !onLaunchWithSync,
@@ -265,10 +276,11 @@ export function ProfileInfoDialog({
    {
      icon: <LuCopy className="w-4 h-4" />,
      label: t("profiles.actions.copyCookiesToProfile"),
-      onClick: () => handleAction(() => onCopyCookiesToProfile?.(profile)),
-      disabled: isDisabled || !crossOsUnlocked,
-      proBadge: !crossOsUnlocked,
-      runningBadge: isRunning && crossOsUnlocked,
+      onClick: () => {
+        handleAction(() => onCopyCookiesToProfile?.(profile));
+      },
+      disabled: isDisabled,
+      runningBadge: isRunning,
      hidden:
        !isCamoufoxOrWayfern ||
        profile.ephemeral === true ||
@@ -277,10 +289,11 @@ export function ProfileInfoDialog({
    {
      icon: <LuCookie className="w-4 h-4" />,
      label: t("profileInfo.actions.manageCookies"),
-      onClick: () => handleAction(() => onOpenCookieManagement?.(profile)),
-      disabled: isDisabled || !crossOsUnlocked,
-      proBadge: !crossOsUnlocked,
-      runningBadge: isRunning && crossOsUnlocked,
+      onClick: () => {
+        handleAction(() => onOpenCookieManagement?.(profile));
+      },
+      disabled: isDisabled,
+      runningBadge: isRunning,
      hidden:
        !isCamoufoxOrWayfern ||
        profile.ephemeral === true ||
@@ -289,7 +302,9 @@ export function ProfileInfoDialog({
    {
      icon: <LuSettings className="w-4 h-4" />,
      label: t("profiles.actions.clone"),
-      onClick: () => handleAction(() => onCloneProfile?.(profile)),
+      onClick: () => {
+        handleAction(() => onCloneProfile?.(profile));
+      },
      disabled: isDisabled,
      runningBadge: isRunning,
      hidden: profile.ephemeral === true,
@@ -297,7 +312,9 @@ export function ProfileInfoDialog({
    {
      icon: <LuPuzzle className="w-4 h-4" />,
      label: t("profileInfo.actions.assignExtensionGroup"),
-      onClick: () => handleAction(() => onAssignExtensionGroup?.([profile.id])),
+      onClick: () => {
+        handleAction(() => onAssignExtensionGroup?.([profile.id]));
+      },
      disabled: isDisabled || !crossOsUnlocked,
      proBadge: !crossOsUnlocked,
      runningBadge: isRunning && crossOsUnlocked,
@@ -306,12 +323,16 @@ export function ProfileInfoDialog({
    {
      icon: <LuShieldCheck className="w-4 h-4" />,
      label: t("profileInfo.network.bypassRulesTitle"),
-      onClick: () => handleAction(() => onOpenBypassRules?.(profile)),
+      onClick: () => {
+        handleAction(() => onOpenBypassRules?.(profile));
+      },
    },
    {
      icon: <LuTrash2 className="w-4 h-4" />,
      label: t("profiles.actions.delete"),
-      onClick: () => handleAction(() => onDeleteProfile?.(profile)),
+      onClick: () => {
+        handleAction(() => onDeleteProfile?.(profile));
+      },
      disabled: isDeleteDisabled,
      destructive: true,
    },
@@ -320,7 +341,12 @@ export function ProfileInfoDialog({
  const visibleActions = actions.filter((a) => !a.hidden);

  return (
-    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) onClose();
+      }}
+    >
      <DialogContent className="sm:max-w-2xl">
        <DialogHeader>
          <DialogTitle>{t("profileInfo.title")}</DialogTitle>
@@ -445,7 +471,7 @@ export function ProfileInfoDialog({
                  >
                    {syncMode === "Disabled"
                      ? t("sync.mode.disabled")
-                      : syncStatus?.status === "syncing"
+                      : syncStatus.status === "syncing"
                        ? t("common.status.syncing")
                        : t("common.status.synced")}
                  </Badge>
@@ -587,7 +613,12 @@ export function ProfileBypassRulesDialog({
  };

  return (
-    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) onClose();
+      }}
+    >
      <DialogContent className="sm:max-w-lg max-h-[80vh] flex flex-col">
        <DialogHeader className="shrink-0">
          <DialogTitle>{t("profileInfo.network.bypassRulesTitle")}</DialogTitle>
@@ -600,7 +631,9 @@ export function ProfileBypassRulesDialog({
            <div className="flex gap-2">
              <Input
                value={newRule}
-                onChange={(e) => setNewRule(e.target.value)}
+                onChange={(e) => {
+                  setNewRule(e.target.value);
+                }}
                onKeyDown={(e) => {
                  if (e.key === "Enter") handleAddRule();
                }}
@@ -630,7 +663,9 @@ export function ProfileBypassRulesDialog({
                    <span className="font-mono text-xs truncate">{rule}</span>
                    <button
                      type="button"
-                      onClick={() => handleRemoveRule(rule)}
+                      onClick={() => {
+                        handleRemoveRule(rule);
+                      }}
                      className="text-muted-foreground hover:text-destructive transition-colors shrink-0"
                    >
                      <LuX className="w-3.5 h-3.5" />
@@ -51,7 +51,7 @@ export function ProfileSelectorDialog({
  const { profiles, runningProfiles: hookRunningProfiles } = useProfileEvents();

  // Use external runningProfiles if provided, otherwise use hook's runningProfiles
-  const runningProfiles = externalRunningProfiles || hookRunningProfiles;
+  const runningProfiles = externalRunningProfiles ?? hookRunningProfiles;

  const { storedProxies } = useProxyEvents();

@@ -60,9 +60,7 @@ export function ProfileSelectorDialog({
  const [launchingProfiles, setLaunchingProfiles] = useState<Set<string>>(
    new Set(),
  );
-  const [stoppingProfiles, _setStoppingProfiles] = useState<Set<string>>(
-    new Set(),
-  );
+  const [stoppingProfiles] = useState<Set<string>>(new Set());

  // Use shared browser state hook
  const browserState = useBrowserState(
@@ -41,10 +41,11 @@ export function ProfileSyncDialog({
    cloudUser.plan !== "free" &&
    (cloudUser.subscriptionStatus === "active" ||
      cloudUser.planPeriod === "lifetime");
+  // Encryption available to everyone except team members who aren't owners
  const canUseEncryption =
-    isCloudSyncEligible &&
-    cloudUser != null &&
-    (cloudUser.plan !== "team" || cloudUser.teamRole === "owner");
+    cloudUser == null ||
+    cloudUser.plan !== "team" ||
+    cloudUser.teamRole === "owner";
  const [isSaving, setIsSaving] = useState(false);
  const [isSyncing, setIsSyncing] = useState(false);
  const [syncMode, setSyncMode] = useState<SyncMode>(
@@ -53,7 +53,9 @@ export function ProxyExportDialog({ isOpen, onClose }: ProxyExportDialogProps) {
      await navigator.clipboard.writeText(exportContent);
      setCopied(true);
      toast.success("Copied to clipboard");
-      setTimeout(() => setCopied(false), 2000);
+      setTimeout(() => {
+        setCopied(false);
+      }, 2000);
    } catch (error) {
      console.error("Failed to copy to clipboard:", error);
      toast.error("Failed to copy to clipboard");
@@ -99,7 +101,9 @@ export function ProxyExportDialog({ isOpen, onClose }: ProxyExportDialogProps) {
            <Label>Export Format</Label>
            <RadioGroup
              value={format}
-              onValueChange={(value) => setFormat(value as "json" | "txt")}
+              onValueChange={(value) => {
+                setFormat(value as "json" | "txt");
+              }}
              className="flex gap-4"
            >
              <div className="flex items-center space-x-2">
@@ -105,8 +105,8 @@ export function ProxyFormDialog({
            proxy_type: editingProxy.proxy_settings.proxy_type,
            host: editingProxy.proxy_settings.host,
            port: editingProxy.proxy_settings.port,
-            username: editingProxy.proxy_settings.username || "",
-            password: editingProxy.proxy_settings.password || "",
+            username: editingProxy.proxy_settings.username ?? "",
+            password: editingProxy.proxy_settings.password ?? "",
          });
        }
      } else {
@@ -250,7 +250,12 @@ export function ProxyFormDialog({

        <div className="grid gap-4 py-4">
          {!editingProxy && (
-            <Tabs value={mode} onValueChange={(v) => setMode(v as ProxyMode)}>
+            <Tabs
+              value={mode}
+              onValueChange={(v) => {
+                setMode(v as ProxyMode);
+              }}
+            >
              <TabsList className="w-full">
                <TabsTrigger value="regular" className="flex-1">
                  {t("proxies.tabs.regular")}
@@ -275,9 +280,9 @@ export function ProxyFormDialog({
                <Input
                  id="proxy-name"
                  value={regularForm.name}
-                  onChange={(e) =>
-                    setRegularForm({ ...regularForm, name: e.target.value })
-                  }
+                  onChange={(e) => {
+                    setRegularForm({ ...regularForm, name: e.target.value });
+                  }}
                  placeholder="e.g. Office Proxy, Home VPN, etc."
                  disabled={isSubmitting}
                />
@@ -287,9 +292,9 @@ export function ProxyFormDialog({
                <Label>{t("proxies.form.type")}</Label>
                <Select
                  value={regularForm.proxy_type}
-                  onValueChange={(value) =>
-                    setRegularForm({ ...regularForm, proxy_type: value })
-                  }
+                  onValueChange={(value) => {
+                    setRegularForm({ ...regularForm, proxy_type: value });
+                  }}
                  disabled={isSubmitting}
                >
                  <SelectTrigger>
@@ -311,9 +316,9 @@ export function ProxyFormDialog({
                  <Input
                    id="proxy-host"
                    value={regularForm.host}
-                    onChange={(e) =>
-                      setRegularForm({ ...regularForm, host: e.target.value })
-                    }
+                    onChange={(e) => {
+                      setRegularForm({ ...regularForm, host: e.target.value });
+                    }}
                    placeholder={t("proxies.form.hostPlaceholder")}
                    disabled={isSubmitting}
                  />
@@ -325,12 +330,12 @@ export function ProxyFormDialog({
                    id="proxy-port"
                    type="number"
                    value={regularForm.port}
-                    onChange={(e) =>
+                    onChange={(e) => {
                      setRegularForm({
                        ...regularForm,
                        port: parseInt(e.target.value, 10) || 0,
-                      })
-                    }
+                      });
+                    }}
                    placeholder={t("proxies.form.portPlaceholder")}
                    min="1"
                    max="65535"
@@ -348,12 +353,12 @@ export function ProxyFormDialog({
                  <Input
                    id="proxy-username"
                    value={regularForm.username}
-                    onChange={(e) =>
+                    onChange={(e) => {
                      setRegularForm({
                        ...regularForm,
                        username: e.target.value,
-                      })
-                    }
+                      });
+                    }}
                    placeholder={t("proxies.form.usernamePlaceholder")}
                    disabled={isSubmitting}
                  />
@@ -368,12 +373,12 @@ export function ProxyFormDialog({
                    id="proxy-password"
                    type="password"
                    value={regularForm.password}
-                    onChange={(e) =>
+                    onChange={(e) => {
                      setRegularForm({
                        ...regularForm,
                        password: e.target.value,
-                      })
-                    }
+                      });
+                    }}
                    placeholder={t("proxies.form.passwordPlaceholder")}
                    disabled={isSubmitting}
                  />
@@ -387,9 +392,9 @@ export function ProxyFormDialog({
                <Input
                  id="dynamic-name"
                  value={dynamicForm.name}
-                  onChange={(e) =>
-                    setDynamicForm({ ...dynamicForm, name: e.target.value })
-                  }
+                  onChange={(e) => {
+                    setDynamicForm({ ...dynamicForm, name: e.target.value });
+                  }}
                  placeholder="e.g. My Tunnel"
                  disabled={isSubmitting}
                />
@@ -400,9 +405,9 @@ export function ProxyFormDialog({
                <Input
                  id="dynamic-url"
                  value={dynamicForm.url}
-                  onChange={(e) =>
-                    setDynamicForm({ ...dynamicForm, url: e.target.value })
-                  }
+                  onChange={(e) => {
+                    setDynamicForm({ ...dynamicForm, url: e.target.value });
+                  }}
                  placeholder={t("proxies.dynamic.urlPlaceholder")}
                  disabled={isSubmitting}
                />
@@ -412,9 +417,9 @@ export function ProxyFormDialog({
                <Label>{t("proxies.dynamic.format")}</Label>
                <Select
                  value={dynamicForm.format}
-                  onValueChange={(value) =>
-                    setDynamicForm({ ...dynamicForm, format: value })
-                  }
+                  onValueChange={(value) => {
+                    setDynamicForm({ ...dynamicForm, format: value });
+                  }}
                  disabled={isSubmitting}
                >
                  <SelectTrigger>
@@ -69,7 +69,7 @@ export function ProxyImportDialog({ isOpen, onClose }: ProxyImportDialogProps) {
  }, []);

  const processContent = useCallback(
-    async (content: string, isJson: boolean, _filename: string = "") => {
+    async (content: string, isJson: boolean, _filename = "") => {
      try {
        if (isJson) {
          setIsImporting(true);
@@ -180,7 +180,7 @@ export function ProxyImportDialog({ isOpen, onClose }: ProxyImportDialogProps) {
  useEffect(() => {
    if (!isOpen || step !== "dropzone") return;

-    const handlePaste = async (e: ClipboardEvent) => {
+    const handlePaste = (e: ClipboardEvent) => {
      const text = e.clipboardData?.getData("text");
      if (text) {
        // Try to detect if it's JSON
@@ -189,7 +189,7 @@ export function ProxyImportDialog({ isOpen, onClose }: ProxyImportDialogProps) {
          (trimmed.startsWith("{") && trimmed.endsWith("}")) ||
          (trimmed.startsWith("[") && trimmed.endsWith("]"));
        // Use "pasted.txt" as filename to trigger content-based detection
-        await processContent(text, isJson, "pasted.txt");
+        void processContent(text, isJson, "pasted.txt");
      }
    };

@@ -339,7 +339,9 @@ export function ProxyImportDialog({ isOpen, onClose }: ProxyImportDialogProps) {
                id="name-prefix"
                placeholder="Imported"
                value={namePrefix}
-                onChange={(e) => setNamePrefix(e.target.value)}
+                onChange={(e) => {
+                  setNamePrefix(e.target.value);
+                }}
              />
              <p className="text-xs text-muted-foreground">
                Proxies will be named &quot;{namePrefix || "Imported"} Proxy
@@ -408,9 +410,9 @@ export function ProxyImportDialog({ isOpen, onClose }: ProxyImportDialogProps) {
                            type="radio"
                            name={`format-${i}`}
                            checked={proxy.selectedFormat === format}
-                            onChange={() =>
-                              handleAmbiguousFormatSelect(i, format)
-                            }
+                            onChange={() => {
+                              handleAmbiguousFormatSelect(i, format);
+                            }}
                            className="accent-primary"
                          />
                          <span className="text-xs">{format}</span>
@@ -389,7 +389,9 @@ export function ProxyManagementDialog({
                      <RippleButton
                        size="sm"
                        variant="outline"
-                        onClick={() => setShowImportDialog(true)}
+                        onClick={() => {
+                          setShowImportDialog(true);
+                        }}
                        className="flex gap-2 items-center"
                      >
                        <LuUpload className="w-4 h-4" />
@@ -398,7 +400,9 @@ export function ProxyManagementDialog({
                      <RippleButton
                        size="sm"
                        variant="outline"
-                        onClick={() => setShowExportDialog(true)}
+                        onClick={() => {
+                          setShowExportDialog(true);
+                        }}
                        className="flex gap-2 items-center"
                        disabled={storedProxies.length === 0}
                      >
@@ -487,7 +491,7 @@ export function ProxyManagementDialog({
                                          <Checkbox
                                            checked={proxy.sync_enabled}
                                            onCheckedChange={() =>
-                                              handleToggleSync(proxy)
+                                              void handleToggleSync(proxy)
                                            }
                                            disabled={
                                              isTogglingSync[proxy.id] ||
@@ -542,9 +546,9 @@ export function ProxyManagementDialog({
                                          <Button
                                            variant="ghost"
                                            size="sm"
-                                            onClick={() =>
-                                              handleEditProxy(proxy)
-                                            }
+                                            onClick={() => {
+                                              handleEditProxy(proxy);
+                                            }}
                                          >
                                            <LuPencil className="w-4 h-4" />
                                          </Button>
@@ -559,9 +563,9 @@ export function ProxyManagementDialog({
                                            <Button
                                              variant="ghost"
                                              size="sm"
-                                              onClick={() =>
-                                                handleDeleteProxy(proxy)
-                                              }
+                                              onClick={() => {
+                                                handleDeleteProxy(proxy);
+                                              }}
                                              disabled={
                                                (proxyUsage[proxy.id] ?? 0) > 0
                                              }
@@ -604,7 +608,9 @@ export function ProxyManagementDialog({
                      <RippleButton
                        size="sm"
                        variant="outline"
-                        onClick={() => setShowVpnImportDialog(true)}
+                        onClick={() => {
+                          setShowVpnImportDialog(true);
+                        }}
                        className="flex gap-2 items-center"
                      >
                        <LuUpload className="w-4 h-4" />
@@ -690,7 +696,7 @@ export function ProxyManagementDialog({
                                          <Checkbox
                                            checked={vpn.sync_enabled}
                                            onCheckedChange={() =>
-                                              handleToggleVpnSync(vpn)
+                                              void handleToggleVpnSync(vpn)
                                            }
                                            disabled={
                                              isTogglingVpnSync[vpn.id] ||
@@ -728,7 +734,9 @@ export function ProxyManagementDialog({
                                          <Button
                                            variant="ghost"
                                            size="sm"
-                                            onClick={() => handleEditVpn(vpn)}
+                                            onClick={() => {
+                                              handleEditVpn(vpn);
+                                            }}
                                          >
                                            <LuPencil className="w-4 h-4" />
                                          </Button>
@@ -743,9 +751,9 @@ export function ProxyManagementDialog({
                                            <Button
                                              variant="ghost"
                                              size="sm"
-                                              onClick={() =>
-                                                handleDeleteVpn(vpn)
-                                              }
+                                              onClick={() => {
+                                                handleDeleteVpn(vpn);
+                                              }}
                                              disabled={
                                                (vpnUsage[vpn.id] ?? 0) > 0
                                              }
@@ -796,7 +804,9 @@ export function ProxyManagementDialog({
      />
      <DeleteConfirmationDialog
        isOpen={proxyToDelete !== null}
-        onClose={() => setProxyToDelete(null)}
+        onClose={() => {
+          setProxyToDelete(null);
+        }}
        onConfirm={handleConfirmDelete}
        title="Delete Proxy"
        description={`This action cannot be undone. This will permanently delete the proxy "${proxyToDelete?.name ?? ""}".`}
@@ -805,11 +815,15 @@ export function ProxyManagementDialog({
      />
      <ProxyImportDialog
        isOpen={showImportDialog}
-        onClose={() => setShowImportDialog(false)}
+        onClose={() => {
+          setShowImportDialog(false);
+        }}
      />
      <ProxyExportDialog
        isOpen={showExportDialog}
-        onClose={() => setShowExportDialog(false)}
+        onClose={() => {
+          setShowExportDialog(false);
+        }}
      />
      <VpnFormDialog
        isOpen={showVpnForm}
@@ -818,7 +832,9 @@ export function ProxyManagementDialog({
      />
      <DeleteConfirmationDialog
        isOpen={vpnToDelete !== null}
-        onClose={() => setVpnToDelete(null)}
+        onClose={() => {
+          setVpnToDelete(null);
+        }}
        onConfirm={handleConfirmDeleteVpn}
        title="Delete VPN"
        description={`This action cannot be undone. This will permanently delete the VPN "${vpnToDelete?.name ?? ""}".`}
@@ -827,7 +843,9 @@ export function ProxyManagementDialog({
      />
      <VpnImportDialog
        isOpen={showVpnImportDialog}
-        onClose={() => setShowVpnImportDialog(false)}
+        onClose={() => {
+          setShowVpnImportDialog(false);
+        }}
      />
    </>
  );
@@ -124,6 +124,12 @@ export function SettingsDialog({
  const [e2ePasswordConfirm, setE2ePasswordConfirm] = useState("");
  const [e2eError, setE2eError] = useState("");
  const [isSavingE2e, setIsSavingE2e] = useState(false);
+  const [systemInfo, setSystemInfo] = useState<{
+    app_version: string;
+    os: string;
+    arch: string;
+    portable: boolean;
+  } | null>(null);

  const { t } = useTranslation();
  const { setTheme } = useTheme();
@@ -134,12 +140,11 @@ export function SettingsDialog({
  } = usePermissions();
  const { trialStatus } = useCommercialTrial();
  const { user: cloudUser } = useCloudAuth();
+  // Encryption is available to everyone except team members who aren't owners
  const canUseEncryption =
-    cloudUser != null &&
-    cloudUser.plan !== "free" &&
-    (cloudUser.subscriptionStatus === "active" ||
-      cloudUser.planPeriod === "lifetime") &&
-    (cloudUser.plan !== "team" || cloudUser.teamRole === "owner");
+    cloudUser == null ||
+    cloudUser.plan !== "team" ||
+    cloudUser.teamRole === "owner";
  const {
    currentLanguage,
    changeLanguage,
@@ -210,7 +215,7 @@ export function SettingsDialog({
      if (merged.theme === "custom" && merged.custom_theme) {
        const matchingTheme = getThemeByColors(merged.custom_theme);
        setCustomThemeState({
-          selectedThemeId: matchingTheme?.id || null,
+          selectedThemeId: matchingTheme?.id ?? null,
          colors: merged.custom_theme,
        });
      } else if (merged.theme === "custom") {
@@ -227,6 +232,18 @@ export function SettingsDialog({
      } catch {
        setHasE2ePassword(false);
      }
+      // Load system info
+      try {
+        const info = await invoke<{
+          app_version: string;
+          os: string;
+          arch: string;
+          portable: boolean;
+        }>("get_system_info");
+        setSystemInfo(info);
+      } catch {
+        setSystemInfo(null);
+      }
    } catch (error) {
      console.error("Failed to load settings:", error);
    } finally {
@@ -236,19 +253,19 @@ export function SettingsDialog({

  const applyCustomTheme = useCallback((vars: Record<string, string>) => {
    const root = document.documentElement;
-    Object.entries(vars).forEach(([k, v]) =>
-      root.style.setProperty(k, v, "important"),
-    );
+    Object.entries(vars).forEach(([k, v]) => {
+      root.style.setProperty(k, v, "important");
+    });
  }, []);

  const clearCustomTheme = useCallback(() => {
    const root = document.documentElement;
-    THEME_VARIABLES.forEach(({ key }) =>
-      root.style.removeProperty(key as string),
-    );
+    THEME_VARIABLES.forEach(({ key }) => {
+      root.style.removeProperty(key as string);
+    });
  }, []);

-  const loadPermissions = useCallback(async () => {
+  const loadPermissions = useCallback(() => {
    setIsLoadingPermissions(true);
    try {
      if (!isMacOS) {
@@ -379,28 +396,29 @@ export function SettingsDialog({

      // Apply or clear custom variables only on Save
      if (settings.theme === "custom") {
-        if (
-          customThemeState.colors &&
-          Object.keys(customThemeState.colors).length > 0
-        ) {
+        if (Object.keys(customThemeState.colors).length > 0) {
          try {
            const root = document.documentElement;
            // Clear any previous custom vars first
-            THEME_VARIABLES.forEach(({ key }) =>
-              root.style.removeProperty(key as string),
-            );
-            Object.entries(customThemeState.colors).forEach(([k, v]) =>
-              root.style.setProperty(k, v, "important"),
-            );
-          } catch {}
+            THEME_VARIABLES.forEach(({ key }) => {
+              root.style.removeProperty(key as string);
+            });
+            Object.entries(customThemeState.colors).forEach(([k, v]) => {
+              root.style.setProperty(k, v, "important");
+            });
+          } catch {
+            /* empty */
+          }
        }
      } else {
        try {
          const root = document.documentElement;
-          THEME_VARIABLES.forEach(({ key }) =>
-            root.style.removeProperty(key as string),
-          );
-        } catch {}
+          THEME_VARIABLES.forEach(({ key }) => {
+            root.style.removeProperty(key as string);
+          });
+        } catch {
+          /* empty */
+        }
      }

      // Save language if changed
@@ -459,7 +477,7 @@ export function SettingsDialog({
    if (originalSettings.theme === "custom" && originalSettings.custom_theme) {
      const matchingTheme = getThemeByColors(originalSettings.custom_theme);
      setCustomThemeState({
-        selectedThemeId: matchingTheme?.id || null,
+        selectedThemeId: matchingTheme?.id ?? null,
        colors: originalSettings.custom_theme,
      });
    }
@@ -482,8 +500,12 @@ export function SettingsDialog({

  useEffect(() => {
    if (isOpen) {
-      loadSettings().catch(console.error);
-      checkDefaultBrowserStatus().catch(console.error);
+      loadSettings().catch((err: unknown) => {
+        console.error(err);
+      });
+      checkDefaultBrowserStatus().catch((err: unknown) => {
+        console.error(err);
+      });

      // Check if we're on macOS
      const userAgent = navigator.userAgent;
@@ -493,12 +515,14 @@ export function SettingsDialog({
      setIsLinux(isLin);

      if (isMac) {
-        loadPermissions().catch(console.error);
+        loadPermissions();
      }

      // Set up interval to check default browser status
      const intervalId = setInterval(() => {
-        checkDefaultBrowserStatus().catch(console.error);
+        checkDefaultBrowserStatus().catch((err: unknown) => {
+          console.error(err);
+        });
      }, 500); // Check every 500ms

      // Cleanup interval on component unmount or dialog close
@@ -613,7 +637,7 @@ export function SettingsDialog({
                    Theme Preset
                  </Label>
                  <Select
-                    value={customThemeState.selectedThemeId || "custom"}
+                    value={customThemeState.selectedThemeId ?? "custom"}
                    onValueChange={(value) => {
                      if (value === "custom") {
                        setCustomThemeState((prev) => ({
@@ -649,7 +673,7 @@ export function SettingsDialog({
                <div className="grid grid-cols-4 gap-3">
                  {THEME_VARIABLES.map(({ key, label }) => {
                    const colorValue =
-                      customThemeState.colors[key] || "#000000";
+                      customThemeState.colors[key] ?? "#000000";
                    return (
                      <div
                        key={key}
@@ -684,7 +708,7 @@ export function SettingsDialog({
                                  getThemeByColors(newColors);

                                setCustomThemeState({
-                                  selectedThemeId: matchingTheme?.id || null,
+                                  selectedThemeId: matchingTheme?.id ?? null,
                                  colors: newColors,
                                });
                              }}
@@ -724,8 +748,10 @@ export function SettingsDialog({
                Interface Language
              </Label>
              <Select
-                value={selectedLanguage || "system"}
-                onValueChange={(value) => setSelectedLanguage(value)}
+                value={selectedLanguage ?? "system"}
+                onValueChange={(value) => {
+                  setSelectedLanguage(value);
+                }}
                disabled={isLanguageLoading}
              >
                <SelectTrigger id="language-select">
@@ -747,34 +773,38 @@ export function SettingsDialog({
            </p>
          </div>

-          {/* Default Browser Section */}
-          <div className="space-y-4">
-            <div className="flex justify-between items-center">
-              <Label className="text-base font-medium">Default Browser</Label>
-              <Badge variant={isDefaultBrowser ? "default" : "secondary"}>
-                {isDefaultBrowser ? "Active" : "Inactive"}
-              </Badge>
+          {/* Default Browser Section - hidden in portable mode */}
+          {!systemInfo?.portable && (
+            <div className="space-y-4">
+              <div className="flex justify-between items-center">
+                <Label className="text-base font-medium">Default Browser</Label>
+                <Badge variant={isDefaultBrowser ? "default" : "secondary"}>
+                  {isDefaultBrowser ? "Active" : "Inactive"}
+                </Badge>
+              </div>
+
+              <LoadingButton
+                isLoading={isSettingDefault}
+                onClick={() => {
+                  handleSetDefaultBrowser().catch((err: unknown) => {
+                    console.error(err);
+                  });
+                }}
+                disabled={isDefaultBrowser}
+                variant={isDefaultBrowser ? "outline" : "default"}
+                className="w-full"
+              >
+                {isDefaultBrowser
+                  ? "Already Default Browser"
+                  : "Set as Default Browser"}
+              </LoadingButton>
+
+              <p className="text-xs text-muted-foreground">
+                When set as default, Donut Browser will handle web links and
+                allow you to choose which profile to use.
+              </p>
            </div>
-
-            <LoadingButton
-              isLoading={isSettingDefault}
-              onClick={() => {
-                handleSetDefaultBrowser().catch(console.error);
-              }}
-              disabled={isDefaultBrowser}
-              variant={isDefaultBrowser ? "outline" : "default"}
-              className="w-full"
-            >
-              {isDefaultBrowser
-                ? "Already Default Browser"
-                : "Set as Default Browser"}
-            </LoadingButton>
-
-            <p className="text-xs text-muted-foreground">
-              When set as default, Donut Browser will handle web links and allow
-              you to choose which profile to use.
-            </p>
-          </div>
+          )}

          {/* Permissions Section - Only show on macOS */}
          {isMacOS && (
@@ -819,7 +849,9 @@ export function SettingsDialog({
                            onClick={() => {
                              handleRequestPermission(
                                permission.permission_type,
-                              ).catch(console.error);
+                              ).catch((err: unknown) => {
+                                console.error(err);
+                              });
                            }}
                          >
                            Grant
@@ -1038,10 +1070,10 @@ export function SettingsDialog({
              <div className="flex items-start space-x-3 p-3 rounded-lg border">
                <Checkbox
                  id="disable-auto-updates"
-                  checked={settings.disable_auto_updates || false}
-                  onCheckedChange={(checked) =>
-                    updateSetting("disable_auto_updates", checked as boolean)
-                  }
+                  checked={settings.disable_auto_updates ?? false}
+                  onCheckedChange={(checked) => {
+                    updateSetting("disable_auto_updates", checked as boolean);
+                  }}
                />
                <div className="space-y-1">
                  <Label
@@ -1060,7 +1092,9 @@ export function SettingsDialog({
            <LoadingButton
              isLoading={isClearingCache}
              onClick={() => {
-                handleClearCache().catch(console.error);
+                handleClearCache().catch((err: unknown) => {
+                  console.error(err);
+                });
              }}
              variant="outline"
              className="w-full"
@@ -1074,6 +1108,15 @@ export function SettingsDialog({
              version information for all browsers.
            </p>
          </div>
+
+          {/* System Info */}
+          {systemInfo && (
+            <div className="pt-2 border-t">
+              <p className="text-xs text-muted-foreground font-mono whitespace-pre-line select-all">
+                {`Donut Browser ${systemInfo.app_version}\n${systemInfo.os} ${systemInfo.arch}${systemInfo.portable ? " (portable)" : ""}`}
+              </p>
+            </div>
+          )}
        </div>

        <DialogFooter className="shrink-0">
@@ -1083,7 +1126,9 @@ export function SettingsDialog({
          <LoadingButton
            isLoading={isSaving}
            onClick={() => {
-              handleSave().catch(console.error);
+              handleSave().catch((err: unknown) => {
+                console.error(err);
+              });
            }}
            disabled={isLoading || !hasChanges}
          >
@@ -77,7 +77,7 @@ function ObjectEditor({
  const [jsonString, setJsonString] = useState("");

  useEffect(() => {
-    setJsonString(JSON.stringify(value || {}, null, 2));
+    setJsonString(JSON.stringify(value ?? {}, null, 2));
  }, [value]);

  const handleChange = (newValue: string) => {
@@ -108,7 +108,9 @@ function ObjectEditor({
      <Label>{title}</Label>
      <Textarea
        value={jsonString}
-        onChange={(e) => handleChange(e.target.value)}
+        onChange={(e) => {
+          handleChange(e.target.value);
+        }}
        placeholder={`Enter ${title} as JSON`}
        className="font-mono text-sm"
        rows={6}
@@ -142,7 +144,7 @@ export function SharedCamoufoxConfigForm({

  const handleGenerateFingerprint = async () => {
    if (!profileVersion) return;
-    const browser = profileBrowser || browserType || "camoufox";
+    const browser = profileBrowser ?? browserType ?? "camoufox";
    setIsGeneratingFingerprint(true);
    try {
      const configJson = JSON.stringify(config);
@@ -267,7 +269,9 @@ export function SharedCamoufoxConfigForm({
        </div>
        <Select
          value={selectedOS}
-          onValueChange={(value: CamoufoxOS) => onConfigChange("os", value)}
+          onValueChange={(value: CamoufoxOS) => {
+            onConfigChange("os", value);
+          }}
          disabled={readOnly}
        >
          <SelectTrigger>
@@ -301,10 +305,10 @@ export function SharedCamoufoxConfigForm({
        <div className="flex items-center space-x-2">
          <Checkbox
            id="randomize-fingerprint"
-            checked={config.randomize_fingerprint_on_launch || false}
-            onCheckedChange={(checked) =>
-              onConfigChange("randomize_fingerprint_on_launch", checked)
-            }
+            checked={config.randomize_fingerprint_on_launch ?? false}
+            onCheckedChange={(checked) => {
+              onConfigChange("randomize_fingerprint_on_launch", checked);
+            }}
            disabled={readOnly}
          />
          <Label htmlFor="randomize-fingerprint" className="font-medium">
@@ -365,10 +369,10 @@ export function SharedCamoufoxConfigForm({
                <div className="flex items-center space-x-2">
                  <Checkbox
                    id="block-images"
-                    checked={config.block_images || false}
-                    onCheckedChange={(checked) =>
-                      onConfigChange("block_images", checked)
-                    }
+                    checked={config.block_images ?? false}
+                    onCheckedChange={(checked) => {
+                      onConfigChange("block_images", checked);
+                    }}
                  />
                  <Label htmlFor="block-images">
                    {t("fingerprint.blockImages")}
@@ -377,10 +381,10 @@ export function SharedCamoufoxConfigForm({
                <div className="flex items-center space-x-2">
                  <Checkbox
                    id="block-webrtc"
-                    checked={config.block_webrtc || false}
-                    onCheckedChange={(checked) =>
-                      onConfigChange("block_webrtc", checked)
-                    }
+                    checked={config.block_webrtc ?? false}
+                    onCheckedChange={(checked) => {
+                      onConfigChange("block_webrtc", checked);
+                    }}
                  />
                  <Label htmlFor="block-webrtc">
                    {t("fingerprint.blockWebRTC")}
@@ -389,10 +393,10 @@ export function SharedCamoufoxConfigForm({
                <div className="flex items-center space-x-2">
                  <Checkbox
                    id="block-webgl"
-                    checked={config.block_webgl || false}
-                    onCheckedChange={(checked) =>
-                      onConfigChange("block_webgl", checked)
-                    }
+                    checked={config.block_webgl ?? false}
+                    onCheckedChange={(checked) => {
+                      onConfigChange("block_webgl", checked);
+                    }}
                  />
                  <Label htmlFor="block-webgl">
                    {t("fingerprint.blockWebGL")}
@@ -410,13 +414,13 @@ export function SharedCamoufoxConfigForm({
                <Label htmlFor="user-agent">{t("fingerprint.userAgent")}</Label>
                <Input
                  id="user-agent"
-                  value={fingerprintConfig["navigator.userAgent"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["navigator.userAgent"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "navigator.userAgent",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="Mozilla/5.0..."
                />
              </div>
@@ -424,13 +428,13 @@ export function SharedCamoufoxConfigForm({
                <Label htmlFor="platform">{t("fingerprint.platform")}</Label>
                <Input
                  id="platform"
-                  value={fingerprintConfig["navigator.platform"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["navigator.platform"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "navigator.platform",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., MacIntel, Win32"
                />
              </div>
@@ -440,13 +444,13 @@ export function SharedCamoufoxConfigForm({
                </Label>
                <Input
                  id="app-version"
-                  value={fingerprintConfig["navigator.appVersion"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["navigator.appVersion"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "navigator.appVersion",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 5.0 (Macintosh)"
                />
              </div>
@@ -454,13 +458,13 @@ export function SharedCamoufoxConfigForm({
                <Label htmlFor="oscpu">{t("fingerprint.osCpu")}</Label>
                <Input
                  id="oscpu"
-                  value={fingerprintConfig["navigator.oscpu"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["navigator.oscpu"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "navigator.oscpu",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., Intel Mac OS X 10.15"
                />
              </div>
@@ -472,14 +476,14 @@ export function SharedCamoufoxConfigForm({
                  id="hardware-concurrency"
                  type="number"
                  value={
-                    fingerprintConfig["navigator.hardwareConcurrency"] || ""
+                    fingerprintConfig["navigator.hardwareConcurrency"] ?? ""
                  }
-                  onChange={(e) =>
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "navigator.hardwareConcurrency",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 8"
                />
              </div>
@@ -490,13 +494,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="max-touch-points"
                  type="number"
-                  value={fingerprintConfig["navigator.maxTouchPoints"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["navigator.maxTouchPoints"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "navigator.maxTouchPoints",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 0"
                />
              </div>
@@ -505,13 +509,13 @@ export function SharedCamoufoxConfigForm({
                  {t("fingerprint.doNotTrack")}
                </Label>
                <Select
-                  value={fingerprintConfig["navigator.doNotTrack"] || ""}
-                  onValueChange={(value) =>
+                  value={fingerprintConfig["navigator.doNotTrack"] ?? ""}
+                  onValueChange={(value) => {
                    updateFingerprintConfig(
                      "navigator.doNotTrack",
                      value || undefined,
-                    )
-                  }
+                    );
+                  }}
                >
                  <SelectTrigger>
                    <SelectValue
@@ -535,13 +539,13 @@ export function SharedCamoufoxConfigForm({
                <Label htmlFor="language">{t("fingerprint.language")}</Label>
                <Input
                  id="language"
-                  value={fingerprintConfig["navigator.language"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["navigator.language"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "navigator.language",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., en-US"
                />
              </div>
@@ -559,13 +563,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="screen-width"
                  type="number"
-                  value={fingerprintConfig["screen.width"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["screen.width"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "screen.width",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 1920"
                />
              </div>
@@ -576,13 +580,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="screen-height"
                  type="number"
-                  value={fingerprintConfig["screen.height"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["screen.height"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "screen.height",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 1080"
                />
              </div>
@@ -593,13 +597,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="avail-width"
                  type="number"
-                  value={fingerprintConfig["screen.availWidth"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["screen.availWidth"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "screen.availWidth",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 1920"
                />
              </div>
@@ -610,13 +614,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="avail-height"
                  type="number"
-                  value={fingerprintConfig["screen.availHeight"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["screen.availHeight"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "screen.availHeight",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 1055"
                />
              </div>
@@ -627,13 +631,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="color-depth"
                  type="number"
-                  value={fingerprintConfig["screen.colorDepth"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["screen.colorDepth"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "screen.colorDepth",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 30"
                />
              </div>
@@ -644,13 +648,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="pixel-depth"
                  type="number"
-                  value={fingerprintConfig["screen.pixelDepth"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["screen.pixelDepth"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "screen.pixelDepth",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 30"
                />
              </div>
@@ -668,13 +672,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="outer-width"
                  type="number"
-                  value={fingerprintConfig["window.outerWidth"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["window.outerWidth"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "window.outerWidth",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 1512"
                />
              </div>
@@ -685,13 +689,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="outer-height"
                  type="number"
-                  value={fingerprintConfig["window.outerHeight"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["window.outerHeight"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "window.outerHeight",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 886"
                />
              </div>
@@ -702,13 +706,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="inner-width"
                  type="number"
-                  value={fingerprintConfig["window.innerWidth"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["window.innerWidth"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "window.innerWidth",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 1512"
                />
              </div>
@@ -719,13 +723,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="inner-height"
                  type="number"
-                  value={fingerprintConfig["window.innerHeight"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["window.innerHeight"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "window.innerHeight",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 886"
                />
              </div>
@@ -734,13 +738,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="screen-x"
                  type="number"
-                  value={fingerprintConfig["window.screenX"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["window.screenX"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "window.screenX",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 0"
                />
              </div>
@@ -749,13 +753,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="screen-y"
                  type="number"
-                  value={fingerprintConfig["window.screenY"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["window.screenY"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "window.screenY",
                      e.target.value ? parseInt(e.target.value, 10) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 0"
                />
              </div>
@@ -772,13 +776,13 @@ export function SharedCamoufoxConfigForm({
                  id="latitude"
                  type="number"
                  step="any"
-                  value={fingerprintConfig["geolocation:latitude"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["geolocation:latitude"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "geolocation:latitude",
                      e.target.value ? parseFloat(e.target.value) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 41.0019"
                />
              </div>
@@ -788,13 +792,13 @@ export function SharedCamoufoxConfigForm({
                  id="longitude"
                  type="number"
                  step="any"
-                  value={fingerprintConfig["geolocation:longitude"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["geolocation:longitude"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "geolocation:longitude",
                      e.target.value ? parseFloat(e.target.value) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 28.9645"
                />
              </div>
@@ -803,13 +807,13 @@ export function SharedCamoufoxConfigForm({
                <Input
                  id="timezone"
                  type="text"
-                  value={fingerprintConfig.timezone || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig.timezone ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "timezone",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., America/New_York"
                />
              </div>
@@ -826,13 +830,13 @@ export function SharedCamoufoxConfigForm({
                </Label>
                <Input
                  id="locale-language"
-                  value={fingerprintConfig["locale:language"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["locale:language"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "locale:language",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., tr"
                />
              </div>
@@ -840,13 +844,13 @@ export function SharedCamoufoxConfigForm({
                <Label htmlFor="locale-region">{t("fingerprint.region")}</Label>
                <Input
                  id="locale-region"
-                  value={fingerprintConfig["locale:region"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["locale:region"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "locale:region",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., TR"
                />
              </div>
@@ -854,13 +858,13 @@ export function SharedCamoufoxConfigForm({
                <Label htmlFor="locale-script">{t("fingerprint.script")}</Label>
                <Input
                  id="locale-script"
-                  value={fingerprintConfig["locale:script"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["locale:script"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "locale:script",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., Latn"
                />
              </div>
@@ -877,13 +881,13 @@ export function SharedCamoufoxConfigForm({
                </Label>
                <Input
                  id="webgl-vendor"
-                  value={fingerprintConfig["webGl:vendor"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["webGl:vendor"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "webGl:vendor",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., Mesa"
                />
              </div>
@@ -893,13 +897,13 @@ export function SharedCamoufoxConfigForm({
                </Label>
                <Input
                  id="webgl-renderer"
-                  value={fingerprintConfig["webGl:renderer"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["webGl:renderer"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "webGl:renderer",
                      e.target.value || undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., llvmpipe, or similar"
                />
              </div>
@@ -913,11 +917,11 @@ export function SharedCamoufoxConfigForm({
                (fingerprintConfig["webGl:parameters"] as Record<
                  string,
                  unknown
-                >) || {}
-              }
-              onChange={(value) =>
-                updateFingerprintConfig("webGl:parameters", value)
+                >) ?? {}
              }
+              onChange={(value) => {
+                updateFingerprintConfig("webGl:parameters", value);
+              }}
              title={t("fingerprint.webglParameters")}
              readOnly={readOnly}
            />
@@ -930,11 +934,11 @@ export function SharedCamoufoxConfigForm({
                (fingerprintConfig["webGl2:parameters"] as Record<
                  string,
                  unknown
-                >) || {}
-              }
-              onChange={(value) =>
-                updateFingerprintConfig("webGl2:parameters", value)
+                >) ?? {}
              }
+              onChange={(value) => {
+                updateFingerprintConfig("webGl2:parameters", value);
+              }}
              title={t("fingerprint.webgl2Parameters")}
              readOnly={readOnly}
            />
@@ -947,11 +951,11 @@ export function SharedCamoufoxConfigForm({
                (fingerprintConfig["webGl:shaderPrecisionFormats"] as Record<
                  string,
                  unknown
-                >) || {}
-              }
-              onChange={(value) =>
-                updateFingerprintConfig("webGl:shaderPrecisionFormats", value)
+                >) ?? {}
              }
+              onChange={(value) => {
+                updateFingerprintConfig("webGl:shaderPrecisionFormats", value);
+              }}
              title={t("fingerprint.webglShaderPrecisionFormats")}
              readOnly={readOnly}
            />
@@ -964,11 +968,11 @@ export function SharedCamoufoxConfigForm({
                (fingerprintConfig["webGl2:shaderPrecisionFormats"] as Record<
                  string,
                  unknown
-                >) || {}
-              }
-              onChange={(value) =>
-                updateFingerprintConfig("webGl2:shaderPrecisionFormats", value)
+                >) ?? {}
              }
+              onChange={(value) => {
+                updateFingerprintConfig("webGl2:shaderPrecisionFormats", value);
+              }}
              title={t("fingerprint.webgl2ShaderPrecisionFormats")}
              readOnly={readOnly}
            />
@@ -1000,12 +1004,12 @@ export function SharedCamoufoxConfigForm({
                  value: font,
                }));
              })()}
-              onChange={(selected: Option[]) =>
+              onChange={(selected: Option[]) => {
                updateFingerprintConfig(
                  "fonts",
                  selected.map((s: Option) => s.value),
-                )
-              }
+                );
+              }}
              placeholder="Add fonts..."
              creatable
            />
@@ -1019,10 +1023,10 @@ export function SharedCamoufoxConfigForm({
                <div className="flex items-center space-x-2">
                  <Checkbox
                    id="battery-charging"
-                    checked={fingerprintConfig["battery:charging"] || false}
-                    onCheckedChange={(checked) =>
-                      updateFingerprintConfig("battery:charging", checked)
-                    }
+                    checked={fingerprintConfig["battery:charging"] ?? false}
+                    onCheckedChange={(checked) => {
+                      updateFingerprintConfig("battery:charging", checked);
+                    }}
                  />
                  <Label htmlFor="battery-charging">
                    {t("fingerprint.charging")}
@@ -1037,13 +1041,13 @@ export function SharedCamoufoxConfigForm({
                  id="charging-time"
                  type="number"
                  step="any"
-                  value={fingerprintConfig["battery:chargingTime"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["battery:chargingTime"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "battery:chargingTime",
                      e.target.value ? parseFloat(e.target.value) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 0"
                />
              </div>
@@ -1055,13 +1059,13 @@ export function SharedCamoufoxConfigForm({
                  id="discharging-time"
                  type="number"
                  step="any"
-                  value={fingerprintConfig["battery:dischargingTime"] || ""}
-                  onChange={(e) =>
+                  value={fingerprintConfig["battery:dischargingTime"] ?? ""}
+                  onChange={(e) => {
                    updateFingerprintConfig(
                      "battery:dischargingTime",
                      e.target.value ? parseFloat(e.target.value) : undefined,
-                    )
-                  }
+                    );
+                  }}
                  placeholder="e.g., 0"
                />
              </div>
@@ -1132,9 +1136,9 @@ export function SharedCamoufoxConfigForm({
              <Label>{t("fingerprint.osLabel")}</Label>
              <Select
                value={selectedOS}
-                onValueChange={(value: CamoufoxOS) =>
-                  onConfigChange("os", value)
-                }
+                onValueChange={(value: CamoufoxOS) => {
+                  onConfigChange("os", value);
+                }}
                disabled={readOnly}
              >
                <SelectTrigger>
@@ -1170,10 +1174,10 @@ export function SharedCamoufoxConfigForm({
              <div className="flex items-center space-x-2">
                <Checkbox
                  id="randomize-fingerprint-auto"
-                  checked={config.randomize_fingerprint_on_launch || false}
-                  onCheckedChange={(checked) =>
-                    onConfigChange("randomize_fingerprint_on_launch", checked)
-                  }
+                  checked={config.randomize_fingerprint_on_launch ?? false}
+                  onCheckedChange={(checked) => {
+                    onConfigChange("randomize_fingerprint_on_launch", checked);
+                  }}
                  disabled={readOnly}
                />
                <Label
@@ -1222,15 +1226,15 @@ export function SharedCamoufoxConfigForm({
                    <Input
                      id="screen-max-width"
                      type="number"
-                      value={config.screen_max_width || ""}
-                      onChange={(e) =>
+                      value={config.screen_max_width ?? ""}
+                      onChange={(e) => {
                        onConfigChange(
                          "screen_max_width",
                          e.target.value
                            ? parseInt(e.target.value, 10)
                            : undefined,
-                        )
-                      }
+                        );
+                      }}
                      placeholder="e.g., 1920"
                    />
                  </div>
@@ -1241,15 +1245,15 @@ export function SharedCamoufoxConfigForm({
                    <Input
                      id="screen-max-height"
                      type="number"
-                      value={config.screen_max_height || ""}
-                      onChange={(e) =>
+                      value={config.screen_max_height ?? ""}
+                      onChange={(e) => {
                        onConfigChange(
                          "screen_max_height",
                          e.target.value
                            ? parseInt(e.target.value, 10)
                            : undefined,
-                        )
-                      }
+                        );
+                      }}
                      placeholder="e.g., 1080"
                    />
                  </div>
@@ -1260,15 +1264,15 @@ export function SharedCamoufoxConfigForm({
                    <Input
                      id="screen-min-width"
                      type="number"
-                      value={config.screen_min_width || ""}
-                      onChange={(e) =>
+                      value={config.screen_min_width ?? ""}
+                      onChange={(e) => {
                        onConfigChange(
                          "screen_min_width",
                          e.target.value
                            ? parseInt(e.target.value, 10)
                            : undefined,
-                        )
-                      }
+                        );
+                      }}
                      placeholder="e.g., 800"
                    />
                  </div>
@@ -1279,15 +1283,15 @@ export function SharedCamoufoxConfigForm({
                    <Input
                      id="screen-min-height"
                      type="number"
-                      value={config.screen_min_height || ""}
-                      onChange={(e) =>
+                      value={config.screen_min_height ?? ""}
+                      onChange={(e) => {
                        onConfigChange(
                          "screen_min_height",
                          e.target.value
                            ? parseInt(e.target.value, 10)
                            : undefined,
-                        )
-                      }
+                        );
+                      }}
                      placeholder="e.g., 600"
                    />
                  </div>
@@ -67,7 +67,7 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
  const [isVerifying, setIsVerifying] = useState(false);

  const [activeTab, setActiveTab] = useState<string>("cloud");
-  const [liveProxyUsage, setLiveProxyUsage] = useState<ProxyUsage | null>(null);
+  const [, setLiveProxyUsage] = useState<ProxyUsage | null>(null);

  const [connectionStatus, setConnectionStatus] = useState<
    "unknown" | "testing" | "connected" | "error"
@@ -89,8 +89,8 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
    setIsLoading(true);
    try {
      const settings = await invoke<SyncSettings>("get_sync_settings");
-      setServerUrl(settings.sync_server_url || "");
-      setToken(settings.sync_token || "");
+      setServerUrl(settings.sync_server_url ?? "");
+      setToken(settings.sync_token ?? "");
      if (settings.sync_server_url && settings.sync_token) {
        void testConnection(settings.sync_server_url);
      }
@@ -108,9 +108,11 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
      setCodeSent(false);
      setOtpCode("");
      setEmail("");
-      invoke<ProxyUsage | null>("cloud_get_proxy_usage")
+      void invoke<ProxyUsage | null>("cloud_get_proxy_usage")
        .then(setLiveProxyUsage)
-        .catch(() => setLiveProxyUsage(null));
+        .catch(() => {
+          setLiveProxyUsage(null);
+        });
    }
  }, [isOpen, loadSettings]);

@@ -300,40 +302,6 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
                  })}
                </span>
              </div>
-              {liveProxyUsage && (
-                <>
-                  <div className="flex justify-between">
-                    <span className="text-muted-foreground">
-                      Recurring Proxy Bandwidth
-                    </span>
-                    <span>
-                      {Math.max(
-                        0,
-                        liveProxyUsage.recurring_limit_mb -
-                          liveProxyUsage.used_mb,
-                      )}{" "}
-                      / {liveProxyUsage.recurring_limit_mb} MB remaining
-                    </span>
-                  </div>
-                  <div className="flex justify-between">
-                    <span className="text-muted-foreground">
-                      Extra Proxy Bandwidth
-                    </span>
-                    <span>
-                      {Math.max(
-                        0,
-                        liveProxyUsage.remaining_mb -
-                          Math.max(
-                            0,
-                            liveProxyUsage.recurring_limit_mb -
-                              liveProxyUsage.used_mb,
-                          ),
-                      )}{" "}
-                      / {liveProxyUsage.extra_limit_mb} MB remaining
-                    </span>
-                  </div>
-                </>
-              )}
              {user.teamName && (
                <>
                  <div className="flex justify-between">
@@ -374,7 +342,7 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
              <Button
                variant="outline"
                className="flex-1"
-                onClick={handleCloudLogout}
+                onClick={() => void handleCloudLogout()}
              >
                {t("sync.cloud.logout")}
              </Button>
@@ -420,7 +388,9 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
                        type="email"
                        placeholder={t("sync.cloud.emailPlaceholder")}
                        value={email}
-                        onChange={(e) => setEmail(e.target.value)}
+                        onChange={(e) => {
+                          setEmail(e.target.value);
+                        }}
                        onKeyDown={(e) => {
                          if (e.key === "Enter" && !codeSent) {
                            void handleSendCode();
@@ -428,7 +398,7 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
                        }}
                      />
                      <LoadingButton
-                        onClick={handleSendCode}
+                        onClick={() => void handleSendCode()}
                        isLoading={isSendingCode}
                        disabled={!email || codeSent}
                        variant="outline"
@@ -447,7 +417,9 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
                        id="cloud-otp"
                        placeholder={t("sync.cloud.codePlaceholder")}
                        value={otpCode}
-                        onChange={(e) => setOtpCode(e.target.value)}
+                        onChange={(e) => {
+                          setOtpCode(e.target.value);
+                        }}
                        onKeyDown={(e) => {
                          if (e.key === "Enter") {
                            void handleVerifyOtp();
@@ -455,7 +427,7 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
                        }}
                      />
                      <LoadingButton
-                        onClick={handleVerifyOtp}
+                        onClick={() => void handleVerifyOtp()}
                        isLoading={isVerifying}
                        disabled={!otpCode}
                        className="w-full"
@@ -485,7 +457,9 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
                      id="sync-server-url"
                      placeholder={t("sync.serverUrlPlaceholder")}
                      value={serverUrl}
-                      onChange={(e) => setServerUrl(e.target.value)}
+                      onChange={(e) => {
+                        setServerUrl(e.target.value);
+                      }}
                    />
                  </div>

@@ -497,14 +471,18 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
                        type={showToken ? "text" : "password"}
                        placeholder={t("sync.tokenPlaceholder")}
                        value={token}
-                        onChange={(e) => setToken(e.target.value)}
+                        onChange={(e) => {
+                          setToken(e.target.value);
+                        }}
                        className="pr-10"
                      />
                      <Tooltip>
                        <TooltipTrigger asChild>
                          <button
                            type="button"
-                            onClick={() => setShowToken(!showToken)}
+                            onClick={() => {
+                              setShowToken(!showToken);
+                            }}
                            className="absolute right-3 top-1/2 p-1 rounded-sm transition-colors transform -translate-y-1/2 hover:bg-accent"
                            aria-label={showToken ? "Hide token" : "Show token"}
                          >
@@ -547,7 +525,7 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
                {hasConfig && (
                  <Button
                    variant="outline"
-                    onClick={handleDisconnect}
+                    onClick={() => void handleDisconnect()}
                    disabled={isSaving}
                  >
                    Disconnect
@@ -555,13 +533,13 @@ export function SyncConfigDialog({ isOpen, onClose }: SyncConfigDialogProps) {
                )}
                <Button
                  variant="outline"
-                  onClick={handleTestConnection}
+                  onClick={() => void handleTestConnection()}
                  disabled={isTesting || !serverUrl}
                >
                  {isTesting ? "Testing..." : "Test Connection"}
                </Button>
                <LoadingButton
-                  onClick={handleSave}
+                  onClick={() => void handleSave()}
                  isLoading={isSaving}
                  disabled={!serverUrl || !token}
                >
--- a/Show More
+++ b/Show More