APEX Download Manager

APEX Download Manager (ADM) is a native Rust download manager with a Slint desktop interface, a loopback-only background daemon, a local REST/WebSocket gateway, a command-line client, and a browser Native Messaging bridge for the APEX Download Manager extension.

The project is under active development. The current codebase contains real engine, storage, gateway, UI, CLI, daemon, native-host, media, queue, scheduler, notification, and browser-integration implementations. Treat releases as alpha until the release pipeline publishes signed production artifacts.

What ADM Includes

Area	Package or binary
Desktop UI	adm-ui from apps/ui
Background daemon	adm-daemon from apps/daemon
Development gateway wrapper	adm-server from apps/server
CLI	adm-cli from apps/cli
Browser Native Messaging host	adm-native-host from apps/host
REST/SSE/WebSocket gateway	crates/gateway
Download orchestration	crates/engine
Network protocols	crates/network
SQLite persistence	crates/storage
Shared contracts	crates/types, crates/ipc
Settings	crates/settings-schema, crates/settings-core

Current Capabilities

• Data-dense Slint desktop UI with modern navigation, settings, dialogs, queues, scheduler surfaces, notifications, localization, and theme support.
• Single-instance protection for UI, daemon, server, CLI, and native host.
• Local REST API on 127.0.0.1:57423 by default.
• Loopback-only REST bind policy. LAN and public binds are rejected.
• Browser extension zero-click pairing through /v1/pair/auto.
• Bearer-token protection for extension add/capture/settings/event routes.
• Download task creation, pause, resume, retry, cancel, delete, verify, extract, queue, automation, and configuration endpoints.
• SSE and WebSocket event streaming.
• Native Messaging host for browser integration.
• Media probing, validation, transcoding, remuxing, audio extraction, thumbnails, and metadata support where the required native tools are available.
• Notifications, Telegram control hooks, observability, readiness diagnostics, WebDAV-scoped access to the download root, and plugin registry operations.

Security Model

ADM is designed as a local desktop application. The REST API must bind only to loopback addresses:

127.0.0.1
::1

The browser extension integration uses local trusted pairing:

• GET /v1/ping is public for local discovery.
• POST /v1/pair/auto is loopback-only and rate-limited.
• Pair tokens are high-entropy opaque values.
• Only SHA-256 token hashes are stored in memory.
• Tokens are never accepted in query strings.
• Sensitive extension endpoints require Authorization: Bearer <pairToken>.
• Zero-click pairing can be disabled with ADM_DISABLE_ZERO_CLICK_PAIRING=1.

See Security and Extension Integration.

Default Endpoints

Purpose	Default
REST API	http://127.0.0.1:57423
REST WebSocket	ws://127.0.0.1:57423/ws
SSE events	http://127.0.0.1:57423/api/v1/events/stream
Extension discovery	http://127.0.0.1:57423/v1/ping
Legacy JSON-RPC WebSocket	ws://127.0.0.1:9001
UI single-instance IPC	127.0.0.1:57424

Build

Install the Rust toolchain pinned by rust-toolchain.toml, then run:

cargo build --workspace
cargo build --release --workspace

Run the daemon:

cargo run -p daemon --bin adm-daemon

Run the UI:

cargo run -p ui --bin adm-ui

Run the CLI:

cargo run -p cli --bin adm-cli -- status

Linux desktop builds may require GTK/AppIndicator/XDO/OpenSSL development packages. Windows and macOS builds require the normal native Rust desktop build toolchain.

Validate

Recommended local checks:

cargo fmt --all -- --check
cargo check --workspace --all-targets
cargo test --workspace --all-features
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo deny check

Targeted checks used during recent backend work:

cargo test -p gateway browser_pairing_tests --lib
cargo check -p gateway -p server -p daemon
cargo check -p ui

Documentation

Start with docs/README.md. Key references:

• Architecture
• API Reference
• Extension Integration
• Native Messaging
• Security
• Stable Readiness Policy
• User Operations Guide
• Installation
• Testing
• Release

Browser Extension

The companion browser extension lives in a separate repository:

https://github.com/Alaa91H/ADM-extension

The desktop side of zero-click pairing is implemented in this repository through the gateway endpoints documented in Extension Integration. The native-host daemon WebSocket override is ADM_DAEMON_WS_URL; it is intended for fixtureable support and test runs, while normal installs use the local default endpoint. CI source gates are Rust-enabled and must run on a toolchain with the workspace Rust components installed.

License

APEX Download Manager is licensed under the Business Source License 1.1. See LICENSE.