Thanks for your interest! CloakDrop is part of the Cloakyard privacy-first suite. The guiding principles are non-negotiable: truly native, minimal, fast, and private — no Electron/web-views, no telemetry, no phone-home.
By participating, you agree to abide by our Code of Conduct. For the architecture and where things live, see ARCHITECTURE.md; for the current status, see the README.
- macOS Tahoe 26+
- Xcode 26+
- XcodeGen:
brew install xcodegen
git clone https://github.com/cloakyard/cloakdrop.git
cd cloakdrop
xcodegen generate # regenerate the (git-ignored) Xcode project from project.yml
open CloakDrop.xcodeprojRun the headless core tests (fast, no GUI):
cd Packages/DownloaderCore
swift test- Swift 6, strict concurrency (
complete). No data races, no@unchecked Sendableunless the invariant is documented and lock-guarded. Prefer actors and structured concurrency. - The engine never imports SwiftUI. All download logic lives in
Packages/DownloaderCoreand must be unit-testable in isolation. UI-only concerns (colors, symbols, formatting) live in the app target. - Protocol boundaries for networking (
HTTPClient), storage (DownloadStore), and network monitoring (NetworkPathMonitoring) so each is mockable. - Pure logic is pure. Segmentation, backoff, and throttle math are I/O-free functions with direct unit tests — keep them that way.
- Liquid Glass discipline. Apply glass only to floating controls and navigation chrome, never to scrolling content or list rows. Use system materials for layered surfaces.
- SF Symbols only for iconography, with hierarchical/multicolor rendering.
- Honor light/dark, Dynamic Type, full keyboard navigation, VoiceOver, and Reduce Motion / Reduce Transparency.
- Model it in
DownloadModelsif it needs new persisted state. - Implement the logic in
DownloadEnginebehind the relevant protocol, with tests againstMockHTTPClientand/or the in-memory store. - Surface it in the app via
AppModelintents and SwiftUI views. - Keep the app target thin — push reusable logic down into the core.
Every engine change needs coverage. The bar:
- Pure math → direct unit tests.
- Engine behavior →
MockHTTPClientintegration tests (fast, deterministic). Use injected drops to exercise retry/resume. - Networking path → loopback
URLSessionHTTPClienttests where it adds real coverage. - Resume must survive force-quit and reboot — if you touch the transfer/persistence path, extend the relaunch test.
Any change that makes a network request, writes outside the sandbox, or adds a dependency must be called out explicitly in the PR description. Network egress is only ever to user-initiated download URLs (and, later, the user's configured proxy). When in doubt, ask first.
Ask before introducing any third-party Swift dependency beyond the persistence layer (GRDB).
Two native command-line tools — ffmpeg (muxing) and yt-dlp (page extraction) — are bundled
as code-signed, sandboxed helper binaries via opt-in build scripts (scripts/fetch-ffmpeg.sh,
scripts/fetch-ytdlp.sh); both only read or transform and must add no network egress of their
own. Prefer system frameworks (e.g. CryptoKit over swift-crypto).