Operant: Local-First Media Engine for Chromium
Manifest V3 extension with a native Rust companion: HLS and DASH capture, ffmpeg and yt-dlp pipelines, all on your machine with no accounts or telemetry.
Three layers, each in its place
Operant (planobinario/operant) starts from a concrete browser-sandbox limit: an extension cannot spawn binaries or touch the disk freely. The answer is three decoupled layers where each one only talks to its neighbor. The side panel, vanilla JavaScript rendered on demand, lists media, drives the queue and exposes the ffmpeg and yt-dlp console. The service worker with its content engine handles interception: it scans the DOM (img, video, srcset, CSS backgrounds, lazy loading, shadow DOM) and watches the network to catch HLS (.m3u8) and DASH (.mpd) manifests the moment they cross the stack. The heavy work belongs to the companion, operant-host.exe: a self-contained 2-3 MB Rust binary, no Python or runtime, running outside the sandbox.
Frictionless capture and download
Detection runs on two planes so media is found whether it lives in the markup or only crosses the wire. Every finding is reduced to the minimum (URL, type and dimensions) and lives in volatile memory plus chrome.storage.session: it dies with the session, never written to disk. Downloads use parallel range requests with live progress. Hotlink-protected resources receive the page’s real Referer through ephemeral declarativeNetRequest rules that exist only for the transfer. Multiple selections pack into an in-memory ZIP, no temp files, and everything lands in ~/Downloads/Operant/.
ffmpeg at native speed
The companion speaks over stdio with 4-byte little-endian framing and JSON messages. The handshake doubles as a toolchain inventory: it reports which tools are installed and at which version, so the UI degrades gracefully when something is missing. Remux and track merging never re-encode (-c copy with faststart): they run at disk speed with zero quality loss. Compress and resize re-encode with x264 at CRF 28, a conscious size-for-speed trade. Concatenated fMP4 segments validate (ftyp, moov and moof boxes) before anything hits disk, so an interrupted capture never leaves a corrupt file behind.
Privacy and verification
No telemetry, no analytics, no intermediary servers. The ffmpeg and yt-dlp binaries download on demand from their official release repositories into their own directory (~/Operant/bin), isolated from the PATH: deleting it and unregistering the companion leaves no trace. On Windows, registration is a double-click with a native dialog; on Linux and macOS, a --register command. The companion only accepts messages from the extension ID registered on the system.
Coverage is verified with Puppeteer against Chrome for Testing: ten deterministic local cases covering galleries, lazy loading, local HLS and shadow DOM, five more against real public sites, eleven Rust companion unit tests and a visual audit of the panel. The project website (planobinario/operant-web, a static Astro site with vanilla CSS and self-hosted fonts, in two languages) documents the full protocol. GPL-3.0-or-later.