arag

arag

arag connects to standard WebDAV servers, browses remote directories lazily, and opens supported videos in an external player.

Seedhost is the first built-in preset, not a dependency of the WebDAV client. Custom WebDAV servers remain supported.

Status

arag is in active development and does not have a stable release yet. The current MVP can:

• connect through the interactive Seedhost preset or a custom WebDAV URL;
• authenticate once per in-memory session;
• browse directories with arrow keys or hjkl;
• inspect complete file and directory metadata;
• display responsive built-in keyboard help;
• open MKV and MP4 videos in IINA after confirmation;
• stream authenticated media through a temporary loopback-only endpoint.

WebDAV browsing is designed to remain portable. MVP video playback currently requires macOS and IINA. The player contract is independent from IINA so that other players can be added later.

Requirements

• Go 1.26.5 or later;
• access to a standard WebDAV server;
• macOS and IINA for video playback in the MVP.

Install a release

Each release provides two prebuilt macOS archives:

• darwin_arm64 for Apple Silicon Macs;
• darwin_amd64 for Intel Macs.

Run uname -m to identify the current architecture, then download the matching archive and checksums.txt from the GitHub release. For example, for v0.1.0 on Apple Silicon:

grep 'arag_0.1.0_darwin_arm64.tar.gz' checksums.txt | shasum -a 256 -c -
tar -xzf arag_0.1.0_darwin_arm64.tar.gz
sudo install arag_0.1.0_darwin_arm64/arag /usr/local/bin/arag
arag --version

The checksum command must report OK. Replace arm64 with amd64 when installing on an Intel Mac.

Initial release binaries are not signed or notarized. Depending on macOS security settings and the download method, macOS may refuse to run them. In that case, install from source instead of disabling system security controls.

Install from source

Clone the repository and install the command with the Go toolchain:

git clone https://github.com/16ur/arag.git
cd arag
go install ./cmd/arag

The binary is installed in GOBIN, or in the bin directory of the first GOPATH entry when GOBIN is unset.

When go env GOBIN is empty, add the default Go binary directory to your shell configuration. For zsh:

echo 'export PATH="$PATH:$(go env GOPATH)/bin"' >> ~/.zshrc
source ~/.zshrc

If go env GOBIN returns a custom directory, add that directory to PATH instead. Verify the installation and start arag with:

command -v arag
arag

To build a repository-local binary instead:

make build
./bin/arag

The repository-local build requires Make. Developers use the same Make targets for formatting and quality checks.

Connect

Running arag without arguments opens the interactive connection screen. Seedhost is selected by default. Entering a username generates:

https://mud.seedhost.eu/<username>/webdav

Only the username and password are required for that preset. Select Custom WebDAV to enter another standard WebDAV URL. The password is masked, kept in memory for the current session, and never written by arag.

Advanced users and automated environments can bypass the connection screen:

arag \
  -url "https://example.com/webdav" \
  -user "USERNAME" \
  -timeout 30s

Direct mode requests the password without displaying it. ARAG_PASSWORD can provide the password in automated environments, but environment variables are less secure than interactive input and must not be stored in shell history or committed files.

Run arag -h to display all command-line options or arag --version to print the installed version.

Keyboard shortcuts

• up/down arrows or j/k: move the selection;
• Enter or l: open the selected directory or file;
• left arrow, h, or Backspace: return to the parent directory;
• i: inspect complete entry details;
• ?: open or close built-in help;
• q: open the quit confirmation;
• Ctrl+C: quit immediately.

Opening an MKV or MP4 file first displays a confirmation. Confirming creates a temporary authenticated stream and opens it in IINA. IINA receives neither the WebDAV password nor the remote media URL.

Security

arag keeps WebDAV credentials in memory for the application session. During playback, authentication remains inside a temporary HTTP endpoint bound to 127.0.0.1 with a random path token. Closing arag stops that endpoint.

Never include real credentials, private URLs, authorization headers, or stream tokens in issues. Report suspected vulnerabilities according to the security policy.

Development

The repository provides these common commands:

Run make check and make test-race before submitting a change. GitHub Actions runs the same checks for every push and pull request.

Documentation

• Project overview
• Architecture
• Terminal interface
• WebDAV behavior
• Architecture decisions
• Release process
• Roadmap

See CONTRIBUTING.md before proposing a change.