Contribute

It builds in four commands.

Flume is Apache-2.0 and developed in the open. The engine is a dependency rather than a project, so almost everything worth doing is in the part people actually touch.

Building from source

You need Rust 1.88 or later, Node 26, and your platform's Tauri system dependencies. The development setup page lists those per platform — on Debian and Ubuntu there are a handful of -dev packages.

git clone https://github.com/adamgreenwell/flume.git
cd flume
npm install
npm run tauri:dev

Before opening a pull request, run the same gate CI runs. It is not a formality — a red gate is the most common reason a change sits.

npm run check
cd src-tauri
cargo fmt --check
cargo clippy --all-targets -- -D warnings
cargo test

Tests needing more than a checkout are #[ignore]d. A failure under --ignored is not automatically a regression: the DHT tests want working internet, and the proxy test wants a SOCKS5 proxy on 127.0.0.1:1080. Each one's ignore reason names its own prerequisite.

Where to start

Four things that would genuinely help.

  • Run it on Windows or Linux

    Flume is developed on macOS. CI builds for every platform, but first-run behaviour on the others has never had a manual pass. This is the single most useful thing anyone can do right now, and it needs no Rust.

    Report what you find →

  • Improve the documentation

    Everything you can read here lives in docs/ in the app repo, and is mirrored to both this site and the wiki from there. Fix it once, at the source.

    Browse docs/ →

  • Pick up an issue

    Issues carry the context needed to start. Anything blocked on an upstream decision says so, so you do not spend an evening on something that cannot land.

    Open issues →

  • Work on this website

    Separate repository, Astro, no Rust required. The design rules are written down and the quality gate is two commands.

    Site repository →

Non-negotiable

Eight rules a change is held to.

These are not style preferences. Violating one is a design defect, and a review will ask you to change it — so they are written down here rather than discovered in a pull request.

  1. 01

    No torrent binary data over IPC

    librqbit writes pieces to disk. The webview receives JSON only — progress, speeds, counts, file lists. This is the architecture's central claim, and everything else follows from it.

  2. 02

    The engine layer imports no Tauri types

    src-tauri/src/engine/ must compile and be testable under plain cargo test. If a change makes the engine need Tauri, the change is in the wrong layer.

  3. 03

    Command handlers are thin

    Logic worth testing belongs in the engine, where it can be tested without a webview or a mock runtime.

  4. 04

    Static export only

    No app/api routes, no middleware, no server-only functions. Everything reaches the backend through invoke, because there is no server to reach.

  5. 05

    Telemetry stays around 1 Hz, batched

    No per-piece events. The payload should scale with torrent count, never with piece count or file size.

  6. 06

    Shared types change together

    A serde struct in Rust and its TypeScript mirror in src/lib/ipc/types.ts change in the same commit. Not the next one.

  7. 07

    Minimal Tauri permissions

    Grant only what a feature needs. The shell plugin is not to be added without a discussion.

  8. 08

    Verdicts the data cannot support are not invented

    Where the engine reports nothing, the interface says so. A plausible number is worse than an honest blank, and the swarm verdicts exist precisely to hold that line.

The interface has its own vocabulary, and it is equally firm: never introduce a colour that is not a token, status is never colour alone, and every number that sits in a column is set in tabular monospace. The design system is the rulebook.

Reporting a security issue

Please do not open a public issue. Use GitHub's private reporting on the Security tab. Note that some things people report are properties of BitTorrent rather than bugs — peers can see your IP, and DHT announces that you are in a swarm. The policy says which is which.

Security policy →

Code of Conduct

The Contributor Covenant, and it is enforced. Everyone taking part — issues, pull requests, discussions — is held to it.

Read it →

What Flume will not do

No cryptocurrency, no chat, no RSS automation, no paid tier, and no second CLI — rqbit already exists. A proposal in those directions will be declined, so the roadmap says so in advance.

Roadmap →