fix(release): the blockers and hardening from the 1.8.0 review

[EtienneLescot]

Findings from the review of release/1.8.0 (main…release = 164 commits, 563 files, +110k/−26k), applied. Three commits, reviewable independently.

−1848 / +665. Most of it is deletion.

---

🚨 The installers had no speech-to-text

electron/native/bin/ is gitignored, and build-whisper-stt.yml publishes the binaries as artifacts of its own workflow run. Nothing carried them into build.yml — its only download-artifact steps collect finished installers in the publish job. There is no runtime download either: modelManager.ts fetches the model, resolveBinaryPath() only probes paths and returns null.

Result: transcription and captions — headline 1.8.0 features — would fail in every shipped build with whisper-stt-server binary not found; build it via scripts/build-whisper-stt.sh, a developer message shown to end users.

scripts/stage-whisper-stt.sh now stages them in all four build legs and fails the build if they are missing. A red build beats a silent one. Artifact retention 30 → 90 days, since a release build now depends on it.

🚨 CI never ran on this branch

ci.yml triggered on [main, feat/ai-edition] only. gh pr checks confirms it: PRs #167, #168 and #169 — 30k+ lines of deletion and refactor — merged into release/1.8.0 with lint, typecheck, tests, build and the PR-title check all skipped, and CodeRabbit reporting "reviews are disabled for this base branch". Added release/** to both triggers.

⚖️ Providers shipping borrowed vendor credentials

openai-oauth and copilot-proxy reached a user's subscription by presenting the vendor's own OAuth client ID (app_EMoamEEZ73f0CkXaXp7hrann, Iv1.b507a08c87ecfe98) and Editor-Version: vscode/1.96.2 against endpoints reserved for first-party clients. In a signed installer on the Microsoft Store and winget, so the exposure landed on our users' accounts.

Both vendors now offer a sanctioned surface, so this is a migration, not an amputation — tracked in #173. Removed here because the constants had to leave the binary; hiding the UI would not have done it.

The eight API-key providers are untouched.

🐛 Lost saves on the timeline path

DocumentService serialises saves of a project through a per-instance queue — its own writeProject comment records that this race destroyed two real project files. handlers.ts built a fresh instance for every runTimelineOperation, so a timeline op and a document.save ran on two queues against one path. temp+rename still kept the file valid JSON, so the symptom was a silently lost save rather than corruption. Hoisted to one instance, alongside LlmConfigStore (two sync readFileSync + a safeStorage decrypt, on every chat message).

🔒 Smaller hardening

• open-external-url passed the renderer's string straight to shell.openExternal, which hands it to the OS handler — file:, ms-msdt:, UNC paths are launch primitives there. Allowlisted to http/https/mailto.
• The native bridge marked every INTERNAL_ERROR retryable and forwarded error.message verbatim, so main-process errors quoted absolute paths into UI strings. Now non-retryable by default, path-redacted for the renderer, logged in full on the main side.
• OPENSCREEN_WHISPER_HOST overrode an explicit --host, so an env var could widen a shipped unauthenticated server's bind address. Fallback only now, and loopback-only.

📄 LGPL notice

fetch-ffmpeg.mjs goes to real lengths to keep the build LGPL rather than GPL — pinned dated tag, SHA-256 before extract, -L/-buildconf/-encoders all checked. But nothing carried the attribution or the source offer into the installer. THIRD-PARTY-NOTICES.md added and shipped into resources/ with LICENSE.

Also stops shipping the static ffmpeg.exe on Windows: the compositor addon dlopens the av*.dll set, but no runtime code spawns the exe (verified — electron/media/ffmpegCapabilities.ts, its old runtime twin, went with the web export path). It was adding a large binary and an LGPL obligation to every installer for a file nothing opens.

🧪 Test flake

document-service.test.ts > "leaves valid JSON when a long and a short save race" timed out at vitest's 5s default in the full run and passed alone in 1.7s — 12 rounds of real fsync+rename, sensitive to parallel load. Explicit 30s timeout: the "this actually hung" threshold, not the expected runtime.

---

Verification

tsc --noEmit	clean
biome check .	0 errors, 7 warnings (all pre-existing, in tests)
vitest --run	1119 / 1119 across 99 files

Baseline before this branch was 1108 tests with 1 failing.

Two things a reviewer should check

1. The four CI build legs are not exercised by this PR. stage-whisper-stt.sh passes bash -n, the YAML parses, and darwin-${{ matrix.arch }} matches the whisper workflow's tags — but gh run download has not run for real. Worth one workflow_dispatch of build.yml before cutting the RC, rather than finding out during the release.
2. typecheck-tests is advisory on purpose (continue-on-error: true). tsconfig.json includes only src + electron and excludes **/*.test.ts, so no test file has ever been typechecked and 82 errors have accumulated. The job makes the drift visible and stops it growing; flip the flag off once the count is zero. Fixing all 82 here would have buried everything above.

Also noted, not touched: npm run i18n:check already fails on main (missing captions.* keys in ar). Unrelated to this branch and not part of CI.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a869e56-8050-49e4-859f-0ec992554255

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-1-8-0-review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}