fix(desktop): close release blockers

Author: yiliang114

.github/actionlint.yaml

@@ -4,5 +4,6 @@ self-hosted-runner:
     - 'ecs-win'
     - 'ecs-update-sg'
     - 'ecs-update-64c'
+    - 'macos-15-intel'
 
 config-variables: null

.github/workflows/desktop-build.yml

@@ -94,8 +94,8 @@ jobs:
             echo "::error::Published macOS releases require signing and App Store Connect notarization secrets."
             exit 1
           fi
-          if [[ "$RUNNER_OS" == "Windows" && -n "$WINDOWS_CERTIFICATE_INPUT" && -z "$WINDOWS_CERTIFICATE_PASSWORD_INPUT" ]]; then
-            echo "::error::A configured Windows certificate requires its password."
+          if [[ "$RUNNER_OS" == "Windows" && ( -z "$WINDOWS_CERTIFICATE_INPUT" || -z "$WINDOWS_CERTIFICATE_PASSWORD_INPUT" ) ]]; then
+            echo "::error::Published Windows releases require an Authenticode certificate and password."
             exit 1
           fi
 
@@ -113,23 +113,42 @@ jobs:
           OPENWORK_DESKTOP_TARGET: '${{ matrix.target }}'
         run: 'npm run build:runtime --prefix packages/desktop-shell --workspaces=false'
 
+      - name: 'Run desktop tests'
+        run: 'npm test --prefix packages/desktop-shell --workspaces=false'
+
+      - name: 'Run desktop release tests'
+        run: 'npm run test:release --prefix packages/desktop-shell --workspaces=false'
+
       - name: 'Configure macOS signing and notarization'
         if: "runner.os == 'macOS' && inputs.publish"
         shell: 'bash'
         env:
           APPLE_API_KEY: '${{ secrets.APPLE_API_KEY || secrets.APPLE_NOTARY_KEY_ID }}'
           APPLE_API_KEY_P8_INPUT: '${{ secrets.APPLE_API_KEY_P8_BASE64 || secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}'
           APPLE_CERTIFICATE_INPUT: '${{ secrets.APPLE_CERTIFICATE || secrets.MAC_CSC_LINK }}'
+          APPLE_CERTIFICATE_PASSWORD: '${{ secrets.APPLE_CERTIFICATE_PASSWORD || secrets.MAC_CSC_KEY_PASSWORD }}'
         run: |
           set -euo pipefail
+          certificate_path="$RUNNER_TEMP/openwork-signing.p12"
           if [[ "$APPLE_CERTIFICATE_INPUT" =~ ^https?:// ]]; then
-            certificate_path="$RUNNER_TEMP/openwork-signing.p12"
             curl --fail --silent --show-error --location "$APPLE_CERTIFICATE_INPUT" --output "$certificate_path"
-            certificate="$(base64 < "$certificate_path" | tr -d '\n')"
           else
-            certificate="${APPLE_CERTIFICATE_INPUT#*base64,}"
+            CERTIFICATE_PATH="$certificate_path" node -e "require('node:fs').writeFileSync(process.env.CERTIFICATE_PATH, Buffer.from(process.env.APPLE_CERTIFICATE_INPUT.replace(/^.*base64,/, ''), 'base64'))"
+          fi
+          keychain="$RUNNER_TEMP/openwork-signing.keychain-db"
+          keychain_password="$(openssl rand -hex 32)"
+          security create-keychain -p "$keychain_password" "$keychain"
+          security set-keychain-settings -lut 21600 "$keychain"
+          security unlock-keychain -p "$keychain_password" "$keychain"
+          security import "$certificate_path" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain"
+          security list-keychains -d user -s "$keychain" login.keychain-db
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain"
+          identity="$(security find-identity -v -p codesigning "$keychain" | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -n 1)"
+          if [[ -z "$identity" ]]; then
+            echo "::error::Developer ID Application identity was not found."
+            exit 1
           fi
-          echo "APPLE_CERTIFICATE=$certificate" >> "$GITHUB_ENV"
+          echo "APPLE_SIGNING_IDENTITY=$identity" >> "$GITHUB_ENV"
           key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY}.p8"
           APPLE_KEY_PATH="$key_path" node -e "require('node:fs').writeFileSync(process.env.APPLE_KEY_PATH, Buffer.from(process.env.APPLE_API_KEY_P8_INPUT, 'base64'), { mode: 0o600 })"
           echo "APPLE_API_KEY_PATH=$key_path" >> "$GITHUB_ENV"
@@ -141,7 +160,6 @@ jobs:
           WINDOWS_CERTIFICATE_INPUT: '${{ secrets.WINDOWS_CERTIFICATE || secrets.WIN_CSC_LINK }}'
           WINDOWS_CERTIFICATE_PASSWORD_INPUT: '${{ secrets.WINDOWS_CERTIFICATE_PASSWORD || secrets.WIN_CSC_KEY_PASSWORD }}'
         run: |
-          if (-not $env:WINDOWS_CERTIFICATE_INPUT) { exit 0 }
           $certificatePath = Join-Path $env:RUNNER_TEMP 'openwork-signing.pfx'
           if ($env:WINDOWS_CERTIFICATE_INPUT -match '^https?://') {
             Invoke-WebRequest -Uri $env:WINDOWS_CERTIFICATE_INPUT -OutFile $certificatePath
@@ -154,6 +172,27 @@ jobs:
           if (-not $certificate.HasPrivateKey) { throw 'The Windows certificate has no private key.' }
           "WINDOWS_CERTIFICATE_THUMBPRINT=$($certificate.Thumbprint)" | Out-File -FilePath $env:GITHUB_ENV -Append
 
+      - name: 'Sign bundled runtime binaries (macOS)'
+        if: "runner.os == 'macOS' && inputs.publish"
+        shell: 'bash'
+        run: |
+          set -euo pipefail
+          while IFS= read -r -d '' binary; do
+            if ! file "$binary" | grep -q 'Mach-O'; then continue; fi
+            args=(--force --sign "$APPLE_SIGNING_IDENTITY" --options runtime --timestamp)
+            if [[ "$binary" == */node/bin/node ]]; then
+              args+=(--entitlements packages/desktop-shell/src-tauri/NodeEntitlements.plist)
+            fi
+            codesign "${args[@]}" "$binary"
+          done < <(find packages/desktop-shell/runtime/openwork -type f -print0)
+
+      - name: 'Refresh bundled runtime checksums (macOS)'
+        if: "runner.os == 'macOS' && inputs.publish"
+        run: 'node packages/desktop-shell/scripts/prepare-runtime.js --refresh-checksums'
+
+      - name: 'Verify bundled runtime'
+        run: 'npm run smoke:runtime --prefix packages/desktop-shell --workspaces=false'
+
       - name: 'Configure platform signing'
         shell: 'bash'
         env:
@@ -165,22 +204,161 @@ jobs:
       - name: 'Build desktop artifacts'
         uses: 'tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f' # v1.0.0
         env:
-          GITHUB_TOKEN: "${{ inputs.publish && secrets.GITHUB_TOKEN || '' }}"
           APPLE_API_ISSUER: "${{ runner.os == 'macOS' && inputs.publish && (secrets.APPLE_API_ISSUER || secrets.APPLE_NOTARY_ISSUER_ID) || '' }}"
           APPLE_API_KEY: "${{ runner.os == 'macOS' && inputs.publish && (secrets.APPLE_API_KEY || secrets.APPLE_NOTARY_KEY_ID) || '' }}"
           APPLE_CERTIFICATE_PASSWORD: "${{ runner.os == 'macOS' && inputs.publish && (secrets.APPLE_CERTIFICATE_PASSWORD || secrets.MAC_CSC_KEY_PASSWORD) || '' }}"
-          APPLE_SIGNING_IDENTITY: "${{ runner.os == 'macOS' && inputs.publish && secrets.APPLE_SIGNING_IDENTITY || '' }}"
           TAURI_SIGNING_PRIVATE_KEY: "${{ inputs.publish && secrets.TAURI_SIGNING_PRIVATE_KEY || '' }}"
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "${{ inputs.publish && secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD || '' }}"
         with:
           projectPath: 'packages/desktop-shell'
           args: '--config src-tauri/release.conf.json --target ${{ matrix.target }}'
-          tagName: "${{ inputs.publish && inputs.tag || '' }}"
-          releaseName: "${{ inputs.publish && inputs.release_name || '' }}"
-          releaseDraft: '${{ inputs.draft }}'
-          prerelease: '${{ inputs.prerelease }}'
-          generateReleaseNotes: true
-          uploadUpdaterJson: '${{ inputs.publish }}'
-          uploadUpdaterSignatures: '${{ inputs.publish }}'
+          uploadUpdaterJson: false
+          uploadUpdaterSignatures: false
           updaterJsonPreferNsis: true
-          uploadWorkflowArtifacts: true
+          uploadWorkflowArtifacts: false
+
+      - name: 'Verify macOS signature'
+        if: "runner.os == 'macOS' && inputs.publish"
+        shell: 'bash'
+        run: |
+          set -euo pipefail
+          app="$(find packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle/macos -maxdepth 1 -name '*.app' -print -quit)"
+          codesign --verify --deep --strict --verbose=2 "$app"
+          spctl --assess --type execute --verbose=2 "$app"
+
+      - name: 'Verify Windows signature'
+        if: "runner.os == 'Windows' && inputs.publish"
+        shell: 'pwsh'
+        run: |
+          $installer = Get-ChildItem packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle/nsis/*.exe | Select-Object -First 1
+          $signature = Get-AuthenticodeSignature $installer.FullName
+          if ($signature.Status -ne 'Valid') { throw "Invalid Authenticode signature: $($signature.Status)" }
+
+      - name: 'Smoke packaged application (macOS)'
+        if: "runner.os == 'macOS'"
+        shell: 'bash'
+        working-directory: 'packages/desktop-shell'
+        run: |
+          set -euo pipefail
+          executable="$(find src-tauri/target/${{ matrix.target }}/release/bundle/macos -path '*.app/Contents/MacOS/*' -type f -perm -111 -print -quit)"
+          npm run smoke:packaged -- "$executable"
+
+      - name: 'Smoke packaged application (Windows)'
+        if: "runner.os == 'Windows'"
+        shell: 'pwsh'
+        working-directory: 'packages/desktop-shell'
+        run: |
+          $executable = Get-ChildItem src-tauri/target/${{ matrix.target }}/release/openwork-desktop.exe | Select-Object -First 1
+          npm run smoke:packaged -- $executable.FullName
+
+      - name: 'Smoke packaged application (Linux)'
+        if: "runner.os == 'Linux'"
+        shell: 'bash'
+        working-directory: 'packages/desktop-shell'
+        run: 'xvfb-run -a npm run smoke:packaged -- src-tauri/target/${{ matrix.target }}/release/openwork-desktop'
+
+      - name: 'Collect verified artifacts'
+        shell: 'bash'
+        run: |
+          set -euo pipefail
+          destination="$RUNNER_TEMP/openwork-desktop-artifacts"
+          mkdir -p "$destination"
+          bundle_root="packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle"
+          while IFS= read -r -d '' artifact; do
+            name="$(basename "$artifact")"
+            if [[ "$RUNNER_OS" == 'macOS' ]]; then
+              case "$name" in
+                *.app.tar.gz.sig) name="${name%.app.tar.gz.sig}-${{ matrix.target }}.app.tar.gz.sig" ;;
+                *.app.tar.gz) name="${name%.app.tar.gz}-${{ matrix.target }}.app.tar.gz" ;;
+                *.dmg) name="OpenWork-${{ matrix.target }}.dmg" ;;
+                *) continue ;;
+              esac
+            elif [[ "$RUNNER_OS" == 'Windows' ]]; then
+              case "$name" in *-setup.exe|*-setup.exe.sig) ;; *) continue ;; esac
+            else
+              case "$name" in *.AppImage|*.AppImage.sig|*.deb|*.deb.sig) ;; *) continue ;; esac
+            fi
+            cp "$artifact" "$destination/${name// /-}"
+          done < <(find "$bundle_root" -mindepth 2 -maxdepth 2 -type f \( -name '*.dmg' -o -name '*.AppImage' -o -name '*.deb' -o -name '*.exe' -o -name '*.app.tar.gz' -o -name '*.sig' \) -print0)
+          if [[ -z "$(find "$destination" -type f -print -quit)" ]]; then
+            echo '::error::No desktop artifacts were produced.'
+            exit 1
+          fi
+
+      - name: 'Upload verified artifacts'
+        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # v4
+        with:
+          name: 'openwork-desktop-${{ matrix.target }}'
+          path: '${{ runner.temp }}/openwork-desktop-artifacts/*'
+          if-no-files-found: 'error'
+          retention-days: 14
+
+  publish:
+    name: 'Publish verified release'
+    if: 'inputs.publish'
+    needs: 'desktop'
+    runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+    steps:
+      - name: 'Check out source'
+        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: 'Download verified artifacts'
+        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093' # v4
+        with:
+          pattern: 'openwork-desktop-*'
+          path: 'release-assets'
+          merge-multiple: true
+
+      - name: 'Generate updater manifest and checksums'
+        shell: 'bash'
+        env:
+          RELEASE_TAG: '${{ inputs.tag }}'
+          RELEASE_VERSION: '${{ inputs.version }}'
+        run: |
+          set -euo pipefail
+          node .github/scripts/create-desktop-update-manifest.mjs --assets release-assets --repository "$GITHUB_REPOSITORY" --tag "$RELEASE_TAG" --version "$RELEASE_VERSION" --output release-assets/latest.json
+          (cd release-assets && sha256sum -- * > SHA256SUMS.txt)
+
+      - name: 'Create GitHub release'
+        env:
+          GH_TOKEN: '${{ github.token }}'
+          RELEASE_DRAFT: '${{ inputs.draft }}'
+          RELEASE_NAME: '${{ inputs.release_name }}'
+          RELEASE_PRERELEASE: '${{ inputs.prerelease }}'
+          RELEASE_TAG: '${{ inputs.tag }}'
+        run: |
+          set -euo pipefail
+          args=("$RELEASE_TAG" release-assets/* --target "$GITHUB_SHA" --title "$RELEASE_NAME" --generate-notes --latest=false)
+          if [[ "$RELEASE_DRAFT" == 'true' ]]; then args+=(--draft); fi
+          if [[ "$RELEASE_PRERELEASE" == 'true' ]]; then args+=(--prerelease); fi
+          gh release create "${args[@]}"
+
+      - name: 'Update stable updater feed'
+        if: 'inputs.draft == false && inputs.prerelease == false'
+        env:
+          GH_TOKEN: '${{ github.token }}'
+          RELEASE_VERSION: '${{ inputs.version }}'
+        run: |
+          set -euo pipefail
+          if gh release view desktop-latest >/dev/null 2>&1; then
+            directory="$(mktemp -d)"
+            trap 'rm -rf "$directory"' EXIT
+            gh release download desktop-latest --dir "$directory" --pattern 'latest.json'
+            current="$(jq -r '.version' "$directory/latest.json")"
+            if [[ ! "$current" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "::error::Current Desktop stable feed has an invalid version: $current"
+              exit 1
+            fi
+            newest="$(printf '%s\n%s\n' "$RELEASE_VERSION" "$current" | sort -V | tail -n 1)"
+            if [[ "$current" != "$RELEASE_VERSION" && "$newest" == "$current" ]]; then
+              echo "::notice::Desktop $RELEASE_VERSION will not replace newer stable feed $current."
+              exit 0
+            fi
+            gh release upload desktop-latest release-assets/latest.json --clobber
+          else
+            gh release create desktop-latest release-assets/latest.json --title 'OpenWork Desktop latest' --notes 'Stable desktop updater feed.' --latest=false
+          fi

.github/workflows/desktop-release.yml

@@ -33,7 +33,7 @@ permissions:
   contents: 'read'
 
 concurrency:
-  group: 'desktop-release-${{ inputs.version }}'
+  group: "desktop-release-${{ inputs.dry_run && inputs.version || 'publish' }}"
   cancel-in-progress: false
 
 jobs:
@@ -52,7 +52,9 @@ jobs:
         env:
           INPUT_VERSION: '${{ inputs.version }}'
           INPUT_RELEASE_NAME: '${{ inputs.release_name }}'
+          IS_DRAFT: '${{ inputs.draft }}'
           IS_DRY_RUN: '${{ inputs.dry_run }}'
+          IS_PRERELEASE: '${{ inputs.prerelease }}'
           SOURCE_BRANCH: '${{ github.ref_name }}'
         run: |
           set -euo pipefail
@@ -65,6 +67,14 @@ jobs:
             echo "::error::Published desktop releases must run from main."
             exit 1
           fi
+          if [[ "$IS_PRERELEASE" == "true" && ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+- ]]; then
+            echo "::error::Prereleases require a SemVer prerelease suffix: $INPUT_VERSION"
+            exit 1
+          fi
+          if [[ "$IS_DRY_RUN" == "false" && "$IS_DRAFT" == "false" && "$IS_PRERELEASE" == "false" && ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Published stable releases require an X.Y.Z version: $INPUT_VERSION"
+            exit 1
+          fi
           if [[ "$INPUT_RELEASE_NAME" == *$'\n'* || "$INPUT_RELEASE_NAME" == *$'\r'* || ${#INPUT_RELEASE_NAME} -gt 200 ]]; then
             echo "::error::Release names must be a single line up to 200 characters."
             exit 1

.gitignore

@@ -95,6 +95,7 @@ pr_body.md
 packages/cli/src/generated/
 packages/core/src/generated/
 packages/web-templates/src/generated/
+packages/desktop-shell/src-tauri/permissions/autogenerated/
 .integration-tests/
 packages/vscode-ide-companion/*.vsix
 

docs/design/2026-07-31-desktop-web-shell-release.md

@@ -32,7 +32,7 @@ flowchart LR
   C -->|authenticated loopback URL| D[Existing Web Shell]
   A -->|retry / choose workspace / logs| B
   B -->|exit event| A
-  E[GitHub latest.json + installers] -->|signed updater| B
+  E[GitHub desktop-latest/latest.json + installers] -->|signed updater| B
 ```
 
 ### 组件职责
@@ -128,7 +128,7 @@ Tauri updater 使用签名更新产物和固定公开 key。应用启动后后
 - 检查失败：写日志，不阻塞启动。
 - 有更新：bootstrap/Web Shell 上方显示原生确认对话框；用户确认后下载并安装，然后重启。
 
-发布 CI 使用 `TAURI_SIGNING_PRIVATE_KEY` 与 `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` 生成 updater signatures。`latest.json` 指向同一 GitHub Release 的平台更新包。只有非 draft、非 prerelease 发布会更新固定的 `desktop-latest` feed release。
+发布 CI 使用 `TAURI_SIGNING_PRIVATE_KEY` 与 `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` 生成 updater signatures。`latest.json` 指向版本化 GitHub Release 的平台更新包。只有非 draft、非 prerelease 发布会更新固定的 `desktop-latest` feed release，客户端只读取该固定 feed。
 
 ## 平台发布矩阵
 

packages/channels/base/src/ChannelBase.ts

@@ -212,6 +212,8 @@ export interface ChannelBaseOptions {
   proxy?: string;
   /** Adapter-owned persistent state directory. */
   stateDir?: string;
+  /** Called when an adapter becomes permanently unavailable after connecting. */
+  onTerminalDisconnect?: (error: Error) => void;
   channelMemory?: ChannelMemoryCallbacks;
   memoryIntentClassifier?: ChannelMemoryIntentClassifier;
   channelMemoryRecallObserver?: (
@@ -373,6 +375,7 @@ export abstract class ChannelBase {
   protected proxy?: string;
   /** Adapter-owned persistent state directory, when supplied by the runtime. */
   protected readonly stateDir?: string;
+  protected readonly onTerminalDisconnect?: (error: Error) => void;
   private readonly channelMemory?: ChannelMemoryCallbacks;
   private readonly memoryIntentClassifier?: ChannelMemoryIntentClassifier;
   private readonly channelMemoryRecallObserver?: (
@@ -810,6 +813,7 @@ export abstract class ChannelBase {
     this.bridge = bridge;
     this.proxy = options?.proxy;
     this.stateDir = options?.stateDir;
+    this.onTerminalDisconnect = options?.onTerminalDisconnect;
     this.identity = Object.freeze(this.resolveIdentity(name, config));
     this.memoryScope = Object.freeze(this.resolveMemoryScope(name, config));
     this.channelMemory = options?.channelMemory;