fix: harden desktop recording and rendering for v0.6

.gitattributes

@@ -0,0 +1 @@
+/apps/desktop-gpui/patches/*.patch text eol=lf

.github/workflows/ci.yml

@@ -32,6 +32,7 @@ jobs:
         with:
           filters: |
             desktop:
+              - '.gitattributes'
               - '.github/actions/install-desktop-deps/**'
               - '.github/workflows/ci.yml'
               - 'apps/cli/**'
@@ -44,7 +45,8 @@ jobs:
               - 'packages/web-api-contract/**'
               - 'scripts/build-desktop-binaries*'
               - 'scripts/build-gpui-binary.sh'
-              - 'scripts/prepare-gpui-dependency.sh'
+              - 'scripts/build-macos-packages*'
+              - 'scripts/prepare-gpui-dependency*'
               - 'scripts/run-gpui-build*'
               - 'scripts/sync-desktop-versions.mjs'
               - 'scripts/verify-gpui-release-inputs.mjs'
@@ -233,6 +235,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Test desktop build preparation
+        run: node --test scripts/prepare-gpui-dependency.test.mjs scripts/build-macos-packages.test.mjs
+
       - name: Install Linux desktop dependencies
         if: ${{ runner.os == 'Linux' }}
         uses: ./.github/actions/install-desktop-deps
@@ -282,7 +287,7 @@ jobs:
           pnpm --dir apps/desktop exec vitest run scripts/prepare.test.js
           cargo test --locked -p cap-utils -p cap-cli-install --lib
           cargo test --locked -p cap --bin cap record::tests
-          cargo test --locked -p cap-recording --lib
+          cargo test --locked -p cap-recording --lib -- --test-threads=1
           cargo test --locked -p cap-enc-ffmpeg
         env:
           LD_LIBRARY_PATH: ${{ format('{0}/target/native-deps/lib:{0}/target/debug:{0}/target/{1}/debug', github.workspace, matrix.settings.target) }}

.github/workflows/desktop-release.yml

@@ -218,6 +218,14 @@ jobs:
         with:
           ref: ${{ inputs.sha }}
 
+      - name: Test GPUI patch checkout
+        if: ${{ hashFiles('scripts/prepare-gpui-dependency.test.mjs') != '' }}
+        run: node --test scripts/prepare-gpui-dependency.test.mjs
+
+      - name: Test macOS packaging retries
+        if: ${{ hashFiles('scripts/build-macos-packages.test.mjs') != '' }}
+        run: node --test scripts/build-macos-packages.test.mjs
+
       # Nightly and promoted builds carry a version that differs from the
       # committed Cargo.toml; Tauri reads the app version from package.version.
       - name: Stamp build version
@@ -340,7 +348,7 @@ jobs:
 
       - name: Build app
         working-directory: apps/desktop
-        run: ${{ runner.os == 'Linux' && 'CARGO_PROFILE_RELEASE_DEBUG=0 node ../../scripts/build-linux-packages.mjs' || 'pnpm build:tauri --target' }} ${{ matrix.settings.target }} --config src-tauri/tauri.prod.conf.json ${{ runner.os == 'Windows' && '--bundles nsis' || runner.os == 'Linux' && '--verbose' || '' }}
+        run: ${{ runner.os == 'Linux' && 'CARGO_PROFILE_RELEASE_DEBUG=0 node ../../scripts/build-linux-packages.mjs' || runner.os == 'macOS' && hashFiles('scripts/build-macos-packages.mjs') != '' && 'node ../../scripts/build-macos-packages.mjs' || 'pnpm build:tauri --target' }} ${{ matrix.settings.target }} --config src-tauri/tauri.prod.conf.json ${{ runner.os == 'Windows' && '--bundles nsis' || runner.os == 'Linux' && '--verbose' || '' }}
         env:
           # https://github.com/tauri-apps/tauri-action/issues/740
           CI: false
@@ -359,6 +367,55 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           RUST_TARGET_TRIPLE: ${{ matrix.settings.target }}
 
+      # Tauri patches Cap.exe with the NSIS marker during the first bundle.
+      # Sign those patched bytes, then rebundle with the same package type.
+      - name: Stage Windows payload for Authenticode signing
+        if: ${{ runner.os == 'Windows' }}
+        shell: pwsh
+        run: |
+          ./scripts/windows-release-signing.ps1 -Operation Stage -Target "${{ matrix.settings.target }}" -WorkspaceRoot "$env:GITHUB_WORKSPACE"
+
+      - name: Upload unsigned Windows payload
+        if: ${{ runner.os == 'Windows' }}
+        id: upload_unsigned_windows_payload
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: unsigned-windows-payload
+          path: target/${{ matrix.settings.target }}/release/windows-signing/payload
+          if-no-files-found: error
+
+      - name: Submit SignPath payload signing request
+        if: ${{ runner.os == 'Windows' }}
+        timeout-minutes: 90
+        id: submit_signpath_payload_signing_request
+        uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: ${{ secrets.SIGNPATH_PROJECT_SLUG }}
+          signing-policy-slug: ${{ secrets.SIGNPATH_SIGNING_POLICY_SLUG }}
+          artifact-configuration-slug: ${{ secrets.SIGNPATH_ARTIFACT_CONFIGURATION_SLUG }}
+          github-artifact-id: ${{ steps.upload_unsigned_windows_payload.outputs.artifact-id }}
+          wait-for-completion: true
+          wait-for-completion-timeout-in-seconds: 5400
+          service-unavailable-timeout-in-seconds: 5400
+          output-artifact-directory: signed-windows-payload
+
+      - name: Restore and verify signed Windows payload
+        if: ${{ runner.os == 'Windows' }}
+        shell: pwsh
+        run: |
+          ./scripts/windows-release-signing.ps1 -Operation Restore -Target "${{ matrix.settings.target }}" -WorkspaceRoot "$env:GITHUB_WORKSPACE"
+
+      - name: Bundle Windows installer
+        if: ${{ runner.os == 'Windows' }}
+        working-directory: apps/desktop
+        shell: bash
+        run: pnpm tauri bundle --target ${{ matrix.settings.target }} --bundles nsis --config src-tauri/tauri.prod.conf.json
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
       - name: Verify macOS app contents and signing
         if: ${{ runner.os == 'macOS' }}
         shell: bash
@@ -396,6 +453,48 @@ jobs:
           fi
           codesign --verify "$DMG"
 
+      - name: Notarize and verify macOS disk image
+        if: ${{ runner.os == 'macOS' }}
+        timeout-minutes: 25
+        shell: bash
+        env:
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_PATH: ${{ github.workspace }}/api.p8
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          DMGS=(target/${{ matrix.settings.target }}/release/bundle/dmg/*.dmg)
+          if [[ ${#DMGS[@]} -eq 0 ]]; then
+            echo "::error::No macOS disk image is available for notarization."
+            exit 1
+          fi
+          [[ -n "$APPLE_API_KEY" && -n "$APPLE_API_ISSUER" && -s "$APPLE_API_KEY_PATH" ]]
+          for DMG in "${DMGS[@]}"; do
+            [[ -f "$DMG" && -s "$DMG" && ! -L "$DMG" ]]
+            codesign --verify "$DMG"
+            NOTARY_RESULT="$(mktemp "$RUNNER_TEMP/cap-dmg-notary.XXXXXX")"
+            NOTARY_EXIT=0
+            xcrun notarytool submit "$DMG" \
+              --key "$APPLE_API_KEY_PATH" --key-id "$APPLE_API_KEY" --issuer "$APPLE_API_ISSUER" \
+              --wait --timeout 20m --output-format json > "$NOTARY_RESULT" || NOTARY_EXIT=$?
+            node -e '
+              const fs = require("node:fs");
+              const result = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+              if (!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(result.id ?? "")) {
+                throw new Error("Notarization submission ID is missing or invalid.");
+              }
+              console.log(JSON.stringify({ submissionId: result.id, status: result.status }));
+              if (process.argv[2] !== "0" || result.status !== "Accepted") {
+                throw new Error("Disk image notarization did not complete with Accepted status.");
+              }
+            ' "$NOTARY_RESULT" "$NOTARY_EXIT"
+            xcrun stapler staple "$DMG"
+            xcrun stapler validate "$DMG"
+            codesign --verify "$DMG"
+            spctl --assess --type open --context context:primary-signature "$DMG"
+          done
+
       # Guards against the Linux packaging regressions:
       #   1. Frontend missing: vinxi must produce apps/desktop/.output/public,
       #      which Tauri EMBEDS into the binary (it is NOT shipped as a loose
@@ -609,16 +708,17 @@ jobs:
       - name: Upload unsigned Windows installer
         if: ${{ runner.os == 'Windows' }}
         id: upload_unsigned_windows_installer
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: unsigned-windows-installer
           path: target/${{ matrix.settings.target }}/release/bundle/nsis/*.exe
           if-no-files-found: error
 
       - name: Submit SignPath signing request
         if: ${{ runner.os == 'Windows' }}
+        timeout-minutes: 90
         id: submit_signpath_signing_request
-        uses: signpath/github-action-submit-signing-request@v1
+        uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1
         with:
           api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
           organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
@@ -627,20 +727,11 @@ jobs:
           artifact-configuration-slug: ${{ secrets.SIGNPATH_ARTIFACT_CONFIGURATION_SLUG }}
           github-artifact-id: ${{ steps.upload_unsigned_windows_installer.outputs.artifact-id }}
           wait-for-completion: true
-          # SignPath Foundation requires a human to approve each signing
-          # request, so this step blocks until someone clicks approve. Raising
-          # wait-for-completion-timeout-in-seconds alone did NOT extend the
-          # window: while a request sits "WaitingForApproval" the action's
-          # per-call retry budget (service-unavailable-timeout-in-seconds,
-          # default 600s) is what expires and fails the job at ~10 min, so both
-          # must be raised. GitHub-hosted jobs are hard-capped at 6h total and
-          # the Windows build already consumes part of that, so ~4h is the
-          # practical ceiling for a blocking wait; the action times out cleanly
-          # here rather than letting GitHub kill the runner mid-build. For a
-          # genuinely longer (12h+) window the signing has to be decoupled from
-          # the build job (submit without waiting, finalise in a later job).
-          wait-for-completion-timeout-in-seconds: 14400
-          service-unavailable-timeout-in-seconds: 14400
+          # Both signing stages share the six-hour job budget with the build.
+          # Match the approval and retry budgets so waiting for approval does
+          # not expire at the action's shorter default retry timeout.
+          wait-for-completion-timeout-in-seconds: 5400
+          service-unavailable-timeout-in-seconds: 5400
           output-artifact-directory: signed-windows-installer
 
       - name: Restore signed Windows installer
@@ -680,6 +771,18 @@ jobs:
             }
           }
 
+      - name: Verify extracted Windows payload signatures and hashes
+        if: ${{ runner.os == 'Windows' }}
+        shell: pwsh
+        run: |
+          $installers = Get-ChildItem -Path "target/${{ matrix.settings.target }}/release/bundle/nsis" -Filter *.exe
+          if (-not $installers) {
+            throw "No Windows installer exists for extracted payload verification."
+          }
+          foreach ($installer in $installers) {
+            ./scripts/windows-release-signing.ps1 -Operation VerifyInstaller -Target "${{ matrix.settings.target }}" -WorkspaceRoot "$env:GITHUB_WORKSPACE" -InstallerPath $installer.FullName
+          }
+
       - name: Re-sign Windows installer for Tauri updater
         if: ${{ runner.os == 'Windows' }}
         shell: bash
@@ -701,6 +804,23 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
+      - name: Retain signed packages for release validation
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: desktop-release-${{ matrix.settings.target }}-${{ inputs.sha }}
+          path: |
+            target/${{ matrix.settings.target }}/release/bundle/dmg/*.dmg
+            target/${{ matrix.settings.target }}/release/bundle/nsis/*.exe
+            target/${{ matrix.settings.target }}/release/bundle/nsis/*.sig
+            target/${{ matrix.settings.target }}/release/windows-signing/payload-manifest.json
+            target/${{ matrix.settings.target }}/release/bundle/deb/*.deb
+            target/${{ matrix.settings.target }}/release/bundle/deb/*.sig
+            target/${{ matrix.settings.target }}/release/bundle/appimage/*.AppImage
+            target/${{ matrix.settings.target }}/release/bundle/appimage/*.sig
+          if-no-files-found: error
+          retention-days: 3
+          compression-level: 0
+
       - name: Upload assets
         if: ${{ runner.os != 'Linux' }}
         uses: crabnebula-dev/cloud-release@v0

.github/workflows/docker-build-media-server.yml

@@ -60,6 +60,16 @@ jobs:
           cache-from: type=gha,scope=media-server-${{ matrix.platform }}
           cache-to: type=gha,mode=max,scope=media-server-${{ matrix.platform }}
 
+      - name: Verify recording decode in the production image
+        env:
+          MEDIA_IMAGE: ghcr.io/${{ env.REPOSITORY_OWNER }}/cap-media-server@${{ steps.build.outputs.digest }}
+        run: |
+          docker run --rm --network none --entrypoint bun "$MEDIA_IMAGE" test \
+            src/__tests__/lib/recording-verification.integration.test.ts \
+            src/__tests__/lib/job-manager.test.ts
+          docker run --rm --network none --entrypoint bun "$MEDIA_IMAGE" test \
+            src/__tests__/routes/recording-verification.test.ts
+
       - name: Export Digest
         run: |
           mkdir -p /tmp/digests

.github/workflows/sync-tests.yml

@@ -26,6 +26,10 @@ on:
       - "crates/editor/**"
       - "crates/audio/**"
       - "crates/media-info/**"
+      - "crates/project/**"
+      - "scripts/recording-reliability.py"
+      - "scripts/recording-reliability-owned-process.cs"
+      - "scripts/test-recording-reliability.py"
       - ".github/workflows/sync-tests.yml"
 
 concurrency:
@@ -67,6 +71,11 @@ jobs:
         with:
           node-version: 24
 
+      - name: Setup Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.13"
+
       - name: Native dependencies
         env:
           RUST_TARGET_TRIPLE: ${{ runner.os == 'Linux' && 'x86_64-unknown-linux-gnu' || runner.os == 'Windows' && 'x86_64-pc-windows-msvc' || 'aarch64-apple-darwin' }}
@@ -77,6 +86,17 @@ jobs:
         shell: pwsh
         run: Add-Content -Path $env:GITHUB_PATH -Value "${{ github.workspace }}\\target\\ffmpeg\\bin"
 
+      - name: Recording metadata and harness regression tests
+        shell: bash
+        run: |
+          cargo test --locked -p cap-project --lib
+          python -B scripts/test-recording-reliability.py
+
+      - name: Compile recording process supervisor (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: Add-Type -Path scripts/recording-reliability-owned-process.cs
+
       - name: Install software Vulkan driver (Linux)
         if: runner.os == 'Linux'
         run: |
@@ -116,7 +136,7 @@ jobs:
         shell: bash
         run: |
           cargo test --locked -p cap-timestamp -p cap-enc-ffmpeg
-          cargo test --locked -p cap-recording --lib
+          cargo test --locked -p cap-recording --lib -- --test-threads=1
           # --nocapture so a WARP-adapter notch skip prints instead of
           # looking identical to a pass in the CI log.
           cargo test --locked -p cap-rendering -- --nocapture
@@ -230,7 +250,7 @@ jobs:
 
       - name: Upload findings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: sync-matrix-${{ matrix.runner }}
           path: ${{ github.workspace }}/sync-matrix-${{ matrix.runner }}.json