TTP 3.2.3: reliable long dictations, silent updates, any shortcut

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,44 @@
+name: Bug report
+description: Something did not work as expected
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time. The fastest route is inside the app: **Settings → Advanced → Report a problem** prepares an e-mail with the technical details and nothing you dictated. You can send that, or describe the problem below.
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you did, what you expected, and what you got instead.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: TTP version
+      description: Shown in the Settings window.
+      placeholder: "3.2.3"
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - macOS (Apple Silicon)
+        - macOS (Intel)
+        - Windows
+    validations:
+      required: true
+  - type: input
+    id: mic
+    attributes:
+      label: Microphone
+      description: Built-in, AirPods, USB headset…
+  - type: textarea
+    id: report
+    attributes:
+      label: Report or logs
+      description: Anything from the report that helps, if you have it.
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security issue
+    url: https://github.com/AmirK-S/TTP/security/policy
+    about: Please report vulnerabilities privately, not as a public issue.
+  - name: Website and setup guide
+    url: https://ttp.amirks.eu
+    about: Download, setup and frequently asked questions.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,15 @@
+name: Feature request
+description: An idea that would make TTP more useful to you
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do
+      description: The situation and what gets in the way today.
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What would help

.github/workflows/release.yml

@@ -32,25 +32,67 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
-      # Detect whether this tag targets the beta channel (e.g. v2.0.0-beta.1).
+      # Detect whether this tag targets the beta channel.
+      # Convention (since v3.0.1): numeric-only pre-release suffix
+      # like `v3.1.0-1`, `v3.1.0-2`. MSI bundler accepts numeric
+      # pre-releases (since tauri-bundler v1.2.0) but rejects alphanumeric
+      # ones like `-beta.N` — see ARCHITECTURE.md for the long history.
+      # The legacy `-beta.N` pattern is still matched for backward
+      # compatibility with the v3.0.0-beta.1..4 tags already in the wild.
       # Outputs:
       #   is_beta = "true" | "false"
       #   channel = "beta" | "stable"
-      # Used downstream to flip the GitHub Release to prerelease and to
-      # publish a `latest-beta.json` manifest pointing at this build.
       - name: Detect beta tag
         id: beta-check
         shell: bash
         run: |
           TAG="${{ github.ref_name }}"
-          if [[ "$TAG" =~ -beta\.[0-9]+$ ]]; then
+          # Accept only:
+          #   vX.Y.Z           — stable
+          #   vX.Y.Z-N         — numeric beta (current convention)
+          #   vX.Y.Z-beta.N    — legacy beta (preserved for v3.0.0-beta.1..4)
+          # Reject ANY other pre-release suffix (rc, hotfix, canary, dash with
+          # nothing after) so a malformed tag can't ship to /releases/latest
+          # as a stable build. Without this guard, `v3.0.5-rc.1` would have
+          # been promoted to `--latest` and silently overwritten the stable
+          # auto-updater pointer.
+          if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "is_beta=false" >> "$GITHUB_OUTPUT"
+            echo "channel=stable" >> "$GITHUB_OUTPUT"
+          elif [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-[0-9]+$ ]] || [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+$ ]]; then
             echo "is_beta=true" >> "$GITHUB_OUTPUT"
             echo "channel=beta" >> "$GITHUB_OUTPUT"
           else
-            echo "is_beta=false" >> "$GITHUB_OUTPUT"
-            echo "channel=stable" >> "$GITHUB_OUTPUT"
+            echo "::error::Tag $TAG has an unrecognised format. Use vX.Y.Z (stable) or vX.Y.Z-N (numeric beta)."
+            exit 1
           fi
 
+      # Cross-check the tag against the version baked into the source. Without
+      # this, you can push tag v3.0.5 against a commit where Cargo.toml +
+      # package.json still say 3.0.4 — the build produces a v3.0.4 binary and
+      # uploads it to release v3.0.5. The updater manifest takes its version
+      # from Cargo.toml/tauri.conf.json, so the manifest would mismatch the
+      # tag and users would re-install the same build on every check.
+      - name: Verify tag matches source version
+        shell: bash
+        run: |
+          TAG="${{ github.ref_name }}"
+          # Strip the leading 'v' and any pre-release suffix to get the bare
+          # vX.Y.Z core for comparison.
+          TAG_VERSION="${TAG#v}"
+          TAG_CORE="${TAG_VERSION%%-*}"
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          CARGO_VERSION=$(grep -E '^version = ' src-tauri/Cargo.toml | head -1 | sed -E 's/version = "(.*)"/\1/')
+          if [ "$TAG_CORE" != "$PKG_VERSION" ]; then
+            echo "::error::Tag $TAG core $TAG_CORE does not match package.json version $PKG_VERSION"
+            exit 1
+          fi
+          if [ "$TAG_CORE" != "$CARGO_VERSION" ]; then
+            echo "::error::Tag $TAG core $TAG_CORE does not match Cargo.toml version $CARGO_VERSION"
+            exit 1
+          fi
+          echo "Tag $TAG matches source version $TAG_CORE (package.json + Cargo.toml)."
+
       # On Windows + beta tags, skip the MSI bundler. MSI rejects non-numeric
       # SemVer pre-release identifiers (e.g. -beta.1) — see tauri-apps/tauri
       # issue. NSIS .exe still ships and is sufficient for beta-channel users.
@@ -74,24 +116,29 @@ jobs:
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable @ 2025-12-16
         with:
+          # Pin the toolchain explicitly. Without a `toolchain:` input, the
+          # action installs whatever is the latest stable rustc at run time,
+          # so two release builds of the same git SHA can produce different
+          # binaries depending on when CI ran. Bump this deliberately via PR.
+          #
+          # 2026-06-10: bumped from 1.85.0 to 1.90.0 — transitive deps (time,
+          # time-core, time-macros) require ≥1.88.0. 1.90.0 is the latest
+          # stable at pin time and gives margin for future minor dep bumps.
+          toolchain: '1.90.0'
           targets: ${{ matrix.target }}
+          components: rustfmt, clippy
 
       - name: Rust cache
         uses: swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae  # v2
         with:
           workspaces: src-tauri -> target
 
-      - name: Install opus dependencies (macOS)
-        if: matrix.platform == 'macos-latest'
-        run: brew install cmake opus pkg-config
-        env:
-          HOMEBREW_NO_AUTO_UPDATE: 1
-
-      - name: Set cross-compile env for x86_64 macOS
-        if: matrix.target == 'x86_64-apple-darwin'
-        run: |
-          echo "OPUS_NO_PKG_CONFIG=1" >> $GITHUB_ENV
-          echo "CMAKE_POLICY_VERSION_MINIMUM=3.5" >> $GITHUB_ENV
+      # `cmake`, `opus`, `pkg-config`, and the `OPUS_NO_PKG_CONFIG` /
+      # `CMAKE_POLICY_VERSION_MINIMUM` env vars used to be installed here to
+      # support an opus cross-compile that no longer exists. Cargo.toml only
+      # enables `rodio` with `features = ["wav"]`, cpal needs neither cmake
+      # nor opus, and `grep opus Cargo.lock` returns zero matches. The
+      # ~30-60s of brew time per macOS run that this saves is non-trivial.
 
       - name: Install frontend dependencies
         run: npm ci
@@ -104,7 +151,19 @@ jobs:
         working-directory: src-tauri
         run: cargo test --lib
 
-      # Windows certificate import
+      # Windows certificate import + thumbprint wire-through.
+      #
+      # Before this step, the certificate was imported into the runner's
+      # CurrentUser cert store but tauri.conf.json carried
+      # `"certificateThumbprint": null`, so the Tauri Windows bundler never
+      # invoked signtool. The NSIS .exe and MSI shipped UNSIGNED — every
+      # SmartScreen prompt showed "Unknown publisher" and the certificate
+      # was effectively unused.
+      #
+      # Now: extract the thumbprint from the imported .pfx and rewrite the
+      # null field in tauri.conf.json before the build runs. We rewrite the
+      # file (rather than passing via env) because tauri-action does not
+      # forward the env var into the bundler config at build time.
       - name: Import Windows Certificate
         if: matrix.platform == 'windows-latest' && env.WINDOWS_CERTIFICATE != ''
         env:
@@ -114,7 +173,15 @@ jobs:
           New-Item -ItemType directory -Path certificate
           Set-Content -Path certificate/tempCert.txt -Value $env:WINDOWS_CERTIFICATE
           certutil -decode certificate/tempCert.txt certificate/certificate.pfx
-          Import-PfxCertificate -FilePath certificate/certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)
+          $pwd = ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText
+          Import-PfxCertificate -FilePath certificate/certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password $pwd
+          # Read the thumbprint back from the .pfx and inject it into the
+          # Tauri config so the bundler actually invokes signtool.
+          $thumb = (Get-PfxCertificate -FilePath certificate/certificate.pfx).Thumbprint
+          Write-Host "Windows certificate thumbprint: $thumb"
+          $conf = Get-Content src-tauri/tauri.conf.json -Raw
+          $conf = $conf -replace '"certificateThumbprint":\s*null', "`"certificateThumbprint`": `"$thumb`""
+          Set-Content -Path src-tauri/tauri.conf.json -Value $conf -NoNewline
 
       # Apple Developer ID certificate import — MANDATORY for release tags.
       # Releases must be signed and notarized; we fail loudly if the secret is
@@ -288,10 +355,23 @@ jobs:
             || sentry-cli debug-files upload \
               --include-sources \
               "src-tauri/target/release/"
-          # TODO: JS source map upload to be added later. With @sentry/react
-          # now wired on the frontend, JS stack traces from the Vite bundle
-          # will arrive minified until we run `sentry-cli sourcemaps upload`
-          # against `dist/` on the same release tag (package.json version).
+
+          # JS sourcemaps: vite.config.ts emits .map sidecars alongside the
+          # bundled JS via `build.sourcemap: "hidden"` (no sourceMappingURL
+          # comment, so end-user devtools don't see them). We upload the maps
+          # to Sentry keyed by the package.json version so server-side
+          # symbolication resolves minified frames in @sentry/react events.
+          #
+          # Only run once per release (macOS arm64) to avoid uploading the
+          # same artifacts three times across the matrix.
+          if [[ "${{ matrix.target }}" == "aarch64-apple-darwin" ]] && [ -d dist ]; then
+            REL_VERSION=$(node -p "require('./package.json').version")
+            echo "Uploading JS sourcemaps for release $REL_VERSION"
+            sentry-cli sourcemaps inject ./dist || true
+            sentry-cli sourcemaps upload \
+              --release "$REL_VERSION" \
+              ./dist || true
+          fi
 
       # Upload a stable-named alias so /releases/latest/download/<stable> works
       # without the consumer having to know the version. Versioned originals
@@ -374,11 +454,19 @@ jobs:
         id: beta-check
         shell: bash
         run: |
+          # MUST stay in sync with the regex in the build job at the top of
+          # this file. Without that, a numeric-pre-release tag like
+          # `v3.1.0-1` would be classified differently between the two jobs
+          # — the build job builds a beta but the publish job tries to mark
+          # the release as latest, hitting HTTP 422 from GitHub.
           TAG="${{ github.ref_name }}"
-          if [[ "$TAG" =~ -beta\.[0-9]+$ ]]; then
+          if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "is_beta=false" >> "$GITHUB_OUTPUT"
+          elif [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-[0-9]+$ ]] || [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+$ ]]; then
             echo "is_beta=true" >> "$GITHUB_OUTPUT"
           else
-            echo "is_beta=false" >> "$GITHUB_OUTPUT"
+            echo "::error::Tag $TAG has an unrecognised format. Use vX.Y.Z (stable) or vX.Y.Z-N (numeric beta)."
+            exit 1
           fi
 
       - name: Publish latest-beta.json (stable tag)
@@ -434,6 +522,33 @@ jobs:
           gh release upload "$STABLE_TAG" _channel/latest-beta.json \
             --clobber --repo "${{ github.repository }}"
 
+      # Release notes. Every release used to say only "See the assets below
+      # for downloadable installers." The app already carries a What's New
+      # note per version (whatsNew.notes in en.json); the release page now
+      # says the same thing. Stable tags only, and never fatal: a version
+      # without a note keeps the default body.
+      - name: Checkout release-notes source
+        if: steps.beta-check.outputs.is_beta == 'false'
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          sparse-checkout: |
+            scripts/release_notes.py
+            src/i18n/locales/en.json
+          sparse-checkout-cone-mode: false
+
+      - name: Write release notes from the What's New note
+        if: steps.beta-check.outputs.is_beta == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          TAG="${{ github.ref_name }}"
+          if python3 scripts/release_notes.py "${TAG#v}" > notes.md; then
+            gh release edit "$TAG" --notes-file notes.md --repo "${{ github.repository }}"
+          else
+            echo "::warning::No What's New note for ${TAG#v}; keeping the default release body."
+          fi
+
       # Flip the GitHub Release from draft to published. The release-matrix job
       # creates it as a draft on purpose (so tauri-action's per-platform retry
       # attempts are idempotent against the same draft), and historically there
@@ -449,10 +564,15 @@ jobs:
         run: |
           set -e
           if [ "${{ steps.beta-check.outputs.is_beta }}" = "true" ]; then
-            # Beta tag: publish but stay prerelease and do NOT mark as latest,
-            # so stable-channel users keep pointing at the most recent stable.
+            # Beta tag: publish but stay prerelease and EXPLICITLY do NOT mark
+            # as latest, so stable-channel users keep pointing at the most
+            # recent stable. We pass `--latest=false` explicitly because
+            # without it gh inherits whatever flag the release was created
+            # with (tauri-action's default leaves it ambiguous), and GitHub
+            # then rejects the prerelease flag with HTTP 422
+            # ("Latest release cannot be draft or prerelease.").
             gh release edit "${{ github.ref_name }}" \
-              --draft=false --prerelease \
+              --draft=false --prerelease --latest=false \
               --repo "${{ github.repository }}"
           else
             # Stable tag: publish and explicitly mark as latest so

.gitignore

@@ -26,3 +26,32 @@ dist-ssr
 .planning/
 .claude/
 assets-export/
+
+# Finder / editor auto-duplicates. macOS Finder creates "<name> 2.<ext>"
+# when paste-copying into a directory that already has the same name;
+# editor crashes can leave "<name>.<ext>.tmp.<pid>.<hex>" files behind.
+# These have shadowed a real workflow file in CI before (a stale
+# "build 2.yml" with rustc 1.85.0 ran instead of build.yml's 1.90.0 pin).
+**/* 2.yml
+**/* 2.rs
+**/* 2.ts
+**/* 2.tsx
+**/*.yml.tmp.*
+**/*.rs.tmp.*
+
+# Certificats de signature (jamais versionnes)
+.dev-certs/
+
+# Builds telecharges (dmg, exe)
+builds/
+
+# Local secrets (fal.ai key for the promo video, etc.)
+.env
+.env.*
+
+# Promo video working files (Remotion project, voice takes, renders)
+promo/
+
+# Python bytecode
+__pycache__/
+*.pyc