chore(release): prepare v0.3.6 - market-readiness pass

- Privacy: remove agent_debug_log + hardcoded host-side path from sftp.rs
  so SFTP debugging no longer writes hostnames, IPs, or key fingerprints
  to disk.
- Security: restrictive CSP in tauri.conf.json (default-src 'self', IPC +
  ws/wss for terminals and the Proxmox WebSocket proxy); SECURITY.md
  updated.
- CI: extend ci.yml with tsc + Vitest, cargo check + cargo test, and
  advisory cargo fmt / clippy jobs alongside the existing Playwright job.
- Robustness: replace unwrap()/expect() in mutex paths with graceful
  recovery in sftp_transfer_ops.rs and proxmux_ws_proxy.rs.
- Tests: add unit-test coverage for sftp.rs (host-key candidates, path
  normalization, error classification), sftp_transfer_ops.rs (handle
  registration / release), session.rs (SSH path / known-hosts helpers),
  license.rs (server-token round-trip + tamper detection), and the
  license-server crate (token signing + entitlement parsing).
- Performance: wrap TerminalPane in React.memo; extract
  useSettingsModalDrag hook from App.tsx; document hot paths and the
  SFTP measurement plan in docs/performance.md.
- Release plumbing: opt-in macOS code signing + notarization and
  Windows code signing wired into release.yml; docs/releases.md lists
  the required GitHub secrets.
- Store packaging: AppStream metainfo refreshed to Flathub validation
  level (description, screenshots, categories, keywords, release
  history); new docs/store-packaging.md documents the GitHub / AUR /
  Flathub / MS Store / Snap channels.
- Version bump: 0.3.6 across package.json, package-lock.json,
  Cargo.toml, tauri.conf.json, AUR PKGBUILD, and the AppStream
  <releases> block; CHANGELOG and README/releases.md tag examples
  updated.

Author: d0dg3r

.github/ISSUE_TEMPLATE/bug_report.md

@@ -6,7 +6,7 @@ labels: bug
 
 ## Environment
 
-- NoSuckShell version (or commit), e.g. `0.3.6-beta.1` or `git rev-parse HEAD`:
+- NoSuckShell version (or commit), e.g. `0.3.6` or `git rev-parse HEAD`:
 - OS / distro (e.g. CachyOS, macOS 14, Windows 11):
 - If Linux WebKit issues: Wayland sessions set `WEBKIT_DISABLE_DMABUF_RENDERER` by default when unset; did you try setting or unsetting it explicitly? (yes/no / N/A)
 

.github/workflows/ci.yml

@@ -17,6 +17,116 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  desktop-frontend:
+    name: Desktop frontend (typecheck + unit tests)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: apps/desktop/package-lock.json
+
+      - name: Install desktop dependencies
+        run: npm run desktop:install
+
+      - name: TypeScript build (tsc + vite build)
+        working-directory: apps/desktop
+        run: npm run build
+
+      - name: Vitest unit tests
+        working-directory: apps/desktop
+        run: npm test
+
+  desktop-rust:
+    name: Desktop backend (cargo check + cargo test)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Linux dependencies
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf
+
+      - name: Cache Cargo registry and target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            apps/desktop/src-tauri/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: cargo check
+        working-directory: apps/desktop/src-tauri
+        run: cargo check --all-targets
+
+      - name: cargo test
+        working-directory: apps/desktop/src-tauri
+        run: cargo test
+
+  desktop-rust-quality:
+    name: Desktop backend (rustfmt + clippy, advisory)
+    runs-on: ubuntu-latest
+    # Advisory until the rust-error-audit cleanup lands; the job runs but does not block merges.
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Install Linux dependencies
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf
+
+      - name: Cache Cargo registry and target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            apps/desktop/src-tauri/target
+          key: ${{ runner.os }}-cargo-quality-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-quality-
+            ${{ runner.os }}-cargo-
+
+      - name: cargo fmt --check
+        working-directory: apps/desktop/src-tauri
+        run: cargo fmt --all --check
+
+      - name: cargo clippy
+        working-directory: apps/desktop/src-tauri
+        run: cargo clippy --all-targets
+
   desktop-e2e:
     name: Desktop E2E (Playwright)
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -263,13 +263,62 @@ jobs:
         working-directory: apps/desktop
         run: npx @tauri-apps/cli icon src-tauri/icons/icon-source-square.png --output src-tauri/icons
 
+      # Import Apple Developer ID certificate into a temporary keychain (macOS only).
+      # Requires repository secrets:
+      #   - APPLE_CERTIFICATE          base64-encoded `.p12` of the Developer ID Application cert
+      #   - APPLE_CERTIFICATE_PASSWORD password used when exporting the .p12
+      #   - APPLE_SIGNING_IDENTITY     full identity string, e.g. "Developer ID Application: Name (TEAMID)"
+      # Skipped (warns only) when secrets are missing so non-official forks can still build.
+      - name: Import Apple signing certificate
+        if: matrix.artifact_name == 'macos'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
+            echo "::warning::APPLE_CERTIFICATE secret is unset — skipping macOS code signing."
+            exit 0
+          fi
+          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
+          KEYCHAIN_PASSWORD="$(uuidgen)"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          echo "$APPLE_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/cert.p12"
+          security import "$RUNNER_TEMP/cert.p12" \
+            -k "$KEYCHAIN_PATH" \
+            -P "$APPLE_CERTIFICATE_PASSWORD" \
+            -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
+          security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')
+
       # Embeds production Ed25519 verify key at compile time (see license.rs `option_env!`).
       # Repository secret: 64 hex chars (32-byte public key), same as desktop `NOSUCKSHELL_LICENSE_PUBKEY_HEX`.
       # If unset, binaries fall back to the public dev key (fine for forks; official releases should set the secret).
+      #
+      # Code signing / notarization secrets that Tauri reads automatically when present:
+      #   macOS    APPLE_SIGNING_IDENTITY              Developer ID Application identity string
+      #   macOS    APPLE_ID + APPLE_PASSWORD           App-Store-Connect account + app-specific password
+      #   macOS    APPLE_TEAM_ID                       Apple Developer team ID (e.g. ABCDE12345)
+      #   macOS    APPLE_API_KEY/...PATH/...ISSUER     Alternative to APPLE_ID for App-Store-Connect API
+      #   Windows  TAURI_WINDOWS_SIGN_COMMAND          Full sign command (e.g. AzureSignTool / signtool)
+      #
+      # All are optional. Tauri skips signing/notarization cleanly when the matching variables are unset
+      # (warns in the build log) so this workflow keeps producing usable binaries before certs land.
       - name: Build Tauri app bundles
         working-directory: apps/desktop
         env:
           NOSUCKSHELL_LICENSE_PUBKEY_HEX: ${{ secrets.NOSUCKSHELL_LICENSE_PUBKEY_HEX }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_PATH: ${{ secrets.APPLE_API_KEY_PATH }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          TAURI_WINDOWS_SIGN_COMMAND: ${{ secrets.TAURI_WINDOWS_SIGN_COMMAND }}
         run: npm run tauri:build
 
       - name: Post-process Linux AppImage (strip bundled libpcre2-8)

README.md

@@ -188,10 +188,10 @@ Details: [docs/backup-security.md](docs/backup-security.md)
 
 GitHub releases are created by pushing a SemVer tag. Full checklist: [docs/releases.md](docs/releases.md). User-facing history: [docs/CHANGELOG.md](docs/CHANGELOG.md).
 
-- Final: `vMAJOR.MINOR.PATCH` (example: `v0.2.1`, `v1.2.3`)
-- Pre-release: `vMAJOR.MINOR.PATCH-<suffix>` (example: `v0.3.6-beta.1`, `v1.2.4-rc.1`)
+- Final: `vMAJOR.MINOR.PATCH` (example: `v0.3.6`, `v1.2.3`)
+- Pre-release: `vMAJOR.MINOR.PATCH-<suffix>` (example: `v0.3.7-beta.1`, `v1.2.4-rc.1`)
 
-**Current pre-release:** [`v0.3.6-beta.1`](https://github.com/d0dg3r/NoSuckShell/releases/tag/v0.3.6-beta.1) — Linux terminal input latency improvements (see [CHANGELOG](docs/CHANGELOG.md)).
+**Current stable:** [`v0.3.6`](https://github.com/d0dg3r/NoSuckShell/releases/tag/v0.3.6) — first store-ready cut of the `0.3.x` line (see [CHANGELOG](docs/CHANGELOG.md)).
 
 **Before tagging**, use the same version string in:
 
@@ -202,8 +202,8 @@ GitHub releases are created by pushing a SemVer tag. Full checklist: [docs/relea
 The [release workflow](.github/workflows/release.yml) still overwrites those files from the tag at build time; keeping them aligned locally avoids drift while developing.
 
 ```bash
-git tag v0.2.1
-git push origin v0.2.1
+git tag v0.3.6
+git push origin v0.3.6
 ```
 
 If the workflow rejects the tag, use `vMAJOR.MINOR.PATCH` or `vMAJOR.MINOR.PATCH-prerelease` (example: `v2.0.0` or `v2.0.0-rc.1`).

SECURITY.md

@@ -84,7 +84,7 @@ The app may process **highly sensitive** data. You should:
 
 ## Technical notes (transparency)
 
-- Tauri config currently sets **`csp: null`** for the webview — this affects **Content Security Policy** for the embedded frontend. Consult the [Tauri documentation](https://v2.tauri.app/) and the source when assessing impact.
+- The Tauri webview enforces a **Content Security Policy** (see `app.security.csp` in [`apps/desktop/src-tauri/tauri.conf.json`](apps/desktop/src-tauri/tauri.conf.json)). It blocks inline scripts, restricts `object-src` to `'none'`, and limits `base-uri`/`form-action` to `'self'`. It still allows arbitrary `https:`/`http:` for `frame-src`/`img-src`/`connect-src` because the app embeds Proxmox Web UIs and connects to user-configured Proxmox WebSocket consoles (often via self-signed TLS). React's inline `style={{...}}` props require `style-src 'unsafe-inline'`. Tightening these to the minimum set per session is tracked as a follow-up.
 - **Dependencies** (Rust, npm) have their own security posture; staying current and running `cargo audit` / `npm audit` is part of responsible use.
 
 ---

apps/desktop/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "desktop",
-  "version": "0.3.6-beta.1",
+  "version": "0.3.6",
   "description": "Cross-platform SSH manager desktop app",
   "scripts": {
     "postinstall": "patch-package",

apps/desktop/package.json

@@ -1,6 +1,6 @@
 [package]
 name = "src-tauri"
-version = "0.3.6-beta.1"
+version = "0.3.6"
 edition = "2024"
 license = "MIT"
 build = "build.rs"

apps/desktop/src-tauri/Cargo.toml

@@ -290,4 +290,75 @@ mod tests {
         assert_eq!(mode, "fused_first_last");
         assert_eq!(n, "aaaa.dddd");
     }
+
+    /// End-to-end: build the same `base64url(payload).base64url(sig)` token format the
+    /// `services/license-server` emits and confirm the desktop's verifier accepts it. Catches
+    /// drift between the server and desktop `LicensePayload` serialization (field order,
+    /// `serde(rename_all)`, `skip_serializing_if`).
+    #[test]
+    fn end_to_end_server_token_format_verifies_on_desktop() {
+        use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+        use base64::Engine;
+
+        let sk = SigningKey::from_bytes(&DEV_LICENSE_SEED);
+        let payload = LicensePayload {
+            v: 1,
+            license_id: "e2e-1".into(),
+            entitlements: vec![
+                "dev.nosuckshell.tier.demo".into(),
+                "dev.nosuckshell.plugin.proxmux".into(),
+            ],
+            iat: now_unix(),
+            exp: None,
+        };
+
+        // Server side: sign UTF-8 JSON of the payload, encode payload + signature as base64url.
+        let json = serde_json::to_string(&payload).expect("serialize payload");
+        let sig = sk.sign(json.as_bytes());
+        let token = format!(
+            "{}.{}",
+            URL_SAFE_NO_PAD.encode(json.as_bytes()),
+            URL_SAFE_NO_PAD.encode(sig.to_bytes()),
+        );
+
+        // Desktop side: split, decode, parse, hex-encode signature, and verify.
+        let (payload_b64, sig_b64) = token.split_once('.').expect("token has two parts");
+        let decoded_payload = URL_SAFE_NO_PAD
+            .decode(payload_b64.as_bytes())
+            .expect("payload base64url decodes");
+        let decoded_sig = URL_SAFE_NO_PAD
+            .decode(sig_b64.as_bytes())
+            .expect("signature base64url decodes");
+        assert_eq!(
+            decoded_sig.len(),
+            64,
+            "Ed25519 signature must be exactly 64 bytes"
+        );
+        let parsed: LicensePayload =
+            serde_json::from_slice(&decoded_payload).expect("payload JSON parses");
+        assert_eq!(parsed, payload, "round-trip payload must equal source");
+
+        verify_payload(&parsed, &hex::encode(&decoded_sig)).expect("signature must verify");
+    }
+
+    #[test]
+    fn rejects_tampered_payload_with_valid_signature() {
+        let sk = SigningKey::from_bytes(&DEV_LICENSE_SEED);
+        let original = LicensePayload {
+            v: 1,
+            license_id: "tamper-1".into(),
+            entitlements: vec!["dev.nosuckshell.tier.demo".into()],
+            iat: now_unix(),
+            exp: None,
+        };
+        let msg = license_message(&original).unwrap();
+        let sig_hex = hex::encode(sk.sign(msg.as_bytes()).to_bytes());
+
+        // Adding an extra entitlement after signing must fail verification.
+        let mut tampered = original;
+        tampered
+            .entitlements
+            .push("dev.nosuckshell.plugin.proxmux".into());
+        assert!(verify_payload(&tampered, &sig_hex).is_err());
+    }
 }

apps/desktop/src-tauri/src/license.rs

@@ -111,7 +111,12 @@ async fn proxy_one_browser_connection(
             let err = http::Response::builder()
                 .status(http::StatusCode::FORBIDDEN)
                 .body(Some("Forbidden: invalid proxy token".to_string()))
-                .expect("response");
+                .unwrap_or_else(|_| {
+                    // The body above is a static String; this branch is unreachable in practice.
+                    let mut fallback = http::Response::new(None);
+                    *fallback.status_mut() = http::StatusCode::FORBIDDEN;
+                    fallback
+                });
             return Err(err);
         }
         Ok(response)
@@ -232,7 +237,9 @@ pub async fn proxmux_ws_proxy_start(
                         auth,
                         cookie,
                     ));
-                    let mut guard = conn_handles_for_loop.lock().expect("conn handles lock");
+                    let mut guard = conn_handles_for_loop
+                        .lock()
+                        .unwrap_or_else(|e| e.into_inner());
                     guard.retain(|h| !h.is_finished());
                     guard.push(conn_handle);
                 }
@@ -246,7 +253,7 @@ pub async fn proxmux_ws_proxy_start(
 
     proxy_tasks()
         .lock()
-        .expect("proxy map lock")
+        .unwrap_or_else(|e| e.into_inner())
         .insert(proxy_id.clone(), ProxyEntry { accept_loop, conn_handles });
 
     Ok(ProxmuxWsProxyStartResult {
@@ -261,9 +268,18 @@ pub fn proxmux_ws_proxy_stop(proxy_id: String) -> Result<(), String> {
     if id.is_empty() {
         return Err("proxyId is required".to_string());
     }
-    if let Some(entry) = proxy_tasks().lock().expect("proxy map lock").remove(&id) {
+    let removed = proxy_tasks()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .remove(&id);
+    if let Some(entry) = removed {
         entry.accept_loop.abort();
-        for h in entry.conn_handles.lock().expect("conn handles lock").drain(..) {
+        for h in entry
+            .conn_handles
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .drain(..)
+        {
             h.abort();
         }
     }