fix(app): harden release contracts across shell, queue, and engine boundaries

- Shell & UI: restore focus on sidebar reveal, guard window drag regions, contain context menu Escape keys, and fallback gracefully when a filtered queue is deleted.
- Download table: fix sort order for estimated sizes, descending null values, 3-state sort cycle, and desktop keyboard row navigation.
- Add window: harden duplicate resolution against unmanaged disk targets, draft id keying, and media credential isolation.
- Properties window: add individual Torrent file path copy, horizontal scroll protection for narrow and RTL layouts, and strict numeric bounds on property edits.
- Settings & scheduler: add draft buffering for integer inputs, sanitize persisted scheduler options, synchronize post-queue action countdown cancellation, and localize token regeneration.
- Engine & backend: isolate loopback JSON-RPC from environment proxies with no_proxy, normalize media cookie sources, dispatch container formats case-insensitively, and preserve snake_case arguments in torrent Tauri commands.
- Verification & packaging: isolate Companion git tag resolution from sandboxed git configs, and add regression tests for workflow normalization and portable packaging.

scripts/release-workflow.node-test.js

@@ -23,3 +23,19 @@ test('macOS release verification uses the app mounted from the final DMG', () =>
   assert.match(releaseWorkflow, /node scripts\/verify-binaries\.js --search-root "\$APP"/);
   assert.doesNotMatch(releaseWorkflow, /verify:macos-signing -- --app "\$APP" --dmg/);
 });
+
+test('release workflow normalizes all 6 distribution target artifacts', () => {
+  assert.match(releaseWorkflow, /rename_asset '\*\.dmg' "Firelink_\$\{VERSION\}_macOS-ARM64\.dmg"/);
+  assert.match(releaseWorkflow, /rename_asset '\*\.AppImage' "Firelink_\$\{VERSION\}_Linux-x64\.AppImage"/);
+  assert.match(releaseWorkflow, /rename_asset '\*\.deb' "Firelink_\$\{VERSION\}_Linux-x64\.deb"/);
+  assert.match(releaseWorkflow, /rename_asset '\*\.rpm' "Firelink_\$\{VERSION\}_Linux-x64\.rpm"/);
+  assert.match(releaseWorkflow, /rename_asset '\*\.exe' "Firelink_\$\{VERSION\}_Windows-x64-setup\.exe"/);
+  assert.match(releaseWorkflow, /rename_asset '\*\.zip' "Firelink_\$\{VERSION\}_Windows-x64-portable\.zip"/);
+});
+
+test('Windows release job packages portable ZIP with portable.flag and data cleanup', () => {
+  assert.match(releaseWorkflow, /Set-Content -Path \(Join-Path \$portableRoot 'portable\.flag'\) -Value 'portable'/);
+  assert.match(releaseWorkflow, /node scripts\/smoke-packaged-app\.js --executable \$portableExe --assert-no-visible-child-windows --assert-portable-data/);
+  assert.match(releaseWorkflow, /Remove-Item -Recurse -Force \$portableDataDir/);
+  assert.match(releaseWorkflow, /refusing to package a ZIP containing runtime data/);
+});

scripts/verify-companion-release.js

@@ -12,12 +12,20 @@ function readJson(file) {
   return JSON.parse(fs.readFileSync(file, 'utf8'));
 }
 
-function exactVersionTag(extensionRoot, expectedTag) {
+export function exactVersionTag(extensionRoot, expectedTag) {
   try {
     const tags = execFileSync(
       'git',
       ['-C', extensionRoot, 'tag', '--points-at', 'HEAD', '--list', '--', expectedTag],
-      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+      {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        env: {
+          ...process.env,
+          GIT_CONFIG_GLOBAL: process.env.GIT_CONFIG_GLOBAL || (process.platform === 'win32' ? 'NUL' : '/dev/null'),
+          GIT_CONFIG_NOSYSTEM: '1',
+        },
+      }
     )
       .split(/\r?\n/)
       .map(tag => tag.trim())

scripts/verify-companion-release.node-test.js

@@ -3,7 +3,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
-import { verifyCompanionRelease } from './verify-companion-release.js';
+import { execFileSync } from 'node:child_process';
+import { exactVersionTag, verifyCompanionRelease } from './verify-companion-release.js';
 
 function createFixture(packageVersion, manifestVersion) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-companion-release-'));
@@ -116,3 +117,26 @@ test('rejects a Companion tag for another version', () => {
     fs.rmSync(root, { recursive: true, force: true });
   }
 });
+
+test('exactVersionTag resolves tag on HEAD with isolated git environment', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'firelink-git-test-'));
+  try {
+    const gitEnv = {
+      ...process.env,
+      GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null',
+      GIT_CONFIG_NOSYSTEM: '1',
+      GIT_AUTHOR_NAME: 'Test',
+      GIT_AUTHOR_EMAIL: 'test@example.com',
+      GIT_COMMITTER_NAME: 'Test',
+      GIT_COMMITTER_EMAIL: 'test@example.com',
+    };
+    execFileSync('git', ['init', root], { env: gitEnv, stdio: 'ignore' });
+    execFileSync('git', ['-C', root, 'commit', '--allow-empty', '-m', 'test'], { env: gitEnv, stdio: 'ignore' });
+    execFileSync('git', ['-C', root, 'tag', 'v2.0.7'], { env: gitEnv, stdio: 'ignore' });
+
+    assert.equal(exactVersionTag(root, 'v2.0.7'), 'v2.0.7');
+    assert.equal(exactVersionTag(root, 'v2.0.8'), null);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});