[Local|Release] Release desktop 2.2.2

.agents/skills/frontend-workflow/base-ui.md

@@ -15,6 +15,16 @@ These are the rules that compile fine and still break. Check
 - A link styled as a button is a real `<a>` with `buttonVariants(...)`. Base
   UI's `Button` gives whatever it renders `role="button"`.
 
+## Buttons
+
+- Every button is `Button` from `components/ui/button.tsx`; ESLint rejects a raw
+  `<button>`. An element with its own layout (a card, a stretched row link, a
+  flip surface) is `variant="bare"`: the focus ring and transition, no looks.
+- Press feedback lives only in `Button`: a 0.95 scale on every button, popup
+  triggers included, in 150ms and back over 250ms on a no-overshoot curve. A
+  wide button or a row passes `static` and presses by colour instead. No
+  `active:` scale or translate in a className; ESLint rejects that too.
+
 ## Menus
 
 - Items act on `onClick`. `onSelect` still typechecks (it is a DOM prop) and
@@ -46,6 +56,11 @@ These are the rules that compile fine and still break. Check
   its state in a store (see `features/egress/ask-egress.ts`).
 - A nested dialog renders no backdrop. The parent dims and shrinks through
   `data-nested-dialog-open` and `--nested-dialogs`, already in the wrappers.
+- Popups carry no `z-index`. `#root` has `isolation: isolate` (Base UI's
+  setup), so portals sit above the app and stack by the order they opened:
+  a nested dialog's own click blocker then covers its parent. A `z-index` on a
+  popup lifts it above that blocker and leaves the parent clickable. The
+  toaster portals to `<body>`, outside `#root`, to stay above dialogs.
 - A popup inside a modal dialog (the combobox, through `container`) portals
   into a host element within the dialog, which hides everything outside itself from
   assistive technology.

.agents/skills/frontend-workflow/color/PALETTE.css

@@ -17,7 +17,7 @@
   --spacing: 0.25rem;
   --font-mono: "IBM Plex Mono", monospace;
   --font-sans: "Instrument Sans", sans-serif;
-  --secondary: #f1f0ec;
+  --secondary: #e8e7e2;
   --background: #f7f6f2;
   --app-shell: #f3f2ee;
   --font-brand: "Fraunces", serif;
@@ -67,7 +67,7 @@
   --spacing: 0.25rem;
   --font-mono: "IBM Plex Mono", monospace;
   --font-sans: "Instrument Sans", sans-serif;
-  --secondary: #222222;
+  --secondary: #2f2f2f;
   --background: #141414;
   --app-shell: #101010;
   --font-brand: "Fraunces", serif;

.agents/skills/translate/glossary.md

@@ -41,6 +41,10 @@ SurfSense, Studio, Markdown, llama.cpp, GGUF, Hugging Face, API, MCP, and every
 | study guide | 学習ガイド | 학습 가이드 | 学习指南 | स्टडी गाइड | Lernzettel † | guía de estudio | Guide de révision | Guia de estudos | конспект |
 | podcast | ポッドキャスト | 팟캐스트 | 播客 | पॉडकास्ट | Podcast | podcast | Podcast | Podcast | подкаст |
 | speech (a model reading text aloud) | 音声合成 | 음성 | 语音 | वॉइस | Sprache | voz | voix | voz | речь |
+| speech recognition (turning recordings and the voice into text, on this computer) | 音声認識 | 음성 인식 | 语音识别 | स्पीच रिकग्निशन | Spracherkennung | reconocimiento de voz | reconnaissance vocale | reconhecimento de voz | распознавание речи |
+| voice input (dictating into the chat composer) | 音声入力 | 음성 입력 | 语音输入 | वॉइस इनपुट | Spracheingabe | entrada de voz | saisie vocale | entrada de voz | голосовой ввод |
+| transcript (a recording’s text) | 文字起こし | 스크립트 | 文字稿 | ट्रांसक्रिप्ट | Transkript | transcripción | transcription | transcrição | расшифровка |
+| recording (an audio file added as a source) | 録音 | 녹음 | 录音 | रिकॉर्डिंग | Aufnahme | grabación | enregistrement | gravação | запись |
 | sidebar (the workspace’s left column) | サイドバー | 사이드바 | 侧边栏 | साइडबार | Seitenleiste | barra lateral | barre latérale | barra lateral | боковая панель |
 | workspace | ワークスペース | 워크스페이스 | 工作区 | वर्कस्पेस | Workspace | espacio de trabajo | espace de travail | Workspace | рабочая область |
 | artifact (a Studio output) | 生成物 | 생성물 | 产物 | आर्टिफ़ैक्ट | Artefakt | artefacto | artefact | artefato | артефакт |

.github/ISSUE_TEMPLATE/bug.yml

@@ -9,6 +9,7 @@ body:
       label: Which part?
       options:
         - Desktop app
+        - Plugins
         - MCP
         - Backend / scraper API
         - Web UI

.github/ISSUE_TEMPLATE/feature.yml

@@ -9,6 +9,7 @@ body:
       label: Which part?
       options:
         - Desktop app
+        - Plugins
         - MCP
         - Backend / scraper API
         - Web UI

.github/ISSUE_TEMPLATE/plugin-report.yml

@@ -0,0 +1,57 @@
+name: Report a plugin
+description: A plugin in Settings → Plugins is broken, misleading or unsafe
+title: "[plugin] "
+labels: [plugins]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for telling us. A maintainer looks at every report, and a third-party plugin that breaks the rules can be removed from the list for everyone.
+
+        **A security problem, such as a plugin taking data it should not?** Please report it privately through a [security advisory](https://github.com/MODSetter/SurfSense/security/advisories/new), not here.
+  - type: input
+    id: plugin
+    attributes:
+      label: Which plugin?
+      description: Its name as Settings → Plugins shows it.
+      placeholder: DeepWiki
+    validations:
+      required: true
+  - type: dropdown
+    id: problem
+    attributes:
+      label: What is wrong?
+      options:
+        - It does not work or cannot be reached
+        - Its tools do something other than they say
+        - A tool's description tells the AI what to do
+        - It sends or keeps more of my data than it should
+        - Its listing is wrong (who runs it, its links, its privacy policy)
+        - Something else
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: What you asked, which tool ran, and what it did.
+    validations:
+      required: true
+  - type: input
+    id: when
+    attributes:
+      label: When?
+      description: Roughly when it happened, and your SurfSense version if you know it.
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: In the desktop app, Report issue copies this session's log to your clipboard. Paste it here, and remove anything you would rather not share.
+      render: text
+  - type: checkboxes
+    id: no-secrets
+    attributes:
+      label: Before you send
+      options:
+        - label: I removed every key, token and password from this report.
+          required: true

.github/workflows/build-audiocpp.yml

@@ -1,8 +1,9 @@
 # Compile audio.cpp's server for Windows and Linux with the recipe in
 # surfsense_local/electron/scripts/audiocpp/, check it against the app's
 # floors, and hand the staged folder to the desktop release as an artifact.
-# A pull request that changes the recipe, or the app code that drives the
-# server, runs it too.
+# Check that upstream's macOS archive, which the release ships as it is, has
+# every curated family too. A pull request that changes the recipe, or the
+# app code that drives the server, runs it too.
 #
 # TODO: ask upstream (0xShug0/audio.cpp) to publish Linux archives built on
 # Ubuntu 22.04 and Windows ones with per-CPU ggml libraries, as llama.cpp does.
@@ -20,7 +21,14 @@ on:
       - surfsense_local/backend/modules/llm/providers/audiocpp/**
       - surfsense_local/backend/modules/llm/catalog/local/engines/audiocpp/**
       - surfsense_local/backend/modules/llm/catalog/local/manifest/models.json
+      - surfsense_local/backend/modules/llm/transcription/**
+      - surfsense_local/backend/worker/ingestion/audio/**
+      - surfsense_local/backend/worker/audio_decode/**
+      - surfsense_local/backend/modules/documents/recordings/**
       - surfsense_local/backend/tests/packaging/test_audiocpp_voicing.py
+      - surfsense_local/backend/tests/packaging/test_audiocpp_transcription.py
+      - surfsense_local/backend/tests/packaging/test_audiocpp_transcription_config.py
+      - surfsense_local/backend/tests/packaging/test_recording_transcription.py
       - .github/workflows/build-audiocpp.yml
 
 permissions:
@@ -71,6 +79,8 @@ jobs:
           echo "CC=gcc-13" >> "$GITHUB_ENV"
           echo "CXX=g++-13" >> "$GITHUB_ENV"
 
+      # Staging starts the server once per curated family and fails unless
+      # that family's loader runs, so a family the recipe drops never ships.
       - name: Compile and stage
         if: steps.cache.outputs.cache-hit != 'true'
         run: node scripts/audiocpp/stage.mjs --strict
@@ -139,6 +149,50 @@ jobs:
           # addopts pins -m 'not packaging'; the later -m on the command line wins.
           uv run pytest tests/packaging/test_audiocpp_voicing.py -m packaging
 
+      - id: recogniser
+        name: Read the curated recogniser's pin
+        working-directory: surfsense_local/backend
+        run: |
+          uv run python - >> "$GITHUB_OUTPUT" <<'EOF'
+          from modules.llm.catalog.local.manifest import load_local_manifest
+
+          # The gate's tests are written for Nemotron; Canary is a second recogniser.
+          (model,) = [
+              m for m in load_local_manifest().models
+              if m.id == "nemotron-3.5-asr-streaming-0.6b"
+          ]
+          pinned = model.builds[0].files[0]
+          print(f"sha256={pinned.sha256}")
+          print(f"url=https://huggingface.co/{pinned.repo}/resolve/{pinned.revision}/{pinned.path}")
+          print(f"name={pinned.path.rsplit('/', 1)[-1]}")
+          EOF
+
+      # 930 MB, so kept by its pinned hash rather than downloaded every run.
+      - uses: actions/cache@v5
+        with:
+          path: ${{ runner.temp }}/recogniser
+          key: recogniser-${{ steps.recogniser.outputs.sha256 }}
+
+      # Kokoro voices sentences in six languages and the transcription server,
+      # started as Electron's second sidecar from the transcription.json the app
+      # writes, writes them down through the app's client; then a recording goes
+      # through ingest, the API and that server. The test checks the file
+      # against the manifest's hash; Silero's check runs once it is staged.
+      - name: Gate on speech recognition through the app
+        working-directory: surfsense_local/backend
+        env:
+          SURFSENSE_TEST_AUDIOCPP_DIR: ${{ github.workspace }}/surfsense_local/electron/audiocpp
+          SURFSENSE_TEST_AUDIO_MODELS: ${{ runner.temp }}/audio-models
+          RECOGNISER: ${{ runner.temp }}/recogniser/${{ steps.recogniser.outputs.name }}
+        run: |
+          if [ ! -f "$RECOGNISER" ]; then
+            mkdir -p "$(dirname "$RECOGNISER")"
+            curl -fsSL --retry 3 -o "$RECOGNISER" "${{ steps.recogniser.outputs.url }}"
+          fi
+          cp "$RECOGNISER" "$SURFSENSE_TEST_AUDIO_MODELS/"
+          uv run scripts/fetch_silero_vad.py models
+          uv run pytest tests/packaging/test_audiocpp_transcription_config.py tests/packaging/test_audiocpp_transcription.py tests/packaging/test_recording_transcription.py -m packaging
+
       # An artifact drops symlinks and file modes; a tar keeps both.
       - name: Pack
         run: tar -cf audiocpp.tar audiocpp
@@ -148,3 +202,25 @@ jobs:
           name: audiocpp-${{ runner.os }}
           path: surfsense_local/electron/audiocpp.tar
           retention-days: 7
+
+  # macOS ships upstream's archive, which the recipe does not build, so a
+  # family added to the pin is checked against the archive itself. The release
+  # job stages it again; this only fails earlier, on the pull request.
+  macos-archive:
+    name: macOS arm64, upstream's archive
+    runs-on: macos-15
+    defaults:
+      run:
+        working-directory: surfsense_local/electron
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          package-manager-cache: false
+
+      # Downloads the pinned archive, copies each curated family's spec, which
+      # fails on one it lacks, and starts the server once per family.
+      - name: Stage and check every curated family
+        run: node scripts/audiocpp/stage.mjs --strict

.github/workflows/desktop-tests.yml

@@ -7,18 +7,23 @@ on:
   pull_request:
     branches: [main, dev]
     types: [opened, synchronize, reopened, ready_for_review]
+  # A merge that breaks dev shows here, not on the next pull request.
+  push:
+    branches: [dev]
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # A later push to dev must not cancel the run that checks the one before it.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # Filtered per job, not per workflow: a workflow skipped by its paths leaves
   # its checks pending, while a skipped job reports success.
   changes:
     name: Changes
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: github.event.pull_request.draft == false
     outputs:
       backend: ${{ steps.filter.outputs.backend }}
@@ -29,7 +34,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
 
-      # A manual run has no pull request to diff; it starts every job instead.
+      # A push or a manual run has no pull request to diff; it starts every job instead.
       - name: Filter changed paths
         id: filter
         if: github.event_name == 'pull_request'
@@ -57,10 +62,21 @@ jobs:
               - '.github/workflows/desktop-tests.yml'
 
   backend:
-    name: Backend
-    runs-on: ubuntu-latest
+    name: Backend (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
     needs: changes
-    if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.backend == 'true'
+    if: github.event_name != 'pull_request' || needs.changes.outputs.backend == 'true'
+    # Hard links, file locks, long paths and the staging rename differ by OS.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+
+    env:
+      # The runner's macOS Python cannot load SQLite extensions, which sqlite_vec
+      # needs; the release freezes with uv's own Python (release-local.yml).
+      UV_PYTHON_PREFERENCE: only-managed
 
     steps:
       - name: Checkout code
@@ -97,8 +113,9 @@ jobs:
   frontend:
     name: Frontend
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: changes
-    if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.frontend == 'true'
+    if: github.event_name != 'pull_request' || needs.changes.outputs.frontend == 'true'
 
     steps:
       - name: Checkout code
@@ -150,10 +167,15 @@ jobs:
         run: pnpm test
 
   electron:
-    name: Electron
-    runs-on: ubuntu-latest
+    name: Electron (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     needs: changes
-    if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.electron == 'true'
+    if: github.event_name != 'pull_request' || needs.changes.outputs.electron == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
 
     steps:
       - name: Checkout code
@@ -190,6 +212,7 @@ jobs:
   gate:
     name: Desktop Gate
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: [changes, backend, frontend, electron]
     if: always()
 

.github/workflows/plugins-registry.yml

@@ -2,8 +2,9 @@ name: Plugins Registry
 
 # plugins/registry/: the third-party plugin list, its icons, its check and the
 # OAuth files the registry container serves.
-# - Pull requests: check the entry rules and icons. A maintainer connects each
-#   new listing on dev and reviews its tools before it reaches main.
+# - Pull requests: check the entry rules and icons, then connect to each plugin
+#   the pull request adds or changes. A maintainer connects each new listing on
+#   dev, signing in where it needs it, and reviews its tools before it reaches main.
 # - Dev: write plugins/registry/published/, a copy of plugins.json stamped with
 #   generated_at and each icon's SHA-256, and plugins.json.sig, its signature.
 #   The release pull request from dev carries it to main, which the registry
@@ -92,6 +93,9 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          # The merge's first parent is the list this pull request is based on.
+          fetch-depth: 2
 
       - name: Setup uv
         uses: astral-sh/setup-uv@v10.2.0
@@ -120,6 +124,18 @@ jobs:
         working-directory: plugins/registry/check
         run: uv run python -m registry_check static
 
+      # Connects to each plugin the pull request adds or changes, after the entry
+      # rules refused loopback and credentials. Pull requests only: a third-party
+      # server down for a minute must never hold up signing the list.
+      - name: Connect to each new or changed plugin
+        if: github.event_name == 'pull_request'
+        working-directory: plugins/registry/check
+        run: |
+          base="$RUNNER_TEMP/base-plugins.json"
+          git show HEAD^1:plugins/registry/plugins.json > "$base" 2>/dev/null \
+            || echo '{"schema_version": 1, "plugins": []}' > "$base"
+          uv run python -m registry_check live --base "$base"
+
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with: