arch-audit v0.6.x — checkpoint: Batches F→J landed

.github/workflows/ci.yml

@@ -27,19 +27,46 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2
 
-      - uses: taiki-e/install-action@just
-
       # WHY: `just ci` runs `cargo deny check`, `typos`, and
       # `cargo nextest run`. All three are external binaries — none ship
       # with the Rust toolchain. Using taiki-e/install-action fetches
       # prebuilt binaries (seconds) rather than `cargo install` (minutes),
       # which matters on the 3-OS matrix. Nextest swap landed in commit
-      # adopting `cargo nextest run` workspace-wide (closes #121) — the
-      # SQLite lock-order inversion that `cargo test` reproduces ~20% is
-      # documented in CLAUDE.md + GH #131.
-      - uses: taiki-e/install-action@cargo-deny
-      - uses: taiki-e/install-action@typos
-      - uses: taiki-e/install-action@cargo-nextest
+      # adopting `cargo nextest run` workspace-wide (closes #121).
+      #
+      # WHY split Windows from Linux/macOS: taiki-e/install-action's
+      # PowerShell wrapper aborts on windows-latest when the runner image
+      # leaks BASH_FUNC_* env vars (Shellshock mitigation correctly
+      # rejects them; their 10-iter retry doesn't catch it; manual reruns
+      # don't help — see issue #137 for full analysis + reproduction).
+      # cargo-binstall fetches the same prebuilt release binaries without
+      # going through bash, sidestepping the env leak entirely.
+      - name: Install just (Linux/macOS)
+        if: runner.os != 'Windows'
+        uses: taiki-e/install-action@just
+      - name: Install cargo-deny (Linux/macOS)
+        if: runner.os != 'Windows'
+        uses: taiki-e/install-action@cargo-deny
+      - name: Install typos (Linux/macOS)
+        if: runner.os != 'Windows'
+        uses: taiki-e/install-action@typos
+      - name: Install cargo-nextest (Linux/macOS)
+        if: runner.os != 'Windows'
+        uses: taiki-e/install-action@cargo-nextest
+
+      # WHY cargo-binstall on Windows only — workaround for #137. binstall
+      # is a prebuilt-binary fetcher; doesn't invoke bash so the windows-
+      # latest BASH_FUNC_* leak doesn't apply. Self-install is one zip
+      # extract; per-tool install is ~5s. If the runner image fix lands
+      # upstream, revert this step + drop the `if: runner.os != 'Windows'`
+      # gates above and verify 5+ consecutive Windows runs stay green.
+      - name: Install just/cargo-deny/typos/cargo-nextest (Windows via cargo-binstall — workaround #137)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          Invoke-WebRequest -Uri "https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-pc-windows-msvc.zip" -OutFile binstall.zip
+          Expand-Archive binstall.zip -DestinationPath "$env:USERPROFILE\.cargo\bin" -Force
+          cargo binstall --no-confirm --locked just cargo-deny typos-cli cargo-nextest
 
       - uses: actions/setup-node@v4
         with:

Cargo.toml

@@ -59,6 +59,7 @@ thiserror    = "2"
 serde        = { version = "1", features = ["derive"] }
 serde_json   = "1"
 tracing      = "0.1"
+tracing-appender   = "0.2"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 tokio        = { version = "1", features = ["full"] }
 tokio-util   = { version = "0.7", features = ["rt"] }
@@ -98,6 +99,7 @@ image        = "0.25"
 nom-exif     = "2.7"
 mp4parse     = "0.17"
 mime_guess   = "2"
+minijinja    = { version = "2", default-features = false, features = ["macros", "loader"] }
 
 [profile.release]
 lto = "thin"

apps/desktop/package.json

@@ -6,7 +6,7 @@
   "packageManager": "bun@1.3.11",
   "scripts": {
     "dev": "vite",
-    "build": "tsc -b && vite build",
+    "build": "tsc -b tsconfig.app.json && vite build",
     "test": "vitest run",
     "lint": "eslint src/ --max-warnings 0",
     "preview": "vite preview",
@@ -16,11 +16,14 @@
     "node": ">=20.19 <21 || >=22.12"
   },
   "dependencies": {
+    "@tanstack/react-query": "^5",
+    "@tanstack/react-router": "^1",
     "@tauri-apps/api": "^2",
     "@tauri-apps/plugin-dialog": "^2",
     "neverthrow": "^8",
     "react": "^19",
-    "react-dom": "^19"
+    "react-dom": "^19",
+    "zustand": "^5"
   },
   "devDependencies": {
     "@evilmartians/lefthook": "^2.1.6",