fix(desktop): remove synthetic browser analysis success

[seonghobae]

Production gap

BandScope had browser-only paths that could manufacture successful product state without the native runtime. This canonical branch first removed synthetic analysis jobs/results from job_runner.ts, then traced the active App.tsx execution path into apps/desktop/src/lib/analysis.ts and removed staged fake analysis success and silent browser project-save success from that canonical bridge. Current maintenance also closes two privacy boundaries in the same desktop bridge: dependency-controlled/native YouTube import errors no longer pass directly into buyer-visible UI state, and workspace-fetch failures no longer copy dependency-controlled paths/tokens/tool diagnostics into routine frontend console logs.

Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
Exact current head: e169e6b89ea913d5e9ab723695ae7b6f39810876.

Test-first repairs

Original runner boundary

• RED 261253d5910f87992dd48e7741550531e8dc9f92 requires enqueue/retry/cancel to fail closed outside Tauri and prohibits synthetic workspace updates/state.
• GREEN bddd8410108d80c81c043a8a1deb911f7e2815d1 removes the mock workspace, fake jobs, timers, demo-song construction, and browser mutation path from job_runner.ts.
• e5e1b7b2046de5e9b55d2c44140589c3c9cdb9d1 records the contract in CHANGELOG; 9aaff0e2e153d83297d0f667b7ce13e2880dc33f removes unrelated dependency drift; a9063cb1eca490010e0f6905380304afb908db40 aligns CLAUDE.md.

Active App analysis bridge correction

• Fresh source tracing proved App.tsx imports its analysis lifecycle from ./lib/analysis, not job_runner.ts.
• RED 5066f18c94fa1c3103457a3e4c427c70c089c8b8 requires browser-only startAnalysisJob to return a stable engine_unavailable failure with no result and requires subsequent status lookup not to find synthetic retained state.
• GREEN 380bac0213f80fc098ec9496a673eaa5500cea32 removes browserJobStore, staged fake progress, and demo-song success from the active bridge. Native Tauri invocation and validated native status parsing remain unchanged.
• 6a976f50f5b7dcc4609a921330f99c3017d493f9 removes the obsolete predecessor test that asserted staged fake browser success.

Project-save mutation fails closed

Fresh exact-code review found another false-success mutation in the same canonical bridge: browserFallback("save_project") returned undefined, so saveProject() reported success although no project was persisted.

• RED 038f05c422e944f94633cd4d29b8b6e9ba883e83 adds a browser-only regression requiring saveProject(createDemoRehearsalSong()) to reject instead of succeeding. Its workflow cycle was superseded before terminal execution and is not counted as RED CI proof.
• GREEN acd5d3d51e997a67a4e61879502fb849375d8721 makes the browser save_project command throw Project save requires the Tauri runtime.; native Tauri save behavior and request validation are unchanged.
• d971e35fa2302f561081e754cee448665413a981 records that boundary in CHANGELOG.md.

YouTube import dependency errors are redacted before UI state

docs/security/app-security.md requires URL/metadata trust boundaries to be schema-controlled and sensitive paths, tokens, cookies, full URLs, and native tool diagnostics to stay out of surfaced output. Exact-current source inspection found that importYoutubeUrl() caught a Tauri/dependency exception and returned its raw Error.message (or raw string) directly as buyer-visible AnalysisJobError.message.

• RED 86b2426e2f71be18ce4f245db10366f8d818ccb8 adds analysis.youtube-error-privacy.test.ts: a mocked Tauri rejection contains a YouTube video id, C:\\Users\\Alice path and token=super-secret; the required result contains only one safe next-action message and explicitly excludes all three sensitive markers.
• GREEN c58ff8c08006b426a242d377c8c60184178e9e65 introduces the stable buyer-facing YouTube import failed. Try again or choose a local audio file. message and stops propagating dependency-controlled exception text. URL allowlist validation still returns its existing precise local validation message before the bridge; native invocation behavior is otherwise unchanged.
• 52d77828f5f528e19338b45a581b8a595dcd1416 records the privacy repair in CHANGELOG.md; 66eb2d8c0916ca1eac933c661b9dcecece9471e7 restores unrelated historical CHANGELOG integrity without broadening production behavior.

Workspace-fetch diagnostics are redacted before console output

Fresh review of the same desktop bridge found that getWorkspaceState() caught a native/dependency failure and passed error.message into console.error. That made routine frontend diagnostics another path for local filesystem paths, tokens, or tool stderr to escape even though the function correctly returned null to the caller.

• RED 76a9e64efb1c4fa8e9fc144206fffadeab137652 adds a focused privacy regression that injects path/token-shaped dependency text and requires the routine console diagnostic to remain stable and payload-free.
• GREEN b722eddb1eec56ed30716e00cfdd6e269464b12a removes dependency-controlled message data from the log and emits only Failed to get workspace state. while preserving the existing null safe-failure result.
• f8112be63fb88d0fab1ba436cab96244be21a809 records the boundary in CHANGELOG.md.
• f8d23d435986d6f409a7c6879c5097a701e2ec12 keeps the regression mock hoist-safe without changing production behavior.
• Exact current head e169e6b89ea913d5e9ab723695ae7b6f39810876 additionally aligns App-level YouTube failure assertions with the same fixed-message privacy contract; it is a test-only successor of the production repair.

Exact current scope

Current protected-base diff contains ten bounded files:

• CHANGELOG.md
• CLAUDE.md
• apps/desktop/src/App.test.tsx
• apps/desktop/src/lib/analysis.browser-fail-closed.test.ts
• apps/desktop/src/lib/analysis.test.ts
• apps/desktop/src/lib/analysis.ts
• apps/desktop/src/lib/analysis.youtube-error-privacy.test.ts
• apps/desktop/src/lib/job_runner.error-privacy.test.ts
• apps/desktop/src/lib/job_runner.production.test.ts
• apps/desktop/src/lib/job_runner.ts

There is no dependency, lockfile, workflow, database, widened network authority, filesystem authority, model, new IPC command, vulnerability suppression, or reviewer-credential change.

Resulting boundary

• real analysis mutations in both desktop analysis entry paths require the native Tauri runtime;
• browser-only analysis execution cannot manufacture queued/running/succeeded state or a demo rehearsal result;
• browser-only project save cannot silently claim persistence;
• browser workspace reads return null rather than fabricated state;
• routine workspace-fetch diagnostics no longer copy raw native/dependency messages into frontend console output;
• passive browser subscriptions remain safe no-ops and never emit fabricated success events;
• dependency-controlled YouTube import exceptions cannot become buyer-visible error text; valid-but-failed imports receive one safe actionable message;
• native Tauri analysis/save/import invocation and validated response parsing remain otherwise unchanged; and
• the existing browser YouTube source-selection preview remains a separate explicit preview behavior, but it cannot produce successful analysis.

Security Notes

Attack surface

• YouTube URL intake and native/downloader/import failure text crossing Tauri → React bridge
• Workspace-state fetch diagnostics crossing the native bridge → frontend console
• Existing local analysis and project-save IPC entry points

Trust boundary

• Untrusted URL / downloader / native tool diagnostics → Tauri IPC rejection → AnalysisJobError rendered by the desktop UI
• Native/dependency workspace failure → getWorkspaceState() catch boundary → routine console diagnostic

Realistic threat

A dependency or native layer can include full source URLs, local paths/usernames, cookies/tokens, command/tool diagnostics, or other operational details in an exception message. Passing that text through verbatim makes internal diagnostics buyer-visible or log-visible and violates BandScope's redacted-by-default desktop boundary.

Mitigations

• URL class is still validated locally before bridge invocation.
• Any exception after YouTube bridge invocation is mapped to one fixed next-action message; raw exception text is discarded at the frontend boundary.
• Workspace-fetch failure logs preserve an operation-level event while discarding raw dependency/native message text.
• No additional telemetry/logging/storage/network authority was added.
• Focused regressions contain deliberate secret/path/URL markers and prove they are absent from returned UI state or routine console output.

Remaining risk

Native/downloader logs remain governed by their owning layers; these repairs prevent raw exception text from crossing the repaired frontend UI/console boundaries but do not claim to sanitize independent native log sinks.

Exact-current-head verification

Fresh repository workflows bind to exact head e169e6b89ea913d5e9ab723695ae7b6f39810876.

Terminal-success repository-owned lanes include:

• ci run 31974254521
• secret-scan-gate run 31974254570
• sbom run 31974254538
• bandit run 31974254518
• SAST Semgrep run 31974254544
• release run 31974254532
• build-baseline run 31974254597

Exact-current-head failures were inspected rather than treated generically:

• security-audit run 31974254556, job 95257263799: checkout/setup/install all succeed; first failing boundary is Audit npm dependencies. Python/Rust audit steps are skipped only because the npm gate fails first.
• aggregate Security Scan run 31974254541: scorecard, dependency-review, and osv-scan succeed. trivy-fs completes scan/SARIF generation and upload, then fails at Print Trivy findings that failed the gate.

This branch has no JavaScript manifest/root-lock/vulnerability-suppression delta, so those exact failures are the canonical protected-base dependency baseline owned by #783 after current-head inspection; they are not suppressed or duplicated here.

Fresh inline review inspection has zero review threads. There is no qualifying independent non-author current-head approval.

Dependency / merge gate

• fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 remains the canonical protected JavaScript dependency-security owner; inherited npm/Trivy findings are non-passing until that repair reaches protected develop and evidence is regenerated.
• Central required-workflow replacement remains read-only ContextualWisdomLab/.github#1020, whose current head must reach protected central main before dependent central evidence can be regenerated.

Keep Draft and unmerged until the unchanged then-current head has exact desktop tests and 100% owned statement/branch/function/line coverage, lint/typecheck/build, repository and central SAST/security/SBOM/supply-chain/package/release gates, zero actionable threads, qualifying independent non-author last-push approval, and branch protection without bypass. Queued, skipped-required, failed inherited-base, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is not success.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 367cbd14-af6d-4381-95b0-97f18510651f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@opencode-agent Please run a fresh review and coverage pass on exact current head a9063cb1eca490010e0f6905380304afb908db40. Ignore predecessor-head evidence. Verify the fail-closed browser-runtime boundary: non-Tauri analysis mutations reject, workspace reads return null, passive subscriptions emit no fabricated success, native Tauri behavior remains unchanged, and the CLAUDE guidance matches production behavior. Repository CI/release/SBOM/build-baseline/Bandit/Semgrep/secret-scan are successful on this exact head; Security Scan and security-audit are blocked by the protected-base dependency findings being remediated in #783 and must remain blockers until the base is updated. Do not copy dependency changes into this product PR. Publish only exact-head evidence and approve only if your coverage/review contract is satisfied.

[seonghobae]

Current-head gate evidence on a9063cb1eca490010e0f6905380304afb908db40 confirms the two red security workflows are inherited from protected develop, not introduced by this four-file product slice: security-audit fails on existing nanoid <3.3.18, pdfjs-dist <6.2.108, and undici <=7.28.0; Security Scan / trivy-fs fails on existing pdfjs-dist CVE-2026-16633. Keep this PR Draft and do not duplicate dependency remediation here. PR #783 is the atomic shared-base remediation; after it lands, update this branch from the new protected develop and require fresh exact-head security/audit/CI/review evidence.

[opencode-agent]

Queued @opencode-agent for PR #827 at head e169e6b89ea913d5e9ab723695ae7b6f39810876. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #827 at head e169e6b89ea913d5e9ab723695ae7b6f39810876. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.