Audit tier1

.editorconfig

@@ -3,6 +3,10 @@
 
 [*.cs]
 
+# The codebase deliberately uses trailing commas in multiline lists (cleaner diffs);
+# tell ReSharper that is the intended style so it stops flagging them for removal.
+resharper_csharp_trailing_comma_in_multiline_lists = true
+
 # IDE0066: Convert switch statement to expression
 dotnet_diagnostic.ide0066.severity = none
 

.github/workflows/package-dry-run-linux.yml

@@ -37,7 +37,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            dpkg-dev rpm wget desktop-file-utils
+            cpio dpkg-dev file rpm wget desktop-file-utils
 
       - name: Resolve dry-run version
         id: meta
@@ -49,7 +49,16 @@ jobs:
       - name: Build all Linux packages
         run: bash scripts/build-linux-packages.sh "${{ steps.meta.outputs.version }}" dist
 
+      - name: Smoke test all Linux packages
+        # Covers building the two prepared images as well as the smoke runs
+        # themselves; a throttled distro mirror has pushed the dependency
+        # download alone past twenty minutes.
+        timeout-minutes: 45
+        run: bash scripts/smoke-test-linux-packages.sh "${{ steps.meta.outputs.version }}" dist
+
       - uses: actions/upload-artifact@v7
+        # Keep the built packages available even when the smoke gate fails so a
+        # failed dry run can still be diagnosed; the job still reports failure.
         if: always()
         with:
           name: package-dry-run-linux-${{ steps.meta.outputs.version }}

.github/workflows/plugins-smoke.yml

@@ -30,6 +30,31 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Run plugin release transaction regression
+        shell: pwsh
+        run: |
+          $minimumPesterVersion = [version]'5.5.0'
+          $pester = Get-Module -ListAvailable Pester |
+            Where-Object Version -ge $minimumPesterVersion |
+            Sort-Object Version -Descending |
+            Select-Object -First 1
+          if (-not $pester) {
+            Install-Module Pester -RequiredVersion 5.7.1 -Scope CurrentUser -Force
+            $pester = Get-Module -ListAvailable Pester |
+              Where-Object Version -ge $minimumPesterVersion |
+              Sort-Object Version -Descending |
+              Select-Object -First 1
+          }
+          Import-Module $pester.Path -Force
+
+          $result = Invoke-Pester `
+            -Path tests/workflows/PublishPluginReleaseTransaction.Tests.ps1 `
+            -Output Detailed `
+            -PassThru
+          if ($result.FailedCount -gt 0) {
+            throw "$($result.FailedCount) plugin release transaction test(s) failed."
+          }
+
       - id: discover
         shell: pwsh
         run: |

.github/workflows/pr-ci-linux.yml

@@ -19,6 +19,7 @@ concurrency:
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
 
     steps:
       - uses: actions/checkout@v7
@@ -50,19 +51,26 @@ jobs:
         run: dotnet build src/TypeWhisper.Cli/TypeWhisper.Cli.csproj -c Release --no-restore -bl:artifacts/logs/typewhisper-cli.binlog
 
       - name: Test TypeWhisper.Core
-        run: dotnet test tests/TypeWhisper.Core.Tests/TypeWhisper.Core.Tests.csproj -c Release --no-build --logger "trx;LogFileName=TypeWhisper.Core.Tests.trx" --results-directory artifacts/test-results
+        timeout-minutes: 15
+        run: dotnet test tests/TypeWhisper.Core.Tests/TypeWhisper.Core.Tests.csproj -c Release --no-build --logger "trx;LogFileName=TypeWhisper.Core.Tests.trx" --results-directory artifacts/test-results --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type mini
 
       - name: Test plugin system
-        run: dotnet test tests/TypeWhisper.PluginSystem.Tests/TypeWhisper.PluginSystem.Tests.csproj -c Release --no-build --logger "trx;LogFileName=TypeWhisper.PluginSystem.Tests.trx" --results-directory artifacts/test-results
+        timeout-minutes: 15
+        run: dotnet test tests/TypeWhisper.PluginSystem.Tests/TypeWhisper.PluginSystem.Tests.csproj -c Release --no-build --logger "trx;LogFileName=TypeWhisper.PluginSystem.Tests.trx" --results-directory artifacts/test-results --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type mini
 
       - name: Test TypeWhisper.Linux
-        run: dotnet test tests/TypeWhisper.Linux.Tests/TypeWhisper.Linux.Tests.csproj -c Release --no-build --logger "trx;LogFileName=TypeWhisper.Linux.Tests.trx" --results-directory artifacts/test-results
+        timeout-minutes: 15
+        run: dotnet test tests/TypeWhisper.Linux.Tests/TypeWhisper.Linux.Tests.csproj -c Release --no-build --logger "trx;LogFileName=TypeWhisper.Linux.Tests.trx" --results-directory artifacts/test-results --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type mini
+
+      - name: Test TypeWhisper.Cli
+        timeout-minutes: 15
+        run: dotnet test tests/TypeWhisper.Cli.Tests/TypeWhisper.Cli.Tests.csproj -c Release --no-build --logger "trx;LogFileName=TypeWhisper.Cli.Tests.trx" --results-directory artifacts/test-results --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type mini
 
       - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: pr-ci-linux-artifacts
           path: |
             artifacts/logs/*.binlog
-            artifacts/test-results/*.trx
+            artifacts/test-results/**
           if-no-files-found: ignore

.github/workflows/publish-plugins.yml

@@ -81,6 +81,10 @@ jobs:
         with:
           dotnet-version: '10.0.x'
 
+      - name: Test plugin system
+        timeout-minutes: 15
+        run: dotnet test tests/TypeWhisper.PluginSystem.Tests/TypeWhisper.PluginSystem.Tests.csproj -c Release -p:DeployBundledLinuxPlugins=false --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type mini
+
       - name: Patch manifest version
         shell: pwsh
         run: |
@@ -161,98 +165,17 @@ jobs:
           echo "PLUGIN_ID=$pluginId" >> $env:GITHUB_ENV
           echo "Created $zipName ($zipSize bytes)"
 
-      - name: Create GitHub Release
+      - name: Publish plugin release transaction
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: pwsh
         run: |
-          $tag = "${{ github.ref_name }}"
-          gh release create $tag $env:ZIP_NAME `
-            --title "$env:PROJECT_NAME v$env:PLUGIN_VERSION" `
-            --notes ""
-
-      - name: Update plugins.json on gh-pages
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        shell: pwsh
-        run: |
-          $tag = "${{ github.ref_name }}"
-          $repo = "${{ github.repository }}"
-          $downloadUrl = "https://github.com/$repo/releases/download/$tag/$env:ZIP_NAME"
-
-          git fetch origin gh-pages
-          git worktree add -B gh-pages gh-pages-work origin/gh-pages
-
-          $maxRetries = 5
-          for ($i = 1; $i -le $maxRetries; $i++) {
-            try {
-              Push-Location gh-pages-work
-              git fetch origin gh-pages
-              git reset --hard origin/gh-pages
-
-              $registry = @(
-                Get-Content plugins.json | ConvertFrom-Json
-              )
-              $updated = $false
-
-              for ($j = 0; $j -lt $registry.Count; $j++) {
-                if ($registry[$j].id -eq $env:PLUGIN_ID) {
-                  $registry[$j].version = $env:PLUGIN_VERSION
-                  $registry[$j].size = [long]$env:ZIP_SIZE
-                  $registry[$j].downloadUrl = $downloadUrl
-                  $updated = $true
-                  Write-Host "Updated $($registry[$j].id) to v$env:PLUGIN_VERSION"
-                  break
-                }
-              }
-
-              if (-not $updated) {
-                $manifestPath = Join-Path ".." "plugins/$env:PROJECT_NAME/manifest.json"
-                $manifest = Get-Content $manifestPath | ConvertFrom-Json
-
-                $registry += [pscustomobject]@{
-                  id = $manifest.id
-                  name = $manifest.name
-                  version = $env:PLUGIN_VERSION
-                  minHostVersion = $manifest.minHostVersion
-                  author = $manifest.author
-                  description = $manifest.description
-                  category = $manifest.category
-                  size = [long]$env:ZIP_SIZE
-                  downloadUrl = $downloadUrl
-                  iconSystemName = $manifest.iconSystemName
-                  requiresApiKey = [bool]($manifest.requiresApiKey)
-                  descriptions = $manifest.descriptions
-                }
-
-                Write-Host "Added $env:PLUGIN_ID to registry at v$env:PLUGIN_VERSION"
-              }
-
-              $registry | ConvertTo-Json -Depth 4 | Set-Content plugins.json
-
-              # Also copy the ZIP to plugins/ directory on gh-pages
-              New-Item -ItemType Directory -Path "plugins" -Force | Out-Null
-              Copy-Item (Join-Path .. $env:ZIP_NAME) "plugins/$env:ZIP_NAME" -Force
-
-              git add -A
-              git config user.name "github-actions[bot]"
-              git config user.email "github-actions[bot]@users.noreply.github.com"
-
-              $diff = git diff --cached --quiet 2>&1; $hasChanges = $LASTEXITCODE -ne 0
-              if ($hasChanges) {
-                git commit -m "Update $env:PROJECT_NAME to v$env:PLUGIN_VERSION"
-                git push origin gh-pages
-                Write-Host "Successfully updated plugins.json (attempt $i)"
-              } else {
-                Write-Host "No changes to deploy"
-              }
-
-              Pop-Location
-              break
-            } catch {
-              Pop-Location
-              if ($i -eq $maxRetries) { throw }
-              Write-Host "Push failed (attempt $i), retrying in ${i}s..."
-              Start-Sleep -Seconds $i
-            }
-          }
+          ./scripts/publish-plugin-release.ps1 `
+            -Tag $env:GITHUB_REF_NAME `
+            -Repository $env:GITHUB_REPOSITORY `
+            -CommitSha $env:GITHUB_SHA `
+            -ProjectName $env:PROJECT_NAME `
+            -PluginVersion $env:PLUGIN_VERSION `
+            -PluginId $env:PLUGIN_ID `
+            -ZipPath $env:ZIP_NAME `
+            -ManifestPath "plugins/$env:PROJECT_NAME/manifest.json"

.github/workflows/release-linux.yml

@@ -95,6 +95,8 @@ jobs:
   build:
     needs: prepare
     runs-on: ubuntu-latest
+    # 30m unit-test cap + 30m package-smoke cap + 30m setup/build/upload allowance.
+    timeout-minutes: 90
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
 
@@ -115,19 +117,28 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            dpkg-dev rpm wget desktop-file-utils
+            cpio dpkg-dev file rpm wget desktop-file-utils
 
       - name: Run unit tests
+        timeout-minutes: 30
         run: |
           dotnet restore TypeWhisper.slnx
           dotnet build TypeWhisper.slnx -c Release --no-restore -p:Version=${VERSION}
-          dotnet test tests/TypeWhisper.Core.Tests/TypeWhisper.Core.Tests.csproj -c Release --no-build
-          dotnet test tests/TypeWhisper.PluginSystem.Tests/TypeWhisper.PluginSystem.Tests.csproj -c Release --no-build
-          dotnet test tests/TypeWhisper.Linux.Tests/TypeWhisper.Linux.Tests.csproj -c Release --no-build
+          dotnet test tests/TypeWhisper.Core.Tests/TypeWhisper.Core.Tests.csproj -c Release --no-build --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type mini
+          dotnet test tests/TypeWhisper.PluginSystem.Tests/TypeWhisper.PluginSystem.Tests.csproj -c Release --no-build --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type mini
+          dotnet test tests/TypeWhisper.Linux.Tests/TypeWhisper.Linux.Tests.csproj -c Release --no-build --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type mini
+          dotnet test tests/TypeWhisper.Cli.Tests/TypeWhisper.Cli.Tests.csproj -c Release --no-build --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type mini
 
       - name: Build all Linux packages
         run: bash scripts/build-linux-packages.sh "$VERSION" dist
 
+      - name: Smoke test all Linux packages
+        # Covers building the two prepared images as well as the smoke runs
+        # themselves; a throttled distro mirror has pushed the dependency
+        # download alone past twenty minutes.
+        timeout-minutes: 45
+        run: bash scripts/smoke-test-linux-packages.sh "$VERSION" dist
+
       - uses: actions/upload-artifact@v7
         with:
           name: release-linux-${{ env.VERSION }}

README.md

@@ -33,7 +33,7 @@ Press a key, talk, and have clean, punctuated text land in whatever app you're i
 - **Personalization** — searchable history, a dictionary with term packs, snippets, and app/URL-matched profiles. History also has an opt-in **Inspect** panel that shows exactly what was sent to the LLM for each entry — the raw→final diff, the exact prompt, injected memory context, and the reply, with local-vs-cloud labelling. See [Profiles](https://github.com/csmashe/typewhisper-linux/wiki/Profiles) and [History](https://github.com/csmashe/typewhisper-linux/wiki/History).
 - **Learns from your corrections** in the Wispr-Flow style — when you type over a dictated word in the target app to fix it, TypeWhisper silently learns the correction (via AT-SPI) and auto-applies it to future dictations. A brief toast shows what was learned and offers **Undo**. Off by default (it reads the focused field); enable it under [Dictation](https://github.com/csmashe/typewhisper-linux/wiki/Dictation) settings, and review or remove learned entries in the [Dictionary](https://github.com/csmashe/typewhisper-linux/wiki/Dictionary).
 - **A localized interface** — English, German, Spanish, or Russian, switched live (or Auto, to follow your system locale). See [General Settings](https://github.com/csmashe/typewhisper-linux/wiki/General-Settings).
-- **Automation** — a local [HTTP API](https://github.com/csmashe/typewhisper-linux/wiki/HTTP-API) and a `typewhisper` [CLI](https://github.com/csmashe/typewhisper-linux/wiki/CLI) client (currently built from source; release packages don't yet bundle the CLI binary).
+- **Automation** — a local [HTTP API](https://github.com/csmashe/typewhisper-linux/wiki/HTTP-API) and an installable `typewhisper` [CLI](https://github.com/csmashe/typewhisper-linux/wiki/CLI).
 - **Desktop integration** — tray icon, XDG autostart, single-instance handoff, and a user-level installer. See [Desktop Integration](https://github.com/csmashe/typewhisper-linux/wiki/Desktop-Integration).
 
 Everything here is Linux-specific work adapted from the upstream macOS/Windows project: Wayland/X11 global hotkeys, compositor-native window and URL detection, session audio handling, and Linux packaging. The deep how-and-why for each lives in the wiki — start with [Wayland Notes](https://github.com/csmashe/typewhisper-linux/wiki/Wayland-Notes) if you're on Wayland.

TypeWhisper.slnx

@@ -11,4 +11,38 @@
         <Project Path="tests/TypeWhisper.PluginSystem.Tests/TypeWhisper.PluginSystem.Tests.csproj"/>
         <Project Path="tests/TypeWhisper.Cli.Tests/TypeWhisper.Cli.Tests.csproj"/>
     </Folder>
+    <Folder Name="/plugins/">
+        <Project Path="plugins/TypeWhisper.Plugin.AssemblyAi/TypeWhisper.Plugin.AssemblyAi.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Cerebras/TypeWhisper.Plugin.Cerebras.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Claude/TypeWhisper.Plugin.Claude.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.CloudflareAsr/TypeWhisper.Plugin.CloudflareAsr.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Cohere/TypeWhisper.Plugin.Cohere.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Deepgram/TypeWhisper.Plugin.Deepgram.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.ElevenLabs/TypeWhisper.Plugin.ElevenLabs.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.FileMemory/TypeWhisper.Plugin.FileMemory.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Fireworks/TypeWhisper.Plugin.Fireworks.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Gemini/TypeWhisper.Plugin.Gemini.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.GemmaLocal/TypeWhisper.Plugin.GemmaLocal.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Gladia/TypeWhisper.Plugin.Gladia.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.GoogleCloudStt/TypeWhisper.Plugin.GoogleCloudStt.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Groq/TypeWhisper.Plugin.Groq.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Linear/TypeWhisper.Plugin.Linear.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Obsidian/TypeWhisper.Plugin.Obsidian.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.OpenAi/TypeWhisper.Plugin.OpenAi.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.OpenAiCompatible/TypeWhisper.Plugin.OpenAiCompatible.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.OpenAiVectorMemory/TypeWhisper.Plugin.OpenAiVectorMemory.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.OpenRouter/TypeWhisper.Plugin.OpenRouter.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Qwen3Stt/TypeWhisper.Plugin.Qwen3Stt.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Reson8/TypeWhisper.Plugin.Reson8.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Script/TypeWhisper.Plugin.Script.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.SherpaOnnx/TypeWhisper.Plugin.SherpaOnnx.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.SmallestAi/TypeWhisper.Plugin.SmallestAi.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Soniox/TypeWhisper.Plugin.Soniox.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Speechmatics/TypeWhisper.Plugin.Speechmatics.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.SupertonicTts/TypeWhisper.Plugin.SupertonicTts.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Voxtral/TypeWhisper.Plugin.Voxtral.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Webhook/TypeWhisper.Plugin.Webhook.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.WhisperCpp/TypeWhisper.Plugin.WhisperCpp.csproj"/>
+        <Project Path="plugins/TypeWhisper.Plugin.Xai/TypeWhisper.Plugin.Xai.csproj"/>
+    </Folder>
 </Solution>