Release v1.1.3

[Power-Maverick]

Please fill in this template.

• Use a meaningful title for the pull request.
• Follow the guidelines from the CONTRIBUTING.md.
• Mention the bug or the feature number the PR will be targeting.
• Test the change in your own code. (Compile and run)
• Resolve all GH Copilot comments.

[github-actions]

Bundle Size Report 📦

Bundle	Size
Main Process	4.86 MB
Renderer JS	696.6 KB
Renderer CSS	76.96 KB
Total	5.62 MB

Bundle Analysis Reports

The detailed bundle analysis reports are available in the workflow artifacts:

• 📊 Main Process: stats-main.html
• 📊 Renderer Process: stats-renderer.html

Download the artifacts from the workflow run to view interactive visualizations.

---

Bundle size tracking is now active! This helps prevent bundle bloat.

[Copilot]

Pull request overview

Release v1.1.3 updates the desktop app and its tool developer APIs to improve security (tool filesystem sandboxing), authentication UX (browser + profile selection for sign-in), and Dataverse capabilities (metadata operations), alongside release pipeline hardening.

Changes:

• Added per-tool-instance filesystem access control with explicit user-consent grants (selectPath/saveFile) and revocation on tool close.
• Added browser detection/profile enumeration and wired interactive auth to open URLs in a selected browser/profile; updated connection UI to configure these settings.
• Expanded Dataverse API with metadata CRUD helpers (plus $metadata/CSDL retrieval) and updated build/release workflows (signing, notarization, hash regeneration).

Reviewed changes

Copilot reviewed 30 out of 34 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
vite.config.ts	Copies new icons/logos assets into the renderer build output.
src/renderer/styles.scss	Adds styles for connection browser/profile badge UI.
src/renderer/modules/connectionManagement.ts	Persists browser settings on connections and renders a browser/profile badge in the sidebar.
src/renderer/modals/sharedStyles.ts	Adds shared modal warning styling.
src/renderer/modals/editConnection/view.ts	Adds “Browser Settings” fields to the edit-connection modal.
src/renderer/modals/editConnection/controller.ts	Loads browser install status/profiles and saves browser settings from the edit modal.
src/renderer/modals/addConnection/view.ts	Adds “Browser Settings” fields to the add-connection modal.
src/renderer/modals/addConnection/controller.ts	Loads browser install status/profiles and saves browser settings from the add modal.
src/main/utilities/filesystem.ts	Extends saveFile to accept optional dialog filters and derive defaults from extension.
src/main/toolPreloadBridge.ts	Hardens tool connection exposure (safe shape) and expands Dataverse/tool filesystem APIs.
src/main/preload.ts	Exposes browser detection/profile APIs to the main renderer and extends saveFile signature.
src/main/modalPreload.ts	Exposes browser detection/profile APIs to modal windows.
src/main/managers/toolWindowManager.ts	Hooks tool instance lifecycle to revoke filesystem grants; adds WebContents→instance/tool lookup and bounds retrieval.
src/main/managers/toolFileSystemAccessManager.ts	New manager to track and validate per-instance allowed filesystem paths.
src/main/managers/loadingOverlayWindowManager.ts	Reworks loading overlay to cover tool panel bounds, adds close behavior, and escapes message HTML.
src/main/managers/dataverseManager.ts	Adds metadata header validation, $metadata retrieval, and extensive metadata CRUD helpers.
src/main/managers/browserManager.ts	New manager for browser install detection, profile enumeration, and browser launch with profile.
src/main/managers/authManager.ts	Routes interactive auth browser launch through BrowserManager (profile-aware).
src/main/index.ts	Wires new managers, IPC handlers (browser + metadata + filesystem sandbox), and tool-panel-scoped loading overlay bounds.
src/common/types/dataverse.ts	Adds metadata-related shared types (labels, attribute types, operation options).
src/common/types/connection.ts	Adds connection-level BrowserType + browser/profile fields.
src/common/types/api.ts	Updates fileSystem.saveFile type signature to accept optional filters.
src/common/ipc/channels.ts	Adds IPC channels for browser detection/profile enumeration and Dataverse metadata endpoints.
packages/toolboxAPI.d.ts	Updates public tool typings (saveFile filters, connection surface tightening).
packages/package.json	Publishes @pptb/types as stable 1.0.19.
packages/dataverseAPI.d.ts	Expands tool-facing Dataverse typings for metadata utilities/CRUD and getCSDLDocument.
package.json	Bumps app version to 1.1.3.
buildScripts/notarize.js	Supports multi-asset notarization submission and status polling.
RELEASE_NOTES.md	Updates release notes for 1.1.3 features/fixes.
README.md	Updates “Force Checkin” comment timestamp.
.github/workflows/prod-release.yml	Enhances signing/notarization flow; repackages signed ZIPs; regenerates update YAML hashes.
.github/workflows/nightly-release.yml	Mirrors prod workflow improvements for nightly artifacts/hashes/notarization.

[Copilot]

openBrowserWithProfile() ignores a non-default browserType when no browserProfile is set (it falls back to shell.openExternal). This makes the “Browser” selector ineffective unless a profile is chosen, and contradicts the UI text saying the browser choice applies even without a profile. Consider launching the selected browser even when browserProfile is empty (only omit the --profile-directory arg), and keep fallback to system default only when the requested browser executable can’t be resolved/started.

[Copilot]

browserType is read as a free-form string and then cast to DataverseConnection["browserType"]. This bypasses the BrowserType union and can persist invalid values (e.g., from tampered modal payloads), which then won’t match BrowserManager’s expectations. Please validate/normalize to the allowed set (default | chrome | edge) before assigning, and fall back to default for unknown values.

[Copilot]

ToolSafeConnection makes createdAt optional, but the published tool API typings (packages/toolboxAPI.d.ts) define createdAt as required. This mismatch can break tool code at runtime if a connection ever lacks createdAt (or if it’s not a string). Either require/validate createdAt in toToolSafeConnection() (return null if missing), or update the public types to mark it optional consistently.

[Copilot]

The error message in this catch block is still Failed to copy icons directory, which is ambiguous now that light/dark/logos are copied separately. Consider making the message specific to the logos copy (or include the source/target dir) to make build failures easier to diagnose.

[Copilot]

spawn() failures like ENOENT (command not found) are emitted asynchronously on the returned ChildProcess and won’t be caught by this try/catch. If a browser is configured but later uninstalled (or not on PATH on Linux), this can silently fail without falling back to shell.openExternal. Consider validating the executable for non-absolute commands (e.g., which/command -v) and/or attaching an error handler on the spawned process to trigger the fallback.

Suggested change

	spawn(executable, browserArgs, {
	detached: true,
	stdio: "ignore",
	}).unref();
	} catch (error) {
	// If browser launch fails, fallback to default browser
	const child = spawn(executable, browserArgs, {
	detached: true,
	stdio: "ignore",
	});
	child.on("error", (spawnError: Error & { code?: string }) => {
	logWarn(`Failed to launch ${browserType} with profile (spawn error), falling back to default: ${spawnError.message}`);
	shell.openExternal(url).catch((fallbackError: Error) => {
	logWarn(`Fallback to default browser also failed: ${fallbackError.message}`);
	});
	});
	child.unref();
	} catch (error) {
	// If browser launch fails synchronously, fallback to default browser