GoWorks v0.7.9

Installers removed — superseded by v0.8.0.
v0.8.0 closes a full static-analysis pass, including an IPC error path that leaked
filesystem paths to the renderer. Please use v0.8.0. The source for this release is
still available at the v0.7.9 tag.

Security

• Installers could ship a build-time OAuth credential; they no longer can. Up to
  v0.7.8, a build could pack a stale compiled chunk from an older generation of
  auth-service that had the OAuth client ID and secret baked in as string literals.
  The mechanism: dotenv loaded .env into process.env at build time and the bundler
  folded those reads into literals — and because dist-electron/ was never cleaned
  between builds, such a chunk could outlive the source change that removed it and end
  up inside app.asar. The source tree never contained a secret; only the compiled
  artifact did. Two changes close this off:
  • prebuild now wipes dist/ and dist-electron/ before every build, so no artifact
    can outlive its generation.
  • A new gate, scripts/check-bundle-secrets.mjs, scans the compiled output for
    credential-shaped strings (OAuth secrets, client IDs, API keys, private-key blocks)
    and fails the build before electron-builder packs an asar. Standalone:
    npm run secrets:check.

Changed

• The local database drops an orphaned googleApiKey row (migration v3 → v4). It came
  from an abandoned Google Picker design and was hand-written into some installs, but no
  code path ever read it — it is not part of the app config schema.
• The README now states plainly that GoWorks was built with AI assistance, and asks you
  to run your own review before pointing it at a production tenant.

---

Verifying this build

Every installer below was produced by a build that cleans dist/ and dist-electron/
first and then refuses to package if the compiled output contains anything
credential-shaped. You can run the same check against your own build:

npm run build          # prebuild clean → vite → secret gate → electron-builder
npm run secrets:check  # the gate on its own

Install

• macOS — GoWorks-Mac-0.7.9-Installer.dmg (Apple silicon)
• Windows — GoWorks-Windows-0.7.9-Setup.exe (x64)

The app is ad-hoc signed, so on first launch macOS will ask you to confirm; open it from
Finder with right-click → Open.