Stage

[evereq]

PR

• Have you followed the contributing guidelines?
• Have you explained what your changes do, and why they add value?

Please note: we will close your PR without comment if you do not check the boxes above and provide ALL requested information.

---

---

Summary by cubic

Adds arch-specific update channels, a new password hashing module (scrypt by default with bcrypt compatibility), and a redesigned plugin upload flow. Also introduces a theme-aware custom tray icon for Desktop Timer and hardens plugin archive extraction security.

• New Features

  • Arch-specific publish channels and updater feeds for desktop builds (linux/win32).
  • Theme-aware custom tray icon in Desktop Timer with IPC hooks; configurable via GAUZY_DESKTOP_TRAY_ICON; icon generator supports tray assets.
  • Upload selection modal and revamped “Add Plugin” UI with improved i18n and accessibility.
  • PasswordHashModule with strategy-based hashing (scrypt default, bcrypt legacy); auth/services and seeding updated to use PasswordHashService.

• Bug Fixes

  • Secure plugin zip extraction: prevent path traversal, use robust stream pipelines, and cleanup incomplete files on errors.
  • Resolve desktop plugin table conflict by renaming to desktop_plugins.
  • Desktop tray setup corrected to use proper icon handling and avoid duplicated listeners.

^{Written for commit 1c8c714. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch develop

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Too many files changed for review.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
5 out of 6 committers have signed the CLA.

✅ syns2191
✅ evereq
✅ samuelmbabhazi
✅ rahul-rocket
✅ adkif
❌ dependabot[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
5 out of 6 committers have signed the CLA.

✅ syns2191
✅ evereq
✅ samuelmbabhazi
✅ rahul-rocket
✅ adkif
❌ dependabot[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[greptile-apps]

Too many files changed for review.

[cubic-dev-ai]

6 issues found across 124 files

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-list/plugin-list.component.html">

<violation number="1" location="packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-list/plugin-list.component.html:42">
P1: The 'Add Plugin' button has been removed during the refactoring. The original code had this button visible at all times (outside the `selected` condition), allowing users to add new plugins. This appears to be a regression that breaks core functionality.</violation>
</file>

<file name="apps/desktop-timer/src/index.ts">

<violation number="1" location="apps/desktop-timer/src/index.ts:812">
P1: Accessing `appSetting.timerStarted` without null check will throw a TypeError if `appSetting` is null/undefined. The existing code pattern in `before-quit` handler (line 622) shows this value should be guarded with `appSetting && appSetting.timerStarted`. Use optional chaining here.</violation>
</file>

<file name="packages/core/src/lib/app/app.module.ts">

<violation number="1" location="packages/core/src/lib/app/app.module.ts:322">
P1: This change passes the `Cacheable` instance instead of the array of raw Keyv stores, but the comment above states "cache-manager currently uses the raw Keyv stores directly". If the cache-manager module expects Keyv stores and not a Cacheable wrapper, this could break caching functionality. Either update the comment to reflect the new approach if `Cacheable` is now supported, or revert to passing `[cacheable.primary, cacheable.secondary]`.</violation>
</file>

<file name="package.json">

<violation number="1" location="package.json:316">
P2: Inconsistent architecture specification: `build:desktop-timer:windows` now explicitly includes `--x64`, while similar base Windows build scripts for other apps (desktop, gauzy-server, agent, etc.) don't specify an architecture. If this is intentional, consider applying the same pattern to other Windows build scripts for consistency. If not, the `--x64` flag should be removed to match the other scripts.</violation>
</file>

<file name="packages/desktop-lib/src/lib/plugin-system/data-access/strategies/cdn-download.strategy.ts">

<violation number="1" location="packages/desktop-lib/src/lib/plugin-system/data-access/strategies/cdn-download.strategy.ts:344">
P1: Missing final path containment verification after resolution. The inline checks only validate the entry path patterns, but unlike `isSafePath` and `extractFile`, this code doesn't verify that `resolvedFullPath.startsWith(path.resolve(extractDir) + path.sep)`. Add a containment check before writing files to ensure the resolved path stays within the extraction directory.</violation>
</file>

<file name="packages/desktop-ui-lib/src/lib/settings/plugins/component/add-plugin/add-plugin.component.html">

<violation number="1" location="packages/desktop-ui-lib/src/lib/settings/plugins/component/add-plugin/add-plugin.component.html:36">
P2: Missing `$event.preventDefault()` on `keydown.space` handler. When Space is pressed on this custom button element, the page will scroll in addition to triggering the action. Add `$event.preventDefault()` before the action call to prevent unwanted scrolling.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: The 'Add Plugin' button has been removed during the refactoring. The original code had this button visible at all times (outside the selected condition), allowing users to add new plugins. This appears to be a regression that breaks core functionality.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/settings/plugins/component/plugin-list/plugin-list.component.html, line 42:

<comment>The 'Add Plugin' button has been removed during the refactoring. The original code had this button visible at all times (outside the `selected` condition), allowing users to add new plugins. This appears to be a regression that breaks core functionality.</comment>

<file context>
@@ -1,86 +1,119 @@
+	} @else if (isPluginAvailable) {
+	<!-- Action Buttons -->
+	@if (selected) {
+	<div class="button-container" aria-label="Plugin actions">
+		<div class="button-hide">
+			@if (selected.renderer) {
</file context>

[cubic-dev-ai]

P1: Accessing appSetting.timerStarted without null check will throw a TypeError if appSetting is null/undefined. The existing code pattern in before-quit handler (line 622) shows this value should be guarded with appSetting && appSetting.timerStarted. Use optional chaining here.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/desktop-timer/src/index.ts, line 812:

<comment>Accessing `appSetting.timerStarted` without null check will throw a TypeError if `appSetting` is null/undefined. The existing code pattern in `before-quit` handler (line 622) shows this value should be guarded with `appSetting && appSetting.timerStarted`. Use optional chaining here.</comment>

<file context>
@@ -798,3 +798,17 @@ app.on('browser-window-created', (_, window) => {
+	const appSetting = LocalStore.getStore('appSetting');
+	timeTrackerWindow?.webContents?.send?.('custom_tray_icon', {
+		event: 'updateTheme',
+		isStopped: !appSetting.timerStarted
+	});
+});
</file context>

Suggested change

	isStopped: !appSetting.timerStarted
	isStopped: !appSetting?.timerStarted

[cubic-dev-ai]

P1: This change passes the Cacheable instance instead of the array of raw Keyv stores, but the comment above states "cache-manager currently uses the raw Keyv stores directly". If the cache-manager module expects Keyv stores and not a Cacheable wrapper, this could break caching functionality. Either update the comment to reflect the new approach if Cacheable is now supported, or revert to passing [cacheable.primary, cacheable.secondary].

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/core/src/lib/app/app.module.ts, line 322:

<comment>This change passes the `Cacheable` instance instead of the array of raw Keyv stores, but the comment above states "cache-manager currently uses the raw Keyv stores directly". If the cache-manager module expects Keyv stores and not a Cacheable wrapper, this could break caching functionality. Either update the comment to reflect the new approach if `Cacheable` is now supported, or revert to passing `[cacheable.primary, cacheable.secondary]`.</comment>

<file context>
@@ -318,7 +319,7 @@ if (environment.THROTTLE_ENABLED) {
 
 								return {
-									stores: [cacheable.primary, cacheable.secondary]
+									stores: cacheable
 								};
 							} catch (error) {
</file context>

Suggested change

	stores: cacheable
	stores: [cacheable.primary, cacheable.secondary]

[cubic-dev-ai]

P1: Missing final path containment verification after resolution. The inline checks only validate the entry path patterns, but unlike isSafePath and extractFile, this code doesn't verify that resolvedFullPath.startsWith(path.resolve(extractDir) + path.sep). Add a containment check before writing files to ensure the resolved path stays within the extraction directory.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-lib/src/lib/plugin-system/data-access/strategies/cdn-download.strategy.ts, line 344:

<comment>Missing final path containment verification after resolution. The inline checks only validate the entry path patterns, but unlike `isSafePath` and `extractFile`, this code doesn't verify that `resolvedFullPath.startsWith(path.resolve(extractDir) + path.sep)`. Add a containment check before writing files to ensure the resolved path stays within the extraction directory.</comment>

<file context>
@@ -326,16 +339,69 @@ export class CdnDownloadStrategy implements IPluginDownloadStrategy {
-						const fullPath = path.join(extractDir, entryPath);
+						// Build the full output path from the normalized entry path
+						const fullPath = path.join(extractDir, normalizedEntryPath);
+						const resolvedFullPath = path.resolve(fullPath);
 
 						if (type === 'Directory') {
</file context>

Suggested change

	const resolvedFullPath = path.resolve(fullPath);
	const resolvedFullPath = path.resolve(fullPath);
	// Final containment check: ensure resolved path stays within extraction directory
	const resolvedExtractDir = path.resolve(extractDir);
	if (!resolvedFullPath.startsWith(resolvedExtractDir + path.sep)) {
	logger.warn(`Path escapes extraction directory, skipping: ${entryPath}`);
	entry.autodrain();
	return;
	}

[cubic-dev-ai]

P2: Inconsistent architecture specification: build:desktop-timer:windows now explicitly includes --x64, while similar base Windows build scripts for other apps (desktop, gauzy-server, agent, etc.) don't specify an architecture. If this is intentional, consider applying the same pattern to other Windows build scripts for consistency. If not, the --x64 flag should be removed to match the other scripts.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 316:

<comment>Inconsistent architecture specification: `build:desktop-timer:windows` now explicitly includes `--x64`, while similar base Windows build scripts for other apps (desktop, gauzy-server, agent, etc.) don't specify an architecture. If this is intentional, consider applying the same pattern to other Windows build scripts for consistency. If not, the `--x64` flag should be removed to match the other scripts.</comment>

<file context>
@@ -311,13 +311,13 @@
-		"build:desktop-timer:windows": "cross-env NODE_ENV=production NODE_OPTIONS=--max-old-space-size=12288 yarn run build:desktop-timer && npm config set cache .cache && yarn electron-builder -c.electronVersion=38.2.2 -c.extraMetadata.author.name=Ever build --windows --project dist/apps/desktop-timer",
+		"build:desktop-timer:linux:release:gh:x64": "yarn run pack --desktop=desktop-timer --arch=x64 --platform=linux && cross-env NODE_ENV=production NODE_OPTIONS=--max-old-space-size=30000 yarn run build:desktop-timer && npm config set cache .cache && yarn electron-builder -c.electronVersion=38.2.2 build --linux --x64 --publish=always --project dist/apps/desktop-timer",
+		"build:desktop-timer:linux:release:gh:arm64": "yarn run pack --desktop=desktop-timer --arch=arm64 --platform=linux && cross-env NODE_ENV=production NODE_OPTIONS=--max-old-space-size=30000 yarn run build:desktop-timer && npm config set cache .cache && yarn electron-builder -c.electronVersion=38.2.2 build --linux --arm64 --publish=always --project dist/apps/desktop-timer",
+		"build:desktop-timer:windows": "cross-env NODE_ENV=production NODE_OPTIONS=--max-old-space-size=12288 yarn run build:desktop-timer && npm config set cache .cache && yarn electron-builder -c.electronVersion=38.2.2 -c.extraMetadata.author.name=Ever build --windows --x64 --project dist/apps/desktop-timer",
 		"build:desktop-timer:windows:release": "cross-env NODE_ENV=production NODE_OPTIONS=--max-old-space-size=12288 yarn run build:desktop-timer && npm config set cache .cache && yarn electron-builder -c.electronVersion=38.2.2 -c.extraMetadata.author.name=Ever build --windows --publish=always --project dist/apps/desktop-timer",
 		"build:desktop-timer:windows:release:gh": "cross-env NODE_ENV=production NODE_OPTIONS=--max-old-space-size=30000 yarn run build:desktop-timer && npm config set cache .cache && yarn electron-builder -c.electronVersion=38.2.2 -c.extraMetadata.author.name=Ever build --windows --publish=always --project dist/apps/desktop-timer",
</file context>

[cubic-dev-ai]

P2: Missing $event.preventDefault() on keydown.space handler. When Space is pressed on this custom button element, the page will scroll in addition to triggering the action. Add $event.preventDefault() before the action call to prevent unwanted scrolling.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/desktop-ui-lib/src/lib/settings/plugins/component/add-plugin/add-plugin.component.html, line 36:

<comment>Missing `$event.preventDefault()` on `keydown.space` handler. When Space is pressed on this custom button element, the page will scroll in addition to triggering the action. Add `$event.preventDefault()` before the action call to prevent unwanted scrolling.</comment>

<file context>
@@ -1,176 +1,273 @@
+					[class.disabled]="installing"
+					(click)="!installing && localPluginInstall()"
+					(keydown.enter)="!installing && localPluginInstall()"
+					(keydown.space)="!installing && localPluginInstall()"
+					[tabindex]="installing ? -1 : 0"
+					[attr.aria-label]="'BUTTONS.LOAD_PLUGIN' | translate"
</file context>

Suggested change

	(keydown.space)="!installing && localPluginInstall()"
	(keydown.space)="$event.preventDefault(); !installing && localPluginInstall()"

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.

[greptile-apps]

Too many files changed for review.