release: v1.27.1 — desktop persistence/security stabilization + nanoid patch

[qnbs]

Summary

Cuts a patch release for everything unreleased on main since v1.27.0 (2026-08-13):

• fix: stabilize critical desktop persistence and release gates #363 — desktop persistence/security stabilization: atomic writes across every Tauri
  filesystem-backed store, unified fail-closed desktop API-key routing + recovery-reset hardening,
  factory-reset UI/logic consolidated into useFactoryReset + FactoryResetDangerZone, a
  packaged-build factory-reset capability-scope fix, #[cfg(desktop)]-gated menu-event handler +
  re-wired native menu-action bridge, and rust-tauri/e2e/vrt promoted to required CI gates.
• fix(deps): patch nanoid security advisory #362 — nanoid security-advisory patch (3.3.17 → 3.3.18).

This PR itself only bumps the version (package.json → 1.27.1, synced to
src-tauri/Cargo.toml/tauri.conf.json/Cargo.lock/public/sw.js) and updates
CHANGELOG.md/README.md/AUDIT.md — no functional code changes; #363 and #362 are already on
main.

Test plan

• pnpm run lint — clean
• pnpm run typecheck — clean (exact CI command, fresh .tsbuildinfo)
• pnpm run i18n:check — 2919 keys × 19 locales, OK
• Full CI suite green (Quality Gate ×2, rust-tauri, Build, E2E, E2E Deep, Storybook,
  Lighthouse, VRT) before merge
• Tag v1.27.1 + push after merge → tauri-build.yml publishes desktop installers + GitHub
  Release

🤖 Generated with Claude Code

Summary by Sourcery

Bump application and Tauri package versions to v1.27.1 and update release documentation to capture the latest desktop persistence/security improvements, CI gate promotions, and the nanoid security patch, without introducing new functional code changes.

Build:

• Synchronize version v1.27.1 across package.json, Tauri configuration, Rust manifests, and the service worker cache version.

Documentation:

• Document the v1.27.1 release in CHANGELOG, AUDIT, and README, including desktop persistence/security stabilization details, CI gate changes, and the nanoid security advisory patch.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[codeant-ai]

Skipping CodeAnt AI review — this PR is a back-merge between long-lived branches (release/v1.27.1 → main). The diff here has already been reviewed when the underlying commits landed on the source branch, so re-running analysis would produce duplicate findings on already-reviewed code.

If you want to analyze this anyway (e.g. you resolved conflicts with new logic), comment @codeant-ai : review and CodeAnt will start a review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
worldscript-studio	Ready	Preview	Aug 14, 2026 4:42am

[sourcery-ai]

Reviewer's Guide

Patch release PR that bumps the application version to v1.27.1 across JS, Rust, Tauri, and service worker metadata, and adds documentation/changelog entries describing previously merged desktop persistence/security stabilization and the nanoid security patch.

Flow diagram for v1.27.1 version metadata synchronization

flowchart LR
  A[package.json version 1.27.1]
  B[public/sw.js APP_VERSION 1.27.1]
  C[src-tauri/Cargo.toml version 1.27.1]
  D[src-tauri/tauri.conf.json version 1.27.1]
  E[README.md version badge v1.27.1]
  F[CHANGELOG.md 1.27.1 section]
  G[AUDIT.md current version v1.27.1]

  A -->|scripts/sync-sw-version.mjs| B
  A --> C
  A --> D
  A --> E
  A --> F
  A --> G

Loading

File-Level Changes

Change	Details	Files
Version synchronized to v1.27.1 across app, desktop bundle, and service worker to invalidate old caches and align JS/Rust release metadata.	Updated package.json version field from 1.27.0 to 1.27.1. Updated service worker APP_VERSION constant and derived cache names to 1.27.1. Updated src-tauri/Cargo.toml package version to 1.27.1. Synced Tauri configuration and Cargo.lock to 1.27.1 to match the JS package version.	package.json public/sw.js src-tauri/Cargo.toml src-tauri/Cargo.lock src-tauri/tauri.conf.json
Release documentation updated to add the v1.27.1 section and reflect the new current version, including quality gate notes and high-level description of the underlying desktop/security and nanoid work.	Added a 1.27.1 release section to the changelog summarizing desktop persistence/security stabilization and the nanoid patch. Extended the audit report follow-up chain with a v1.27.1 entry and updated the current version description to v1.27.1, including quality gate status for this release. Updated README version badge text from v1.27.0 to v1.27.1 to keep the landing page in sync with the release.	CHANGELOG.md AUDIT.md README.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 12 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ecc52c4e-a9fa-4946-855e-d7b0347d3ad1

📥 Commits

Reviewing files that changed from the base of the PR and between ea4de45 and fc0f0a2.

⛔ Files ignored due to path filters (1)

• src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (9)

• AGENTS.md
• AUDIT.md
• CHANGELOG.md
• README.md
• package.json
• public/sw.js
• scripts/sync-tauri-version.mjs
• src-tauri/Cargo.toml
• src-tauri/tauri.conf.json

---

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[codeant-ai]

🏁 CodeAnt Quality Gate Results

Commit: fc0f0a25
Scan Time: 2026-08-14 06:27:43 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	Rating S: No issues

View Full Results

[qodo-code-review]

PR Summary by Qodo

Release v1.27.1: sync app/Tauri versions and publish release notes

📝 Documentation ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Bump version to 1.27.1 across web app, service worker cache, and Tauri/Rust manifests.
• Publish v1.27.1 release notes and audit trail updates for #363 and #362.
• Update README version badge to reflect the new patch release.

Diagram

graph TD
  A["package.json (1.27.1)"] --> B(["Version sync (release process)"]) --> C["public/sw.js (cache version)"]
  B --> D["src-tauri/tauri.conf.json"]
  B --> E["src-tauri/Cargo.toml"] --> F["src-tauri/Cargo.lock"]
  B --> G["CHANGELOG/AUDIT/README"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Single source-of-truth version + generated outputs

• ➕ Eliminates manual multi-file bumps (package.json, Cargo.toml, tauri.conf.json, sw.js).
• ➕ Reduces risk of version skew (especially SW cache version vs app version).
• ➕ Enables consistent CI validation (e.g., a check that all versions match).
• ➖ Requires maintaining generation scripts and developer workflow changes.
• ➖ May be harder to reconcile with upstream tooling expectations (Cargo/Tauri).

2. Release automation (Changesets / semantic-release)

• ➕ Automates changelog entries and tagging/publishing steps.
• ➕ Standardizes patch-release cadence and reduces human error.
• ➖ Upfront setup and ongoing maintenance cost.
• ➖ May not fit a repo that mixes Rust/Tauri + web release requirements cleanly.

Recommendation: For a patch cut, the current approach is appropriate and low-risk because it only touches version strings and documentation. Longer-term, consider enforcing version alignment via a single source-of-truth plus a CI check (or generation step) to prevent accidental drift between package.json, Tauri/Rust manifests, and the service worker cache version.

Files changed (8) +73 / -8

Documentation (3) +68 / -3

AUDIT.mdRecord v1.27.1 audit chain and quality-gate status +4/-2

Record v1.27.1 audit chain and quality-gate status

• Appends the v1.27.1 entry to the audit follow-up chain and updates the current-version section. Adds a v1.27.1 quality-gate line item mirroring the release verification workflow.

AUDIT.md

CHANGELOG.mdAdd v1.27.1 release notes section +63/-0

Add v1.27.1 release notes section

• Introduces a new 1.27.1 entry with fixed/security/changed/tests bullets summarizing the already-merged work from #363 and #362. No functional code is changed here—this is release documentation.

CHANGELOG.md

README.mdUpdate README version badge to v1.27.1 +1/-1

Update README version badge to v1.27.1

• Bumps the displayed version badge from v1.27.0 to v1.27.1.

README.md

Other (5) +5 / -5

package.jsonBump app version to 1.27.1 +1/-1

Bump app version to 1.27.1

• Updates the root package version from 1.27.0 to 1.27.1 as the release source version.

package.json

sw.jsBump service worker APP_VERSION to 1.27.1 +1/-1

Bump service worker APP_VERSION to 1.27.1

• Updates APP_VERSION used in cache names, ensuring the new release invalidates prior caches on activation.

public/sw.js

Cargo.lockSync Rust lockfile package version to 1.27.1 +1/-1

Sync Rust lockfile package version to 1.27.1

• Updates the worldscript-studio package version recorded in Cargo.lock to match the release version.

src-tauri/Cargo.lock

Cargo.tomlBump Tauri/Rust crate version to 1.27.1 +1/-1

Bump Tauri/Rust crate version to 1.27.1

• Updates the Rust package version to 1.27.1 for the desktop build.

src-tauri/Cargo.toml

tauri.conf.jsonBump Tauri app version to 1.27.1 +1/-1

Bump Tauri app version to 1.27.1

• Updates Tauri configuration version from 1.27.0 to 1.27.1 to align desktop packaging metadata with the release.

src-tauri/tauri.conf.json

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

1. Agent guide version drift ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

After bumping the application version to 1.27.1, AGENTS.md still declares version 1.27.0, leaving
the repository’s agent-facing documentation inconsistent with the actual release version.

Code

package.json[4]

+  "version": "1.27.1",

Relevance

●●● Strong

They routinely fix documentation drift to match source-of-truth values; updating AGENTS.md is
low-risk consistency work.

PR-#168

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

package.json shows the new release version 1.27.1, but AGENTS.md still hard-codes 1.27.0, so
the release bump is not fully reflected in agent documentation.

package.json[1-6]
AGENTS.md[11-16]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The repository version was bumped to `1.27.1`, but `AGENTS.md` still lists `1.27.0`, creating documentation drift.

### Issue Context
`AGENTS.md` is an AI/agent-facing guide and includes an explicit `Version:` field that should stay in sync with `package.json` for release branches.

### Fix Focus Areas
- AGENTS.md[11-16]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Missing QNBS-v3 note 📘 Rule violation § Compliance

Description

public/sw.js changes runtime cache versioning behavior but the modified block is not annotated
with a // QNBS-v3: comment as required. This reduces review/audit traceability for non-trivial
behavior changes.

Code

public/sw.js[R8-9]

// QNBS-v3 (CodeRabbit): version bump auto-synced from package.json by scripts/sync-sw-version.mjs — every CACHE_STATIC/CACHE_DYNAMIC name changes too, so this alone invalidates all prior caches on next activate.
-const APP_VERSION   = '1.27.0';
+const APP_VERSION   = '1.27.1';

Relevance

● Weak

Same-file QNBS-v3/APP_VERSION annotation-format tweak was previously rejected; team likely won’t
change this block.

PR-#351

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 2524933 requires a // QNBS-v3: annotation comment in the diff for substantive
logic/config changes. The PR modifies APP_VERSION in public/sw.js but does not add a `//
QNBS-v3:` annotation immediately above the modified line in this diff block.

Rule 2524933: Require QNBS-v3 annotation comments on all non-trivial code changes
public/sw.js[8-10]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`public/sw.js` contains a non-trivial behavior/config change (service worker `APP_VERSION` bump impacting cache names/invalidation) but the change is not accompanied by a correctly prefixed `// QNBS-v3:` annotation comment immediately above the modified block.

## Issue Context
Compliance requires at least one `QNBS-v3` annotation comment for each modified source file with substantive logic/config changes.

## Fix Focus Areas
- public/sw.js[8-10]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context

✅ Compliance rules (platform): 84 rules

Review mode: ⚖️ Balanced: This release diff is mostly versioning and documentation, but it includes dependency/configuration changes and represents a security-sensitive desktop stabilization release; standard review is appropriate rather than skip or lite.

Tip of the day

💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗