Skip to content

chore: small cleanups#56

Merged
aicayzer merged 6 commits into
mainfrom
chore/review-followups
May 16, 2026
Merged

chore: small cleanups#56
aicayzer merged 6 commits into
mainfrom
chore/review-followups

Conversation

@aicayzer
Copy link
Copy Markdown
Owner

@aicayzer aicayzer commented May 16, 2026

Six small cleanups:

  • Drop dead waveform field on Recording and stale references
  • Use async showMessageBox in the update-downloaded handler
  • Document the watcher's grandchild limitation
  • Remove a stale path from the auto-detect candidates
  • Cover the sw:// protocol path-traversal guard with tests
  • Tighten the modeByWeekFlat typing

See per-commit messages for full rationale.

aicayzer added 6 commits May 16, 2026 16:34
The `waveform?: number[]` field on Recording had no readers, no writers
(verified across src/), and a docstring promising Web Audio decoding
that doesn't exist. The visual waveform was replaced by AudioProgressBar
some time ago; this removes the leftover type and the two stale
user-facing strings that still mentioned "audio + waveform".

- src/shared/types.ts: remove waveform field + docstring
- src/preload/api.ts: trim "audio player + waveform" -> "audio player"
- src/renderer/src/state/configStore.ts: same trim on transcriptsOnly
- src/renderer/src/screens/Settings.tsx: same trim on the user-facing
  toggle description
showMessageBoxSync blocks the main process for the entire time the
"Restart / Later" prompt is on screen — watcher events queue, IPC
handlers stop responding, the auto-updater's own event loop pauses.
Swap to the async form with a .then on the result so main keeps
pumping events while the user decides. Buttons, default/cancel ids,
title, message, detail, and the quitAndInstall branch are unchanged.
fs.watch only fires for direct-child changes on macOS. New recordings
land in a fresh `<timestamp>/` folder under the root (direct child →
fires), but if SuperWhisper ever mutates an *existing* recording's
meta.json in place (transcript correction, model upgrade, llmResult
population), that's a grandchild change and this watcher misses it.
Reindex is the workaround.

Future-me will want to know this without re-reading the docs. No code
change.
The second entry in CANDIDATE_PATHS — ~/Services/superwhisper/recordings
— is the author's local layout, not a SuperWhisper-canonical path. It's
harmless (just a probe) but is a fingerprint in a public repo and a
phantom probe that will never resolve on any other user's machine.

Leaves the canonical macOS path
(~/Library/Application Support/com.superduper.superwhisper/recordings)
as the only auto-detect target. Non-standard installs use the folder
picker in the welcome modal or Settings.
The protocol handler does real defence at protocol.ts:102 — the
target's resolved absolute path must start with the configured root
prefix. That's the kind of security-shaped check that deserves a test
pinning it, especially against future refactors.

- traversal rejection via URL-encoded `..` (the literal form is
  normalised away by the URL parser, so the encoded form is the real
  attack surface)
- wrong host rejection
- no recordings folder configured -> 404
- id-only URL with no file segment -> 404
- non-existent file at a valid path -> 404
- happy path delegates to net.fetch with the resolved file:// URL

Mocks electron's `protocol.handle` to capture the registered handler
and `net.fetch` as a spy, mirroring the vi.hoisted shape established
in config.test.ts.
The rows always carry the ISO-week date string under "date" plus one
numeric count per mode key. `Record<string, string | number>` reflects
that shape exactly. The previous `unknown` form forced consumers
(Recharts cells in particular) to cast at the access site or accept a
less precise type than the data warrants.

Behaviour-equivalent — Recharts only cares that values are
serialisable. Tests and typecheck stay green.
@aicayzer aicayzer changed the title chore: pre-release cleanups chore: small cleanups May 16, 2026
@aicayzer aicayzer merged commit cc28614 into main May 16, 2026
3 checks passed
@aicayzer aicayzer deleted the chore/review-followups branch May 18, 2026 21:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant