release: 0.5.5

[NeikiDev]

JLab Desktop 0.5.5

Patch release. Security hardening, one display fix, and an internal endpoint swap. No new features, no breaking changes.

Changed

• Status probe moved from /api/stats to the new /api/public/heartbeat endpoint. The 60s liveness poll no longer pulls the heavy stats aggregation just to read the deploy version. No UI change. After this, the app talks only to /api/public/* (static-scan, threat-intel, heartbeat).

Fixed

• Windows history rows recorded under the extended-length path form (\\?\C:\...) now render the way a user types them (C:\..., and \\?\UNC\server\share becomes \\server\share). Display only; stored values and scan logic are unchanged.
• Release workflow now uses a randomized heredoc delimiter when building the release body, so a CHANGELOG.md line matching the old fixed delimiter can no longer inject into the step output. CI-only.

Security

• The folder watcher refuses to watch credential/config folders (.ssh, .gnupg, .aws, .docker, .kube, .config/git, .config/gh) and the user's home directory itself. Stops secret-laden paths from landing in debug.log.
• open_url now restricts GitHub URLs to the repo root and source-only sub-paths (releases, tree, blob, tag, commits). Issue, wiki, discussion, pulls, and security paths are rejected. Shrinks the open-redirect blast radius.
• The watcher coalesce window (coalesce_window_ms) is no longer read from or written to watcher-settings.json, so a hand-edited settings file can no longer delay the next "threat found" toast.
• Removed the unused core:webview:allow-internal-toggle-devtools capability from the Tauri capability set. SECURITY.md's permission list is synced to capabilities/default.json.

Audit

• tsc, cargo fmt --check, cargo clippy -D warnings, and cargo test (132 passed) all green on dev.
• README.md, SECURITY.md, and CHANGELOG.md reviewed and updated. Stale changelog link refs (0.5.3 / 0.5.4) restored.
• Version bumped to 0.5.5 across package.json, package-lock.json, tauri.conf.json, Cargo.toml, Cargo.lock.

Merging to main triggers the release workflow, which builds the bundles, attaches them to a GitHub Release, and tags v0.5.5.