Harden config storage and fix concurrency/install checks

app.go

@@ -144,14 +144,16 @@ func (a *App) Quit() {
 	wailsruntime.Quit(a.ctx)
 }
 
-var lastToggle time.Time
+var lastToggleUnixNano int64
 
 func (a *App) ToggleRecording() {
 	// Debounce toggle calls to prevent rapid firing from double-binds or Wayland glitches
-	if time.Since(lastToggle) < 500*time.Millisecond {
+	now := time.Now().UnixNano()
+	last := atomic.LoadInt64(&lastToggleUnixNano)
+	if last != 0 && time.Duration(now-last) < 500*time.Millisecond {
 		return
 	}
-	lastToggle = time.Now()
+	atomic.StoreInt64(&lastToggleUnixNano, now)
 
 	if atomic.LoadInt32(&a.recording) == 1 {
 		a.StopRecording()

internal/config/config.go

@@ -89,7 +89,7 @@ func Save(c *Config, configPath string) error {
 
 	// Ensure the directory exists
 	dir := filepath.Dir(configPath)
-	if err := os.MkdirAll(dir, 0755); err != nil {
+	if err := os.MkdirAll(dir, 0700); err != nil {
 		return err
 	}
 
@@ -98,7 +98,7 @@ func Save(c *Config, configPath string) error {
 		return err
 	}
 
-	return os.WriteFile(configPath, data, 0644)
+	return os.WriteFile(configPath, data, 0600)
 }
 
 // GetConfigPath returns the default configuration file path.

internal/services/whisper/whisper.go

@@ -74,7 +74,12 @@ func (m *Manager) IsInstalled() bool {
 		return false
 	}
 
-	modelPath := filepath.Join(m.installDir, Models[info.Model].Filename)
+	modelInfo, ok := Models[info.Model]
+	if !ok || modelInfo.Filename == "" {
+		return false
+	}
+
+	modelPath := filepath.Join(m.installDir, modelInfo.Filename)
 	if _, err := os.Stat(modelPath); os.IsNotExist(err) {
 		return false
 	}
@@ -445,4 +450,3 @@ func downloadFile(url, dest string, progress chan<- DownloadProgress) error {
 	return nil
 }
 
-