[PR #1] [MERGED] Harden config storage, fix toggle concurrency, and validate local Whisper install #1

New Issue

2026-08-08T18:06:17Z

jahruz67 commented

2026-08-08 18:06:17 +00:00

📋 Pull Request Information

Original PR: https://github.com/jahruz67/wisp-open/pull/1
Author: @jahruz67
Created: 5/15/2026
Status: ✅ Merged
Merged: 5/15/2026
Merged by: @jahruz67

Base: main ← Head: codex/review-code-for-bugs-and-improvements

📝 Commits (1)

ccf4d61 Harden config storage and fix concurrency/install checks

📊 Changes

3 files changed (+13 additions, -7 deletions)

View changed files

📝 app.go (+5 -3)
📝 internal/config/config.go (+2 -2)
📝 internal/services/whisper/whisper.go (+6 -2)

📄 Description

Motivation

Prevent a data race / lost-debounce when hotkey events fire concurrently by making the toggle debounce atomic.
Reduce the risk of leaking sensitive data by restricting config directory/file permissions to user-only.
Avoid incorrect "installed" states or panics when installed.json contains unknown or corrupted model names by validating the model key before using it.

Description

Replaced shared time.Time debounce state with an atomic int64 nanosecond timestamp in App.ToggleRecording to make debounce checks thread-safe (app.go).
Tightened config storage permissions when creating the config directory and writing the file from 0755/0644 to 0700/0600 to limit access to the current user (internal/config/config.go).
Added validation of the model key read from installed.json by checking the Models map before constructing the model path to avoid false-positive install detection (internal/services/whisper/whisper.go).

Testing

Ran go test ./...; the test run attempted to build and failed due to missing native Linux desktop dependencies (X11/extensions/XTest.h for robotgo and the ayatana-appindicator3-0.1 pkg-config package), which caused internal/ui/tray and the overall build to fail in this environment.
No package-level unit test failures were caused by these code changes; the run was blocked by external native dependencies required to compile desktop integration code.

Codex Task

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/jahruz67/wisp-open/pull/1 **Author:** [@jahruz67](https://github.com/jahruz67) **Created:** 5/15/2026 **Status:** ✅ Merged **Merged:** 5/15/2026 **Merged by:** [@jahruz67](https://github.com/jahruz67) **Base:** `main` ← **Head:** `codex/review-code-for-bugs-and-improvements` --- ### 📝 Commits (1) - [`ccf4d61`](https://github.com/jahruz67/wisp-open/commit/ccf4d6184c036ddd7ee88d1d618e3cafbe50d606) Harden config storage and fix concurrency/install checks ### 📊 Changes **3 files changed** (+13 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `app.go` (+5 -3) 📝 `internal/config/config.go` (+2 -2) 📝 `internal/services/whisper/whisper.go` (+6 -2) </details> ### 📄 Description ### Motivation - Prevent a data race / lost-debounce when hotkey events fire concurrently by making the toggle debounce atomic. - Reduce the risk of leaking sensitive data by restricting config directory/file permissions to user-only. - Avoid incorrect "installed" states or panics when `installed.json` contains unknown or corrupted model names by validating the model key before using it. ### Description - Replaced shared `time.Time` debounce state with an atomic `int64` nanosecond timestamp in `App.ToggleRecording` to make debounce checks thread-safe (`app.go`). - Tightened config storage permissions when creating the config directory and writing the file from `0755/0644` to `0700/0600` to limit access to the current user (`internal/config/config.go`). - Added validation of the model key read from `installed.json` by checking the `Models` map before constructing the model path to avoid false-positive install detection (`internal/services/whisper/whisper.go`). ### Testing - Ran `go test ./...`; the test run attempted to build and failed due to missing native Linux desktop dependencies (`X11/extensions/XTest.h` for `robotgo` and the `ayatana-appindicator3-0.1` pkg-config package), which caused `internal/ui/tray` and the overall build to fail in this environment. - No package-level unit test failures were caused by these code changes; the run was blocked by external native dependencies required to compile desktop integration code. ------ [Codex Task](https://chatgpt.com/codex/cloud/tasks/task_e_6a0685a3cc44832eb15a7b50f815a92f) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

jahruz67 added the pull-request label 2026-08-08 18:06:17 +00:00

jahruz67 closed this issue

2026-08-08 18:06:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: jahruz67/wisp-open#1