fix: clippy embed ifs + Retranscribe Menu argument order

[div0-space]

Stacked on #78 (feat/site-voice-lab @ 9af80e1f).

• Collapse nested if in core/build.rs so pre-push clippy (-D collapsible_if) passes.
• Overlay Retranscribe Menu: label before primaryAction (xcodebuild error 65).

Does not include the unstaged Voice Lab site CSS on the working tree.

Authored-By: grok agents@vetcoders.io

[claude]

⚠️ Code review skipped — your organization has reached its monthly code review spending cap.

An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.

Once the cap resets or is raised, reopen this pull request to trigger a review.

[Copilot]

Pull request overview

This PR is a small maintenance/compatibility fix stacked on #78, aimed at keeping local/CI tooling green by addressing a Clippy lint in the Rust build script and fixing SwiftUI Menu trailing-closure argument ordering that was causing an Xcode build failure.

Changes:

• Refactors resolve_whisper_embed_model_path in core/build.rs to avoid nested if blocks by using a single if with && let chaining.
• Reorders SwiftUI Menu trailing closures so label precedes primaryAction, matching the initializer’s expected argument order.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
macos/Codescribe/Screens/Overlay/DictationOverlayView.swift	Reorders Menu trailing-closure arguments (label before primaryAction) to resolve Xcode build error.
core/build.rs	Collapses nested conditionals in Whisper embed model path resolution to satisfy Clippy’s collapsible_if lint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Suppressed comments (2)

Makefile:202

• BIT can be 1 because developer-surface-gate.sh accepts SPARKLE_ED_PUBLIC_KEY from the environment, but install-app always re-reads SPARKLE from $(CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE) and then overwrites SPARKLE_ED_PUBLIC_KEY (possibly with an empty string). This can make the xcodebuild embed step see an empty SPARKLE_ED_PUBLIC_KEY even though the gate passed.

	echo "Developer surface: 1 (Sparkle + license public keys from the org Voice Lab pack)."; \
	SPARKLE=$$(tr -d '[:space:]' < "$(CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE)" 2>/dev/null || true); \
	env -u CODESCRIBE_LICENSE_PUBLIC_KEY_HEX \
	  CODESCRIBE_DEVELOPER_SURFACE=1 \
	  SPARKLE_ED_PUBLIC_KEY="$$SPARKLE" \

core/quality/engine_contract.rs:41

• meta_content_is() claims to require a tag, but it currently accepts any tag that contains both attributes (e.g.
  ). That weakens the handshake guarantee that the value is carried via meta tags specifically.

/// True when a `<meta>` tag carries both `name` and `content` on the same tag.
/// Prose elsewhere in the document does not satisfy the handshake.
fn meta_content_is(html: &str, name: &str, content: &str) -> bool {
    let name_attr = format!(r#"name="{name}""#);
    let content_attr = format!(r#"content="{content}""#);
    let mut rest = html;
    while let Some(name_at) = rest.find(&name_attr) {
        let before = &rest[..name_at];
        let tag_start = before.rfind('<').unwrap_or(0);
        let after = &rest[name_at..];
        let tag_end = after.find('>').unwrap_or(after.len());
        let tag = &rest[tag_start..name_at + tag_end];
        if tag.contains(&content_attr) {
            return true;
        }

[Copilot]

Pull request overview

Copilot reviewed 32 out of 32 changed files in this pull request and generated no new comments.

Suppressed comments (6)

scripts/install-voice-lab.sh:42

• remote_is_voice_lab() only checks whether the URL contains the substring "voice-lab". That would accept unrelated repos (e.g. an attacker-controlled "voice-lab-mirror") and then this script will git clone and execute setup.sh from it. Since this is effectively remote code execution, the URL should be validated strictly (e.g. github.com + exact org/repo vetcoders/voice-lab in both SSH and HTTPS forms).

remote_is_voice_lab() {
  local url="$1"
  [[ "$url" == *voice-lab* ]]
}

core/stt/request_vocabulary.rs:56

• This test asserts that arbitrary custom hosts (stt.example.test) receive the vocabulary token. If vocabulary emission is limited to known hosts that accept the field, this expectation should be updated so custom providers stay compatible by default.

        assert_eq!(
            codescribe_stt_vocabulary("https://stt.example.test/v1/audio/transcriptions"),
            Some("programming")
        );

core/stt/request_vocabulary.rs:25

• codescribe_stt_vocabulary() currently returns "programming" for any non-OpenAI host. Codescribe supports custom STT_ENDPOINT values (e.g. https://custom.example/v1/audio/transcriptions), and many OpenAI-compatible servers reject unknown multipart fields. To avoid breaking custom providers, restrict the vocabulary field to known endpoints that actually accept it (loopback + *.libraxis.cloud) and omit it elsewhere.

This issue also appears on line 53 of the same file.

pub fn codescribe_stt_vocabulary(endpoint: &str) -> Option<&'static str> {
    let host = Url::parse(endpoint).ok().and_then(|url| {
        url.host_str()
            .map(|host| host.trim_matches(['[', ']']).to_owned())
    })?;
    if host.eq_ignore_ascii_case("api.openai.com") {
        return None;
    }
    Some(CODESCRIBE_STT_VOCABULARY)
}

docs/INSTALLATION.md:50

• The updated docs describe extra developer-console pieces as "resolved ... when present", which implies make install-app still works without private Voice Lab access. The Makefile now hard-depends on install-voice-lab and fails if the developer-surface keys are unavailable, so make install-app is effectively org-only/fail-closed. The documentation should be updated to reflect that behavior (and point public builds at make app).

`make install-app` builds the local-release app and copies it to
`/Applications`. Extra developer-console pieces are resolved from a
private sibling checkout when present; they are not part of the public
source path. A machine that already has `settings.json` keeps it.
Production DMGs do not bake the developer surface.

README.md:409

• The Makefile target list now describes make install-app as a generic local install, but the target is fail-closed and depends on installing the private Voice Lab pack + resolving keys. This entry should mention that it is org-only so public builders don’t hit a confusing failure path.

make app              # Debug SwiftUI app build
make app PROFILE=local-release # Optimized local SwiftUI app build
make install-app      # Local-release install to /Applications
make release-stable   # Everyday: notarize slim DMG + install that stapled .app

CHANGELOG.md:16

• The PR title/description mentions only a small clippy fix and a Swift Menu argument-order fix, but this PR also includes substantial behavior changes (Layer 1 coalescing + rewrite rules, STT vocabulary signaling, install-app/Voice Lab tooling). Please update the PR description (or split the changes) so reviewers can validate the intended scope and risk.

### Changed

- **Layer 1 applies aligned same-utterance wording.** When live Apple and
  the Whisper window share most words, Layer 1 now substitutes those
  spans instead of discarding the repair at the 50% change cap. Unrelated
  dumps and pause-tail inserts still skip.
- **Layer 1 Whisper windows join about five Apple segments.** Short

[Copilot]

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated no new comments.

Suppressed comments (5)

scripts/install-voice-lab.sh:42

• remote_is_voice_lab currently accepts any URL containing the substring voice-lab, which is too weak for a guard that claims to ensure the org-only repo. This can allow unintended repos/hosts to pass the check. Tighten the matcher to known-good GitHub URL forms for vetcoders/voice-lab.

remote_is_voice_lab() {
  local url="$1"
  [[ "$url" == *voice-lab* ]]
}

Makefile:53

• CODESCRIBE_LICENSE_PUBLIC_KEY_FILE can now resolve to an empty string when neither key file exists; in that case $(shell cat $(CODESCRIBE_LICENSE_PUBLIC_KEY_FILE) ...) becomes cat with no path, which reads stdin and can hang make (or at least produces non-deterministic results). Guard the cat with a non-empty-path check so missing files fail closed without blocking.

CODESCRIBE_LICENSE_PUBLIC_KEY_FILE ?= $(firstword $(wildcard $(HOME)/.codescribe/config/dev/keys/license-public.hex $(HOME)/.vibecrafted/secrets/codescribe/license-public.hex))
CODESCRIBE_DIST_LICENSE_KEY = $(if $(CODESCRIBE_LICENSE_PUBLIC_KEY_HEX),$(CODESCRIBE_LICENSE_PUBLIC_KEY_HEX),$(shell cat $(CODESCRIBE_LICENSE_PUBLIC_KEY_FILE) 2>/dev/null | tr -d '[:space:]'))

Makefile:62

• Same issue as the license key: if CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE resolves to empty, cat runs with no filename and may block waiting for stdin. Guard the shell read so missing files don’t hang make evaluation.

CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE ?= $(firstword $(wildcard $(HOME)/.codescribe/config/dev/keys/sparkle-public.b64 $(HOME)/.vibecrafted/secrets/codescribe/sparkle-public.b64))
CODESCRIBE_DIST_SPARKLE_KEY = $(if $(SPARKLE_ED_PUBLIC_KEY),$(SPARKLE_ED_PUBLIC_KEY),$(shell cat $(CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE) 2>/dev/null | tr -d '[:space:]'))

scripts/install-if-idle.sh:20

• The Transcript Bus probe reads the entire JSONL into memory (read().splitlines()) and only then keeps the last 4000 lines. If the bus file grows large, this makes install-if-idle slow and memory-heavy. Iterate with a bounded deque so you only retain the tail you need.

try:
    lines = open(path, encoding="utf-8", errors="replace").read().splitlines()
except OSError:
    raise SystemExit(1)
for raw in lines[-4000:]:

core/build.rs:481

• PR metadata says this change set is limited to a clippy fix in core/build.rs and a SwiftUI Menu argument reorder, but this PR includes substantial additional behavior changes (new install scripts/targets, STT vocabulary token, Layer 1 coalescing, docs/changelog updates, new UI mark, etc.). Please update the PR title/description (or split into focused PRs) so reviewers can evaluate the full scope appropriately.

    if embed_model.contains('/')
        && let Some(snapshot) = find_hf_snapshot(embed_model)
        && whisper_dir_complete(&snapshot)
    {
        return snapshot;

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

README.md:409

• make install-app is described as a generic local-release install, but the Makefile now hard-requires install-voice-lab and will fail closed unless the dev key pack (Sparkle + license public keys) is present. The README target list should mention this prerequisite to avoid misleading new contributors.

make app              # Debug SwiftUI app build
make app PROFILE=local-release # Optimized local SwiftUI app build
make install-app      # Local-release install to /Applications
make release-stable   # Everyday: notarize slim DMG + install that stapled .app

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated no new comments.

Suppressed comments (5)

scripts/install-voice-lab.sh:42

• VOICE_LAB_REPO_URL validation is too permissive: remote_is_voice_lab only checks for the substring voice-lab, so a non-org repo like https://github.com/someone/voice-lab-malware.git would pass and be cloned/executed via setup.sh. Tighten the check to the expected vetcoders/voice-lab repository URL forms.
  macos/Codescribe/Core/VoiceLabRuntime.swift:92
• VoiceLabRuntime.isListening mutates ok from a URLSession callback thread while reading it on the caller thread, with no synchronization. Even though a semaphore is used, the unsynchronized shared mutable state can still trigger race warnings and is brittle. Guard reads/writes with a lock (or switch to an async data(for:) path).
  scripts/install-voice-lab.sh:115
• VOICE_LAB_INSTALL_SETTINGS=1 is documented as “overwrite settings.json”, but seed_app_settings currently returns immediately and performs no overwrite. This makes the env knob a no-op.
  macos/CodescribeTests/OverlayStateTests.swift:157
• OverlayStateTestGate only stores a single continuation; if wait() is called more than once before open(), the earlier continuation is overwritten and will never resume (test deadlock). Store and resume all pending continuations (or explicitly assert single-wait usage).
  core/build.rs:486
• PR description says this change only collapses a clippy if in core/build.rs and fixes a Swift Menu argument order, but the diff includes many additional behavioral changes (install scripts, hotkeys/assistive semantics, STT vocabulary, Layer 1 coalescing, overlay delivery changes, etc.). Please update the PR description (or split the PR) so reviewers can evaluate scope and risk accurately.

    if embed_model.contains('/')
        && let Some(snapshot) = find_hf_snapshot(embed_model)
        && whisper_dir_complete(&snapshot)
    {
        return snapshot;
    } else if embed_model == DEFAULT_MODEL_NAME
        && let Some(snapshot) = find_hf_snapshot(default_repo)
        && whisper_dir_complete(&snapshot)
    {
        return snapshot;

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

macos/Codescribe/Screens/Overlay/OverlayState.swift:908

• Same Sendable issue as formatTranscript(): the Task.detached closure captures engine (non-Sendable). If strict concurrency is enabled, this capture can fail the build; wrap the engine reference in an @unchecked Sendable box (or otherwise ensure it’s Sendable).
  core/quality/engine_contract.rs:41
• meta_content_is() claims to validate that a tag contains both attributes, but the implementation does not ensure the match is actually inside a <meta ...> element (it just searches backward to the previous '<'). This can accept non-meta tags (or accidental prose) that include name/content attributes, weakening the handshake.

/// True when a `<meta>` tag carries both `name` and `content` on the same tag.
/// Prose elsewhere in the document does not satisfy the handshake.
fn meta_content_is(html: &str, name: &str, content: &str) -> bool {
    let name_attr = format!(r#"name="{name}""#);
    let content_attr = format!(r#"content="{content}""#);

CHANGELOG.md:15

• The PR title/description mentions only the clippy collapsible_if fix and the Menu argument order change, but this PR includes substantial additional behavior changes (e.g., install scripts/targets, clipboard delivery semantics, Voice Lab runtime spawning, hotkey behavior, STT vocabulary/topic token, Layer 1 coalescing). Please update the PR description/title (or split the PR) so reviewers can validate the full scope intentionally.

### Fixed

- **`make install-app` accepts keys from Get license.** A keyed local
  install verifies CSK1 with the same public key the site signs. The
  forgeable development verifier is no longer baked into that path.
- **Refused paste does not steal the user's clipboard.** Synthetic Cmd+V

[Copilot]

Pull request overview

Copilot reviewed 59 out of 59 changed files in this pull request and generated no new comments.

Suppressed comments (3)

Makefile:62

• CODESCRIBE_DIST_SPARKLE_KEY has the same stdin-hang risk as the license key: when $(CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE) is empty, cat is invoked with no path and can block waiting for stdin. Add a guard so missing local key files fail closed without hanging.

CODESCRIBE_DIST_SPARKLE_KEY = $(if $(SPARKLE_ED_PUBLIC_KEY),$(SPARKLE_ED_PUBLIC_KEY),$(shell cat $(CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE) 2>/dev/null | tr -d '[:space:]'))

Makefile:53

• CODESCRIBE_DIST_LICENSE_KEY shells out to cat $(CODESCRIBE_LICENSE_PUBLIC_KEY_FILE); if the wildcard finds no file, the variable expands empty and cat runs with no arguments (reads stdin), which can hang make invocations in interactive shells/CI. Guard the read so the shell command is a no-op when the file var is empty.

This issue also appears on line 62 of the same file.

CODESCRIBE_DIST_LICENSE_KEY = $(if $(CODESCRIBE_LICENSE_PUBLIC_KEY_HEX),$(CODESCRIBE_LICENSE_PUBLIC_KEY_HEX),$(shell cat $(CODESCRIBE_LICENSE_PUBLIC_KEY_FILE) 2>/dev/null | tr -d '[:space:]'))

app/controller/mod.rs:1084

• arm_or_copy_deferred_payload returns OverlayPasteDelivery::DeferredInsertArmed even when deferred_insert_registration is Unavailable. Downstream UI typically treats DeferredInsertArmed as “press to paste”, but in this branch deferred_insert_shortcut stays None and only deferred_insert_failure is set—so consumers can easily prompt a shortcut that is disabled/unregistered/conflicted. Consider introducing a distinct delivery outcome for “parked but no Paste Here shortcut available”, or ensure every DeferredInsertArmed result carries a usable shortcut label that will actually work.

            DeferredInsertRegistration::Unavailable { reason } => {
                *registration_failure = Some(reason);
                // Slot is armed. The chord is not bound, so the overlay stays
                // the visible buffer. Do not steal the user's clipboard.
                Ok(OverlayPasteDelivery::DeferredInsertArmed)
            }

[Copilot]

Pull request overview

Copilot reviewed 60 out of 60 changed files in this pull request and generated no new comments.

Suppressed comments (4)

macos/Codescribe/Core/VoiceLabRuntime.swift:88

• isListening mutates ok from the URLSession callback while reading it on the caller thread. Even though the semaphore orders execution, this is still a data race under Swift concurrency/thread sanitizers. Consider guarding the shared state (or switching to an async URLSession.data(for:) implementation).
  macos/Codescribe/Screens/Overlay/OverlayState.swift:830
• Task.detached requires a @Sendable closure; capturing engine (a non-Sendable AnyObject protocol) can become a Swift 6 strict-concurrency compile error and/or introduce thread-safety risk if the engine implementation isn’t actually safe off the MainActor. If you need this to run off-main, consider moving the heavy work behind a Sendable/actor boundary (or marking the engine implementation @unchecked Sendable with an explicit thread-safety justification).
  macos/Codescribe/Screens/Overlay/OverlayState.swift:1027
• In the .deferredInsertArmed path, the UI always falls back to showing ⌘⌥V even when the Paste Here shortcut is unavailable (i.e., deferredInsertShortcut == nil and deferredInsertFailure contains the reason). This can instruct users to press a chord that isn't bound/registered. Prefer showing the actual shortcut when present; otherwise surface the failure reason (or a neutral "buffered" label).
  CHANGELOG.md:16
• The PR description lists only a clippy collapsible_if fix and a SwiftUI Menu argument-order fix, but this diff also includes large functional changes (install tooling, delivery-route/paste semantics, Voice Lab runtime spawning, hotkey/selection attach behavior, Layer 1 coalescing, STT vocabulary token, etc.). This makes review and risk assessment harder; consider updating the PR description to reflect the actual scope (or splitting into smaller PRs if possible).

### Fixed

- **`make install-app` accepts keys from Get license.** A keyed local
  install verifies CSK1 with the same public key the site signs. The
  forgeable development verifier is no longer baked into that path.
- **Refused paste does not steal the user's clipboard.** Synthetic Cmd+V
  still snapshots and restores after a confirmed paste into a foreign app.

[Copilot]

Pull request overview

Copilot reviewed 62 out of 62 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

app/controller/overlay_paste.rs:152

• confirm_latched_paste_target reports activation_confirmed=true for Codescribe, but we don't actually activate/confirm focus for that case. Downstream, that can cause a paste to be treated as confirmed even when the frontmost app is unknown or mismatched.

    if target_is_self_app(name) {
        return true;
    }

[Copilot]

Pull request overview

Copilot reviewed 65 out of 65 changed files in this pull request and generated no new comments.

Suppressed comments (3)

docs/INSTALLATION.md:50

• This section says Voice Lab pieces are only resolved from a private sibling checkout “when present”, but make install-app now unconditionally runs scripts/install-voice-lab.sh (which will attempt to probe/clone the org-private repo and fail closed if access is missing). The docs should state that make install-app is org-only and will fail without voice-lab repo access, and point external contributors to make app instead.
  macos/Codescribe/Screens/Overlay/OverlayState.swift:1026
• When deferred insert is armed, the footer notice defaults to showing “⌘⌥V” even if the Paste Here chord is disabled or registration failed (in which case deferredInsertFailure is populated and deferredInsertShortcut may be nil). This can mislead the operator into trying a shortcut that won’t work.
  CHANGELOG.md:14
• The PR description mentions only a Clippy fix and a SwiftUI Menu argument-order fix, but this change set includes substantial additional work (install-app/Voice Lab runtime, delivery-route changes, Layer 1 coalescing, STT vocabulary token, etc.). Please update the PR description (and/or split the PR) so the review scope is explicit and matches what’s being merged.

### Fixed

- **`make install-app` accepts keys from Get license.** A keyed local
  install verifies CSK1 with the same public key the site signs. The
  forgeable development verifier is no longer baked into that path.