test(relay): reproduce password rejection lost on hosted relay close

Preserve the failing client-path reproduction for #7929 and a close-timing control. The hosted relay loses the rejection after the daemon send completes; the internal relay cause and proposed upstream correction still require verification.

Co-authored-by: ThePharmer <77949461+ThePharmer@users.noreply.github.com>

.github/workflows/desktop-release.yml

@@ -169,6 +169,34 @@ jobs:
           NODE_OPTIONS: --max-old-space-size=${{ matrix.node_heap_mb }}
         run: |
           set -euo pipefail
+          export PASEO_REAL_XCRUN="$(command -v xcrun)"
+          stapler_bin="$(mktemp -d)"
+          trap 'rm -rf "$stapler_bin"' EXIT
+          cat > "$stapler_bin/xcrun" <<'STAPLER'
+          #!/bin/bash
+          if [[ "${1:-}" != stapler || "${2:-}" != staple ]]; then
+            exec "$PASEO_REAL_XCRUN" "$@"
+          fi
+          output="$(mktemp)"
+          trap 'rm -f "$output"' EXIT
+          for attempt in 1 2 3 4; do
+            if "$PASEO_REAL_XCRUN" "$@" >"$output" 2>&1; then
+              cat "$output"
+              exit 0
+            else
+              status=$?
+            fi
+            cat "$output"
+            if [[ "$status" != 68 || "$attempt" == 4 ]] ||
+              ! grep -Fq 'NSURLErrorDomain Code=-1005' "$output"; then
+              exit "$status"
+            fi
+            echo "::warning::Apple staple connection lost; retrying the same signed app ($attempt/4)" >&2
+            sleep 30
+          done
+          STAPLER
+          chmod +x "$stapler_bin/xcrun"
+          export PATH="$stapler_bin:$PATH"
           build_args=(-- --publish never --mac --${{ matrix.electron_arch }})
           build_args+=("-c.publish.releaseType=$RELEASE_TYPE")
           build_args+=("-c.publish.channel=$RELEASE_CHANNEL")

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.13.2 - 2026-10-26
+
+### Fixed
+
+- Fixed repeated Android animation exceptions for views that have already unmounted ([#7907](https://github.com/getpaseo/paseo/pull/7907))
+- Fixed the Android animation run loop continuing while the app is in the background ([#7914](https://github.com/getpaseo/paseo/pull/7914))
+- Fixed finished Android chat messages being remeasured during streaming updates ([#7914](https://github.com/getpaseo/paseo/pull/7914))
+- Fixed bottom sheets retaining window-size listeners after closing ([#7914](https://github.com/getpaseo/paseo/pull/7914))
+
 ## 0.13.1 - 2026-10-26
 
 ### Fixed

CHANGELOG.zh-CN.md

@@ -1,5 +1,14 @@
 # 更新日志
 
+## 0.13.2 - 2026-10-26
+
+### 修复
+
+- 修复 Android 对已卸载视图反复抛出动画异常的问题 ([#7907](https://github.com/getpaseo/paseo/pull/7907))
+- 修复 Android 应用进入后台后动画运行循环仍持续执行的问题 ([#7914](https://github.com/getpaseo/paseo/pull/7914))
+- 修复 Android 在流式更新时反复测量已完成聊天消息的问题 ([#7914](https://github.com/getpaseo/paseo/pull/7914))
+- 修复底部面板关闭后仍保留窗口尺寸监听器的问题 ([#7914](https://github.com/getpaseo/paseo/pull/7914))
+
 ## 0.13.1 - 2026-10-26
 
 ### 修复

fastlane/metadata/android/en-US/changelogs/130021.txt

@@ -0,0 +1,7 @@
+Fixed
+- Fixed repeated Android animation exceptions for views that have already unmounted
+- Fixed the Android animation run loop continuing while the app is in the background
+- Fixed finished Android chat messages being remeasured during streaming updates
+- Fixed bottom sheets retaining window-size listeners after closing
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/130022.txt

@@ -0,0 +1,7 @@
+Fixed
+- Fixed repeated Android animation exceptions for views that have already unmounted
+- Fixed the Android animation run loop continuing while the app is in the background
+- Fixed finished Android chat messages being remeasured during streaming updates
+- Fixed bottom sheets retaining window-size listeners after closing
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/130023.txt

@@ -0,0 +1,7 @@
+Fixed
+- Fixed repeated Android animation exceptions for views that have already unmounted
+- Fixed the Android animation run loop continuing while the app is in the background
+- Fixed finished Android chat messages being remeasured during streaming updates
+- Fixed bottom sheets retaining window-size listeners after closing
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/130024.txt

@@ -0,0 +1,7 @@
+Fixed
+- Fixed repeated Android animation exceptions for views that have already unmounted
+- Fixed the Android animation run loop continuing while the app is in the background
+- Fixed finished Android chat messages being remeasured during streaming updates
+- Fixed bottom sheets retaining window-size listeners after closing
+
+Full notes: https://paseo.sh/changelog

nix/npm-deps.hash

@@ -1 +1 @@
-sha256-SKL7TMIuuV3imTIaQc66UDf3n6V3FB0nGSBucJ6rlA0=
+sha256-eNiKmiZ3XXZMRZRSoGxUbMn2RtY6AX079vUatBYM+qE=

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "paseo",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "paseo",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "workspaces": [
@@ -35695,7 +35695,7 @@
     },
     "packages/app": {
       "name": "@getpaseo/app",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
         "@codemirror/commands": "6.10.4",
         "@codemirror/language": "6.12.4",
@@ -37961,12 +37961,12 @@
     },
     "packages/cli": {
       "name": "@getpaseo/cli",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
         "@clack/prompts": "^1.0.0",
-        "@getpaseo/client": "0.13.1",
-        "@getpaseo/protocol": "0.13.1",
-        "@getpaseo/server": "0.13.1",
+        "@getpaseo/client": "0.13.2",
+        "@getpaseo/protocol": "0.13.2",
+        "@getpaseo/server": "0.13.2",
         "chalk": "^5.3.0",
         "commander": "^12.0.0",
         "mime-types": "^2.1.35",
@@ -38213,10 +38213,10 @@
     },
     "packages/client": {
       "name": "@getpaseo/client",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
-        "@getpaseo/protocol": "0.13.1",
-        "@getpaseo/relay": "0.13.1",
+        "@getpaseo/protocol": "0.13.2",
+        "@getpaseo/relay": "0.13.2",
         "ws": "^8.20.0",
         "zod": "^4.4.3"
       },
@@ -38228,7 +38228,7 @@
     },
     "packages/desktop": {
       "name": "@getpaseo/desktop",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@getpaseo/cli": "*",
@@ -38472,7 +38472,7 @@
     },
     "packages/expo-two-way-audio": {
       "name": "@getpaseo/expo-two-way-audio",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "license": "MIT",
       "devDependencies": {
         "@types/jest": "^29.5.14",
@@ -42091,7 +42091,7 @@
     },
     "packages/highlight": {
       "name": "@getpaseo/highlight",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
         "@codemirror/language": "6.12.4",
         "@codemirror/legacy-modes": "^6.5.3",
@@ -42120,15 +42120,15 @@
     },
     "packages/plugin": {
       "name": "@getpaseo/plugin",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.4.0",
         "i18next": "^26.3.0",
         "use-sync-external-store": "^1.6.0"
       },
       "devDependencies": {
-        "@getpaseo/client": "0.13.1",
-        "@getpaseo/protocol": "0.13.1",
+        "@getpaseo/client": "0.13.2",
+        "@getpaseo/protocol": "0.13.2",
         "@types/node": "^20.9.0",
         "@types/react": "~19.2.0",
         "react": "19.2.3",
@@ -42138,8 +42138,8 @@
         "zod": "^4.4.3"
       },
       "peerDependencies": {
-        "@getpaseo/client": "0.13.1",
-        "@getpaseo/protocol": "0.13.1",
+        "@getpaseo/client": "0.13.2",
+        "@getpaseo/protocol": "0.13.2",
         "react": ">=19.1.0 <20",
         "react-native": ">=0.81.5",
         "zod": "^4.4.3"
@@ -42161,7 +42161,7 @@
     },
     "packages/protocol": {
       "name": "@getpaseo/protocol",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
         "semver": "^7.8.5",
         "zod": "^4.4.3"
@@ -42188,7 +42188,7 @@
     },
     "packages/relay": {
       "name": "@getpaseo/relay",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
         "@noble/ciphers": "^2.4.0",
         "@noble/curves": "^2.4.0",
@@ -42409,16 +42409,16 @@
     },
     "packages/server": {
       "name": "@getpaseo/server",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
         "@agentclientprotocol/sdk": "^0.17.1",
         "@anthropic-ai/claude-agent-sdk": "0.3.246",
         "@anthropic-ai/sdk": "^0.104.2",
-        "@getpaseo/client": "0.13.1",
-        "@getpaseo/highlight": "0.13.1",
-        "@getpaseo/plugin": "0.13.1",
-        "@getpaseo/protocol": "0.13.1",
-        "@getpaseo/relay": "0.13.1",
+        "@getpaseo/client": "0.13.2",
+        "@getpaseo/highlight": "0.13.2",
+        "@getpaseo/plugin": "0.13.2",
+        "@getpaseo/protocol": "0.13.2",
+        "@getpaseo/relay": "0.13.2",
         "@isaacs/ttlcache": "^2.1.4",
         "@modelcontextprotocol/sdk": "1.29.0",
         "@opencode-ai/sdk": "1.14.46",
@@ -43339,7 +43339,7 @@
     },
     "packages/website": {
       "name": "@getpaseo/website",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
         "@cloudflare/vite-plugin": "^1.29.1",
         "@cloudflare/workers-types": "^4.20260317.1",
@@ -44949,7 +44949,7 @@
     },
     "plugins": {
       "name": "@getpaseo/builtin-plugins",
-      "version": "0.13.1",
+      "version": "0.13.2",
       "dependencies": {
         "@getpaseo/plugin": "*",
         "zod": "^4.4.3"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "paseo",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "private": true,
   "description": "Paseo: voice-controlled development environment for local AI coding agents",
   "keywords": [

packages/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/app",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "private": true,
   "main": "index.ts",
   "scripts": {

packages/app/src/components/sidebar-workspace-list.tsx

@@ -30,7 +30,7 @@ import {
   type ActiveWorkspaceSelection,
 } from "@/stores/navigation-active-workspace-store";
 import { StyleSheet, withUnistyles } from "react-native-unistyles";
-import { density, densityIconBox } from "@/styles/density";
+import { density, densityIconBox, densityIconProps } from "@/styles/density";
 import type { Theme } from "@/styles/theme";
 import type { SidebarSurfaceBackdrop } from "@/styles/surface-backdrop";
 import { getSidebarRowBackdrop } from "@/components/sidebar/sidebar-row-backdrop";
@@ -463,12 +463,12 @@ const openInNewWindowLeadingIcon = (
   <ThemedExternalLink size={14} uniProps={foregroundMutedColorMapping} />
 );
 
+const kebabTriggerIconProps = densityIconProps("sm", foregroundMutedColorMapping);
+const kebabTriggerIconHoveredProps = densityIconProps("sm", foregroundColorMapping);
+
 function renderKebabTriggerIcon({ hovered }: { hovered?: boolean }) {
   return (
-    <ThemedMoreVertical
-      size={14}
-      uniProps={hovered ? foregroundColorMapping : foregroundMutedColorMapping}
-    />
+    <ThemedMoreVertical uniProps={hovered ? kebabTriggerIconHoveredProps : kebabTriggerIconProps} />
   );
 }
 
@@ -2705,8 +2705,12 @@ const styles = StyleSheet.create((theme) => ({
     marginRight: -6,
   },
   projectKebabButton: {
-    width: 24,
-    height: 24,
+    // Larger on compact so the kebab is an easy tap target. The negative margins keep its
+    // dots on the same rail as the 24px desktop box and the row at its 44px height.
+    width: { xs: 32, md: 24 },
+    height: { xs: 32, md: 24 },
+    marginRight: { xs: -4, md: 0 },
+    marginVertical: { xs: -4, md: 0 },
     borderRadius: theme.borderRadius.md,
     alignItems: "center",
     justifyContent: "center",

packages/app/src/components/sidebar/sidebar-workspace-menu.tsx

@@ -17,6 +17,7 @@ import { isWeb } from "@/constants/platform";
 import { getForgePresentation, normalizeForge } from "@/git/forge";
 import type { SidebarWorkspaceEntry } from "@/hooks/use-sidebar-workspaces-list";
 import { useAppSettings } from "@/hooks/use-settings";
+import { densityIconProps } from "@/styles/density";
 import type { Theme } from "@/styles/theme";
 import type { ShortcutKey } from "@/utils/format-shortcut";
 import {
@@ -70,13 +71,11 @@ const archiveLeadingIcon = <ThemedArchive size={14} uniProps={foregroundMutedCol
 const pinLeadingIcon = <ThemedPin size={14} uniProps={foregroundMutedColorMapping} />;
 const unpinLeadingIcon = <ThemedPinOff size={14} uniProps={foregroundMutedColorMapping} />;
 
+const triggerIconProps = densityIconProps("sm", foregroundMutedColorMapping);
+const triggerIconHoveredProps = densityIconProps("sm", foregroundColorMapping);
+
 function renderTriggerIcon({ hovered }: { hovered?: boolean }) {
-  return (
-    <ThemedMoreVertical
-      size={14}
-      uniProps={hovered ? foregroundColorMapping : foregroundMutedColorMapping}
-    />
-  );
+  return <ThemedMoreVertical uniProps={hovered ? triggerIconHoveredProps : triggerIconProps} />;
 }
 
 export interface SidebarWorkspaceMenuProps {
@@ -439,12 +438,18 @@ function triggerStyle({ hovered = false }: PressableStateCallbackType & { hovere
 
 const styles = StyleSheet.create((theme) => ({
   trigger: {
-    padding: 2,
+    // Larger on compact so the kebab is an easy tap target.
+    width: { xs: 32, md: 18 },
+    height: { xs: 32, md: 18 },
+    alignItems: "center",
+    justifyContent: "center",
     borderRadius: 4,
     marginLeft: 2,
+    // Center the compact box on the 20px title line it is anchored to.
+    marginTop: { xs: -6, md: 0 },
     // MoreVertical paints only around the center of its SVG. Keep the padded hit box, but
     // pull the painted dots through that unused view-box space onto the trailing-content rail.
-    marginRight: -7,
+    marginRight: { xs: -14, md: -7 },
   },
   triggerHovered: {
     backgroundColor: theme.colors.surface2,

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/cli",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Paseo CLI - control your AI coding agents from the command line",
   "bin": {
     "paseo": "bin/paseo"
@@ -28,9 +28,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.0.0",
-    "@getpaseo/client": "0.13.1",
-    "@getpaseo/protocol": "0.13.1",
-    "@getpaseo/server": "0.13.1",
+    "@getpaseo/client": "0.13.2",
+    "@getpaseo/protocol": "0.13.2",
+    "@getpaseo/server": "0.13.2",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "mime-types": "^2.1.35",

packages/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/client",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Paseo client SDK package",
   "files": [
     "dist",
@@ -47,8 +47,8 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@getpaseo/protocol": "0.13.1",
-    "@getpaseo/relay": "0.13.1",
+    "@getpaseo/protocol": "0.13.2",
+    "@getpaseo/relay": "0.13.2",
     "ws": "^8.20.0",
     "zod": "^4.4.3"
   },

packages/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/desktop",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "private": true,
   "description": "Paseo desktop app (Electron wrapper)",
   "homepage": "https://paseo.sh",

packages/expo-two-way-audio/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/expo-two-way-audio",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Native module for two way audio streaming",
   "keywords": [
     "ExpoTwoWayAudio",

packages/highlight/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/highlight",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "files": [
     "dist",
     "!dist/**/*.map",

packages/plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/plugin",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Paseo plugin SDK package",
   "files": [
     "dist",
@@ -72,8 +72,8 @@
     "use-sync-external-store": "^1.6.0"
   },
   "devDependencies": {
-    "@getpaseo/client": "0.13.1",
-    "@getpaseo/protocol": "0.13.1",
+    "@getpaseo/client": "0.13.2",
+    "@getpaseo/protocol": "0.13.2",
     "@types/node": "^20.9.0",
     "@types/react": "~19.2.0",
     "react": "19.2.3",
@@ -83,8 +83,8 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@getpaseo/client": "0.13.1",
-    "@getpaseo/protocol": "0.13.1",
+    "@getpaseo/client": "0.13.2",
+    "@getpaseo/protocol": "0.13.2",
     "react": ">=19.1.0 <20",
     "react-native": ">=0.81.5",
     "zod": "^4.4.3"

packages/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/protocol",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Paseo shared protocol schemas and wire types",
   "files": [
     "dist",

packages/relay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/relay",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Paseo relay for bridging daemon and client connections",
   "files": [
     "dist",

packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/server",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Paseo backend server",
   "files": [
     "dist/server",
@@ -107,11 +107,11 @@
     "@agentclientprotocol/sdk": "^0.17.1",
     "@anthropic-ai/claude-agent-sdk": "0.3.246",
     "@anthropic-ai/sdk": "^0.104.2",
-    "@getpaseo/client": "0.13.1",
-    "@getpaseo/highlight": "0.13.1",
-    "@getpaseo/plugin": "0.13.1",
-    "@getpaseo/protocol": "0.13.1",
-    "@getpaseo/relay": "0.13.1",
+    "@getpaseo/client": "0.13.2",
+    "@getpaseo/highlight": "0.13.2",
+    "@getpaseo/plugin": "0.13.2",
+    "@getpaseo/protocol": "0.13.2",
+    "@getpaseo/relay": "0.13.2",
     "@isaacs/ttlcache": "^2.1.4",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@opencode-ai/sdk": "1.14.46",

packages/server/src/server/daemon-e2e/relay-auth-rejection.live.e2e.test.ts

@@ -0,0 +1,260 @@
+import { test, expect } from "vitest";
+import { hashSync } from "bcryptjs";
+import { WebSocket } from "ws";
+import { DaemonClient, getDaemonAuthFailureReason } from "@getpaseo/client/internal/daemon-client";
+import { generateLocalPairingOffer } from "../pairing-offer.js";
+import { parseConnectionOfferFromUrl } from "@getpaseo/protocol/connection-offer";
+import { buildRelayWebSocketUrl } from "@getpaseo/protocol/daemon-endpoints";
+import { createTestPaseoDaemon } from "../test-utils/paseo-daemon.js";
+import { randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+import pino from "pino";
+import { generateKeyPair, exportPublicKey } from "@getpaseo/relay/e2ee";
+import { startRelayTransport } from "../relay-transport.js";
+import { admitSecuredRelaySocket } from "../websocket/secure-relay-ingress.js";
+
+const liveTest = process.env.RUN_LIVE_RELAY_E2E === "1" ? test : test.skip;
+
+liveTest(
+  "hosted relay preserves password rejection from a real daemon",
+  async () => {
+    const daemon = await createTestPaseoDaemon({
+      auth: { password: hashSync("diagnostic-password", 4) },
+      relayEnabled: true,
+      relayEndpoint: "relay.paseo.sh:443",
+      relayUseTls: true,
+      mcpEnabled: false,
+      pluginsEnabled: false,
+      agentClients: {},
+    });
+    const observations: Array<Record<string, unknown>> = [];
+    try {
+      const pairing = await generateLocalPairingOffer({
+        paseoHome: daemon.paseoHome,
+        relayEnabled: true,
+        relayEndpoint: "relay.paseo.sh:443",
+        relayUseTls: true,
+        includeQr: false,
+      });
+      const offer = parseConnectionOfferFromUrl(pairing.url!);
+      if (!offer) throw new Error("No relay pairing offer");
+      for (const mode of ["direct", "relay"] as const) {
+        for (const credential of ["missing", "wrong", "correct"] as const) {
+          for (let attempt = 0; attempt < (mode === "relay" ? 3 : 1); attempt++) {
+            const frames: string[] = [];
+            let closeCode: number | null = null;
+            let closeReason: string | null = null;
+            const client = new DaemonClient({
+              url:
+                mode === "direct"
+                  ? `ws://127.0.0.1:${daemon.port}/ws`
+                  : buildRelayWebSocketUrl({
+                      endpoint: "relay.paseo.sh:443",
+                      useTls: true,
+                      serverId: offer.serverId,
+                      role: "client",
+                    }),
+              clientId: `diagnostic-${mode}-${credential}-${attempt}`,
+              clientType: "cli",
+              connectTimeoutMs: 20_000,
+              reconnect: { enabled: false },
+              password: { missing: undefined, wrong: "incorrect", correct: "diagnostic-password" }[
+                credential
+              ],
+              ...(mode === "relay"
+                ? { e2ee: { enabled: true, daemonPublicKeyB64: offer.daemonPublicKeyB64 } }
+                : {}),
+              webSocketFactory: (url, options) => {
+                const socket = new WebSocket(url, options?.protocols, {
+                  headers: options?.headers,
+                });
+                socket.on("message", (data, binary) => frames.push(frameKind(data, binary)));
+                socket.on("close", (code, reason) => {
+                  closeCode = code;
+                  closeReason = reason.toString();
+                });
+                return socket;
+              },
+            });
+            const result = await connectOutcome(client);
+            const observation = {
+              mode,
+              credential,
+              attempt,
+              ...result,
+              frames,
+              closeCode,
+              closeReason,
+            };
+            observations.push(observation);
+            console.log(JSON.stringify(observation));
+          }
+        }
+      }
+    } finally {
+      await daemon.close();
+    }
+    for (const observation of observations) {
+      expect(observation, JSON.stringify(observation)).toMatchObject(
+        observation.credential === "correct"
+          ? { connected: true }
+          : {
+              connected: false,
+              reason:
+                observation.credential === "missing" ? "password_required" : "incorrect_password",
+            },
+      );
+    }
+  },
+  180_000,
+);
+
+async function connectOutcome(client: DaemonClient): Promise<Record<string, unknown>> {
+  try {
+    await client.connect();
+    return { connected: true };
+  } catch (error) {
+    return {
+      connected: false,
+      error: error instanceof Error ? error.message : String(error),
+      reason: getDaemonAuthFailureReason(error),
+    };
+  } finally {
+    await client.close();
+  }
+}
+
+function frameKind(data: WebSocket.RawData, binary: boolean): string {
+  if (binary) return "encrypted-record";
+  try {
+    const parsed = JSON.parse(data.toString());
+    return ["e2ee_ready", "hello.rejected", "session"].includes(parsed.type)
+      ? parsed.type
+      : "other-json";
+  } catch {
+    return "encrypted-record";
+  }
+}
+
+liveTest(
+  "close timing isolates loss after the daemon send callback",
+  async () => {
+    const observations: Array<{
+      delayMs: number;
+      reason: string | null;
+      sendCompleted: boolean;
+      frames: string[];
+    }> = [];
+    for (const delayMs of [0, 500]) {
+      const daemonKeyPair = generateKeyPair();
+      const serverId = `diagnostic-${randomUUID()}`;
+      let markReady!: () => void;
+      const ready = new Promise<void>((resolve) => {
+        markReady = resolve;
+      });
+      let sendCompleted = false;
+      const controller = startRelayTransport({
+        serverId,
+        relayEndpoint: "relay.paseo.sh:443",
+        relayUseTls: true,
+        logger: pino({ level: "silent" }),
+        createWebSocket: (url) => {
+          const socket = new WebSocket(url);
+          if (!new URL(url).searchParams.has("connectionId")) {
+            socket.on("message", (data) => {
+              if (JSON.parse(data.toString()).type === "sync") markReady();
+            });
+          }
+          return socket;
+        },
+        attachSocket: async (raw) =>
+          admitSecuredRelaySocket(
+            raw,
+            {
+              daemonKeyPair,
+              logger: pino({ level: "silent" }),
+              requireProtectedMode: () => false,
+            },
+            async ({ socket }) => {
+              async function rejectHello() {
+                try {
+                  await socket.send(
+                    JSON.stringify({
+                      type: "hello.rejected",
+                      reason: "password_required",
+                      accepts: ["password"],
+                    }),
+                  );
+                  sendCompleted = true;
+                  if (delayMs) await delay(delayMs);
+                  socket.close(4401, "Password required");
+                } catch {
+                  socket.close(1011, "Diagnostic send failed");
+                }
+              }
+              socket.on("message", rejectHello);
+            },
+          ),
+      });
+      try {
+        await Promise.race([
+          ready,
+          new Promise<never>((_resolve, reject) => {
+            const timeout = setTimeout(
+              () => reject(new Error("Relay control did not become ready")),
+              10_000,
+            );
+            timeout.unref();
+          }),
+        ]);
+        for (let attempt = 0; attempt < 3; attempt++) {
+          sendCompleted = false;
+          const frames: string[] = [];
+          const client = new DaemonClient({
+            url: buildRelayWebSocketUrl({
+              endpoint: "relay.paseo.sh:443",
+              useTls: true,
+              serverId,
+              role: "client",
+            }),
+            clientId: `close-timing-${attempt}`,
+            clientType: "cli",
+            reconnect: { enabled: false },
+            connectTimeoutMs: 20_000,
+            e2ee: { enabled: true, daemonPublicKeyB64: exportPublicKey(daemonKeyPair.publicKey) },
+            webSocketFactory: (url) => {
+              const socket = new WebSocket(url);
+              socket.on("message", (data, binary) => frames.push(frameKind(data, binary)));
+              return socket;
+            },
+          });
+          let reason: string | null = null;
+          try {
+            await client.connect();
+          } catch (error) {
+            reason = getDaemonAuthFailureReason(error);
+          } finally {
+            await client.close();
+          }
+          const observation = { delayMs, reason, sendCompleted, frames };
+          observations.push(observation);
+          process.stdout.write(`${JSON.stringify(observation)}\n`);
+        }
+      } finally {
+        await controller.stop();
+      }
+    }
+    expect(observations.filter((item) => item.delayMs === 500)).toEqual(
+      Array.from({ length: 3 }, () => ({
+        delayMs: 500,
+        reason: "password_required",
+        sendCompleted: true,
+        frames: ["e2ee_ready", "encrypted-record"],
+      })),
+    );
+    expect(
+      observations.filter((item) => item.delayMs === 0).every((item) => item.sendCompleted),
+    ).toBe(true);
+  },
+  120_000,
+);

packages/website/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/website",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "private": true,
   "type": "module",
   "scripts": {

plugins/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/builtin-plugins",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "private": true,
   "type": "module",
   "scripts": {

scripts/ci-workflow.test.mjs

@@ -1,5 +1,8 @@
 import assert from "node:assert/strict";
-import { readFileSync, readdirSync } from "node:fs";
+import { readFileSync, readdirSync, mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { relative as relativePath } from "node:path";
 import test from "node:test";
 import { runInNewContext } from "node:vm";
@@ -530,3 +533,111 @@ test("Windows units and integration run independently with complete routed cover
     assert.equal(selected(integrationCondition, outputs, true), false);
   }
 });
+
+test("macOS release retries only transient stapling failures without rebuilding the signed app", async (t) => {
+  const workflow = readFileSync(new URL(".github/workflows/desktop-release.yml", repoRoot), "utf8");
+  const wrapper = workflow
+    .match(/<<'STAPLER'\n([\s\S]*?)\n          STAPLER/)[1]
+    .replace(/^          /gm, "");
+  const networkError =
+    'Error Domain=NSURLErrorDomain Code=-1005 "The network connection was lost."';
+  const cases = [
+    {
+      name: "success",
+      outcomes: [0],
+      output: "stapled",
+      command: "stapler",
+      expected: 0,
+      attempts: 1,
+    },
+    {
+      name: "transient then success",
+      outcomes: [68, 0],
+      output: networkError,
+      command: "stapler",
+      expected: 0,
+      attempts: 2,
+    },
+    {
+      name: "exhausted network retries",
+      outcomes: [68, 68, 68, 68, 0],
+      output: networkError,
+      command: "stapler",
+      expected: 68,
+      attempts: 4,
+    },
+    {
+      name: "non-network staple error",
+      outcomes: [68, 0],
+      output: "ticket not found",
+      command: "stapler",
+      expected: 68,
+      attempts: 1,
+    },
+    {
+      name: "different exit code",
+      outcomes: [1, 0],
+      output: networkError,
+      command: "stapler",
+      expected: 1,
+      attempts: 1,
+    },
+    {
+      name: "notary submission is not retried",
+      outcomes: [68, 0],
+      output: networkError,
+      command: "notarytool",
+      expected: 68,
+      attempts: 1,
+    },
+  ];
+  for (const scenario of cases) {
+    await t.test(scenario.name, () => {
+      const directory = mkdtempSync(join(tmpdir(), "stapler-retry-"));
+      try {
+        const statePath = join(directory, "state.json");
+        const realXcrun = join(directory, "real-xcrun");
+        const wrapperPath = join(directory, "xcrun");
+        writeFileSync(wrapperPath, wrapper, { mode: 0o755 });
+        writeFileSync(join(directory, "sleep"), "#!/bin/sh\nexit 0\n", { mode: 0o755 });
+        writeFileSync(
+          statePath,
+          JSON.stringify({ outcomes: scenario.outcomes, output: scenario.output, calls: [] }),
+        );
+        writeFileSync(
+          realXcrun,
+          `#!/usr/bin/env node
+const fs = require("node:fs");
+const state = JSON.parse(fs.readFileSync(process.env.STAPLER_STATE, "utf8"));
+state.calls.push(process.argv.slice(2));
+const code = state.outcomes.shift();
+fs.writeFileSync(process.env.STAPLER_STATE, JSON.stringify(state));
+console.log(state.output);
+process.exit(code);
+`,
+          { mode: 0o755 },
+        );
+        const args = [scenario.command, "staple", "-v", "Paseo signed.app"];
+        const result = spawnSync("bash", [wrapperPath, ...args], {
+          encoding: "utf8",
+          env: {
+            ...process.env,
+            PASEO_REAL_XCRUN: realXcrun,
+            STAPLER_STATE: statePath,
+            PATH: `${directory}:${process.env.PATH}`,
+          },
+          timeout: 5000,
+        });
+        assert.equal(result.status, scenario.expected, result.stdout + result.stderr);
+        const state = JSON.parse(readFileSync(statePath, "utf8"));
+        assert.deepEqual(
+          state.calls,
+          Array.from({ length: scenario.attempts }, () => args),
+        );
+        assert.match(result.stdout, /stapled|network connection was lost|ticket not found/);
+      } finally {
+        rmSync(directory, { recursive: true, force: true });
+      }
+    });
+  }
+});