chore(release): cut 0.15.1

On 0.15.0 the daemon launches the detached terminal worker while it is
being created, and the worker refuses to start unless it can read its own
birth time and command line (Windows PowerShell 5.1 `Get-CimInstance`,
`ps` elsewhere). Any failure of that query used to escape
startWorkerTerminalManager and take the whole daemon down with
"Daemon failed to start (exit 1)", as two Windows machines hit after the
update: one whose PowerShell 5.1 cannot load CimCmdlets, one where
powershell.exe cannot be spawned at all. 0.14.0 never ran that query at
startup.

The launch error is now logged and the daemon starts without a current
worker. The pool already launches one lazily on the first terminal
creation, so that request reports the same error while the machine still
cannot run the query, and terminals come back once it can. The identity
requirement itself is unchanged: a worker without a verified identity is
never written or adopted.

(cherry picked from commit 8dfdb479ab)

.github/workflows/desktop-release.yml

@@ -135,6 +135,32 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      # Backport electron-builder#10172 to the pinned build tool only.
+      # Remove this step when app-builder-lib is upgraded to a release containing it.
+      - name: Repair temporary keychain password in signing tool
+        shell: bash
+        run: |
+          node <<'KEYCHAIN_FIX'
+          const fs = require('node:fs');
+          const path = require('node:path');
+          const manifestPath = require.resolve('app-builder-lib/package.json');
+          if (JSON.parse(fs.readFileSync(manifestPath, 'utf8')).version !== '26.8.1') {
+            throw new Error('Reassess/remove the signing backport for the new app-builder-lib version');
+          }
+          const sourcePath = path.join(path.dirname(manifestPath), 'out/codeSign/macCodeSign.js');
+          let source = fs.readFileSync(sourcePath, 'utf8');
+          const replacements = [
+            ['importCerts(keychainFile, certPaths, cscPasswords)', 'importCerts(keychainFile, certPaths, cscPasswords, keychainPassword)'],
+            ['importCerts(keychainFile, paths, keyPasswords)', 'importCerts(keychainFile, paths, keyPasswords, keychainPassword)'],
+            ['["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]', '["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", keychainPassword, keychainFile]'],
+          ];
+          for (const [before, after] of replacements) {
+            if (source.split(before).length !== 2) throw new Error('Unexpected signing tool source; refusing to patch');
+            source = source.replace(before, after);
+          }
+          fs.writeFileSync(sourcePath, source);
+          KEYCHAIN_FIX
+
       - name: Set desktop package version from tag
         shell: bash
         run: |

CHANGELOG.md

@@ -1,8 +1,14 @@
 # Changelog
 
-## 0.15.0-beta.1 - 2026-11-01
+## 0.15.1 - 2026-11-05
 
-Daemon restarts now keep terminal programs running and automatically resume interrupted agents in their existing conversations.
+### Fixed
+
+- Fixed the daemon failing to start when the terminal worker cannot read its own process identity, which left Paseo Desktop without a daemon on Windows machines where Windows PowerShell 5.1 cannot run `Get-CimInstance` ([#8810](https://github.com/getpaseo/paseo/pull/8810))
+
+## 0.15.0 - 2026-11-03
+
+Daemon restarts now keep terminal programs running. Interrupted agents can resume in their existing conversations when you turn on agent recovery.
 
 Mobile terminals have native rendering and draggable text-selection handles. Reconnecting restores up to 10,000 lines of terminal history.
 
@@ -13,7 +19,7 @@ Worktree setup can copy ignored files and use plugin-defined locations before ag
 - Insert known agent commands from replies into the Composer draft ([#8371](https://github.com/getpaseo/paseo/pull/8371))
 - Reuse running OpenCode v2 services ([#7435](https://github.com/getpaseo/paseo/pull/7435) by [@mcowger](https://github.com/mcowger))
 - Kept terminal programs running across daemon restarts, crashes and supported updates ([#7644](https://github.com/getpaseo/paseo/pull/7644), [#8155](https://github.com/getpaseo/paseo/pull/8155) by [@sebastianarena](https://github.com/sebastianarena))
-- Automatically resume interrupted agents in their existing conversations after a host restart ([#8127](https://github.com/getpaseo/paseo/pull/8127) by [@coolwindX](https://github.com/coolwindX), [@suntianc](https://github.com/suntianc))
+- Added an opt-in setting to resume interrupted agents in their existing conversations after a host restart ([#8127](https://github.com/getpaseo/paseo/pull/8127), [#8619](https://github.com/getpaseo/paseo/pull/8619) by [@coolwindX](https://github.com/coolwindX), [@suntianc](https://github.com/suntianc))
 - Added draggable terminal text-selection handles on iOS and Android ([#8348](https://github.com/getpaseo/paseo/pull/8348))
 - Let phones and tablets rotate with the system orientation setting ([#8256](https://github.com/getpaseo/paseo/pull/8256) by [@magiclaw](https://github.com/magiclaw), [@yzim](https://github.com/yzim))
 - Copy ignored files selected by `.worktreeinclude` into new worktrees before setup and agents start ([#8100](https://github.com/getpaseo/paseo/pull/8100) by [@cprecioso](https://github.com/cprecioso))
@@ -64,6 +70,7 @@ Worktree setup can copy ignored files and use plugin-defined locations before ag
 - Fixed the MiniMax Code catalog command failing to select an executable ([#8201](https://github.com/getpaseo/paseo/pull/8201) by [@Peanut-HZM](https://github.com/Peanut-HZM))
 - Fixed Android keeping the wrong layout after folding or unfolding while backgrounded ([#8285](https://github.com/getpaseo/paseo/pull/8285))
 - Fixed Android workspace layouts and header fades retaining their old size after rotation ([#8349](https://github.com/getpaseo/paseo/pull/8349), [#8377](https://github.com/getpaseo/paseo/pull/8377))
+- Fixed chat reconnecting and updating status being hidden behind the header on iOS and Android phones ([#8568](https://github.com/getpaseo/paseo/pull/8568))
 - Fixed deleted agents leaving unclosable tabs in another window ([#8248](https://github.com/getpaseo/paseo/pull/8248) by [@loganmeyer](https://github.com/loganmeyer))
 - Fixed transcript text retaining old theme colors after the theme changes while the window is hidden ([#8199](https://github.com/getpaseo/paseo/pull/8199) by [@Nurshot](https://github.com/Nurshot), [@dansabin](https://github.com/dansabin))
 - Fixed web menus snapping back to their loading size after content arrives ([#8180](https://github.com/getpaseo/paseo/pull/8180) by [@babo-jeonguk](https://github.com/babo-jeonguk))
@@ -74,7 +81,7 @@ Worktree setup can copy ignored files and use plugin-defined locations before ag
 ### Notes
 
 - The first upgrade from 0.14.0 still closes terminals; terminal preservation starts once the new daemon is installed, and Windows desktop app upgrades still close them
-- Automatic agent recovery is on by default and sends `Resume working.`; change the prompt or disable it in Host settings → Agents
+- Agent recovery is off by default; turn on **Resume agents after restart** in Host settings → Agents to send `Resume working.` or your own prompt
 - Before downgrading to 0.14.0, restore a backed-up `config.json` or remove the saved agent-resume and usage-check settings
 
 ## 0.14.0 - 2026-10-29

CHANGELOG.zh-CN.md

@@ -1,8 +1,14 @@
 # Changelog
 
-## 0.15.0-beta.1 - 2026-11-01
+## 0.15.1 - 2026-11-05
 
-daemon 重启后，终端中的程序继续运行，被中断的 Agent 会自动在原有会话中恢复工作。
+### 修复
+
+- 修复终端工作进程无法读取自身进程标识时 daemon 无法启动的问题；此前在 Windows PowerShell 5.1 无法运行 `Get-CimInstance` 的 Windows 机器上，Paseo 桌面版因此没有可用的 daemon ([#8810](https://github.com/getpaseo/paseo/pull/8810))
+
+## 0.15.0 - 2026-11-03
+
+daemon 重启后，终端中的程序继续运行。开启 Agent 恢复后，被中断的 Agent 会在原有会话中恢复工作。
 
 移动端终端采用原生渲染，并提供可拖动的文本选择手柄。重新连接时最多恢复 10,000 行终端历史。
 
@@ -13,7 +19,7 @@ worktree 初始化支持复制被忽略的文件，并在 Agent 启动前使用
 - 点击回复中的已知 Agent 命令，将其插入 Composer 草稿 ([#8371](https://github.com/getpaseo/paseo/pull/8371))
 - 复用已运行的 OpenCode v2 服务 ([#7435](https://github.com/getpaseo/paseo/pull/7435)，贡献者：[@mcowger](https://github.com/mcowger))
 - 让终端中的程序在 daemon 重启、崩溃和支持的更新过程中继续运行 ([#7644](https://github.com/getpaseo/paseo/pull/7644), [#8155](https://github.com/getpaseo/paseo/pull/8155)，贡献者：[@sebastianarena](https://github.com/sebastianarena))
-- 主机重启后，自动在原有会话中恢复被中断的 Agent ([#8127](https://github.com/getpaseo/paseo/pull/8127)，贡献者：[@coolwindX](https://github.com/coolwindX), [@suntianc](https://github.com/suntianc))
+- 新增可选设置，在主机重启后于原有会话中恢复被中断的 Agent ([#8127](https://github.com/getpaseo/paseo/pull/8127), [#8619](https://github.com/getpaseo/paseo/pull/8619)，贡献者：[@coolwindX](https://github.com/coolwindX), [@suntianc](https://github.com/suntianc))
 - 在 iOS 和 Android 终端中新增可拖动的文本选择手柄 ([#8348](https://github.com/getpaseo/paseo/pull/8348))
 - 让手机和平板遵循系统屏幕旋转设置 ([#8256](https://github.com/getpaseo/paseo/pull/8256)，贡献者：[@magiclaw](https://github.com/magiclaw), [@yzim](https://github.com/yzim))
 - 通过 `.worktreeinclude` 选择要复制到新 worktree 的被忽略文件，在初始化和 Agent 启动前完成复制 ([#8100](https://github.com/getpaseo/paseo/pull/8100)，贡献者：[@cprecioso](https://github.com/cprecioso))
@@ -64,6 +70,7 @@ worktree 初始化支持复制被忽略的文件，并在 Agent 启动前使用
 - 修复了 MiniMax Code 目录命令无法选定可执行文件的问题 ([#8201](https://github.com/getpaseo/paseo/pull/8201)，贡献者：[@Peanut-HZM](https://github.com/Peanut-HZM))
 - 修复了 Android 应用在后台折叠或展开后保留错误布局的问题 ([#8285](https://github.com/getpaseo/paseo/pull/8285))
 - 修复了 Android 屏幕旋转后工作区布局和顶栏渐变保留旧尺寸的问题 ([#8349](https://github.com/getpaseo/paseo/pull/8349), [#8377](https://github.com/getpaseo/paseo/pull/8377))
+- 修复了 iOS 和 Android 手机聊天中重新连接和更新状态被顶栏遮挡的问题 ([#8568](https://github.com/getpaseo/paseo/pull/8568))
 - 修复了删除 Agent 后，另一个窗口留下无法关闭的标签页的问题 ([#8248](https://github.com/getpaseo/paseo/pull/8248)，贡献者：[@loganmeyer](https://github.com/loganmeyer))
 - 修复了窗口隐藏期间切换主题后，聊天文本保留旧主题颜色的问题 ([#8199](https://github.com/getpaseo/paseo/pull/8199)，贡献者：[@Nurshot](https://github.com/Nurshot), [@dansabin](https://github.com/dansabin))
 - 修复了网页菜单加载内容后跳回加载时尺寸的问题 ([#8180](https://github.com/getpaseo/paseo/pull/8180)，贡献者：[@babo-jeonguk](https://github.com/babo-jeonguk))
@@ -74,7 +81,7 @@ worktree 初始化支持复制被忽略的文件，并在 Agent 启动前使用
 ### 说明
 
 - 首次从 0.14.0 升级时仍会关闭终端；安装新 daemon 后才支持保留终端，Windows 桌面应用升级仍会关闭终端
-- Agent 自动恢复默认开启，并发送 `Resume working.`；可在主机设置 → Agent 中修改提示词或关闭此功能
+- Agent 恢复默认关闭；在主机设置 → Agent 中开启 **重启后恢复智能体**，即可发送 `Resume working.` 或自定义提示词
 - 降级到 0.14.0 前，请恢复备份的 `config.json`，或删除已保存的 Agent 恢复和用量查询设置
 
 ## 0.14.0 - 2026-10-29

docs/agent-lifecycle.md

@@ -14,9 +14,10 @@ Each live agent in `AgentManager` carries a `lastStatus` of `initializing`, `idl
 
 ## Daemon restart recovery
 
-Hosts resume interrupted agents by default after graceful shutdown or a crash. The daemon
-reopens the saved provider conversation and settings, then sends `Resume working.`. Change
-`agents.resumePrompt` or disable `agents.resumeOnStartup` in host config or Host settings → Agents.
+Restart recovery is off by default. Enable `agents.resumeOnStartup` in host config or
+Host settings → Agents to resume interrupted agents after graceful shutdown or a crash. The daemon
+reopens the saved provider conversation and settings, then sends `Resume working.`. Customize
+the prompt with `agents.resumePrompt` or the same settings page.
 Disabling recovery consumes pending intent; enabling it later does not revive old work.
 
 Only agents recorded as running qualify. Idle and initializing agents stay inactive. Archived

fastlane/metadata/android/en-US/changelogs/150001.txt

@@ -0,0 +1,10 @@
+Daemon restarts now keep terminal programs running. Interrupted agents can resume in their existing conversations when you turn on agent recovery.
+
+Mobile terminals have native rendering and draggable text-selection handles. Reconnecting restores up to 10,000 lines of terminal history.
+
+Worktree setup can copy ignored files and use plugin-defined locations before agents start.
+
+Added
+- Insert known agent commands from replies into the Composer draft
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/150002.txt

@@ -0,0 +1,10 @@
+Daemon restarts now keep terminal programs running. Interrupted agents can resume in their existing conversations when you turn on agent recovery.
+
+Mobile terminals have native rendering and draggable text-selection handles. Reconnecting restores up to 10,000 lines of terminal history.
+
+Worktree setup can copy ignored files and use plugin-defined locations before agents start.
+
+Added
+- Insert known agent commands from replies into the Composer draft
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/150003.txt

@@ -0,0 +1,10 @@
+Daemon restarts now keep terminal programs running. Interrupted agents can resume in their existing conversations when you turn on agent recovery.
+
+Mobile terminals have native rendering and draggable text-selection handles. Reconnecting restores up to 10,000 lines of terminal history.
+
+Worktree setup can copy ignored files and use plugin-defined locations before agents start.
+
+Added
+- Insert known agent commands from replies into the Composer draft
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/150004.txt

@@ -0,0 +1,10 @@
+Daemon restarts now keep terminal programs running. Interrupted agents can resume in their existing conversations when you turn on agent recovery.
+
+Mobile terminals have native rendering and draggable text-selection handles. Reconnecting restores up to 10,000 lines of terminal history.
+
+Worktree setup can copy ignored files and use plugin-defined locations before agents start.
+
+Added
+- Insert known agent commands from replies into the Composer draft
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/150011.txt

@@ -0,0 +1,4 @@
+Fixed
+- Fixed the daemon failing to start when the terminal worker cannot read its own process identity, which left Paseo Desktop without a daemon on Windows machines where Windows PowerShell 5.1 cannot run Get-CimInstance
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/150012.txt

@@ -0,0 +1,4 @@
+Fixed
+- Fixed the daemon failing to start when the terminal worker cannot read its own process identity, which left Paseo Desktop without a daemon on Windows machines where Windows PowerShell 5.1 cannot run Get-CimInstance
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/150013.txt

@@ -0,0 +1,4 @@
+Fixed
+- Fixed the daemon failing to start when the terminal worker cannot read its own process identity, which left Paseo Desktop without a daemon on Windows machines where Windows PowerShell 5.1 cannot run Get-CimInstance
+
+Full notes: https://paseo.sh/changelog

fastlane/metadata/android/en-US/changelogs/150014.txt

@@ -0,0 +1,4 @@
+Fixed
+- Fixed the daemon failing to start when the terminal worker cannot read its own process identity, which left Paseo Desktop without a daemon on Windows machines where Windows PowerShell 5.1 cannot run Get-CimInstance
+
+Full notes: https://paseo.sh/changelog

nix/npm-deps.hash

@@ -1 +1 @@
-sha256-CeT2PtYIAFwvBC9LIku8VkTl0pvKxYzSCn0QW2ManfU=
+sha256-YLrbUckIiyV7esu2tmiKdLL0YHsvwqcA0Xe0gSeMCC0=

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "paseo",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "paseo",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "workspaces": [
@@ -37632,7 +37632,7 @@
     },
     "packages/app": {
       "name": "@getpaseo/app",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
         "@codemirror/commands": "6.10.4",
         "@codemirror/language": "6.12.4",
@@ -39800,12 +39800,12 @@
     },
     "packages/cli": {
       "name": "@getpaseo/cli",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
         "@clack/prompts": "^1.0.0",
-        "@getpaseo/client": "0.15.0-beta.1",
-        "@getpaseo/protocol": "0.15.0-beta.1",
-        "@getpaseo/server": "0.15.0-beta.1",
+        "@getpaseo/client": "0.15.1",
+        "@getpaseo/protocol": "0.15.1",
+        "@getpaseo/server": "0.15.1",
         "chalk": "^5.3.0",
         "commander": "^12.0.0",
         "mime-types": "^2.1.35",
@@ -40052,10 +40052,10 @@
     },
     "packages/client": {
       "name": "@getpaseo/client",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
-        "@getpaseo/protocol": "0.15.0-beta.1",
-        "@getpaseo/relay": "0.15.0-beta.1",
+        "@getpaseo/protocol": "0.15.1",
+        "@getpaseo/relay": "0.15.1",
         "ws": "^8.20.0",
         "zod": "^4.4.3"
       },
@@ -40067,7 +40067,7 @@
     },
     "packages/desktop": {
       "name": "@getpaseo/desktop",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@getpaseo/cli": "*",
@@ -40311,7 +40311,7 @@
     },
     "packages/expo-two-way-audio": {
       "name": "@getpaseo/expo-two-way-audio",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "license": "MIT",
       "devDependencies": {
         "@types/jest": "^29.5.14",
@@ -40357,7 +40357,7 @@
     },
     "packages/highlight": {
       "name": "@getpaseo/highlight",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
         "@codemirror/language": "6.12.4",
         "@codemirror/legacy-modes": "^6.5.3",
@@ -40386,15 +40386,15 @@
     },
     "packages/plugin": {
       "name": "@getpaseo/plugin",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.4.0",
         "i18next": "^26.3.0",
         "use-sync-external-store": "^1.6.0"
       },
       "devDependencies": {
-        "@getpaseo/client": "0.15.0-beta.1",
-        "@getpaseo/protocol": "0.15.0-beta.1",
+        "@getpaseo/client": "0.15.1",
+        "@getpaseo/protocol": "0.15.1",
         "@types/node": "^20.9.0",
         "@types/react": "~19.2.0",
         "react": "19.2.3",
@@ -40404,8 +40404,8 @@
         "zod": "^4.4.3"
       },
       "peerDependencies": {
-        "@getpaseo/client": "0.15.0-beta.1",
-        "@getpaseo/protocol": "0.15.0-beta.1",
+        "@getpaseo/client": "0.15.1",
+        "@getpaseo/protocol": "0.15.1",
         "react": ">=19.1.0 <20",
         "react-native": ">=0.81.5",
         "zod": "^4.4.3"
@@ -40427,7 +40427,7 @@
     },
     "packages/protocol": {
       "name": "@getpaseo/protocol",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
         "semver": "^7.8.5",
         "zod": "^4.4.3"
@@ -40454,7 +40454,7 @@
     },
     "packages/relay": {
       "name": "@getpaseo/relay",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
         "@noble/ciphers": "^2.4.0",
         "@noble/curves": "^2.4.0",
@@ -40675,16 +40675,16 @@
     },
     "packages/server": {
       "name": "@getpaseo/server",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
         "@agentclientprotocol/sdk": "^0.17.1",
         "@anthropic-ai/claude-agent-sdk": "0.3.246",
         "@anthropic-ai/sdk": "^0.104.2",
-        "@getpaseo/client": "0.15.0-beta.1",
-        "@getpaseo/highlight": "0.15.0-beta.1",
-        "@getpaseo/plugin": "0.15.0-beta.1",
-        "@getpaseo/protocol": "0.15.0-beta.1",
-        "@getpaseo/relay": "0.15.0-beta.1",
+        "@getpaseo/client": "0.15.1",
+        "@getpaseo/highlight": "0.15.1",
+        "@getpaseo/plugin": "0.15.1",
+        "@getpaseo/protocol": "0.15.1",
+        "@getpaseo/relay": "0.15.1",
         "@isaacs/ttlcache": "^2.1.4",
         "@modelcontextprotocol/sdk": "1.29.0",
         "@opencode-ai/sdk": "1.14.46",
@@ -41631,7 +41631,7 @@
     },
     "packages/website": {
       "name": "@getpaseo/website",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
         "@cloudflare/vite-plugin": "^1.29.1",
         "@cloudflare/workers-types": "^4.20260317.1",
@@ -43241,7 +43241,7 @@
     },
     "plugins": {
       "name": "@getpaseo/builtin-plugins",
-      "version": "0.15.0-beta.1",
+      "version": "0.15.1",
       "dependencies": {
         "@getpaseo/plugin": "*",
         "zod": "^4.4.3"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "paseo",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "private": true,
   "description": "Paseo: voice-controlled development environment for local AI coding agents",
   "keywords": [

packages/app/e2e/browser/settings-host-page.spec.ts

@@ -257,12 +257,15 @@ test.describe("Settings host page", () => {
   });
 });
 
-test("restart recovery host controls persist the opt-out and custom prompt", async ({ page }) => {
+test("restart recovery defaults off and persists opt-in and custom prompt", async ({ page }) => {
   const serverId = getServerId();
   await gotoAppShell(page);
   await openSettings(page);
   await openSettingsHost(page, serverId);
   await openHostSection(page, serverId, "agents");
+  await expectRestartRecoveryEnabled(page, false);
+  await setRestartRecoveryEnabled(page, true);
+  await page.reload();
   await expectRestartRecoveryEnabled(page, true);
   await expectRestartRecoveryPrompt(page, "Resume working.");
   await editRestartRecoveryPrompt(page, "Continue the interrupted work.");

packages/app/e2e/mobile/timeline-status/placement.mjs

@@ -0,0 +1,54 @@
+// Open an existing compact chat, with the keyboard closed, then interrupt its host connection.
+// Hold that interruption externally (for example, stop a disposable SSH TCP forward).
+// Leave the daemon running. This test observes the public reconnecting state.
+// node placement.mjs <session> <platform> <coordinate-scale> <composer-label> <artifacts>
+// coordinate-scale is screenshot pixels per layout point (Android density; iOS snapshots use 1).
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+const [, , session, platform, coordinateScale, composerLabel, artifacts] = process.argv;
+assert(
+  session && ["android", "ios"].includes(platform) && composerLabel && artifacts,
+  "Pass all five arguments",
+);
+const scale = Number(coordinateScale);
+assert(scale > 0, "Pass a positive coordinate scale");
+mkdirSync(artifacts, { recursive: true });
+function ad(...args) {
+  return execFileSync("agent-device", ["--session", session, "--platform", platform, ...args], {
+    encoding: "utf8",
+    timeout: 90_000,
+  });
+}
+function capture(name) {
+  const snapshot = ad("snapshot", "--raw", "--json");
+  writeFileSync(path.join(artifacts, `${name}.json`), snapshot);
+  ad("screenshot", path.join(artifacts, `${name}.png`));
+  const nodes = JSON.parse(snapshot).data.nodes;
+  const header = nodes.find((node) => node.identifier === "floating-header");
+  const toast = nodes.find((node) => node.identifier === "agent-reconnecting-toast");
+  assert(header?.rect && toast?.rect, "Measured header and reconnecting toast must be present");
+  assert(toast.rect.height > 0 && toast.rect.width > 0, "Toast must have visible bounds");
+  const gap = (toast.rect.y - header.rect.y - header.rect.height) / scale;
+  assert(Math.abs(gap - 12) <= 1, `${name}: actual header-to-toast gap ${gap}, expected12 points`);
+  return toast.rect.y / scale;
+}
+
+ad("wait", 'id="agent-reconnecting-toast"', "20000");
+const closedTop = capture("keyboard-closed");
+ad("press", `label=${JSON.stringify(composerLabel)}`);
+const opened = ad("snapshot", "--raw", "--json");
+const nodes = JSON.parse(opened).data.nodes;
+assert(
+  nodes.some(
+    (node) => /keyboard/i.test(node.type ?? "") || /inputmethod/i.test(node.bundleId ?? ""),
+  ),
+  "Use a real visible software keyboard; open Android sessions with --no-test-ime",
+);
+const openTop = capture("keyboard-open");
+assert(Math.abs(openTop - closedTop) <= 1, "Keyboard must not translate the toast");
+console.log(
+  "PASS: rendered reconnecting toast stays12 points below measured header, keyboard closed/open",
+);

packages/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/app",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "private": true,
   "main": "index.ts",
   "scripts": {

packages/app/src/components/floating-header/index.tsx

@@ -1,8 +1,26 @@
-import { useCallback, useState, type ReactNode } from "react";
+import { createContext, useContext, useCallback, useState, useId, type ReactNode } from "react";
 import { View, type LayoutChangeEvent } from "react-native";
 import { StyleSheet } from "react-native-unistyles";
+import { Portal, PortalHost } from "@gorhom/portal";
+import { useRetainedPanelActive } from "@/components/retained-panel";
 import { EdgeFade } from "@/components/ui/edge-fade";
 
+const OverlayClearanceContext = createContext(0);
+const OverlayHostContext = createContext<string | null>(null);
+
+/** Keep status overlays above the fade without lifting the scrolling content. */
+export function FloatingHeaderOverlay({ children }: { children: ReactNode }) {
+  const hostName = useContext(OverlayHostContext);
+  const active = useRetainedPanelActive();
+  if (!hostName) return children;
+  return active ? <Portal hostName={hostName}>{children}</Portal> : null;
+}
+
+/** Clearance for stationary overlays inside this layout, measured to the header bottom. */
+export function useFloatingHeaderOverlayClearance(): number {
+  return useContext(OverlayClearanceContext);
+}
+
 /** How far the fade runs past the header's bottom edge, so content dissolves instead of clipping. */
 const FADE_OVERHANG = 48;
 /** Share of the fade that stays opaque, so the header's title and icons keep contrast. */
@@ -20,15 +38,24 @@ interface FloatingHeaderLayoutProps {
  * same tree position in both modes, so toggling `floating` never remounts them.
  */
 export function FloatingHeaderLayout({ header, floating, children }: FloatingHeaderLayoutProps) {
+  const overlayHostName = useId();
   const [headerHeight, setHeaderHeight] = useState(0);
   const handleHeaderLayout = useCallback((event: LayoutChangeEvent) => {
     setHeaderHeight(Math.round(event.nativeEvent.layout.height));
   }, []);
 
+  const overlayClearance = floating ? headerHeight : 0;
+
   return (
     <View style={styles.root}>
       {floating ? null : header}
-      <View style={styles.content}>{children(floating ? headerHeight : 0)}</View>
+      <View style={styles.content}>
+        <OverlayClearanceContext.Provider value={overlayClearance}>
+          <OverlayHostContext.Provider value={floating ? overlayHostName : null}>
+            {children(floating ? headerHeight : 0)}
+          </OverlayHostContext.Provider>
+        </OverlayClearanceContext.Provider>
+      </View>
       {floating ? (
         <View style={styles.overlay} pointerEvents="box-none">
           <EdgeFade
@@ -37,11 +64,19 @@ export function FloatingHeaderLayout({ header, floating, children }: FloatingHea
             backdrop="surfaceWorkspace"
             style={styles.fade}
           />
-          <View pointerEvents="box-none" onLayout={handleHeaderLayout}>
+          <View
+            testID="floating-header"
+            collapsable={false}
+            pointerEvents="box-none"
+            onLayout={handleHeaderLayout}
+          >
             {header}
           </View>
         </View>
       ) : null}
+      <View style={styles.statusOverlay} pointerEvents="box-none">
+        <PortalHost name={overlayHostName} />
+      </View>
     </View>
   );
 }
@@ -55,6 +90,13 @@ const styles = StyleSheet.create({
     flex: 1,
     minHeight: 0,
   },
+  statusOverlay: {
+    position: "absolute",
+    top: 0,
+    bottom: 0,
+    left: 0,
+    right: 0,
+  },
   overlay: {
     position: "absolute",
     top: 0,

packages/app/src/components/toast-host.tsx

@@ -1,3 +1,7 @@
+import {
+  FloatingHeaderOverlay,
+  useFloatingHeaderOverlayClearance,
+} from "@/components/floating-header";
 import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import { createPortal } from "react-dom";
 import {
@@ -190,9 +194,11 @@ export function ToastViewport({
     return clearTimer;
   }, [clearTimer, durationMs, scheduleDismiss, toastId]);
 
+  const panelClearance = useFloatingHeaderOverlayClearance();
   const headerHeight = isMobile ? HEADER_INNER_HEIGHT_MOBILE : HEADER_INNER_HEIGHT;
   const headerTopPadding = isMobile ? HEADER_TOP_PADDING_MOBILE : 0;
-  const topOffset = placement === "app-shell" ? insets.top + headerTopPadding + headerHeight : 0;
+  const topOffset =
+    placement === "app-shell" ? insets.top + headerTopPadding + headerHeight : panelClearance;
 
   const content = (
     <View
@@ -220,7 +226,7 @@ export function ToastViewport({
     return createPortal(content, getOverlayRoot());
   }
 
-  return content;
+  return placement === "panel" ? <FloatingHeaderOverlay>{content}</FloatingHeaderOverlay> : content;
 }
 
 function ToastCard({

packages/app/src/composer/dock/index.native.tsx

@@ -179,8 +179,8 @@ export function ComposerDock({
               <View style={fullscreen ? fullscreenSurface : dockStyles.composer}>{composer}</View>
             </ComposerViewportContent>
           </ComposerViewportContent>
-          {overlay}
         </KeyboardTranslateView>
+        {overlay}
       </ComposerViewport>
     );
   }
@@ -214,8 +214,8 @@ export function ComposerDock({
             {composer}
           </View>
         </ComposerViewportContent>
-        {overlay}
       </KeyboardTranslateView>
+      {overlay}
     </ComposerViewport>
   );
 }

packages/app/src/composer/dock/overlay-placement.test.ts

@@ -0,0 +1,31 @@
+import { readFileSync } from "node:fs";
+import ts from "typescript";
+import { expect, it } from "vitest";
+
+it("keeps dock overlays outside keyboard translation in every native layout", () => {
+  const source = ts.createSourceFile(
+    "dock.tsx",
+    readFileSync(new URL("./index.native.tsx", import.meta.url), "utf8"),
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TSX,
+  );
+  let surfaces = 0;
+  function visit(node: ts.Node) {
+    if (
+      ts.isJsxElement(node) &&
+      node.openingElement.tagName.getText(source) === "KeyboardTranslateView"
+    ) {
+      surfaces++;
+      function assertStationary(child: ts.Node) {
+        if (ts.isJsxExpression(child))
+          expect(child.expression?.getText(source)).not.toBe("overlay");
+        ts.forEachChild(child, assertStationary);
+      }
+      ts.forEachChild(node, assertStationary);
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(source);
+  expect(surfaces).toBe(2);
+});

packages/app/src/screens/settings/restart-recovery-card.tsx

@@ -59,7 +59,7 @@ export function RestartRecoveryCard({ serverId }: { serverId: string }) {
 
   if (!isConnected || !isSupported || !config) return null;
 
-  const isEnabled = config.resumeOnStartup !== false;
+  const isEnabled = config.resumeOnStartup === true;
 
   return (
     <>

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/cli",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "description": "Paseo CLI - control your AI coding agents from the command line",
   "bin": {
     "paseo": "bin/paseo"
@@ -28,9 +28,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.0.0",
-    "@getpaseo/client": "0.15.0-beta.1",
-    "@getpaseo/protocol": "0.15.0-beta.1",
-    "@getpaseo/server": "0.15.0-beta.1",
+    "@getpaseo/client": "0.15.1",
+    "@getpaseo/protocol": "0.15.1",
+    "@getpaseo/server": "0.15.1",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "mime-types": "^2.1.35",

packages/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/client",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "description": "Paseo client SDK package",
   "files": [
     "dist",
@@ -47,8 +47,8 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@getpaseo/protocol": "0.15.0-beta.1",
-    "@getpaseo/relay": "0.15.0-beta.1",
+    "@getpaseo/protocol": "0.15.1",
+    "@getpaseo/relay": "0.15.1",
     "ws": "^8.20.0",
     "zod": "^4.4.3"
   },

packages/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/desktop",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "private": true,
   "description": "Paseo desktop app (Electron wrapper)",
   "homepage": "https://paseo.sh",

packages/expo-two-way-audio/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/expo-two-way-audio",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "description": "Native module for two way audio streaming",
   "keywords": [
     "ExpoTwoWayAudio",

packages/highlight/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/highlight",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "files": [
     "dist",
     "!dist/**/*.map",

packages/plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/plugin",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "description": "Paseo plugin SDK package",
   "files": [
     "dist",
@@ -77,8 +77,8 @@
     "use-sync-external-store": "^1.6.0"
   },
   "devDependencies": {
-    "@getpaseo/client": "0.15.0-beta.1",
-    "@getpaseo/protocol": "0.15.0-beta.1",
+    "@getpaseo/client": "0.15.1",
+    "@getpaseo/protocol": "0.15.1",
     "@types/node": "^20.9.0",
     "@types/react": "~19.2.0",
     "react": "19.2.3",
@@ -88,8 +88,8 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@getpaseo/client": "0.15.0-beta.1",
-    "@getpaseo/protocol": "0.15.0-beta.1",
+    "@getpaseo/client": "0.15.1",
+    "@getpaseo/protocol": "0.15.1",
     "react": ">=19.1.0 <20",
     "react-native": ">=0.81.5",
     "zod": "^4.4.3"

packages/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/protocol",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "description": "Paseo shared protocol schemas and wire types",
   "files": [
     "dist",

packages/relay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/relay",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "description": "Paseo relay for bridging daemon and client connections",
   "files": [
     "dist",

packages/relay/src/e2e.test.ts

@@ -56,6 +56,9 @@ function spawnRelayDevServer(port: number): ChildProcess {
       wranglerCliPath,
       "dev",
       "--local",
+      // Local execution still inherits production vars; exercise the local Durable Object.
+      "--var",
+      "PASEO_RELAY_UPSTREAM:",
       "--ip",
       "127.0.0.1",
       "--port",

packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/server",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "description": "Paseo backend server",
   "files": [
     "dist/server",
@@ -107,11 +107,11 @@
     "@agentclientprotocol/sdk": "^0.17.1",
     "@anthropic-ai/claude-agent-sdk": "0.3.246",
     "@anthropic-ai/sdk": "^0.104.2",
-    "@getpaseo/client": "0.15.0-beta.1",
-    "@getpaseo/highlight": "0.15.0-beta.1",
-    "@getpaseo/plugin": "0.15.0-beta.1",
-    "@getpaseo/protocol": "0.15.0-beta.1",
-    "@getpaseo/relay": "0.15.0-beta.1",
+    "@getpaseo/client": "0.15.1",
+    "@getpaseo/highlight": "0.15.1",
+    "@getpaseo/plugin": "0.15.1",
+    "@getpaseo/protocol": "0.15.1",
+    "@getpaseo/relay": "0.15.1",
     "@isaacs/ttlcache": "^2.1.4",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@opencode-ai/sdk": "1.14.46",

packages/server/src/server/bootstrap.ts

@@ -600,7 +600,7 @@ function createInitialMutableDaemonConfig(config: ResolvedDaemonSettings): Mutab
     autoArchiveAfterMerge: config.autoArchiveAfterMerge ?? false,
     enableTerminalAgentHooks: config.enableTerminalAgentHooks ?? false,
     idleRuntimeCleanup: config.idleRuntimeCleanup !== false,
-    resumeOnStartup: config.resumeOnStartup !== false,
+    resumeOnStartup: config.resumeOnStartup === true,
     resumePrompt: config.resumePrompt ?? "Resume working.",
     appendSystemPrompt: config.appendSystemPrompt ?? "",
     pluginsEnabled: config.pluginsEnabled ?? false,
@@ -1047,7 +1047,7 @@ export async function createPaseoDaemon(
   const restartRecovery = createRestartRecovery({
     storage: agentStorage,
     settings: () => ({
-      enabled: daemonConfigStore.get().resumeOnStartup !== false,
+      enabled: daemonConfigStore.get().resumeOnStartup === true,
       prompt: daemonConfigStore.get().resumePrompt ?? "Resume working.",
     }),
     eligible: async (record) =>

packages/server/src/server/config.test.ts

@@ -40,6 +40,24 @@ describe("server config", () => {
     expect(blockingMs).toBeLessThan(50);
   });
 
+  test.each([undefined, false, true])(
+    "restart recovery requires explicit opt-in (%s)",
+    async (enabled) => {
+      const paseoHome = await mkdtemp(path.join(os.tmpdir(), "paseo-config-recovery-"));
+      roots.push(paseoHome);
+      await writeFile(
+        path.join(paseoHome, "config.json"),
+        JSON.stringify({
+          version: 1,
+          agents: { resumeOnStartup: enabled, resumePrompt: "Continue exactly.\n" },
+        }),
+      );
+      const config = loadConfig(paseoHome, { env: {} });
+      expect(config.resumeOnStartup).toBe(enabled === true);
+      expect(config.resumePrompt).toBe("Continue exactly.\n");
+    },
+  );
+
   test("records when the daemon is managed by Paseo Desktop", async () => {
     const paseoHome = await mkdtemp(path.join(os.tmpdir(), "paseo-config-desktop-managed-"));
     roots.push(paseoHome);

packages/server/src/server/config.ts

@@ -839,7 +839,7 @@ function resolveSpeechOverrideControlledPaths(
 
 function resolveRestartRecoveryConfig(agents: PersistedConfig["agents"]) {
   return {
-    resumeOnStartup: agents?.resumeOnStartup ?? true,
+    resumeOnStartup: agents?.resumeOnStartup ?? false,
     resumePrompt: agents?.resumePrompt ?? "Resume working.",
   };
 }

packages/server/src/server/daemon-e2e/daemon-restart-resume.e2e.test.ts

@@ -134,7 +134,7 @@ test.each([false, true])(
     let client: DaemonClient | undefined;
     let mcp: Client | undefined;
     try {
-      const first = await restartFixture(root);
+      const first = await restartFixture(root, { resumeOnStartup: true });
       processes.push(first.child);
       client = new DaemonClient({ url: `ws://127.0.0.1:${first.port}/ws`, appVersion: "0.13.0" });
       await client.connect();
@@ -182,7 +182,7 @@ test.each([false, true])(
       await client.close();
       client = undefined;
       await stopFixture(first.child, abrupt);
-      const second = await restartFixture(root);
+      const second = await restartFixture(root, { resumeOnStartup: true });
       processes.push(second.child);
       await expect.poll(() => readPrompts(root), { timeout: 15000 }).toHaveLength(1);
       const prompts = await readPrompts(root);
@@ -222,7 +222,7 @@ test.each([false, true])(
       await client.close();
       client = undefined;
       await stopFixture(second.child, false);
-      const third = await restartFixture(root);
+      const third = await restartFixture(root, { resumeOnStartup: true });
       processes.push(third.child);
       expect(await readPrompts(root)).toHaveLength(1);
       expect(
@@ -243,7 +243,7 @@ test.each([false, true])(
   60000,
 );
 
-test.each([false, true])(
+test.each([undefined, false, true])(
   "host restart recovery settings (enabled=%s)",
   async (enabled) => {
     const root = await mkdtemp(path.join(tmpdir(), "resume-settings-process-"));
@@ -314,7 +314,7 @@ test("a provider that is slow to reopen does not hold daemon startup", async ()
   const processes: ChildProcess[] = [];
   let client: DaemonClient | undefined;
   try {
-    const first = await restartFixture(root);
+    const first = await restartFixture(root, { resumeOnStartup: true });
     processes.push(first.child);
     client = new DaemonClient({ url: `ws://127.0.0.1:${first.port}/ws`, appVersion: "0.13.0" });
     await client.connect();
@@ -338,7 +338,7 @@ test("a provider that is slow to reopen does not hold daemon startup", async ()
     client = undefined;
     await stopFixture(first.child, false);
 
-    const second = await restartFixture(root, {}, { holdResume: true });
+    const second = await restartFixture(root, { resumeOnStartup: true }, { holdResume: true });
     processes.push(second.child);
     client = new DaemonClient({ url: `ws://127.0.0.1:${second.port}/ws`, appVersion: "0.13.0" });
     await client.connect();

packages/server/src/terminal/worker-terminal-manager.test.ts

@@ -70,7 +70,7 @@ import {
   TerminalWorkerIncompatibleError,
 } from "./terminal-worker-pool.js";
 import { connectTerminalWorker } from "./terminal-worker-client.js";
-import { launchTerminalWorker } from "./terminal-worker-launch.js";
+import { launchTerminalWorker, TerminalWorkerLaunchError } from "./terminal-worker-launch.js";
 
 type TerminalRow = TerminalState["grid"][number];
 
@@ -2658,3 +2658,34 @@ it.each([false, true])(
   },
   45000,
 );
+
+// Both Windows reports in #8766: the worker's process identity query (PowerShell there, `ps` here)
+// fails, the worker exits before writing its record, and the daemon used to exit with it.
+it.skipIf(isPlatform("win32"))(
+  "starts without a worker when the worker cannot read its own identity, and launches one once it can",
+  async () => {
+    const paseoHome = createTemporaryHome();
+    const binDir = mkdtempSync(join(tmpdir(), "worker-terminal-manager-no-ps-"));
+    temporaryDirs.push(binDir);
+    writeFileSync(join(binDir, "ps"), "#!/bin/sh\nexit 1\n", { mode: 0o755 });
+    const originalPath = process.env.PATH;
+    process.env.PATH = `${binDir}${delimiter}${originalPath ?? ""}`;
+    try {
+      manager = await startRealWorkerManager({ paseoHome });
+      expect(await workerRecords(paseoHome)).toEqual([]);
+      await expect(
+        manager.createTerminal({ workspaceId: "ws-no-identity", cwd: paseoHome }),
+      ).rejects.toThrow(TerminalWorkerLaunchError);
+      expect(await workerRecords(paseoHome)).toEqual([]);
+    } finally {
+      process.env.PATH = originalPath;
+    }
+
+    const terminal = trackTerminal(
+      await manager.createTerminal({ workspaceId: "ws-no-identity", cwd: paseoHome }),
+    );
+    expect(terminal.id).toBeTruthy();
+    expect((await workerRecords(paseoHome)).map((record) => record.pid)).toHaveLength(1);
+  },
+  30000,
+);

packages/server/src/terminal/worker-terminal-manager.ts

@@ -1269,8 +1269,17 @@ export async function startWorkerTerminalManager(
     try {
       current = await startCurrent();
     } catch (error) {
-      if (!(error instanceof NoTerminalWorkerAvailableError)) throw error;
-      logger.warn(error.message);
+      if (error instanceof NoTerminalWorkerAvailableError) {
+        logger.warn(error.message);
+      } else {
+        // The daemon starts without terminals rather than not at all. A worker that cannot start
+        // here (its process identity query failed, say) is launched again by the first terminal
+        // creation, which reports the same error if it still cannot.
+        logger.error(
+          { err: error },
+          "Terminal worker did not start; terminals are unavailable until one starts",
+        );
+      }
     }
   }
 

packages/website/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/website",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "private": true,
   "type": "module",
   "scripts": {

plugins/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/builtin-plugins",
-  "version": "0.15.0-beta.1",
+  "version": "0.15.1",
   "private": true,
   "type": "module",
   "scripts": {

scripts/ci-workflow.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { readFileSync, readdirSync, mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { readFileSync, readdirSync, mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -679,3 +679,53 @@ test("macOS jobs use latest runners while preserving release architectures", ()
   // GitHub has no standard macos-latest-intel alias; use the newest Intel image.
   assert.match(release, /runner: macos-26-intel\n\s+electron_arch: x64/);
 });
+
+test("macOS signing repair keeps certificate and keychain passwords separate", () => {
+  const workflow = readFileSync(new URL(".github/workflows/desktop-release.yml", repoRoot), "utf8");
+  const match = workflow.match(/<<'KEYCHAIN_FIX'\n([\s\S]*?)\n          KEYCHAIN_FIX/);
+  assert.ok(match, "the release workflow repairs the pinned signing tool");
+  const script = match[1].replace(/^          /gm, "");
+  const original = [
+    "return await importCerts(keychainFile, certPaths, cscPasswords);",
+    "async function importCerts(keychainFile, paths, keyPasswords) {",
+    '["import", paths[i], "-P", password]',
+    '["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]',
+    "}",
+  ].join("\n");
+  const directory = mkdtempSync(join(tmpdir(), "signing-repair-"));
+  try {
+    const packageDirectory = join(directory, "node_modules/app-builder-lib");
+    mkdirSync(join(packageDirectory, "out/codeSign"), { recursive: true });
+    const manifest = join(packageDirectory, "package.json");
+    const sourcePath = join(packageDirectory, "out/codeSign/macCodeSign.js");
+    for (const [version, source, succeeds] of [
+      ["26.8.1", original, true],
+      ["26.8.1", original.replace("cscPasswords);", "differentArguments);"), false],
+      ["26.18.0", original, false],
+    ]) {
+      writeFileSync(manifest, JSON.stringify({ name: "app-builder-lib", version }));
+      writeFileSync(sourcePath, source);
+      const result = spawnSync(process.execPath, ["-e", script], {
+        cwd: directory,
+        encoding: "utf8",
+      });
+      const actual = readFileSync(sourcePath, "utf8");
+      if (succeeds) {
+        assert.equal(result.status, 0, result.stderr);
+        assert.ok(
+          actual.includes("importCerts(keychainFile, certPaths, cscPasswords, keychainPassword)"),
+        );
+        assert.ok(
+          actual.includes("importCerts(keychainFile, paths, keyPasswords, keychainPassword)"),
+        );
+        assert.ok(actual.includes('["import", paths[i], "-P", password]'));
+        assert.ok(actual.includes('"-k", keychainPassword, keychainFile]'));
+      } else {
+        assert.notEqual(result.status, 0);
+        assert.equal(actual, source, "unexpected tool inputs must fail without a partial write");
+      }
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});