chore: bump version to 0.2.3 [skip ci]

- Fix is_running() to check actual process liveness via try_wait()
  instead of just checking if the handle exists
- Auto-restart sidecar on pipe errors (broken pipe, closed stdout)
  with one retry attempt
- Hide sidecar console window on Windows (CREATE_NO_WINDOW flag)
- Log sidecar stderr to sidecar.log file for crash diagnostics
- Include exit status in error message when sidecar fails to start

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/build-linux.yml

@@ -1,120 +0,0 @@
-name: Build Linux
-
-on:
-  push:
-    tags: ["v*"]
-
-env:
-  PYTHON_VERSION: "3.11"
-  NODE_VERSION: "20"
-  TARGET: x86_64-unknown-linux-gnu
-
-jobs:
-  build:
-    name: Build (Linux)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      # ── Python sidecar ──
-      - name: Install uv
-        run: |
-          if command -v uv &> /dev/null; then
-            echo "uv already installed: $(uv --version)"
-          else
-            curl -LsSf https://astral.sh/uv/install.sh | sh
-            echo "$HOME/.local/bin" >> $GITHUB_PATH
-          fi
-
-      - name: Install ffmpeg
-        run: sudo apt-get update && sudo apt-get install -y ffmpeg
-
-      - name: Set up Python
-        run: uv python install ${{ env.PYTHON_VERSION }}
-
-      - name: Build sidecar
-        working-directory: python
-        run: uv run --python ${{ env.PYTHON_VERSION }} python build_sidecar.py --cpu-only
-
-      - name: Package sidecar for Tauri
-        run: |
-          cd python/dist/voice-to-notes-sidecar && zip -r ../../../src-tauri/sidecar.zip .
-
-      # ── Tauri app ──
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-
-      - name: Install Rust stable
-        run: |
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
-          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-
-      - name: Install system dependencies
-        run: |
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf xdg-utils
-
-      - name: Install npm dependencies
-        run: npm ci
-
-      - name: Build Tauri app
-        run: npm run tauri build
-
-      # ── Release ──
-      - name: Upload to release
-        env:
-          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
-        run: |
-          sudo apt-get install -y jq
-          REPO_API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
-
-          TAG="${GITHUB_REF_NAME}"
-          RELEASE_NAME="Voice to Notes ${TAG}"
-          echo "Release tag: ${TAG}"
-
-          # Wait for release to be created by the release workflow
-          for i in 1 2 3 4 5; do
-            RELEASE_ID=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
-              "${REPO_API}/releases/tags/${TAG}" | jq -r '.id // empty')
-            if [ -n "${RELEASE_ID}" ] && [ "${RELEASE_ID}" != "null" ]; then
-              break
-            fi
-            echo "Release not found yet, waiting 10s... (attempt $i)"
-            sleep 10
-          done
-
-          # Fallback: create release if it still doesn't exist
-          if [ -z "${RELEASE_ID}" ] || [ "${RELEASE_ID}" = "null" ]; then
-            RELEASE_ID=$(curl -s -X POST \
-              -H "Authorization: token ${BUILD_TOKEN}" \
-              -H "Content-Type: application/json" \
-              -d "{\"tag_name\": \"${TAG}\", \"name\": \"${RELEASE_NAME}\", \"body\": \"Automated build.\", \"draft\": false, \"prerelease\": false}" \
-              "${REPO_API}/releases" | jq -r '.id')
-          fi
-
-          echo "Release ID: ${RELEASE_ID}"
-          if [ "${RELEASE_ID}" = "null" ] || [ -z "${RELEASE_ID}" ]; then
-            echo "ERROR: Failed to create/find release."
-            exit 1
-          fi
-
-          find src-tauri/target/release/bundle -type f -name "*.deb" | while IFS= read -r file; do
-            filename=$(basename "$file")
-            encoded_name=$(echo "$filename" | sed 's/ /%20/g')
-            echo "Uploading ${filename} ($(du -h "$file" | cut -f1))..."
-
-            ASSET_ID=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
-              "${REPO_API}/releases/${RELEASE_ID}/assets" | jq -r ".[] | select(.name == \"${filename}\") | .id // empty")
-            if [ -n "${ASSET_ID}" ]; then
-              curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
-                "${REPO_API}/releases/${RELEASE_ID}/assets/${ASSET_ID}"
-            fi
-
-            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
-              -H "Authorization: token ${BUILD_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              -T "$file" \
-              "${REPO_API}/releases/${RELEASE_ID}/assets?name=${encoded_name}")
-            echo "Upload response: HTTP ${HTTP_CODE}"
-          done

.gitea/workflows/build-macos.yml

@@ -1,121 +0,0 @@
-name: Build macOS
-
-on:
-  push:
-    tags: ["v*"]
-
-env:
-  PYTHON_VERSION: "3.11"
-  NODE_VERSION: "20"
-  TARGET: aarch64-apple-darwin
-
-jobs:
-  build:
-    name: Build (macOS)
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      # ── Python sidecar ──
-      - name: Install uv
-        run: |
-          if command -v uv &> /dev/null; then
-            echo "uv already installed: $(uv --version)"
-          else
-            curl -LsSf https://astral.sh/uv/install.sh | sh
-            echo "$HOME/.local/bin" >> $GITHUB_PATH
-          fi
-
-      - name: Install ffmpeg
-        run: brew install ffmpeg
-
-      - name: Set up Python
-        run: uv python install ${{ env.PYTHON_VERSION }}
-
-      - name: Build sidecar
-        working-directory: python
-        run: uv run --python ${{ env.PYTHON_VERSION }} python build_sidecar.py --cpu-only
-
-      - name: Package sidecar for Tauri
-        run: |
-          cd python/dist/voice-to-notes-sidecar && zip -r ../../../src-tauri/sidecar.zip .
-
-      # ── Tauri app ──
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-
-      - name: Install Rust stable
-        run: |
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
-          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-
-      - name: Install system dependencies
-        run: brew install --quiet create-dmg || true
-
-      - name: Install npm dependencies
-        run: npm ci
-
-      - name: Build Tauri app
-        run: npm run tauri build
-
-      # ── Release ──
-      - name: Upload to release
-        env:
-          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
-        run: |
-          # Ensure jq is available
-          which jq || brew install jq
-
-          REPO_API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
-
-          TAG="${GITHUB_REF_NAME}"
-          RELEASE_NAME="Voice to Notes ${TAG}"
-          echo "Release tag: ${TAG}"
-
-          # Wait for release to be created by the release workflow
-          for i in 1 2 3 4 5; do
-            RELEASE_ID=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
-              "${REPO_API}/releases/tags/${TAG}" | jq -r '.id // empty')
-            if [ -n "${RELEASE_ID}" ] && [ "${RELEASE_ID}" != "null" ]; then
-              break
-            fi
-            echo "Release not found yet, waiting 10s... (attempt $i)"
-            sleep 10
-          done
-
-          # Fallback: create release if it still doesn't exist
-          if [ -z "${RELEASE_ID}" ] || [ "${RELEASE_ID}" = "null" ]; then
-            RELEASE_ID=$(curl -s -X POST \
-              -H "Authorization: token ${BUILD_TOKEN}" \
-              -H "Content-Type: application/json" \
-              -d "{\"tag_name\": \"${TAG}\", \"name\": \"${RELEASE_NAME}\", \"body\": \"Automated build.\", \"draft\": false, \"prerelease\": false}" \
-              "${REPO_API}/releases" | jq -r '.id')
-          fi
-
-          echo "Release ID: ${RELEASE_ID}"
-          if [ "${RELEASE_ID}" = "null" ] || [ -z "${RELEASE_ID}" ]; then
-            echo "ERROR: Failed to create/find release."
-            exit 1
-          fi
-
-          find src-tauri/target/release/bundle -type f -name "*.dmg" | while IFS= read -r file; do
-            filename=$(basename "$file")
-            encoded_name=$(echo "$filename" | sed 's/ /%20/g')
-            echo "Uploading ${filename} ($(du -h "$file" | cut -f1))..."
-
-            ASSET_ID=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
-              "${REPO_API}/releases/${RELEASE_ID}/assets" | jq -r ".[] | select(.name == \"${filename}\") | .id // empty")
-            if [ -n "${ASSET_ID}" ]; then
-              curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
-                "${REPO_API}/releases/${RELEASE_ID}/assets/${ASSET_ID}"
-            fi
-
-            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
-              -H "Authorization: token ${BUILD_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              -T "$file" \
-              "${REPO_API}/releases/${RELEASE_ID}/assets?name=${encoded_name}")
-            echo "Upload response: HTTP ${HTTP_CODE}"
-          done

.gitea/workflows/build-windows.yml

@@ -1,141 +0,0 @@
-name: Build Windows
-
-on:
-  push:
-    tags: ["v*"]
-
-env:
-  PYTHON_VERSION: "3.11"
-  NODE_VERSION: "20"
-  TARGET: x86_64-pc-windows-msvc
-
-jobs:
-  build:
-    name: Build (Windows)
-    runs-on: windows-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      # ── Python sidecar ──
-      - name: Install uv
-        shell: powershell
-        run: |
-          if (Get-Command uv -ErrorAction SilentlyContinue) {
-            Write-Host "uv already installed: $(uv --version)"
-          } else {
-            irm https://astral.sh/uv/install.ps1 | iex
-            echo "$env:USERPROFILE\.local\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-          }
-
-      - name: Install ffmpeg
-        shell: powershell
-        run: choco install ffmpeg -y
-
-      - name: Set up Python
-        shell: powershell
-        run: uv python install ${{ env.PYTHON_VERSION }}
-
-      - name: Build sidecar
-        shell: powershell
-        working-directory: python
-        run: uv run --python ${{ env.PYTHON_VERSION }} python build_sidecar.py --cpu-only
-
-      - name: Package sidecar for Tauri
-        shell: powershell
-        run: |
-          Compress-Archive -Path python\dist\voice-to-notes-sidecar\* -DestinationPath src-tauri\sidecar.zip
-
-      # ── Tauri app ──
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-
-      - name: Install Rust stable
-        shell: powershell
-        run: |
-          if (Get-Command rustup -ErrorAction SilentlyContinue) {
-            rustup default stable
-          } else {
-            Invoke-WebRequest -Uri https://win.rustup.rs/x86_64 -OutFile rustup-init.exe
-            .\rustup-init.exe -y --default-toolchain stable
-            echo "$env:USERPROFILE\.cargo\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-          }
-
-      - name: Install npm dependencies
-        shell: powershell
-        run: npm ci
-
-      - name: Build Tauri app
-        shell: powershell
-        run: npm run tauri build
-
-      # ── Release ──
-      - name: Upload to release
-        shell: powershell
-        env:
-          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
-        run: |
-          $REPO_API = "${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
-          $Headers = @{ "Authorization" = "token $env:BUILD_TOKEN" }
-
-          $TAG = "${{ github.ref_name }}"
-          $RELEASE_NAME = "Voice to Notes ${TAG}"
-          Write-Host "Release tag: ${TAG}"
-
-          # Wait for release to be created by the release workflow
-          $RELEASE_ID = $null
-          for ($i = 1; $i -le 5; $i++) {
-            try {
-              $release = Invoke-RestMethod -Uri "${REPO_API}/releases/tags/${TAG}" -Headers $Headers -ErrorAction Stop
-              $RELEASE_ID = $release.id
-              break
-            } catch {
-              Write-Host "Release not found yet, waiting 10s... (attempt $i)"
-              Start-Sleep -Seconds 10
-            }
-          }
-
-          # Fallback: create release if it still doesn't exist
-          if (-not $RELEASE_ID) {
-            $body = @{
-              tag_name = $TAG
-              name = $RELEASE_NAME
-              body = "Automated build."
-              draft = $false
-              prerelease = $false
-            } | ConvertTo-Json
-            $release = Invoke-RestMethod -Uri "${REPO_API}/releases" -Method Post -Headers $Headers -ContentType "application/json" -Body $body
-            $RELEASE_ID = $release.id
-          }
-
-          Write-Host "Release ID: ${RELEASE_ID}"
-
-          Get-ChildItem -Path src-tauri\target\release\bundle -Recurse -Include *.msi,*-setup.exe | ForEach-Object {
-            $filename = $_.Name
-            $encodedName = [System.Uri]::EscapeDataString($filename)
-            $size = [math]::Round($_.Length / 1MB, 1)
-            Write-Host "Uploading ${filename} (${size} MB)..."
-
-            try {
-              $assets = Invoke-RestMethod -Uri "${REPO_API}/releases/${RELEASE_ID}/assets" -Headers $Headers
-              $existing = $assets | Where-Object { $_.name -eq $filename }
-              if ($existing) {
-                Invoke-RestMethod -Uri "${REPO_API}/releases/${RELEASE_ID}/assets/$($existing.id)" -Method Delete -Headers $Headers
-              }
-            } catch {}
-
-            # Use curl for streaming upload (Invoke-RestMethod fails on large files)
-            $uploadUrl = "${REPO_API}/releases/${RELEASE_ID}/assets?name=${encodedName}"
-            $result = curl.exe --fail --silent --show-error `
-              -X POST `
-              -H "Authorization: token $env:BUILD_TOKEN" `
-              -H "Content-Type: application/octet-stream" `
-              --data-binary "@$($_.FullName)" `
-              "$uploadUrl" 2>&1
-            if ($LASTEXITCODE -eq 0) {
-              Write-Host "Upload successful: ${filename}"
-            } else {
-              Write-Host "WARNING: Upload failed for ${filename}: ${result}"
-            }
-          }

.gitea/workflows/release.yml

@@ -10,6 +10,9 @@ jobs:
     # Skip if this is a version-bump commit (avoid infinite loop)
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     runs-on: ubuntu-latest
+    outputs:
+      new_version: ${{ steps.bump.outputs.new_version }}
+      tag: ${{ steps.bump.outputs.tag }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -21,6 +24,7 @@ jobs:
           git config user.email "actions@gitea.local"
 
       - name: Bump patch version
+        id: bump
         run: |
           # Read current version from package.json
           CURRENT=$(grep '"version"' package.json | head -1 | sed 's/.*"version": *"\([^"]*\)".*/\1/')
@@ -46,12 +50,14 @@ jobs:
           # Update python/pyproject.toml
           sed -i "s/^version = \".*\"/version = \"${NEW_VERSION}\"/" python/pyproject.toml
 
-          echo "NEW_VERSION=${NEW_VERSION}" >> $GITHUB_ENV
+          echo "new_version=${NEW_VERSION}" >> $GITHUB_OUTPUT
+          echo "tag=v${NEW_VERSION}" >> $GITHUB_OUTPUT
 
       - name: Commit and tag
         env:
           BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
         run: |
+          NEW_VERSION="${{ steps.bump.outputs.new_version }}"
           git add package.json src-tauri/tauri.conf.json src-tauri/Cargo.toml python/pyproject.toml
           git commit -m "chore: bump version to ${NEW_VERSION} [skip ci]"
           git tag "v${NEW_VERSION}"
@@ -66,7 +72,7 @@ jobs:
           BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
         run: |
           REPO_API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
-          TAG="v${NEW_VERSION}"
+          TAG="${{ steps.bump.outputs.tag }}"
           RELEASE_NAME="Voice to Notes ${TAG}"
 
           curl -s -X POST \
@@ -75,3 +81,315 @@ jobs:
             -d "{\"tag_name\": \"${TAG}\", \"name\": \"${RELEASE_NAME}\", \"body\": \"Automated build.\", \"draft\": false, \"prerelease\": false}" \
             "${REPO_API}/releases"
           echo "Created release: ${RELEASE_NAME}"
+
+  # ── Platform builds (run after version bump) ──
+
+  build-linux:
+    name: Build (Linux)
+    needs: bump-version
+    runs-on: ubuntu-latest
+    env:
+      PYTHON_VERSION: "3.11"
+      NODE_VERSION: "20"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.bump-version.outputs.tag }}
+
+      # ── Python sidecar ──
+      - name: Install uv
+        run: |
+          if command -v uv &> /dev/null; then
+            echo "uv already installed: $(uv --version)"
+          else
+            curl -LsSf https://astral.sh/uv/install.sh | sh
+            echo "$HOME/.local/bin" >> $GITHUB_PATH
+          fi
+
+      - name: Install ffmpeg
+        run: sudo apt-get update && sudo apt-get install -y ffmpeg
+
+      - name: Set up Python
+        run: uv python install ${{ env.PYTHON_VERSION }}
+
+      - name: Build sidecar
+        working-directory: python
+        run: uv run --python ${{ env.PYTHON_VERSION }} python build_sidecar.py --cpu-only
+
+      - name: Package sidecar for Tauri
+        run: |
+          cd python/dist/voice-to-notes-sidecar && zip -r ../../../src-tauri/sidecar.zip .
+
+      # ── Tauri app ──
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install Rust stable
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf xdg-utils
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Build Tauri app
+        run: npm run tauri build
+
+      # ── Release ──
+      - name: Upload to release
+        env:
+          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
+        run: |
+          sudo apt-get install -y jq
+          REPO_API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+
+          TAG="${{ needs.bump-version.outputs.tag }}"
+          RELEASE_NAME="Voice to Notes ${TAG}"
+          echo "Release tag: ${TAG}"
+
+          RELEASE_ID=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
+            "${REPO_API}/releases/tags/${TAG}" | jq -r '.id // empty')
+
+          if [ -z "${RELEASE_ID}" ] || [ "${RELEASE_ID}" = "null" ]; then
+            echo "ERROR: Failed to find release for tag ${TAG}."
+            exit 1
+          fi
+
+          echo "Release ID: ${RELEASE_ID}"
+
+          find src-tauri/target/release/bundle -type f -name "*.deb" | while IFS= read -r file; do
+            filename=$(basename "$file")
+            encoded_name=$(echo "$filename" | sed 's/ /%20/g')
+            echo "Uploading ${filename} ($(du -h "$file" | cut -f1))..."
+
+            ASSET_ID=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
+              "${REPO_API}/releases/${RELEASE_ID}/assets" | jq -r ".[] | select(.name == \"${filename}\") | .id // empty")
+            if [ -n "${ASSET_ID}" ]; then
+              curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
+                "${REPO_API}/releases/${RELEASE_ID}/assets/${ASSET_ID}"
+            fi
+
+            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
+              -H "Authorization: token ${BUILD_TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              -T "$file" \
+              "${REPO_API}/releases/${RELEASE_ID}/assets?name=${encoded_name}")
+            echo "Upload response: HTTP ${HTTP_CODE}"
+          done
+
+  build-windows:
+    name: Build (Windows)
+    needs: bump-version
+    runs-on: windows-latest
+    env:
+      PYTHON_VERSION: "3.11"
+      NODE_VERSION: "20"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.bump-version.outputs.tag }}
+
+      # ── Python sidecar ──
+      - name: Install uv
+        shell: powershell
+        run: |
+          if (Get-Command uv -ErrorAction SilentlyContinue) {
+            Write-Host "uv already installed: $(uv --version)"
+          } else {
+            irm https://astral.sh/uv/install.ps1 | iex
+            echo "$env:USERPROFILE\.local\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          }
+
+      - name: Install ffmpeg
+        shell: powershell
+        run: choco install ffmpeg -y
+
+      - name: Set up Python
+        shell: powershell
+        run: uv python install ${{ env.PYTHON_VERSION }}
+
+      - name: Build sidecar
+        shell: powershell
+        working-directory: python
+        run: uv run --python ${{ env.PYTHON_VERSION }} python build_sidecar.py --cpu-only
+
+      - name: Package sidecar for Tauri
+        shell: powershell
+        run: |
+          Compress-Archive -Path python\dist\voice-to-notes-sidecar\* -DestinationPath src-tauri\sidecar.zip
+
+      # ── Tauri app ──
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install Rust stable
+        shell: powershell
+        run: |
+          if (Get-Command rustup -ErrorAction SilentlyContinue) {
+            rustup default stable
+          } else {
+            Invoke-WebRequest -Uri https://win.rustup.rs/x86_64 -OutFile rustup-init.exe
+            .\rustup-init.exe -y --default-toolchain stable
+            echo "$env:USERPROFILE\.cargo\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          }
+
+      - name: Install npm dependencies
+        shell: powershell
+        run: npm ci
+
+      - name: Build Tauri app
+        shell: powershell
+        run: npm run tauri build
+
+      # ── Release ──
+      - name: Upload to release
+        shell: powershell
+        env:
+          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
+        run: |
+          $REPO_API = "${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+          $Headers = @{ "Authorization" = "token $env:BUILD_TOKEN" }
+
+          $TAG = "${{ needs.bump-version.outputs.tag }}"
+          $RELEASE_NAME = "Voice to Notes ${TAG}"
+          Write-Host "Release tag: ${TAG}"
+
+          $release = Invoke-RestMethod -Uri "${REPO_API}/releases/tags/${TAG}" -Headers $Headers -ErrorAction Stop
+          $RELEASE_ID = $release.id
+          Write-Host "Release ID: ${RELEASE_ID}"
+
+          Get-ChildItem -Path src-tauri\target\release\bundle -Recurse -Include *.msi,*-setup.exe | ForEach-Object {
+            $filename = $_.Name
+            $encodedName = [System.Uri]::EscapeDataString($filename)
+            $size = [math]::Round($_.Length / 1MB, 1)
+            Write-Host "Uploading ${filename} (${size} MB)..."
+
+            try {
+              $assets = Invoke-RestMethod -Uri "${REPO_API}/releases/${RELEASE_ID}/assets" -Headers $Headers
+              $existing = $assets | Where-Object { $_.name -eq $filename }
+              if ($existing) {
+                Invoke-RestMethod -Uri "${REPO_API}/releases/${RELEASE_ID}/assets/$($existing.id)" -Method Delete -Headers $Headers
+              }
+            } catch {}
+
+            # Use curl for streaming upload (Invoke-RestMethod fails on large files)
+            $uploadUrl = "${REPO_API}/releases/${RELEASE_ID}/assets?name=${encodedName}"
+            $result = curl.exe --fail --silent --show-error `
+              -X POST `
+              -H "Authorization: token $env:BUILD_TOKEN" `
+              -H "Content-Type: application/octet-stream" `
+              --data-binary "@$($_.FullName)" `
+              "$uploadUrl" 2>&1
+            if ($LASTEXITCODE -eq 0) {
+              Write-Host "Upload successful: ${filename}"
+            } else {
+              Write-Host "WARNING: Upload failed for ${filename}: ${result}"
+            }
+          }
+
+  build-macos:
+    name: Build (macOS)
+    needs: bump-version
+    runs-on: macos-latest
+    env:
+      PYTHON_VERSION: "3.11"
+      NODE_VERSION: "20"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.bump-version.outputs.tag }}
+
+      # ── Python sidecar ──
+      - name: Install uv
+        run: |
+          if command -v uv &> /dev/null; then
+            echo "uv already installed: $(uv --version)"
+          else
+            curl -LsSf https://astral.sh/uv/install.sh | sh
+            echo "$HOME/.local/bin" >> $GITHUB_PATH
+          fi
+
+      - name: Install ffmpeg
+        run: brew install ffmpeg
+
+      - name: Set up Python
+        run: uv python install ${{ env.PYTHON_VERSION }}
+
+      - name: Build sidecar
+        working-directory: python
+        run: uv run --python ${{ env.PYTHON_VERSION }} python build_sidecar.py --cpu-only
+
+      - name: Package sidecar for Tauri
+        run: |
+          cd python/dist/voice-to-notes-sidecar && zip -r ../../../src-tauri/sidecar.zip .
+
+      # ── Tauri app ──
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install Rust stable
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+
+      - name: Install system dependencies
+        run: brew install --quiet create-dmg || true
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Build Tauri app
+        run: npm run tauri build
+
+      # ── Release ──
+      - name: Upload to release
+        env:
+          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
+        run: |
+          which jq || brew install jq
+
+          REPO_API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+
+          TAG="${{ needs.bump-version.outputs.tag }}"
+          RELEASE_NAME="Voice to Notes ${TAG}"
+          echo "Release tag: ${TAG}"
+
+          RELEASE_ID=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
+            "${REPO_API}/releases/tags/${TAG}" | jq -r '.id // empty')
+
+          if [ -z "${RELEASE_ID}" ] || [ "${RELEASE_ID}" = "null" ]; then
+            echo "ERROR: Failed to find release for tag ${TAG}."
+            exit 1
+          fi
+
+          echo "Release ID: ${RELEASE_ID}"
+
+          find src-tauri/target/release/bundle -type f -name "*.dmg" | while IFS= read -r file; do
+            filename=$(basename "$file")
+            encoded_name=$(echo "$filename" | sed 's/ /%20/g')
+            echo "Uploading ${filename} ($(du -h "$file" | cut -f1))..."
+
+            ASSET_ID=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
+              "${REPO_API}/releases/${RELEASE_ID}/assets" | jq -r ".[] | select(.name == \"${filename}\") | .id // empty")
+            if [ -n "${ASSET_ID}" ]; then
+              curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
+                "${REPO_API}/releases/${RELEASE_ID}/assets/${ASSET_ID}"
+            fi
+
+            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
+              -H "Authorization: token ${BUILD_TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              -T "$file" \
+              "${REPO_API}/releases/${RELEASE_ID}/assets?name=${encoded_name}")
+            echo "Upload response: HTTP ${HTTP_CODE}"
+          done

package.json

@@ -1,6 +1,6 @@
 {
   "name": "voice-to-notes",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Desktop app for transcribing audio/video with speaker identification",
   "type": "module",
   "scripts": {

python/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "voice-to-notes"
-version = "0.2.1"
+version = "0.2.3"
 description = "Python sidecar for Voice to Notes — transcription, diarization, and AI services"
 requires-python = ">=3.11"
 license = "MIT"

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "voice-to-notes"
-version = "0.2.1"
+version = "0.2.3"
 description = "Voice to Notes — desktop transcription with speaker identification"
 authors = ["Voice to Notes Contributors"]
 license = "MIT"

src-tauri/src/sidecar/mod.rs

@@ -6,6 +6,9 @@ use std::path::{Path, PathBuf};
 use std::process::{Child, ChildStdin, Command, Stdio};
 use std::sync::{Mutex, OnceLock};
 
+#[cfg(target_os = "windows")]
+use std::os::windows::process::CommandExt;
+
 use crate::sidecar::messages::IPCMessage;
 
 /// Resource directory set by the Tauri app during setup.
@@ -231,10 +234,28 @@ impl SidecarManager {
         self.stop().ok();
         eprintln!("[sidecar-rs] Starting frozen sidecar: {}", path.display());
 
-        let child = Command::new(path)
+        // Log sidecar stderr to a file for diagnostics
-            .stdin(Stdio::piped())
+        let stderr_cfg = if let Some(data_dir) = DATA_DIR.get() {
+            let log_path = data_dir.join("sidecar.log");
+            eprintln!("[sidecar-rs] Sidecar stderr → {}", log_path.display());
+            match std::fs::File::create(&log_path) {
+                Ok(f) => Stdio::from(f),
+                Err(_) => Stdio::inherit(),
+            }
+        } else {
+            Stdio::inherit()
+        };
+
+        let mut cmd = Command::new(path);
+        cmd.stdin(Stdio::piped())
             .stdout(Stdio::piped())
-            .stderr(Stdio::inherit())
+            .stderr(stderr_cfg);
+
+        // Hide the console window on Windows (CREATE_NO_WINDOW = 0x08000000)
+        #[cfg(target_os = "windows")]
+        cmd.creation_flags(0x08000000);
+
+        let child = cmd
             .spawn()
             .map_err(|e| format!("Failed to start sidecar binary: {e}"))?;
 
@@ -300,7 +321,22 @@ impl SidecarManager {
                     .read_line(&mut line)
                     .map_err(|e| format!("Read error: {e}"))?;
                 if bytes == 0 {
-                    return Err("Sidecar closed stdout before sending ready".to_string());
+                    // Try to get the exit code for diagnostics
+                    let exit_info = {
+                        let mut proc = self.process.lock().map_err(|e| e.to_string())?;
+                        if let Some(ref mut child) = *proc {
+                            match child.try_wait() {
+                                Ok(Some(status)) => format!(" (exit status: {status})"),
+                                _ => String::new(),
+                            }
+                        } else {
+                            String::new()
+                        }
+                    };
+                    return Err(format!(
+                        "Sidecar closed stdout before sending ready{exit_info}. \
+                         The Python sidecar may have crashed on startup — check app logs for details."
+                    ));
                 }
                 let trimmed = line.trim();
                 if trimmed.is_empty() {
@@ -330,11 +366,46 @@ impl SidecarManager {
 
     /// Send a message and receive the response, calling a callback for intermediate messages.
     /// Intermediate messages include progress, pipeline.segment, and pipeline.speaker_update.
+    ///
+    /// If the sidecar has crashed (broken pipe), automatically restarts it and retries once.
     pub fn send_and_receive_with_progress<F>(
         &self,
         msg: &IPCMessage,
         on_intermediate: F,
     ) -> Result<IPCMessage, String>
+    where
+        F: Fn(&IPCMessage),
+    {
+        match self.send_and_receive_inner(msg, &on_intermediate) {
+            Ok(response) => Ok(response),
+            Err(e)
+                if e.contains("Write error")
+                    || e.contains("closed stdout")
+                    || e.contains("not available") =>
+            {
+                eprintln!("[sidecar-rs] Sidecar communication failed ({e}), restarting...");
+                self.cleanup_handles();
+                // Stop any zombie process
+                {
+                    let mut proc = self.process.lock().map_err(|e| e.to_string())?;
+                    if let Some(ref mut child) = proc.take() {
+                        let _ = child.kill();
+                        let _ = child.wait();
+                    }
+                }
+                self.ensure_running()?;
+                self.send_and_receive_inner(msg, &on_intermediate)
+            }
+            Err(e) => Err(e),
+        }
+    }
+
+    /// Inner implementation of send_and_receive.
+    fn send_and_receive_inner<F>(
+        &self,
+        msg: &IPCMessage,
+        on_intermediate: &F,
+    ) -> Result<IPCMessage, String>
     where
         F: Fn(&IPCMessage),
     {
@@ -420,8 +491,39 @@ impl SidecarManager {
     }
 
     pub fn is_running(&self) -> bool {
-        let proc = self.process.lock().ok();
+        let mut proc = match self.process.lock() {
-        proc.map_or(false, |p| p.is_some())
+            Ok(p) => p,
+            Err(_) => return false,
+        };
+        if let Some(ref mut child) = *proc {
+            // Check if the process has exited
+            match child.try_wait() {
+                Ok(Some(_status)) => {
+                    // Process has exited — clean up handles
+                    eprintln!("[sidecar-rs] Sidecar process has exited");
+                    drop(proc);
+                    let _ = self.cleanup_handles();
+                    false
+                }
+                Ok(None) => true, // Still running
+                Err(_) => false,
+            }
+        } else {
+            false
+        }
+    }
+
+    /// Clean up stdin/stdout/process handles after the sidecar has exited.
+    fn cleanup_handles(&self) {
+        if let Ok(mut s) = self.stdin.lock() {
+            *s = None;
+        }
+        if let Ok(mut r) = self.reader.lock() {
+            *r = None;
+        }
+        if let Ok(mut p) = self.process.lock() {
+            *p = None;
+        }
     }
 }
 

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Voice to Notes",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "identifier": "com.voicetonotes.app",
   "build": {
     "beforeDevCommand": "npm run dev",