fix(desktop): beta6 语音与 UI 回归修复、2.0.0 发布和 Homebrew 自动同步

.github/workflows/android-apk.yml

@@ -164,9 +164,6 @@ jobs:
           # Android does not use the local Qwen3/Whisper C submodules.
           submodules: false
 
-      - name: Disable macOS-only Qwen3 MLX dependency
-        run: node openless-all/app/scripts/ci-disable-macos-qwen3.mjs
-
       - name: Check updater signing availability (tag release)
         if: needs.plan.outputs.is_tag_release == 'true'
         shell: bash
@@ -548,7 +545,8 @@ jobs:
           name: OpenLess ${{ github.ref_name }}
           # The desktop and Android jobs share one Beta draft. Publish it only
           # after all jobs and package verification have finished.
-          draft: ${{ env.OPENLESS_RELEASE_CHANNEL == 'beta' }}
+          # Publication is administrator-controlled after both asset workflows pass.
+          draft: true
           prerelease: ${{ env.OPENLESS_RELEASE_CHANNEL == 'beta' }}
           append_body: true
           body_path: ${{ runner.temp }}/android-release-body.md

.github/workflows/ci.yml

@@ -95,15 +95,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          # Android uses no desktop local-ASR submodules; the macOS MLX dependency stays out of
-          # this job.
+          # Optional local runtimes are not source submodules of the main application.
           submodules: false
 
-        # Android compiles no local-ASR C code: build.rs excludes the Android triple by TARGET
-        # (does not call build_qwen_asr). qwen3-asr-rs is a path dependency, and the Cargo
-        # resolver must read its manifest for all targets — so the ci-disable-macos-qwen3.mjs
-        # step below removes that dependency line, otherwise cargo check hard-fails.
-        # Dropping recursive fetch saves one network fetch and one failure point.
       - name: Setup Android SDK + NDK
         uses: android-actions/setup-android@v3
         with:
@@ -175,9 +169,6 @@ jobs:
       - name: Check Android updater pubkey matches tauri.conf.json
         run: npm run check:android-updater-pubkey
 
-      - name: Disable macOS-only Qwen3 MLX dependency
-        run: node scripts/ci-disable-macos-qwen3.mjs
-
       - name: Check Tauri backend (Android target)
         run: cargo check --locked --manifest-path src-tauri/Cargo.toml --target aarch64-linux-android
 
@@ -264,8 +255,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     env:
-      # With the shared Core in place, macOS's first build compiles the MLX C++ dependencies and
-      # the full Tauri test binary together; limit concurrency so the arm64 runner is not OOM-killed
+      # The shared Core and full Tauri test binary compile together; limit concurrency
+      # so the arm64 runner is not OOM-killed
       # at peak memory.
       CARGO_BUILD_JOBS: 2
       CARGO_PROFILE_TEST_DEBUG: 0
@@ -276,12 +267,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          # Initialize the MLX submodule on macOS only; Windows does not resolve that dependency.
-          submodules: ${{ matrix.os == 'macos-latest' && 'recursive' || 'false' }}
-      - name: Disable macOS-only Qwen3 MLX dependency
-        if: runner.os != 'macOS'
-        run: node scripts/ci-disable-macos-qwen3.mjs
-
+          # No legacy native-ASR submodules remain in this application.
+          submodules: false
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
@@ -319,12 +306,6 @@ jobs:
             openless-all/app -> target
             openless-all/app/src-tauri -> target
 
-      - name: Cache macOS MLX native build
-        if: runner.os == 'macOS' && runner.arch == 'ARM64'
-        uses: ./.github/actions/cache-macos-mlx
-        with:
-          profile: debug
-
       - name: Prepare Windows Sherpa static libraries
         if: runner.os == 'Windows'
         shell: pwsh
@@ -460,7 +441,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          submodules: recursive
+          submodules: false
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
@@ -474,11 +455,6 @@ jobs:
           workspaces: |
             openless-all/app/src-tauri -> target
             openless-all/app/src-tauri/backend-tests -> target
-      - name: Cache macOS MLX native build
-        if: runner.arch == 'ARM64'
-        uses: ./.github/actions/cache-macos-mlx
-        with:
-          profile: debug
       - run: npm ci
       - run: npm run build
       - name: Check Tauri backend with Rust 1.88 MSRV

.github/workflows/release-tauri.yml

@@ -62,12 +62,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          # The MLX submodule is only needed for macOS release builds.
-          submodules: ${{ startsWith(matrix.platform, 'macos') && 'recursive' || 'false' }}
-
-      - name: Disable macOS-only Qwen3 MLX dependency
-        if: ${{ !startsWith(matrix.platform, 'macos') }}
-        run: node openless-all/app/scripts/ci-disable-macos-qwen3.mjs
+          # Optional inference dependencies are installed only by explicit user opt-in.
+          submodules: false
 
       - uses: actions/setup-node@v4
         with:
@@ -99,12 +95,6 @@ jobs:
           key: macos-release-v1
           workspaces: 'openless-all/app/src-tauri -> target'
 
-      - name: Cache macOS MLX native build
-        if: matrix.updater-arch == 'aarch64'
-        uses: ./.github/actions/cache-macos-mlx
-        with:
-          profile: release
-
       - name: Prepare Windows Sherpa static libraries
         if: matrix.platform == 'windows-latest'
         working-directory: 'openless-all/app'
@@ -536,9 +526,9 @@ jobs:
         with:
           tag_name: ${{ github.ref_name }}
           name: 'OpenLess ${{ github.ref_name }}'
-          # Keep Beta assets private until all platforms have built and the
-          # administrator has verified the downloadable packages.
-          draft: ${{ env.OPENLESS_RELEASE_CHANNEL == 'beta' }}
+          # Both channels stay draft until all desktop/Android assets are verified.
+          # The administrator explicitly publishes the shared release afterwards.
+          draft: true
           # Beta releases must be marked prerelease=true: GitHub UI collapses them and regular
           # users do not see them; only latest-*-beta.json is uploaded, so stable users'
           # endpoint (latest-*.json) is never overwritten and beta never leaks into stable.
@@ -560,100 +550,3 @@ jobs:
             openless-all/app/src-tauri/target/release/bundle/msi/*.msi
             openless-all/app/src-tauri/target/release/bundle/msi/*.msi.sig
             openless-all/app/src-tauri/target/release/bundle/latest-*.json
-
-  # ── After a stable release, update the Homebrew cask automatically ──
-  # Why in this pipeline instead of a separate `release: published` workflow: a Release created
-  # by softprops with the default GITHUB_TOKEN does not trigger other workflows on the `release`
-  # event (GitHub's anti-recursion rule), so a standalone update-cask workflow would never fire
-  # automatically. Chaining it with needs: build in the same pipeline is the only way to update
-  # the cask on every stable release.
-  #
-  # Stable only: v*-tauri and not -beta-tauri. Beta does not touch Homebrew, avoiding pushing a
-  # prerelease to `brew install --cask openless` users. The cask lives on the default branch
-  # (beta); commits go back to that branch.
-  update-homebrew-cask:
-    name: Update Homebrew cask (stable only)
-    needs: build
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: write
-    if: >-
-      startsWith(github.ref, 'refs/tags/v')
-      && endsWith(github.ref, '-tauri')
-      && !endsWith(github.ref, '-beta-tauri')
-      && !contains(github.ref_name, '-Beta.')
-    steps:
-      - name: Checkout default branch (cask 住在这里)
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.repository.default_branch }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Resolve version + DMG sha256 from the release
-        id: meta
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          version="${TAG#v}"
-          version="${version%-tauri}"
-
-          # Download the DMGs directly and compute sha256 ourselves; do not depend on the
-          # timing/availability of GitHub's asset digest fields.
-          mkdir -p "$RUNNER_TEMP/dmg"
-          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
-            --dir "$RUNNER_TEMP/dmg" \
-            --pattern '*aarch64.dmg' --pattern '*_x64.dmg'
-
-          arm_sha="$(sha256sum "$RUNNER_TEMP"/dmg/*aarch64.dmg | cut -d' ' -f1)"
-          intel_sha="$(sha256sum "$RUNNER_TEMP"/dmg/*_x64.dmg | cut -d' ' -f1)"
-
-          {
-            echo "version=$version"
-            echo "arm_sha=$arm_sha"
-            echo "intel_sha=$intel_sha"
-          } >> "$GITHUB_OUTPUT"
-          echo "cask → version=$version arm=$arm_sha intel=$intel_sha"
-
-      - name: Update Casks/openless.rb
-        env:
-          VERSION: ${{ steps.meta.outputs.version }}
-          ARM_SHA: ${{ steps.meta.outputs.arm_sha }}
-          INTEL_SHA: ${{ steps.meta.outputs.intel_sha }}
-        run: |
-          set -euo pipefail
-          cask="Casks/openless.rb"
-          # Warning: line 2 of the cask, `arch arm: "aarch64", intel: "x64"`, also contains
-          # `intel: "..."`. A bare `s/intel: "..."/` would rewrite the arch instruction with a
-          # hash too -> brew installs 404 for Intel users. So the intel sed anchors the sha256
-          # line with `^[[:space:]]*intel:`, while the arm sed naturally matches only the sha256
-          # line via the `sha256 arm:   ` prefix. Capture group \1 preserves the original indent.
-          sed -i "s/version \"[^\"]*\"/version \"$VERSION\"/" "$cask"
-          sed -i "s/sha256 arm:   \"[^\"]*\"/sha256 arm:   \"$ARM_SHA\"/" "$cask"
-          sed -i "s/^\([[:space:]]*\)intel: \"[^\"]*\"/\1intel: \"$INTEL_SHA\"/" "$cask"
-          # Guard: the arch instruction must remain untouched and both new sha256 values must
-          # actually be written, otherwise fail the job.
-          grep -q 'arch arm: "aarch64", intel: "x64"' "$cask" \
-            || { echo "::error::arch 指令被 sed 误伤"; exit 1; }
-          grep -q "\"$ARM_SHA\"" "$cask" && grep -q "\"$INTEL_SHA\"" "$cask" \
-            || { echo "::error::sha256 未正确写入 cask"; exit 1; }
-          echo "----- updated $cask -----"
-          cat "$cask"
-
-      - name: Commit & push cask bump
-        env:
-          VERSION: ${{ steps.meta.outputs.version }}
-        run: |
-          set -euo pipefail
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add Casks/openless.rb
-          if git diff --cached --quiet; then
-            echo "cask 已是 $VERSION，无需提交"
-            exit 0
-          fi
-          # [skip ci]: cask text changes do not need another cross-platform ci.yml run.
-          git commit -m "[cask] openless $VERSION (auto from release) [skip ci]"
-          git push