Build shadowcode before cargo test so Native Linux release can verify

[Shadowfetchapps]

Cause

Native Linux release for tag v0.21.0 failed in Verify native source (run 35605675739). qualification_real required target/debug/shadowcode before cargo test built it.

Native desktop on this PR then failed after that ordering fix:

1. Run 35608824340: attach_close_loop_does_not_grow_descriptors — descriptor leak: baseline=39 after=64 from process-wide /proc/self/fd while other control tests ran in the same binary.
2. Run 35611464742: CLI harness still required ShadowCode 0.20.0; binary printed 0.21.0.
3. Run 35612626146: cargo test and CLI passed. Step Exercise the native window failed at scripts/test-native-desktop.mjs:944 (Window can close after its owner exits timed out). ViewClient::reattach() held the attach mutex across a 20s wait_available.
4. Run 35614403801 job 106381282983: cargo test, CLI, and the window suite passed. Step Build native development packages with dependency notices failed after the type2-runtime Docker build:

Using sanitized packaging PATH: .../target/release:.../target/debug:/opt/hostedtoolcache/node/22.23.2/x64/bin:/usr/bin:/bin:/usr/sbin:/sbin
...
Error: spawn rustc ENOENT
  path: 'rustc'
  spawnargs: [ '--version', '--verbose' ]
  cmd: 'rustc --version --verbose'

applicationNotices() in scripts/native-notices.mjs records the compiler for dependency notices. applyPackagingPath omitted rustup/CARGO_HOME, so rustc was gone while /usr/local/bin (Hermes) stayed correctly excluded.

Fix

1. Build -p shadowcode-desktop before cargo test in release.yml and native.yml.
2. Move the descriptor loop into control_descriptors.rs.
3. Read --version from src-tauri/tauri.conf.json in the CLI/runtime harnesses.
4. Stop holding the attach lock while waiting for a missing owner; close() sets a closing flag so reconnect aborts immediately.
5. Keep CARGO_HOME/bin, ~/.cargo/bin, and any already-safe PATH directory that contains rustc/cargo on the sanitized packaging PATH. Still reject /usr/local/bin, /snap/bin, and Hermes.

No version, tag, or release-artifact changes.

Local verification

• Isolated qualification_real without a prior desktop build: same missing-binary assertion as v0.21.0.
• Isolated descriptor test: 17 → 17. Remaining plus new control suite: 13 passed.
• node scripts/test-native-cli.mjs passed (21 scenario groups).
• Close-during-reattach test plus existing reattach/owner-exit tests pass.
• node --test scripts/test-native-packaging-env.mjs: 3 passed, linuxdeploy scan skipped (no cached AppImage).
• After a dirty caller PATH (/usr/local/bin:/snap/bin:/usr/bin:/bin), sanitized PATH still runs rustc --version --verbose and cargo --version, and does not include /usr/local/bin or .hermes.

The full WebDriver window suite and build-native.mjs package step are not re-run in this environment. Native desktop CI is the check.

After merge

This PR does not publish v0.21.0. After Native desktop is green and the PR is merged, Robert must re-run the failed Native Linux release workflow or retag v0.21.0 onto a commit that includes this fix. Do not merge from this agent; do not retag from this PR.

  

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d426d194-ca36-4981-bb65-88b37bfb9790

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}