Prepare Ceiling 1.5.31

[tsouth89]

Cuts 1.5.31. Version bumped in all five locations from VERSIONING.md, BUILD_NUMBER=133, Cargo.lock regenerated, and everything since the last public 1.5.29 folded into a dated section.

Supersedes 1.5.30, which was tagged and drafted on 2026-08-13 but never published. The v1.5.30 tag stays as a marker.

What's in it

Updates check Authenticode, not just a GitHub SHA256 (#285). A compromised release could replace both the installer and its digest. Every download is now checked against Ceiling's publisher identity twice, and a failed check is deleted.

codexbar serve requires a per-user bearer token (#291 / SBS-728). Loopback plus Host was not enough. /usage and /cost need Authorization: Bearer unless --allow-unauthenticated. Identity and raw provider errors are omitted by default.

Cookie and token fields are masked; revoke confirms first (#291 / SBS-735, SBS-734). Accidental Remove signed people out with one click, and leftover quota could stay on screen.

Windows PowerShell and where.exe launch from System32 (#291 / SBS-729). Bare names are gone.

Gemini/Grok refreshes merge instead of rewriting the credential file (#287). Account edits are transactional (#289). Codex token totals are 64-bit (#288). diagnose no longer copies provider error text (#286).

From unpublished 1.5.30: second tray click hides the dashboard (#283), Grok banked resets (#282), taskbar hidden-state in Settings (#264), second taskbar lane (#281), charts account isolation (#277), stale detail discarded (#278), credential status scoped to the selected provider (#279).

OpenCode and OpenCode Go show their mark on the taskbar (#290).

Validation

Hosted Frontend and Rust will run on this PR. Full local-check.ps1 -All is Windows-only and was not run on this Linux checkout.

Three release-doctor warnings are expected pre-tag: no local v1.5.31 tag, no GitHub release yet, no local assets directory.

Affected areas

• Tray panel
• Settings UI
• CLI
• Provider-specific behavior
• Installer / release packaging
• Documentation
• Config file / settings persistence
• Startup / background behavior

UI / tray proof

• Visual proof was not practical; manual validation and explanation attached

Release notes are the changelog section in this PR.

Notes for reviewers

This PR is the version bump and changelog only. The signed installer is built by tagging v1.5.31 after merge. Do not publish the 1.5.30 draft.

Note

Bump Ceiling desktop app version to 1.5.31

Updates version strings across all package manifests, Cargo files, and version.env from 1.5.30 to 1.5.31, and increments the build number from 132 to 133. The CHANGELOG.md documents security hardening changes in this release: Authenticode publisher pinning for installers, bearer-token auth for the codexbar serve API, System32-only PowerShell/where.exe resolution, and masked credential operations.

^{Macroscope summarized eb3b3eb.}

Summary by CodeRabbit

• Release
  • Updated the application to version 1.5.31 (build 133).
  • Added release notes covering improved tray behavior, taskbar placement, branding, and account handling.
  • Strengthened update and credential security, including better masking and confirmation for destructive actions.
  • Fixed diagnostics redaction, large usage totals, account-saving conflicts, and credential refresh reliability.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ceiling	eb3b3eb	Commit Preview URL Branch Preview URL	Aug 14 2026, 11:51 AM

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f955db0e-5d6d-4764-ba0b-f1cb19568d37

📥 Commits

Reviewing files that changed from the base of the PR and between 48d6055 and eb3b3eb.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• CHANGELOG.md
• apps/desktop-tauri/package.json
• apps/desktop-tauri/src-tauri/Cargo.toml
• apps/desktop-tauri/src-tauri/tauri.conf.json
• rust/Cargo.toml
• version.env

---

📝 Walkthrough

Walkthrough

The release changelog now documents Ceiling 1.5.31. Application, Rust, Tauri, marketing, and build metadata are synchronized to version 1.5.31, with build number 133.

Changes

Ceiling 1.5.31 release

Layer / File(s)	Summary
Release changelog entry CHANGELOG.md	Adds the dated 1.5.31 release entry and consolidates security, added, and fixed changes.
Synchronized version metadata apps/desktop-tauri/package.json, apps/desktop-tauri/src-tauri/Cargo.toml, apps/desktop-tauri/src-tauri/tauri.conf.json, rust/Cargo.toml, version.env	Updates release versions to 1.5.31 and increments the build number to 133.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to eb3b3

This PR updates release metadata and changelog content; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: finesssee

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: preparing the Ceiling 1.5.31 release.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch prepare/1.5.31

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Automated review

No blocking issues found.

Resolved since the previous pass: 1.

_{For coding agents: fix BLOCK and FIX IF QUICK findings now; everything else is tracked or informational; never exceed one CodeRev fix round per PR.}

_{Advisory. Findings generated by grok-subscription and muse-spark-1.2-contributor, each filtered through a 3-vote refutation panel with the changed code in evidence.}