Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/desktop-build-deploy.yml:
- Around line 82-86: The version extraction logic only handles tags with the v
prefix (refs/tags/v*) but fails to extract the version from bare SemVer tags
like 1.2.3. To fix this, add an additional condition in all three
release-version blocks (lines 82-86, 197-201, and 285-289) that also matches
tags in the refs/tags/ format directly and extracts the version by stripping the
refs/tags/ prefix. The VERSION variable assignment should handle both cases:
first check for refs/tags/v* and strip the prefix accordingly, then fall back to
checking for refs/tags/ with a simple suffix removal, ensuring bare SemVer tags
are properly recognized and VERSION is populated correctly for all tag formats.

In `@packages/dtx-desktop/src-tauri/src/filesystem.rs`:
- Around line 378-389: The while let Ok(Some(entry)) pattern at the start of the
loop in inspect_tree_folder silently exits iteration when next_entry()
encounters an error without logging it, causing incomplete directory processing.
Replace this pattern with explicit error handling that logs the error from
next_entry().await before deciding to break the loop, similar to how file_type
errors are logged in the match statement, to ensure visibility into why
directory iteration failed.
- Around line 59-67: The order of checks in the match statement for
canonicalize_within_workspace is leaking information about the existence of
paths outside the workspace boundary. Before attempting to canonicalize, first
validate that the full_path_string is actually contained within the
workspace_root, and return a consistent "outside the workspace" error for all
cases where the path is outside the boundary regardless of whether the path
exists. Only proceed with canonicalization for paths that pass the containment
check first, ensuring that NotFound errors only occur for paths that are
legitimately within the workspace.

In `@packages/dtx-desktop/src-tauri/src/lib.rs`:
- Around line 42-45: The deep-link scheme filtering in the `map` and `filter`
chain is case-sensitive and only matches lowercase "dtx://" schemes, causing
valid uppercase or mixed-case variants like "DTX://" to be filtered out and
ignored. Convert each argument to lowercase before checking if it starts with
the deep-link scheme by using `to_lowercase()` on the arg within the filter
closure, so the check becomes case-insensitive while preserving the original
case of the captured URL.

---

Outside diff comments:
In `@packages/dtx-desktop/src-tauri/src/songs.rs`:
- Around line 118-125: The code validates that song_path is within the workspace
bounds on line 118 using canonicalize_within_workspace, but then passes the
original song_path to export_song_folder_to_zip on line 125. This creates a
security vulnerability where a symlink could be changed between validation and
use. Store the result of the canonicalize_within_workspace call as the validated
canonical path, then pass this canonical path to export_song_folder_to_zip
instead of the original song_path to ensure the validated path is actually used
for the export operation.

---

Nitpick comments:
In `@packages/dtx-desktop/src-tauri/src/tests/api_tests.rs`:
- Around line 1464-1480: The test `upload_form_to_api_times_out_on_slow_server`
is slow because it waits for the full production timeout value
`API_REQUEST_TIMEOUT_MS`. Refactor the `upload_form_to_api` function to accept
an injectable HTTP client parameter with a configurable timeout, then create a
test helper that takes a custom timeout duration. In the test, inject a client
with a short timeout duration (e.g., a few milliseconds) instead of waiting for
the production timeout, and call the helper with this short-timeout client to
make the test run quickly while still verifying timeout behavior.

In `@packages/dtx-desktop/src/renderer/src/components/NewSong.svelte`:
- Line 6: In the NewSong.svelte file, the import statement for desktopHost
currently uses a relative path that should be replaced with the package alias
for consistency and maintainability. Change the desktopHost import statement
from using the relative path `../services/desktopHost` to instead use the
`$lib/` alias pattern, which will resolve to the same location but provides a
more stable path reference that is safer for future refactors.

In `@packages/dtx-desktop/src/renderer/src/components/Settings.svelte`:
- Line 5: The import statement for desktopHost currently uses a relative path
../services/desktopHost instead of following the package convention of using the
$lib/ alias. Replace the relative path import in Settings.svelte with the $lib/
aliased path, changing from '../services/desktopHost' to
'$lib/services/desktopHost' to match the codebase conventions for internal
package imports.

In `@packages/dtx-desktop/src/renderer/src/components/Settings.test.ts`:
- Around line 12-14: The vi.mock call for desktopHost is using a relative path
'../services/desktopHost' instead of the repository's $lib/ alias convention.
Replace the relative path string in the vi.mock function call with the
appropriate $lib/ alias path to match the project's import conventions and
ensure consistency across the codebase.