diff --git a/.github/workflows/desktop-macos-release.yml b/.github/workflows/desktop-macos-release.yml
index d52f20db..31073cb4 100644
--- a/.github/workflows/desktop-macos-release.yml
+++ b/.github/workflows/desktop-macos-release.yml
@@ -53,18 +53,30 @@ jobs:
           if [ -z "$TAG" ]; then
             TAG="v${VERSION}"
           fi
+          TAG="$(printf '%s' "$TAG" | tr -d '\r\n' | sed 's/[^A-Za-z0-9._-]/-/g')"
+          if [ -z "$TAG" ]; then
+            echo "Resolved release tag is empty after normalization." >&2
+            exit 1
+          fi
 
           RELEASE_NAME="$RELEASE_NAME_INPUT"
           if [ -z "$RELEASE_NAME" ]; then
             RELEASE_NAME="CloudCLI Desktop macOS ${TAG}"
           fi
+          RELEASE_NAME_DELIMITER="release_name_$(uuidgen)"
 
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "release_name=$RELEASE_NAME" >> "$GITHUB_OUTPUT"
-          echo "server_bundle_tag=cloudcli-local-server-${TAG}" >> "$GITHUB_OUTPUT"
+          {
+            echo "tag=$TAG"
+            echo "release_name<<$RELEASE_NAME_DELIMITER"
+            printf '%s\n' "$RELEASE_NAME"
+            echo "$RELEASE_NAME_DELIMITER"
+            echo "server_bundle_tag=cloudcli-local-server-${TAG}"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Configure release server bundle source
-        run: printf '{"releaseTag":"%s"}\n' "${{ steps.release.outputs.server_bundle_tag }}" > electron/server-bundle-config.json
+        env:
+          SERVER_BUNDLE_TAG: ${{ steps.release.outputs.server_bundle_tag }}
+        run: printf '{"releaseTag":"%s"}\n' "$SERVER_BUNDLE_TAG" > electron/server-bundle-config.json
 
       - name: Verify signing secrets are configured
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 32ace264..d33fd337 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,6 +30,8 @@ jobs:
           - runs_on: macos-15-intel
             target_dir: darwin-x64
     runs-on: ${{ matrix.runs_on }}
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
@@ -63,6 +65,8 @@ jobs:
           - runs_on: windows-11-arm
             target_dir: win32-arm64
     runs-on: ${{ matrix.runs_on }}
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
diff --git a/server/modules/computer-use/semantics/helpers/macos/CloudCLISemantics.swift b/server/modules/computer-use/semantics/helpers/macos/CloudCLISemantics.swift
index 8b83f9ee..be435f9b 100644
--- a/server/modules/computer-use/semantics/helpers/macos/CloudCLISemantics.swift
+++ b/server/modules/computer-use/semantics/helpers/macos/CloudCLISemantics.swift
@@ -78,8 +78,9 @@ func bounds(_ element: AXUIElement) -> [String: Double]? {
           CFGetTypeID(sizeValue) == AXValueGetTypeID()
     else { return nil }
 
-    let positionAxValue = positionValue as! AXValue
-    let sizeAxValue = sizeValue as! AXValue
+    guard let positionAxValue = positionValue as? AXValue,
+          let sizeAxValue = sizeValue as? AXValue
+    else { return nil }
     guard AXValueGetValue(positionAxValue, .cgPoint, &point),
           AXValueGetValue(sizeAxValue, .cgSize, &size)
     else { return nil }