Fix desktop release review findings

.github/workflows/release.yml

@@ -13,6 +13,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build-macos-semantic-helper:
     strategy:

electron/main.js

@@ -156,8 +156,8 @@ function getComputerUsePermissions() {
     };
   }
 
-  let accessibility = 'unknown';
-  let screenRecording = 'unknown';
+  let accessibility;
+  let screenRecording;
   try {
     accessibility = systemPreferences.isTrustedAccessibilityClient(false) ? 'granted' : 'not_granted';
   } catch {

scripts/release/build-server-bundle.js

@@ -86,6 +86,7 @@ async function writeServerPackageJson(stageDir) {
   // The bundle stage is not a git checkout with dev dependencies, so lifecycle
   // scripts such as Husky prepare must not run there. Dependency install scripts
   // still run; native modules need them before the Electron ABI rebuild below.
+  delete stagedPackageJson.scripts.postinstall;
   delete stagedPackageJson.scripts.prepare;
   delete stagedPackageJson.scripts.prepublishOnly;
   await fs.writeFile(

server/modules/computer-use/semantics/helpers/windows/Program.cs

@@ -1,6 +1,7 @@
 using System.Diagnostics;
 using System.Drawing;
 using System.Drawing.Imaging;
+using System.IO;
 using System.Runtime.InteropServices;
 using System.Text.Json;
 using System.Windows.Automation;