chore(release): 0.13.1 [skip ci]

## [0.13.1](https://github.com/evandrodevbr/GeminiNexus/compare/v0.13.0...v0.13.1) (2026-04-29)

### 🐛 Bug Fixes

* lazy-initialize api-logger to prevent EACCES in CI environments ([9bf7c46](https://github.com/evandrodevbr/GeminiNexus/commit/9bf7c46ff6320f49cba80923c9e11eac35a7d4f0))

.github/workflows/publish.yaml

@@ -1,11 +1,9 @@
 name: Publish Release
 
 on:
-  push:
+  workflow_run:
-    tags:
+    workflows: ["Release"]
-      - 'v*'
+    types: [completed]
-  release:
-    types: [published]
   workflow_dispatch:
     inputs:
       dry_run:
@@ -20,7 +18,46 @@ on:
         default: false
 
 jobs:
+  check-release:
+    name: Check for new release
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    permissions:
+      contents: read
+    outputs:
+      tag: ${{ steps.get_tag.outputs.tag }}
+      has_release: ${{ steps.get_tag.outputs.has_release }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get latest release tag
+        id: get_tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            version="$(node -e "process.stdout.write(require('./package.json').version)")"
+            tag="v$version"
+            echo "tag=$tag" >> "$GITHUB_OUTPUT"
+            echo "has_release=true" >> "$GITHUB_OUTPUT"
+          else
+            tag=$(gh release list --limit 1 --json tagName --jq '.[0].tagName // empty')
+            if [ -n "$tag" ]; then
+              echo "tag=$tag" >> "$GITHUB_OUTPUT"
+              echo "has_release=true" >> "$GITHUB_OUTPUT"
+              echo "Found release: $tag"
+            else
+              echo "has_release=false" >> "$GITHUB_OUTPUT"
+              echo "No release found, skipping build."
+            fi
+          fi
+
   build:
+    needs: check-release
+    if: needs.check-release.outputs.has_release == 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -136,16 +173,12 @@ jobs:
           echo "Dry run enabled: build artifacts generated and uploaded; release publish step will be skipped."
 
   publish:
-    name: Publish Release (Manual Approval)
+    name: Publish Release
-    needs: build
+    needs: [check-release, build]
     runs-on: ubuntu-latest
     if: needs.build.result == 'success' && (github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true')
     permissions:
       contents: write
-    # Configure the `release` environment with required reviewers in GitHub settings
-    # to enforce a manual approval gate before assets are uploaded.
-    environment:
-      name: release
 
     steps:
       - name: Checkout git repo
@@ -158,54 +191,17 @@ jobs:
           merge-multiple: true
           path: release-assets
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-
-      - name: Install Node and NPM
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
       - name: Resolve release tag
         id: release_tag
-        env:
-          RELEASE_EVENT_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || '' }}
         run: |
-          if [ -n "$RELEASE_EVENT_TAG" ]; then
+          tag="${{ needs.check-release.outputs.tag }}"
-            tag="$RELEASE_EVENT_TAG"
+          if [ -z "$tag" ]; then
-          else
+            version="$(node -e "process.stdout.write(require('./package.json').version)")"
-            version="$(node -e "const v=require('./package.json').version; if (!v) { throw new Error('package.json version is empty'); } process.stdout.write(v);")"
             tag="v$version"
           fi
-
-          if [ -z "$tag" ]; then
-            echo "::error::Resolved release tag is empty"
-            exit 1
-          fi
-
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
           echo "Using release tag: $tag"
 
-      - name: Ensure release is safe to update
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_TAG: ${{ steps.release_tag.outputs.tag }}
-          ALLOW_UPDATE_PUBLISHED_RELEASE: ${{ github.event_name == 'release' && 'true' || (github.event_name == 'workflow_dispatch' && github.event.inputs.allow_update_published_release) || 'false' }}
-        run: |
-          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
-            is_draft="$(gh release view "$RELEASE_TAG" --json isDraft --jq '.isDraft')"
-            if [ "$is_draft" != "true" ] && [ "$ALLOW_UPDATE_PUBLISHED_RELEASE" != "true" ]; then
-              echo "::error::Release $RELEASE_TAG is already published. Refusing to upload assets."
-              echo "::error::Re-run with workflow_dispatch input allow_update_published_release=true if you explicitly want to update it."
-              exit 1
-            fi
-          else
-            gh release create "$RELEASE_TAG" --title "$RELEASE_TAG" --draft --notes "Automated release draft."
-          fi
-
       - name: Upload assets to release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.releaserc.json

@@ -37,7 +37,7 @@
       "npmPublish": false
     }],
     ["@semantic-release/git", {
-      "assets": ["package.json", "package-lock.json", "CHANGELOG.md"],
+      "assets": ["package.json", "pnpm-lock.yaml", "CHANGELOG.md"],
       "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
     }],
     ["@semantic-release/github", {

CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.13.1](https://github.com/evandrodevbr/GeminiNexus/compare/v0.13.0...v0.13.1) (2026-04-29)
+
+### 🐛 Bug Fixes
+
+* lazy-initialize api-logger to prevent EACCES in CI environments ([9bf7c46](https://github.com/evandrodevbr/GeminiNexus/commit/9bf7c46ff6320f49cba80923c9e11eac35a7d4f0))
+
 <a name="readme-top"></a>
 
 # Changelog

package.json

@@ -1,7 +1,7 @@
 {
   "name": "gemini-nexus",
   "productName": "Gemini Nexus",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Gemini Nexus - Electron App",
   "main": ".vite/build/main.js",
   "private": true,

src/server/logging/api-logger.ts

@@ -8,17 +8,29 @@ import { sanitizeObject } from '../../utils/sensitiveDataMasking';
 const LOG_RETENTION = '30d';
 const LOG_MAX_SIZE = '50m';
 
-const agentDir = getAgentDir();
+let _logger: winston.Logger | null = null;
 
-if (!fs.existsSync(agentDir)) {
+/**
+ * Lazily initializes the API logger on first access.
+ * Avoids creating directories and file transports at module load time,
+ * preventing EACCES errors in CI/test environments.
+ */
+function getLogger(): winston.Logger {
+  if (_logger) {
+    return _logger;
+  }
+
+  const agentDir = getAgentDir();
+
+  if (!fs.existsSync(agentDir)) {
     try {
       fs.mkdirSync(agentDir, { recursive: true });
     } catch (e) {
       console.error('Failed to create agent directory for API logs', e);
     }
-}
+  }
 
-const fileFormat = winston.format.combine(
+  const fileFormat = winston.format.combine(
     winston.format.timestamp(),
     winston.format.printf(({ timestamp, level, message, ...meta }) => {
       const logEntry = {
@@ -29,9 +41,9 @@ const fileFormat = winston.format.combine(
       };
       return JSON.stringify(logEntry);
     }),
-);
+  );
 
-const consoleFormat = winston.format.combine(
+  const consoleFormat = winston.format.combine(
     winston.format.colorize({ all: true }),
     winston.format.printf(({ timestamp, level, message, ...meta }) => {
       const logEntry = {
@@ -42,9 +54,9 @@ const consoleFormat = winston.format.combine(
       };
       return JSON.stringify(logEntry);
     }),
-);
+  );
 
-const rotateTransport = new DailyRotateFile({
+  const rotateTransport = new DailyRotateFile({
     filename: path.join(agentDir, 'api-%DATE%.log'),
     datePattern: 'YYYY-MM-DD-HH',
     maxSize: LOG_MAX_SIZE,
@@ -53,25 +65,40 @@ const rotateTransport = new DailyRotateFile({
     auditFile: path.join(agentDir, '.api-log-audit.json'),
     level: 'debug',
     format: fileFormat,
-});
+  });
 
-rotateTransport.on('error', (error) => {
+  rotateTransport.on('error', (error) => {
     console.error('DailyRotateFile API transport error', error);
-});
+  });
 
-const consoleTransport = new winston.transports.Console({
+  const consoleTransport = new winston.transports.Console({
     level: 'debug',
     format: consoleFormat,
-});
+  });
 
-consoleTransport.on('error', (error) => {
+  consoleTransport.on('error', (error) => {
     console.error('Console API transport error', error);
-});
+  });
 
-export const apiLogger = winston.createLogger({
+  _logger = winston.createLogger({
     level: 'debug',
     transports: [consoleTransport, rotateTransport],
     exitOnError: false,
+  });
+
+  return _logger;
+}
+
+/** Lazily-initialized API logger instance. */
+export const apiLogger = new Proxy({} as winston.Logger, {
+  get(_target, prop: string) {
+    const logger = getLogger();
+    const value = logger[prop as keyof winston.Logger];
+    if (typeof value === 'function') {
+      return value.bind(logger);
+    }
+    return value;
+  },
 });
 
 /**