move to RAM build

This reverts commit 6c7a87994e.

.gitea/actions/prepare-ram-ci/action.yml

@@ -0,0 +1,204 @@
+name: Prepare RAM CI environment
+description: Configure RAM-backed CI directories and Nexus package proxies
+
+runs:
+  using: composite
+
+  steps:
+    - name: Configure RAM CI environment
+      shell: bash
+      run: |
+        set -euo pipefail
+        set +x
+
+        require_value() {
+          local name="$1"
+          local value="$2"
+
+          if [ -z "$value" ]; then
+            echo "ERROR: required CI value is empty: $name"
+            exit 1
+          fi
+        }
+
+        require_value "NEXUS_CARGO_URL" "$NEXUS_CARGO_URL"
+        require_value "NEXUS_MAVEN_URL" "$NEXUS_MAVEN_URL"
+        require_value "NEXUS_NPM_URL" "$NEXUS_NPM_URL"
+        require_value "NEXUS_NODEJS_URL" "$NEXUS_NODEJS_URL"
+
+        normalize_url() {
+          local value="$1"
+
+          value="${value//$'\r'/}"
+          value="${value//$'\n'/}"
+
+          case "$value" in
+            \"*\")
+              value="${value#\"}"
+              value="${value%\"}"
+              ;;
+            \'*\')
+              value="${value#\'}"
+              value="${value%\'}"
+              ;;
+          esac
+
+          printf '%s' "$value"
+        }
+
+        NEXUS_CARGO_URL="$(normalize_url "$NEXUS_CARGO_URL")"
+        NEXUS_MAVEN_URL="$(normalize_url "$NEXUS_MAVEN_URL")"
+        NEXUS_NPM_URL="$(normalize_url "$NEXUS_NPM_URL")"
+        NEXUS_NODEJS_URL="$(normalize_url "$NEXUS_NODEJS_URL")"
+
+        NEXUS_CARGO_URL="${NEXUS_CARGO_URL%/}/"
+        NEXUS_MAVEN_URL="${NEXUS_MAVEN_URL%/}/"
+        NEXUS_NPM_URL="${NEXUS_NPM_URL%/}/"
+        NEXUS_NODEJS_URL="${NEXUS_NODEJS_URL%/}/"
+
+        # Resolve the image's stable toolchain before HOME/CARGO_HOME move to RAM.
+        # Keep toolchains in the image; only registry data and build output are ephemeral.
+        RUSTUP_HOME="${RUSTUP_HOME:-$HOME/.rustup}"
+        export RUSTUP_HOME
+        RUST_BIN="$(dirname "$(rustup which --toolchain stable rustc)")"
+        test -x "$RUST_BIN/cargo"
+
+        CI_ROOT="$GITHUB_WORKSPACE/.ci"
+
+        CI_HOME="$CI_ROOT/home"
+        CI_TMP="$CI_ROOT/tmp"
+        CI_BIN="$CI_ROOT/bin"
+
+        NPM_CONFIG_USERCONFIG="$CI_ROOT/npmrc"
+        NPM_CACHE="$CI_ROOT/npm-cache"
+
+        COREPACK_HOME="$CI_ROOT/corepack"
+        PNPM_HOME="$CI_ROOT/pnpm-home"
+
+        GRADLE_USER_HOME="$CI_ROOT/gradle"
+
+        CARGO_HOME="$CI_ROOT/cargo"
+        CARGO_TARGET_DIR="$CI_ROOT/cargo-target"
+
+        XDG_CACHE_HOME="$CI_ROOT/xdg-cache"
+        XDG_CONFIG_HOME="$CI_ROOT/xdg-config"
+        XDG_DATA_HOME="$CI_ROOT/xdg-data"
+
+        mkdir -p \
+          "$CI_HOME" \
+          "$CI_TMP" \
+          "$CI_BIN" \
+          "$NPM_CACHE" \
+          "$COREPACK_HOME" \
+          "$PNPM_HOME" \
+          "$GRADLE_USER_HOME/init.d" \
+          "$CARGO_HOME" \
+          "$CARGO_TARGET_DIR" \
+          "$XDG_CACHE_HOME" \
+          "$XDG_CONFIG_HOME" \
+          "$XDG_DATA_HOME"
+
+        chmod 700 \
+          "$CI_HOME" \
+          "$GRADLE_USER_HOME" \
+          "$CARGO_HOME"
+
+        cat > "$NPM_CONFIG_USERCONFIG" <<EOF
+        registry=$NEXUS_NPM_URL
+        cache=$NPM_CACHE
+        EOF
+
+        chmod 600 "$NPM_CONFIG_USERCONFIG"
+
+        {
+          printf '%s\n' '[source.crates-io]'
+          printf '%s\n' 'replace-with = "cargo-proxy"'
+          printf '\n'
+          printf '%s\n' '[source.cargo-proxy]'
+          printf 'registry = "sparse+%s"\n' "$NEXUS_CARGO_URL"
+        } > "$CARGO_HOME/config.toml"
+
+        chmod 600 "$CARGO_HOME/config.toml"
+
+        if [ "$(wc -l < "$CARGO_HOME/config.toml")" -ne 5 ]; then
+          echo "ERROR: generated Cargo config has unexpected line count"
+          nl -ba "$CARGO_HOME/config.toml"
+          exit 1
+        fi
+
+        cat > "$GRADLE_USER_HOME/init.d/00-nexus.init.gradle" <<'EOF'
+        def nexusUrl = System.getenv("NEXUS_MAVEN_URL")
+
+        if (nexusUrl == null || nexusUrl.isBlank()) {
+            throw new GradleException(
+                "NEXUS_MAVEN_URL is not configured"
+            )
+        }
+
+        def configureNexusRepository = { repositories ->
+            repositories.maven {
+                name = "CI_NEXUS"
+                url = uri(nexusUrl)
+                allowInsecureProtocol =
+                    nexusUrl.startsWith("http://")
+
+            }
+        }
+
+        gradle.beforeSettings { settings ->
+            configureNexusRepository(
+                settings.pluginManagement.repositories
+            )
+
+            configureNexusRepository(
+                settings.dependencyResolutionManagement.repositories
+            )
+        }
+        EOF
+
+        chmod 600 \
+          "$GRADLE_USER_HOME/init.d/00-nexus.init.gradle"
+
+        {
+          echo "CI_ROOT=$CI_ROOT"
+          echo "CI_BIN=$CI_BIN"
+
+          echo "HOME=$CI_HOME"
+          echo "TMPDIR=$CI_TMP"
+
+          echo "XDG_CACHE_HOME=$XDG_CACHE_HOME"
+          echo "XDG_CONFIG_HOME=$XDG_CONFIG_HOME"
+          echo "XDG_DATA_HOME=$XDG_DATA_HOME"
+
+          echo "NPM_CONFIG_USERCONFIG=$NPM_CONFIG_USERCONFIG"
+          echo "NPM_CONFIG_CACHE=$NPM_CACHE"
+          echo "npm_config_cache=$NPM_CACHE"
+
+          echo "COREPACK_HOME=$COREPACK_HOME"
+          echo "COREPACK_NPM_REGISTRY=$NEXUS_NPM_URL"
+
+          echo "PNPM_HOME=$PNPM_HOME"
+          echo "PNPM_CONFIG_REGISTRY=$NEXUS_NPM_URL"
+
+          echo "GRADLE_USER_HOME=$GRADLE_USER_HOME"
+
+          echo "CARGO_HOME=$CARGO_HOME"
+          echo "CARGO_TARGET_DIR=$CARGO_TARGET_DIR"
+          echo "RUSTUP_HOME=$RUSTUP_HOME"
+          echo "RUSTUP_TOOLCHAIN=stable"
+
+          echo "NVM_NODEJS_ORG_MIRROR=$NEXUS_NODEJS_URL"
+
+          echo "NEXUS_CARGO_URL=$NEXUS_CARGO_URL"
+          echo "NEXUS_MAVEN_URL=$NEXUS_MAVEN_URL"
+          echo "NEXUS_NPM_URL=$NEXUS_NPM_URL"
+          echo "NEXUS_NODEJS_URL=$NEXUS_NODEJS_URL"
+        } >> "$GITHUB_ENV"
+
+        {
+          echo "$RUST_BIN"
+          echo "$CI_BIN"
+          echo "$PNPM_HOME"
+        } >> "$GITHUB_PATH"
+
+        echo "CI package environment prepared."

.gitea/workflows/desktop.yml

@@ -2,9 +2,6 @@ name: Build Fluxer Desktop
 
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - main
 
 env:
   NODE_VERSION: "24"
@@ -150,6 +147,38 @@ jobs:
             throw "CANARY_APP_URL was not configured"
           }
 
+          $PackagePath = "fluxer-src\fluxer_desktop\package.json"
+
+          if (-not (Test-Path $PackagePath)) {
+            throw "package.json not found at $PackagePath"
+          }
+
+          $Package = Get-Content $PackagePath -Raw | ConvertFrom-Json
+          $Package.homepage = "https://ds.gandc.ru"
+
+          $PackageJson = $Package | ConvertTo-Json -Depth 100
+
+          [System.IO.File]::WriteAllText(
+            $PackagePath,
+            $PackageJson + [Environment]::NewLine,
+            (New-Object System.Text.UTF8Encoding($false))
+          )
+
+          Write-Host "Desktop homepage configured:"
+          (Get-Content $PackagePath -Raw | ConvertFrom-Json).homepage
+
+          $PackageBytes = [System.IO.File]::ReadAllBytes($PackagePath)
+          if (
+            $PackageBytes.Length -ge 3 -and
+            $PackageBytes[0] -eq 0xEF -and
+            $PackageBytes[1] -eq 0xBB -and
+            $PackageBytes[2] -eq 0xBF
+          ) {
+            throw "package.json unexpectedly contains UTF-8 BOM"
+          }
+
+          Write-Host "package.json UTF-8 BOM check: OK"
+
           $WindowPath = "fluxer-src\fluxer_desktop\src\main\Window.ts"
 
           if (-not (Test-Path $WindowPath)) {
@@ -208,6 +237,90 @@ jobs:
             -Pattern "sso.gandc.ru|will-redirect|allowTrustedOrSsoNavigation"
 
 
+      - name: Configure GSCORD update source
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $PatchScript = [Text.Encoding]::UTF8.GetString(
+            [Convert]::FromBase64String(
+              "CmNvbnN0IGZzID0gcmVxdWlyZSgnZnMnKTsKCmNvbnN0IGRvd25sb2Fkc1BhdGggPSAnZmx1eGVyLXNyYy9mbHV4ZXJfZGVza3RvcC9zcmMvbWFpbi9VcGRhdGVyRG93bmxvYWRzLnRzJzsKY29uc3QgdXBkYXRlclBhdGggPSAnZmx1eGVyLXNyYy9mbHV4ZXJfZGVza3RvcC9zcmMvbWFpbi9VcGRhdGVyLnRzJzsKCmZ1bmN0aW9uIHJlcGxhY2VSZWdleE9uY2UoaW5wdXQsIHBhdHRlcm4sIHJlcGxhY2VtZW50LCBsYWJlbCkgewogIGxldCBjb3VudCA9IDA7CiAgY29uc3Qgb3V0cHV0ID0gaW5wdXQucmVwbGFjZShwYXR0ZXJuLCAoLi4uYXJncykgPT4gewogICAgY291bnQgKz0gMTsKICAgIHJldHVybiB0eXBlb2YgcmVwbGFjZW1lbnQgPT09ICdmdW5jdGlvbicKICAgICAgPyByZXBsYWNlbWVudCguLi5hcmdzKQogICAgICA6IHJlcGxhY2VtZW50OwogIH0pOwoKICBpZiAoY291bnQgIT09IDEpIHsKICAgIHRocm93IG5ldyBFcnJvcihgVW5hYmxlIHRvIHBhdGNoICR7bGFiZWx9OiBtYXRjaGVzPSR7Y291bnR9YCk7CiAgfQoKICByZXR1cm4gb3V0cHV0Owp9CgpsZXQgZG93bmxvYWRzID0gZnMucmVhZEZpbGVTeW5jKGRvd25sb2Fkc1BhdGgsICd1dGY4Jyk7Cgpkb3dubG9hZHMgPSByZXBsYWNlUmVnZXhPbmNlKAogIGRvd25sb2FkcywKICAvY29uc3QgUEtHU19CQVNFX1VSTCA9ICdodHRwczpcL1wvcGtnc1wuZmx1eGVyXC5jb20nO1xyP1xuZXhwb3J0IGNvbnN0IFVQREFURV9CQVNFX1VSTCA9IGBcJFx7UEtHU19CQVNFX1VSTFx9XC9kZXNrdG9wXC9cJFx7QlVJTERfQ0hBTk5FTFx9XC9cJFx7cHJvY2Vzc1wucGxhdGZvcm1cfVwvXCRce0RFU0tUT1BfRE9XTkxPQURfQVJDSFx9YDtccj9cbmV4cG9ydCBjb25zdCBET1dOTE9BRF9QQUdFX1VSTCA9XHI/XG5ccypCVUlMRF9DSEFOTkVMID09PSAnY2FuYXJ5JyBcPyAnaHR0cHM6XC9cL2NhbmFyeVwuZmx1eGVyXC5hcHBcL2Rvd25sb2FkJyA6ICdodHRwczpcL1wvZmx1eGVyXC5hcHBcL2Rvd25sb2FkJzsvLAogICJleHBvcnQgY29uc3QgVVBEQVRFX0JBU0VfVVJMID0gJ2h0dHBzOi8vZ2l0LmdhbmRjLnJ1L2dzY29yZC9nc2NvcmQtZGVza3RvcC9yZWxlYXNlcyc7XG4iICsKICAgICJleHBvcnQgY29uc3QgRE9XTkxPQURfUEFHRV9VUkwgPSBVUERBVEVfQkFTRV9VUkw7IiwKICAnVXBkYXRlckRvd25sb2FkcyB1cGRhdGUgc291cmNlJywKKTsKCmRvd25sb2FkcyA9IHJlcGxhY2VSZWdleE9uY2UoCiAgZG93bmxvYWRzLAogIC9leHBvcnQgZnVuY3Rpb24gYnVpbGRNYW51YWxWZXJzaW9uRG93bmxvYWRVcmxcKHZlcnNpb246IHN0cmluZywgZm9ybWF0OiBNYW51YWxEZXNrdG9wRm9ybWF0XCk6IHN0cmluZyBce1xyP1xuXHMqcmV0dXJuIGBcJFx7VVBEQVRFX0JBU0VfVVJMXH1cL1wkXHt2ZXJzaW9uXH1cL1wkXHtmb3JtYXRcfWA7XHI/XG5cfS8sCiAgImV4cG9ydCBmdW5jdGlvbiBidWlsZE1hbnVhbFZlcnNpb25Eb3dubG9hZFVybCh2ZXJzaW9uOiBzdHJpbmcsIGZvcm1hdDogTWFudWFsRGVza3RvcEZvcm1hdCk6IHN0cmluZyB7XG4iICsKICAgICJcdHZvaWQgdmVyc2lvbjtcbiIgKwogICAgIlx0dm9pZCBmb3JtYXQ7XG4iICsKICAgICJcdHJldHVybiBET1dOTE9BRF9QQUdFX1VSTDtcbiIgKwogICAgIn0iLAogICdtYW51YWwgZmFsbGJhY2sgVVJMJywKKTsKCmRvd25sb2FkcyA9IHJlcGxhY2VSZWdleE9uY2UoCiAgZG93bmxvYWRzLAogIC91cmw6XHMqYnVpbGRNYW51YWxWZXJzaW9uRG93bmxvYWRVcmxcKGluZm9cLnZlcnNpb24sXHMqZm9ybWF0XCksLywKICAidXJsOiBmaWxlPy51cmwgPz8gYnVpbGRNYW51YWxWZXJzaW9uRG93bmxvYWRVcmwoaW5mby52ZXJzaW9uLCBmb3JtYXQpLCIsCiAgJ21hbnVhbCBhc3NldCBVUkwnLAopOwoKaWYgKGRvd25sb2Fkcy5pbmNsdWRlcygncGtncy5mbHV4ZXIuY29tJykpIHsKICB0aHJvdyBuZXcgRXJyb3IoCiAgICAncGtncy5mbHV4ZXIuY29tIGlzIHN0aWxsIHByZXNlbnQgaW4gVXBkYXRlckRvd25sb2Fkcy50cycsCiAgKTsKfQoKaWYgKAogICFkb3dubG9hZHMuaW5jbHVkZXMoCiAgICAnaHR0cHM6Ly9naXQuZ2FuZGMucnUvZ3Njb3JkL2dzY29yZC1kZXNrdG9wL3JlbGVhc2VzJywKICApCikgewogIHRocm93IG5ldyBFcnJvcignR1NDT1JEIHJlbGVhc2VzIFVSTCB3YXMgbm90IGluc3RhbGxlZCcpOwp9Cgpmcy53cml0ZUZpbGVTeW5jKGRvd25sb2Fkc1BhdGgsIGRvd25sb2FkcywgJ3V0ZjgnKTsKCmxldCB1cGRhdGVyID0gZnMucmVhZEZpbGVTeW5jKHVwZGF0ZXJQYXRoLCAndXRmOCcpOwoKdXBkYXRlciA9IHJlcGxhY2VSZWdleE9uY2UoCiAgdXBkYXRlciwKICAvY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBmZXRjaFwoYFwkXHtVUERBVEVfQkFTRV9VUkxcfVwvbGF0ZXN0YCwgXHsvLAogICJjb25zdCByZXNwb25zZSA9IGF3YWl0IGZldGNoKFxuIiArCiAgICAiXHRcdCdodHRwczovL2dpdC5nYW5kYy5ydS9hcGkvdjEvcmVwb3MvZ3Njb3JkL2dzY29yZC1kZXNrdG9wL3JlbGVhc2VzL2xhdGVzdCcsXG4iICsKICAgICJcdFx0eyIsCiAgJ0dpdGVhIGxhdGVzdCByZWxlYXNlIFVSTCcsCik7Cgpjb25zdCBnaXRlYVBhcnNlciA9IGAJY29uc3QgcGF5bG9hZCA9IChhd2FpdCByZXNwb25zZS5qc29uKCkpIGFzIHsKCQl0YWdfbmFtZT86IHVua25vd247CgkJcHVibGlzaGVkX2F0PzogdW5rbm93bjsKCQljcmVhdGVkX2F0PzogdW5rbm93bjsKCQlhc3NldHM/OiB1bmtub3duOwoJfTsKCglpZiAoCgkJdHlwZW9mIHBheWxvYWQudGFnX25hbWUgIT09ICdzdHJpbmcnIHx8CgkJcGF5bG9hZC50YWdfbmFtZS50cmltKCkubGVuZ3RoID09PSAwCgkpIHsKCQl0aHJvdyBuZXcgRXJyb3IoJ0dTQ09SRCBsYXRlc3QgcmVsZWFzZSByZXNwb25zZSBtaXNzaW5nIHRhZ19uYW1lJyk7Cgl9CgoJY29uc3QgdmVyc2lvbiA9IHBheWxvYWQudGFnX25hbWUudHJpbSgpLnJlcGxhY2UoL152LywgJycpOwoJY29uc3QgYXNzZXRzID0gQXJyYXkuaXNBcnJheShwYXlsb2FkLmFzc2V0cykgPyBwYXlsb2FkLmFzc2V0cyA6IFtdOwoJY29uc3QgZmlsZXM6IFBhcnRpYWw8CgkJUmVjb3JkPE1hbnVhbERlc2t0b3BGb3JtYXQsIE1hbnVhbExhdGVzdEZpbGU+Cgk+ID0ge307CgoJY29uc3QgaXNBcm02NCA9IHByb2Nlc3MuYXJjaCA9PT0gJ2FybTY0JzsKCglmb3IgKGNvbnN0IHJhd0Fzc2V0IG9mIGFzc2V0cykgewoJCWlmICghaXNSZWNvcmQocmF3QXNzZXQpKSB7CgkJCWNvbnRpbnVlOwoJCX0KCgkJY29uc3QgbmFtZSA9CgkJCXR5cGVvZiByYXdBc3NldC5uYW1lID09PSAnc3RyaW5nJwoJCQkJPyByYXdBc3NldC5uYW1lCgkJCQk6ICcnOwoKCQljb25zdCB1cmwgPQoJCQl0eXBlb2YgcmF3QXNzZXQuYnJvd3Nlcl9kb3dubG9hZF91cmwgPT09ICdzdHJpbmcnCgkJCQk/IHJhd0Fzc2V0LmJyb3dzZXJfZG93bmxvYWRfdXJsCgkJCQk6ICcnOwoKCQlpZiAoIW5hbWUgfHwgIXVybCkgewoJCQljb250aW51ZTsKCQl9CgoJCWNvbnN0IGxvd2VyTmFtZSA9IG5hbWUudG9Mb3dlckNhc2UoKTsKCgkJaWYgKGlzQXJtNjQpIHsKCQkJaWYgKAoJCQkJIWxvd2VyTmFtZS5pbmNsdWRlcygnYXJtNjQnKSAmJgoJCQkJIWxvd2VyTmFtZS5pbmNsdWRlcygnYWFyY2g2NCcpCgkJCSkgewoJCQkJY29udGludWU7CgkJCX0KCQl9IGVsc2UgaWYgKAoJCQlsb3dlck5hbWUuaW5jbHVkZXMoJ2FybTY0JykgfHwKCQkJbG93ZXJOYW1lLmluY2x1ZGVzKCdhYXJjaDY0JykKCQkpIHsKCQkJY29udGludWU7CgkJfQoKCQlpZiAoL2xpbnV4LXg4Line truncated
+            )
+          )
+
+          $PatchPath = Join-Path $env:RUNNER_TEMP "patch-gscord-updater.cjs"
+
+          [System.IO.File]::WriteAllText(
+            $PatchPath,
+            $PatchScript,
+            (New-Object System.Text.UTF8Encoding($false))
+          )
+
+          node $PatchPath
+
+          Select-String `
+            -Path "fluxer-src\fluxer_desktop\src\main\UpdaterDownloads.ts" `
+            -Pattern "git.gandc.ru/gscord/gscord-desktop/releases"
+
+          Select-String `
+            -Path "fluxer-src\fluxer_desktop\src\main\Updater.ts" `
+            -Pattern "api/v1/repos/gscord/gscord-desktop/releases/latest"
+
+      - name: Apply Electron LiveKit compatibility fixes
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $Path = "fluxer-src\fluxer_desktop\src\preload\index.ts"
+
+          if (-not (Test-Path $Path)) {
+            throw "Desktop preload not found at $Path"
+          }
+
+          $Content = Get-Content $Path -Raw
+          $Anchor = "import {contextBridge, ipcRenderer, webFrame} from 'electron';"
+
+          if ($Content -notmatch [regex]::Escape($Anchor)) {
+            throw "Unable to locate Electron preload import"
+          }
+
+          if ($Content -match "installForceAllIceTransportPolicy") {
+            throw "WebRTC ICE policy patch is already present"
+          }
+
+          $Patch = [Text.Encoding]::UTF8.GetString(
+            [Convert]::FromBase64String(
+              "aW1wb3J0IHtjb250ZXh0QnJpZGdlLCBpcGNSZW5kZXJlciwgd2ViRnJhbWV9IGZyb20gJ2VsZWN0cm9uJzsKCmZ1bmN0aW9uIGluc3RhbGxGb3JjZUFsbEljZVRyYW5zcG9ydFBvbGljeSgpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVJUQ1BlZXJDb25uZWN0aW9uID0gd2luZG93LlJUQ1BlZXJDb25uZWN0aW9uOwoKCQkJaWYgKHR5cGVvZiBOYXRpdmVSVENQZWVyQ29ubmVjdGlvbiAhPT0gJ2Z1bmN0aW9uJykgewoJCQkJcmV0dXJuOwoJCQl9CgoJCQl3aW5kb3cuUlRDUGVlckNvbm5lY3Rpb24gPSBuZXcgUHJveHkoTmF0aXZlUlRDUGVlckNvbm5lY3Rpb24sIHsKCQkJCWNvbnN0cnVjdChUYXJnZXQsIGFyZ3MsIG5ld1RhcmdldCkgewoJCQkJCWNvbnN0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgUlRDQ29uZmlndXJhdGlvbiB8IHVuZGVmaW5lZDsKCgkJCQkJaWYgKGNvbmZpZz8uaWNlVHJhbnNwb3J0UG9saWN5ID09PSAncmVsYXknKSB7CgkJCQkJCWFyZ3NbMF0gPSB7CgkJCQkJCQkuLi5jb25maWcsCgkJCQkJCQlpY2VUcmFuc3BvcnRQb2xpY3k6ICdhbGwnLAoJCQkJCQl9OwoJCQkJCX0KCgkJCQkJcmV0dXJuIFJlZmxlY3QuY29uc3RydWN0KFRhcmdldCwgYXJncywgbmV3VGFyZ2V0KTsKCQkJCX0sCgkJCX0pOwoKCQkJY29uc29sZS5pbmZvKCdbRmx1eGVyIERlc2t0b3BdIFdlYlJUQyBpY2VUcmFuc3BvcnRQb2xpY3kgZm9yY2VkIHRvIGFsbCcpOwoJCX0sCgl9KTsKfQoKZnVuY3Rpb24gaW5zdGFsbERpc2FibGVMaXZlS2l0T2ZmZXJXaXRoSm9pbigpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVdlYlNvY2tldCA9IHdpbmRvdy5XZWJTb2NrZXQ7CgkJCWNvbnN0IGNvbXByZXNzaW9uRGVzY3JpcHRvciA9IE9iamVjdC5nZXRPd25Qcm9wZXJ0eURlc2NyaXB0b3IoCgkJCQl3aW5kb3csCgkJCQknQ29tcHJlc3Npb25TdHJlYW0nLAoJCQkpOwoKCQkJbGV0IGNvbXByZXNzaW9uU3VwcHJlc3NlZCA9IGZhbHNlOwoKCQkJY29uc3Qgc3VwcHJlc3NDb21wcmVzc2lvblN0cmVhbSA9ICgpOiB2b2lkID0+IHsKCQkJCWlmIChjb21wcmVzc2lvblN1cHByZXNzZWQpIHsKCQkJCQlyZXR1cm47CgkJCQl9CgoJCQkJT2JqZWN0LmRlZmluZVByb3BlcnR5KHdpbmRvdywgJ0NvbXByZXNzaW9uU3RyZWFtJywgewoJCQkJCWNvbmZpZ3VyYWJsZTogdHJ1ZSwKCQkJCQl3cml0YWJsZTogdHJ1ZSwKCQkJCQl2YWx1ZTogdW5kZWZpbmVkLAoJCQkJfSk7CgoJCQkJY29tcHJlc3Npb25TdXBwcmVzc2VkID0gdHJ1ZTsKCQkJfTsKCgkJCWNvbnN0IHJlc3RvcmVDb21wcmVzc2lvblN0cmVhbSA9ICgpOiB2b2lkID0+IHsKCQkJCWlmICghY29tcHJlc3Npb25TdXBwcmVzc2VkKSB7CgkJCQkJcmV0dXJuOwoJCQkJfQoKCQkJCWlmIChjb21wcmVzc2lvbkRlc2NyaXB0b3IpIHsKCQkJCQlPYmplY3QuZGVmaW5lUHJvcGVydHkoCgkJCQkJCXdpbmRvdywKCQkJCQkJJ0NvbXByZXNzaW9uU3RyZWFtJywKCQkJCQkJY29tcHJlc3Npb25EZXNjcmlwdG9yLAoJCQkJCSk7CgkJCQl9IGVsc2UgewoJCQkJCWRlbGV0ZSAod2luZG93IGFzIHR5cGVvZiB3aW5kb3cgJiB7CgkJCQkJCUNvbXByZXNzaW9uU3RyZWFtPzogdHlwZW9mIENvbXByZXNzaW9uU3RyZWFtOwoJCQkJCX0pLkNvbXByZXNzaW9uU3RyZWFtOwoJCQkJfQoKCQkJCWNvbXByZXNzaW9uU3VwcHJlc3NlZCA9IGZhbHNlOwoJCQl9OwoKCQkJY29uc3QgaXNMaXZlS2l0UnRjU29ja2V0ID0gKHZhbHVlOiBzdHJpbmcgfCBVUkwpOiBib29sZWFuID0+IHsKCQkJCXRyeSB7CgkJCQkJY29uc3QgdXJsID0gbmV3IFVSTChTdHJpbmcodmFsdWUpLCB3aW5kb3cubG9jYXRpb24uaHJlZik7CgkJCQkJcmV0dXJuIC9cL3J0Y1wvdjFcLz8kLy50ZXN0KHVybC5wYXRobmFtZSk7CgkJCQl9IGNhdGNoIHsKCQkJCQlyZXR1cm4gZmFsc2U7CgkJCQl9CgkJCX07CgoJCQl3aW5kb3cuV2ViU29ja2V0ID0gbmV3IFByb3h5KE5hdGl2ZVdlYlNvY2tldCwgewoJCQkJY29uc3RydWN0KFRhcmdldCwgYXJncykgewoJCQkJCWNvbnN0IGlzTGl2ZUtpdFJ0YyA9IGlzTGl2ZUtpdFJ0Y1NvY2tldCgKCQkJCQkJYXJnc1swXSBhcyBzdHJpbmcgfCBVUkwsCgkJCQkJKTsKCgkJCQkJaWYgKGlzTGl2ZUtpdFJ0YykgewoJCQkJCQlyZXN0b3JlQ29tcHJlc3Npb25TdHJlYW0oKTsKCQkJCQl9CgoJCQkJCWxldCBzb2NrZXQ6IFdlYlNvY2tldDsKCgkJCQkJdHJ5IHsKCQkJCQkJc29ja2V0ID0gUmVmbGVjdC5jb25zdHJ1Y3QoVGFyZ2V0LCBhcmdzLCBUYXJnZXQpOwoJCQkJCX0gY2F0Y2ggKGVycm9yKSB7CgkJCQkJCWlmIChpc0xpdmVLaXRSdGMpIHsKCQkJCQkJCXN1cHByZXNzQ29tcHJlc3Npb25TdHJlYW0oKTsKCQkJCQkJfQoJCQkJCQl0aHJvdyBlcnJvcjsKCQkJCQl9CgoJCQkJCWlmIChpc0xpdmVLaXRSdGMpIHsKCQkJCQkJc29ja2V0LmFkZEV2ZW50TGlzdGVuZXIoCgkJCQkJCQknY2xvc2UnLAoJCQkJCQkJKCkgPT4gc3VwcHJlc3NDb21wcmVzc2lvblN0cmVhbSgpLAoJCQkJCQkJe29uY2U6IHRydWV9LAoJCQkJCQkpOwoJCQkJCX0KCgkJCQkJcmV0dXJuIHNvY2tldDsKCQkJCX0sCgkJCX0pIGFzIHR5cGVvZiBXZWJTb2NrZXQ7CgoJCQlzdXBwcmVzc0NvbXByZXNzaW9uU3RyZWFtKCk7CgoJCQljb25zb2xlLmluZm8oCgkJCQknW0ZsdXhlciBEZXNrdG9wXSBMaXZlS2l0IHB1Ymxpc2hlciBvZmZlci13aXRoLWpvaW4gZGlzYWJsZWQnLAoJCQkpOwoJCX0sCgl9KTsKfQoKaW5zdGFsbEZvcmNlQWxsSWNlVHJhbnNwb3J0UG9saWN5KCk7Cmluc3RhbGxEaXNhYmxlTGl2ZUtpdE9mZmVyV2l0aEpvaW4oKTsK"
+            )
+          )
+
+          $Content = $Content.Replace(
+            $Anchor,
+            $Patch
+          )
+
+          Set-Content `
+            -Path $Path `
+            -Value $Content `
+            -NoNewline `
+            -Encoding utf8
+
+          $Result = Get-Content $Path -Raw
+
+          if ($Result -notmatch "installForceAllIceTransportPolicy") {
+            throw "WebRTC ICE policy patch verification failed"
+          }
+
+          if ($Result -notmatch "installDisableLiveKitOfferWithJoin") {
+            throw "LiveKit offer-with-join workaround verification failed"
+          }
+
+          Write-Host "Installed Electron WebRTC and LiveKit compatibility fixes"
+
+          Select-String `
+            -Path $Path `
+            -Pattern "installForceAllIceTransportPolicy|installDisableLiveKitOfferWithJoin|iceTransportPolicy forced to all|LiveKit publisher offer-with-join disabled"
+
       - name: Install dependencies
         shell: powershell
         run: |
@@ -270,9 +383,21 @@ jobs:
   linux-x64:
     name: Linux x64
 
-    runs-on: ubuntu-22.04
+    runs-on: ci-linux-builder
+
+    env:
+      NEXUS_CARGO_URL: ${{ secrets.NEXUS_CARGO_URL }}
+      NEXUS_MAVEN_URL: ${{ secrets.NEXUS_MAVEN_URL }}
+      NEXUS_NPM_URL: ${{ secrets.NEXUS_NPM_URL }}
+      NEXUS_NODEJS_URL: ${{ secrets.NEXUS_NODEJS_URL }}
 
     steps:
+      - name: Checkout CI repository
+        uses: actions/checkout@v4
+
+      - name: Prepare RAM CI environment
+        uses: ./.gitea/actions/prepare-ram-ci
+
       - name: Clone Fluxer
         shell: bash
         run: |
@@ -296,251 +421,43 @@ jobs:
           ls -la fluxer-src/fluxer_desktop
 
 
-      - name: Install Linux build dependencies
+      - name: Verify builder image
         shell: bash
+        env:
+          PKG_CONFIG_PATH: /usr/local/lib/x86_64-linux-gnu/pkgconfig:/usr/local/lib/pkgconfig:/usr/lib/x86_64-linux-gnu/pkgconfig
         run: |
-          set -euxo pipefail
+          set -euo pipefail
 
-          apt-get update
+          node --version
-
+          npm --version
-          DEBIAN_FRONTEND=noninteractive apt-get install -y \
+          corepack --version
-            build-essential \
+          rustc --version
-            ca-certificates \
+          cargo --version
-            clang \
+          cmake --version
-            cmake \
+          meson --version
-            curl \
+          ninja --version
-            desktop-file-utils \
-            dpkg-dev \
-            fakeroot \
-            ffmpeg \
-            git \
-            libasound2 \
-            libaom-dev \
-            libavcodec-dev \
-            libavfilter-dev \
-            libavformat-dev \
-            libavutil-dev \
-            libcbor-dev \
-            libdbus-1-dev \
-            libdav1d-dev \
-            libde265-dev \
-            libfido2-dev \
-            libgbm1 \
-            libgtk-3-0 \
-            liblcms2-dev \
-            libnotify4 \
-            libnss3 \
-            libpipewire-0.3-dev \
-            libpulse-dev \
-            libsecret-1-0 \
-            libssl-dev \
-            libswresample-dev \
-            libswscale-dev \
-            libudev-dev \
-            libvips-dev \
-            libwayland-dev \
-            libwebp-dev \
-            libx11-xcb1 \
-            libxcb-dri3-0 \
-            libxcomposite1 \
-            libxdamage1 \
-            libxkbcommon-dev \
-            libxkbcommon0 \
-            libxrandr2 \
-            libxshmfence1 \
-            libxss1 \
-            libxtst6 \
-            llvm \
-            meson \
-            nasm \
-            ninja-build \
-            pkg-config \
-            python3 \
-            python3-pip \
-            rpm \
-            unzip \
-            xdg-utils \
-            xz-utils \
-            yasm \
-            zlib1g-dev \
-            zstd
-
-      - name: Install modern libfido2
-        shell: bash
-        run: |
-          set -euxo pipefail
-
-          rm -rf /tmp/libfido2
-
-          git clone \
-            --depth 1 \
-            --branch 1.17.0 \
-            https://github.com/Yubico/libfido2.git \
-            /tmp/libfido2
-
-          cmake \
-            -S /tmp/libfido2 \
-            -B /tmp/libfido2/build \
-            -DCMAKE_BUILD_TYPE=Release \
-            -DCMAKE_INSTALL_PREFIX=/usr/local \
-            -DCMAKE_INSTALL_LIBDIR=lib/x86_64-linux-gnu \
-            -DBUILD_EXAMPLES=OFF \
-            -DBUILD_MANPAGES=OFF \
-            -DBUILD_TOOLS=OFF
-
-          cmake \
-            --build /tmp/libfido2/build \
-            --parallel "$(nproc)"
-
-          cmake \
-            --install /tmp/libfido2/build
-
-          ldconfig
-
-          echo "=== libfido2 ==="
-
-          PKG_CONFIG_PATH="/usr/local/lib/x86_64-linux-gnu/pkgconfig:/usr/local/lib/pkgconfig:/usr/lib/x86_64-linux-gnu/pkgconfig" \
-            pkg-config --modversion libfido2
 
+          pkg-config --atleast-version=1.17.0 libfido2
+          pkg-config --atleast-version=1.0.5 libpipewire-0.3
+          pkg-config --modversion libfido2 libpipewire-0.3 libspa-0.2
           test -f /usr/local/include/fido/es384.h
 
-          ls -la /usr/local/include/fido/
-
-          echo "=== libraries ==="
-
-          find /usr/local/lib \
-            -name 'libfido2*' \
-            -print
-
-      - name: Install modern PipeWire
-        shell: bash
-        run: |
-          set -euxo pipefail
-
-          PIPEWIRE_VERSION="1.0.5"
-
-          rm -rf /tmp/pipewire
-
-          git clone \
-            --depth 1 \
-            --branch "${PIPEWIRE_VERSION}" \
-            https://github.com/PipeWire/pipewire.git \
-            /tmp/pipewire
-
-          meson setup \
-            /tmp/pipewire/build \
-            /tmp/pipewire \
-            --prefix=/usr/local \
-            --libdir=lib/x86_64-linux-gnu \
-            --buildtype=release \
-            -Ddocs=disabled \
-            -Dman=disabled \
-            -Dexamples=disabled \
-            -Dtests=disabled \
-            -Dinstalled_tests=disabled \
-            -Dsession-managers=[] \
-            -Dgstreamer=disabled \
-            -Dsystemd=disabled \
-            -Dselinux=disabled \
-            -Dpipewire-jack=disabled \
-            -Dpipewire-v4l2=disabled \
-            -Dbluez5=disabled \
-            -Djack=disabled \
-            -Dv4l2=disabled \
-            -Dlibcamera=disabled \
-            -Dvulkan=disabled \
-            -Dsdl2=disabled \
-            -Dlibmysofa=disabled \
-            -Droc=disabled \
-            -Davahi=disabled \
-            -Decho-cancel-webrtc=disabled \
-            -Dlibusb=disabled \
-            -Draop=disabled \
-            -Dlv2=disabled \
-            -Dlibcanberra=disabled \
-            -Dlibffado=disabled
-
-          meson compile \
-            -C /tmp/pipewire/build \
-            -j "$(nproc)"
-
-          meson install \
-            -C /tmp/pipewire/build
-
-          ldconfig
-
-          export PKG_CONFIG_PATH="/usr/local/lib/x86_64-linux-gnu/pkgconfig:/usr/local/lib/pkgconfig:/usr/lib/x86_64-linux-gnu/pkgconfig"
-
-          echo "=== PipeWire ==="
-
-          pkg-config \
-            --modversion \
-            libpipewire-0.3
-
-          pkg-config \
-            --modversion \
-            libspa-0.2
-
-          echo "=== PipeWire CFLAGS ==="
-
-          pkg-config \
-            --cflags \
-            libpipewire-0.3
-
-          pkg-config \
-            --cflags \
-            libspa-0.2
-
-          echo "=== Checking headers ==="
-
-          grep -R \
-            "spa_meta_region_is_valid" \
-            /usr/local/include/spa-0.2/spa \
-            | head
-
-          echo "=== PipeWire libraries ==="
-
-          find /usr/local/lib \
-            \( -name 'libpipewire-0.3.so*' -o -name 'libspa*.so*' \) \
-            -print
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-
 
       - name: Setup pnpm
         shell: bash
         run: |
           set -euxo pipefail
 
-          corepack enable
+          corepack enable \
-          corepack prepare pnpm@10.29.3 --activate
+            --install-directory "$CI_BIN"
+
+          corepack prepare \
+            "pnpm@$PNPM_VERSION" \
+            --activate
 
           node --version
           pnpm --version
-
+          pnpm store path
-
-      - name: Setup Rust
-        shell: bash
-        run: |
-          set -euxo pipefail
-
-          curl \
-            --proto '=https' \
-            --tlsv1.2 \
-            -sSf \
-            https://sh.rustup.rs |
-            sh -s -- -y --profile minimal
-
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-
-          "$HOME/.cargo/bin/rustup" update stable
-          "$HOME/.cargo/bin/rustup" default stable
-
-          "$HOME/.cargo/bin/rustc" --version
-          "$HOME/.cargo/bin/cargo" --version
 
 
       - name: Configure self-hosted server
@@ -619,6 +536,42 @@ jobs:
           print(result)
           PY
 
+          python3 <<'PY'
+          from pathlib import Path
+          import json
+
+          path = Path(
+              "fluxer-src/fluxer_desktop/package.json"
+          )
+
+          if not path.is_file():
+              raise SystemExit(
+                  f"package.json not found: {path}"
+              )
+
+          package = json.loads(
+              path.read_text(
+                  encoding="utf-8"
+              )
+          )
+
+          package["homepage"] = "https://ds.gandc.ru"
+
+          path.write_text(
+              json.dumps(
+                  package,
+                  ensure_ascii=False,
+                  indent=2,
+              ) + "\n",
+              encoding="utf-8",
+          )
+
+          print(
+              "Desktop homepage configured:",
+              package["homepage"],
+          )
+          PY
+
           python3 <<'PY'
           from pathlib import Path
           import re
@@ -690,6 +643,95 @@ jobs:
             fluxer-src/fluxer_desktop/src/main/Window.ts
 
 
+      - name: Configure GSCORD update source
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          PATCH_PATH="$(mktemp --suffix=.cjs)"
+
+          printf '%s' 'CmNvbnN0IGZzID0gcmVxdWlyZSgnZnMnKTsKCmNvbnN0IGRvd25sb2Fkc1BhdGggPSAnZmx1eGVyLXNyYy9mbHV4ZXJfZGVza3RvcC9zcmMvbWFpbi9VcGRhdGVyRG93bmxvYWRzLnRzJzsKY29uc3QgdXBkYXRlclBhdGggPSAnZmx1eGVyLXNyYy9mbHV4ZXJfZGVza3RvcC9zcmMvbWFpbi9VcGRhdGVyLnRzJzsKCmZ1bmN0aW9uIHJlcGxhY2VSZWdleE9uY2UoaW5wdXQsIHBhdHRlcm4sIHJlcGxhY2VtZW50LCBsYWJlbCkgewogIGxldCBjb3VudCA9IDA7CiAgY29uc3Qgb3V0cHV0ID0gaW5wdXQucmVwbGFjZShwYXR0ZXJuLCAoLi4uYXJncykgPT4gewogICAgY291bnQgKz0gMTsKICAgIHJldHVybiB0eXBlb2YgcmVwbGFjZW1lbnQgPT09ICdmdW5jdGlvbicKICAgICAgPyByZXBsYWNlbWVudCguLi5hcmdzKQogICAgICA6IHJlcGxhY2VtZW50OwogIH0pOwoKICBpZiAoY291bnQgIT09IDEpIHsKICAgIHRocm93IG5ldyBFcnJvcihgVW5hYmxlIHRvIHBhdGNoICR7bGFiZWx9OiBtYXRjaGVzPSR7Y291bnR9YCk7CiAgfQoKICByZXR1cm4gb3V0cHV0Owp9CgpsZXQgZG93bmxvYWRzID0gZnMucmVhZEZpbGVTeW5jKGRvd25sb2Fkc1BhdGgsICd1dGY4Jyk7Cgpkb3dubG9hZHMgPSByZXBsYWNlUmVnZXhPbmNlKAogIGRvd25sb2FkcywKICAvY29uc3QgUEtHU19CQVNFX1VSTCA9ICdodHRwczpcL1wvcGtnc1wuZmx1eGVyXC5jb20nO1xyP1xuZXhwb3J0IGNvbnN0IFVQREFURV9CQVNFX1VSTCA9IGBcJFx7UEtHU19CQVNFX1VSTFx9XC9kZXNrdG9wXC9cJFx7QlVJTERfQ0hBTk5FTFx9XC9cJFx7cHJvY2Vzc1wucGxhdGZvcm1cfVwvXCRce0RFU0tUT1BfRE9XTkxPQURfQVJDSFx9YDtccj9cbmV4cG9ydCBjb25zdCBET1dOTE9BRF9QQUdFX1VSTCA9XHI/XG5ccypCVUlMRF9DSEFOTkVMID09PSAnY2FuYXJ5JyBcPyAnaHR0cHM6XC9cL2NhbmFyeVwuZmx1eGVyXC5hcHBcL2Rvd25sb2FkJyA6ICdodHRwczpcL1wvZmx1eGVyXC5hcHBcL2Rvd25sb2FkJzsvLAogICJleHBvcnQgY29uc3QgVVBEQVRFX0JBU0VfVVJMID0gJ2h0dHBzOi8vZ2l0LmdhbmRjLnJ1L2dzY29yZC9nc2NvcmQtZGVza3RvcC9yZWxlYXNlcyc7XG4iICsKICAgICJleHBvcnQgY29uc3QgRE9XTkxPQURfUEFHRV9VUkwgPSBVUERBVEVfQkFTRV9VUkw7IiwKICAnVXBkYXRlckRvd25sb2FkcyB1cGRhdGUgc291cmNlJywKKTsKCmRvd25sb2FkcyA9IHJlcGxhY2VSZWdleE9uY2UoCiAgZG93bmxvYWRzLAogIC9leHBvcnQgZnVuY3Rpb24gYnVpbGRNYW51YWxWZXJzaW9uRG93bmxvYWRVcmxcKHZlcnNpb246IHN0cmluZywgZm9ybWF0OiBNYW51YWxEZXNrdG9wRm9ybWF0XCk6IHN0cmluZyBce1xyP1xuXHMqcmV0dXJuIGBcJFx7VVBEQVRFX0JBU0VfVVJMXH1cL1wkXHt2ZXJzaW9uXH1cL1wkXHtmb3JtYXRcfWA7XHI/XG5cfS8sCiAgImV4cG9ydCBmdW5jdGlvbiBidWlsZE1hbnVhbFZlcnNpb25Eb3dubG9hZFVybCh2ZXJzaW9uOiBzdHJpbmcsIGZvcm1hdDogTWFudWFsRGVza3RvcEZvcm1hdCk6IHN0cmluZyB7XG4iICsKICAgICJcdHZvaWQgdmVyc2lvbjtcbiIgKwogICAgIlx0dm9pZCBmb3JtYXQ7XG4iICsKICAgICJcdHJldHVybiBET1dOTE9BRF9QQUdFX1VSTDtcbiIgKwogICAgIn0iLAogICdtYW51YWwgZmFsbGJhY2sgVVJMJywKKTsKCmRvd25sb2FkcyA9IHJlcGxhY2VSZWdleE9uY2UoCiAgZG93bmxvYWRzLAogIC91cmw6XHMqYnVpbGRNYW51YWxWZXJzaW9uRG93bmxvYWRVcmxcKGluZm9cLnZlcnNpb24sXHMqZm9ybWF0XCksLywKICAidXJsOiBmaWxlPy51cmwgPz8gYnVpbGRNYW51YWxWZXJzaW9uRG93bmxvYWRVcmwoaW5mby52ZXJzaW9uLCBmb3JtYXQpLCIsCiAgJ21hbnVhbCBhc3NldCBVUkwnLAopOwoKaWYgKGRvd25sb2Fkcy5pbmNsdWRlcygncGtncy5mbHV4ZXIuY29tJykpIHsKICB0aHJvdyBuZXcgRXJyb3IoCiAgICAncGtncy5mbHV4ZXIuY29tIGlzIHN0aWxsIHByZXNlbnQgaW4gVXBkYXRlckRvd25sb2Fkcy50cycsCiAgKTsKfQoKaWYgKAogICFkb3dubG9hZHMuaW5jbHVkZXMoCiAgICAnaHR0cHM6Ly9naXQuZ2FuZGMucnUvZ3Njb3JkL2dzY29yZC1kZXNrdG9wL3JlbGVhc2VzJywKICApCikgewogIHRocm93IG5ldyBFcnJvcignR1NDT1JEIHJlbGVhc2VzIFVSTCB3YXMgbm90IGluc3RhbGxlZCcpOwp9Cgpmcy53cml0ZUZpbGVTeW5jKGRvd25sb2Fkc1BhdGgsIGRvd25sb2FkcywgJ3V0ZjgnKTsKCmxldCB1cGRhdGVyID0gZnMucmVhZEZpbGVTeW5jKHVwZGF0ZXJQYXRoLCAndXRmOCcpOwoKdXBkYXRlciA9IHJlcGxhY2VSZWdleE9uY2UoCiAgdXBkYXRlciwKICAvY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBmZXRjaFwoYFwkXHtVUERBVEVfQkFTRV9VUkxcfVwvbGF0ZXN0YCwgXHsvLAogICJjb25zdCByZXNwb25zZSA9IGF3YWl0IGZldGNoKFxuIiArCiAgICAiXHRcdCdodHRwczovL2dpdC5nYW5kYy5ydS9hcGkvdjEvcmVwb3MvZ3Njb3JkL2dzY29yZC1kZXNrdG9wL3JlbGVhc2VzL2xhdGVzdCcsXG4iICsKICAgICJcdFx0eyIsCiAgJ0dpdGVhIGxhdGVzdCByZWxlYXNlIFVSTCcsCik7Cgpjb25zdCBnaXRlYVBhcnNlciA9IGAJY29uc3QgcGF5bG9hZCA9IChhd2FpdCByZXNwb25zZS5qc29uKCkpIGFzIHsKCQl0YWdfbmFtZT86IHVua25vd247CgkJcHVibGlzaGVkX2F0PzogdW5rbm93bjsKCQljcmVhdGVkX2F0PzogdW5rbm93bjsKCQlhc3NldHM/OiB1bmtub3duOwoJfTsKCglpZiAoCgkJdHlwZW9mIHBheWxvYWQudGFnX25hbWUgIT09ICdzdHJpbmcnIHx8CgkJcGF5bG9hZC50YWdfbmFtZS50cmltKCkubGVuZ3RoID09PSAwCgkpIHsKCQl0aHJvdyBuZXcgRXJyb3IoJ0dTQ09SRCBsYXRlc3QgcmVsZWFzZSByZXNwb25zZSBtaXNzaW5nIHRhZ19uYW1lJyk7Cgl9CgoJY29uc3QgdmVyc2lvbiA9IHBheWxvYWQudGFnX25hbWUudHJpbSgpLnJlcGxhY2UoL152LywgJycpOwoJY29uc3QgYXNzZXRzID0gQXJyYXkuaXNBcnJheShwYXlsb2FkLmFzc2V0cykgPyBwYXlsb2FkLmFzc2V0cyA6IFtdOwoJY29uc3QgZmlsZXM6IFBhcnRpYWw8CgkJUmVjb3JkPE1hbnVhbERlc2t0b3BGb3JtYXQsIE1hbnVhbExhdGVzdEZpbGU+Cgk+ID0ge307CgoJY29uc3QgaXNBcm02NCA9IHByb2Nlc3MuYXJjaCA9PT0gJ2FybTY0JzsKCglmb3IgKGNvbnN0IHJhd0Fzc2V0IG9mIGFzc2V0cykgewoJCWlmICghaXNSZWNvcmQocmF3QXNzZXQpKSB7CgkJCWNvbnRpbnVlOwoJCX0KCgkJY29uc3QgbmFtZSA9CgkJCXR5cGVvZiByYXdBc3NldC5uYW1lID09PSAnc3RyaW5nJwoJCQkJPyByYXdBc3NldC5uYW1lCgkJCQk6ICcnOwoKCQljb25zdCB1cmwgPQoJCQl0eXBlb2YgcmF3QXNzZXQuYnJvd3Nlcl9kb3dubG9hZF91cmwgPT09ICdzdHJpbmcnCgkJCQk/IHJhd0Fzc2V0LmJyb3dzZXJfZG93bmxvYWRfdXJsCgkJCQk6ICcnOwoKCQlpZiAoIW5hbWUgfHwgIXVybCkgewoJCQljb250aW51ZTsKCQl9CgoJCWNvbnN0IGxvd2VyTmFtZSA9IG5hbWUudG9Mb3dlckNhc2UoKTsKCgkJaWYgKGlzQXJtNjQpIHsKCQkJaWYgKAoJCQkJIWxvd2VyTmFtZS5pbmNsdWRlcygnYXJtNjQnKSAmJgoJCQkJIWxvd2VyTmFtZS5pbmNsdWRlcygnYWFyY2g2NCcpCgkJCSkgewoJCQkJY29udGludWU7CgkJCX0KCQl9IGVsc2UgaWYgKAoJCQlsb3dlck5hbWUuaW5jbHVkZXMoJ2FybTY0JykgfHwKCQkJbG93ZXJOYW1lLmluY2x1ZGVzKCdhYXJjaDY0JykKCQkpIHsKCQkJY29udGludWU7CgkJfQoKCQlpZiAoL2xpLine truncated
+            base64 -d > "$PATCH_PATH"
+
+          node "$PATCH_PATH"
+
+          grep -n 'git.gandc.ru/gscord/gscord-desktop/releases' fluxer-src/fluxer_desktop/src/main/UpdaterDownloads.ts
+
+          grep -n 'api/v1/repos/gscord/gscord-desktop/releases/latest' fluxer-src/fluxer_desktop/src/main/Updater.ts
+
+      - name: Apply Electron LiveKit compatibility fixes
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          python3 - <<'PY'
+          from pathlib import Path
+          import base64
+
+          path = Path(
+              "fluxer-src/fluxer_desktop/"
+              "src/preload/index.ts"
+          )
+
+          if not path.is_file():
+              raise SystemExit(
+                  f"Desktop preload not found: {path}"
+              )
+
+          data = path.read_text(
+              encoding="utf-8"
+          )
+
+          anchor = "import {contextBridge, ipcRenderer, webFrame} from 'electron';"
+
+          if anchor not in data:
+              raise SystemExit(
+                  "Unable to locate Electron preload import"
+              )
+
+          if "installForceAllIceTransportPolicy" in data:
+              raise SystemExit(
+                  "WebRTC ICE policy patch is already present"
+              )
+
+          patch = base64.b64decode(
+              "aW1wb3J0IHtjb250ZXh0QnJpZGdlLCBpcGNSZW5kZXJlciwgd2ViRnJhbWV9IGZyb20gJ2VsZWN0cm9uJzsKCmZ1bmN0aW9uIGluc3RhbGxGb3JjZUFsbEljZVRyYW5zcG9ydFBvbGljeSgpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVJUQ1BlZXJDb25uZWN0aW9uID0gd2luZG93LlJUQ1BlZXJDb25uZWN0aW9uOwoKCQkJaWYgKHR5cGVvZiBOYXRpdmVSVENQZWVyQ29ubmVjdGlvbiAhPT0gJ2Z1bmN0aW9uJykgewoJCQkJcmV0dXJuOwoJCQl9CgoJCQl3aW5kb3cuUlRDUGVlckNvbm5lY3Rpb24gPSBuZXcgUHJveHkoTmF0aXZlUlRDUGVlckNvbm5lY3Rpb24sIHsKCQkJCWNvbnN0cnVjdChUYXJnZXQsIGFyZ3MsIG5ld1RhcmdldCkgewoJCQkJCWNvbnN0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgUlRDQ29uZmlndXJhdGlvbiB8IHVuZGVmaW5lZDsKCgkJCQkJaWYgKGNvbmZpZz8uaWNlVHJhbnNwb3J0UG9saWN5ID09PSAncmVsYXknKSB7CgkJCQkJCWFyZ3NbMF0gPSB7CgkJCQkJCQkuLi5jb25maWcsCgkJCQkJCQlpY2VUcmFuc3BvcnRQb2xpY3k6ICdhbGwnLAoJCQkJCQl9OwoJCQkJCX0KCgkJCQkJcmV0dXJuIFJlZmxlY3QuY29uc3RydWN0KFRhcmdldCwgYXJncywgbmV3VGFyZ2V0KTsKCQkJCX0sCgkJCX0pOwoKCQkJY29uc29sZS5pbmZvKCdbRmx1eGVyIERlc2t0b3BdIFdlYlJUQyBpY2VUcmFuc3BvcnRQb2xpY3kgZm9yY2VkIHRvIGFsbCcpOwoJCX0sCgl9KTsKfQoKZnVuY3Rpb24gaW5zdGFsbERpc2FibGVMaXZlS2l0T2ZmZXJXaXRoSm9pbigpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVdlYlNvY2tldCA9IHdpbmRvdy5XZWJTb2NrZXQ7CgkJCWNvbnN0IGNvbXByZXNzaW9uRGVzY3JpcHRvciA9IE9iamVjdC5nZXRPd25Qcm9wZXJ0eURlc2NyaXB0b3IoCgkJCQl3aW5kb3csCgkJCQknQ29tcHJlc3Npb25TdHJlYW0nLAoJCQkpOwoKCQkJbGV0IGNvbXByZXNzaW9uU3VwcHJlc3NlZCA9IGZhbHNlOwoKCQkJY29uc3Qgc3VwcHJlc3NDb21wcmVzc2lvblN0cmVhbSA9ICgpOiB2b2lkID0+IHsKCQkJCWlmIChjb21wcmVzc2lvblN1cHByZXNzZWQpIHsKCQkJCQlyZXR1cm47CgkJCQl9CgoJCQkJT2JqZWN0LmRlZmluZVByb3BlcnR5KHdpbmRvdywgJ0NvbXByZXNzaW9uU3RyZWFtJywgewoJCQkJCWNvbmZpZ3VyYWJsZTogdHJ1ZSwKCQkJCQl3cml0YWJsZTogdHJ1ZSwKCQkJCQl2YWx1ZTogdW5kZWZpbmVkLAoJCQkJfSk7CgoJCQkJY29tcHJlc3Npb25TdXBwcmVzc2VkID0gdHJ1ZTsKCQkJfTsKCgkJCWNvbnN0IHJlc3RvcmVDb21wcmVzc2lvblN0cmVhbSA9ICgpOiB2b2lkID0+IHsKCQkJCWlmICghY29tcHJlc3Npb25TdXBwcmVzc2VkKSB7CgkJCQkJcmV0dXJuOwoJCQkJfQoKCQkJCWlmIChjb21wcmVzc2lvbkRlc2NyaXB0b3IpIHsKCQkJCQlPYmplY3QuZGVmaW5lUHJvcGVydHkoCgkJCQkJCXdpbmRvdywKCQkJCQkJJ0NvbXByZXNzaW9uU3RyZWFtJywKCQkJCQkJY29tcHJlc3Npb25EZXNjcmlwdG9yLAoJCQkJCSk7CgkJCQl9IGVsc2UgewoJCQkJCWRlbGV0ZSAod2luZG93IGFzIHR5cGVvZiB3aW5kb3cgJiB7CgkJCQkJCUNvbXByZXNzaW9uU3RyZWFtPzogdHlwZW9mIENvbXByZXNzaW9uU3RyZWFtOwoJCQkJCX0pLkNvbXByZXNzaW9uU3RyZWFtOwoJCQkJfQoKCQkJCWNvbXByZXNzaW9uU3VwcHJlc3NlZCA9IGZhbHNlOwoJCQl9OwoKCQkJY29uc3QgaXNMaXZlS2l0UnRjU29ja2V0ID0gKHZhbHVlOiBzdHJpbmcgfCBVUkwpOiBib29sZWFuID0+IHsKCQkJCXRyeSB7CgkJCQkJY29uc3QgdXJsID0gbmV3IFVSTChTdHJpbmcodmFsdWUpLCB3aW5kb3cubG9jYXRpb24uaHJlZik7CgkJCQkJcmV0dXJuIC9cL3J0Y1wvdjFcLz8kLy50ZXN0KHVybC5wYXRobmFtZSk7CgkJCQl9IGNhdGNoIHsKCQkJCQlyZXR1cm4gZmFsc2U7CgkJCQl9CgkJCX07CgoJCQl3aW5kb3cuV2ViU29ja2V0ID0gbmV3IFByb3h5KE5hdGl2ZVdlYlNvY2tldCwgewoJCQkJY29uc3RydWN0KFRhcmdldCwgYXJncykgewoJCQkJCWNvbnN0IGlzTGl2ZUtpdFJ0YyA9IGlzTGl2ZUtpdFJ0Y1NvY2tldCgKCQkJCQkJYXJnc1swXSBhcyBzdHJpbmcgfCBVUkwsCgkJCQkJKTsKCgkJCQkJaWYgKGlzTGl2ZUtpdFJ0YykgewoJCQkJCQlyZXN0b3JlQ29tcHJlc3Npb25TdHJlYW0oKTsKCQkJCQl9CgoJCQkJCWxldCBzb2NrZXQ6IFdlYlNvY2tldDsKCgkJCQkJdHJ5IHsKCQkJCQkJc29ja2V0ID0gUmVmbGVjdC5jb25zdHJ1Y3QoVGFyZ2V0LCBhcmdzLCBUYXJnZXQpOwoJCQkJCX0gY2F0Y2ggKGVycm9yKSB7CgkJCQkJCWlmIChpc0xpdmVLaXRSdGMpIHsKCQkJCQkJCXN1cHByZXNzQ29tcHJlc3Npb25TdHJlYW0oKTsKCQkJCQkJfQoJCQkJCQl0aHJvdyBlcnJvcjsKCQkJCQl9CgoJCQkJCWlmIChpc0xpdmVLaXRSdGMpIHsKCQkJCQkJc29ja2V0LmFkZEV2ZW50TGlzdGVuZXIoCgkJCQkJCQknY2xvc2UnLAoJCQkJCQkJKCkgPT4gc3VwcHJlc3NDb21wcmVzc2lvblN0cmVhbSgpLAoJCQkJCQkJe29uY2U6IHRydWV9LAoJCQkJCQkpOwoJCQkJCX0KCgkJCQkJcmV0dXJuIHNvY2tldDsKCQkJCX0sCgkJCX0pIGFzIHR5cGVvZiBXZWJTb2NrZXQ7CgoJCQlzdXBwcmVzc0NvbXByZXNzaW9uU3RyZWFtKCk7CgoJCQljb25zb2xlLmluZm8oCgkJCQknW0ZsdXhlciBEZXNrdG9wXSBMaXZlS2l0IHB1Ymxpc2hlciBvZmZlci13aXRoLWpvaW4gZGlzYWJsZWQnLAoJCQkpOwoJCX0sCgl9KTsKfQoKaW5zdGFsbEZvcmNlQWxsSWNlVHJhbnNwb3J0UG9saWN5KCk7Cmluc3RhbGxEaXNhYmxlTGl2ZUtpdE9mZmVyV2l0aEpvaW4oKTsK"
+          ).decode("utf-8")
+
+          data = data.replace(
+              anchor,
+              patch,
+              1,
+          )
+
+          path.write_text(
+              data,
+              encoding="utf-8",
+          )
+
+          result = path.read_text(
+              encoding="utf-8"
+          )
+
+          if "installForceAllIceTransportPolicy" not in result:
+              raise SystemExit(
+                  "WebRTC ICE policy patch verification failed"
+              )
+
+          if "installDisableLiveKitOfferWithJoin" not in result:
+              raise SystemExit(
+                  "LiveKit offer-with-join workaround verification failed"
+              )
+
+          print(
+              "Installed Electron WebRTC and LiveKit compatibility fixes"
+          )
+          PY
+
+          grep -n \
+            -E 'installForceAllIceTransportPolicy|installDisableLiveKitOfferWithJoin|iceTransportPolicy forced to all|LiveKit publisher offer-with-join disabled' \
+            fluxer-src/fluxer_desktop/src/preload/index.ts
+
       - name: Install dependencies
         shell: bash
         run: |