desktopEntryMatchesApp normalized haystack values without dropping empty
ones, so a .desktop entry with no ASCII letters or digits in Name, id,
file name, or Exec (e.g. Name=抖音) normalized to "" and
needle.includes("") matched every requested app — hijacking the
installed-apps list and Open In launch specs. Empty normalized haystack
values are now filtered, matching the existing needles handling.
discovered-apps.json gains a version field (INSTALLED_APPS_CACHE_VERSION
= 2); caches written before the fix are treated as stale and refresh
through the existing TTL-expiry path instead of serving the poisoned
list for the rest of the 24h TTL.
Node's happy-eyeballs default (autoSelectFamilyAttemptTimeout=250ms)
aborts every connect attempt to provider endpoints whose TCP handshake
exceeds 250ms, so quota fetches from Node processes fail with
"fetch failed" while the Bun-based opencode CLI path succeeds (#3399).
Raise the per-attempt cap to 5s via a shared applyConnectAttemptTimeout()
helper called from the two Node entrypoints that host the quota module:
the Electron main process and the openchamber CLI. Family autoselection
stays enabled (::1 and IPv6→IPv4 fallback preserved); runtimes without
the setter are a no-op.
ouyangjian28