fix(win): Program Files boot - compiled engine, CI boot gate, installer clamp relax - #338
Merged
Conversation
Fixes the v1.12.0 Windows brick where an install under C:\Program Files showed a 30s blank window: main.ts ran `bun run desktop/dev.ts` and Bun EPERMs loading a .ts from the ACL-protected tree. P-WINBOOT.1 (ADR-0250): installer clamp (nsis allowElevation + allowToChangeInstallationDirectory = false), early engine-exit detection, and an actionable engine_boot.ts classifier (protected-location | engine-exited | timeout) instead of a silent 30s wait. P-WINBOOT.2 (ADR-0251): ship the engine as a `bun build --compile` binary (bin/lucid-engine, --external '*.node'): dev.ts is embedded so Bun never module-loads a .ts off the install disk; native addons load via the OS loader (Program Files-safe); execPath-derived base dir; prebuilt renderer bundle; resolveEngineSpawn cutover in main.ts. airgap-smoke guards both shipped artifacts. Verified: demo-P-WINBOOT.1/.2 (the latter builds+boots the real binary), 23 unit tests, packaged_boot green, desktop tsc clean. The Program Files end-to-end boot is Increment C, which this branch's test installer is for.
Reverts the P-WINBOOT.1 installer clamp ON THIS TEST BRANCH ONLY so LucidAgent-Setup.exe offers C:\Program Files again, letting the smoke test reproduce the friend's exact original install path and confirm the P-WINBOOT.2 compiled engine now boots from a protected dir. master keeps allowElevation:false + allowToChangeInstallationDirectory:false until Increment C proves a protected-root boot in CI (see ADR-0251). Drop this commit before any merge. Note: demo-P-WINBOOT.1's nsis assertions intentionally do not hold on this branch.
Stages the packaged repo (or a source-built skeleton) into a Program Files-ACL location, denies the current user the specific write/delete rights (never generic W - it includes SYNCHRONIZE and EPERMs CreateProcess itself), proves the denial with a failed probe write, then requires bin/lucid-engine to answer /api/health and serve the prebuilt renderer bundle from the protected tree. Wired STRICT into build-desktop.yml's Windows runner - the regression class that shipped the v1.12.0 brick now fails the build, never a user. Verified: demo-P-WINBOOT.2C end to end on Windows (engine boots from the write-denied tree, health ok, 7.1MB bundle served); 14 unit tests; demo-P-WINBOOT.2 still green; root+desktop tsc clean; license clean; bun test harness at the documented baseline.
…eir output dir A fresh CI checkout had no bin/ (fully gitignored, zero tracked files) and the runner's floating bun latest no longer creates the --outfile parent dir, so dist:win died ENOENT at compile-lucid before packaging. Same .gitkeep pattern as desktop/whisper/.
…ot gate (ADR-0262) demo-P-WINBOOT.1 section [5] now asserts the assisted-installer, per-user-default, per-machine-allowed posture AND that build-desktop.yml still runs the strict Program Files boot gate - removing the gate turns the demo red, so the clamp relax can never outlive its justification silently. engine_boot.ts keeps its protected-location classifier (stale pre-engine packages must still fail fast + actionably); comment and Makefile help text updated; ADR-0262 + PROGRESS entry.
Conflict resolutions: - desktop/main.ts: UNION of ADR-0259's engine tail + exit watcher and ADR-0246's spawn-error tee; the error handler now also feeds the tail and the exit flag so waitForServer bails at once with a named cause. - DECISIONS.md / PROGRESS.md: both sides kept, chronological order. - ADR renumber: the branch's parallel P-WINBOOT ADR-0250/0251 collided with master's shipped 0250 (P-MODEL.1) / 0251 (P-AVATAR); renumbered to ADR-0259/0260 across code comments, demos, Makefile, and both logs (master-meaning citations untouched, e.g. trainer_model.ts, dev.ts P-AVATAR line). Verified post-merge: demos P-WINBOOT.1/.2C green, 37 engine tests, root + desktop tsc clean, license clean, bun test harness 1833 pass / 3 documented pre-existing fails, bun test desktop 4268 pass / 15 documented pre-existing (fs_browse Windows, symbol_graph TS7, stale desktop/release copies).
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| for (const cmd of hardenPlan(STAGE, user, PLAT)) run(cmd); | ||
| hardened = true; | ||
| let denied = false; | ||
| try { writeFileSync(join(STAGE, "deny-probe.txt"), "x"); } catch { denied = true; } |
The 10-minute silence kill murdered legitimately long turns (subagent fan-outs outlive any fixed clock). User call: the cutoff is removed - a turn ends when the work ends, Stop, or transport death. The failure the clock actually guarded against is now event-driven: ACPClient rejects every in-flight request when the omp child exits (proven with a real child process). Visibility replaces the clock: turn_pending.ts tracks the open tool calls (spawned subagent tasks labeled as such), every slow notice carries them, and the HUD/toast name what the turn is waiting on and for how long. Chat turns only; util completions keep their deliberate background clocks until P-KG-INGEST.5 lands. 20 unit tests; demos P-STALL.1 (evolved) + P-STALL.2 green; root + desktop tsc clean; desktop suite at the documented baseline.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Payload (the full ADR-0250 -> 0262 arc)
bin/lucid-engine, abun build --compilebinary (dev.ts + all JS embedded; native.nodeaddons the only externals; renderer prebuilt). Fast, actionable failure dialogs for stale installs.desktop/build/pf-boot-smoke.tsstages the packaged repo intoC:\Program Files\..., denies the runner user the specific write/delete rights (never generic W - it includes SYNCHRONIZE and EPERMs CreateProcess), proves the denial, then requiresbin/lucid-engineto answer/api/healthand serve the prebuilt renderer from the protected tree. Wired STRICT intobuild-desktop.yml's Windows job.bin/kept tracked via.gitkeep- a fresh CI checkout had nobin/and current Bun no longer creates the--outfileparent (dist died ENOENT at compile-lucid).Proof
publish-latestskipped. The Windows job ran the gate strict on the max-fidelity path - packaged bytes staged to realC:\Program Files, write-denial proven, engine booted, health ok, 7.1MB bundle served.bun test harnessat the documented baseline (3 pre-existing lucid_acp.test.ts path-separator fails only).Merge instructions
SQUASH-merge required. The branch deliberately keeps its history (no force-push), which includes the Aug-1 "test-only ... DO NOT MERGE" titled commit whose content ADR-0262 has since made intended. Squashing keeps that stale title out of master. See DECISIONS.md ADR-0262.