@cats-inc/cats-platform 0.1.21 → 0.3.4

package/scripts/verify-desktop-app-bundle.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+// Verify the actual unpacked installer resources and offline App activation.
+// Usage: node scripts/verify-desktop-app-bundle.mjs --release-root release --expect-lock config/desktop-apps.lock.json
+// Alternatively pass --resources <resources-directory>. Uses only a temporary registry;
+// does not start provider CLIs, download Apps, or touch the user's installed state.
+import assert from 'node:assert/strict';
+import { access, mkdtemp, readFile, readdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createRequire } from 'node:module';
+import { resolveDesktopHostConfig } from '../build/desktop/config.js';
+import { buildManagedServiceSpecs } from '../build/desktop/processSupervisor.js';
+import { installBundledApps } from '../build/server/platform/apps/packageInstaller.js';
+import { FileCatsAppRegistry } from '../build/server/platform/apps/registry.js';
+import { readAppRenderer } from '../build/server/platform/apps/renderer.js';
+
+const pins = (apps) => apps.map(({ id, version, sha256 }) => ({ id, version, sha256 }));
+
+export async function verifyDesktopAppBundle(resourcesRoot, expectedLockPath) {
+  const root = await mkdtemp(path.join(tmpdir(), 'cats-packaged-app-check-'));
+  try {
+    const config = resolveDesktopHostConfig({
+      env: {}, packaged: true, resourcesPath: path.resolve(resourcesRoot),
+      userDataDir: path.join(root, 'desktop'), catsHomeDir: path.join(root, 'cats-home'),
+    });
+    const [, platform] = buildManagedServiceSpecs(config, {}, process.platform);
+    const sdk = await import(pathToFileURL(path.join(config.packageRoot, 'packages/app-sdk/package.js')).href);
+    const expected = sdk.parseAppLock(JSON.parse(await readFile(expectedLockPath, 'utf8')));
+    const bundledLock = platform.env.CATS_APP_BUNDLE_PATH;
+    assert.equal(bundledLock, path.join(config.packageRoot, 'official-apps/bundle.lock.json'));
+    assert.equal(config.paths.platformBundledConfigDir, path.join(config.packageRoot, 'config'));
+    await access(config.paths.appEntryScript);
+    await access(path.join(config.paths.platformBundledConfigDir, 'provider-capability-bootstrap.yaml.example'));
+    const bundled = sdk.parseAppLock(JSON.parse(await readFile(bundledLock, 'utf8')));
+    const plan = JSON.parse(await readFile(path.join(resourcesRoot, 'desktop-package-plan.json'), 'utf8'));
+    assert.deepEqual(pins(bundled.apps), pins(expected.apps), 'Installer must contain the selected exact App set');
+    assert.deepEqual(pins(plan.apps ?? []), pins(expected.apps), 'Packaging plan must retain the selected App set');
+    if (expected.apps.length > 0) {
+      assert.equal(createRequire(pathToFileURL(config.paths.appEntryScript)).resolve('#cats-app-package'),
+        path.join(config.packageRoot, 'packages/app-sdk/package.js'), 'Sidecar SDK alias must resolve to its shipped package');
+      if (plan.sidecarLayout?.app === 'bundle') {
+        const entry = await readFile(config.paths.appEntryScript, 'utf8');
+        assert.match(entry, /\bfrom\s+['"]#cats-app-package['"]/u,
+          'Bundled sidecar must retain the SDK package import; inlining relocates browser.js');
+      }
+    }
+    assert.ok((await sdk.readBrowserSdk()).includes('getSnapshot'), 'Shipped browser SDK must be readable');
+    for (const app of bundled.apps) {
+      assert.equal(app.artifact, `${app.id}-${app.version}.catsapp`, 'Startup must use adjacent offline archives');
+      sdk.decodeAppPackage(await readFile(path.join(path.dirname(bundledLock), app.artifact)), app);
+    }
+    // Exercise the same installer invoked before the Platform HTTP server starts.
+    // These compiled modules come from this build; bytes and SDK above come from
+    // the actual installer resources, including bundled-sidecar builds.
+    await installBundledApps(config.paths.appStatePath, bundledLock);
+    await installBundledApps(config.paths.appStatePath, bundledLock);
+    const registry = new FileCatsAppRegistry({ registryPath: path.join(config.paths.platformDir, 'apps/registry.json') });
+    const installed = await registry.listInstalledApps();
+    assert.equal(installed.length, expected.apps.length);
+    for (const app of installed) {
+      assert.equal(app.enabled, true);
+      assert.equal(app.installState, 'enabled');
+      assert.equal(app.packageSource, 'desktop-bundle');
+      assert.ok(app.manifest.contributions.lobbyApps.length > 0);
+      assert.ok((await readAppRenderer(app)).html.includes('<head>'));
+    }
+    return { resources: path.resolve(resourcesRoot), apps: pins(bundled.apps), offlineActivation: true };
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+async function findResources(directory, depth = 0) {
+  try {
+    await access(path.join(directory, 'desktop-package-plan.json'));
+    return [directory];
+  } catch { /* Look only through unpacked distribution directories below. */ }
+  if (depth >= 6) return [];
+  const entries = await readdir(directory, { withFileTypes: true });
+  const nested = await Promise.all(entries.filter((entry) => entry.isDirectory()
+    && !['node_modules', 'app-sidecar', 'cats-runtime'].includes(entry.name))
+    .map((entry) => findResources(path.join(directory, entry.name), depth + 1)));
+  return nested.flat();
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.includes('--help')) {
+    console.log('Usage: verify-desktop-app-bundle.mjs (--release-root <directory> | --resources <directory>) --expect-lock <lock>');
+    return;
+  }
+  const options = {};
+  for (let index = 0; index < args.length; index += 2) {
+    if (!['--resources', '--release-root', '--expect-lock'].includes(args[index])
+      || !args[index + 1] || args[index + 1].startsWith('--')) throw new Error('Invalid verifier arguments. Use --help.');
+    options[args[index]] = path.resolve(args[index + 1]);
+  }
+  assert.ok(options['--expect-lock'], '--expect-lock is required');
+  assert.ok(Boolean(options['--resources']) !== Boolean(options['--release-root']), 'Select resources or release-root');
+  const roots = options['--resources'] ? [options['--resources']] : await findResources(options['--release-root']);
+  assert.ok(roots.length > 0, 'No unpacked installer resources found');
+  for (const resources of roots) console.log(JSON.stringify(await verifyDesktopAppBundle(resources, options['--expect-lock']), null, 2));
+}
+
+if (path.resolve(process.argv[1] ?? '') === fileURLToPath(import.meta.url)) {
+  main().catch((error) => { console.error(error); process.exitCode = 1; });
+}

package/scripts/windows/Build-DesktopPackage.ps1

@@ -13,6 +13,9 @@
 .PARAMETER OutputDir
     Optional override for the packaging output directory.
 
+.PARAMETER AppsLock
+    App selection lock with exact IDs, versions and SHA-256 hashes.
+
 .EXAMPLE
     .\scripts\windows\Build-DesktopPackage.ps1 -Platform windows
     Build the staged Windows packaging outputs.
@@ -20,7 +23,8 @@
 param(
   [ValidateSet('all', 'windows', 'macos', 'linux')]
   [string]$Platform = 'all',
-  [string]$OutputDir = ''
+  [string]$OutputDir = '',
+  [string]$AppsLock = ''
 )
 
 Set-StrictMode -Version Latest
@@ -34,11 +38,10 @@ try {
   if ($LASTEXITCODE -ne 0) {
     throw "npm run build failed with exit code $LASTEXITCODE"
   }
-  if ($OutputDir) {
-    node .\scripts\package-desktop.mjs --platform $Platform --output-dir $OutputDir
-  } else {
-    node .\scripts\package-desktop.mjs --platform $Platform
-  }
+  $packageArguments = @('.\scripts\package-desktop.mjs', '--platform', $Platform)
+  if ($OutputDir) { $packageArguments += @('--output-dir', $OutputDir) }
+  if ($AppsLock) { $packageArguments += @('--apps-lock', $AppsLock) }
+  node @packageArguments
   if ($LASTEXITCODE -ne 0) {
     throw "desktop packaging failed with exit code $LASTEXITCODE"
   }

package/scripts/windows/Install-Antigravity.ps1

@@ -28,6 +28,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
 . (Join-Path $PSScriptRoot '_HiddenProcess.ps1')
+. (Join-Path $PSScriptRoot '_NativeInstallerSupport.ps1')
 . (Join-Path $PSScriptRoot '_PackagedUninstall.ps1')
 
 function Write-StructuredResult {
@@ -36,6 +37,10 @@ function Write-StructuredResult {
     [int]$ExitCode
   )
 
+  if (Get-Variable -Name catsInitialObservation -Scope Script -ErrorAction SilentlyContinue) {
+    Add-CatsNativeObservation -Result $Result -Before $script:catsInitialObservation -Attempted ([bool]$script:shouldInstall) -Skipped ([bool]$SkipInstaller)
+  }
+
   if ($Json) {
     $Result | ConvertTo-Json -Depth 10
   } else {
@@ -274,7 +279,15 @@ if ($CheckOnly) {
   Write-StructuredResult -Result $result -ExitCode 0
 }
 
+$installFailed = $false
+$catsInitialObservation = $detected.PSObject.Copy()
 $shouldInstall = $Force -or $Upgrade -or -not $detected.installed
+if ($Upgrade -and -not $Force -and $detected.installed -and -not $SkipInstaller -and -not $DryRun) {
+  $versionGate = Test-CatsNativeUpgrade -Provider 'antigravity' -InstalledVersion $detected.detectedVersion
+  $shouldInstall = $versionGate.shouldInstall
+  if (-not $versionGate.known) { $warnings.Add('Could not compare the published version; the official installer will verify the update.') }
+  if (-not $shouldInstall) { $plannedActions.Clear() }
+}
 $installFailed = $false
 $installSkipped = $false
 if ($shouldInstall) {
@@ -282,8 +295,11 @@ if ($shouldInstall) {
     $warnings.Add('Dry-run requested; Antigravity installer invocation was skipped.')
     $installSkipped = $true
   } else {
-    if (($Force -or $Upgrade) -and (Test-Path -LiteralPath (Resolve-AntigravityExecutablePath) -PathType Leaf)) {
+    $previousBinary = $null
+    if (($Force -or $Upgrade) -and -not $SkipInstaller -and (Test-Path -LiteralPath (Resolve-AntigravityExecutablePath) -PathType Leaf)) {
       try {
+        $previousBinary = Join-Path ([IO.Path]::GetTempPath()) ('cats-agy-' + [guid]::NewGuid().ToString('N') + '.exe')
+        Copy-Item -LiteralPath (Resolve-AntigravityExecutablePath) -Destination $previousBinary -ErrorAction Stop
         Remove-Item -LiteralPath (Resolve-AntigravityExecutablePath) -Force -ErrorAction Stop
       } catch {
         $warnings.Add("Unable to remove existing agy.exe before refresh: $($_.Exception.Message)")
@@ -308,12 +324,19 @@ if ($shouldInstall) {
     }
 
     Start-Sleep -Seconds 2
-    Add-AntigravityToUserPath
+    if (-not $SkipInstaller) { Add-AntigravityToUserPath }
     $detected = Detect-AntigravityInstall
     if (-not $detected.installed -and -not $installSkipped -and -not $installFailed) {
       $warnings.Add('Antigravity installation completed but agy.exe was not detected at the expected path.')
       $installFailed = $true
     }
+    if ($previousBinary) {
+      if ($installFailed) {
+        Copy-Item -LiteralPath $previousBinary -Destination (Resolve-AntigravityExecutablePath) -Force
+        $detected = Detect-AntigravityInstall
+      }
+      Remove-Item -LiteralPath $previousBinary -Force -ErrorAction SilentlyContinue
+    }
   }
 
   if ($installFailed -or ($DryRun -and $shouldInstall)) {
@@ -332,7 +355,7 @@ $interruptions = [System.Collections.Generic.List[object]]::new()
 if ($shouldInstall -and -not $installFailed -and -not $DryRun) {
   $interruptions.Add([pscustomobject]@{
       kind = 'relaunch_required'
-      summary = 'Relaunch Cats Desktop Host after the Antigravity install step, then rerun the packaged setup check.'
+      summary = 'Run Detect Again after the Antigravity install step if the command is not visible yet.'
       resumable = $true
       requiresRestart = $false
       requiresElevation = $false

package/scripts/windows/Install-ClaudeCode.ps1

@@ -74,6 +74,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
 . (Join-Path $PSScriptRoot '_HiddenProcess.ps1')
+. (Join-Path $PSScriptRoot '_NativeInstallerSupport.ps1')
 
 function Write-StructuredResult {
   param(
@@ -81,6 +82,10 @@ function Write-StructuredResult {
     [int]$ExitCode
   )
 
+  if (Get-Variable -Name catsInitialObservation -Scope Script -ErrorAction SilentlyContinue) {
+    Add-CatsNativeObservation -Result $Result -Before $script:catsInitialObservation -Attempted ([bool]$script:shouldInstall) -Skipped ([bool]$SkipInstaller)
+  }
+
   if ($Json) {
     $Result | ConvertTo-Json -Depth 10
   } else {
@@ -250,7 +255,8 @@ function Invoke-ClaudeInstaller {
 
   try {
     $installScript = Invoke-RestMethod 'https://claude.ai/install.ps1'
-    Invoke-Expression $installScript
+    $child = Invoke-CatsRemoteInstaller -ScriptText $installScript
+    if (-not $child.success) { throw $child.stderr }
     return [pscustomobject]@{
       usedWingetFallback = $false
       skipped = $false
@@ -493,6 +499,10 @@ if ($CheckOnly) {
   Write-StructuredResult -Result $result -ExitCode 0
 }
 
+if ($DryRun) {
+  Write-CatsNativePreview -Helper 'windows-claude-native-installer' -Mode $executionMode -Detected $detected -Actions $plannedActions.ToArray() -EmitJson ([bool]$Json)
+}
+
 $cleanedNpmShim = $false
 if ($npmShimPresent) {
   $cleanedNpmShim = Remove-ClaudeNpmShim
@@ -503,9 +513,16 @@ if ($npmShimPresent) {
   }
 }
 
+$installFailed = $false
+$catsInitialObservation = $detected.PSObject.Copy()
 $shouldInstall = $Force -or $Upgrade -or -not $detected.installed
+$installFailed = $false
 if ($shouldInstall) {
-  $installResult = Invoke-ClaudeInstaller
+  $installResult = try { Invoke-ClaudeInstaller } catch { [pscustomobject]@{ skipped = $false; success = $false; stderr = [string]$_.Exception.Message; usedPowerShell51Fallback = $false; usedWingetFallback = $false } }
+  if ($installResult.PSObject.Properties['success'] -and -not $installResult.success) {
+    $installFailed = $true
+    $warnings.Add($installResult.stderr)
+  }
   $usedWingetFallback = [bool]$installResult.usedWingetFallback
   if ($usedWingetFallback) {
     $warnings.Add('Claude Code installer required the winget fallback path.')
@@ -516,8 +533,9 @@ if ($shouldInstall) {
 
   Start-Sleep -Seconds 2
   $detected = Detect-ClaudeInstall
-  if (-not $detected.installed -and -not $SkipInstaller) {
-    throw 'Claude Code installation completed but claude was still not detected.'
+  if (-not $detected.installed -and -not $SkipInstaller -and -not $installFailed) {
+    $warnings.Add('Claude Code installation completed but claude was still not detected.')
+    $installFailed = $true
   }
 
   if ($Force) {
@@ -535,7 +553,7 @@ $interruptions = [System.Collections.Generic.List[object]]::new()
 if ($shouldInstall -or $cleanedNpmShim) {
   $interruptions.Add([pscustomobject]@{
       kind = 'relaunch_required'
-      summary = 'Relaunch Cats Desktop Host after the Claude Code install step, then rerun the packaged setup check.'
+      summary = 'Run Detect Again after the Claude Code install step if the command is not visible yet.'
       resumable = $true
       requiresRestart = $false
       requiresElevation = $false
@@ -555,7 +573,7 @@ $restartRequired = $false
 $result = [pscustomobject]@{
   helper = 'windows-claude-native-installer'
   mode = $executionMode
-  status = if ($interruptions.Count -gt 0) { [string]$interruptions[0].kind } else { 'ready' }
+  status = if ($installFailed) { 'failed' } elseif ($interruptions.Count -gt 0) { [string]$interruptions[0].kind } else { 'ready' }
   installed = [bool]$detected.installed
   detectedVersion = if ($detected.detectedVersion) { $detected.detectedVersion } else { $null }
   commandPath = $detected.commandPath
@@ -568,4 +586,4 @@ $result = [pscustomobject]@{
   cleanedNpmShim = $cleanedNpmShim
   usedWingetFallback = $usedWingetFallback
 }
-Write-StructuredResult -Result $result -ExitCode 0
+Write-StructuredResult -Result $result -ExitCode $(if ($installFailed) { 1 } else { 0 })

package/scripts/windows/Install-CursorAgent.ps1

@@ -59,6 +59,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
 . (Join-Path $PSScriptRoot '_HiddenProcess.ps1')
+. (Join-Path $PSScriptRoot '_NativeInstallerSupport.ps1')
 . (Join-Path $PSScriptRoot '_PackagedUninstall.ps1')
 
 function Write-StructuredResult {
@@ -67,6 +68,10 @@ function Write-StructuredResult {
     [int]$ExitCode
   )
 
+  if (Get-Variable -Name catsInitialObservation -Scope Script -ErrorAction SilentlyContinue) {
+    Add-CatsNativeObservation -Result $Result -Before $script:catsInitialObservation -Attempted ([bool]$script:shouldInstall) -Skipped ([bool]$SkipInstaller)
+  }
+
   if ($Json) {
     $Result | ConvertTo-Json -Depth 10
   } else {
@@ -88,7 +93,13 @@ function Write-StructuredResult {
 }
 
 function Resolve-CursorExecutablePath {
-  return Join-Path $env:USERPROFILE '.local\bin\cursor-agent.exe'
+  foreach ($name in @('cursor-agent.exe', 'cursor-agent.cmd', 'agent.exe', 'agent.cmd')) {
+    $candidate = Join-Path $env:LOCALAPPDATA "cursor-agent\$name"
+    if (Test-Path -LiteralPath $candidate -PathType Leaf) { return $candidate }
+  }
+  $legacy = Join-Path $env:USERPROFILE '.local\bin\cursor-agent.exe'
+  if (Test-Path -LiteralPath $legacy -PathType Leaf) { return $legacy }
+  return Join-Path $env:LOCALAPPDATA 'cursor-agent\cursor-agent.cmd'
 }
 
 function Refresh-UserPath {
@@ -133,6 +144,10 @@ function Detect-CursorInstall {
     }
   }
 
+  if ($installed -and -not $version -and $commandPath -match '\.(cmd|bat)$') {
+    $version = Get-CatsShimVersionText -Path $commandPath
+  }
+
   return [pscustomobject]@{
     installed = $installed
     commandPath = $commandPath
@@ -161,30 +176,11 @@ function Invoke-CursorInstaller {
     }
   }
 
-  try {
-    $installScript = Invoke-RestMethod 'https://cursor.com/install?win32=true'
-    Invoke-Expression $installScript
-    return [pscustomobject]@{
-      usedPowerShell51Fallback = $false
-      skipped = $false
-    }
-  } catch {
-    $isPowerShell7 = $PSVersionTable.PSVersion.Major -ge 7
-    $ps51Path = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
-    if (-not $isPowerShell7 -or -not (Test-Path -LiteralPath $ps51Path -PathType Leaf)) {
-      throw
-    }
-
-    & $ps51Path -NoProfile -ExecutionPolicy Bypass -Command "irm 'https://cursor.com/install?win32=true' | iex"
-    if ($LASTEXITCODE -ne 0) {
-      throw 'Cursor Agent installer fallback via Windows PowerShell 5.1 failed.'
-    }
+  $installScript = Invoke-RestMethod 'https://cursor.com/install?win32=true' -TimeoutSec 30 -UseBasicParsing
+  $result = Invoke-CatsRemoteInstaller -ScriptText $installScript
+  $result | Add-Member -NotePropertyName usedPowerShell51Fallback -NotePropertyValue $true
+  return $result
 
-    return [pscustomobject]@{
-      usedPowerShell51Fallback = $true
-      skipped = $false
-    }
-  }
 }
 
 if (-not $CheckOnly -and -not $Apply -and -not $Upgrade -and -not $Force -and -not $Uninstall) {
@@ -219,6 +215,7 @@ if ($Uninstall) {
   Invoke-PackagedProviderUninstall `
     -HelperId 'windows-cursor-native-installer' `
     -UserBinaryPath (Resolve-CursorExecutablePath) `
+    -ExtraUserOwnedPaths @((Join-Path $env:LOCALAPPDATA 'cursor-agent')) `
     -RedetectCommand { Detect-CursorInstall } `
     -EmitJson:$Json `
     -DryRun:$DryRun
@@ -289,9 +286,26 @@ if ($CheckOnly) {
   Write-StructuredResult -Result $result -ExitCode 0
 }
 
+if ($DryRun) {
+  Write-CatsNativePreview -Helper 'windows-cursor-native-installer' -Mode $executionMode -Detected $detected -Actions $plannedActions.ToArray() -EmitJson ([bool]$Json)
+}
+
+$installFailed = $false
+$catsInitialObservation = $detected.PSObject.Copy()
 $shouldInstall = $Force -or $Upgrade -or -not $detected.installed
+if ($Upgrade -and -not $Force -and $detected.installed -and -not $SkipInstaller -and -not $DryRun) {
+  $versionGate = Test-CatsNativeUpgrade -Provider 'cursor' -InstalledVersion $detected.detectedVersion
+  $shouldInstall = $versionGate.shouldInstall
+  if (-not $versionGate.known) { $warnings.Add('Could not compare the published version; the official installer will verify the update.') }
+  if (-not $shouldInstall) { $plannedActions.Clear() }
+}
+$installFailed = $false
 if ($shouldInstall) {
-  $installResult = Invoke-CursorInstaller
+  $installResult = try { Invoke-CursorInstaller } catch { [pscustomobject]@{ skipped = $false; success = $false; stderr = [string]$_.Exception.Message; usedPowerShell51Fallback = $false; usedWingetFallback = $false } }
+  if ($installResult.PSObject.Properties['success'] -and -not $installResult.success) {
+    $installFailed = $true
+    $warnings.Add($installResult.stderr)
+  }
   $usedPowerShell51Fallback = [bool]$installResult.usedPowerShell51Fallback
   if ($usedPowerShell51Fallback) {
     $warnings.Add('Cursor installer required the Windows PowerShell 5.1 fallback.')
@@ -302,8 +316,9 @@ if ($shouldInstall) {
 
   Start-Sleep -Seconds 2
   $detected = Detect-CursorInstall
-  if (-not $detected.installed -and -not $SkipInstaller) {
-    throw 'Cursor Agent installation completed but cursor-agent was still not detected.'
+  if (-not $detected.installed -and -not $SkipInstaller -and -not $installFailed) {
+    $warnings.Add('Cursor Agent installation completed but cursor-agent was still not detected.')
+    $installFailed = $true
   }
 
   if ($Force) {
@@ -320,7 +335,7 @@ $interruptions = [System.Collections.Generic.List[object]]::new()
 if ($shouldInstall) {
   $interruptions.Add([pscustomobject]@{
       kind = 'relaunch_required'
-      summary = 'Relaunch Cats Desktop Host after the Cursor Agent install step, then rerun the packaged setup check.'
+      summary = 'Run Detect Again after the Cursor Agent install step if the command is not visible yet.'
       resumable = $true
       requiresRestart = $false
       requiresElevation = $false
@@ -339,7 +354,7 @@ if (-not $authSatisfied) {
 $result = [pscustomobject]@{
   helper = 'windows-cursor-native-installer'
   mode = $executionMode
-  status = if ($interruptions.Count -gt 0) { [string]$interruptions[0].kind } else { 'ready' }
+  status = if ($installFailed) { 'failed' } elseif ($interruptions.Count -gt 0) { [string]$interruptions[0].kind } else { 'ready' }
   installed = [bool]$detected.installed
   detectedVersion = if ($detected.detectedVersion) { $detected.detectedVersion } else { $null }
   commandPath = $detected.commandPath
@@ -350,4 +365,4 @@ $result = [pscustomobject]@{
   interruptions = $interruptions.ToArray()
   usedPowerShell51Fallback = $usedPowerShell51Fallback
 }
-Write-StructuredResult -Result $result -ExitCode 0
+Write-StructuredResult -Result $result -ExitCode $(if ($installFailed) { 1 } else { 0 })

package/scripts/windows/Install-Devin.ps1

@@ -31,6 +31,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
 . (Join-Path $PSScriptRoot '_HiddenProcess.ps1')
+. (Join-Path $PSScriptRoot '_NativeInstallerSupport.ps1')
 . (Join-Path $PSScriptRoot '_PackagedUninstall.ps1')
 
 function Write-StructuredResult {
@@ -39,6 +40,10 @@ function Write-StructuredResult {
     [int]$ExitCode
   )
 
+  if (Get-Variable -Name catsInitialObservation -Scope Script -ErrorAction SilentlyContinue) {
+    Add-CatsNativeObservation -Result $Result -Before $script:catsInitialObservation -Attempted ([bool]$script:shouldInstall) -Skipped ([bool]$SkipInstaller)
+  }
+
   if ($Json) {
     $Result | ConvertTo-Json -Depth 10
   } else {
@@ -126,12 +131,6 @@ function Invoke-DevinInstaller {
     return [pscustomobject]@{ skipped = $true; success = $true; exitCode = 0; stderr = '' }
   }
 
-  $tempScript = [System.IO.Path]::Combine(
-    [System.IO.Path]::GetTempPath(),
-    "cats-devin-install-$([System.Guid]::NewGuid().ToString('N')).ps1"
-  )
-  $stdoutPath = "$tempScript.stdout"
-  $stderrPath = "$tempScript.stderr"
   # Devin's setup.ps1 ends by launching the interactive `devin setup` wizard.
   # Packaged setup runs with no console a prompt can reach, so an unstripped
   # installer would stall the step rather than fail.
@@ -174,46 +173,8 @@ function Invoke-DevinInstaller {
   }
   $bootstrap = ($patchedLines -join [Environment]::NewLine)
 
-  try {
-    [System.IO.File]::WriteAllText(
-      $tempScript,
-      $bootstrap,
-      [System.Text.UTF8Encoding]::new($false)
-    )
-    $powerShellExe = if (Get-Command pwsh.exe -ErrorAction SilentlyContinue) {
-      'pwsh.exe'
-    } else {
-      'powershell.exe'
-    }
-    $process = Start-Process -FilePath $powerShellExe `
-      -ArgumentList @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', $tempScript) `
-      -Wait -PassThru -NoNewWindow `
-      -RedirectStandardOutput $stdoutPath `
-      -RedirectStandardError $stderrPath
-    $stderrRaw = if (Test-Path -LiteralPath $stderrPath -PathType Leaf) {
-      Get-Content -LiteralPath $stderrPath -Raw -ErrorAction SilentlyContinue
-    } else { $null }
+  return Invoke-CatsRemoteInstaller -ScriptText $bootstrap -RetrySharingViolation
 
-    return [pscustomobject]@{
-      skipped = $false
-      success = ($process.ExitCode -eq 0)
-      exitCode = $process.ExitCode
-      stderr = if ($null -eq $stderrRaw) { '' } else { [string]$stderrRaw }
-    }
-  } catch {
-    return [pscustomobject]@{
-      skipped = $false
-      success = $false
-      exitCode = -1
-      stderr = "Failed to invoke Devin installer: $($_.Exception.Message)"
-    }
-  } finally {
-    foreach ($path in @($tempScript, $stdoutPath, $stderrPath)) {
-      if (Test-Path -LiteralPath $path -PathType Leaf) {
-        Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
-      }
-    }
-  }
 }
 
 if (-not $CheckOnly -and -not $Apply -and -not $Upgrade -and -not $Force -and -not $Uninstall) {
@@ -303,7 +264,15 @@ if ($CheckOnly) {
     }) -ExitCode 0
 }
 
+$installFailed = $false
+$catsInitialObservation = $detected.PSObject.Copy()
 $shouldInstall = $Force -or $Upgrade -or -not $detected.installed
+if ($Upgrade -and -not $Force -and $detected.installed -and -not $SkipInstaller -and -not $DryRun) {
+  $versionGate = Test-CatsNativeUpgrade -Provider 'devin' -InstalledVersion $detected.detectedVersion
+  $shouldInstall = $versionGate.shouldInstall
+  if (-not $versionGate.known) { $warnings.Add('Could not compare the published version; the official installer will verify the update.') }
+  if (-not $shouldInstall) { $plannedActions.Clear() }
+}
 $installFailed = $false
 $installSkipped = $false
 if ($shouldInstall) {
@@ -347,12 +316,12 @@ if ($shouldInstall) {
   }
 }
 
-$manualSteps.Add('Run `devin login` or set XAI_API_KEY before first use.')
+$manualSteps.Add('Run `devin auth login` to authenticate; check with `devin auth status`. The interactive setup wizard is skipped.')
 $interruptions = [System.Collections.Generic.List[object]]::new()
 if ($shouldInstall -and -not $installFailed -and -not $DryRun) {
   $interruptions.Add([pscustomobject]@{
       kind = 'relaunch_required'
-      summary = 'Relaunch Cats Desktop Host after the Devin install step, then rerun the packaged setup check.'
+      summary = 'Run Detect Again after the Devin install step if the command is not visible yet.'
       resumable = $true
       requiresRestart = $false
       requiresElevation = $false

package/scripts/windows/Install-GitHubCli.ps1

@@ -179,6 +179,10 @@ $mode = if ($CheckOnly) {
   'apply'
 }
 
+# Desktop can outlive an installation. A fresh check must include the registry
+# PATH, while retaining caller-provided command locations in this process.
+$env:Path = [System.Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' +
+  [System.Environment]::GetEnvironmentVariable('Path', 'User') + ';' + $env:Path
 $installed = Test-GhInstalled
 $detected = Get-GhDetectedVersion -Override $DetectedVersion
 $commandPath = if ($SkipGhProbe) { '' } else { Resolve-GhCommandPath }

package/scripts/windows/Install-Goose.ps1

@@ -59,6 +59,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
 . (Join-Path $PSScriptRoot '_HiddenProcess.ps1')
+. (Join-Path $PSScriptRoot '_NativeInstallerSupport.ps1')
 . (Join-Path $PSScriptRoot '_PackagedUninstall.ps1')
 
 function Write-StructuredResult {
@@ -67,6 +68,10 @@ function Write-StructuredResult {
     [int]$ExitCode
   )
 
+  if (Get-Variable -Name catsInitialObservation -Scope Script -ErrorAction SilentlyContinue) {
+    Add-CatsNativeObservation -Result $Result -Before $script:catsInitialObservation -Attempted ([bool]$script:shouldInstall) -Skipped ([bool]$SkipInstaller)
+  }
+
   if ($Json) {
     $Result | ConvertTo-Json -Depth 10
   } else {
@@ -364,7 +369,19 @@ if ($CheckOnly) {
   Write-StructuredResult -Result $result -ExitCode 0
 }
 
+if ($DryRun) {
+  Write-CatsNativePreview -Helper 'windows-goose-native-installer' -Mode $executionMode -Detected $detected -Actions $plannedActions.ToArray() -EmitJson ([bool]$Json)
+}
+
+$installFailed = $false
+$catsInitialObservation = $detected.PSObject.Copy()
 $shouldInstall = $Force -or $Upgrade -or -not $detected.installed
+if ($Upgrade -and -not $Force -and $detected.installed -and -not $SkipInstaller -and -not $DryRun) {
+  $versionGate = Test-CatsNativeUpgrade -Provider 'goose' -InstalledVersion $detected.detectedVersion
+  $shouldInstall = $versionGate.shouldInstall
+  if (-not $versionGate.known) { $warnings.Add('Could not compare the published version; the official installer will verify the update.') }
+  if (-not $shouldInstall) { $plannedActions.Clear() }
+}
 $installFailed = $false
 $installSkipped = $false
 if ($shouldInstall) {
@@ -410,7 +427,7 @@ $interruptions = [System.Collections.Generic.List[object]]::new()
 if ($shouldInstall -and -not $installFailed) {
   $interruptions.Add([pscustomobject]@{
       kind = 'relaunch_required'
-      summary = 'Relaunch Cats Desktop Host after the Goose install step, then rerun the packaged setup check.'
+      summary = 'Run Detect Again after the Goose install step if the command is not visible yet.'
       resumable = $true
       requiresRestart = $false
       requiresElevation = $false