@mindexec/cli 0.2.478 → 0.2.480

package/electron/preload.cjs

@@ -1,17 +1,17 @@
-'use strict';
-
-const { contextBridge, ipcRenderer } = require('electron');
-
-contextBridge.exposeInMainWorld('mindExecDesktop', {
-  updates: {
-    getStatus: () => ipcRenderer.invoke('updates:get-status'),
-    check: () => ipcRenderer.invoke('updates:check'),
-    install: () => ipcRenderer.invoke('updates:install'),
-    onStatus: callback => {
-      if (typeof callback !== 'function') return () => undefined;
-      const listener = (_event, payload) => callback(payload);
-      ipcRenderer.on('updates:status', listener);
-      return () => ipcRenderer.removeListener('updates:status', listener);
-    }
-  }
-});
+'use strict';
+
+const { contextBridge, ipcRenderer } = require('electron');
+
+contextBridge.exposeInMainWorld('mindExecDesktop', {
+  updates: {
+    getStatus: () => ipcRenderer.invoke('updates:get-status'),
+    check: () => ipcRenderer.invoke('updates:check'),
+    install: () => ipcRenderer.invoke('updates:install'),
+    onStatus: callback => {
+      if (typeof callback !== 'function') return () => undefined;
+      const listener = (_event, payload) => callback(payload);
+      ipcRenderer.on('updates:status', listener);
+      return () => ipcRenderer.removeListener('updates:status', listener);
+    }
+  }
+});

package/electron/recurring-update-owner-smoke.mjs

@@ -1,55 +1,55 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import recurringOwnerModule from './recurring-update-owner.cjs';
-
-const {
-  DEFAULT_UPDATE_INTERVAL_MS,
-  createRecurringProductUpdateOwner
-} = recurringOwnerModule;
-
-test('default recurring update cadence is one minute after the startup check', () => {
-  const owner = createRecurringProductUpdateOwner({
-    manager: { check: async () => ({ state: 'current' }) },
-    setTimer: () => ({ unref() {} }),
-    clearTimer: () => undefined
-  });
-
-  owner.start();
-  assert.equal(DEFAULT_UPDATE_INTERVAL_MS, 60_000);
-  assert.equal(owner.inspect().initialDelayMs, 60_000);
-  assert.equal(owner.inspect().intervalMs, 60_000);
-  owner.stop();
-});
-
-test('one recurring owner checks once and never installs without user approval', async () => {
-  let checkCalls = 0;
-  let installCalls = 0;
-  let timerCallback = null;
-  const manager = {
-    getStatus: () => ({ state: 'downloaded', downloaded: true }),
-    check: async () => {
-      checkCalls += 1;
-      await new Promise(resolve => setTimeout(resolve, 5));
-      return { state: 'downloaded', downloaded: true };
-    },
-    install: async () => { installCalls += 1; }
-  };
-  const owner = createRecurringProductUpdateOwner({
-    manager,
-    initialDelayMs: 1_000,
-    intervalMs: 1_000,
-    setTimer: callback => { timerCallback = callback; return { unref() {} }; },
-    clearTimer: () => { timerCallback = null; }
-  });
-
-  owner.start();
-  assert.equal(owner.inspect().timerCount, 1);
-  const [first, second] = await Promise.all([owner.runNow(), owner.runNow()]);
-  assert.equal(first.downloaded, true);
-  assert.equal(second.downloaded, true);
-  assert.equal(checkCalls, 1);
-  assert.equal(installCalls, 0);
-  assert.ok(timerCallback, 'the single next check must be re-armed');
-  owner.stop();
-  assert.equal(owner.inspect().timerCount, 0);
-});
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import recurringOwnerModule from './recurring-update-owner.cjs';
+
+const {
+  DEFAULT_UPDATE_INTERVAL_MS,
+  createRecurringProductUpdateOwner
+} = recurringOwnerModule;
+
+test('default recurring update cadence is one minute after the startup check', () => {
+  const owner = createRecurringProductUpdateOwner({
+    manager: { check: async () => ({ state: 'current' }) },
+    setTimer: () => ({ unref() {} }),
+    clearTimer: () => undefined
+  });
+
+  owner.start();
+  assert.equal(DEFAULT_UPDATE_INTERVAL_MS, 60_000);
+  assert.equal(owner.inspect().initialDelayMs, 60_000);
+  assert.equal(owner.inspect().intervalMs, 60_000);
+  owner.stop();
+});
+
+test('one recurring owner checks once and never installs without user approval', async () => {
+  let checkCalls = 0;
+  let installCalls = 0;
+  let timerCallback = null;
+  const manager = {
+    getStatus: () => ({ state: 'downloaded', downloaded: true }),
+    check: async () => {
+      checkCalls += 1;
+      await new Promise(resolve => setTimeout(resolve, 5));
+      return { state: 'downloaded', downloaded: true };
+    },
+    install: async () => { installCalls += 1; }
+  };
+  const owner = createRecurringProductUpdateOwner({
+    manager,
+    initialDelayMs: 1_000,
+    intervalMs: 1_000,
+    setTimer: callback => { timerCallback = callback; return { unref() {} }; },
+    clearTimer: () => { timerCallback = null; }
+  });
+
+  owner.start();
+  assert.equal(owner.inspect().timerCount, 1);
+  const [first, second] = await Promise.all([owner.runNow(), owner.runNow()]);
+  assert.equal(first.downloaded, true);
+  assert.equal(second.downloaded, true);
+  assert.equal(checkCalls, 1);
+  assert.equal(installCalls, 0);
+  assert.ok(timerCallback, 'the single next check must be re-armed');
+  owner.stop();
+  assert.equal(owner.inspect().timerCount, 0);
+});

package/electron/recurring-update-owner.cjs

@@ -1,97 +1,97 @@
-'use strict';
-
-const MINIMUM_UPDATE_DELAY_MS = 1_000;
-const DEFAULT_UPDATE_INTERVAL_MS = 60_000;
-
-function normalizeDelay(value, fallback) {
-  const delay = Number(value);
-  return Number.isFinite(delay) && delay >= MINIMUM_UPDATE_DELAY_MS
-    ? Math.round(delay)
-    : fallback;
-}
-
-function createRecurringProductUpdateOwner({
-  manager,
-  canRun = () => true,
-  initialDelayMs = DEFAULT_UPDATE_INTERVAL_MS,
-  intervalMs = DEFAULT_UPDATE_INTERVAL_MS,
-  setTimer = setTimeout,
-  clearTimer = clearTimeout,
-  onError = () => undefined
-} = {}) {
-  if (!manager || typeof manager.check !== 'function') {
-    throw new TypeError('recurring-product-update-manager-required');
-  }
-
-  const initialDelay = normalizeDelay(initialDelayMs, DEFAULT_UPDATE_INTERVAL_MS);
-  const interval = normalizeDelay(intervalMs, DEFAULT_UPDATE_INTERVAL_MS);
-  let stopped = true;
-  let generation = 0;
-  let timer = null;
-  let running = null;
-
-  const clearOwnedTimer = () => {
-    if (!timer) return;
-    clearTimer(timer);
-    timer = null;
-  };
-
-  const arm = (delay, ownerGeneration) => {
-    if (stopped || ownerGeneration !== generation || !canRun()) return;
-    clearOwnedTimer();
-    timer = setTimer(() => {
-      if (stopped || ownerGeneration !== generation) return;
-      timer = null;
-      void runCycle(ownerGeneration);
-    }, delay);
-    timer?.unref?.();
-  };
-
-  const runCycle = ownerGeneration => {
-    if (stopped || ownerGeneration !== generation || !canRun()) {
-      return Promise.resolve(manager.getStatus?.() || { state: 'stopped' });
-    }
-    if (running) return running;
-
-    const operation = Promise.resolve(manager.check());
-    running = operation;
-    void operation.catch(error => onError(error)).finally(() => {
-      if (running === operation) running = null;
-      arm(interval, ownerGeneration);
-    });
-    return operation;
-  };
-
-  return {
-    start() {
-      if (!stopped) return;
-      stopped = false;
-      generation += 1;
-      arm(initialDelay, generation);
-    },
-    stop() {
-      stopped = true;
-      generation += 1;
-      clearOwnedTimer();
-    },
-    runNow() {
-      clearOwnedTimer();
-      return runCycle(generation);
-    },
-    inspect() {
-      return {
-        stopped,
-        generation,
-        timerCount: timer ? 1 : 0,
-        running: Boolean(running),
-        initialDelayMs: initialDelay,
-        intervalMs: interval
-      };
-    }
-  };
-}
-
-module.exports = {
-  DEFAULT_UPDATE_INTERVAL_MS,
-  createRecurringProductUpdateOwner
-};
+'use strict';
+
+const MINIMUM_UPDATE_DELAY_MS = 1_000;
+const DEFAULT_UPDATE_INTERVAL_MS = 60_000;
+
+function normalizeDelay(value, fallback) {
+  const delay = Number(value);
+  return Number.isFinite(delay) && delay >= MINIMUM_UPDATE_DELAY_MS
+    ? Math.round(delay)
+    : fallback;
+}
+
+function createRecurringProductUpdateOwner({
+  manager,
+  canRun = () => true,
+  initialDelayMs = DEFAULT_UPDATE_INTERVAL_MS,
+  intervalMs = DEFAULT_UPDATE_INTERVAL_MS,
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+  onError = () => undefined
+} = {}) {
+  if (!manager || typeof manager.check !== 'function') {
+    throw new TypeError('recurring-product-update-manager-required');
+  }
+
+  const initialDelay = normalizeDelay(initialDelayMs, DEFAULT_UPDATE_INTERVAL_MS);
+  const interval = normalizeDelay(intervalMs, DEFAULT_UPDATE_INTERVAL_MS);
+  let stopped = true;
+  let generation = 0;
+  let timer = null;
+  let running = null;
+
+  const clearOwnedTimer = () => {
+    if (!timer) return;
+    clearTimer(timer);
+    timer = null;
+  };
+
+  const arm = (delay, ownerGeneration) => {
+    if (stopped || ownerGeneration !== generation || !canRun()) return;
+    clearOwnedTimer();
+    timer = setTimer(() => {
+      if (stopped || ownerGeneration !== generation) return;
+      timer = null;
+      void runCycle(ownerGeneration);
+    }, delay);
+    timer?.unref?.();
+  };
+
+  const runCycle = ownerGeneration => {
+    if (stopped || ownerGeneration !== generation || !canRun()) {
+      return Promise.resolve(manager.getStatus?.() || { state: 'stopped' });
+    }
+    if (running) return running;
+
+    const operation = Promise.resolve(manager.check());
+    running = operation;
+    void operation.catch(error => onError(error)).finally(() => {
+      if (running === operation) running = null;
+      arm(interval, ownerGeneration);
+    });
+    return operation;
+  };
+
+  return {
+    start() {
+      if (!stopped) return;
+      stopped = false;
+      generation += 1;
+      arm(initialDelay, generation);
+    },
+    stop() {
+      stopped = true;
+      generation += 1;
+      clearOwnedTimer();
+    },
+    runNow() {
+      clearOwnedTimer();
+      return runCycle(generation);
+    },
+    inspect() {
+      return {
+        stopped,
+        generation,
+        timerCount: timer ? 1 : 0,
+        running: Boolean(running),
+        initialDelayMs: initialDelay,
+        intervalMs: interval
+      };
+    }
+  };
+}
+
+module.exports = {
+  DEFAULT_UPDATE_INTERVAL_MS,
+  createRecurringProductUpdateOwner
+};

package/electron/source-smoke.mjs

@@ -1,108 +1,108 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import sharp from 'sharp';
-
-const electronDirectory = path.dirname(fileURLToPath(import.meta.url));
-const packageRoot = path.resolve(electronDirectory, '..');
-const packageJson = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
-const mainSource = fs.readFileSync(path.join(electronDirectory, 'main.cjs'), 'utf8');
-const preloadSource = fs.readFileSync(path.join(electronDirectory, 'preload.cjs'), 'utf8');
-const updateManagerSource = fs.readFileSync(path.join(electronDirectory, 'update-manager.cjs'), 'utf8');
-const updateFeed = JSON.parse(fs.readFileSync(path.join(electronDirectory, 'update-feed.json'), 'utf8'));
-const serverSource = fs.readFileSync(path.join(packageRoot, 'server.js'), 'utf8');
-
-assert.equal(packageJson.build?.appId, 'com.mindexec.desktop', 'Stable desktop appId is required.');
-assert.equal(packageJson.build?.productName, 'MindExec', 'Desktop product name changed unexpectedly.');
-assert.match(mainSource, /title:\s*'MindExec'/, 'The Electron window title must use the MindExec app brand.');
-assert.equal(packageJson.build?.extraMetadata?.main, 'electron/main.cjs', 'Packaged Electron entry point is missing.');
-assert.equal(packageJson.build?.asar, false, 'Bundled runtime executables require an unpacked app directory.');
-assert.ok(packageJson.files?.includes('electron/'), 'The npm package must include the Electron source contract.');
-assert.ok(packageJson.files?.includes('desktop-workspace-state.cjs'), 'The npm package must include desktop workspace state.');
-assert.match(packageJson.scripts?.['desktop:build:win'] || '', /electron-builder/, 'Windows build script is missing.');
-assert.match(packageJson.scripts?.['test:desktop:win'] || '', /windows-package-smoke/, 'Packaged smoke test is missing.');
-assert.match(packageJson.scripts?.['desktop:publish:update:dev'] || '', /--channel dev[\s\S]*--allow-unsigned[\s\S]*--publish/,
-  'The explicit development update publishing command is missing.');
-assert.equal(packageJson.dependencies?.['electron-updater'], '^6.8.9', 'The packaged updater dependency is missing.');
-assert.equal(packageJson.build?.extraMetadata?.desktopUpdateChannel, 'dev', 'Development installers must stay on the dev feed.');
-assert.equal(packageJson.build?.publish?.provider, 'generic', 'Desktop updates must use the generic R2-backed provider.');
-assert.equal(
-  packageJson.build?.publish?.url,
-  'https://mindexec.lovecrdm.workers.dev/dev/windows/x64',
-  'The packaged development update URL changed unexpectedly.'
-);
-assert.equal(updateFeed.baseUrl, 'https://mindexec.lovecrdm.workers.dev', 'MindExec update hostname has a typo.');
-assert.equal(updateFeed.channel, 'dev', 'The packaged update feed must default to the isolated dev channel.');
-
-assert.equal(
-  packageJson.build?.win?.icon,
-  '../MindExecution.Web/wwwroot/app-icon-1024.png',
-  'Electron must build from the canonical 1024px MindExec icon.'
-);
-const builderIconPath = path.resolve(packageRoot, packageJson.build.win.icon);
-assert.ok(fs.existsSync(builderIconPath), `Electron builder icon is missing: ${builderIconPath}`);
-const builderIconMetadata = await sharp(builderIconPath).metadata();
-assert.equal(builderIconMetadata.width, 1024, 'Electron builder icon must be 1024px wide.');
-assert.equal(builderIconMetadata.height, 1024, 'Electron builder icon must be 1024px tall.');
-assert.equal(builderIconMetadata.hasAlpha, true, 'Electron builder icon must preserve transparency.');
-const { data: builderIconPixels, info: builderIconInfo } = await sharp(builderIconPath)
-  .ensureAlpha()
-  .raw()
-  .toBuffer({ resolveWithObject: true });
-const builderIconCornerAlpha = [
-  builderIconPixels[3],
-  builderIconPixels[(builderIconInfo.width - 1) * 4 + 3],
-  builderIconPixels[(builderIconInfo.height - 1) * builderIconInfo.width * 4 + 3],
-  builderIconPixels[(builderIconInfo.width * builderIconInfo.height - 1) * 4 + 3]
-];
-assert.ok(
-  builderIconCornerAlpha.every((alpha) => alpha === 0),
-  'Electron builder icon must have fully transparent corners.'
-);
-
-const targets = packageJson.build?.win?.target || [];
-assert.ok(targets.some((target) => target.target === 'nsis'), 'NSIS target is required.');
-assert.ok(targets.some((target) => target.target === 'portable'), 'Portable target is required.');
-
-assert.match(mainSource, /contextIsolation:\s*true/, 'Electron renderer isolation must remain enabled.');
-assert.match(mainSource, /nodeIntegration:\s*false/, 'Node integration must remain disabled.');
-assert.match(mainSource, /sandbox:\s*true/, 'Electron renderer sandbox must remain enabled.');
-assert.match(mainSource, /preload:\s*path\.join\(__dirname, 'preload\.cjs'\)/, 'The isolated updater preload is missing.');
-assert.match(mainSource, /runtimeMode:\s*'bundled'/, 'Packaged runtime must report bundled mode.');
-assert.match(mainSource, /spawnBundledBridge/, 'Electron must start its bundled LocalBridge.');
-assert.match(mainSource, /wwwroot.*index\.html/s, 'Electron must verify its bundled frontend.');
-assert.match(mainSource, /resolveDedicatedPort/, 'Electron must allocate dedicated local ports.');
-assert.doesNotMatch(mainSource, /adopted|probeBridge/, 'Electron must not adopt an external LocalBridge.');
-assert.match(mainSource, /MINDEXEC_DESKTOP_SMOKE_RESULT/, 'Packaged runtime smoke contract is missing.');
-assert.match(mainSource, /icon:\s*resolveDesktopIconPath\(\)/, 'Electron windows must use the packaged MindExec icon.');
-assert.match(mainSource, /app\.setAppUserModelId\(DESKTOP_APP_ID\)/, 'Windows taskbar identity must use the stable app id.');
-assert.match(mainSource, /resolveDesktopWorkspace/, 'Electron startup must restore the last desktop workspace.');
-assert.match(mainSource, /MINDEXEC_DESKTOP_WORKSPACE_STATE_PATH/, 'Electron must share its workspace state path with LocalBridge.');
-assert.match(mainSource, /resolveDesktopInstallKind/, 'Installed, portable, and unpacked update behavior must remain separate.');
-assert.match(mainSource, /createProductUpdateManager/, 'The Electron update manager is not wired into the app.');
-assert.match(mainSource, /updates:get-status/, 'The updater status IPC contract is missing.');
-assert.match(mainSource, /updates:check/, 'The manual updater check IPC contract is missing.');
-assert.match(mainSource, /updates:install/, 'The updater install IPC contract is missing.');
-assert.match(mainSource, /await stopBundledBridge\(\)[\s\S]{0,180}await waitForBundledRuntimePortsReleased\(\)/,
-  'The Bridge and RemoteHub ports must reach zero before the installer starts.');
-assert.match(mainSource, /Restart and update/, 'A downloaded update must ask before restarting active work.');
-assert.match(preloadSource, /mindExecDesktop/, 'The updater preload namespace changed unexpectedly.');
-assert.match(preloadSource, /updates:\s*\{/, 'The updater preload API is missing.');
-assert.match(updateManagerSource, /autoDownload\s*=\s*false/, 'Updates must not download through an unowned implicit path.');
-assert.match(updateManagerSource, /autoInstallOnAppQuit\s*=\s*false/, 'Updates must not restart without the explicit prompt path.');
-assert.match(updateManagerSource, /quitAndInstall\(true, true\)/, 'Downloaded updates must relaunch silently after approval.');
-assert.match(updateManagerSource, /desktop-updates-require-installed-windows-app/,
-  'Portable and unpacked builds must fail closed instead of replacing themselves.');
-assert.match(serverSource, /saveDesktopWorkspaceState\(DESKTOP_WORKSPACE_STATE_PATH, resolvedPath\)/,
-  'A successful desktop workspace switch must be saved for the next launch.');
-
-console.log(JSON.stringify({
-  ok: true,
-  appId: packageJson.build.appId,
-  version: packageJson.version,
-  runtimeMode: 'bundled',
-  icon: packageJson.build.win.icon,
-  updateFeed: `${updateFeed.baseUrl}/${updateFeed.channel}/windows/x64`,
-  targets: targets.map((target) => `${target.target}:${target.arch.join(',')}`)
-}));
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import sharp from 'sharp';
+
+const electronDirectory = path.dirname(fileURLToPath(import.meta.url));
+const packageRoot = path.resolve(electronDirectory, '..');
+const packageJson = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+const mainSource = fs.readFileSync(path.join(electronDirectory, 'main.cjs'), 'utf8');
+const preloadSource = fs.readFileSync(path.join(electronDirectory, 'preload.cjs'), 'utf8');
+const updateManagerSource = fs.readFileSync(path.join(electronDirectory, 'update-manager.cjs'), 'utf8');
+const updateFeed = JSON.parse(fs.readFileSync(path.join(electronDirectory, 'update-feed.json'), 'utf8'));
+const serverSource = fs.readFileSync(path.join(packageRoot, 'server.js'), 'utf8');
+
+assert.equal(packageJson.build?.appId, 'com.mindexec.desktop', 'Stable desktop appId is required.');
+assert.equal(packageJson.build?.productName, 'MindExec', 'Desktop product name changed unexpectedly.');
+assert.match(mainSource, /title:\s*'MindExec'/, 'The Electron window title must use the MindExec app brand.');
+assert.equal(packageJson.build?.extraMetadata?.main, 'electron/main.cjs', 'Packaged Electron entry point is missing.');
+assert.equal(packageJson.build?.asar, false, 'Bundled runtime executables require an unpacked app directory.');
+assert.ok(packageJson.files?.includes('electron/'), 'The npm package must include the Electron source contract.');
+assert.ok(packageJson.files?.includes('desktop-workspace-state.cjs'), 'The npm package must include desktop workspace state.');
+assert.match(packageJson.scripts?.['desktop:build:win'] || '', /electron-builder/, 'Windows build script is missing.');
+assert.match(packageJson.scripts?.['test:desktop:win'] || '', /windows-package-smoke/, 'Packaged smoke test is missing.');
+assert.match(packageJson.scripts?.['desktop:publish:update:dev'] || '', /--channel dev[\s\S]*--allow-unsigned[\s\S]*--publish/,
+  'The explicit development update publishing command is missing.');
+assert.equal(packageJson.dependencies?.['electron-updater'], '^6.8.9', 'The packaged updater dependency is missing.');
+assert.equal(packageJson.build?.extraMetadata?.desktopUpdateChannel, 'dev', 'Development installers must stay on the dev feed.');
+assert.equal(packageJson.build?.publish?.provider, 'generic', 'Desktop updates must use the generic R2-backed provider.');
+assert.equal(
+  packageJson.build?.publish?.url,
+  'https://mindexec.lovecrdm.workers.dev/dev/windows/x64',
+  'The packaged development update URL changed unexpectedly.'
+);
+assert.equal(updateFeed.baseUrl, 'https://mindexec.lovecrdm.workers.dev', 'MindExec update hostname has a typo.');
+assert.equal(updateFeed.channel, 'dev', 'The packaged update feed must default to the isolated dev channel.');
+
+assert.equal(
+  packageJson.build?.win?.icon,
+  '../MindExecution.Web/wwwroot/app-icon-1024.png',
+  'Electron must build from the canonical 1024px MindExec icon.'
+);
+const builderIconPath = path.resolve(packageRoot, packageJson.build.win.icon);
+assert.ok(fs.existsSync(builderIconPath), `Electron builder icon is missing: ${builderIconPath}`);
+const builderIconMetadata = await sharp(builderIconPath).metadata();
+assert.equal(builderIconMetadata.width, 1024, 'Electron builder icon must be 1024px wide.');
+assert.equal(builderIconMetadata.height, 1024, 'Electron builder icon must be 1024px tall.');
+assert.equal(builderIconMetadata.hasAlpha, true, 'Electron builder icon must preserve transparency.');
+const { data: builderIconPixels, info: builderIconInfo } = await sharp(builderIconPath)
+  .ensureAlpha()
+  .raw()
+  .toBuffer({ resolveWithObject: true });
+const builderIconCornerAlpha = [
+  builderIconPixels[3],
+  builderIconPixels[(builderIconInfo.width - 1) * 4 + 3],
+  builderIconPixels[(builderIconInfo.height - 1) * builderIconInfo.width * 4 + 3],
+  builderIconPixels[(builderIconInfo.width * builderIconInfo.height - 1) * 4 + 3]
+];
+assert.ok(
+  builderIconCornerAlpha.every((alpha) => alpha === 0),
+  'Electron builder icon must have fully transparent corners.'
+);
+
+const targets = packageJson.build?.win?.target || [];
+assert.ok(targets.some((target) => target.target === 'nsis'), 'NSIS target is required.');
+assert.ok(targets.some((target) => target.target === 'portable'), 'Portable target is required.');
+
+assert.match(mainSource, /contextIsolation:\s*true/, 'Electron renderer isolation must remain enabled.');
+assert.match(mainSource, /nodeIntegration:\s*false/, 'Node integration must remain disabled.');
+assert.match(mainSource, /sandbox:\s*true/, 'Electron renderer sandbox must remain enabled.');
+assert.match(mainSource, /preload:\s*path\.join\(__dirname, 'preload\.cjs'\)/, 'The isolated updater preload is missing.');
+assert.match(mainSource, /runtimeMode:\s*'bundled'/, 'Packaged runtime must report bundled mode.');
+assert.match(mainSource, /spawnBundledBridge/, 'Electron must start its bundled LocalBridge.');
+assert.match(mainSource, /wwwroot.*index\.html/s, 'Electron must verify its bundled frontend.');
+assert.match(mainSource, /resolveDedicatedPort/, 'Electron must allocate dedicated local ports.');
+assert.doesNotMatch(mainSource, /adopted|probeBridge/, 'Electron must not adopt an external LocalBridge.');
+assert.match(mainSource, /MINDEXEC_DESKTOP_SMOKE_RESULT/, 'Packaged runtime smoke contract is missing.');
+assert.match(mainSource, /icon:\s*resolveDesktopIconPath\(\)/, 'Electron windows must use the packaged MindExec icon.');
+assert.match(mainSource, /app\.setAppUserModelId\(DESKTOP_APP_ID\)/, 'Windows taskbar identity must use the stable app id.');
+assert.match(mainSource, /resolveDesktopWorkspace/, 'Electron startup must restore the last desktop workspace.');
+assert.match(mainSource, /MINDEXEC_DESKTOP_WORKSPACE_STATE_PATH/, 'Electron must share its workspace state path with LocalBridge.');
+assert.match(mainSource, /resolveDesktopInstallKind/, 'Installed, portable, and unpacked update behavior must remain separate.');
+assert.match(mainSource, /createProductUpdateManager/, 'The Electron update manager is not wired into the app.');
+assert.match(mainSource, /updates:get-status/, 'The updater status IPC contract is missing.');
+assert.match(mainSource, /updates:check/, 'The manual updater check IPC contract is missing.');
+assert.match(mainSource, /updates:install/, 'The updater install IPC contract is missing.');
+assert.match(mainSource, /await stopBundledBridge\(\)[\s\S]{0,180}await waitForBundledRuntimePortsReleased\(\)/,
+  'The Bridge and RemoteHub ports must reach zero before the installer starts.');
+assert.match(mainSource, /Restart and update/, 'A downloaded update must ask before restarting active work.');
+assert.match(preloadSource, /mindExecDesktop/, 'The updater preload namespace changed unexpectedly.');
+assert.match(preloadSource, /updates:\s*\{/, 'The updater preload API is missing.');
+assert.match(updateManagerSource, /autoDownload\s*=\s*false/, 'Updates must not download through an unowned implicit path.');
+assert.match(updateManagerSource, /autoInstallOnAppQuit\s*=\s*false/, 'Updates must not restart without the explicit prompt path.');
+assert.match(updateManagerSource, /quitAndInstall\(true, true\)/, 'Downloaded updates must relaunch silently after approval.');
+assert.match(updateManagerSource, /desktop-updates-require-installed-windows-app/,
+  'Portable and unpacked builds must fail closed instead of replacing themselves.');
+assert.match(serverSource, /saveDesktopWorkspaceState\(DESKTOP_WORKSPACE_STATE_PATH, resolvedPath\)/,
+  'A successful desktop workspace switch must be saved for the next launch.');
+
+console.log(JSON.stringify({
+  ok: true,
+  appId: packageJson.build.appId,
+  version: packageJson.version,
+  runtimeMode: 'bundled',
+  icon: packageJson.build.win.icon,
+  updateFeed: `${updateFeed.baseUrl}/${updateFeed.channel}/windows/x64`,
+  targets: targets.map((target) => `${target.target}:${target.arch.join(',')}`)
+}));