@trillboards/edge-sdk 0.2.17 → 0.2.18

package/deploy/macos/scripts/setup-litertlm.sh

@@ -32,6 +32,17 @@ HF_REPO="litert-community/gemma-4-E2B-it-litert-lm"
 SERVE_LABEL="com.trillboards.litertlm"
 SERVE_PORT="9379"
 LITERT_PYTHON="${LITERT_LM_PYTHON:-3.12}"
+# PINNED litert-lm. This is not hygiene — the accelerator is selected by posting
+# a `<model-id>,gpu` model id, upstream calls that syntax deprecated, and it has
+# already changed twice without any release of ours: 0.14.0 (2026-07-08) dropped
+# both the `,gpu` entry from `GET /v1/models` AND the parse (measured: 404), and
+# 0.15.0 restored the parse but never the entry. An unpinned `--upgrade` means a
+# customer's per-frame cost can change 1.7-6.6x on a reinstall we did not ship.
+# Keep in lockstep with deploy/windows/setup-litertlm.ps1, LiteRtVlmProvider's
+# LITERT_LM_PINNED_VERSION, and .github/contracts/litert-lm-tested-versions.json
+# — the `litert-lm-version-pin` guard fails CI if they diverge or if this version
+# has no measured entry in that contract.
+LITERT_LM_VERSION="${LITERT_LM_VERSION:-0.16.0}"
 REQUIRE_BUNDLED_MODEL="${TRILLBOARDS_REQUIRE_BUNDLED_MODEL:-0}"
 ALLOW_MODEL_DOWNLOAD="${TRILLBOARDS_ALLOW_MODEL_DOWNLOAD:-0}"
 # Customer packages stage the model here. A network fallback remains available
@@ -170,18 +181,32 @@ if ! command -v "$UV" >/dev/null 2>&1 && [ ! -x "$UV" ]; then
   log "ERROR: uv unavailable; cannot provision LiteRT-LM"; exit 0
 fi
 
-# 2. litert-lm CLI. Keep a healthy existing install, but actively repair a
-# broken one. Older connector versions could let uv bind the tool to Apple's
-# Python 3.9; current LiteRT-LM uses Python features introduced in 3.10 and then
-# crash-loops before serving. --force rebuilds that existing tool environment
-# with the explicit managed interpreter while --upgrade refreshes the package.
+# 2. litert-lm CLI. Keep a healthy existing install AT THE PINNED VERSION, but
+# actively repair a broken or drifted one. Older connector versions could let uv
+# bind the tool to Apple's Python 3.9; current LiteRT-LM uses Python features
+# introduced in 3.10 and then crash-loops before serving. --force rebuilds that
+# existing tool environment with the explicit managed interpreter.
+#
+# The version check is part of "healthy". A `list`-only health check kept every
+# machine on whatever it happened to install first — which is how the box this
+# was designed on stayed on 0.13.1 (where the `,gpu` entry is advertised) while
+# every customer install after 2026-07-08 got a build that omits it. The bug
+# reproduced on their hosts and on none of ours.
 LITERTLM="$LOCAL_BIN/litert-lm"
 [ -x "$LITERTLM" ] || LITERTLM="$(command -v litert-lm || echo "$LITERTLM")"
-if [ -x "$LITERTLM" ] && "$LITERTLM" list >/dev/null 2>&1; then
-  log "litert-lm CLI is healthy — keeping current install"
+INSTALLED_LITERT_VERSION=""
+if [ -x "$LITERTLM" ]; then
+  INSTALLED_LITERT_VERSION="$("$LITERTLM" --version 2>/dev/null | tr -d '\r' | awk '{print $NF}')"
+fi
+if [ -x "$LITERTLM" ] && [ "$INSTALLED_LITERT_VERSION" = "$LITERT_LM_VERSION" ] \
+  && "$LITERTLM" list >/dev/null 2>&1; then
+  log "litert-lm CLI is healthy at pinned $LITERT_LM_VERSION — keeping current install"
 else
-  log "installing/repairing litert-lm with uv-managed Python $LITERT_PYTHON"
-  if ! "$UV" tool install --python "$LITERT_PYTHON" --managed-python --upgrade --force litert-lm >>"$LOG" 2>&1; then
+  if [ -n "$INSTALLED_LITERT_VERSION" ] && [ "$INSTALLED_LITERT_VERSION" != "$LITERT_LM_VERSION" ]; then
+    log "litert-lm $INSTALLED_LITERT_VERSION differs from pinned $LITERT_LM_VERSION — reinstalling"
+  fi
+  log "installing/repairing litert-lm==$LITERT_LM_VERSION with uv-managed Python $LITERT_PYTHON"
+  if ! "$UV" tool install --python "$LITERT_PYTHON" --managed-python --force "litert-lm==$LITERT_LM_VERSION" >>"$LOG" 2>&1; then
     [ "$REQUIRE_BUNDLED_MODEL" = "1" ] && fail "litert-lm install/repair failed"
     log "ERROR: litert-lm install/repair failed; local AI will retry later"
     exit 0
@@ -193,7 +218,7 @@ else
     log "ERROR: litert-lm remains unhealthy after repair; local AI will retry later"
     exit 0
   fi
-  log "litert-lm CLI repaired successfully"
+  log "litert-lm CLI repaired successfully at $("$LITERTLM" --version 2>/dev/null | awk '{print $NF}')"
 fi
 
 # 3. Model - import the verified bundled file. Idempotent: skip entirely if

package/deploy/windows/README.md

@@ -19,7 +19,11 @@ bin\trillboards-pair.cmd     hidden setup engine used by the setup window
 bin\trillboards-hidden-run.vbs  runs a helper with NO console (never use cmd's
                              `start`: it allocates a visible console before the
                              child can hide itself)
-bin\register-task.ps1        registers the logon Scheduled Task
+bin\register-task.ps1        registers the background Scheduled Task. Tries
+                             S4U + boot trigger first (runs with NOBODY logged
+                             on), and steps down one capability at a time to a
+                             repeating trigger and then an interactive
+                             principal, so a machine is never left with no task
 bin\stop-existing.ps1        DISABLES the task, stops this install's processes,
                              and proves bin\node.exe is unlocked before a swap
 bin\ensure-sensing.ps1       re-arms the task (register/enable/start) — closing
@@ -40,13 +44,22 @@ serves every Windows 10/11 — no per-arch builds.
 2. Run it. Production installers are Authenticode-signed with Azure Trusted
    Signing and the release workflow verifies the signature before publishing.
 3. Installer copies the connector, installs and verifies the included local AI,
-   registers the logon tasks, then opens **Trillboards CCTV Setup** without a
+   registers the startup tasks, then opens **Trillboards CCTV Setup** without a
    command window.
 4. Select **Start setup**. The app opens the Trillboards camera wizard, discovers
    local recorders, and validates each channel. Black, disconnected, and
    unreadable inputs are ignored; only working camera feeds become screens.
-5. Sensing starts with the already-installed local AI and restarts on every
-   logon; cloud inference is off by default.
+5. Sensing starts with the already-installed local AI; cloud inference is off
+   by default.
+6. Closing the setup window asks for **one UAC elevation**. That single prompt is
+   what makes sensing survive an unattended reboot, and it is a Windows rule
+   rather than a preference: an S4U principal performs a batch logon, and Task
+   Scheduler grants `SeBatchLogonRight` only when the caller is an administrator
+   (boot triggers are Administrators-only for the same reason). Accepting it
+   registers both tasks S4U + at boot, so the connector comes back within ~30 s
+   of every restart with nobody signed in. Declining it — or installing under a
+   standard user, who is never prompted because they could not satisfy it — keeps
+   a working task that repeats every 5 minutes but still needs someone logged on.
 
 ## Build (CI: `release-connector-windows.yml`, runs on `windows-latest`)