@trillboards/edge-sdk 0.2.4 → 0.2.7

package/deploy/macos/test-install-pair.sh

@@ -0,0 +1,383 @@
+#!/usr/bin/env bash
+#
+# test-install-pair.sh — local, no-sudo, self-cleaning end-to-end proof that the
+# Trillboards "cloud-sense" CCTV connector .pkg builds, installs home-domain,
+# pairs, and actually senses (real bundled-ffmpeg JPEG capture → POST) on THIS
+# Mac.
+#
+# Acceptance (each step is a TAP assert):
+#   1. Build the .pkg (build-macos-pkg.sh).
+#   2. Install it home-domain (installer -target CurrentUserHomeDirectory, no
+#      sudo). Assert node + ffmpeg + cli.js landed and `version` runs via the
+#      bundled node.
+#   3. Start a local STUB pair+analyze server returning a valid pair response
+#      for a known claim code, with one camera pointed at a LOCAL synthetic
+#      ffmpeg source (a generated mp4 via file:), so the real connector code
+#      path runs without an RTSP-server rabbit-hole.
+#   4. Pair headlessly (trillboards-edge pair --code … --api-base …). Assert
+#      exit 0, config written 0600 with the camera + deviceToken.
+#   5. Start the connector from that config (cloud-sense) and assert it produces
+#      a real JPEG frame via the BUNDLED ffmpeg and POSTs it to
+#      /v2/earner/audience-analyze carrying the paired X-Device-Token. Also
+#      assert the per-user LaunchAgent bootstraps + senses end-to-end.
+#   6. Tear everything down (bootout agent, uninstall home tree, remove temp
+#      config/logs, kill the stub) — idempotent / re-runnable.
+#
+# Re-run:  bash deploy/macos/test-install-pair.sh
+
+set -uo pipefail
+
+# ─── Locate ──────────────────────────────────────────────────────────────────
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"   # deploy/macos
+PKG_ROOT="$(cd "$HERE/../.." && pwd)"                   # edge-sdk
+WORKSPACE_ROOT="$(cd "$PKG_ROOT/../.." && pwd)"
+
+EDGE_ROOT="$HOME/Library/Trillboards/edge"
+APP_SUPPORT="$HOME/Library/Application Support/Trillboards"
+INSTALLED_CONFIG="$APP_SUPPORT/trillboards.config.json"
+LOG_DIR="$HOME/Library/Logs/Trillboards"
+LA_PLIST="$HOME/Library/LaunchAgents/com.trillboards.edge.plist"
+LABEL="com.trillboards.edge"
+# Customer-facing native setup application installed under the user's home.
+SETUP_APP="$HOME/Applications/Trillboards CCTV Setup.app"
+SETUP_APP_BIN="$SETUP_APP/Contents/MacOS/Trillboards CCTV Setup"
+LEGACY_PAIR_LAUNCHER="$HOME/Applications/Trillboards Pair.command"
+UID_N="$(id -u)"
+
+# Scratch (under the worktree's build dir so it's easy to clean).
+SCRATCH="$HERE/dist-installer/test-scratch"
+SAMPLE_MP4="$SCRATCH/cctv_sample.mp4"
+STUB_JS="$SCRATCH/stub_server.js"
+STUB_OUT="$SCRATCH/stub.out"
+TEST_CONFIG="$SCRATCH/paired.config.json"
+CS_OUT="$SCRATCH/cloud-sense.out"
+STUB_PID=""
+CS_PID=""
+
+# ─── TAP plumbing ────────────────────────────────────────────────────────────
+TAP_N=0
+FAILS=0
+ok()  { TAP_N=$((TAP_N+1)); printf 'ok %d - %s\n' "$TAP_N" "$1"; }
+nok() { TAP_N=$((TAP_N+1)); FAILS=$((FAILS+1)); printf 'not ok %d - %s\n' "$TAP_N" "$1"; [ -n "${2:-}" ] && printf '  ---\n  %s\n  ---\n' "$2"; }
+diag(){ printf '# %s\n' "$1"; }
+
+# Portable octal-mode reader. The `stat` on PATH may be GNU coreutils (uses
+# `-c %a`) or BSD (uses `-f %Lp`), and on this Mac Homebrew shims GNU stat in
+# front — so probe both, and finally fall back to the bundled node (always
+# correct). Echoes the 3-4 digit octal mode (e.g. 600) or empty on failure.
+file_mode() {
+  local f="$1" m=""
+  m="$(stat -c '%a' "$f" 2>/dev/null)" && [ -n "$m" ] && { echo "$m"; return; }
+  m="$(stat -f '%Lp' "$f" 2>/dev/null)" && [ -n "$m" ] && { echo "$m"; return; }
+  if [ -x "$EDGE_ROOT/bin/node" ]; then
+    "$EDGE_ROOT/bin/node" -e "process.stdout.write((require('fs').statSync(process.argv[1]).mode & 0o777).toString(8))" "$f" 2>/dev/null
+  fi
+}
+
+# ─── Teardown (idempotent) — runs on EXIT so partial runs still clean up ──────
+teardown() {
+  diag "teardown…"
+  pkill -x 'Trillboards CCTV Setup' >/dev/null 2>&1 || true
+  [ -n "$CS_PID" ] && kill "$CS_PID" >/dev/null 2>&1 || true
+  [ -n "$STUB_PID" ] && kill "$STUB_PID" >/dev/null 2>&1 || true
+  pkill -f "$STUB_JS" >/dev/null 2>&1 || true
+  launchctl bootout "gui/$UID_N/$LABEL" >/dev/null 2>&1 || true
+  launchctl unload "$LA_PLIST" >/dev/null 2>&1 || true
+  rm -f "$LA_PLIST"
+  rm -rf "$HOME/Library/Trillboards" "$APP_SUPPORT" "$LOG_DIR"
+  rm -rf "$SETUP_APP"
+  rm -f "$LEGACY_PAIR_LAUNCHER"
+  # Forget the home-domain receipt so a re-run installs cleanly.
+  pkgutil --volume "$HOME" --forget "$LABEL" >/dev/null 2>&1 || true
+  rm -rf "$SCRATCH"
+}
+trap teardown EXIT
+
+# Pre-clean anything left by a prior aborted run BEFORE we start.
+pkill -x 'Trillboards CCTV Setup' >/dev/null 2>&1 || true
+launchctl bootout "gui/$UID_N/$LABEL" >/dev/null 2>&1 || true
+rm -f "$LA_PLIST"
+rm -rf "$HOME/Library/Trillboards" "$APP_SUPPORT" "$LOG_DIR"
+rm -rf "$SETUP_APP"
+rm -f "$LEGACY_PAIR_LAUNCHER"
+pkgutil --volume "$HOME" --forget "$LABEL" >/dev/null 2>&1 || true
+mkdir -p "$SCRATCH"
+
+echo "TAP version 13"
+diag "Trillboards Edge — macOS install+pair self-test"
+diag "edge-sdk root: $PKG_ROOT"
+
+# ─── Preconditions ───────────────────────────────────────────────────────────
+command -v ffmpeg >/dev/null 2>&1 || { diag "ffmpeg required on PATH to generate the synthetic source"; }
+if ffmpeg -hide_banner -loglevel error -f lavfi -i "testsrc=size=320x240:rate=5" -frames:v 10 -y "$SAMPLE_MP4" >/dev/null 2>&1 && [ -s "$SAMPLE_MP4" ]; then
+  ok "generated synthetic camera source (testsrc → $SAMPLE_MP4)"
+else
+  nok "could not generate synthetic camera source" "ffmpeg lavfi testsrc failed"
+fi
+
+# ─── STEP 1: build the pkg ───────────────────────────────────────────────────
+diag "STEP 1 — build the .pkg"
+# Offline is fine if the host already has a matching node; default tries the
+# pinned official download and falls back to host node automatically.
+BUILD_LOG="$SCRATCH/build.log"
+if "$HERE/build-macos-pkg.sh" >"$BUILD_LOG" 2>&1; then
+  PKG="$(tail -1 "$BUILD_LOG")"
+  if [ -f "$PKG" ]; then
+    ok "build-macos-pkg.sh produced a pkg ($(du -h "$PKG" | cut -f1)): $PKG"
+  else
+    nok "build succeeded but pkg path not found" "last line: $PKG"
+    PKG=""
+  fi
+else
+  nok "build-macos-pkg.sh failed" "$(tail -5 "$BUILD_LOG")"
+  PKG=""
+fi
+
+# ─── STEP 2: install home-domain (no sudo) + assert the tree ─────────────────
+diag "STEP 2 — install home-domain (no sudo) + assert tree"
+if [ -n "$PKG" ]; then
+  if installer -pkg "$PKG" -target CurrentUserHomeDirectory >"$SCRATCH/install.log" 2>&1; then
+    ok "installed home-domain with no sudo"
+  else
+    nok "home-domain install failed" "$(tail -5 "$SCRATCH/install.log")"
+  fi
+else
+  nok "skipped install (no pkg)"
+fi
+
+# node + ffmpeg + launcher present and executable
+for b in node ffmpeg trillboards-edge trillboards-pair; do
+  if [ -x "$EDGE_ROOT/bin/$b" ]; then ok "bundled bin/$b is present + executable"; else nok "bundled bin/$b missing or not executable"; fi
+done
+# cli.js present
+if [ -f "$EDGE_ROOT/lib/edge-sdk/dist/cli.js" ]; then ok "bundled cli.js present"; else nok "bundled cli.js missing"; fi
+
+# bundled node runs
+NODE_VER="$("$EDGE_ROOT/bin/node" --version 2>/dev/null || true)"
+if printf '%s' "$NODE_VER" | grep -q '^v'; then ok "bundled node runs ($NODE_VER)"; else nok "bundled node did not run" "$NODE_VER"; fi
+
+# bundled ffmpeg runs
+if "$EDGE_ROOT/bin/ffmpeg" -version >/dev/null 2>&1; then ok "bundled ffmpeg runs"; else nok "bundled ffmpeg did not run"; fi
+
+# the connector runs through the bundled launcher (this also proves the lazy
+# require keeps the cloud-sense entrypoint free of the ONNX stack — the bundle
+# ships NO onnxruntime-node).
+LAUNCH_VER="$("$EDGE_ROOT/bin/trillboards-edge" version 2>&1 || true)"
+if printf '%s' "$LAUNCH_VER" | grep -q 'edge-sdk v'; then ok "trillboards-edge version works via bundled node ($LAUNCH_VER)"; else nok "trillboards-edge version failed" "$LAUNCH_VER"; fi
+
+# explicitly assert the heavy stack is NOT bundled (design contract)
+if [ ! -d "$EDGE_ROOT/lib/node_modules/onnxruntime-node" ]; then ok "ONNX runtime correctly EXCLUDED from the bundle"; else nok "onnxruntime-node was bundled (should be excluded)"; fi
+
+# postinstall created the runtime dirs
+if [ -d "$APP_SUPPORT" ]; then ok "postinstall created Application Support dir"; else nok "Application Support dir not created"; fi
+if [ -d "$LOG_DIR" ]; then ok "postinstall created Logs dir"; else nok "Logs dir not created"; fi
+
+# The native setup application replaces the old .command launcher, so Finder
+# never opens Terminal during customer setup.
+if [ -d "$SETUP_APP" ]; then ok "native setup application installed in ~/Applications"; else nok "native setup application missing" "$SETUP_APP"; fi
+if [ -x "$SETUP_APP_BIN" ]; then ok "native setup application executable is present"; else nok "native setup application executable missing" "$SETUP_APP_BIN"; fi
+if [ ! -e "$LEGACY_PAIR_LAUNCHER" ]; then ok "legacy Terminal .command launcher is absent"; else nok "legacy Terminal launcher still exists" "$LEGACY_PAIR_LAUNCHER"; fi
+
+# ─── STEP 3: start the stub pair+analyze server ──────────────────────────────
+diag "STEP 3 — start local stub pair+analyze server"
+STATS_FILE="$SCRATCH/stub.stats.json"
+# Config values are passed via env (NOT templated into JS) so the source stays
+# inert and robust. The camera rtspUrl points at the synthetic mp4 via file:,
+# so the connector's REAL RTSPCameraProvider → bundled ffmpeg → mjpeg path runs
+# without standing up an actual RTSP server.
+# NOTE: quoted heredoc ('EOF') — no shell expansion inside the JS.
+cat > "$STUB_JS" <<'EOF'
+const http = require('http');
+const fs = require('fs');
+const STATS_FILE = process.env.STATS_FILE;
+const SAMPLE = process.env.SAMPLE_MP4;
+const received = { pair: 0, analyze: 0, lastDeviceToken: null, lastBodyLen: 0, sawJpeg: false };
+const CONFIG = {
+  apiBaseUrl: 'http://127.0.0.1:__PORT__',
+  cloudSensing: { enabled: true, periodicIntervalMs: 1500, faceTriggeredIntervalMs: 1500, jpegQuality: 70 },
+  cameras: [{
+    name: 'Front Door',
+    screenId: 'scr_test_1',
+    deviceToken: 'tok_TEST_123',
+    rtspUrl: SAMPLE.startsWith('/') ? 'file:' + SAMPLE : SAMPLE,
+    width: 320,
+    height: 240,
+  }],
+};
+function flush() { try { fs.writeFileSync(STATS_FILE, JSON.stringify(received)); } catch (e) {} }
+const server = http.createServer((req, res) => {
+  let body = '';
+  req.on('data', (c) => (body += c));
+  req.on('end', () => {
+    if (req.url.endsWith('/v2/earner/cameras/pair')) {
+      received.pair++;
+      const cfg = JSON.parse(JSON.stringify(CONFIG).replace('__PORT__', String(server.address().port)));
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(cfg));
+    } else if (req.url.endsWith('/v2/earner/audience-analyze')) {
+      received.analyze++;
+      received.lastDeviceToken = req.headers['x-device-token'] || null;
+      received.lastBodyLen = body.length;
+      // Body is JSON { imageBase64, ... }; decode + verify the JPEG SOI marker.
+      try {
+        const j = JSON.parse(body);
+        if (j.imageBase64) {
+          const buf = Buffer.from(j.imageBase64, 'base64');
+          received.sawJpeg = buf.length > 2 && buf[0] === 0xff && buf[1] === 0xd8;
+        }
+      } catch (e) {}
+      flush();
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, profileId: 'p_test' }));
+    } else {
+      res.writeHead(404);
+      res.end('nope');
+    }
+  });
+});
+server.listen(0, '127.0.0.1', () => { process.stdout.write('PORT=' + server.address().port + '\n'); flush(); });
+process.on('SIGTERM', () => { flush(); process.exit(0); });
+EOF
+
+STATS_FILE="$STATS_FILE" SAMPLE_MP4="$SAMPLE_MP4" "$EDGE_ROOT/bin/node" "$STUB_JS" >"$STUB_OUT" 2>&1 &
+STUB_PID=$!
+# Wait for the port line (up to ~5s).
+PORT=""
+for _ in $(seq 1 25); do
+  PORT="$(grep -oE 'PORT=[0-9]+' "$STUB_OUT" 2>/dev/null | head -1 | cut -d= -f2)"
+  [ -n "$PORT" ] && break
+  sleep 0.2
+done
+if [ -n "$PORT" ] && kill -0 "$STUB_PID" 2>/dev/null; then
+  ok "stub server listening on 127.0.0.1:$PORT"
+else
+  nok "stub server failed to start" "$(cat "$STUB_OUT" 2>/dev/null)"
+fi
+
+# ─── STEP 4: pair headlessly + assert config ─────────────────────────────────
+diag "STEP 4 — headless pair + assert config (0600, deviceToken, camera)"
+if [ -n "$PORT" ]; then
+  if "$EDGE_ROOT/bin/trillboards-edge" pair --code TEST-CODE --api-base "http://127.0.0.1:$PORT" --config "$TEST_CONFIG" >"$SCRATCH/pair.log" 2>&1; then
+    ok "pair exited 0"
+  else
+    nok "pair exited non-zero" "$(cat "$SCRATCH/pair.log")"
+  fi
+else
+  nok "skipped pair (no stub port)"
+fi
+
+if [ -f "$TEST_CONFIG" ]; then
+  ok "config file written: $TEST_CONFIG"
+  MODE="$(file_mode "$TEST_CONFIG")"
+  if [ "$MODE" = "600" ]; then ok "config is mode 0600"; else nok "config mode is '$MODE' (expected 600)"; fi
+  if grep -q 'tok_TEST_123' "$TEST_CONFIG"; then ok "config carries the paired deviceToken"; else nok "config missing deviceToken"; fi
+  if grep -q 'scr_test_1' "$TEST_CONFIG"; then ok "config carries the paired camera (screenId)"; else nok "config missing camera"; fi
+else
+  nok "config file was not written"
+fi
+
+# ─── STEP 5a: connector starts from the config + senses (foreground, bounded) ─
+diag "STEP 5a — cloud-sense from config: real bundled-ffmpeg JPEG → POST"
+if [ -f "$TEST_CONFIG" ]; then
+  "$EDGE_ROOT/bin/trillboards-edge" cloud-sense --config "$TEST_CONFIG" >"$CS_OUT" 2>&1 &
+  CS_PID=$!
+  # Wait until we see at least one analyze POST (cadence is 1.5s) — up to ~12s.
+  SENSED=0
+  for _ in $(seq 1 40); do
+    if grep -q 'analyze → HTTP 200' "$CS_OUT" 2>/dev/null; then SENSED=1; break; fi
+    if ! kill -0 "$CS_PID" 2>/dev/null; then break; fi  # process died early
+    sleep 0.3
+  done
+  kill "$CS_PID" >/dev/null 2>&1 || true
+  wait "$CS_PID" 2>/dev/null || true
+  CS_PID=""
+
+  if [ "$SENSED" -eq 1 ]; then
+    ok "cloud-sense captured + POSTed a frame (HTTP 200 in connector log)"
+  else
+    nok "cloud-sense did not produce a successful POST" "$(tail -8 "$CS_OUT" 2>/dev/null)"
+  fi
+
+  # Inspect what the stub actually received.
+  if [ -f "$STATS_FILE" ]; then
+    A_COUNT="$("$EDGE_ROOT/bin/node" -e "process.stdout.write(String((require('$STATS_FILE').analyze)||0))" 2>/dev/null || echo 0)"
+    A_TOKEN="$("$EDGE_ROOT/bin/node" -e "process.stdout.write(String((require('$STATS_FILE').lastDeviceToken)||''))" 2>/dev/null || echo '')"
+    A_JPEG="$("$EDGE_ROOT/bin/node" -e "process.stdout.write(String((require('$STATS_FILE').sawJpeg)||false))" 2>/dev/null || echo false)"
+    if [ "${A_COUNT:-0}" -ge 1 ] 2>/dev/null; then ok "stub received $A_COUNT analyze POST(s)"; else nok "stub received no analyze POSTs"; fi
+    if [ "$A_TOKEN" = "tok_TEST_123" ]; then ok "analyze POST carried X-Device-Token from pairing"; else nok "analyze POST missing/incorrect X-Device-Token" "got: '$A_TOKEN'"; fi
+    if [ "$A_JPEG" = "true" ]; then ok "analyze POST body was a real JPEG (SOI 0xFFD8) from the bundled ffmpeg"; else nok "analyze POST body was not a valid JPEG"; fi
+  else
+    nok "stub stats file missing — cannot verify POST contents"
+  fi
+else
+  nok "skipped cloud-sense (no config)"
+fi
+
+# ─── STEP 5b: LaunchAgent bootstrap + autonomous sensing ─────────────────────
+diag "STEP 5b — pair via trillboards-pair (GUI helper, headless mode) bootstraps the LaunchAgent"
+if [ -n "$PORT" ]; then
+  if "$EDGE_ROOT/bin/trillboards-pair" TEST-CODE --api-base "http://127.0.0.1:$PORT" >"$SCRATCH/pairgui.log" 2>&1; then
+    ok "trillboards-pair (headless) exited 0"
+  else
+    nok "trillboards-pair (headless) failed" "$(cat "$SCRATCH/pairgui.log")"
+  fi
+
+  # The agent should now be loaded; give it a moment.
+  if launchctl print "gui/$UID_N/$LABEL" >/dev/null 2>&1; then
+    ok "LaunchAgent is bootstrapped (launchctl print sees it)"
+  else
+    nok "LaunchAgent not found after pair"
+  fi
+
+  # Wait for the agent's own log to show a successful POST (autonomous run).
+  AGENT_SENSED=0
+  for _ in $(seq 1 40); do
+    if grep -q 'analyze → HTTP 200' "$LOG_DIR/edge.out.log" 2>/dev/null; then AGENT_SENSED=1; break; fi
+    sleep 0.3
+  done
+  if [ "$AGENT_SENSED" -eq 1 ]; then
+    ok "LaunchAgent autonomously captured + POSTed a frame (edge.out.log)"
+  else
+    nok "LaunchAgent did not sense within timeout" "$(tail -6 "$LOG_DIR/edge.out.log" 2>/dev/null; echo '--- err ---'; tail -4 "$LOG_DIR/edge.err.log" 2>/dev/null)"
+  fi
+
+  # The installed config must be 0600 too.
+  if [ -f "$INSTALLED_CONFIG" ]; then
+    IMODE="$(file_mode "$INSTALLED_CONFIG")"
+    if [ "$IMODE" = "600" ]; then ok "installed config is mode 0600"; else nok "installed config mode is '$IMODE' (expected 600)"; fi
+  else
+    nok "installed config not written by pair helper"
+  fi
+else
+  nok "skipped LaunchAgent test (no stub port)"
+fi
+
+# ─── STEP 5c: prove the installed UI payload has the no-Terminal contract ─────
+diag "STEP 5c — native setup application payload"
+if plutil -lint "$SETUP_APP/Contents/Info.plist" >/dev/null 2>&1; then
+  ok "native setup application Info.plist is valid"
+else
+  nok "native setup application Info.plist is invalid or missing"
+fi
+if file "$SETUP_APP_BIN" 2>/dev/null | grep -q 'Mach-O'; then
+  ok "native setup application executable is Mach-O"
+else
+  nok "native setup application executable is not Mach-O"
+fi
+
+# ─── STEP 6: teardown happens in the EXIT trap ───────────────────────────────
+diag "STEP 6 — teardown runs automatically on exit (idempotent)"
+
+# ─── Summary ─────────────────────────────────────────────────────────────────
+echo "1..$TAP_N"
+echo ""
+if [ "$FAILS" -eq 0 ]; then
+  printf '\033[1;32mPASS\033[0m — all %d checks passed.\n' "$TAP_N"
+else
+  printf '\033[1;31mFAIL\033[0m — %d of %d checks failed.\n' "$FAILS" "$TAP_N"
+fi
+echo "Re-run: bash $PKG_ROOT/deploy/macos/test-install-pair.sh"
+
+# Explicit exit so the EXIT-trap teardown (which runs AFTER this and would
+# otherwise clobber $?) does not mask a failure.
+if [ "$FAILS" -eq 0 ]; then exit 0; else exit 1; fi

package/deploy/macos/test-setup-litertlm-reinstall.sh

@@ -0,0 +1,109 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SETUP="$SCRIPT_DIR/scripts/setup-litertlm.sh"
+TEST_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/trillboards-litertlm-reinstall.XXXXXX")"
+trap 'rm -rf "$TEST_ROOT"' EXIT
+
+export HOME="$TEST_ROOT/home"
+export TRILLBOARDS_TEST_STATE_DIR="$TEST_ROOT/state"
+export LITERT_LM_DIR="$TEST_ROOT/store"
+export TRILLBOARDS_REQUIRE_BUNDLED_MODEL=1
+FAKE_BIN="$HOME/.local/bin"
+SHARE_DIR="$HOME/Library/Trillboards/edge/share"
+mkdir -p "$FAKE_BIN" "$SHARE_DIR" "$TRILLBOARDS_TEST_STATE_DIR"
+
+cat >"$FAKE_BIN/uname" <<'EOF'
+#!/bin/bash
+case "${1:-}" in
+  -s) printf 'Darwin\n' ;;
+  -m) printf 'arm64\n' ;;
+  *) printf 'Darwin\n' ;;
+esac
+EOF
+
+cat >"$FAKE_BIN/uv" <<'EOF'
+#!/bin/bash
+exit 0
+EOF
+
+cat >"$FAKE_BIN/litert-lm" <<'EOF'
+#!/bin/bash
+if [ "${1:-}" = "list" ]; then
+  printf 'gemma-4-E2B-it.litertlm\n'
+fi
+exit 0
+EOF
+
+cat >"$FAKE_BIN/curl" <<'EOF'
+#!/bin/bash
+printf '{"data":[{"id":"gemma-4-E2B-it.litertlm"}]}\n'
+EOF
+
+cat >"$FAKE_BIN/sleep" <<'EOF'
+#!/bin/bash
+exit 0
+EOF
+
+cat >"$FAKE_BIN/launchctl" <<'EOF'
+#!/bin/bash
+set -u
+STATE_DIR="${TRILLBOARDS_TEST_STATE_DIR:?}"
+STATE_FILE="$STATE_DIR/service-state"
+ATTEMPTS_FILE="$STATE_DIR/bootstrap-attempts"
+
+case "${1:-}" in
+  bootout)
+    printf '3\n' >"$STATE_FILE"
+    exit 0
+    ;;
+  print)
+    [ -f "$STATE_FILE" ] || exit 113
+    state="$(cat "$STATE_FILE")"
+    if [ "$state" = "loaded" ]; then
+      exit 0
+    fi
+    if [ "$state" -gt 1 ]; then
+      printf '%s\n' "$((state - 1))" >"$STATE_FILE"
+      exit 0
+    fi
+    rm -f "$STATE_FILE"
+    exit 113
+    ;;
+  bootstrap)
+    attempts=0
+    [ ! -f "$ATTEMPTS_FILE" ] || attempts="$(cat "$ATTEMPTS_FILE")"
+    attempts=$((attempts + 1))
+    printf '%s\n' "$attempts" >"$ATTEMPTS_FILE"
+    if [ "$attempts" -eq 1 ]; then
+      printf 'Bootstrap failed: 37: Operation already in progress\n' >&2
+      exit 37
+    fi
+    printf 'loaded\n' >"$STATE_FILE"
+    exit 0
+    ;;
+esac
+
+exit 0
+EOF
+
+chmod +x "$FAKE_BIN/uname" "$FAKE_BIN/uv" "$FAKE_BIN/litert-lm" \
+  "$FAKE_BIN/curl" "$FAKE_BIN/sleep" "$FAKE_BIN/launchctl"
+
+cat >"$SHARE_DIR/com.trillboards.litertlm.plist" <<'EOF'
+<plist><string>__LITERTLM__</string><string>__PORT__</string><string>__LOG_DIR__</string></plist>
+EOF
+printf 'loaded\n' >"$TRILLBOARDS_TEST_STATE_DIR/service-state"
+
+export PATH="$FAKE_BIN:/usr/bin:/bin:/usr/sbin:/sbin"
+if ! OUTPUT="$(/bin/bash "$SETUP" 2>&1)"; then
+  printf '%s\n' "$OUTPUT" >&2
+  exit 1
+fi
+
+[ "$(cat "$TRILLBOARDS_TEST_STATE_DIR/bootstrap-attempts")" = "2" ]
+grep -Fq 'Bootstrap failed: 37: Operation already in progress' \
+  "$HOME/Library/Logs/Trillboards/litertlm-setup.log"
+grep -Fq 'local AI is installed and healthy' <<<"$OUTPUT"
+printf 'macOS LiteRT-LM reinstall race regression passed\n'

package/deploy/systemd/install.sh

@@ -27,28 +27,38 @@ fi
 echo "Creating trillboards user and directories..."
 sudo useradd --system --home-dir /opt/trillboards --shell /usr/sbin/nologin trillboards 2>/dev/null || true
 sudo mkdir -p /opt/trillboards /var/lib/trillboards /etc/trillboards
-sudo chown -R trillboards:trillboards /opt/trillboards /var/lib/trillboards
+# /etc/trillboards MUST be trillboards-owned too: pairing runs as the trillboards
+# user and writes /etc/trillboards/config.json directly — without this chown the
+# write fails with EACCES on a fresh install before the service ever has a config
+# (Codex P1 on #7730).
+sudo chown -R trillboards:trillboards /opt/trillboards /var/lib/trillboards /etc/trillboards
 
 # Install SDK
 echo "Installing @trillboards/edge-sdk..."
 cd /opt/trillboards
 sudo -u trillboards npm init -y --silent 2>/dev/null
-sudo -u trillboards npm install @trillboards/edge-sdk @trillboards/edge-platform-linux
+sudo -u trillboards npm install @trillboards/edge-sdk @trillboards/edge-platform-linux @trillboards/edge-platform-rtsp
 
-# Download models
-echo "Downloading ONNX models..."
-sudo -u trillboards mkdir -p /opt/trillboards/models
-sudo -u trillboards npx trillboards-edge download-models --dir /opt/trillboards/models
+# cloud-sense uses the cloud VLM for inference — NO local ONNX models to download.
 
-# Install config template
+# Pair with a claim code from the portal (Add a camera -> Install). Pairing writes
+# /etc/trillboards/config.json (device token + feeds) — the token is delivered at
+# pair, NEVER baked. Accept the code as $1 for headless installs, else prompt.
+CLAIM_CODE="${1:-}"
 if [ ! -f /etc/trillboards/config.json ]; then
-  echo "Installing config template..."
-  sudo cp node_modules/@trillboards/edge-sdk/configs/generic-linux.json /etc/trillboards/config.json
-  sudo chown trillboards:trillboards /etc/trillboards/config.json
-  echo ""
-  echo "  *** IMPORTANT: Edit /etc/trillboards/config.json ***"
-  echo "  Set your deviceToken and screenId from the Trillboards dashboard."
-  echo ""
+  if [ -z "$CLAIM_CODE" ]; then
+    read -rp "Enter your Trillboards pairing code (from the portal): " CLAIM_CODE || true
+  fi
+  if [ -n "$CLAIM_CODE" ]; then
+    echo "Pairing with the cloud..."
+    sudo -u trillboards npx trillboards-edge pair --code "$CLAIM_CODE" --config /etc/trillboards/config.json
+    sudo chown trillboards:trillboards /etc/trillboards/config.json
+  else
+    echo ""
+    echo "  *** No code entered — pair before starting the service: ***"
+    echo "  sudo -u trillboards npx trillboards-edge pair --code <CODE> --config /etc/trillboards/config.json"
+    echo ""
+  fi
 fi
 
 # Install systemd service
@@ -61,7 +71,7 @@ echo ""
 echo "=== Installation Complete ==="
 echo ""
 echo "Next steps:"
-echo "  1. Edit /etc/trillboards/config.json with your device token"
+echo "  1. (If not paired above) sudo -u trillboards npx trillboards-edge pair --code <CODE> --config /etc/trillboards/config.json"
 echo "  2. Start: sudo systemctl start trillboards-edge"
 echo "  3. Logs:  sudo journalctl -u trillboards-edge -f"
 echo "  4. Status: sudo systemctl status trillboards-edge"

package/deploy/systemd/trillboards-edge.service

@@ -10,7 +10,10 @@ User=trillboards
 Group=trillboards
 WorkingDirectory=/opt/trillboards
 ExecStartPre=/usr/bin/node -e "require('@trillboards/edge-sdk')"
-ExecStart=/usr/bin/npx trillboards-edge start --config /etc/trillboards/config.json
+# This legacy Linux installer explicitly selects cloud-sense and does not install
+# LiteRT-LM. Customer macOS/Windows installers use the local-first auto-sense
+# policy. The paired config is written by install.sh; the token is never baked.
+ExecStart=/usr/bin/npx trillboards-edge cloud-sense --config /etc/trillboards/config.json
 Restart=always
 RestartSec=10
 StartLimitInterval=300

package/deploy/windows/README.md

@@ -0,0 +1,70 @@
+# Trillboards Edge — Windows local-first CCTV connector
+
+Self-contained, **no-admin** Windows installer for the BYO-CCTV connector. The
+Windows analogue of `deploy/macos/` — same `cli pair` + `auto-sense` flow, same
+claim-code pairing, same CDN.
+
+## What the installer lays down
+
+`%LOCALAPPDATA%\Trillboards\edge\` (per-user, no UAC):
+
+```
+bin\node.exe                 official Node x64 runtime (pinned v22.22.0)
+bin\ffmpeg.exe               pinned static ffmpeg (eugeneware/ffmpeg-static b6.0,
+                             SHA-256 verified — same upstream as macOS)
+bin\trillboards-edge.cmd     launcher (PATH=bin first; node lib\...\cli.js)
+bin\trillboards-setup.vbs    no-console launcher for the customer setup app
+bin\trillboards-setup.ps1    native Windows Forms customer setup window
+bin\trillboards-pair.cmd     hidden setup engine used by the setup window
+bin\register-task.ps1        registers the logon Scheduled Task
+lib\edge-sdk\dist\cli.js     the connector CLI
+lib\node_modules\...         runtime subset (NO onnxruntime/sharp/sqlite; LiteRT-LM
+                             provides the on-device VLM outside Node)
+trillboards.config.json      written by `pair` (device token delivered ONLY here)
+```
+
+RTSP capture is via the bundled ffmpeg (cross-platform), so a single x64 build
+serves every Windows 10/11 — no per-arch builds.
+
+## Operator flow (the "no typing" path)
+
+1. Portal → "Add a camera" → download the single **Windows (.exe)** containing
+   the connector and private local AI model.
+2. Run it. Production installers are Authenticode-signed with Azure Trusted
+   Signing and the release workflow verifies the signature before publishing.
+3. Installer copies the connector, installs and verifies the included local AI,
+   registers the logon tasks, then opens **Trillboards CCTV Setup** without a
+   command window.
+4. Select **Start setup**. The app opens the Trillboards camera wizard, discovers
+   local recorders, and validates each channel. Black, disconnected, and
+   unreadable inputs are ignored; only working camera feeds become screens.
+5. Sensing starts with the already-installed local AI and restarts on every
+   logon; cloud inference is off by default.
+
+## Build (CI: `release-connector-windows.yml`, runs on `windows-latest`)
+
+```powershell
+# bundles node + ffmpeg + edge-sdk, then compiles the inner NSIS .exe
+./build-windows.ps1                 # -> dist-installer\inner\TrillboardsEdgeSetup-core-<ver>-x64.exe
+./build-windows.ps1 -SkipNsis       # stage the tree only (no NSIS) — for checks
+./build-windows.ps1 -Offline        # copy host node/ffmpeg (air-gapped)
+
+# after the inner installer is signed, create the one-file customer artifact
+./bundle-windows-installer.ps1 -InnerInstaller <signed-inner.exe>
+```
+
+Requires NSIS and 7-Zip on PATH (`choco install nsis 7zip -y`). The release workflow publishes
+the `.exe` to `s3://trillboards-screen-static/connector/trillboards-connector-windows.exe`
+and invalidates the `screen.trillboards.com` CloudFront distribution, so the
+portal's stable download URL never changes.
+
+## Notes
+
+- Production `.exe` artifacts are signed with Azure Trusted Signing and checked
+  with `Get-AuthenticodeSignature` before CDN publication.
+- The one-file wrapper uses the official 7-Zip SFX installer module from the
+  LZMA SDK. 7-Zip is licensed under the GNU LGPL; source and license information
+  are available at https://www.7-zip.org/.
+- The legacy `install-service.ps1` (local-inference: requires system Node + npm
+  install + ONNX models + a hand-edited deviceToken) is a different, older path.
+  This local-first installer supersedes it for BYO-CCTV onboarding.