local-operator-ui 0.19.0 → 0.19.2

package/out/main/index.js

@@ -1323,6 +1323,19 @@ function trustedDesktopFrame(actual, expected) {
     return false;
   }
 }
+const PYTHON_BYTECODE_CACHE_DIR_NAME = "python-bytecode-cache";
+const PATH_SEPARATORS = /[\\/]/;
+function insideAppBundle(path2) {
+  return path2.split(PATH_SEPARATORS).some((segment) => segment.length > 4 && segment.endsWith(".app"));
+}
+function pythonBytecodeCacheDir(userDataDir) {
+  return path.join(userDataDir, PYTHON_BYTECODE_CACHE_DIR_NAME);
+}
+function withPythonBytecodeCache(env, userDataDir) {
+  const existing = env.PYTHONPYCACHEPREFIX?.trim();
+  if (existing && !insideAppBundle(existing)) return { ...env };
+  return { ...env, PYTHONPYCACHEPREFIX: pythonBytecodeCacheDir(userDataDir) };
+}
 var main = { exports: {} };
 const version = "16.5.0";
 const require$$4 = {
@@ -1989,6 +2002,7 @@ class BackendServiceManager {
         `Shell environment variables loaded successfully. PATH: ${this.shellEnv.PATH || this.shellEnv.Path || "(not set)"}`,
         LogFileType.BACKEND
       );
+      this.shellEnv = withPythonBytecodeCache(this.shellEnv, this.appDataPath);
     } catch (error) {
       logger.error(
         "Error loading shell environment variables:",
@@ -1997,6 +2011,34 @@ class BackendServiceManager {
       );
     }
   }
+  /**
+   * The environment the backend process is spawned with.
+   *
+   * The prefix is applied HERE, at the point the environment is handed to the
+   * spawn, rather than only inside `loadShellEnvironment()`. That load is
+   * started from the constructor without `await` (a constructor cannot wait)
+   * and `start()` has nothing sequencing it, so a shell rc that takes seconds
+   * to source - nvm, pyenv, conda init all do - leaves `shellEnv` at its
+   * `{ ...process.env }` seed when the first spawn happens: no prefix, and the
+   * exact pre-fix configuration, on the machines whose rc is slowest. Applying
+   * it here makes the guarantee structural instead of ordering-dependent, so
+   * no spawn path can miss it.
+   *
+   * These spawns are the ones whose `python` is the interpreter we ship:
+   * CPython writes `__pycache__/*.pyc` beside the sources it imports, those
+   * sources are inside the code-sealed `.app`, and every such write breaks the
+   * signature ShipIt validates before an in-place update.
+   */
+  backendSpawnEnv() {
+    return {
+      ...withPythonBytecodeCache(this.shellEnv, this.appDataPath),
+      // Managed starts rotate the token; set after the spread so the spawn
+      // can never inherit a stale one from the shell environment. `start()`
+      // mints it before it can reach a spawn site, so the `??` only satisfies
+      // the field's nullable seed from `process.env`.
+      LOCAL_OPERATOR_DESKTOP_TOKEN: this.desktopToken ?? void 0
+    };
+  }
   /**
    * Load environment variables from macOS shell configuration files
    */
@@ -2315,10 +2357,7 @@ class BackendServiceManager {
           detached: false,
           // Ensure process is not detached from parent
           stdio: "pipe",
-          env: {
-            ...this.shellEnv,
-            LOCAL_OPERATOR_DESKTOP_TOKEN: this.desktopToken
-          },
+          env: this.backendSpawnEnv(),
           // On Windows, we need to create a new process group to ensure proper termination
           ...process.platform === "win32" ? { windowsHide: true } : {}
         });
@@ -2381,10 +2420,7 @@ class BackendServiceManager {
           detached: false,
           // Ensure process is not detached from parent
           stdio: "pipe",
-          env: {
-            ...this.shellEnv,
-            LOCAL_OPERATOR_DESKTOP_TOKEN: this.desktopToken
-          },
+          env: this.backendSpawnEnv(),
           // On Windows, we need to create a new process group to ensure proper termination
           ...process.platform === "win32" ? { windowsHide: true } : {}
         });
@@ -2818,7 +2854,7 @@ class BackendServiceManager {
     return success;
   }
 }
-const linuxInstallScriptRaw = '#!/bin/bash\n# Local Operator Backend Installation Script for Linux\n# This script sets up a virtual environment for the Local Operator backend\n# without requiring sudo or admin privileges.\n\n# Exit on error, undefined variables, and failed pipe commands\nset -e  # Exit immediately if a command exits with a non-zero status\nset -u  # Error on unset variables\nset -o pipefail  # Fail if any command in a pipe fails\n\n# Configuration\n# Variables APP_NAME and MIN_PYTHON_VERSION removed as they were unused\nVENV_NAME="local-operator-venv"\nAPP_DATA_DIR="${HOME}/.config/local-operator"\nVENV_PATH="${APP_DATA_DIR}/${VENV_NAME}"\nLOG_FILE="${APP_DATA_DIR}/backend-install.log"\nTIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")\n\n# Create app data directory if it doesn\'t exist\nif ! mkdir -p "${APP_DATA_DIR}"; then\n  echo "ERROR: Unable to create app data directory at ${APP_DATA_DIR}"\n  echo "Please check permissions and try again."\n  exit 1\nfi\n\n# Handle cleanup on script exit\ncleanup() {\n  # Remove any temporary files created during execution\n  if [ -f "${APP_DATA_DIR}/get-pip.py" ]; then\n    rm -f "${APP_DATA_DIR}/get-pip.py"\n  fi\n  if [ -n "${FFMPEG_TEMP_ARCHIVE:-}" ] && [ -f "${FFMPEG_TEMP_ARCHIVE}" ]; then\n    log "Removing temporary FFmpeg archive: ${FFMPEG_TEMP_ARCHIVE}"\n    rm -f "${FFMPEG_TEMP_ARCHIVE}"\n  fi\n  echo "$(date): Cleanup completed."\n}\n\n# Set trap only for manual interruption (SIGINT, SIGTERM), not normal exits\ntrap cleanup SIGINT SIGTERM\n\n\n# Start logging\nexec > >(tee -a "${LOG_FILE}") 2>&1\necho "[${TIMESTAMP}]: Starting Local Operator backend installation..."\necho "[${TIMESTAMP}]: System information: $(uname -a)"\n\n# Function to log messages with timestamp (defined later, but used by FFmpeg section)\n_log_internal() {\n  local internal_timestamp\n  internal_timestamp=$(date +"%Y-%m-%d %H:%M:%S")\n  echo "[${internal_timestamp}] $1"\n}\n\n# --- FFmpeg Installation ---\nBIN_DIR="${APP_DATA_DIR}/bin"\nFFMPEG_BIN="${BIN_DIR}/ffmpeg" # Path to ffmpeg binary\n\n_log_internal "Ensuring bin directory exists: ${BIN_DIR}"\nif ! mkdir -p "${BIN_DIR}"; then\n    _log_internal "ERROR: Unable to create bin directory at ${BIN_DIR}"\n    exit 1\nfi\n\n# Check if FFmpeg is already installed and executable\nif [ -f "${FFMPEG_BIN}" ] && [ -x "${FFMPEG_BIN}" ]; then\n    _log_internal "FFmpeg already installed at ${FFMPEG_BIN}. Skipping download."\nelse\n    _log_internal "FFmpeg not found or not executable. Attempting to download and install FFmpeg..."\n\n    FFMPEG_DOWNLOAD_URL=""\n\n    LINUX_ARCH=$(uname -m)\n    if [[ "${LINUX_ARCH}" == "x86_64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-linux-x64"\n    elif [[ "${LINUX_ARCH}" == "aarch64" ]] || [[ "${LINUX_ARCH}" == "arm64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-linux-arm64"\n    else\n        _log_internal "Error: Unsupported CPU architecture for FFmpeg download: ${LINUX_ARCH}"\n        exit 1\n    fi\n\n    _log_internal "Downloading FFmpeg from: ${FFMPEG_DOWNLOAD_URL}"\n    if command -v curl >/dev/null 2>&1; then\n        if ! curl -L "${FFMPEG_DOWNLOAD_URL}" -o "${FFMPEG_BIN}"; then\n            _log_internal "Error: Failed to download FFmpeg using curl from ${FFMPEG_DOWNLOAD_URL}"\n            exit 1\n        fi\n    elif command -v wget >/dev/null 2>&1; then\n        if ! wget -O "${FFMPEG_BIN}" "${FFMPEG_DOWNLOAD_URL}"; then\n            _log_internal "Error: Failed to download FFmpeg using wget from ${FFMPEG_DOWNLOAD_URL}"\n            exit 1\n        fi\n    else\n        _log_internal "Error: Neither curl nor wget found. Cannot download FFmpeg."\n        exit 1\n    fi\n    _log_internal "FFmpeg binary downloaded successfully to ${FFMPEG_BIN}"\n\n    chmod +x "${FFMPEG_BIN}"\n    _log_internal "Set executable permissions for ${FFMPEG_BIN}"\n\n    # Verify FFmpeg is executable after download\n    if [ ! -f "${FFMPEG_BIN}" ] || [ ! -x "${FFMPEG_BIN}" ]; then\n        _log_internal "Error: FFmpeg binary not found or not executable after download."\n        exit 1\n    fi\nfi\n\n_log_internal "FFmpeg installation complete. FFmpeg binary is at: ${FFMPEG_BIN}"\n\n# Function to check if a command exists\ncommand_exists() {\n  command -v "$1" >/dev/null 2>&1\n}\n\n# Function to log messages with timestamp\nlog() {\n  local timestamp\n  timestamp=$(date +"%Y-%m-%d %H:%M:%S")\n  echo "[${timestamp}] $1"\n}\n\n# Function to display error messages and exit\nerror_exit() {\n  log "ERROR: $1" >&2\n  exit "${2:-1}"\n}\n\n# Function to check if Python binary is valid for current architecture\nis_valid_python_binary() {\n  local python_path="$1"\n  \n  # First check if file exists and is executable\n  if [ ! -f "${python_path}" ] || [ ! -x "${python_path}" ]; then\n    return 1\n  fi\n  \n  # Try to run a simple Python command to verify it works on current architecture\n  "${python_path}" -c "print(\'Testing Python executable\')" >/dev/null 2>&1\n  return $?\n}\n\n# Check for network connectivity to key servers\ncheck_connectivity() {\n  log "Checking network connectivity..."\n  local servers=("pypi.org" "bootstrap.pypa.io")\n  local has_connectivity=false\n  \n  for server in "${servers[@]}"; do\n    if command_exists curl; then\n      if curl --connect-timeout 5 -s "https://${server}" -o /dev/null; then\n        has_connectivity=true\n        break\n      fi\n    elif command_exists wget; then\n      if wget --timeout=5 -q --spider "https://${server}"; then\n        has_connectivity=true\n        break\n      fi\n    fi\n  done\n  \n  if [ "$has_connectivity" = false ]; then\n    log "WARNING: Network connectivity issues detected. This may affect installation."\n  else\n    log "Network connectivity confirmed."\n  fi\n}\n\n# Call connectivity check\ncheck_connectivity\n\n# Check if PYTHON_BIN is already set by the installer\nif [ -n "${PYTHON_BIN:-}" ]; then\n  log "Using Python executable provided by installer: ${PYTHON_BIN}"\n  # Verify the provided Python binary works on this architecture\n  if ! is_valid_python_binary "${PYTHON_BIN}"; then\n    log "Warning: The provided Python binary is not compatible with this system architecture."\n    log "Will attempt to find a system Python installation instead."\n    PYTHON_BIN=""\n  fi\nfi\n\n# If PYTHON_BIN is empty or invalid, try to find a suitable Python installation\nif [ -z "${PYTHON_BIN:-}" ] || ! is_valid_python_binary "${PYTHON_BIN:-}"; then\n  # Try to find a suitable Python installation\n  log "Looking for a suitable Python installation..."\n  \n  # Try multiple possible locations to find Python\n  POSSIBLE_PYTHON_PATHS=(\n    # System paths first (more likely to be compatible with current architecture)\n    "/usr/local/bin/python3.12"\n    "/usr/bin/python3.12"\n    "/usr/local/bin/python3"\n    "/usr/bin/python3"\n    # From environment variable (set by the installer)\n    "${ELECTRON_RESOURCE_PATH:-}/python/bin/python3"\n    # Development paths\n    "$(dirname "$0")/../../../resources/python/bin/python3"\n    "$(pwd)/resources/python/bin/python3"\n  )\n\n  # Find the first Python that exists and is version 3.12+ and works on this architecture\n  PYTHON_BIN=""\n  for path in "${POSSIBLE_PYTHON_PATHS[@]}"; do\n    # Skip empty paths that might come from unset environment variables\n    if [ -z "${path}" ]; then\n      continue\n    fi\n    \n    if is_valid_python_binary "${path}"; then\n      # Check Python version\n      if PY_VERSION=$("${path}" -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')" 2>/dev/null); then\n        MAJOR=$(echo "${PY_VERSION}" | cut -d. -f1)\n        MINOR=$(echo "${PY_VERSION}" | cut -d. -f2)\n        if [ "${MAJOR}" -eq 3 ] && [ "${MINOR}" -ge 12 ]; then\n          PYTHON_BIN="${path}"\n          log "Found suitable Python ${PY_VERSION} at ${path}"\n          break\n        else\n          log "Python at ${path} is version ${PY_VERSION}, which is below the required 3.12+"\n        fi\n      fi\n    else\n      if [ -f "${path}" ]; then\n        log "Python at ${path} exists but is not compatible with this system architecture"\n      fi\n    fi\n  done\n\n  # If we couldn\'t find a suitable Python, exit with error\n  if [ -z "${PYTHON_BIN:-}" ]; then\n    error_exit "No suitable Python installation found (version 3.12 or higher required).\\nPlease install Python 3.12 or higher before running this script.\\nYou can install Python from https://www.python.org/downloads/"\n  fi\nfi\n\necho "Using Python: $PYTHON_BIN"\n"$PYTHON_BIN" --version || {\n  echo "Error: Failed to run Python. Please ensure it is executable and accessible."\n  echo "System architecture: $(uname -m)"\n  echo "Python binary architecture: $(file "$PYTHON_BIN" 2>/dev/null || echo \'Unable to determine\')"\n  exit 1\n}\n\n# Detect the Linux distribution to provide specific instructions\nif command_exists lsb_release; then\n  DISTRO=$(lsb_release -is)\n  DISTRO_VERSION=$(lsb_release -rs)\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelif [ -f /etc/os-release ]; then\n  DISTRO=$(grep -oP \'(?<=^ID=).+\' /etc/os-release | tr -d \'"\')\n  DISTRO_VERSION=$(grep -oP \'(?<=^VERSION_ID=).+\' /etc/os-release | tr -d \'"\')\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelse\n  DISTRO="unknown"\n  echo "Unable to detect Linux distribution"\nfi\n\n# Check if Python has venv module and ensurepip available\nlog "Checking for venv module and ensurepip availability..."\nVENV_AVAILABLE=0\nENSUREPIP_AVAILABLE=0\n\n"${PYTHON_BIN}" -c "import venv" > /dev/null 2>&1 || VENV_AVAILABLE=1\n"${PYTHON_BIN}" -c "import ensurepip" > /dev/null 2>&1 || ENSUREPIP_AVAILABLE=1\n\n# If venv is still not available, try to use virtualenv as a fallback\nif [ $VENV_AVAILABLE -ne 0 ]; then\n  echo "venv module is not available. Checking for virtualenv as an alternative..."\n  \n  # Check if virtualenv is already installed\n  if "$PYTHON_BIN" -c "import virtualenv" > /dev/null 2>&1; then\n    echo "virtualenv is available, will use it instead of venv"\n  else\n    echo "ERROR: Neither venv nor virtualenv is available."\n    echo "Python 3.12 and venv should be installed as package dependencies."\n    echo "Please ensure Python 3.12 and venv are properly installed on your system."\n    exit 1\n  fi\nfi\n\n# Create virtual environment if it doesn\'t exist\nif [ ! -d "$VENV_PATH" ]; then\n  echo "Creating virtual environment at $VENV_PATH..."\n  # Remove any potentially corrupted virtual environment\n  if [ -e "$VENV_PATH" ]; then\n    echo "Removing existing but potentially corrupted venv directory..."\n    rm -rf "$VENV_PATH"\n  fi\n  \n  # Make sure parent directory exists and is writable\n  mkdir -p "$(dirname "$VENV_PATH")"\n  \n  # Try different methods to create a virtual environment\n  VENV_CREATE_STATUS=1\n  \n  # First try with venv if available\n  if [ $VENV_AVAILABLE -eq 0 ] && [ $ENSUREPIP_AVAILABLE -eq 0 ]; then\n    echo "Creating virtual environment using venv module..."\n    "$PYTHON_BIN" -m venv "$VENV_PATH"\n    VENV_CREATE_STATUS=$?\n  fi\n  \n  # If venv failed, try virtualenv\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    echo "venv creation failed with status $VENV_CREATE_STATUS. Falling back to virtualenv..."\n    if command_exists virtualenv; then\n      virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    elif "$PYTHON_BIN" -m pip list | grep -q virtualenv; then\n      "$PYTHON_BIN" -m virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    else\n      echo "ERROR: Both venv and virtualenv are unavailable or failed."\n      echo "Python 3.12 and venv should be installed as package dependencies."\n      echo "Please ensure Python 3.12 and venv are properly installed on your system."\n      echo "You can install Python 3.12 from https://www.python.org/downloads/"\n      exit 1\n    fi\n  fi\n  \n  # Check if virtual environment creation was successful\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    log "ERROR: Failed to create virtual environment. Exit code: $VENV_CREATE_STATUS"\n    log "Virtual environment path: $VENV_PATH"\n    log "Python binary used: $PYTHON_BIN"\n    ls -la "$(dirname "$VENV_PATH")" || true\n    log "Python executable permissions:"\n    ls -la "$PYTHON_BIN" || true\n    \n    # Check for common issues\n    log "Checking for common virtual environment creation issues..."\n    \n    # Check disk space\n    df -h "$(dirname "$VENV_PATH")" || true\n    \n    # Check if directory is writable\n    if [ ! -w "$(dirname "$VENV_PATH")" ]; then\n      log "ERROR: Directory $(dirname "$VENV_PATH") is not writable"\n    fi\n    \n    # Try to create a minimal virtual environment manually as a last resort\n    log "Attempting to create a minimal virtual environment manually..."\n    mkdir -p "$VENV_PATH/bin" || error_exit "Could not create directory $VENV_PATH/bin"\n    echo "#!/bin/bash" > "$VENV_PATH/bin/activate"\n    echo "export VIRTUAL_ENV=\\"$VENV_PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "export PATH=\\"$VENV_PATH/bin:\\$PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "unset PYTHONHOME" >> "$VENV_PATH/bin/activate"\n    chmod +x "$VENV_PATH/bin/activate" || error_exit "Could not set execute permissions on activate script"\n    \n    # Create symlinks to the system Python\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python" || log "WARNING: Failed to create symlink for python"\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python3" || log "WARNING: Failed to create symlink for python3"\n    \n    # Try to bootstrap pip\n    log "Bootstrapping pip in the minimal virtual environment..."\n    if command_exists curl; then\n      curl -s https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py" || log "WARNING: Failed to download get-pip.py"\n    elif command_exists wget; then\n      wget -q -O "$APP_DATA_DIR/get-pip.py" https://bootstrap.pypa.io/get-pip.py || log "WARNING: Failed to download get-pip.py"\n    else\n      log "ERROR: Neither curl nor wget available to download get-pip.py"\n      error_exit "Installation cannot continue without being able to download pip"\n    fi\n    \n    # shellcheck disable=SC1090\n    source "$VENV_PATH/bin/activate" && python "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n    \n    if [ ! -f "$VENV_PATH/bin/pip" ]; then\n      error_exit "Failed to create even a minimal virtual environment."\n    else\n      log "Created a minimal virtual environment as a fallback."\n    fi\n  else\n    log "Successfully created virtual environment"\n  fi\nfi\n\n# Verify the virtual environment structure\necho "Verifying virtual environment structure..."\nif [ ! -f "$VENV_PATH/bin/python" ]; then\n  echo "Python executable missing in virtual environment, creating symlink..."\n  ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python"\nfi\n\nif [ ! -f "$VENV_PATH/bin/pip" ]; then\n  echo "pip missing in virtual environment, attempting to bootstrap it..."\n  curl -s https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py"\n  "$VENV_PATH/bin/python" "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n  \n  if [ ! -f "$VENV_PATH/bin/pip" ]; then\n    echo "ERROR: Failed to bootstrap pip in the virtual environment"\n    exit 1\n  fi\nfi\n\necho "Virtual environment structure verified"\n\n# Activate virtual environment and install local-operator\necho "Installing local-operator in virtual environment..."\nsource "$VENV_PATH/bin/activate"\n\necho "Upgrading pip..."\npython -m pip install --upgrade pip || {\n  echo "WARNING: Failed to upgrade pip. Will try to continue with existing pip version."\n  pip --version\n}\n\n# Check network connectivity to PyPI\necho "Checking network connectivity to PyPI..."\nif command_exists curl; then\n  curl -s https://pypi.org/pypi/local-operator/json -o /dev/null || {\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  }\nelif command_exists wget; then\n  wget -q --spider https://pypi.org/pypi/local-operator/json || {\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  }\nfi\n\necho "Installing local-operator package..."\npython -m pip install --verbose local-operator || {\n  echo "ERROR: Failed to install local-operator package. Exit code: $?"\n  echo "Python version:"\n  python --version\n  echo "pip version:"\n  pip --version\n  echo "Available pip packages:"\n  pip list\n  exit 1\n}\necho "local-operator installation successful"\n\n# Verify installation\nif [ -f "$VENV_PATH/bin/local-operator" ]; then\n  log "Local Operator backend installed successfully!"\n  \n  # Show more information about the installed binary\n  ls -la "$VENV_PATH/bin/local-operator" || true\n  file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n  \n  # Try to run the version command with full error output\n  log "Testing local-operator binary..."\n  "$VENV_PATH/bin/local-operator" --version || {\n    log "ERROR: local-operator binary exists but failed to execute. Exit code: $?"\n    log "Binary details:"\n    file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n    log "Binary permissions:"\n    ls -la "$VENV_PATH/bin/local-operator" || true\n    log ""\n    log "This could be due to missing dependencies or architecture incompatibility."\n    log "Try running the binary manually to see specific errors."\n    \n    # Don\'t exit here - just warn the user\n    log "WARNING: Installation completed but binary verification failed."\n  }\n  \n  # Create a summary of the installation\n  SUMMARY_FILE="${APP_DATA_DIR}/installation-summary-${TIMESTAMP}.txt"\n  {\n    echo "=== Local Operator Backend Installation Summary ==="\n    echo "Timestamp: $(date)"\n    echo "Python Version: $("${PYTHON_BIN}" --version 2>&1)"\n    echo "Virtual Environment: ${VENV_PATH}"\n    echo "Binary Location: ${VENV_PATH}/bin/local-operator"\n    echo "To activate the virtual environment, run: source ${VENV_PATH}/bin/activate"\n    echo "To test the installation, run: ${VENV_PATH}/bin/local-operator --version"\n    echo "Log file: ${LOG_FILE}"\n    echo "=================================================="\n  } > "${SUMMARY_FILE}"\n  \n  log "Installation summary saved to: ${SUMMARY_FILE}"\nelse\n  log "Error: Failed to install Local Operator backend. Binary not found."\n  log "Contents of bin directory:"\n  ls -la "$VENV_PATH/bin/" || true\n  log "Check the log file for details: ${LOG_FILE}"\n  error_exit "Installation failed. Binary not installed properly."\nfi\n\nlog "Installation completed successfully at $(date)"\n\n# Clean up temporary files now that installation is complete\ncleanup\n\n# Print final instructions\nlog ""\nlog "=== INSTALLATION COMPLETE ==="\nlog "You can now use the Local Operator backend by running: ${VENV_PATH}/bin/local-operator"\nlog "Installation directory: ${VENV_PATH}"\nlog "Log file: ${LOG_FILE}"\nlog "================================"\n';
+const linuxInstallScriptRaw = '#!/bin/bash\n# Local Operator Backend Installation Script for Linux\n# This script sets up a virtual environment for the Local Operator backend\n# without requiring sudo or admin privileges.\n\n# Exit on error, undefined variables, and failed pipe commands\nset -e  # Exit immediately if a command exits with a non-zero status\nset -u  # Error on unset variables\nset -o pipefail  # Fail if any command in a pipe fails\n\n# Configuration\n# Variables APP_NAME and MIN_PYTHON_VERSION removed as they were unused\nVENV_NAME="local-operator-venv"\nAPP_DATA_DIR="${HOME}/.config/local-operator"\nVENV_PATH="${APP_DATA_DIR}/${VENV_NAME}"\nLOG_FILE="${APP_DATA_DIR}/backend-install.log"\nTIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")\n\n# Keep CPython\'s bytecode cache out of the application directory.\n#\n# Same reason as the macOS script: an interpreter writing __pycache__/*.pyc\n# beside its own stdlib sources writes into the installed tree. Linux does not\n# code-seal the app the way macOS does, so this is uniformity and hygiene here\n# rather than the load-bearing fix it is on macOS - but it is also the value a\n# standalone run of this script has to agree with, because the app and the\n# script must not disagree about where bytecode goes.\n: "${PYTHONPYCACHEPREFIX:=${APP_DATA_DIR}/python-bytecode-cache}"\nexport PYTHONPYCACHEPREFIX\n\n# Create app data directory if it doesn\'t exist\nif ! mkdir -p "${APP_DATA_DIR}"; then\n  echo "ERROR: Unable to create app data directory at ${APP_DATA_DIR}"\n  echo "Please check permissions and try again."\n  exit 1\nfi\n\n# Handle cleanup on script exit\ncleanup() {\n  # Remove any temporary files created during execution\n  if [ -f "${APP_DATA_DIR}/get-pip.py" ]; then\n    rm -f "${APP_DATA_DIR}/get-pip.py"\n  fi\n  if [ -n "${FFMPEG_TEMP_ARCHIVE:-}" ] && [ -f "${FFMPEG_TEMP_ARCHIVE}" ]; then\n    log "Removing temporary FFmpeg archive: ${FFMPEG_TEMP_ARCHIVE}"\n    rm -f "${FFMPEG_TEMP_ARCHIVE}"\n  fi\n  echo "$(date): Cleanup completed."\n}\n\n# Set trap only for manual interruption (SIGINT, SIGTERM), not normal exits\ntrap cleanup SIGINT SIGTERM\n\n\n# Start logging\nexec > >(tee -a "${LOG_FILE}") 2>&1\necho "[${TIMESTAMP}]: Starting Local Operator backend installation..."\necho "[${TIMESTAMP}]: System information: $(uname -a)"\n\n# Function to log messages with timestamp (defined later, but used by FFmpeg section)\n_log_internal() {\n  local internal_timestamp\n  internal_timestamp=$(date +"%Y-%m-%d %H:%M:%S")\n  echo "[${internal_timestamp}] $1"\n}\n\n# --- FFmpeg Installation ---\nBIN_DIR="${APP_DATA_DIR}/bin"\nFFMPEG_BIN="${BIN_DIR}/ffmpeg" # Path to ffmpeg binary\n\n_log_internal "Ensuring bin directory exists: ${BIN_DIR}"\nif ! mkdir -p "${BIN_DIR}"; then\n    _log_internal "ERROR: Unable to create bin directory at ${BIN_DIR}"\n    exit 1\nfi\n\n# Check if FFmpeg is already installed and executable\nif [ -f "${FFMPEG_BIN}" ] && [ -x "${FFMPEG_BIN}" ]; then\n    _log_internal "FFmpeg already installed at ${FFMPEG_BIN}. Skipping download."\nelse\n    _log_internal "FFmpeg not found or not executable. Attempting to download and install FFmpeg..."\n\n    FFMPEG_DOWNLOAD_URL=""\n\n    LINUX_ARCH=$(uname -m)\n    if [[ "${LINUX_ARCH}" == "x86_64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-linux-x64"\n    elif [[ "${LINUX_ARCH}" == "aarch64" ]] || [[ "${LINUX_ARCH}" == "arm64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-linux-arm64"\n    else\n        _log_internal "Error: Unsupported CPU architecture for FFmpeg download: ${LINUX_ARCH}"\n        exit 1\n    fi\n\n    _log_internal "Downloading FFmpeg from: ${FFMPEG_DOWNLOAD_URL}"\n    if command -v curl >/dev/null 2>&1; then\n        if ! curl -L "${FFMPEG_DOWNLOAD_URL}" -o "${FFMPEG_BIN}"; then\n            _log_internal "Error: Failed to download FFmpeg using curl from ${FFMPEG_DOWNLOAD_URL}"\n            exit 1\n        fi\n    elif command -v wget >/dev/null 2>&1; then\n        if ! wget -O "${FFMPEG_BIN}" "${FFMPEG_DOWNLOAD_URL}"; then\n            _log_internal "Error: Failed to download FFmpeg using wget from ${FFMPEG_DOWNLOAD_URL}"\n            exit 1\n        fi\n    else\n        _log_internal "Error: Neither curl nor wget found. Cannot download FFmpeg."\n        exit 1\n    fi\n    _log_internal "FFmpeg binary downloaded successfully to ${FFMPEG_BIN}"\n\n    chmod +x "${FFMPEG_BIN}"\n    _log_internal "Set executable permissions for ${FFMPEG_BIN}"\n\n    # Verify FFmpeg is executable after download\n    if [ ! -f "${FFMPEG_BIN}" ] || [ ! -x "${FFMPEG_BIN}" ]; then\n        _log_internal "Error: FFmpeg binary not found or not executable after download."\n        exit 1\n    fi\nfi\n\n_log_internal "FFmpeg installation complete. FFmpeg binary is at: ${FFMPEG_BIN}"\n\n# Function to check if a command exists\ncommand_exists() {\n  command -v "$1" >/dev/null 2>&1\n}\n\n# Function to log messages with timestamp\nlog() {\n  local timestamp\n  timestamp=$(date +"%Y-%m-%d %H:%M:%S")\n  echo "[${timestamp}] $1"\n}\n\n# Function to display error messages and exit\nerror_exit() {\n  log "ERROR: $1" >&2\n  exit "${2:-1}"\n}\n\n# Function to check if Python binary is valid for current architecture\nis_valid_python_binary() {\n  local python_path="$1"\n  \n  # First check if file exists and is executable\n  if [ ! -f "${python_path}" ] || [ ! -x "${python_path}" ]; then\n    return 1\n  fi\n  \n  # Try to run a simple Python command to verify it works on current architecture\n  "${python_path}" -c "print(\'Testing Python executable\')" >/dev/null 2>&1\n  return $?\n}\n\n# Check for network connectivity to key servers\ncheck_connectivity() {\n  log "Checking network connectivity..."\n  local servers=("pypi.org" "bootstrap.pypa.io")\n  local has_connectivity=false\n  \n  for server in "${servers[@]}"; do\n    if command_exists curl; then\n      if curl --connect-timeout 5 -s "https://${server}" -o /dev/null; then\n        has_connectivity=true\n        break\n      fi\n    elif command_exists wget; then\n      if wget --timeout=5 -q --spider "https://${server}"; then\n        has_connectivity=true\n        break\n      fi\n    fi\n  done\n  \n  if [ "$has_connectivity" = false ]; then\n    log "WARNING: Network connectivity issues detected. This may affect installation."\n  else\n    log "Network connectivity confirmed."\n  fi\n}\n\n# Call connectivity check\ncheck_connectivity\n\n# Check if PYTHON_BIN is already set by the installer\nif [ -n "${PYTHON_BIN:-}" ]; then\n  log "Using Python executable provided by installer: ${PYTHON_BIN}"\n  # Verify the provided Python binary works on this architecture\n  if ! is_valid_python_binary "${PYTHON_BIN}"; then\n    log "Warning: The provided Python binary is not compatible with this system architecture."\n    log "Will attempt to find a system Python installation instead."\n    PYTHON_BIN=""\n  fi\nfi\n\n# If PYTHON_BIN is empty or invalid, try to find a suitable Python installation\nif [ -z "${PYTHON_BIN:-}" ] || ! is_valid_python_binary "${PYTHON_BIN:-}"; then\n  # Try to find a suitable Python installation\n  log "Looking for a suitable Python installation..."\n  \n  # Try multiple possible locations to find Python\n  POSSIBLE_PYTHON_PATHS=(\n    # System paths first (more likely to be compatible with current architecture)\n    "/usr/local/bin/python3.12"\n    "/usr/bin/python3.12"\n    "/usr/local/bin/python3"\n    "/usr/bin/python3"\n    # From environment variable (set by the installer)\n    "${ELECTRON_RESOURCE_PATH:-}/python/bin/python3"\n    # Development paths\n    "$(dirname "$0")/../../../resources/python/bin/python3"\n    "$(pwd)/resources/python/bin/python3"\n  )\n\n  # Find the first Python that exists and is version 3.12+ and works on this architecture\n  PYTHON_BIN=""\n  for path in "${POSSIBLE_PYTHON_PATHS[@]}"; do\n    # Skip empty paths that might come from unset environment variables\n    if [ -z "${path}" ]; then\n      continue\n    fi\n    \n    if is_valid_python_binary "${path}"; then\n      # Check Python version\n      if PY_VERSION=$("${path}" -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')" 2>/dev/null); then\n        MAJOR=$(echo "${PY_VERSION}" | cut -d. -f1)\n        MINOR=$(echo "${PY_VERSION}" | cut -d. -f2)\n        if [ "${MAJOR}" -eq 3 ] && [ "${MINOR}" -ge 12 ]; then\n          PYTHON_BIN="${path}"\n          log "Found suitable Python ${PY_VERSION} at ${path}"\n          break\n        else\n          log "Python at ${path} is version ${PY_VERSION}, which is below the required 3.12+"\n        fi\n      fi\n    else\n      if [ -f "${path}" ]; then\n        log "Python at ${path} exists but is not compatible with this system architecture"\n      fi\n    fi\n  done\n\n  # If we couldn\'t find a suitable Python, exit with error\n  if [ -z "${PYTHON_BIN:-}" ]; then\n    error_exit "No suitable Python installation found (version 3.12 or higher required).\\nPlease install Python 3.12 or higher before running this script.\\nYou can install Python from https://www.python.org/downloads/"\n  fi\nfi\n\necho "Using Python: $PYTHON_BIN"\n"$PYTHON_BIN" --version || {\n  echo "Error: Failed to run Python. Please ensure it is executable and accessible."\n  echo "System architecture: $(uname -m)"\n  echo "Python binary architecture: $(file "$PYTHON_BIN" 2>/dev/null || echo \'Unable to determine\')"\n  exit 1\n}\n\n# Detect the Linux distribution to provide specific instructions\nif command_exists lsb_release; then\n  DISTRO=$(lsb_release -is)\n  DISTRO_VERSION=$(lsb_release -rs)\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelif [ -f /etc/os-release ]; then\n  DISTRO=$(grep -oP \'(?<=^ID=).+\' /etc/os-release | tr -d \'"\')\n  DISTRO_VERSION=$(grep -oP \'(?<=^VERSION_ID=).+\' /etc/os-release | tr -d \'"\')\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelse\n  DISTRO="unknown"\n  echo "Unable to detect Linux distribution"\nfi\n\n# Check if Python has venv module and ensurepip available\nlog "Checking for venv module and ensurepip availability..."\nVENV_AVAILABLE=0\nENSUREPIP_AVAILABLE=0\n\n"${PYTHON_BIN}" -c "import venv" > /dev/null 2>&1 || VENV_AVAILABLE=1\n"${PYTHON_BIN}" -c "import ensurepip" > /dev/null 2>&1 || ENSUREPIP_AVAILABLE=1\n\n# If venv is still not available, try to use virtualenv as a fallback\nif [ $VENV_AVAILABLE -ne 0 ]; then\n  echo "venv module is not available. Checking for virtualenv as an alternative..."\n  \n  # Check if virtualenv is already installed\n  if "$PYTHON_BIN" -c "import virtualenv" > /dev/null 2>&1; then\n    echo "virtualenv is available, will use it instead of venv"\n  else\n    echo "ERROR: Neither venv nor virtualenv is available."\n    echo "Python 3.12 and venv should be installed as package dependencies."\n    echo "Please ensure Python 3.12 and venv are properly installed on your system."\n    exit 1\n  fi\nfi\n\n# Create virtual environment if it doesn\'t exist\nif [ ! -d "$VENV_PATH" ]; then\n  echo "Creating virtual environment at $VENV_PATH..."\n  # Remove any potentially corrupted virtual environment\n  if [ -e "$VENV_PATH" ]; then\n    echo "Removing existing but potentially corrupted venv directory..."\n    rm -rf "$VENV_PATH"\n  fi\n  \n  # Make sure parent directory exists and is writable\n  mkdir -p "$(dirname "$VENV_PATH")"\n  \n  # Try different methods to create a virtual environment\n  VENV_CREATE_STATUS=1\n  \n  # First try with venv if available\n  if [ $VENV_AVAILABLE -eq 0 ] && [ $ENSUREPIP_AVAILABLE -eq 0 ]; then\n    echo "Creating virtual environment using venv module..."\n    "$PYTHON_BIN" -m venv "$VENV_PATH"\n    VENV_CREATE_STATUS=$?\n  fi\n  \n  # If venv failed, try virtualenv\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    echo "venv creation failed with status $VENV_CREATE_STATUS. Falling back to virtualenv..."\n    if command_exists virtualenv; then\n      virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    elif "$PYTHON_BIN" -m pip list | grep -q virtualenv; then\n      "$PYTHON_BIN" -m virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    else\n      echo "ERROR: Both venv and virtualenv are unavailable or failed."\n      echo "Python 3.12 and venv should be installed as package dependencies."\n      echo "Please ensure Python 3.12 and venv are properly installed on your system."\n      echo "You can install Python 3.12 from https://www.python.org/downloads/"\n      exit 1\n    fi\n  fi\n  \n  # Check if virtual environment creation was successful\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    log "ERROR: Failed to create virtual environment. Exit code: $VENV_CREATE_STATUS"\n    log "Virtual environment path: $VENV_PATH"\n    log "Python binary used: $PYTHON_BIN"\n    ls -la "$(dirname "$VENV_PATH")" || true\n    log "Python executable permissions:"\n    ls -la "$PYTHON_BIN" || true\n    \n    # Check for common issues\n    log "Checking for common virtual environment creation issues..."\n    \n    # Check disk space\n    df -h "$(dirname "$VENV_PATH")" || true\n    \n    # Check if directory is writable\n    if [ ! -w "$(dirname "$VENV_PATH")" ]; then\n      log "ERROR: Directory $(dirname "$VENV_PATH") is not writable"\n    fi\n    \n    # Try to create a minimal virtual environment manually as a last resort\n    log "Attempting to create a minimal virtual environment manually..."\n    mkdir -p "$VENV_PATH/bin" || error_exit "Could not create directory $VENV_PATH/bin"\n    echo "#!/bin/bash" > "$VENV_PATH/bin/activate"\n    echo "export VIRTUAL_ENV=\\"$VENV_PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "export PATH=\\"$VENV_PATH/bin:\\$PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "unset PYTHONHOME" >> "$VENV_PATH/bin/activate"\n    chmod +x "$VENV_PATH/bin/activate" || error_exit "Could not set execute permissions on activate script"\n    \n    # Create symlinks to the system Python\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python" || log "WARNING: Failed to create symlink for python"\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python3" || log "WARNING: Failed to create symlink for python3"\n    \n    # Try to bootstrap pip\n    log "Bootstrapping pip in the minimal virtual environment..."\n    if command_exists curl; then\n      curl -s https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py" || log "WARNING: Failed to download get-pip.py"\n    elif command_exists wget; then\n      wget -q -O "$APP_DATA_DIR/get-pip.py" https://bootstrap.pypa.io/get-pip.py || log "WARNING: Failed to download get-pip.py"\n    else\n      log "ERROR: Neither curl nor wget available to download get-pip.py"\n      error_exit "Installation cannot continue without being able to download pip"\n    fi\n    \n    # shellcheck disable=SC1090\n    source "$VENV_PATH/bin/activate" && python "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n    \n    if [ ! -f "$VENV_PATH/bin/pip" ]; then\n      error_exit "Failed to create even a minimal virtual environment."\n    else\n      log "Created a minimal virtual environment as a fallback."\n    fi\n  else\n    log "Successfully created virtual environment"\n  fi\nfi\n\n# Verify the virtual environment structure\necho "Verifying virtual environment structure..."\nif [ ! -f "$VENV_PATH/bin/python" ]; then\n  echo "Python executable missing in virtual environment, creating symlink..."\n  ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python"\nfi\n\nif [ ! -f "$VENV_PATH/bin/pip" ]; then\n  echo "pip missing in virtual environment, attempting to bootstrap it..."\n  curl -s https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py"\n  "$VENV_PATH/bin/python" "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n  \n  if [ ! -f "$VENV_PATH/bin/pip" ]; then\n    echo "ERROR: Failed to bootstrap pip in the virtual environment"\n    exit 1\n  fi\nfi\n\necho "Virtual environment structure verified"\n\n# Activate virtual environment and install local-operator\necho "Installing local-operator in virtual environment..."\nsource "$VENV_PATH/bin/activate"\n\necho "Upgrading pip..."\npython -m pip install --upgrade pip || {\n  echo "WARNING: Failed to upgrade pip. Will try to continue with existing pip version."\n  pip --version\n}\n\n# Check network connectivity to PyPI\necho "Checking network connectivity to PyPI..."\nif command_exists curl; then\n  curl -s https://pypi.org/pypi/local-operator/json -o /dev/null || {\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  }\nelif command_exists wget; then\n  wget -q --spider https://pypi.org/pypi/local-operator/json || {\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  }\nfi\n\necho "Installing local-operator package..."\npython -m pip install --verbose local-operator || {\n  echo "ERROR: Failed to install local-operator package. Exit code: $?"\n  echo "Python version:"\n  python --version\n  echo "pip version:"\n  pip --version\n  echo "Available pip packages:"\n  pip list\n  exit 1\n}\necho "local-operator installation successful"\n\n# Verify installation\nif [ -f "$VENV_PATH/bin/local-operator" ]; then\n  log "Local Operator backend installed successfully!"\n  \n  # Show more information about the installed binary\n  ls -la "$VENV_PATH/bin/local-operator" || true\n  file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n  \n  # Try to run the version command with full error output\n  log "Testing local-operator binary..."\n  "$VENV_PATH/bin/local-operator" --version || {\n    log "ERROR: local-operator binary exists but failed to execute. Exit code: $?"\n    log "Binary details:"\n    file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n    log "Binary permissions:"\n    ls -la "$VENV_PATH/bin/local-operator" || true\n    log ""\n    log "This could be due to missing dependencies or architecture incompatibility."\n    log "Try running the binary manually to see specific errors."\n    \n    # Don\'t exit here - just warn the user\n    log "WARNING: Installation completed but binary verification failed."\n  }\n  \n  # Create a summary of the installation\n  SUMMARY_FILE="${APP_DATA_DIR}/installation-summary-${TIMESTAMP}.txt"\n  {\n    echo "=== Local Operator Backend Installation Summary ==="\n    echo "Timestamp: $(date)"\n    echo "Python Version: $("${PYTHON_BIN}" --version 2>&1)"\n    echo "Virtual Environment: ${VENV_PATH}"\n    echo "Binary Location: ${VENV_PATH}/bin/local-operator"\n    echo "To activate the virtual environment, run: source ${VENV_PATH}/bin/activate"\n    echo "To test the installation, run: ${VENV_PATH}/bin/local-operator --version"\n    echo "Log file: ${LOG_FILE}"\n    echo "=================================================="\n  } > "${SUMMARY_FILE}"\n  \n  log "Installation summary saved to: ${SUMMARY_FILE}"\nelse\n  log "Error: Failed to install Local Operator backend. Binary not found."\n  log "Contents of bin directory:"\n  ls -la "$VENV_PATH/bin/" || true\n  log "Check the log file for details: ${LOG_FILE}"\n  error_exit "Installation failed. Binary not installed properly."\nfi\n\nlog "Installation completed successfully at $(date)"\n\n# Clean up temporary files now that installation is complete\ncleanup\n\n# Print final instructions\nlog ""\nlog "=== INSTALLATION COMPLETE ==="\nlog "You can now use the Local Operator backend by running: ${VENV_PATH}/bin/local-operator"\nlog "Installation directory: ${VENV_PATH}"\nlog "Log file: ${LOG_FILE}"\nlog "================================"\n';
 const macosInstallScriptRaw = `#!/bin/bash
 # Local Operator Backend Installation Script for macOS
 # This script uses the bundled standalone Python and sets up a virtual environment for the Local Operator backend.
@@ -2832,6 +2868,22 @@ APP_DATA_DIR="$HOME/Library/Application Support/$APP_NAME"
 VENV_PATH="$APP_DATA_DIR/$VENV_NAME"
 LOG_FILE="$APP_DATA_DIR/backend-install.log"
 
+# Keep CPython's bytecode cache out of the application bundle.
+#
+# The bundled interpreter writes __pycache__/*.pyc beside the stdlib sources it
+# imports, and those sources live inside the code-signed .app - which is the
+# build's own extraResource. Every such write is a change to a sealed resource:
+# measured on an installed 0.17.3, \`codesign --verify --deep\` reported 308
+# \`file added:\` violations, all of them .pyc, and ShipIt then refuses the
+# in-place update with -67028 errSecCSBadBundleFormat. A file codesign reports
+# as *added* can be deleted and the seal comes back; a *modified* one cannot,
+# which is why nothing may ship a .pyc at all. The app sets this variable when
+# it spawns us; defaulting it here means a standalone run of this script cannot
+# pollute the bundle either. $HOME is the right place for the same reason the
+# venv lives there: it is never inside the thing that gets signed and swapped.
+: "\${PYTHONPYCACHEPREFIX:=$APP_DATA_DIR/python-bytecode-cache}"
+export PYTHONPYCACHEPREFIX
+
 # Determine CPU Architecture and Python Directory Name
 ARCH=$(uname -m)
 PYTHON_DIR_NAME="python" # Default for x86_64
@@ -3102,6 +3154,19 @@ $VenvPath = "$AppDataDir\\\\$VenvName"
 $LogFile = "$AppDataDir\\\\backend-install-shell.log"
 $PyenvDir = "$env:USERPROFILE\\\\.pyenv"
 
+# Keep CPython's bytecode cache out of the application directory.
+#
+# Same rule as the macOS script, and stated here for the same reason: an
+# interpreter writes __pycache__/*.pyc beside the stdlib sources it imports. On
+# Windows those sources are the bundled python directory rather than a
+# code-signed bundle, so this is hygiene rather than the load-bearing fix it is
+# on macOS - but the app and the script must not disagree about where bytecode
+# goes. $AppDataDir is used for the same reason the venv is: it is never inside
+# the installed application tree.
+if (-not $env:PYTHONPYCACHEPREFIX) {
+    $env:PYTHONPYCACHEPREFIX = "$AppDataDir\\\\python-bytecode-cache"
+}
+
 # Create app data directory if it doesn't exist
 if (-not (Test-Path $AppDataDir)) {
     New-Item -ItemType Directory -Path $AppDataDir -Force | Out-Null
@@ -3672,7 +3737,7 @@ class BackendInstaller {
       electron.app.once("before-quit", appQuitHandler);
       const result = await new Promise((resolve) => {
         try {
-          const env = { ...process.env };
+          const env = withPythonBytecodeCache({ ...process.env }, this.appDataPath);
           env.ELECTRON_RESOURCE_PATH = this.resourcesPath;
           logger.info(
             `Setting ELECTRON_RESOURCE_PATH to ${this.resourcesPath}`,
@@ -3982,6 +4047,22 @@ function registerDesktopIPC(window, expectedUrl, request, streams, media, notifi
     });
   }
 }
+function presentWindow(window, show) {
+  if (show === "never") return;
+  if (window.isMinimized()) window.restore();
+  if (show === "inactive") window.showInactive();
+  else window.show();
+}
+function raiseWindow(window, show) {
+  if (show === "never") return;
+  if (window.isMinimized()) window.restore();
+  if (show === "inactive") {
+    window.showInactive();
+    return;
+  }
+  window.show();
+  window.focus();
+}
 const NOTIFY_TTL_MS = 10 * 60 * 1e3;
 const MAX_DEDUPE_KEYS = 2048;
 const CONTRACT_PROBE_ATTEMPTS = 3;
@@ -4000,9 +4081,10 @@ function gateBody(kind, gateTitle, gateDetail) {
   return subject || GATE_BODIES[kind] || GATE_BODIES.approval;
 }
 class DesktopNotifier {
-  constructor(window, request) {
+  constructor(window, request, windowRaise = "focus") {
     this.window = window;
     this.request = request;
+    this.windowRaise = windowRaise;
   }
   delivered = /* @__PURE__ */ new Map();
   /** Last known frontend epoch per session, to key dedupe on owner epoch. */
@@ -4191,6 +4273,7 @@ class DesktopNotifier {
   /** Called by the stream relay for every parsed frame it forwards. */
   observe(sessionId2, frame) {
     if (!this.canNotify) return;
+    if (this.windowRaise === "never") return;
     if (frame.type === "snapshot") {
       this.epochs.set(sessionId2, frame.payload.frontend.epoch);
       const gate = frame.payload.frontend.snapshot.pending_gate;
@@ -4414,9 +4497,7 @@ class DesktopNotifier {
     notification.on("click", () => {
       const target2 = this.window();
       if (!target2) return;
-      if (target2.isMinimized()) target2.restore();
-      target2.show();
-      target2.focus();
+      raiseWindow(target2, this.windowRaise);
       target2.webContents.send("desktop-open-conversation", { sessionId: sessionId2 });
     });
     notification.show();
@@ -4472,6 +4553,111 @@ function installedBundleSealBlock(appBundlePath, detail, version2) {
     detail: `${appBundlePath}: ${detail}`
   };
 }
+const VIOLATION_LINE = /^file (added|modified|missing):\s*(.+)$/;
+function parseSealViolations(output) {
+  const violations = [];
+  for (const rawLine of output.split("\n")) {
+    const line = rawLine.trim();
+    if (line.length === 0) continue;
+    const match = VIOLATION_LINE.exec(line);
+    if (match) {
+      violations.push({
+        kind: match[1],
+        path: match[2].trim()
+      });
+      continue;
+    }
+    violations.push({ kind: "other", path: line });
+  }
+  return violations;
+}
+function canonicalPath(path$1) {
+  try {
+    return fs.realpathSync(path$1);
+  } catch {
+    try {
+      return path.join(fs.realpathSync(path.dirname(path$1)), path.basename(path$1));
+    } catch {
+      return path$1;
+    }
+  }
+}
+const BUNDLED_PYTHON_DIRS = ["python", "python_aarch64"];
+function isPythonBytecodePath(bundlePath, candidate) {
+  const bundle = canonicalPath(bundlePath);
+  const path$1 = canonicalPath(candidate);
+  const dirs = BUNDLED_PYTHON_DIRS.map(
+    (name) => path.join(bundle, "Contents", "Resources", name)
+  );
+  const separator = "/";
+  if (!path$1.endsWith(".pyc")) return false;
+  const segments = path$1.split(separator);
+  if (!segments.includes("__pycache__")) return false;
+  return dirs.some((dir) => path$1.startsWith(`${dir}${separator}`));
+}
+function planPythonBytecodeHeal(bundlePath, violations) {
+  const added = violations.filter((violation) => violation.kind === "added");
+  const elsewhere = violations.filter(
+    (violation) => violation.kind !== "added"
+  );
+  if (added.length === 0) {
+    return {
+      healable: false,
+      reason: `no added-resource violation to heal (${violations.length} violation(s))`,
+      paths: []
+    };
+  }
+  if (elsewhere.length > 0) {
+    const kinds = [...new Set(elsewhere.map((violation) => violation.kind))];
+    return {
+      healable: false,
+      reason: `unhealable violation class(es) present: ${kinds.join(", ")}`,
+      paths: []
+    };
+  }
+  const outside = added.filter(
+    (violation) => !isPythonBytecodePath(bundlePath, violation.path)
+  );
+  if (outside.length > 0) {
+    return {
+      healable: false,
+      reason: `added resource outside the bundled python trees: ${outside[0].path}`,
+      paths: []
+    };
+  }
+  return {
+    healable: true,
+    reason: `${added.length} bytecode file(s) added after signing`,
+    paths: [...new Set(added.map((violation) => violation.path))]
+  };
+}
+function healPythonBytecode(bundlePath, violations, remove = (path2) => fs.rmSync(path2, { force: true })) {
+  const plan = planPythonBytecodeHeal(bundlePath, violations);
+  if (!plan.healable) return { ...plan, removed: [] };
+  const removed = [];
+  for (const path2 of plan.paths) {
+    if (!isPythonBytecodePath(bundlePath, path2)) {
+      return {
+        healable: false,
+        reason: `refused to remove ${path2}: not bytecode under the bundled python trees`,
+        paths: plan.paths,
+        removed
+      };
+    }
+    try {
+      remove(path2);
+      removed.push(path2);
+    } catch (error) {
+      return {
+        healable: false,
+        reason: `could not remove ${path2}: ${error instanceof Error ? error.message : String(error)}`,
+        paths: plan.paths,
+        removed
+      };
+    }
+  }
+  return { ...plan, removed };
+}
 function metadataBasenames(filePath, updatePath) {
   const names = [path.basename(filePath)];
   if (updatePath) names.push(path.basename(updatePath));
@@ -5318,7 +5504,11 @@ function runCommand(command, args, options = {}) {
     node_child_process.execFile(
       command,
       args,
-      { timeout: options.timeoutMs ?? 2e4, maxBuffer: 4 * 1024 * 1024 },
+      {
+        timeout: options.timeoutMs ?? 2e4,
+        maxBuffer: 4 * 1024 * 1024,
+        ...options.env ? { env: options.env } : {}
+      },
       (error, stdout, stderr) => {
         const code = error?.code;
         const killed = error?.killed === true;
@@ -5457,6 +5647,20 @@ class UpdateService {
   markerDir() {
     return electron.app.getPath("userData");
   }
+  /**
+   * The environment every python this service spawns has to run under.
+   *
+   * The bundled venv's `python` is the interpreter we ship, so its stdlib - and
+   * therefore any `__pycache__` CPython writes for it - is inside the code-sealed
+   * `.app`. `pip show` and the pip upgrade both compile stdlib modules, so both
+   * would unseal the bundle the pre-flight is about to ask ShipIt to replace.
+   *
+   * userData is the location for the same reason the pending marker uses it: it
+   * is never inside the bundle being swapped.
+   */
+  pythonSpawnEnv() {
+    return withPythonBytecodeCache(process.env, this.markerDir());
+  }
   sendToRenderer(channel, payload) {
     const webContents = this.mainWindow?.webContents;
     if (!webContents || webContents.isDestroyed()) return false;
@@ -5721,6 +5925,13 @@ class UpdateService {
    * - A probe that could not run is retried once and then *allowed to proceed*.
    *   "We could not ask" is not "the bundle is bad", and treating it as one is
    *   how a transient hiccup became a permanent reinstall message (R5).
+   *
+   * A bundle that fails the check is given one chance to heal itself, because
+   * the failure every 0.17.x/0.18.0 install has is ours rather than the user's:
+   * a CPython stdlib bytecode cache written into the sealed bundle by our own
+   * backend. Those writes are `file added:` violations and deleting exactly
+   * those files restores the seal (measured; see `healPythonBytecode`), where a
+   * bundle broken any other way still gets the reinstall refusal below.
    */
   async probeInstalledBundleSeal(version2) {
     if (process.platform !== "darwin" || !electron.app.isPackaged) return null;
@@ -5737,13 +5948,15 @@ class UpdateService {
       ["--verify", "--deep", "--verbose=2", bundlePath],
       { timeoutMs: SEAL_PROBE_TIMEOUT_MS }
     );
-    let seal = evaluateBundleSeal(await probeBundle());
+    let probe = await probeBundle();
+    let seal = evaluateBundleSeal(probe);
     if (seal.kind === "unavailable") {
       logger.warn(
         `Seal check did not complete, retrying once: ${seal.detail}`,
         LogFileType.UPDATE_SERVICE
       );
-      seal = evaluateBundleSeal(await probeBundle());
+      probe = await probeBundle();
+      seal = evaluateBundleSeal(probe);
     }
     if (seal.kind === "unavailable") {
       logger.warn(
@@ -5763,7 +5976,33 @@ class UpdateService {
       `Installed bundle failed its seal check: ${seal.detail}`,
       LogFileType.UPDATE_SERVICE
     );
-    return installedBundleSealBlock(bundlePath, seal.detail, version2);
+    const violations = parseSealViolations(probe.stdout);
+    const heal = healPythonBytecode(bundlePath, violations);
+    if (!heal.healable) {
+      logger.warn(
+        `Installed bundle is not healable in place: ${heal.reason}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return installedBundleSealBlock(bundlePath, seal.detail, version2);
+    }
+    logger.info(
+      `Removed ${heal.removed.length} bytecode file(s) our own interpreter had written into the sealed bundle: ${heal.reason}. Paths:
+${heal.removed.join("\n")}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    const healed = evaluateBundleSeal(await probeBundle());
+    if (healed.kind === "sealed") {
+      logger.info(
+        `Installed bundle sealed again after removing ${heal.removed.length} added bytecode file(s); continuing with the install.`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return null;
+    }
+    logger.error(
+      `Installed bundle still fails its seal check after healing: ${healed.detail}`,
+      LogFileType.UPDATE_SERVICE
+    );
+    return installedBundleSealBlock(bundlePath, healed.detail, version2);
   }
   /** File names the updater's metadata knows this update by. */
   stagedArtifactCandidates(info) {
@@ -6866,7 +7105,7 @@ class UpdateService {
     const probe = await runCommand(
       pythonPath,
       ["-m", "pip", "show", "local-operator"],
-      { timeoutMs: 12e4 }
+      { timeoutMs: 12e4, env: this.pythonSpawnEnv() }
     );
     if (probe.exitCode !== 0) {
       logger.warn(
@@ -7030,7 +7269,8 @@ class UpdateService {
         LogFileType.UPDATE_SERVICE
       );
       const pipRun = await runCommand(pip.command, pip.args, {
-        timeoutMs: 15 * 60 * 1e3
+        timeoutMs: 15 * 60 * 1e3,
+        env: this.pythonSpawnEnv()
       });
       logger.info(
         `pip stdout:
@@ -7298,6 +7538,105 @@ ${pipRun.stderr.trim()}`,
     }
   }
 }
+const WINDOW_MODES = ["normal", "headless", "inactive"];
+const WINDOW_MODE_ENV = "LOCAL_OPERATOR_UI_WINDOW_MODE";
+const WINDOW_SIZE_ENV = "LOCAL_OPERATOR_UI_WINDOW_SIZE";
+const WINDOW_MODE_FLAG = "--window-mode";
+const WINDOW_SIZE_FLAG = "--window-size";
+const WINDOW_MIN_WIDTH = 800;
+const WINDOW_MIN_HEIGHT = 600;
+const WINDOW_MAX_EDGE = 16384;
+const DEFAULT_WINDOW_WIDTH = 1380;
+const DEFAULT_WINDOW_HEIGHT = 900;
+const WINDOW_BEHAVIOUR = {
+  normal: { show: "focus", focusable: true, backgroundThrottling: true },
+  inactive: { show: "inactive", focusable: true, backgroundThrottling: false },
+  headless: { show: "never", focusable: false, backgroundThrottling: false }
+};
+function readFlag(argv, name) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === name) {
+      const next = argv[index + 1];
+      return { found: true, value: next?.startsWith("--") ? void 0 : next };
+    }
+    if (argument.startsWith(`${name}=`)) {
+      return { found: true, value: argument.slice(name.length + 1) };
+    }
+  }
+  return { found: false, value: void 0 };
+}
+function parseWindowMode(value) {
+  if (value === void 0) return null;
+  const normalized = value.trim().toLowerCase();
+  return WINDOW_MODES.includes(normalized) ? normalized : null;
+}
+const WINDOW_SIZE_PATTERN = /^(\d+)\s*[x×]\s*(\d+)$/i;
+function parseWindowSize(value) {
+  if (value === void 0) return null;
+  const match = value.trim().match(WINDOW_SIZE_PATTERN);
+  if (!match) return null;
+  const width = Number(match[1]);
+  const height = Number(match[2]);
+  if (width <= 0 || height <= 0) return null;
+  return { width, height };
+}
+function resolveWindowLaunchPlan(input = {}) {
+  const env = input.env ?? {};
+  const argv = input.argv ?? [];
+  const problems = [];
+  const modeFlag = readFlag(argv, WINDOW_MODE_FLAG);
+  const modeRaw = modeFlag.found ? modeFlag.value : env[WINDOW_MODE_ENV];
+  const parsedMode = parseWindowMode(modeRaw);
+  if (modeFlag.found && modeFlag.value === void 0) {
+    problems.push(
+      `${WINDOW_MODE_FLAG} needs a value: ${WINDOW_MODES.join("|")}`
+    );
+  } else if (parsedMode === null && modeRaw !== void 0) {
+    problems.push(
+      `${modeFlag.found ? WINDOW_MODE_FLAG : WINDOW_MODE_ENV}="${modeRaw}" is not one of ${WINDOW_MODES.join("|")}; using normal`
+    );
+  }
+  const mode = parsedMode ?? "normal";
+  const sizeFlag = readFlag(argv, WINDOW_SIZE_FLAG);
+  const sizeRaw = sizeFlag.found ? sizeFlag.value : env[WINDOW_SIZE_ENV];
+  const parsedSize = parseWindowSize(sizeRaw);
+  if (sizeFlag.found && sizeFlag.value === void 0) {
+    problems.push(`${WINDOW_SIZE_FLAG} needs a value: <width>x<height>`);
+  } else if (parsedSize === null && sizeRaw !== void 0) {
+    problems.push(
+      `${sizeFlag.found ? WINDOW_SIZE_FLAG : WINDOW_SIZE_ENV}="${sizeRaw}" is not <width>x<height>; using ${DEFAULT_WINDOW_WIDTH}x${DEFAULT_WINDOW_HEIGHT}`
+    );
+  }
+  const requested = parsedSize ?? {
+    width: DEFAULT_WINDOW_WIDTH,
+    height: DEFAULT_WINDOW_HEIGHT
+  };
+  const width = Math.min(
+    Math.max(requested.width, WINDOW_MIN_WIDTH),
+    WINDOW_MAX_EDGE
+  );
+  const height = Math.min(
+    Math.max(requested.height, WINDOW_MIN_HEIGHT),
+    WINDOW_MAX_EDGE
+  );
+  if (width !== requested.width || height !== requested.height) {
+    problems.push(
+      `window size ${requested.width}x${requested.height} clamped to ${width}x${height} (floor ${WINDOW_MIN_WIDTH}x${WINDOW_MIN_HEIGHT}, ceiling ${WINDOW_MAX_EDGE})`
+    );
+  }
+  return {
+    mode,
+    ...WINDOW_BEHAVIOUR[mode],
+    width,
+    height,
+    problems
+  };
+}
+function describeWindowLaunch(plan) {
+  const behaviour = plan.show === "never" ? "window created and never shown" : plan.show === "inactive" ? "window shown without activating the app" : "window shown and focused";
+  return `window mode ${plan.mode}: ${plan.width}x${plan.height}, ${behaviour}, page throttling ${plan.backgroundThrottling ? "on" : "off"}`;
+}
 const BASE64_FILE_EXTENSIONS = ["csv", "tsv", "xls", "xlsx", "ods"];
 electron.app.setName("Local Operator");
 const image = electron.nativeImage.createFromPath(icon);
@@ -7435,16 +7774,28 @@ function createApplicationMenu() {
 }
 function createWindow() {
   const mainWindow2 = new electron.BrowserWindow({
-    width: 1380,
-    height: 900,
+    width: windowLaunch.width,
+    height: windowLaunch.height,
     // The layout is verified down to 800x600 and not below: the app rail,
     // the per-route list pane and the canvas all have their own minimums,
     // and past this point they start taking room from each other rather
     // than from the window. The auth popup below sets its own floor the
-    // same way.
-    minWidth: 800,
-    minHeight: 600,
+    // same way. The floor lives in `window-mode.ts` because that is what
+    // clamps a requested `--window-size` to it.
+    minWidth: WINDOW_MIN_WIDTH,
+    minHeight: WINDOW_MIN_HEIGHT,
     show: false,
+    /*
+     * `headless` is never shown, so no key window can be made out of it; this
+     * keeps that true of the window object itself rather than of the code
+     * path. It is NOT a safety net against a stray `show()`: on macOS
+     * `NativeWindowMac::Show()` activates the app for any non-panel window
+     * whatever `focusable` says (measured — a non-focusable window, shown,
+     * made the app frontmost while `isFocused()` still read false). The guard
+     * against a window being raised is that `window-raise.ts` is the only
+     * module that raises one, and this flag is the second line of defence.
+     */
+    focusable: windowLaunch.focusable,
     autoHideMenuBar: true,
     title: "Local Operator",
     icon,
@@ -7458,7 +7809,17 @@ function createWindow() {
       nodeIntegration: false,
       contextIsolation: true,
       webSecurity: true,
-      allowRunningInsecureContent: false
+      allowRunningInsecureContent: false,
+      // Chromium throttles timers and animation frames in a window it
+      // believes nobody is looking at, which would make a headless test
+      // run measure a different app than the one users get. Measured on
+      // Electron 35 / macOS: a `show: false` window does keep
+      // `visibilityState` at "visible" and keeps rAF ticking, but that
+      // comes from Electron's MacWebContentsOcclusion default rather
+      // than from anything this app controls, so hold the page at full
+      // rate explicitly instead of trusting the platform. `normal`
+      // keeps Electron's own default.
+      backgroundThrottling: windowLaunch.backgroundThrottling
     }
   });
   mainWindow2.webContents.on("console-message", (_event, level, message) => {
@@ -7467,7 +7828,16 @@ function createWindow() {
     write.call(logger, `[renderer] ${message}`, LogFileType.BACKEND);
   });
   mainWindow2.on("ready-to-show", () => {
-    mainWindow2.show();
+    presentWindow(mainWindow2, windowLaunch.show);
+    if (windowLaunch.mode === "normal") return;
+    setTimeout(() => {
+      if (!mainWindow2 || mainWindow2.isDestroyed()) return;
+      const [width, height] = mainWindow2.getSize();
+      const [contentWidth, contentHeight] = mainWindow2.getContentSize();
+      console.log(
+        `[window-mode] state: visible=${mainWindow2.isVisible()} focused=${mainWindow2.isFocused()} focusable=${mainWindow2.isFocusable()} size=${width}x${height} content=${contentWidth}x${contentHeight}`
+      );
+    }, 1500);
   });
   mainWindow2.webContents.setWindowOpenHandler((details) => {
     const url = new URL(details.url);
@@ -7538,6 +7908,17 @@ function createWindow() {
 }
 const backendService = new BackendServiceManager();
 const backendInstaller = new BackendInstaller();
+const windowLaunch = resolveWindowLaunchPlan({
+  env: process.env,
+  argv: process.argv
+});
+for (const problem of windowLaunch.problems) {
+  logger.warn(`[window-mode] ${problem}`, LogFileType.BACKEND);
+  console.log(`[window-mode] ${problem}`);
+}
+if (windowLaunch.mode !== "normal") {
+  console.log(`[window-mode] ${describeWindowLaunch(windowLaunch)}`);
+}
 let mainWindow = null;
 const zoomInFromEvent = () => {
   if (mainWindow) {
@@ -7565,8 +7946,7 @@ if (!gotTheLock) {
 } else {
   electron.app.on("second-instance", (_event, commandLine) => {
     if (mainWindow) {
-      if (mainWindow.isMinimized()) mainWindow.restore();
-      mainWindow.focus();
+      raiseWindow(mainWindow, windowLaunch.show);
     }
   });
 }
@@ -7586,7 +7966,11 @@ electron.app.whenReady().then(async () => {
     () => mainWindow,
     (input) => backendService.requestDesktop(input)
   );
-  const desktopNotifier = new DesktopNotifier(() => mainWindow, sendDesktop);
+  const desktopNotifier = new DesktopNotifier(
+    () => mainWindow,
+    sendDesktop,
+    windowLaunch.show
+  );
   backendService.onBackendReady(() => {
     void desktopNotifier.refreshNotificationContract();
   });