local-operator-ui 0.30.6 → 0.30.8

package/out/main/index.js

@@ -5540,6 +5540,205 @@ function ensureVenvBytecodeGuard(venvPath) {
     reason: `${path2} now sets sys.dont_write_bytecode for every process using this venv`
   };
 }
+const SHELL_PATH_BEGIN = "__LOCAL_OPERATOR_SHELL_PATH_BEGIN__";
+const SHELL_PATH_END = "__LOCAL_OPERATOR_SHELL_PATH_END__";
+const SHELL_PATH_TIMEOUT_MS = 3e3;
+const SHELL_PATH_ANSWER_GRACE_MS = 500;
+const SHELL_PATH_ARGS = [
+  "-l",
+  "-i",
+  "-c",
+  `command printf '${SHELL_PATH_BEGIN}%s${SHELL_PATH_END}' "$PATH"`
+];
+const POSIX_SHELL_NAMES = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "dash",
+  "zsh",
+  "ksh",
+  "ksh93",
+  "mksh",
+  "lksh",
+  "pdksh",
+  "ash",
+  "posh",
+  "yash",
+  "rbash"
+]);
+function isPosixShell(shell) {
+  const name = path$1.basename(shell).toLowerCase().replace(/\.exe$/, "");
+  return POSIX_SHELL_NAMES.has(name);
+}
+function defaultShell(env, options = {}) {
+  const shell = env.SHELL?.trim();
+  if (shell && path$1.isAbsolute(shell)) return shell;
+  const platform = options.platform ?? process.platform;
+  const exists = options.exists ?? fs.existsSync;
+  const candidates = platform === "darwin" ? ["/bin/zsh", "/bin/bash", "/bin/sh"] : ["/bin/bash", "/bin/sh", "/bin/zsh"];
+  return candidates.find((candidate) => exists(candidate)) ?? "/bin/sh";
+}
+function shellPathRunner() {
+  return ({ shell, args, env, timeoutMs }) => new Promise((resolve, reject) => {
+    const child = node_child_process.spawn(shell, [...args], {
+      stdio: ["ignore", "pipe", "pipe"],
+      env,
+      detached: true
+    });
+    let stdout = "";
+    let timedOut = false;
+    const deadline2 = setTimeout(() => {
+      timedOut = true;
+      try {
+        if (child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+        else child.kill("SIGKILL");
+      } catch {
+        child.kill("SIGKILL");
+      }
+    }, timeoutMs);
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr?.resume();
+    child.on("error", (error) => {
+      clearTimeout(deadline2);
+      reject(error);
+    });
+    child.on("close", () => {
+      clearTimeout(deadline2);
+      resolve({ stdout, timedOut });
+    });
+  });
+}
+function countOccurrences(value, needle) {
+  let count = 0;
+  let at = value.indexOf(needle);
+  while (at !== -1) {
+    count += 1;
+    at = value.indexOf(needle, at + needle.length);
+  }
+  return count;
+}
+function pathFromStdout(stdout, shell) {
+  const begins = countOccurrences(stdout, SHELL_PATH_BEGIN);
+  const ends = countOccurrences(stdout, SHELL_PATH_END);
+  if (begins === 0 || ends === 0) {
+    return { ok: false, reason: "empty", shell };
+  }
+  if (begins > 1 || ends > 1) {
+    return {
+      ok: false,
+      reason: "unparsable",
+      shell,
+      detail: `${begins} BEGIN and ${ends} END sentinels`
+    };
+  }
+  const start = stdout.indexOf(SHELL_PATH_BEGIN) + SHELL_PATH_BEGIN.length;
+  const path2 = stdout.slice(start, stdout.indexOf(SHELL_PATH_END));
+  if (path2 === "") return { ok: false, reason: "empty", shell };
+  return { ok: true, path: path2, shell };
+}
+function pathFromError(error, shell) {
+  const code = error?.code;
+  const detail = error instanceof Error ? error.message : String(error);
+  if (code === "ENOENT") return { ok: false, reason: "missing", shell, detail };
+  if (code === "EACCES" || code === "EPERM")
+    return { ok: false, reason: "not-executable", shell, detail };
+  return { ok: false, reason: "failed", shell, detail };
+}
+async function resolveLoginShellPath(options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform !== "darwin" && platform !== "linux") {
+    return { ok: false, reason: "unsupported-platform", shell: null };
+  }
+  const env = options.env ?? process.env;
+  const run = options.run ?? shellPathRunner();
+  const timeoutMs = options.timeoutMs ?? SHELL_PATH_TIMEOUT_MS;
+  const shell = defaultShell(env, { platform });
+  if (!isPosixShell(shell)) {
+    return { ok: false, reason: "unsupported-shell", shell };
+  }
+  const attempt = run({
+    shell,
+    args: SHELL_PATH_ARGS,
+    env,
+    timeoutMs
+  }).then(
+    (result) => (
+      // A run the runner cut short at the bound is a timeout even when the pipe
+      // holds a complete-looking value: a shell killed mid-rc has a PATH that is
+      // whatever the file had reached, which is not the terminal's PATH and is
+      // not worth preferring to the one the app already had.
+      result.timedOut ? { ok: false, reason: "timeout", shell } : pathFromStdout(result.stdout ?? "", shell)
+    ),
+    (error) => pathFromError(error, shell)
+  );
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(
+      () => resolve("timeout"),
+      timeoutMs + SHELL_PATH_ANSWER_GRACE_MS
+    );
+  });
+  try {
+    const settled = await Promise.race([attempt, expired]);
+    if (settled === "timeout") return { ok: false, reason: "timeout", shell };
+    return settled;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+const USER_SHELL_PATH_MAX_ATTEMPTS = 3;
+function createUserShellPath(options = {}) {
+  let answer = null;
+  let pending = null;
+  let attempts = 0;
+  return {
+    resolve() {
+      if (answer) return Promise.resolve(answer);
+      if (pending) return pending;
+      if (attempts >= USER_SHELL_PATH_MAX_ATTEMPTS)
+        return Promise.resolve(null);
+      attempts += 1;
+      const attempt = attempts;
+      pending = resolveLoginShellPath(options).then((result) => {
+        try {
+          if (result.ok) {
+            options.log?.(
+              `[shell-path] ${result.shell} reports PATH: ${result.path}`
+            );
+          } else {
+            options.log?.(
+              `[shell-path] attempt ${attempt}/${USER_SHELL_PATH_MAX_ATTEMPTS}: ${result.shell ?? "no shell"} could not report a PATH (${result.reason}${result.detail ? `: ${result.detail}` : ""}); ${attempt < USER_SHELL_PATH_MAX_ATTEMPTS ? "a later ask will retry" : "the PATH this app was launched with is used instead"}`
+            );
+          }
+        } catch {
+        }
+        if (result.ok) answer = result.path;
+        return answer;
+      }).finally(() => {
+        pending = null;
+      });
+      return pending;
+    }
+  };
+}
+function mergeShellPath(resolved, base) {
+  if (!base) return resolved;
+  const seen = /* @__PURE__ */ new Set();
+  const merged = [];
+  for (const entry of [...resolved.split(":"), ...base.split(":")]) {
+    if (seen.has(entry)) continue;
+    seen.add(entry);
+    merged.push(entry);
+  }
+  return merged.join(":");
+}
+async function withUserShellPath(env, userShellPath2) {
+  const path2 = await userShellPath2?.resolve();
+  if (!path2) return { ...env };
+  return { ...env, PATH: mergeShellPath(path2, env.PATH) };
+}
 const launchEnv = {
   ...process.env
 };
@@ -7156,6 +7355,16 @@ class BackendServiceManager {
   /** Consumers of status changes in main (the window's IPC sender). */
   statusObserver = null;
   shellEnv = {};
+  /**
+   * The user's own login-shell PATH, resolved once for the whole app.
+   *
+   * Handed in by `src/main/index.ts` rather than constructed here, for one
+   * reason: the console host is given the SAME instance, so "what is this user's
+   * PATH" has one answer in this process instead of one per consumer. Absent -
+   * every test and rig that builds a manager directly - means this instance keeps
+   * the launch environment's PATH, which is exactly what it did before.
+   */
+  userShellPath;
   // External/dev backends may be explicitly paired through main's environment.
   // Managed starts always rotate this; it is never exposed by preload or logs.
   /**
@@ -7468,8 +7677,13 @@ class BackendServiceManager {
   // Configurable timeouts for different shutdown scenarios
   /**
    * Constructor
+   *
+   * @param options.userShellPath the app's one login-shell PATH resolver (see
+   * `../shell-path`). Optional so a manager built without the app - a test, a rig
+   * - behaves exactly as it did before this option existed.
    */
-  constructor() {
+  constructor(options = {}) {
+    this.userShellPath = options.userShellPath;
     try {
       const apiUrl = new URL(backendConfig.VITE_LOCAL_OPERATOR_API_URL);
       this.port = Number.parseInt(apiUrl.port, 10) || 1111;
@@ -7526,11 +7740,12 @@ class BackendServiceManager {
           LogFileType.BACKEND
         );
       }
+      this.shellEnv = withPythonBytecodeCache(this.shellEnv, this.appDataPath);
+      await this.settleUserShellPath();
       logger.info(
         `Shell environment variables loaded successfully. PATH: ${this.shellEnv.PATH || this.shellEnv.Path || "(not set)"}`,
         LogFileType.BACKEND
       );
-      this.shellEnv = withPythonBytecodeCache(this.shellEnv, this.appDataPath);
     } catch (error) {
       logger.error(
         "Error loading shell environment variables:",
@@ -7539,6 +7754,24 @@ class BackendServiceManager {
       );
     }
   }
+  /**
+   * Fold the user's login-shell PATH into `shellEnv`, when the app handed one in.
+   *
+   * Awaited at BOTH of its call sites, unlike the other enrichments the spawn
+   * environment carries, because unlike them this one IS the value being fixed: a
+   * fire-and-forget resolution is the defect it exists to remove, and the first
+   * spawn would keep the launchd PATH on exactly the machines whose rc is slowest.
+   * `resolve()` is memoized, so the second caller - and the console host, which
+   * holds the same resolver - is answered from the first shell's result rather
+   * than starting one.
+   *
+   * A no-op without a resolver: a manager a test or rig builds directly keeps the
+   * launch environment's PATH exactly as it did before.
+   */
+  async settleUserShellPath() {
+    if (!this.userShellPath) return;
+    this.shellEnv = await withUserShellPath(this.shellEnv, this.userShellPath);
+  }
   /**
    * The environment the backend process is spawned with.
    *
@@ -7552,6 +7785,14 @@ class BackendServiceManager {
    * it here makes the guarantee structural instead of ordering-dependent, so
    * no spawn path can miss it.
    *
+   * PATH is the one term of that race this method no longer has to carry: its
+   * resolver is awaited before the first spawn (`settleUserShellPath`), so a slow
+   * rc delays the start rather than quietly leaving the launchd PATH in place.
+   * The prefix and the kill switch stay here all the same, because the seed they
+   * are read from is `process.env` itself - an exported `PYTHONPYCACHEPREFIX`
+   * inside the bundle, or a `.env` folded over the launch - and no shell
+   * resolution of PATH has anything to say about either.
+   *
    * These spawns are the ones whose `python` is the interpreter we ship:
    * CPython writes `__pycache__/*.pyc` beside the sources it imports, those
    * sources are inside the code-sealed `.app`, and every such write breaks the
@@ -8388,6 +8629,7 @@ class BackendServiceManager {
         packaged: electron.app.isPackaged
       });
       const globalInstall = await this.checkLocalOperatorExists();
+      await this.settleUserShellPath();
       const env = this.backendSpawnEnv();
       let interpreters;
       if (globalInstall) {
@@ -9490,338 +9732,9 @@ function managedPythonOptions() {
     arch: process.arch
   };
 }
-const linuxInstallScriptRaw = '#!/bin/bash\n# Local Operator Backend Installation Script for Linux\n# This script sets up a virtual environment for the Local Operator backend\n# without requiring sudo or admin privileges.\n\n# Exit on error, undefined variables, and failed pipe commands\nset -e  # Exit immediately if a command exits with a non-zero status\nset -u  # Error on unset variables\nset -o pipefail  # Fail if any command in a pipe fails\n\n# Configuration\n# Variables APP_NAME and MIN_PYTHON_VERSION removed as they were unused\nVENV_NAME="local-operator-venv"\nAPP_DATA_DIR="${HOME}/.config/local-operator"\nVENV_PATH="${APP_DATA_DIR}/${VENV_NAME}"\nLOG_FILE="${APP_DATA_DIR}/backend-install.log"\nTIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")\n\n# Which environment this installs into - the app\'s decision, handed in. See the\n# macOS script for why the script must not re-derive it (a packaged and an\n# unpackaged instance use different environments, and only the app knows which\n# it is); `LOCAL_OPERATOR_VENV_PATH` is set from `managedVenvPath`.\n: "${LOCAL_OPERATOR_VENV_PATH:=$VENV_PATH}"\nVENV_PATH="$LOCAL_OPERATOR_VENV_PATH"\n\n# Keep CPython\'s bytecode cache out of the application directory.\n#\n# Same reason as the macOS script: an interpreter writing __pycache__/*.pyc\n# beside its own stdlib sources writes into the installed tree. Linux does not\n# code-seal the app the way macOS does, so this is uniformity and hygiene here\n# rather than the load-bearing fix it is on macOS - but it is also the value a\n# standalone run of this script has to agree with, because the app and the\n# script must not disagree about where bytecode goes.\n: "${PYTHONPYCACHEPREFIX:=${APP_DATA_DIR}/python-bytecode-cache}"\nexport PYTHONPYCACHEPREFIX\n\n# The refusal half of the pair, set rather than merged with whatever the caller\n# had: CPython reads the flag before its first import, so nothing this script\n# runs - `-m venv`, pip, the venv they create - can write a `__pycache__` at\n# all. Kept in step with the app\'s `withPythonBytecodeCache`, which sets both\n# variables on every python it spawns.\nexport PYTHONDONTWRITEBYTECODE=1\n\n# Create app data directory if it doesn\'t exist\nif ! mkdir -p "${APP_DATA_DIR}"; then\n  echo "ERROR: Unable to create app data directory at ${APP_DATA_DIR}"\n  echo "Please check permissions and try again."\n  exit 1\nfi\n\n# Handle cleanup on script exit\ncleanup() {\n  # Remove any temporary files created during execution\n  if [ -f "${APP_DATA_DIR}/get-pip.py" ]; then\n    rm -f "${APP_DATA_DIR}/get-pip.py"\n  fi\n  if [ -n "${FFMPEG_TEMP_ARCHIVE:-}" ] && [ -f "${FFMPEG_TEMP_ARCHIVE}" ]; then\n    log "Removing temporary FFmpeg archive: ${FFMPEG_TEMP_ARCHIVE}"\n    rm -f "${FFMPEG_TEMP_ARCHIVE}"\n  fi\n  echo "$(date): Cleanup completed."\n}\n\n# Set trap only for manual interruption (SIGINT, SIGTERM), not normal exits\ntrap cleanup SIGINT SIGTERM\n\n\n# Start logging\nexec > >(tee -a "${LOG_FILE}") 2>&1\necho "[${TIMESTAMP}]: Starting Local Operator backend installation..."\necho "[${TIMESTAMP}]: System information: $(uname -a)"\n\n# Function to log messages with timestamp (defined later, but used by FFmpeg section)\n_log_internal() {\n  local internal_timestamp\n  internal_timestamp=$(date +"%Y-%m-%d %H:%M:%S")\n  echo "[${internal_timestamp}] $1"\n}\n\n# --- FFmpeg Installation ---\nBIN_DIR="${APP_DATA_DIR}/bin"\nFFMPEG_BIN="${BIN_DIR}/ffmpeg" # Path to ffmpeg binary\n\n_log_internal "Ensuring bin directory exists: ${BIN_DIR}"\nif ! mkdir -p "${BIN_DIR}"; then\n    _log_internal "ERROR: Unable to create bin directory at ${BIN_DIR}"\n    exit 1\nfi\n\n# Check if FFmpeg is already installed and executable\nif [ -f "${FFMPEG_BIN}" ] && [ -x "${FFMPEG_BIN}" ]; then\n    _log_internal "FFmpeg already installed at ${FFMPEG_BIN}. Skipping download."\nelse\n    _log_internal "FFmpeg not found or not executable. Attempting to download and install FFmpeg..."\n\n    FFMPEG_DOWNLOAD_URL=""\n\n    LINUX_ARCH=$(uname -m)\n    if [[ "${LINUX_ARCH}" == "x86_64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-linux-x64"\n    elif [[ "${LINUX_ARCH}" == "aarch64" ]] || [[ "${LINUX_ARCH}" == "arm64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-linux-arm64"\n    else\n        _log_internal "Error: Unsupported CPU architecture for FFmpeg download: ${LINUX_ARCH}"\n        exit 1\n    fi\n\n    _log_internal "Downloading FFmpeg from: ${FFMPEG_DOWNLOAD_URL}"\n    if command -v curl >/dev/null 2>&1; then\n        if ! curl -L "${FFMPEG_DOWNLOAD_URL}" -o "${FFMPEG_BIN}"; then\n            _log_internal "Error: Failed to download FFmpeg using curl from ${FFMPEG_DOWNLOAD_URL}"\n            exit 1\n        fi\n    elif command -v wget >/dev/null 2>&1; then\n        if ! wget -O "${FFMPEG_BIN}" "${FFMPEG_DOWNLOAD_URL}"; then\n            _log_internal "Error: Failed to download FFmpeg using wget from ${FFMPEG_DOWNLOAD_URL}"\n            exit 1\n        fi\n    else\n        _log_internal "Error: Neither curl nor wget found. Cannot download FFmpeg."\n        exit 1\n    fi\n    _log_internal "FFmpeg binary downloaded successfully to ${FFMPEG_BIN}"\n\n    chmod +x "${FFMPEG_BIN}"\n    _log_internal "Set executable permissions for ${FFMPEG_BIN}"\n\n    # Verify FFmpeg is executable after download\n    if [ ! -f "${FFMPEG_BIN}" ] || [ ! -x "${FFMPEG_BIN}" ]; then\n        _log_internal "Error: FFmpeg binary not found or not executable after download."\n        exit 1\n    fi\nfi\n\n_log_internal "FFmpeg installation complete. FFmpeg binary is at: ${FFMPEG_BIN}"\n\n# Function to check if a command exists\ncommand_exists() {\n  command -v "$1" >/dev/null 2>&1\n}\n\n# Function to log messages with timestamp\nlog() {\n  local timestamp\n  timestamp=$(date +"%Y-%m-%d %H:%M:%S")\n  echo "[${timestamp}] $1"\n}\n\n# Function to display error messages and exit\nerror_exit() {\n  log "ERROR: $1" >&2\n  exit "${2:-1}"\n}\n\n# Function to check if Python binary is valid for current architecture\nis_valid_python_binary() {\n  local python_path="$1"\n  \n  # First check if file exists and is executable\n  if [ ! -f "${python_path}" ] || [ ! -x "${python_path}" ]; then\n    return 1\n  fi\n  \n  # Try to run a simple Python command to verify it works on current architecture\n  "${python_path}" -c "print(\'Testing Python executable\')" >/dev/null 2>&1\n  return $?\n}\n\n# Check for network connectivity to key servers\ncheck_connectivity() {\n  log "Checking network connectivity..."\n  local servers=("pypi.org" "bootstrap.pypa.io")\n  local has_connectivity=false\n  \n  for server in "${servers[@]}"; do\n    if command_exists curl; then\n      if curl --connect-timeout 5 -s "https://${server}" -o /dev/null; then\n        has_connectivity=true\n        break\n      fi\n    elif command_exists wget; then\n      if wget --timeout=5 -q --spider "https://${server}"; then\n        has_connectivity=true\n        break\n      fi\n    fi\n  done\n  \n  if [ "$has_connectivity" = false ]; then\n    log "WARNING: Network connectivity issues detected. This may affect installation."\n  else\n    log "Network connectivity confirmed."\n  fi\n}\n\n# Call connectivity check\ncheck_connectivity\n\n# Check if PYTHON_BIN is already set by the installer\nif [ -n "${PYTHON_BIN:-}" ]; then\n  log "Using Python executable provided by installer: ${PYTHON_BIN}"\n  # Verify the provided Python binary works on this architecture\n  if ! is_valid_python_binary "${PYTHON_BIN}"; then\n    log "Warning: The provided Python binary is not compatible with this system architecture."\n    log "Will attempt to find a system Python installation instead."\n    PYTHON_BIN=""\n  fi\nfi\n\n# If PYTHON_BIN is empty or invalid, try to find a suitable Python installation\nif [ -z "${PYTHON_BIN:-}" ] || ! is_valid_python_binary "${PYTHON_BIN:-}"; then\n  # Try to find a suitable Python installation\n  log "Looking for a suitable Python installation..."\n  \n  # Try multiple possible locations to find Python\n  POSSIBLE_PYTHON_PATHS=(\n    # System paths first (more likely to be compatible with current architecture)\n    "/usr/local/bin/python3.12"\n    "/usr/bin/python3.12"\n    "/usr/local/bin/python3"\n    "/usr/bin/python3"\n    # From environment variable (set by the installer)\n    "${ELECTRON_RESOURCE_PATH:-}/python/bin/python3"\n    # Development paths\n    "$(dirname "$0")/../../../resources/python/bin/python3"\n    "$(pwd)/resources/python/bin/python3"\n  )\n\n  # Find the first Python that exists and is version 3.12+ and works on this architecture\n  PYTHON_BIN=""\n  for path in "${POSSIBLE_PYTHON_PATHS[@]}"; do\n    # Skip empty paths that might come from unset environment variables\n    if [ -z "${path}" ]; then\n      continue\n    fi\n    \n    if is_valid_python_binary "${path}"; then\n      # Check Python version\n      if PY_VERSION=$("${path}" -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')" 2>/dev/null); then\n        MAJOR=$(echo "${PY_VERSION}" | cut -d. -f1)\n        MINOR=$(echo "${PY_VERSION}" | cut -d. -f2)\n        if [ "${MAJOR}" -eq 3 ] && [ "${MINOR}" -ge 12 ]; then\n          PYTHON_BIN="${path}"\n          log "Found suitable Python ${PY_VERSION} at ${path}"\n          break\n        else\n          log "Python at ${path} is version ${PY_VERSION}, which is below the required 3.12+"\n        fi\n      fi\n    else\n      if [ -f "${path}" ]; then\n        log "Python at ${path} exists but is not compatible with this system architecture"\n      fi\n    fi\n  done\n\n  # If we couldn\'t find a suitable Python, exit with error\n  if [ -z "${PYTHON_BIN:-}" ]; then\n    error_exit "No suitable Python installation found (version 3.12 or higher required).\\nPlease install Python 3.12 or higher before running this script.\\nYou can install Python from https://www.python.org/downloads/"\n  fi\nfi\n\necho "Using Python: $PYTHON_BIN"\n"$PYTHON_BIN" --version || {\n  echo "Error: Failed to run Python. Please ensure it is executable and accessible."\n  echo "System architecture: $(uname -m)"\n  echo "Python binary architecture: $(file "$PYTHON_BIN" 2>/dev/null || echo \'Unable to determine\')"\n  exit 1\n}\n\n# Detect the Linux distribution to provide specific instructions\nif command_exists lsb_release; then\n  DISTRO=$(lsb_release -is)\n  DISTRO_VERSION=$(lsb_release -rs)\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelif [ -f /etc/os-release ]; then\n  DISTRO=$(grep -oP \'(?<=^ID=).+\' /etc/os-release | tr -d \'"\')\n  DISTRO_VERSION=$(grep -oP \'(?<=^VERSION_ID=).+\' /etc/os-release | tr -d \'"\')\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelse\n  DISTRO="unknown"\n  echo "Unable to detect Linux distribution"\nfi\n\n# Check if Python has venv module and ensurepip available\nlog "Checking for venv module and ensurepip availability..."\nVENV_AVAILABLE=0\nENSUREPIP_AVAILABLE=0\n\n"${PYTHON_BIN}" -c "import venv" > /dev/null 2>&1 || VENV_AVAILABLE=1\n"${PYTHON_BIN}" -c "import ensurepip" > /dev/null 2>&1 || ENSUREPIP_AVAILABLE=1\n\n# If venv is still not available, try to use virtualenv as a fallback\nif [ $VENV_AVAILABLE -ne 0 ]; then\n  echo "venv module is not available. Checking for virtualenv as an alternative..."\n  \n  # Check if virtualenv is already installed\n  if "$PYTHON_BIN" -c "import virtualenv" > /dev/null 2>&1; then\n    echo "virtualenv is available, will use it instead of venv"\n  else\n    echo "ERROR: Neither venv nor virtualenv is available."\n    echo "Python 3.12 and venv should be installed as package dependencies."\n    echo "Please ensure Python 3.12 and venv are properly installed on your system."\n    exit 1\n  fi\nfi\n\n# Create virtual environment if it doesn\'t exist\nif [ ! -d "$VENV_PATH" ]; then\n  echo "Creating virtual environment at $VENV_PATH..."\n  # Remove any potentially corrupted virtual environment\n  if [ -e "$VENV_PATH" ]; then\n    echo "Removing existing but potentially corrupted venv directory..."\n    rm -rf "$VENV_PATH"\n  fi\n  \n  # Make sure parent directory exists and is writable\n  mkdir -p "$(dirname "$VENV_PATH")"\n  \n  # Try different methods to create a virtual environment\n  VENV_CREATE_STATUS=1\n  \n  # First try with venv if available\n  if [ $VENV_AVAILABLE -eq 0 ] && [ $ENSUREPIP_AVAILABLE -eq 0 ]; then\n    echo "Creating virtual environment using venv module..."\n    "$PYTHON_BIN" -m venv "$VENV_PATH"\n    VENV_CREATE_STATUS=$?\n  fi\n  \n  # If venv failed, try virtualenv\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    echo "venv creation failed with status $VENV_CREATE_STATUS. Falling back to virtualenv..."\n    if command_exists virtualenv; then\n      virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    elif "$PYTHON_BIN" -m pip list | grep -q virtualenv; then\n      "$PYTHON_BIN" -m virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    else\n      echo "ERROR: Both venv and virtualenv are unavailable or failed."\n      echo "Python 3.12 and venv should be installed as package dependencies."\n      echo "Please ensure Python 3.12 and venv are properly installed on your system."\n      echo "You can install Python 3.12 from https://www.python.org/downloads/"\n      exit 1\n    fi\n  fi\n  \n  # Check if virtual environment creation was successful\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    log "ERROR: Failed to create virtual environment. Exit code: $VENV_CREATE_STATUS"\n    log "Virtual environment path: $VENV_PATH"\n    log "Python binary used: $PYTHON_BIN"\n    ls -la "$(dirname "$VENV_PATH")" || true\n    log "Python executable permissions:"\n    ls -la "$PYTHON_BIN" || true\n    \n    # Check for common issues\n    log "Checking for common virtual environment creation issues..."\n    \n    # Check disk space\n    df -h "$(dirname "$VENV_PATH")" || true\n    \n    # Check if directory is writable\n    if [ ! -w "$(dirname "$VENV_PATH")" ]; then\n      log "ERROR: Directory $(dirname "$VENV_PATH") is not writable"\n    fi\n    \n    # Try to create a minimal virtual environment manually as a last resort\n    log "Attempting to create a minimal virtual environment manually..."\n    mkdir -p "$VENV_PATH/bin" || error_exit "Could not create directory $VENV_PATH/bin"\n    echo "#!/bin/bash" > "$VENV_PATH/bin/activate"\n    echo "export VIRTUAL_ENV=\\"$VENV_PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "export PATH=\\"$VENV_PATH/bin:\\$PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "unset PYTHONHOME" >> "$VENV_PATH/bin/activate"\n    chmod +x "$VENV_PATH/bin/activate" || error_exit "Could not set execute permissions on activate script"\n    \n    # Create symlinks to the system Python\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python" || log "WARNING: Failed to create symlink for python"\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python3" || log "WARNING: Failed to create symlink for python3"\n    \n    # Try to bootstrap pip\n    log "Bootstrapping pip in the minimal virtual environment..."\n    if command_exists curl; then\n      curl -s https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py" || log "WARNING: Failed to download get-pip.py"\n    elif command_exists wget; then\n      wget -q -O "$APP_DATA_DIR/get-pip.py" https://bootstrap.pypa.io/get-pip.py || log "WARNING: Failed to download get-pip.py"\n    else\n      log "ERROR: Neither curl nor wget available to download get-pip.py"\n      error_exit "Installation cannot continue without being able to download pip"\n    fi\n    \n    # shellcheck disable=SC1090\n    source "$VENV_PATH/bin/activate" && python "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n    \n    if [ ! -f "$VENV_PATH/bin/pip" ]; then\n      error_exit "Failed to create even a minimal virtual environment."\n    else\n      log "Created a minimal virtual environment as a fallback."\n    fi\n  else\n    log "Successfully created virtual environment"\n  fi\nfi\n\n# Verify the virtual environment structure\necho "Verifying virtual environment structure..."\nif [ ! -f "$VENV_PATH/bin/python" ]; then\n  echo "Python executable missing in virtual environment, creating symlink..."\n  ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python"\nfi\n\nif [ ! -f "$VENV_PATH/bin/pip" ]; then\n  echo "pip missing in virtual environment, attempting to bootstrap it..."\n  curl -s https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py"\n  "$VENV_PATH/bin/python" "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n  \n  if [ ! -f "$VENV_PATH/bin/pip" ]; then\n    echo "ERROR: Failed to bootstrap pip in the virtual environment"\n    exit 1\n  fi\nfi\n\necho "Virtual environment structure verified"\n\n# Activate virtual environment and install local-operator\necho "Installing local-operator in virtual environment..."\nsource "$VENV_PATH/bin/activate"\n\necho "Upgrading pip..."\npython -m pip install --upgrade pip || {\n  echo "WARNING: Failed to upgrade pip. Will try to continue with existing pip version."\n  pip --version\n}\n\n# Check network connectivity to PyPI\necho "Checking network connectivity to PyPI..."\nif command_exists curl; then\n  curl -s https://pypi.org/pypi/local-operator/json -o /dev/null || {\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  }\nelif command_exists wget; then\n  wget -q --spider https://pypi.org/pypi/local-operator/json || {\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  }\nfi\n\necho "Installing local-operator package..."\npython -m pip install --verbose local-operator || {\n  echo "ERROR: Failed to install local-operator package. Exit code: $?"\n  echo "Python version:"\n  python --version\n  echo "pip version:"\n  pip --version\n  echo "Available pip packages:"\n  pip list\n  exit 1\n}\necho "local-operator installation successful"\n\n# Verify installation\nif [ -f "$VENV_PATH/bin/local-operator" ]; then\n  log "Local Operator backend installed successfully!"\n  \n  # Show more information about the installed binary\n  ls -la "$VENV_PATH/bin/local-operator" || true\n  file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n  \n  # Try to run the version command with full error output\n  log "Testing local-operator binary..."\n  "$VENV_PATH/bin/local-operator" --version || {\n    log "ERROR: local-operator binary exists but failed to execute. Exit code: $?"\n    log "Binary details:"\n    file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n    log "Binary permissions:"\n    ls -la "$VENV_PATH/bin/local-operator" || true\n    log ""\n    log "This could be due to missing dependencies or architecture incompatibility."\n    log "Try running the binary manually to see specific errors."\n    \n    # Don\'t exit here - just warn the user\n    log "WARNING: Installation completed but binary verification failed."\n  }\n  \n  # Create a summary of the installation\n  SUMMARY_FILE="${APP_DATA_DIR}/installation-summary-${TIMESTAMP}.txt"\n  {\n    echo "=== Local Operator Backend Installation Summary ==="\n    echo "Timestamp: $(date)"\n    echo "Python Version: $("${PYTHON_BIN}" --version 2>&1)"\n    echo "Virtual Environment: ${VENV_PATH}"\n    echo "Binary Location: ${VENV_PATH}/bin/local-operator"\n    echo "To activate the virtual environment, run: source ${VENV_PATH}/bin/activate"\n    echo "To test the installation, run: ${VENV_PATH}/bin/local-operator --version"\n    echo "Log file: ${LOG_FILE}"\n    echo "=================================================="\n  } > "${SUMMARY_FILE}"\n  \n  log "Installation summary saved to: ${SUMMARY_FILE}"\nelse\n  log "Error: Failed to install Local Operator backend. Binary not found."\n  log "Contents of bin directory:"\n  ls -la "$VENV_PATH/bin/" || true\n  log "Check the log file for details: ${LOG_FILE}"\n  error_exit "Installation failed. Binary not installed properly."\nfi\n\nlog "Installation completed successfully at $(date)"\n\n# Clean up temporary files now that installation is complete\ncleanup\n\n# Print final instructions\nlog ""\nlog "=== INSTALLATION COMPLETE ==="\nlog "You can now use the Local Operator backend by running: ${VENV_PATH}/bin/local-operator"\nlog "Installation directory: ${VENV_PATH}"\nlog "Log file: ${LOG_FILE}"\nlog "================================"\n';
-const macosInstallScriptRaw = '#!/bin/bash\n# Local Operator Backend Installation Script for macOS\n# This script uses the bundled standalone Python and sets up a virtual environment for the Local Operator backend.\n\nset -e  # Exit immediately if a command exits with a non-zero status\n\n# Configuration\nAPP_NAME="Local Operator"\nVENV_NAME="local-operator-venv"\nAPP_DATA_DIR="${LOCAL_OPERATOR_SUPPORT_PATH:-$HOME/Library/Application Support/$APP_NAME}"\nVENV_PATH="$APP_DATA_DIR/$VENV_NAME"\nLOG_FILE="$APP_DATA_DIR/backend-install.log"\n\n# Which environment this installs into. The path is the app\'s decision, not this\n# script\'s: a packaged install and an unpackaged one must not share an\n# environment (the venv is built on whatever interpreter the instance resolves,\n# and the installed bundle\'s stdlib lives inside the code-sealed .app), and only\n# the app knows which one it is. The app passes its answer in\n# (`LOCAL_OPERATOR_VENV_PATH`, set from `managedVenvPath` in\n# src/main/backend/venv-paths.ts).\n#\n# macOS REFUSES a standalone run rather than falling back, and the asymmetry with\n# the Linux and Windows scripts is deliberate. Their default is the packaged name,\n# which is harmless there; here it is the exact environment this split exists to\n# stop a second instance from writing into - the measured failure is a dev-venv\n# interpreter whose stdlib is `/Applications/Local Operator.app/Contents/\n# Resources/python_aarch64`, so a silent default would rebuild that venv and\n# `pip install` into it, which is what R1 of the review caught. A caller that\n# cannot name the environment is a caller that should not be installing into one.\n: "${LOCAL_OPERATOR_VENV_PATH:?Pass the resolved managed environment path (see venv-paths.ts); this script will not guess which instance it belongs to}"\nVENV_PATH="$LOCAL_OPERATOR_VENV_PATH"\n\n# Keep CPython\'s bytecode cache out of the application bundle.\n#\n# The bundled interpreter writes __pycache__/*.pyc beside the stdlib sources it\n# imports, and those sources live inside the code-signed .app - which is the\n# build\'s own extraResource. Every such write is a change to a sealed resource:\n# measured on an installed 0.17.3, `codesign --verify --deep` reported 308\n# `file added:` violations, all of them .pyc, and ShipIt then refuses the\n# in-place update with -67028 errSecCSBadBundleFormat. A file codesign reports\n# as *added* can be deleted and the seal comes back; a *modified* one cannot,\n# which is why nothing may ship a .pyc at all. The app sets this variable when\n# it spawns us; defaulting it here keeps a standalone run of this script in\n# agreement with the app about where bytecode goes. It is not a complete answer:\n# the app does not spawn every python that runs this interpreter, and a python\n# started by something else - a shell, a CLI script, an agent - has no prefix at\n# all (measured: a venv over this tree wrote 25 .pyc into it that way). The half\n# that covers those is the app\'s seal on the tree itself\n# (src/main/python-bytecode-cache.ts), which a standalone run of this script does\n# not apply. $HOME is the right place for the cache for the same reason the venv\n# lives there: it is never inside the thing that gets signed and swapped.\n: "${PYTHONPYCACHEPREFIX:=$APP_DATA_DIR/python-bytecode-cache}"\nexport PYTHONPYCACHEPREFIX\n\n# And the refusal half of the same pair, so a standalone run of this script\n# cannot write bytecode into the bundle even where the redirect above does not\n# apply - a relative or unwritable prefix, or a child that drops the variable.\n# CPython reads the flag before its first import, so this script\'s own\n# `python -m venv`, its pip runs and the venv they create all compile without\n# writing a `__pycache__` anywhere. Measured on CPython: `0` and the empty\n# string are the two falsy spellings, so the value is set rather than merged\n# with whatever the caller had.\nexport PYTHONDONTWRITEBYTECODE=1\n\n# The architecture block that used to live here computed and logged the name of\n# a directory for an in-bundle search this script no longer performs: every run\n# announced which architecture-named directory it was about to use, and then\n# installed from `PYTHON_BIN` anyway - the line stated the opposite of how the\n# script finds Python, and the names it computed were used nowhere else (review\n# N1). Which interpreter to build the environment with is the caller\'s decision,\n# checked immediately below.\n\n# The app prepares a complete external runtime before invoking this script.\n# Searching /Applications here would reintroduce legacy-bundle execution during\n# migration. Standalone callers must make the same explicit path decision.\n: "${PYTHON_BIN:?Pass an external prepared Python executable}"\ncase "$PYTHON_BIN" in\n  *.app/*) echo "Refusing to execute Python inside an application bundle" >&2; exit 1 ;;\nesac\n\n# Create app data directory if it doesn\'t exist\nmkdir -p "$APP_DATA_DIR"\n\n# Start logging - capture everything and ensure it\'s visible to parent process\nexec > >(tee -a "$LOG_FILE") 2> >(tee -a "$LOG_FILE" >&2)\necho "=============================================="\necho "$(date): Starting Local Operator backend installation..."\necho "=============================================="\necho "Python bin path: $PYTHON_BIN"\necho "Virtual environment path: $VENV_PATH"\necho "App data directory: $APP_DATA_DIR"\necho "Log file: $LOG_FILE"\necho "=============================================="\n\n# --- FFmpeg Installation ---\nBIN_DIR="$APP_DATA_DIR/bin"\nFFMPEG_BIN="$BIN_DIR/ffmpeg"\n\necho "Ensuring bin directory exists: $BIN_DIR"\nmkdir -p "$BIN_DIR"\n\n# Check if FFmpeg is already installed and executable\nif [ -f "$FFMPEG_BIN" ] && [ -x "$FFMPEG_BIN" ]; then\n    echo "FFmpeg already installed at $FFMPEG_BIN. Skipping download."\nelse\n    echo "FFmpeg not found or not executable. Attempting to download and install FFmpeg..."\n\n    # The architecture, read here because this URL is the one place left that needs\n    # it: the environment is built on `PYTHON_BIN`, handed in above, so nothing\n    # else in this script derives anything from `uname -m`. The block that used to\n    # compute it at the top of the file was removed with the in-bundle interpreter\n    # search it existed for (review N1) - and that removal took this variable with\n    # it while this block still read it, so `$ARCH` was empty for every caller,\n    # including the app, and any install on a machine without a cached ffmpeg\n    # exited 1 here, before the venv was ever created. Measured: `bash\n    # src/main/backend/scripts/macos-install-script.sh` with `PYTHON_BIN` set stops\n    # on "Unsupported CPU architecture for FFmpeg download:".\n    ARCH=$(uname -m)\n\n    FFMPEG_DOWNLOAD_URL=""\n\n    if [[ "$ARCH" == "x86_64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-mac-x64"\n    elif [[ "$ARCH" == "arm64" ]] || [[ "$ARCH" == "aarch64" ]]; then\n        FFMPEG_DOWNLOAD_URL="https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-mac-arm64"\n    else\n        echo "Error: Unsupported CPU architecture for FFmpeg download: $ARCH"\n        exit 1\n    fi\n\n    echo "Downloading FFmpeg from: $FFMPEG_DOWNLOAD_URL"\n    if curl -L "$FFMPEG_DOWNLOAD_URL" -o "$FFMPEG_BIN"; then\n        echo "FFmpeg downloaded successfully to $FFMPEG_BIN"\n        chmod +x "$FFMPEG_BIN"\n        echo "Set executable permissions for $FFMPEG_BIN"\n    else\n        echo "Error: Failed to download FFmpeg from $FFMPEG_DOWNLOAD_URL"\n        exit 1\n    fi\n\n    # Verify FFmpeg is executable after download\n    if [ ! -f "$FFMPEG_BIN" ] || [ ! -x "$FFMPEG_BIN" ]; then\n        echo "Error: FFmpeg binary not found or not executable after download."\n        exit 1\n    fi\nfi\n\necho "FFmpeg installation complete. FFmpeg binary is at: $FFMPEG_BIN"\n# --- End FFmpeg Installation ---\n\n# Verify bundled Python exists\nif [ ! -f "$PYTHON_BIN" ]; then\n  echo "Error: Bundled Python not found at $PYTHON_BIN"\n  echo "Please ensure standalone Python is properly installed in the application resources."\n  exit 1\nfi\n\n# Make sure Python binary is executable\necho "Using bundled Python: $PYTHON_BIN"\n"$PYTHON_BIN" --version\n\n# Check if Python has venv module available\necho "Checking for venv module availability..."\n"$PYTHON_BIN" -m venv --help > /dev/null 2>&1 || {\n  echo "ERROR: Python venv module not available in the Python installation"\n  echo "Python details:"\n  "$PYTHON_BIN" --version\n  "$PYTHON_BIN" -c "import sys; print(\'Prefix:\', sys.prefix); print(\'Exec Prefix:\', sys.exec_prefix)"\n  "$PYTHON_BIN" -c "import sys; print(\'Modules path:\'); print(\'\\n\'.join(sys.path))"\n  exit 1\n}\necho "venv module is available"\n\n# Create virtual environment if it doesn\'t exist\nif [ ! -d "$VENV_PATH" ]; then\n  echo "Creating virtual environment at $VENV_PATH..."\n  # Never repair a path we did not create. Preparation allocates a fresh final\n  # pathname; a collision is evidence to preserve, not a reason to delete it.\n  if [ -e "$VENV_PATH" ] || [ -L "$VENV_PATH" ]; then\n    echo "Refusing to replace an existing environment path: $VENV_PATH" >&2\n    exit 1\n  fi\n  \n  # Make sure parent directory exists and is writable\n  mkdir -p "$(dirname "$VENV_PATH")"\n  \n  # Create the virtual environment with verbosity\n  "$PYTHON_BIN" -m venv "$VENV_PATH" || {\n    echo "ERROR: Failed to create virtual environment. Exit code: $?"\n    echo "Virtual environment path: $VENV_PATH"\n    echo "Python binary used: $PYTHON_BIN"\n    ls -la "$(dirname "$VENV_PATH")"\n    echo "Python executable permissions:"\n    ls -la "$PYTHON_BIN"\n    exit 1\n  }\n  echo "Successfully created virtual environment"\nfi\n\n# Verify the virtual environment structure\necho "Verifying virtual environment structure..."\nif [ ! -f "$VENV_PATH/bin/python" ] || [ ! -f "$VENV_PATH/bin/pip" ]; then\n  echo "ERROR: Virtual environment is missing critical components"\n  echo "Contents of virtual environment directory:"\n  ls -la "$VENV_PATH"\n  if [ -d "$VENV_PATH/bin" ]; then\n    echo "Contents of bin directory:"\n    ls -la "$VENV_PATH/bin"\n  fi\n  exit 1\nfi\necho "Virtual environment structure verified"\n\n# Activate virtual environment and install local-operator\necho "Installing local-operator in virtual environment..."\nsource "$VENV_PATH/bin/activate"\n\necho "Upgrading pip..."\npython -m pip install --upgrade pip || {\n  echo "ERROR: Failed to upgrade pip. Exit code: $?"\n  echo "pip version before failing:"\n  pip --version\n  exit 1\n}\necho "pip upgrade successful:"\npip --version\n\n# Check network connectivity to PyPI\necho "Checking network connectivity to PyPI..."\ncurl -s https://pypi.org/pypi/local-operator/json -o /dev/null || {\n  echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  echo "Attempting to ping common domains to diagnose network issues:"\n  ping -c 1 google.com || echo "Cannot ping google.com"\n  ping -c 1 pypi.org || echo "Cannot ping pypi.org"\n}\n\necho "Installing local-operator package..."\npython -m pip install --upgrade --verbose local-operator || {\n  echo "ERROR: Failed to install local-operator package. Exit code: $?"\n  echo "Python version:"\n  python --version\n  echo "pip version:"\n  pip --version\n  echo "Available pip packages:"\n  pip list\n  echo "Pip config:"\n  pip config list\n  echo "Network diagnosis:"\n  curl -I https://pypi.org || echo "Cannot reach PyPI server"\n  exit 1\n}\necho "local-operator installation successful"\n\n# Verify installation\nif [ -f "$VENV_PATH/bin/local-operator" ]; then\n  echo "Local Operator backend installed successfully!"\n  \n  # Show more information about the installed binary\n  ls -la "$VENV_PATH/bin/local-operator"\n  file "$VENV_PATH/bin/local-operator"\n  \n  # Try to run the version command with full error output\n  echo "Testing local-operator binary..."\n  "$VENV_PATH/bin/local-operator" --version || {\n    echo "ERROR: local-operator binary exists but failed to execute. Exit code: $?"\n    echo "Binary details:"\n    file "$VENV_PATH/bin/local-operator"\n    echo "Binary permissions:"\n    ls -la "$VENV_PATH/bin/local-operator"\n    echo "Dependencies:"\n    if command -v otool >/dev/null; then\n      otool -L "$VENV_PATH/bin/local-operator" || echo "Could not get dependencies with otool"\n    fi\n    exit 1\n  }\nelse\n  echo "Error: Failed to install Local Operator backend. Binary not found."\n  echo "Contents of bin directory:"\n  ls -la "$VENV_PATH/bin/"\n  exit 1\nfi\n\necho "$(date): Installation completed successfully."\n';
-const windowsInstallScriptRaw = `# Local Operator Backend Installation Script for Windows
-# This script installs pyenv-win, Python 3.12, and sets up a virtual environment for the Local Operator backend.
-
-# Configuration
-$AppName = "Local Operator"
-$PythonVersion = "3.12.0"
-$VenvName = "local-operator-venv"
-$AppDataDir = "$env:APPDATA\\\\$AppName"
-$VenvPath = "$AppDataDir\\\\$VenvName"
-$LogFile = "$AppDataDir\\\\backend-install-shell.log"
-$PyenvDir = "$env:USERPROFILE\\\\.pyenv"
-
-# Which environment this installs into - the app's decision, handed in rather
-# than re-derived. A packaged install and an unpackaged one must not share an
-# environment (the venv is built on whatever interpreter the instance resolves),
-# and only the app knows which it is: LOCAL_OPERATOR_VENV_PATH carries
-# managedVenvPath's answer (src/main/backend/venv-paths.ts). The default above is
-# what a standalone run uses - the packaged name, because that is what every
-# install on a disk today has.
-if ($env:LOCAL_OPERATOR_VENV_PATH) {
-    $VenvPath = $env:LOCAL_OPERATOR_VENV_PATH
-}
-
-# Keep CPython's bytecode cache out of the application directory.
-#
-# Same rule as the macOS script, and stated here for the same reason: an
-# interpreter writes __pycache__/*.pyc beside the stdlib sources it imports. On
-# Windows those sources are the bundled python directory rather than a
-# code-signed bundle, so this is hygiene rather than the load-bearing fix it is
-# on macOS - but the app and the script must not disagree about where bytecode
-# goes. $AppDataDir is used for the same reason the venv is: it is never inside
-# the installed application tree.
-if (-not $env:PYTHONPYCACHEPREFIX) {
-    $env:PYTHONPYCACHEPREFIX = "$AppDataDir\\\\python-bytecode-cache"
-}
-
-# The refusal half of the same pair, kept in step with the app's
-# \`withPythonBytecodeCache\`: CPython reads the flag before its first import, so
-# nothing this script runs can write a __pycache__ at all.
-$env:PYTHONDONTWRITEBYTECODE = "1"
-
-# Create app data directory if it doesn't exist
-if (-not (Test-Path $AppDataDir)) {
-    New-Item -ItemType Directory -Path $AppDataDir -Force | Out-Null
-}
-
-# Start logging
-Start-Transcript -Path $LogFile -Append
-Write-Output "$(Get-Date): Starting Local Operator backend installation..."
-
-$BinDir = "$AppDataDir\\\\bin"
-$FFmpegBin = "$BinDir\\\\ffmpeg.exe"
-
-Write-Output "Ensuring bin directory exists: $BinDir"
-if (-not (Test-Path $BinDir)) {
-    New-Item -ItemType Directory -Path $BinDir -Force | Out-Null
-}
-
-# Check if FFmpeg is already installed
-if (Test-Path $FFmpegBin) {
-    Write-Output "FFmpeg already installed at $FFmpegBin. Skipping download."
-} else {
-    Write-Output "FFmpeg not found. Attempting to download and install FFmpeg..."
-
-    $FFmpegDownloadUrl = ""
-    
-    # Determine architecture and set appropriate download URL
-    if ($env:PROCESSOR_ARCHITECTURE -eq "AMD64" -or $env:PROCESSOR_ARCHITEW6432 -eq "AMD64") {
-        $FFmpegDownloadUrl = "https://github.com/eugeneware/ffmpeg-static/releases/download/b6.0/ffmpeg-win32-x64"
-    } else {
-        Write-Error "Unsupported CPU architecture for FFmpeg download: $env:PROCESSOR_ARCHITECTURE"
-        exit 1
-    }
-
-    Write-Output "Downloading FFmpeg from: $FFmpegDownloadUrl"
-    try {
-        Invoke-WebRequest -Uri $FFmpegDownloadUrl -OutFile $FFmpegBin -ErrorAction Stop
-        Write-Output "FFmpeg downloaded successfully to $FFmpegBin"
-        
-        # Verify FFmpeg is accessible after download
-        if (-not (Test-Path $FFmpegBin)) {
-            Write-Error "FFmpeg binary not found at $FFmpegBin after download."
-            exit 1
-        }
-    } catch {
-        Write-Error "Failed to download FFmpeg: $($_.Exception.Message)"
-        exit 1
-    }
-}
-Write-Output "FFmpeg installation complete. FFmpeg binary is at: $FFmpegBin"
-
-# Function to check if a command exists
-function Test-CommandExists {
-    param ($command)
-    $oldPreference = $ErrorActionPreference
-    $ErrorActionPreference = 'stop'
-    try {
-        if (Get-Command $command) { return $true }
-    } catch {
-        return $false
-    } finally {
-        $ErrorActionPreference = $oldPreference
-    }
-}
-
-# Install pyenv-win if not installed
-if (-not (Test-Path $PyenvDir)) {
-    Write-Output "Installing pyenv-win..."
-    
-    # Create temporary directory
-    $TempDir = "$env:TEMP\\\\pyenv-win"
-    if (Test-Path $TempDir) {
-        Remove-Item -Path $TempDir -Recurse -Force
-    }
-    New-Item -ItemType Directory -Path $TempDir -Force | Out-Null
-    
-    # Download and extract pyenv-win
-    $PyenvZip = "$TempDir\\\\pyenv-win.zip"
-    Invoke-WebRequest -Uri "https://github.com/pyenv-win/pyenv-win/archive/master.zip" -OutFile $PyenvZip
-    Expand-Archive -Path $PyenvZip -DestinationPath $TempDir
-    
-    # Create .pyenv directory
-    New-Item -ItemType Directory -Path $PyenvDir -Force | Out-Null
-    
-    # Copy pyenv-win files
-    Copy-Item -Path "$TempDir\\\\pyenv-win-master\\\\*" -Destination $PyenvDir -Recurse
-    
-    # Set environment variables
-    [System.Environment]::SetEnvironmentVariable("PYENV", "$PyenvDir\\\\pyenv-win", "User")
-    [System.Environment]::SetEnvironmentVariable("PYENV_HOME", "$PyenvDir\\\\pyenv-win", "User")
-    
-    # Update PATH - ensure both bin and shims are added separately for better compatibility
-    $Path = [System.Environment]::GetEnvironmentVariable("PATH", "User")
-    $PyenvBinPath = "$PyenvDir\\\\pyenv-win\\\\bin"
-    $PyenvShimsPath = "$PyenvDir\\\\pyenv-win\\\\shims"
-    
-    # Add bin path if not already in PATH
-    if ($Path -notlike "*$PyenvBinPath*") {
-        [System.Environment]::SetEnvironmentVariable("PATH", "$PyenvBinPath;$Path", "User")
-        $Path = [System.Environment]::GetEnvironmentVariable("PATH", "User")
-    }
-    
-    # Add shims path if not already in PATH
-    if ($Path -notlike "*$PyenvShimsPath*") {
-        [System.Environment]::SetEnvironmentVariable("PATH", "$PyenvShimsPath;$Path", "User")
-    }
-    
-    # Set PYENV environment variables
-    [System.Environment]::SetEnvironmentVariable("PYENV", "$PyenvDir\\\\pyenv-win", "User")
-    [System.Environment]::SetEnvironmentVariable("PYENV_HOME", "$PyenvDir\\\\pyenv-win", "User")
-    
-    # Update current session PATH
-    $env:PYENV = "$PyenvDir\\\\pyenv-win"
-    $env:PYENV_HOME = "$PyenvDir\\\\pyenv-win"
-    $env:PATH = "$PyenvDir\\\\pyenv-win\\\\bin;$PyenvDir\\\\pyenv-win\\\\shims;$env:PATH"
-    
-    # Refresh environment variables for the current process
-    $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "User") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "Machine")
-    
-    # Clean up
-    Remove-Item -Path $TempDir -Recurse -Force
-}
-
-# Refresh environment variables for current session
-$env:PYENV = "$PyenvDir\\\\pyenv-win"
-$env:PYENV_HOME = "$PyenvDir\\\\pyenv-win"
-$env:PATH = "$PyenvDir\\\\pyenv-win\\\\bin;$PyenvDir\\\\pyenv-win\\\\shims;$env:PATH"
-
-# Install Python 3.12 if not installed
-$PythonInstalled = $false
-try {
-    $InstalledVersions = & pyenv versions
-    if ($InstalledVersions -like "*$PythonVersion*") {
-        $PythonInstalled = $true
-    }
-} catch {
-    $PythonInstalled = $false
-}
-
-if (-not $PythonInstalled) {
-    Write-Output "Installing Python $PythonVersion..."
-    & pyenv install $PythonVersion
-    if ($LASTEXITCODE -ne 0) {
-        Write-Error "Failed to install Python $PythonVersion"
-        exit 1
-    }
-}
-
-# Set Python 3.12 as the local version
-& pyenv local $PythonVersion
-if ($LASTEXITCODE -ne 0) {
-    Write-Error "Failed to set Python $PythonVersion as local version"
-    exit 1
-}
-
-# Create virtual environment if it doesn't exist
-if (-not (Test-Path $VenvPath)) {
-    Write-Output "Creating virtual environment at $VenvPath..."
-    
-    # Ensure the directory exists
-    if (-not (Test-Path $AppDataDir)) {
-        New-Item -ItemType Directory -Path $AppDataDir -Force | Out-Null
-        Write-Output "Created directory: $AppDataDir"
-    }
-    
-    # Use the full path to python from pyenv
-    $PythonExe = "$PyenvDir\\\\pyenv-win\\\\versions\\\\$PythonVersion\\\\python.exe"
-    
-    if (Test-Path $PythonExe) {
-        Write-Output "Using Python at: $PythonExe"
-        & $PythonExe -m venv $VenvPath
-    } else {
-        Write-Output "Using system Python"
-        & python -m venv $VenvPath
-    }
-    
-    if ($LASTEXITCODE -ne 0) {
-        Write-Error "Failed to create virtual environment"
-        exit 1
-    }
-}
-
-# Verify the virtual environment was created
-if (-not (Test-Path "$VenvPath\\\\Scripts\\\\Activate.ps1")) {
-    Write-Error "Virtual environment activation script not found at $VenvPath\\\\Scripts\\\\Activate.ps1"
-    exit 1
-}
-
-# Activate virtual environment and install local-operator
-Write-Output "Installing local-operator in virtual environment..."
-# Use PowerShell to run the activation script
-& "$VenvPath\\\\Scripts\\\\Activate.ps1"
-& python -m pip install --upgrade pip
-& python -m pip install --upgrade local-operator
-
-if ($LASTEXITCODE -ne 0) {
-    Write-Error "Failed to install packages in virtual environment"
-    exit 1
-}
-
-# Verify installation
-$LocalOperatorInstalled = $false
-try {
-    # First try to run local-operator directly (it should be in PATH from the activated venv)
-    $Version = & local-operator --version
-    $LocalOperatorInstalled = $true
-    Write-Output "Local Operator backend installed successfully!"
-    Write-Output $Version
-} catch {
-    Write-Output "Could not run local-operator directly, trying with full path..."
-    try {
-        # Try with explicit path
-        $LocalOperatorExe = "$VenvPath\\\\Scripts\\\\local-operator.exe"
-        if (Test-Path $LocalOperatorExe) {
-            $Version = & $LocalOperatorExe --version
-            $LocalOperatorInstalled = $true
-            Write-Output "Local Operator backend installed successfully at $LocalOperatorExe!"
-            Write-Output $Version
-        } else {
-            # Try without .exe extension
-            $LocalOperatorCmd = "$VenvPath\\\\Scripts\\\\local-operator"
-            if (Test-Path $LocalOperatorCmd) {
-                $Version = & $LocalOperatorCmd --version
-                $LocalOperatorInstalled = $true
-                Write-Output "Local Operator backend installed successfully at $LocalOperatorCmd!"
-                Write-Output $Version
-            } else {
-                Write-Error "Error: local-operator executable not found in expected locations."
-                
-                # Create a symlink to make it more accessible
-                Write-Output "Attempting to create a symlink for local-operator..."
-                $PythonModule = "$VenvPath\\\\Lib\\\\site-packages\\\\local_operator"
-                if (Test-Path $PythonModule) {
-                    Write-Output "Found local_operator module at $PythonModule"
-                    
-                    # Create a batch file that runs the module
-                    $BatchContent = "@echo off\`npython -m local_operator %*"
-                    Set-Content -Path "$VenvPath\\\\Scripts\\\\local-operator.bat" -Value $BatchContent
-                    
-                    # Test the batch file
-                    if (Test-Path "$VenvPath\\\\Scripts\\\\local-operator.bat") {
-                        Write-Output "Created local-operator.bat in Scripts directory"
-                        $LocalOperatorInstalled = $true
-                    } else {
-                        Write-Error "Failed to create local-operator.bat"
-                        exit 1
-                    }
-                } else {
-                    Write-Error "local_operator module not found in site-packages"
-                    exit 1
-                }
-            }
-        }
-    } catch {
-        Write-Error "Error: Failed to install Local Operator backend."
-        Write-Error $_.Exception.Message
-        exit 1
-    }
-}
-
-# If we got here, installation was successful
-if ($LocalOperatorInstalled) {
-    Write-Output "Local Operator backend installation verified."
-} else {
-    Write-Error "Error: Failed to verify Local Operator backend installation."
-    exit 1
-}
-
-Write-Output "$(Get-Date): Installation completed successfully."
-
-# Properly close the transcript and ensure it's released
-try {
-    Write-Output "Finalizing installation and releasing resources..."
-    # Flush any pending output
-    [System.Console]::Out.Flush()
-    # Stop transcript properly
-    Stop-Transcript
-    
-    # Add a small delay to ensure file handles are released
-    Start-Sleep -Seconds 1
-    
-    # Explicitly release any COM objects
-    [System.GC]::Collect()
-    [System.GC]::WaitForPendingFinalizers()
-    
-    Write-Output "Installation completed and resources released."
-} catch {
-    Write-Error "Error during cleanup: $_"
-}
-`;
+const linuxInstallScriptRaw = '#!/bin/bash\n# Local Operator Backend Installation Script for Linux\n# This script sets up a virtual environment for the Local Operator backend\n# without requiring sudo or admin privileges.\n\n# Exit on error, undefined variables, and failed pipe commands\nset -e  # Exit immediately if a command exits with a non-zero status\nset -u  # Error on unset variables\nset -o pipefail  # Fail if any command in a pipe fails\n\n# Configuration\n# Variables APP_NAME and MIN_PYTHON_VERSION removed as they were unused\nVENV_NAME="local-operator-venv"\nAPP_DATA_DIR="${HOME}/.config/local-operator"\nVENV_PATH="${APP_DATA_DIR}/${VENV_NAME}"\nLOG_FILE="${APP_DATA_DIR}/backend-install.log"\nTIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")\n\n# Which environment this installs into - the app\'s decision, handed in. See the\n# macOS script for why the script must not re-derive it (a packaged and an\n# unpackaged instance use different environments, and only the app knows which\n# it is); `LOCAL_OPERATOR_VENV_PATH` is set from `managedVenvPath`.\n: "${LOCAL_OPERATOR_VENV_PATH:=$VENV_PATH}"\nVENV_PATH="$LOCAL_OPERATOR_VENV_PATH"\n\n# Keep CPython\'s bytecode cache out of the application directory.\n#\n# Same reason as the macOS script: an interpreter writing __pycache__/*.pyc\n# beside its own stdlib sources writes into the installed tree. Linux does not\n# code-seal the app the way macOS does, so this is uniformity and hygiene here\n# rather than the load-bearing fix it is on macOS - but it is also the value a\n# standalone run of this script has to agree with, because the app and the\n# script must not disagree about where bytecode goes.\n: "${PYTHONPYCACHEPREFIX:=${APP_DATA_DIR}/python-bytecode-cache}"\nexport PYTHONPYCACHEPREFIX\n\n# The refusal half of the pair, set rather than merged with whatever the caller\n# had: CPython reads the flag before its first import, so nothing this script\n# runs - `-m venv`, pip, the venv they create - can write a `__pycache__` at\n# all. Kept in step with the app\'s `withPythonBytecodeCache`, which sets both\n# variables on every python it spawns.\nexport PYTHONDONTWRITEBYTECODE=1\n\n# Create app data directory if it doesn\'t exist\nif ! mkdir -p "${APP_DATA_DIR}"; then\n  echo "ERROR: Unable to create app data directory at ${APP_DATA_DIR}"\n  echo "Please check permissions and try again."\n  exit 1\nfi\n\n# Handle cleanup on script exit\ncleanup() {\n  # Remove any temporary files created during execution\n  if [ -f "${APP_DATA_DIR}/get-pip.py" ]; then\n    rm -f "${APP_DATA_DIR}/get-pip.py"\n  fi\n  echo "$(date): Cleanup completed."\n}\n\n# Set trap only for manual interruption (SIGINT, SIGTERM), not normal exits\ntrap cleanup SIGINT SIGTERM\n\n\n# Start logging\nexec > >(tee -a "${LOG_FILE}") 2>&1\necho "[${TIMESTAMP}]: Starting Local Operator backend installation..."\necho "[${TIMESTAMP}]: System information: $(uname -a)"\n\n# Nothing is fetched here but the package itself.\n#\n# This script used to download a third-party FFmpeg binary from a GitHub release\n# into `${APP_DATA_DIR}/bin`, and under `set -e` a failed download killed the\n# install before the venv existed - so a machine that can reach PyPI but not\n# github.com could not install at all. Nothing in the app or in `local-operator`\n# ever executed that binary. Tooling a task actually needs is acquired later, on\n# demand, through the app\'s Console with the user\'s approval; this script\'s job is\n# the environment below and nothing else. (`_log_internal`, the logging helper\n# that read like a second `log` and existed only for that section, went with it.)\n# Function to check if a command exists\ncommand_exists() {\n  command -v "$1" >/dev/null 2>&1\n}\n\n# Function to log messages with timestamp\nlog() {\n  local timestamp\n  timestamp=$(date +"%Y-%m-%d %H:%M:%S")\n  echo "[${timestamp}] $1"\n}\n\n# Function to display error messages and exit\nerror_exit() {\n  log "ERROR: $1" >&2\n  exit "${2:-1}"\n}\n\n# Function to check if Python binary is valid for current architecture\nis_valid_python_binary() {\n  local python_path="$1"\n  \n  # First check if file exists and is executable\n  if [ ! -f "${python_path}" ] || [ ! -x "${python_path}" ]; then\n    return 1\n  fi\n  \n  # Try to run a simple Python command to verify it works on current architecture\n  "${python_path}" -c "print(\'Testing Python executable\')" >/dev/null 2>&1\n  return $?\n}\n\n# Check for network connectivity to key servers.\n#\n# Bounded on both spellings: `--connect-timeout 5`/`--max-time 30` for curl and\n# `--timeout=30`/`--tries=1` for wget (a single attempt, whose timeout covers\n# connect and read since wget has no separate connect bound for BusyBox). 5 ends\n# a black-hole network; 30 is the stall bound and is deliberately well above a\n# slow-but-working link\'s answer time, because a probe that fails a working\n# connection is noise users learn to ignore.\n#\n# `--fail` turns an HTTP error status into a non-zero exit (a proxy\'s 403/407,\n# any 4xx/5xx). It does NOT notice a captive portal answering 200 with its own\n# HTML page - measured, a portal-shaped 200 exits 0 with and without the flag -\n# so this check answers "did a request to the host complete", and the PyPI probe\n# below is the one that also checks WHAT came back.\ncheck_connectivity() {\n  log "Checking network connectivity..."\n  local servers=("pypi.org" "bootstrap.pypa.io")\n  local has_connectivity=false\n  \n  for server in "${servers[@]}"; do\n    if command_exists curl; then\n      if curl --fail --connect-timeout 5 --max-time 30 -s "https://${server}" -o /dev/null; then\n        has_connectivity=true\n        break\n      fi\n    elif command_exists wget; then\n      if wget --timeout=30 --tries=1 -q --spider "https://${server}"; then\n        has_connectivity=true\n        break\n      fi\n    fi\n  done\n  \n  if [ "$has_connectivity" = false ]; then\n    log "WARNING: Network connectivity issues detected. This may affect installation."\n  else\n    log "Network connectivity confirmed."\n  fi\n}\n\n# Call connectivity check\ncheck_connectivity\n\n# Check if PYTHON_BIN is already set by the installer\nif [ -n "${PYTHON_BIN:-}" ]; then\n  log "Using Python executable provided by installer: ${PYTHON_BIN}"\n  # Verify the provided Python binary works on this architecture\n  if ! is_valid_python_binary "${PYTHON_BIN}"; then\n    log "Warning: The provided Python binary is not compatible with this system architecture."\n    log "Will attempt to find a system Python installation instead."\n    PYTHON_BIN=""\n  fi\nfi\n\n# If PYTHON_BIN is empty or invalid, try to find a suitable Python installation\nif [ -z "${PYTHON_BIN:-}" ] || ! is_valid_python_binary "${PYTHON_BIN:-}"; then\n  # Try to find a suitable Python installation\n  log "Looking for a suitable Python installation..."\n  \n  # Try multiple possible locations to find Python\n  POSSIBLE_PYTHON_PATHS=(\n    # System paths first (more likely to be compatible with current architecture)\n    "/usr/local/bin/python3.12"\n    "/usr/bin/python3.12"\n    "/usr/local/bin/python3"\n    "/usr/bin/python3"\n    # From environment variable (set by the installer)\n    "${ELECTRON_RESOURCE_PATH:-}/python/bin/python3"\n    # Development paths\n    "$(dirname "$0")/../../../resources/python/bin/python3"\n    "$(pwd)/resources/python/bin/python3"\n  )\n\n  # Find the first Python that exists and is version 3.12+ and works on this architecture\n  PYTHON_BIN=""\n  for path in "${POSSIBLE_PYTHON_PATHS[@]}"; do\n    # Skip empty paths that might come from unset environment variables\n    if [ -z "${path}" ]; then\n      continue\n    fi\n    \n    if is_valid_python_binary "${path}"; then\n      # Check Python version\n      if PY_VERSION=$("${path}" -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')" 2>/dev/null); then\n        MAJOR=$(echo "${PY_VERSION}" | cut -d. -f1)\n        MINOR=$(echo "${PY_VERSION}" | cut -d. -f2)\n        if [ "${MAJOR}" -eq 3 ] && [ "${MINOR}" -ge 12 ]; then\n          PYTHON_BIN="${path}"\n          log "Found suitable Python ${PY_VERSION} at ${path}"\n          break\n        else\n          log "Python at ${path} is version ${PY_VERSION}, which is below the required 3.12+"\n        fi\n      fi\n    else\n      if [ -f "${path}" ]; then\n        log "Python at ${path} exists but is not compatible with this system architecture"\n      fi\n    fi\n  done\n\n  # If we couldn\'t find a suitable Python, exit with error\n  if [ -z "${PYTHON_BIN:-}" ]; then\n    error_exit "No suitable Python installation found (version 3.12 or higher required).\\nPlease install Python 3.12 or higher before running this script.\\nYou can install Python from https://www.python.org/downloads/"\n  fi\nfi\n\necho "Using Python: $PYTHON_BIN"\n"$PYTHON_BIN" --version || {\n  echo "Error: Failed to run Python. Please ensure it is executable and accessible."\n  echo "System architecture: $(uname -m)"\n  echo "Python binary architecture: $(file "$PYTHON_BIN" 2>/dev/null || echo \'Unable to determine\')"\n  exit 1\n}\n\n# Detect the Linux distribution to provide specific instructions\nif command_exists lsb_release; then\n  DISTRO=$(lsb_release -is)\n  DISTRO_VERSION=$(lsb_release -rs)\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelif [ -f /etc/os-release ]; then\n  DISTRO=$(grep -oP \'(?<=^ID=).+\' /etc/os-release | tr -d \'"\')\n  DISTRO_VERSION=$(grep -oP \'(?<=^VERSION_ID=).+\' /etc/os-release | tr -d \'"\')\n  echo "Detected Linux distribution: $DISTRO $DISTRO_VERSION"\nelse\n  DISTRO="unknown"\n  echo "Unable to detect Linux distribution"\nfi\n\n# Check if Python has venv module and ensurepip available\nlog "Checking for venv module and ensurepip availability..."\nVENV_AVAILABLE=0\nENSUREPIP_AVAILABLE=0\n\n"${PYTHON_BIN}" -c "import venv" > /dev/null 2>&1 || VENV_AVAILABLE=1\n"${PYTHON_BIN}" -c "import ensurepip" > /dev/null 2>&1 || ENSUREPIP_AVAILABLE=1\n\n# If venv is still not available, try to use virtualenv as a fallback\nif [ $VENV_AVAILABLE -ne 0 ]; then\n  echo "venv module is not available. Checking for virtualenv as an alternative..."\n  \n  # Check if virtualenv is already installed\n  if "$PYTHON_BIN" -c "import virtualenv" > /dev/null 2>&1; then\n    echo "virtualenv is available, will use it instead of venv"\n  else\n    echo "ERROR: Neither venv nor virtualenv is available."\n    echo "Python 3.12 and venv should be installed as package dependencies."\n    echo "Please ensure Python 3.12 and venv are properly installed on your system."\n    exit 1\n  fi\nfi\n\n# Create virtual environment if it doesn\'t exist\nif [ ! -d "$VENV_PATH" ]; then\n  echo "Creating virtual environment at $VENV_PATH..."\n  # Remove any potentially corrupted virtual environment\n  if [ -e "$VENV_PATH" ]; then\n    echo "Removing existing but potentially corrupted venv directory..."\n    rm -rf "$VENV_PATH"\n  fi\n  \n  # Make sure parent directory exists and is writable\n  mkdir -p "$(dirname "$VENV_PATH")"\n  \n  # Try different methods to create a virtual environment\n  VENV_CREATE_STATUS=1\n  \n  # First try with venv if available\n  if [ $VENV_AVAILABLE -eq 0 ] && [ $ENSUREPIP_AVAILABLE -eq 0 ]; then\n    echo "Creating virtual environment using venv module..."\n    "$PYTHON_BIN" -m venv "$VENV_PATH"\n    VENV_CREATE_STATUS=$?\n  fi\n  \n  # If venv failed, try virtualenv\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    echo "venv creation failed with status $VENV_CREATE_STATUS. Falling back to virtualenv..."\n    if command_exists virtualenv; then\n      virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    elif "$PYTHON_BIN" -m pip list | grep -q virtualenv; then\n      "$PYTHON_BIN" -m virtualenv -p "$PYTHON_BIN" "$VENV_PATH"\n      VENV_CREATE_STATUS=$?\n    else\n      echo "ERROR: Both venv and virtualenv are unavailable or failed."\n      echo "Python 3.12 and venv should be installed as package dependencies."\n      echo "Please ensure Python 3.12 and venv are properly installed on your system."\n      echo "You can install Python 3.12 from https://www.python.org/downloads/"\n      exit 1\n    fi\n  fi\n  \n  # Check if virtual environment creation was successful\n  if [ $VENV_CREATE_STATUS -ne 0 ]; then\n    log "ERROR: Failed to create virtual environment. Exit code: $VENV_CREATE_STATUS"\n    log "Virtual environment path: $VENV_PATH"\n    log "Python binary used: $PYTHON_BIN"\n    ls -la "$(dirname "$VENV_PATH")" || true\n    log "Python executable permissions:"\n    ls -la "$PYTHON_BIN" || true\n    \n    # Check for common issues\n    log "Checking for common virtual environment creation issues..."\n    \n    # Check disk space\n    df -h "$(dirname "$VENV_PATH")" || true\n    \n    # Check if directory is writable\n    if [ ! -w "$(dirname "$VENV_PATH")" ]; then\n      log "ERROR: Directory $(dirname "$VENV_PATH") is not writable"\n    fi\n    \n    # Try to create a minimal virtual environment manually as a last resort\n    log "Attempting to create a minimal virtual environment manually..."\n    mkdir -p "$VENV_PATH/bin" || error_exit "Could not create directory $VENV_PATH/bin"\n    echo "#!/bin/bash" > "$VENV_PATH/bin/activate"\n    echo "export VIRTUAL_ENV=\\"$VENV_PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "export PATH=\\"$VENV_PATH/bin:\\$PATH\\"" >> "$VENV_PATH/bin/activate"\n    echo "unset PYTHONHOME" >> "$VENV_PATH/bin/activate"\n    chmod +x "$VENV_PATH/bin/activate" || error_exit "Could not set execute permissions on activate script"\n    \n    # Create symlinks to the system Python\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python" || log "WARNING: Failed to create symlink for python"\n    ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python3" || log "WARNING: Failed to create symlink for python3"\n    \n    # Try to bootstrap pip\n    log "Bootstrapping pip in the minimal virtual environment..."\n    if command_exists curl; then\n      curl -s --fail --connect-timeout 10 --max-time 60 https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py" || log "WARNING: Failed to download get-pip.py"\n    elif command_exists wget; then\n      wget -q --timeout=30 --tries=1 -O "$APP_DATA_DIR/get-pip.py" https://bootstrap.pypa.io/get-pip.py || log "WARNING: Failed to download get-pip.py"\n    else\n      log "ERROR: Neither curl nor wget available to download get-pip.py"\n      error_exit "Installation cannot continue without being able to download pip"\n    fi\n    \n    # shellcheck disable=SC1090\n    source "$VENV_PATH/bin/activate" && python "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n    \n    if [ ! -f "$VENV_PATH/bin/pip" ]; then\n      error_exit "Failed to create even a minimal virtual environment."\n    else\n      log "Created a minimal virtual environment as a fallback."\n    fi\n  else\n    log "Successfully created virtual environment"\n  fi\nfi\n\n# Verify the virtual environment structure\necho "Verifying virtual environment structure..."\nif [ ! -f "$VENV_PATH/bin/python" ]; then\n  echo "Python executable missing in virtual environment, creating symlink..."\n  ln -sf "$PYTHON_BIN" "$VENV_PATH/bin/python"\nfi\n\nif [ ! -f "$VENV_PATH/bin/pip" ]; then\n  echo "pip missing in virtual environment, attempting to bootstrap it..."\n  curl -s --fail --connect-timeout 10 --max-time 60 https://bootstrap.pypa.io/get-pip.py -o "$APP_DATA_DIR/get-pip.py"\n  "$VENV_PATH/bin/python" "$APP_DATA_DIR/get-pip.py" --no-warn-script-location\n  \n  if [ ! -f "$VENV_PATH/bin/pip" ]; then\n    echo "ERROR: Failed to bootstrap pip in the virtual environment"\n    exit 1\n  fi\nfi\n\necho "Virtual environment structure verified"\n\n# Activate virtual environment and install local-operator\necho "Installing local-operator in virtual environment..."\nsource "$VENV_PATH/bin/activate"\n\necho "Upgrading pip..."\npython -m pip install --upgrade pip || {\n  echo "WARNING: Failed to upgrade pip. Will try to continue with existing pip version."\n  pip --version\n}\n\n# Check network connectivity to PyPI. A DIAGNOSTIC, not a gate: the install below\n# decides whether it can proceed.\n#\n# What this answers, stated precisely because an earlier version of this comment\n# claimed more than the flags buy: "did a TLS fetch to PyPI\'s JSON API complete,\n# and did the answer come back as JSON?". `--fail` turns an HTTP ERROR status\n# into a non-zero exit, and does NOT notice a captive portal answering 200 with\n# its own HTML page (measured: a portal-shaped 200 exits 0 with and without the\n# flag). Both spellings therefore check the CONTENT TYPE as well, since a portal\n# that reports "reachable" while pip is about to fail is the false negative this\n# warning exists to catch: curl through `-w \'%{content_type}\'`, and wget through\n# the response headers `-S` prints (`-S`/`--server-response` is in BusyBox\'s wget\n# since 2017 as well as GNU\'s, which is the wget a system without curl has).\n#\n# What the content type does NOT prove, stated so this paragraph is not read as\n# more than it says: a proxy answering 200 with `application/json` and an error\n# body (`{"detail":"blocked by proxy policy"}`) is silent here, because the\n# answer did come back as JSON. Only parsing the body - a fetch of PyPI\'s own\n# payload shape - would tell those apart, and a diagnostic that costs a parse is\n# not what stands in front of an install.\n#\n# Two bounds, two jobs: the connect bound ends a black-hole network, the total\n# stops a connected-but-stalled peer. Both must be POSITIVE - `--max-time 0` and\n# `--timeout=0` disable the bound rather than making it immediate on both curl and\n# wget. 30 rather than 10 because the total must not fire on a slow-but-working\n# link: a working endpoint that answered in 15s tripped a 10s bound and printed\n# this warning on an install that then succeeded.\necho "Checking network connectivity to PyPI..."\nif command_exists curl; then\n  PYPI_PROBE_CONTENT_TYPE=$(curl -s --fail --connect-timeout 5 --max-time 30 -o /dev/null -w \'%{content_type}\' https://pypi.org/pypi/local-operator/json) || PYPI_PROBE_CONTENT_TYPE=""\n  if [[ "${PYPI_PROBE_CONTENT_TYPE}" != application/json* ]]; then\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  fi\nelif command_exists wget; then\n  # The headers are captured into a variable and matched with a here-string\n  # rather than piped into `grep -q`: `-q` exits on the first match, the closed\n  # pipe gives wget SIGPIPE, and the script runs under `set -o pipefail`, so a\n  # WORKING link printed this warning whenever the match landed before wget had\n  # finished writing its headers. The piped shape was this remediation\'s own - the\n  # first fix piped it and was measured warning 1 time in 20 against real PyPI\n  # (and 1 in 20 against a healthy local endpoint) while this shape warns 0 in 40\n  # with the same flags - so the trap is recorded here because it is one line away\n  # from being reintroduced, not because the released script ever shipped it.\n  PYPI_PROBE_HEADERS=$(wget -q -S --spider --timeout=30 --tries=1 https://pypi.org/pypi/local-operator/json 2>&1) || PYPI_PROBE_HEADERS=""\n  if ! grep -qi \'^ *content-type: application/json\' <<< "$PYPI_PROBE_HEADERS"; then\n    echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  fi\nfi\n\necho "Installing local-operator package..."\npython -m pip install --verbose local-operator || {\n  echo "ERROR: Failed to install local-operator package. Exit code: $?"\n  echo "Python version:"\n  python --version\n  echo "pip version:"\n  pip --version\n  echo "Available pip packages:"\n  pip list\n  exit 1\n}\necho "local-operator installation successful"\n\n# Verify installation\nif [ -f "$VENV_PATH/bin/local-operator" ]; then\n  log "Local Operator backend installed successfully!"\n  \n  # Show more information about the installed binary\n  ls -la "$VENV_PATH/bin/local-operator" || true\n  file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n  \n  # Try to run the version command with full error output\n  log "Testing local-operator binary..."\n  "$VENV_PATH/bin/local-operator" --version || {\n    log "ERROR: local-operator binary exists but failed to execute. Exit code: $?"\n    log "Binary details:"\n    file "$VENV_PATH/bin/local-operator" 2>/dev/null || log "Note: \'file\' command not available"\n    log "Binary permissions:"\n    ls -la "$VENV_PATH/bin/local-operator" || true\n    log ""\n    log "This could be due to missing dependencies or architecture incompatibility."\n    log "Try running the binary manually to see specific errors."\n    \n    # Don\'t exit here - just warn the user\n    log "WARNING: Installation completed but binary verification failed."\n  }\n  \n  # Create a summary of the installation\n  SUMMARY_FILE="${APP_DATA_DIR}/installation-summary-${TIMESTAMP}.txt"\n  {\n    echo "=== Local Operator Backend Installation Summary ==="\n    echo "Timestamp: $(date)"\n    echo "Python Version: $("${PYTHON_BIN}" --version 2>&1)"\n    echo "Virtual Environment: ${VENV_PATH}"\n    echo "Binary Location: ${VENV_PATH}/bin/local-operator"\n    echo "To activate the virtual environment, run: source ${VENV_PATH}/bin/activate"\n    echo "To test the installation, run: ${VENV_PATH}/bin/local-operator --version"\n    echo "Log file: ${LOG_FILE}"\n    echo "=================================================="\n  } > "${SUMMARY_FILE}"\n  \n  log "Installation summary saved to: ${SUMMARY_FILE}"\nelse\n  log "Error: Failed to install Local Operator backend. Binary not found."\n  log "Contents of bin directory:"\n  ls -la "$VENV_PATH/bin/" || true\n  log "Check the log file for details: ${LOG_FILE}"\n  error_exit "Installation failed. Binary not installed properly."\nfi\n\nlog "Installation completed successfully at $(date)"\n\n# Clean up temporary files now that installation is complete\ncleanup\n\n# Print final instructions\nlog ""\nlog "=== INSTALLATION COMPLETE ==="\nlog "You can now use the Local Operator backend by running: ${VENV_PATH}/bin/local-operator"\nlog "Installation directory: ${VENV_PATH}"\nlog "Log file: ${LOG_FILE}"\nlog "================================"\n';
+const macosInstallScriptRaw = '#!/bin/bash\n# Local Operator Backend Installation Script for macOS\n# This script uses the bundled standalone Python and sets up a virtual environment for the Local Operator backend.\n\nset -e  # Exit immediately if a command exits with a non-zero status\n\n# Configuration\nAPP_NAME="Local Operator"\nVENV_NAME="local-operator-venv"\nAPP_DATA_DIR="${LOCAL_OPERATOR_SUPPORT_PATH:-$HOME/Library/Application Support/$APP_NAME}"\nVENV_PATH="$APP_DATA_DIR/$VENV_NAME"\nLOG_FILE="$APP_DATA_DIR/backend-install.log"\n\n# Which environment this installs into. The path is the app\'s decision, not this\n# script\'s: a packaged install and an unpackaged one must not share an\n# environment (the venv is built on whatever interpreter the instance resolves,\n# and the installed bundle\'s stdlib lives inside the code-sealed .app), and only\n# the app knows which one it is. The app passes its answer in\n# (`LOCAL_OPERATOR_VENV_PATH`, set from `managedVenvPath` in\n# src/main/backend/venv-paths.ts).\n#\n# macOS REFUSES a standalone run rather than falling back, and the asymmetry with\n# the Linux and Windows scripts is deliberate. Their default is the packaged name,\n# which is harmless there; here it is the exact environment this split exists to\n# stop a second instance from writing into - the measured failure is a dev-venv\n# interpreter whose stdlib is `/Applications/Local Operator.app/Contents/\n# Resources/python_aarch64`, so a silent default would rebuild that venv and\n# `pip install` into it, which is what R1 of the review caught. A caller that\n# cannot name the environment is a caller that should not be installing into one.\n: "${LOCAL_OPERATOR_VENV_PATH:?Pass the resolved managed environment path (see venv-paths.ts); this script will not guess which instance it belongs to}"\nVENV_PATH="$LOCAL_OPERATOR_VENV_PATH"\n\n# Keep CPython\'s bytecode cache out of the application bundle.\n#\n# The bundled interpreter writes __pycache__/*.pyc beside the stdlib sources it\n# imports, and those sources live inside the code-signed .app - which is the\n# build\'s own extraResource. Every such write is a change to a sealed resource:\n# measured on an installed 0.17.3, `codesign --verify --deep` reported 308\n# `file added:` violations, all of them .pyc, and ShipIt then refuses the\n# in-place update with -67028 errSecCSBadBundleFormat. A file codesign reports\n# as *added* can be deleted and the seal comes back; a *modified* one cannot,\n# which is why nothing may ship a .pyc at all. The app sets this variable when\n# it spawns us; defaulting it here keeps a standalone run of this script in\n# agreement with the app about where bytecode goes. It is not a complete answer:\n# the app does not spawn every python that runs this interpreter, and a python\n# started by something else - a shell, a CLI script, an agent - has no prefix at\n# all (measured: a venv over this tree wrote 25 .pyc into it that way). The half\n# that covers those is the app\'s seal on the tree itself\n# (src/main/python-bytecode-cache.ts), which a standalone run of this script does\n# not apply. $HOME is the right place for the cache for the same reason the venv\n# lives there: it is never inside the thing that gets signed and swapped.\n: "${PYTHONPYCACHEPREFIX:=$APP_DATA_DIR/python-bytecode-cache}"\nexport PYTHONPYCACHEPREFIX\n\n# And the refusal half of the same pair, so a standalone run of this script\n# cannot write bytecode into the bundle even where the redirect above does not\n# apply - a relative or unwritable prefix, or a child that drops the variable.\n# CPython reads the flag before its first import, so this script\'s own\n# `python -m venv`, its pip runs and the venv they create all compile without\n# writing a `__pycache__` anywhere. Measured on CPython: `0` and the empty\n# string are the two falsy spellings, so the value is set rather than merged\n# with whatever the caller had.\nexport PYTHONDONTWRITEBYTECODE=1\n\n# The architecture block that used to live here computed and logged the name of\n# a directory for an in-bundle search this script no longer performs: every run\n# announced which architecture-named directory it was about to use, and then\n# installed from `PYTHON_BIN` anyway - the line stated the opposite of how the\n# script finds Python, and the names it computed were used nowhere else (review\n# N1). Which interpreter to build the environment with is the caller\'s decision,\n# checked immediately below.\n\n# The app prepares a complete external runtime before invoking this script.\n# Searching /Applications here would reintroduce legacy-bundle execution during\n# migration. Standalone callers must make the same explicit path decision.\n: "${PYTHON_BIN:?Pass an external prepared Python executable}"\ncase "$PYTHON_BIN" in\n  *.app/*) echo "Refusing to execute Python inside an application bundle" >&2; exit 1 ;;\nesac\n\n# Create app data directory if it doesn\'t exist\nmkdir -p "$APP_DATA_DIR"\n\n# Start logging - capture everything and ensure it\'s visible to parent process\nexec > >(tee -a "$LOG_FILE") 2> >(tee -a "$LOG_FILE" >&2)\necho "=============================================="\necho "$(date): Starting Local Operator backend installation..."\necho "=============================================="\necho "Python bin path: $PYTHON_BIN"\necho "Virtual environment path: $VENV_PATH"\necho "App data directory: $APP_DATA_DIR"\necho "Log file: $LOG_FILE"\necho "=============================================="\n\n# Nothing is fetched here but the package itself.\n#\n# This script used to download a third-party FFmpeg binary from a GitHub\n# release into `$APP_DATA_DIR/bin`. The macOS asset names it asked for do not\n# exist (curl without `--fail` wrote the 404 body to the binary path, `chmod +x`\n# made it executable, its own `[ -f ] && [ -x ]` verification passed and the next\n# run skipped the download, so the broken file was permanent), nothing in the app\n# or in `local-operator` ever executed it, and under `set -e` a failed download\n# killed the install before the venv existed - so a machine that can reach PyPI\n# but not github.com could not install at all. Tooling a task actually needs is\n# acquired later, on demand, through the app\'s Console with the user\'s approval;\n# this script\'s job is the environment below and nothing else.\n# Verify bundled Python exists\nif [ ! -f "$PYTHON_BIN" ]; then\n  echo "Error: Bundled Python not found at $PYTHON_BIN"\n  echo "Please ensure standalone Python is properly installed in the application resources."\n  exit 1\nfi\n\n# Make sure Python binary is executable\necho "Using bundled Python: $PYTHON_BIN"\n"$PYTHON_BIN" --version\n\n# Check if Python has venv module available\necho "Checking for venv module availability..."\n"$PYTHON_BIN" -m venv --help > /dev/null 2>&1 || {\n  echo "ERROR: Python venv module not available in the Python installation"\n  echo "Python details:"\n  "$PYTHON_BIN" --version\n  "$PYTHON_BIN" -c "import sys; print(\'Prefix:\', sys.prefix); print(\'Exec Prefix:\', sys.exec_prefix)"\n  "$PYTHON_BIN" -c "import sys; print(\'Modules path:\'); print(\'\\n\'.join(sys.path))"\n  exit 1\n}\necho "venv module is available"\n\n# Create virtual environment if it doesn\'t exist\nif [ ! -d "$VENV_PATH" ]; then\n  echo "Creating virtual environment at $VENV_PATH..."\n  # Never repair a path we did not create. Preparation allocates a fresh final\n  # pathname; a collision is evidence to preserve, not a reason to delete it.\n  if [ -e "$VENV_PATH" ] || [ -L "$VENV_PATH" ]; then\n    echo "Refusing to replace an existing environment path: $VENV_PATH" >&2\n    exit 1\n  fi\n  \n  # Make sure parent directory exists and is writable\n  mkdir -p "$(dirname "$VENV_PATH")"\n  \n  # Create the virtual environment with verbosity\n  "$PYTHON_BIN" -m venv "$VENV_PATH" || {\n    echo "ERROR: Failed to create virtual environment. Exit code: $?"\n    echo "Virtual environment path: $VENV_PATH"\n    echo "Python binary used: $PYTHON_BIN"\n    ls -la "$(dirname "$VENV_PATH")"\n    echo "Python executable permissions:"\n    ls -la "$PYTHON_BIN"\n    exit 1\n  }\n  echo "Successfully created virtual environment"\nfi\n\n# Verify the virtual environment structure\necho "Verifying virtual environment structure..."\nif [ ! -f "$VENV_PATH/bin/python" ] || [ ! -f "$VENV_PATH/bin/pip" ]; then\n  echo "ERROR: Virtual environment is missing critical components"\n  echo "Contents of virtual environment directory:"\n  ls -la "$VENV_PATH"\n  if [ -d "$VENV_PATH/bin" ]; then\n    echo "Contents of bin directory:"\n    ls -la "$VENV_PATH/bin"\n  fi\n  exit 1\nfi\necho "Virtual environment structure verified"\n\n# Activate virtual environment and install local-operator\necho "Installing local-operator in virtual environment..."\nsource "$VENV_PATH/bin/activate"\n\necho "Upgrading pip..."\npython -m pip install --upgrade pip || {\n  echo "ERROR: Failed to upgrade pip. Exit code: $?"\n  echo "pip version before failing:"\n  pip --version\n  exit 1\n}\necho "pip upgrade successful:"\npip --version\n\n# Check network connectivity to PyPI. A DIAGNOSTIC, not a gate: the install below\n# decides whether it can proceed.\n#\n# What this answers, stated precisely because an earlier version of this comment\n# claimed more than the flags buy: "did a TLS fetch to PyPI\'s JSON API complete,\n# and did the answer come back as JSON?". `--fail` turns an HTTP ERROR status\n# into a non-zero exit - a proxy\'s 403/407, any 4xx/5xx - and does NOT notice a\n# captive portal answering 200 with its own HTML page (measured: a portal-shaped\n# 200 returns exit 0 with AND without the flag). `-o /dev/null` cannot tell a\n# portal\'s page from PyPI\'s JSON either, so the content type is what\n# discriminates, and on a captive network a probe that reports "reachable" while\n# pip is about to fail is the false negative this warning exists to catch.\n#\n# What the content type does NOT prove, stated so this paragraph is not read as\n# more than it says: a proxy answering 200 with `application/json` and an error\n# body (`{"detail":"blocked by proxy policy"}`) is silent here, because the\n# answer did come back as JSON. Only parsing the body - a fetch of PyPI\'s own\n# payload shape - would tell those apart, and a diagnostic that costs a parse is\n# not what stands in front of an install.\n#\n# Two bounds, two jobs: `--connect-timeout 5` ends a black-hole network (a\n# connect that never completes), `--max-time 30` stops a connected-but-stalled\n# peer. Both must be POSITIVE: `--max-time 0` and `--connect-timeout 0` disable\n# the bound rather than making it immediate, which is why the test beside this\n# script requires `[1-9]`. 30 rather than 10 because the total must not fire on a\n# slow-but-working link: a working endpoint that answered in 15s tripped a 10s\n# total bound and printed this warning on an install that then succeeded, and a\n# warning that cries wolf is one users learn to ignore.\necho "Checking network connectivity to PyPI..."\nPYPI_PROBE_CONTENT_TYPE=$(curl -s --fail --connect-timeout 5 --max-time 30 -o /dev/null -w \'%{content_type}\' https://pypi.org/pypi/local-operator/json) || PYPI_PROBE_CONTENT_TYPE=""\nif [[ "$PYPI_PROBE_CONTENT_TYPE" != application/json* ]]; then\n  echo "WARNING: Could not reach PyPI. Network connectivity issues might prevent installation."\n  echo "Attempting to ping common domains to diagnose network issues:"\n  ping -c 1 -W 2000 google.com || echo "Cannot ping google.com"\n  ping -c 1 -W 2000 pypi.org || echo "Cannot ping pypi.org"\nfi\n\necho "Installing local-operator package..."\npython -m pip install --upgrade --verbose local-operator || {\n  echo "ERROR: Failed to install local-operator package. Exit code: $?"\n  echo "Python version:"\n  python --version\n  echo "pip version:"\n  pip --version\n  echo "Available pip packages:"\n  pip list\n  echo "Pip config:"\n  pip config list\n  echo "Network diagnosis:"\n  curl -sI --fail --connect-timeout 5 --max-time 30 https://pypi.org || echo "Cannot reach PyPI server"\n  exit 1\n}\necho "local-operator installation successful"\n\n# Verify installation\nif [ -f "$VENV_PATH/bin/local-operator" ]; then\n  echo "Local Operator backend installed successfully!"\n  \n  # Show more information about the installed binary\n  ls -la "$VENV_PATH/bin/local-operator"\n  file "$VENV_PATH/bin/local-operator"\n  \n  # Try to run the version command with full error output\n  echo "Testing local-operator binary..."\n  "$VENV_PATH/bin/local-operator" --version || {\n    echo "ERROR: local-operator binary exists but failed to execute. Exit code: $?"\n    echo "Binary details:"\n    file "$VENV_PATH/bin/local-operator"\n    echo "Binary permissions:"\n    ls -la "$VENV_PATH/bin/local-operator"\n    echo "Dependencies:"\n    if command -v otool >/dev/null; then\n      otool -L "$VENV_PATH/bin/local-operator" || echo "Could not get dependencies with otool"\n    fi\n    exit 1\n  }\nelse\n  echo "Error: Failed to install Local Operator backend. Binary not found."\n  echo "Contents of bin directory:"\n  ls -la "$VENV_PATH/bin/"\n  exit 1\nfi\n\necho "$(date): Installation completed successfully."\n';
+const windowsInstallScriptRaw = '# Local Operator Backend Installation Script for Windows\n# This script installs pyenv-win, Python 3.12, and sets up a virtual environment for the Local Operator backend.\n\n# Configuration\n$AppName = "Local Operator"\n$PythonVersion = "3.12.0"\n$VenvName = "local-operator-venv"\n$AppDataDir = "$env:APPDATA\\\\$AppName"\n$VenvPath = "$AppDataDir\\\\$VenvName"\n$LogFile = "$AppDataDir\\\\backend-install-shell.log"\n$PyenvDir = "$env:USERPROFILE\\\\.pyenv"\n\n# Which environment this installs into - the app\'s decision, handed in rather\n# than re-derived. A packaged install and an unpackaged one must not share an\n# environment (the venv is built on whatever interpreter the instance resolves),\n# and only the app knows which it is: LOCAL_OPERATOR_VENV_PATH carries\n# managedVenvPath\'s answer (src/main/backend/venv-paths.ts). The default above is\n# what a standalone run uses - the packaged name, because that is what every\n# install on a disk today has.\nif ($env:LOCAL_OPERATOR_VENV_PATH) {\n    $VenvPath = $env:LOCAL_OPERATOR_VENV_PATH\n}\n\n# Keep CPython\'s bytecode cache out of the application directory.\n#\n# Same rule as the macOS script, and stated here for the same reason: an\n# interpreter writes __pycache__/*.pyc beside the stdlib sources it imports. On\n# Windows those sources are the bundled python directory rather than a\n# code-signed bundle, so this is hygiene rather than the load-bearing fix it is\n# on macOS - but the app and the script must not disagree about where bytecode\n# goes. $AppDataDir is used for the same reason the venv is: it is never inside\n# the installed application tree.\nif (-not $env:PYTHONPYCACHEPREFIX) {\n    $env:PYTHONPYCACHEPREFIX = "$AppDataDir\\\\python-bytecode-cache"\n}\n\n# The refusal half of the same pair, kept in step with the app\'s\n# `withPythonBytecodeCache`: CPython reads the flag before its first import, so\n# nothing this script runs can write a __pycache__ at all.\n$env:PYTHONDONTWRITEBYTECODE = "1"\n\n# Create app data directory if it doesn\'t exist\nif (-not (Test-Path $AppDataDir)) {\n    New-Item -ItemType Directory -Path $AppDataDir -Force | Out-Null\n}\n\n# Start logging\nStart-Transcript -Path $LogFile -Append\nWrite-Output "$(Get-Date): Starting Local Operator backend installation..."\n\n# Nothing is fetched here but the package itself and Python\'s own toolchain.\n#\n# This script used to download a third-party FFmpeg binary from a GitHub release\n# into `$AppDataDir\\bin`. Nothing in the app or in `local-operator` ever executed\n# it. Tooling a task actually needs is acquired later, on demand, through the\n# app\'s Console with the user\'s approval; this script\'s job is the environment\n# below and nothing else. (pyenv-win\'s source archive below is the one remaining\n# third-party fetch, and it is a source archive the Windows install cannot do\n# without - see `scripts/install-scripts-network.test.mjs`, which keeps that list\n# down to the fetches each platform genuinely needs.)\n\n# Function to check if a command exists\nfunction Test-CommandExists {\n    param ($command)\n    $oldPreference = $ErrorActionPreference\n    $ErrorActionPreference = \'stop\'\n    try {\n        if (Get-Command $command) { return $true }\n    } catch {\n        return $false\n    } finally {\n        $ErrorActionPreference = $oldPreference\n    }\n}\n\n# Install pyenv-win if not installed\nif (-not (Test-Path $PyenvDir)) {\n    Write-Output "Installing pyenv-win..."\n    \n    # Create temporary directory\n    $TempDir = "$env:TEMP\\\\pyenv-win"\n    if (Test-Path $TempDir) {\n        Remove-Item -Path $TempDir -Recurse -Force\n    }\n    New-Item -ItemType Directory -Path $TempDir -Force | Out-Null\n    \n    # Download and extract pyenv-win\n    $PyenvZip = "$TempDir\\\\pyenv-win.zip"\n    # Bounded, and the bound FAILS LOUDLY. An unbounded request here holds a\n    # first-run install open behind the progress bar forever on a black-hole\n    # network; and without -ErrorAction Stop a fired -TimeoutSec is a\n    # NON-TERMINATING error, so the script would walk straight into\n    # Expand-Archive with an absent or partial zip and report an archive error\n    # instead of "the download timed out". The partial file is removed in the\n    # failure branch so a later run cannot expand what this one failed to fetch\n    # (the next run clears $TempDir before it downloads at all, which is the\n    # `if (Test-Path $TempDir) { Remove-Item ... }` above - named rather than\n    # cited by line, because a line number in a script that keeps changing is\n    # what a stale citation is made of).\n    # 120 seconds is a payload bound rather than the 30-second stall bound the PyPI\n    # probes use: this downloads a source archive instead of answering an API\n    # call, so it only has to stop an indefinite hang.\n    #\n    # WHICH BOUND `-TimeoutSec` ACTUALLY IS DEPENDS ON THE POWERSHELL, and that is\n    # a trap worth naming because the two paths differ here. The app spawns this\n    # script with `powershell.exe` (Windows PowerShell 5.1, see\n    # backend-installer.ts), where -TimeoutSec is the REQUEST\'s timeout - 120\n    # seconds to complete the transfer. On PowerShell 7.4+ it was renamed to\n    # -OperationTimeoutSeconds and -TimeoutSec survives only as an ALIAS of\n    # -ConnectionTimeoutSeconds, i.e. a connect bound, so on a 7.x host (the CI\n    # runner is one) a mirror that accepts and then stalls is not ended by this.\n    # Do not "fix" that by adding the 7.x spelling: 5.1 does not know\n    # -OperationTimeoutSeconds, and an unknown parameter is a binding error which\n    # the catch below turns into `exit 1` on every install. The version-agnostic\n    # answer is a bound on the transfer itself (a BITS job or a size/rate check),\n    # which is a larger change than this one and is recorded rather than made.\n    try {\n        Invoke-WebRequest -Uri "https://github.com/pyenv-win/pyenv-win/archive/master.zip" -OutFile $PyenvZip -TimeoutSec 120 -ErrorAction Stop\n    } catch {\n        Remove-Item -Path $PyenvZip -Force -ErrorAction SilentlyContinue\n        Write-Error "Failed to download pyenv-win from https://github.com/pyenv-win/pyenv-win/archive/master.zip within 120 seconds: $($_.Exception.Message)"\n        exit 1\n    }\n    # -ErrorAction Stop for the same reason as the download: a truncated archive\n    # must fail here rather than half-copy into $PyenvDir.\n    Expand-Archive -Path $PyenvZip -DestinationPath $TempDir -ErrorAction Stop\n    \n    # Create .pyenv directory\n    New-Item -ItemType Directory -Path $PyenvDir -Force | Out-Null\n    \n    # Copy pyenv-win files\n    Copy-Item -Path "$TempDir\\\\pyenv-win-master\\\\*" -Destination $PyenvDir -Recurse\n    \n    # Set environment variables\n    [System.Environment]::SetEnvironmentVariable("PYENV", "$PyenvDir\\\\pyenv-win", "User")\n    [System.Environment]::SetEnvironmentVariable("PYENV_HOME", "$PyenvDir\\\\pyenv-win", "User")\n    \n    # Update PATH - ensure both bin and shims are added separately for better compatibility\n    $Path = [System.Environment]::GetEnvironmentVariable("PATH", "User")\n    $PyenvBinPath = "$PyenvDir\\\\pyenv-win\\\\bin"\n    $PyenvShimsPath = "$PyenvDir\\\\pyenv-win\\\\shims"\n    \n    # Add bin path if not already in PATH\n    if ($Path -notlike "*$PyenvBinPath*") {\n        [System.Environment]::SetEnvironmentVariable("PATH", "$PyenvBinPath;$Path", "User")\n        $Path = [System.Environment]::GetEnvironmentVariable("PATH", "User")\n    }\n    \n    # Add shims path if not already in PATH\n    if ($Path -notlike "*$PyenvShimsPath*") {\n        [System.Environment]::SetEnvironmentVariable("PATH", "$PyenvShimsPath;$Path", "User")\n    }\n    \n    # Set PYENV environment variables\n    [System.Environment]::SetEnvironmentVariable("PYENV", "$PyenvDir\\\\pyenv-win", "User")\n    [System.Environment]::SetEnvironmentVariable("PYENV_HOME", "$PyenvDir\\\\pyenv-win", "User")\n    \n    # Update current session PATH\n    $env:PYENV = "$PyenvDir\\\\pyenv-win"\n    $env:PYENV_HOME = "$PyenvDir\\\\pyenv-win"\n    $env:PATH = "$PyenvDir\\\\pyenv-win\\\\bin;$PyenvDir\\\\pyenv-win\\\\shims;$env:PATH"\n    \n    # Refresh environment variables for the current process\n    $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "User") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "Machine")\n    \n    # Clean up\n    Remove-Item -Path $TempDir -Recurse -Force\n}\n\n# Refresh environment variables for current session\n$env:PYENV = "$PyenvDir\\\\pyenv-win"\n$env:PYENV_HOME = "$PyenvDir\\\\pyenv-win"\n$env:PATH = "$PyenvDir\\\\pyenv-win\\\\bin;$PyenvDir\\\\pyenv-win\\\\shims;$env:PATH"\n\n# Install Python 3.12 if not installed\n$PythonInstalled = $false\ntry {\n    $InstalledVersions = & pyenv versions\n    if ($InstalledVersions -like "*$PythonVersion*") {\n        $PythonInstalled = $true\n    }\n} catch {\n    $PythonInstalled = $false\n}\n\nif (-not $PythonInstalled) {\n    Write-Output "Installing Python $PythonVersion..."\n    & pyenv install $PythonVersion\n    if ($LASTEXITCODE -ne 0) {\n        Write-Error "Failed to install Python $PythonVersion"\n        exit 1\n    }\n}\n\n# Set Python 3.12 as the local version\n& pyenv local $PythonVersion\nif ($LASTEXITCODE -ne 0) {\n    Write-Error "Failed to set Python $PythonVersion as local version"\n    exit 1\n}\n\n# Create virtual environment if it doesn\'t exist\nif (-not (Test-Path $VenvPath)) {\n    Write-Output "Creating virtual environment at $VenvPath..."\n    \n    # Ensure the directory exists\n    if (-not (Test-Path $AppDataDir)) {\n        New-Item -ItemType Directory -Path $AppDataDir -Force | Out-Null\n        Write-Output "Created directory: $AppDataDir"\n    }\n    \n    # Use the full path to python from pyenv\n    $PythonExe = "$PyenvDir\\\\pyenv-win\\\\versions\\\\$PythonVersion\\\\python.exe"\n    \n    if (Test-Path $PythonExe) {\n        Write-Output "Using Python at: $PythonExe"\n        & $PythonExe -m venv $VenvPath\n    } else {\n        Write-Output "Using system Python"\n        & python -m venv $VenvPath\n    }\n    \n    if ($LASTEXITCODE -ne 0) {\n        Write-Error "Failed to create virtual environment"\n        exit 1\n    }\n}\n\n# Verify the virtual environment was created\nif (-not (Test-Path "$VenvPath\\\\Scripts\\\\Activate.ps1")) {\n    Write-Error "Virtual environment activation script not found at $VenvPath\\\\Scripts\\\\Activate.ps1"\n    exit 1\n}\n\n# Activate virtual environment and install local-operator\nWrite-Output "Installing local-operator in virtual environment..."\n# Use PowerShell to run the activation script\n& "$VenvPath\\\\Scripts\\\\Activate.ps1"\n& python -m pip install --upgrade pip\n& python -m pip install --upgrade local-operator\n\nif ($LASTEXITCODE -ne 0) {\n    Write-Error "Failed to install packages in virtual environment"\n    exit 1\n}\n\n# Verify installation\n$LocalOperatorInstalled = $false\ntry {\n    # First try to run local-operator directly (it should be in PATH from the activated venv)\n    $Version = & local-operator --version\n    $LocalOperatorInstalled = $true\n    Write-Output "Local Operator backend installed successfully!"\n    Write-Output $Version\n} catch {\n    Write-Output "Could not run local-operator directly, trying with full path..."\n    try {\n        # Try with explicit path\n        $LocalOperatorExe = "$VenvPath\\\\Scripts\\\\local-operator.exe"\n        if (Test-Path $LocalOperatorExe) {\n            $Version = & $LocalOperatorExe --version\n            $LocalOperatorInstalled = $true\n            Write-Output "Local Operator backend installed successfully at $LocalOperatorExe!"\n            Write-Output $Version\n        } else {\n            # Try without .exe extension\n            $LocalOperatorCmd = "$VenvPath\\\\Scripts\\\\local-operator"\n            if (Test-Path $LocalOperatorCmd) {\n                $Version = & $LocalOperatorCmd --version\n                $LocalOperatorInstalled = $true\n                Write-Output "Local Operator backend installed successfully at $LocalOperatorCmd!"\n                Write-Output $Version\n            } else {\n                Write-Error "Error: local-operator executable not found in expected locations."\n                \n                # Create a symlink to make it more accessible\n                Write-Output "Attempting to create a symlink for local-operator..."\n                $PythonModule = "$VenvPath\\\\Lib\\\\site-packages\\\\local_operator"\n                if (Test-Path $PythonModule) {\n                    Write-Output "Found local_operator module at $PythonModule"\n                    \n                    # Create a batch file that runs the module\n                    $BatchContent = "@echo off`npython -m local_operator %*"\n                    Set-Content -Path "$VenvPath\\\\Scripts\\\\local-operator.bat" -Value $BatchContent\n                    \n                    # Test the batch file\n                    if (Test-Path "$VenvPath\\\\Scripts\\\\local-operator.bat") {\n                        Write-Output "Created local-operator.bat in Scripts directory"\n                        $LocalOperatorInstalled = $true\n                    } else {\n                        Write-Error "Failed to create local-operator.bat"\n                        exit 1\n                    }\n                } else {\n                    Write-Error "local_operator module not found in site-packages"\n                    exit 1\n                }\n            }\n        }\n    } catch {\n        Write-Error "Error: Failed to install Local Operator backend."\n        Write-Error $_.Exception.Message\n        exit 1\n    }\n}\n\n# If we got here, installation was successful\nif ($LocalOperatorInstalled) {\n    Write-Output "Local Operator backend installation verified."\n} else {\n    Write-Error "Error: Failed to verify Local Operator backend installation."\n    exit 1\n}\n\nWrite-Output "$(Get-Date): Installation completed successfully."\n\n# Properly close the transcript and ensure it\'s released\ntry {\n    Write-Output "Finalizing installation and releasing resources..."\n    # Flush any pending output\n    [System.Console]::Out.Flush()\n    # Stop transcript properly\n    Stop-Transcript\n    \n    # Add a small delay to ensure file handles are released\n    Start-Sleep -Seconds 1\n    \n    # Explicitly release any COM objects\n    [System.GC]::Collect()\n    [System.GC]::WaitForPendingFinalizers()\n    \n    Write-Output "Installation completed and resources released."\n} catch {\n    Write-Error "Error during cleanup: $_"\n}\n';
 const macosInstallScript = macosInstallScriptRaw;
 const linuxInstallScript = linuxInstallScriptRaw;
 const windowsInstallScript = windowsInstallScriptRaw;
@@ -12632,11 +12545,6 @@ function surfaceEnvironment(input) {
   }
   return env;
 }
-function defaultShell(env) {
-  const shell = env.SHELL?.trim();
-  if (shell && path$1.isAbsolute(shell)) return shell;
-  return "/bin/zsh";
-}
 function resolveCwd(cwd) {
   const wanted = cwd?.trim();
   if (wanted && path$1.isAbsolute(wanted)) return wanted;
@@ -13615,6 +13523,15 @@ async function startConsoleHost(options) {
     log,
     history,
     now: options.now,
+    // Resolved BEFORE the host exists, so no surface can be created against the
+    // launch environment and then start behaving like the user's terminal later:
+    // a surface's PATH is decided here, once, and every surface this host makes
+    // carries the same one. Bounded by the resolver's own timeout (it never
+    // rejects and answers null when the shell cannot speak), and no part of the
+    // app's own startup waits on it: the browser host is attached to the window
+    // without being awaited, so the cost of a slow rc here is this host coming
+    // online later, not the app failing to come up.
+    env: await withUserShellPath(process.env, options.userShellPath),
     captureOffscreen: capture ? (request) => capture.capture(request) : void 0,
     spawn: options.spawn ?? ((spawnOptions) => spawnPty(load.module, spawnOptions, (report) => {
       log(
@@ -20668,6 +20585,7 @@ async function startBrowserHost(options) {
      */
     consoleCaptureUrl: options.consoleCaptureUrl,
     preloadPath: options.preloadPath,
+    userShellPath: options.userShellPath,
     log
   });
   const sessionKey = mintSessionKey();
@@ -29225,7 +29143,10 @@ function createWindow(initialSession = null, openCatalogue = false, request = ow
   attachBrowserHostToWindow?.(mainWindow2);
   return mainWindow2;
 }
-const backendService = new BackendServiceManager();
+const userShellPath = createUserShellPath({
+  log: (message) => logger.info(message, LogFileType.BACKEND)
+});
+const backendService = new BackendServiceManager({ userShellPath });
 const backendInstaller = new BackendInstaller();
 const reportBackendFailure = (message, fileType) => {
   if (backendService.isShuttingDown()) {
@@ -30132,6 +30053,14 @@ electron.app.whenReady().then(async () => {
         // lets main feed the reconstruction to it.
         consoleCaptureUrl,
         preloadPath: path$1.join(__dirname, "../preload/index.js"),
+        /*
+         * The console's surfaces are handed the user's own PATH, from the same
+         * resolver the backend spawn uses (above). Without it a surface inherits
+         * this app's launchd environment, in which `brew` - and every other tool
+         * the user installed - does not exist, so the console cannot run the
+         * tooling the agent is meant to acquire through it.
+         */
+        userShellPath,
         log: (message) => logger.info(message, LogFileType.BACKEND)
       });
     } catch (error) {