Desktop local update verification
English | 中文
Summary
Verification record for the Windows checkout through 2026-09-14. Local download and mandatory-dialog evidence is separate from production backend integration, visual acceptance, and installed-application upgrades. Run the command in the Desktop README to produce a fresh isolated report.
Installed qualification can opt into DSH_DESKTOP_UPDATE_JOURNAL_DIR, an absolute directory outside the installation tree that both versions retain. Each main process flushes a separate JSONL file with its installed version, state transitions, and manual-operation milestones. Raw diagnostics and request data are excluded; storage errors propagate. The journal decision defines evidence limits. Unit and main-entry tests cover the journal; a signed installed upgrade is still unverified.
Table of Contents
Manual walkthrough
For actual installation, publication after startup, failure/retry, and restart evidence, use the installed-update operator checklist. The interactive runner below intercepts installation and is a different qualification.
With Host, client, and Desktop artifacts built, run node --import tsx apps/desktop/scripts/test-workspace-updates.ts --interactive from the repository root on Windows. The actual workspace stays open with a separate control window. Its menus select ordinary or mandatory updates, hold and release downloads, inject download failures, and queue or clear test tasks. Select a failure before starting the download. After installation approval and task shutdown, a fixture message reports the intercepted installer call; acknowledging it ends the walkthrough. Closing the control window also exits. Each run owns a private profile and loopback server; payloads are not installers. Restart the command for a fresh round. Omitting --interactive runs the automated scenarios with their 120-second deadline and automatic exit; interactive downloads have a ten-minute network deadline.
Evidence
The local command builds Desktop and executes Electron 44 with the actual HTTP updater, policy client, sandboxed preload, and mandatory renderer. It records each scenario and preserves its report under .desktop-build/qualification/local-updater-*. The installer call, external browser, and clipboard are observation substitutes; downloaded bytes are not an executable installer.
| Layer | Observed result |
|---|---|
| Ordinary updater | Same/older-version rejection, user-authorized full download, SHA-512 rejection, interrupted transfer, stalled-feed/download deadlines, explicit retry, coalesced requests, same-address feed replacement, readiness, and separate install handoff pass |
| Mandatory policy | Flattened 40005, exact release headers, guest requests, no-force validation, failure retention, interval/backoff, timeout, and disposal regressions pass |
| Ordinary scheduling | Fake-clock regressions with the real coordinator verify bounded jitter/backoff, manual joins, success reset, no automatic download retry, wall-clock independence, and disposal. Main-entry tests verify focus/resume throttling, immediate explicit checks, and quit cleanup |
| Actual mandatory window | Text-only server content, native Windows move/resize/maximize and restore, Escape blocking, direct download, same-modal task confirmation, deferral, recovery-only page actions, navigation/copy feedback, and fresh policy clearance pass; a focused test verifies close-to-exit without clearing policy |
| Actual ordinary dialog | Isolated preload, 380px card, 24px corners, black primary button, parent blur, Escape cancellation retaining readiness, and task-warning approval with recorded installation handoff pass |
| Unlocked Windows interaction | OS-level clicks and screenshots of the actual mandatory renderer confirm Escape blocking, user-started download, readiness, red policy-error feedback, and modal clearance with the parent enabled again. A fixture-provided native task-warning dialog returns to readiness on deferral; task activity is simulated, not a full Host workload |
| Main entry | A known block refuses plugin mutations and recovery without stopping the Host; fresh success closes the block; packaged policy ignores environment overrides; installer failure after a clean stop restores the Host before another confirmation and retains mandatory blocking |
| Host task protection | The actual controller with substituted composition detects running agents, queued turns/steps, and global and agent jobs; API reads do not warn. Admission locking returns 503 for new requests, drains existing requests, and rechecks tasks; unlock restores admission |
| Visible output | Chinese mandatory-dialog DOM expectation and ordinary update presentation expectation pass; account-row component tests cover progress and persistent retry |
| Packaging configuration | Metadata embeds the configured application ID and policy; the built pre-pack hook rejects an HTTP policy origin without running packaging or upload |
The focused dialog, main-entry, settings, and sidebar run passes 119 regression cases. Five carrier tests cover all statements, branches, functions, and lines of the shared update-status source. The real-Electron command passes 17 scenarios and captures ordinary-ready, task-warning, and mandatory-error dialogs. These isolated checks do not certify the complete workspace or a release. Full-repository gate results and environment limitations remain separate from this focused evidence.
Chromium headless shell revision 1228 is installed in the ignored .desktop-build/playwright directory. The assembled settings and sidebar browser suites pass 18 cases. The Desktop workspace browser scenario passes both Chinese and English cases, captures six screenshots per locale, and verifies bottom-row placement, compact progress with duplicate-click rejection, a top-toggle badge, persistent red retry with error tooltip, and a separate ready action. The presentation function, Host Web composition, client plugins, and CSS are real; the Desktop carrier is substituted. These cases do not exercise Electron IPC, menus, task authorization, or installation.
The built Host scenario uses the actual profile Loader, standard agent preset, task services, and Node background processes. It verifies queued turns/steps, a running model request, pending questions/approvals, global and agent jobs in running/stopping states, admission locking without cancellation, restored admission, and rejected inspection after Host disposal. Only model responses and human answers are substituted. Two independent invocations pass concurrently with private profiles and session data; all owned agents, jobs, and Hosts finish before a success report is written.
The Electron workspace runner executes a private copy of the compiled main entry with the real preload, workspace, and separate Host process. It acknowledges the first-run notice and drives renderer buttons through Electron input events. Ten scenarios pass, covering menu feedback, download failure and retry, separate installation confirmation, real confirmation-time task creation, deferral, mandatory blocking, and actual Host teardown timeout. Both ordinary and mandatory failures restore a replacement Host and require fresh installation confirmation; recovery does not clear mandatory policy. Delivery uses a local server and installation is intercepted; these are not signed installed-app results.
The Windows signature runner uses the installed electron-builder metadata generator and NsisUpdater verifier with the public release certificate and real executable inputs. Matching publisher attributes pass; the same valid signature with a different expected publisher and an unsigned executable are rejected. A missing-publisher negative control confirms that verification is skipped. Unit regressions cover DN escaping, incomplete identities, and explicit or host-default Windows targets; removing the publisher configuration fails both metadata cases. This check does not download, install, or sign an artifact.
The signed-download runner connects real Electron HTTP, NsisUpdater, Windows Authenticode, and the built coordinator. Four scenarios pass: valid-hash wrong-publisher rejection, valid-hash unsigned rejection, corrupt-transfer rejection before signature verification, and explicit retry to signed readiness with separate installation handoff. Rejected executable caches are empty, automatic checks issue no retry request, prepared downloads are retained, and original inputs keep their SHA-512. The synthetic feed and test application adapter do not establish installed-version compatibility; no installer or Host starts.
With an old installer and both original blockmaps, the same runner additionally verifies single-range and multipart-range reconstruction, missing-old-blockmap fallback, and rejected-range fallback. Reconstructed executables pass SHA-512 and Authenticode checks. Request records distinguish differential payload bytes from full downloads; a full fallback cannot satisfy a differential-success assertion. These loopback results do not certify CDN Range support or an installed application's cache.
Open verification
The following items are not passing evidence and must remain visible during review:
- Electron
capturePage()captures individual windows. Windows interactive observations include composed dialogs and native menu selection, but cross-platform Figma/layout acceptance and a complete recording remain unverified. The automated workspace runner invokes the menu handler directly. - The development launcher encounters a dangling optional Linux ARM64 dependency junction in this Windows checkout; the qualification runners link the existing dependency graph directly and do not validate that launcher's projection.
- The fixture does not execute an installer, overwrite an installed application, or establish that a new version starts successfully. Signed Windows and macOS installed-version qualification remains required for release.
- Two isolated Windows test installers pass signed-package inspection, including their embedded feed configuration. Installed startup, failure/retry, automatic restart, and data retention remain operator verification; file inspection does not certify a release.
- Live policy origins, gateway behavior, rate limits, approved page origins, and deployed policy configuration are pending backend integration. Local responses are not proof of a live service.
- Policy, updater feed, and updater download stalls reach their real deadlines and recover. Injected download-write
ENOSPCis covered; actual volume exhaustion and installed-upgrade disk pressure remain unverified. Differential download and publisher rejection are verified through real Electron downloads, but not yet in a newly packaged application's installed-upgrade path. - Native clipboard writing passes on Windows. Default-browser launch is attempted, but destination verification stops because the automation tool cannot reliably identify the current URL. macOS browser and clipboard integration remain unverified.
- Mandatory and ordinary failures use localized summaries and folded diagnostics; copy failure reveals a selectable address. Ordinary error tooltips show summaries rather than raw diagnostics. Installed Windows/macOS attention, notification permission, and focus-mode behavior remain unverified.
- Full
doc-syncencounters Windows file-symlinkEPERMin the documentation-site test. This is not an updater failure and does not make the full documentation gate green.
Dev Note
The 2026-09-15 full-workspace run electron-workspace-updates-OwsLMP passes ten scenarios with real Electron, preload, and Host processes and an intercepted installer. It checks that ordinary download errors retain raw text only in initially folded details, task-change guidance survives error summarization, and the installation indicator remains visible without reconnection copy during shutdown. Ordinary and mandatory failed-stop recovery both pass. The screenshot installing-before-host-exit.png records the main-window state; this does not certify the separate installer or subsequent startup GUI.
The 2026-09-15 local run local-updater-Y770Uz passes 17 real-Electron scenarios without executing an installer. Its ordinary-error captures and DOM assertions verify collapsed diagnostics, complete expanded text, a scrollable detail area capped at 180 CSS pixels, and a visible confirmation button with 1,000 diagnostic lines. This does not certify small-window or installed-app layout across operating systems.
TODO (deferred Desktop UX): provide continuous feedback from installation confirmation through the new workspace becoming usable. The old application should describe task shutdown, the installer should own visible progress after the old process exits, and the new application should show startup status. Use real percentages only for measurable installation work, and indeterminate feedback for shutdown/startup; require no additional confirmation. Add timestamps for installer handoff, file replacement, process startup, and first visible window before optimizing the delay. This is a backlog item, not implemented behavior or part of the current error-copy and publication fixes.
On 2026-09-14, operator-authorized builds in .desktop-build/qualification/installed-update-r5dYNH/ produce signed 0.1.6-nightly.20260914.1 and 0.1.6-nightly.20260914.2 installers with one shared private identity and test feed. Each supervised build records 15 successful signing operations and no signing failures; this count does not measure internal token authentication attempts. Version-local verification/check-KaQ0AB/result.json and verification/check-nO2tMM/result.json pass real updater/Authenticode verification, timestamps, archive paths, frozen application bytes, runtime contents, and embedded update settings. The installers contain 155,855,536 and 155,854,520 bytes respectively. The retained authorization and incident archive document software-interlock recovery based on a successful single-file probe; current token login state and retry count were not queried. No installer was executed or remote feed written during these builds and inspections. These local receipts qualify the files, not an installed upgrade. These Nightly numbers identify historical qualification material only; new releases follow the release version rules.
The 2026-09-14 run local-updater-k1Sbo5 passes 17 real-Electron/local-server scenarios, including same-modal installation confirmation and deferral. The complete-workspace report electron-workspace-updates-7J0rLB records 10 scenarios using the compiled main entry, real preload, and real Host process, including mandatory task-stop failure and recovery. Neither run executes an installer. Eight focused suites pass 94 regressions for mandatory rendering, version-bound approval, stale frame rejection, clipboard failures, task recovery, and one-shot Windows/macOS attention adapters. Native notification display is not qualified by these substitutes.
The 2026-09-11 packaging attempt with pnpm run package:desktop:win:x64 and test configuration passes the official build, native payload checks, and isolated runtime Host smoke. The 0.1.5-rc.2 runtime records protocol 4, Node 24.18.1, pnpm 11.7.0, 241 shared packages, and 11,212 files. The first signing operation fails with No private key is available; the command exits 1, and queued operations retain that failure without another signing attempt. No installer, release record, or app-update.yml is produced. The partial app.asar contains com.deepseek.dsh and no mandatory policy. Report .desktop-build/qualification/windows-package-20260911-*.json records the attempt and the other task's uncommitted payload-smoke input. Nothing is uploaded or installed; the configured test origin is not verified final-artifact evidence.
After merging the thin-Web baseline, the Desktop and Host TypeScript builds and bundles pass, as do 79 focused tests for profile management, package preparation, startup, and task protection. host-updates-3u05JI passes twelve real-Host observations; electron-workspace-updates-4Xh5ts passes ten compiled-main scenarios with the shared Web profile defaults. Both exit normally without installer execution. These reports qualify the merged profile composition, not signed installed-version upgrades.
Concurrent runs local-updater-76Tj0v and local-updater-NsoFtx pass seventeen scenarios each, including partial-write ENOSPC, cache cleanup, refused installation, persistent retry, and restored download. A negative control using the original writer fails with ready !== error; the injection is restored. An earlier control that kept short writes without the injected error reaches the runner deadline and provides no success evidence. No real volume is filled and no installer executes.
Windows interactive run native-workspace-updates-2ITSmL uses the compiled main entry, real shared Web Host, native menu selection, and OS clicks. It observes direct download, hash rejection, explicit retry, progress, separate ready confirmation, deferral, the collapsed-sidebar badge, and mandatory blocking. Three retained native-*.png captures show complete ready/mandatory windows and the collapsed sidebar. The actual clipboard equals the configured test URL. Browser destination validation is interrupted by the automation tool; it is not a pass. The synthetic updater version is 0.1.5-rc.1, while the unpackaged shell reports Electron 44.0.0; this is not installed-version evidence. Explicit fixture shutdown exits normally with no installer calls and retains native-runtime-result.json. The private driver and captures are local aids, not an automated CI scenario.
Thin-Web baseline qualification is separate from the historical reports below. Concurrent built-Host runs host-updates-8pqnUP and host-updates-ZwYzBa pass twelve observations, including a real HTTP read drained without a task warning and an admitted write whose queued task is detected after draining. The compiled-main run electron-workspace-updates-HCWgwA passes ten scenarios with the shared Web Host and Electron Node runtime, including ordinary and mandatory failed-stop recovery. Installation remains intercepted; individual window captures do not certify operating-system composition.
The 2026-09-11 test-deployment reports cdn-test-upload-report.json and cdn-test-download-report.json under .desktop-build/qualification/ record successful isolated COS uploads, same-URL feed replacement, updater observation, 60-byte download with matching SHA-512, and a correct HTTP 206 Range response from download-test.deepseek.com. Feed responses use max-age=0; the payload uses max-age=86400. Remote probe objects are retained. This is transport evidence only: no installer executes and no publisher signature is verified.
Append <old.exe> to the signed-download command to enable four differential cases; <signed.exe>.blockmap and <old.exe>.blockmap must exist beside the input installers. On 2026-09-11, signed-downloads-roqKBc reconstructs the 190,511,600-byte signed 0.1.3-alpha.1 installer from a private cached copy of 0.1.2-rc.1, downloading 122,242,722 payload bytes through either Range mode, excluding blockmaps and multipart framing. Both fallback cases download the full payload. Concurrent runs signed-downloads-HXCCYB and signed-downloads-MWpDAQ overlap from 08:11:09 to 08:11:37 UTC and pass eight cases each. Negative control signed-downloads-XcCPuf disables differential download and fails the blockmap-request assertion despite reaching signed readiness; the fixture setting is restored. Reports record normal child exits without deadlines for these runs; their runtime directories are removed after exit.
The 2026-09-11 Windows preparation produces a 0.1.5-rc.1 runtime with 11,213 inventoried files and 241 shared packages. An independent verifyDesktopRuntime → smokeDesktopRuntime → verifyDesktopRuntime run passes against that tree: its isolated profile boots the real Host, serves the frontend, and stops. The original preparation process exits, but its terminal result is unavailable; this record relies on the independent checks rather than claiming its exit code. This is resource preparation, not a new signed package or installed upgrade.
With Desktop outputs built, run node apps/desktop/scripts/test-signed-updates.mjs <public.cer> <signed.exe> <unsigned.exe> from the repository root on Windows. Reports remain under apps/desktop/.desktop-build/qualification/signed-downloads-*; runtime caches are removed after child exit. The default deadline is 180 seconds; DSH_SIGNED_UPDATE_TEST_TIMEOUT_MS accepts 1000–180000 milliseconds for runner-failure qualification. Concurrent runs signed-downloads-JBJCU8 and signed-downloads-N4D01x overlap from 07:52:30 to 07:52:38 UTC on 2026-09-11 and pass four scenarios each. The 1000 ms control signed-downloads-L6rrcn records a timeout and exit 1; signed-downloads-uxgcmk fails because missing publisher metadata incorrectly reaches readiness. Associated processes and runtime caches are absent after these runs. These tests use historical artifact bytes and synthetic 1.0.0/1.0.1-nightly.1 application/feed versions, not a releasable version pair.
On Windows with dependencies installed, run node apps/desktop/scripts/test-windows-update-signature.mjs <public.cer> <signed.exe> <unsigned.exe> from the repository root, replacing all three paths with local inputs. It requires no PIN or private key, rejects skipped PowerShell verification, preserves both input hashes, and writes a private report under apps/desktop/.desktop-build/qualification/windows-update-signature-*/result.json. The 2026-09-11 run windows-update-signature-jVs7pV passes all four controls using the signed 0.1.3-alpha.1 and unsigned 0.1.5-rc.1 installers. These inputs do not represent the current update implementation; the report qualifies signature verification only, not their installation or release readiness.
This record does not certify a release. The mandatory client decision and local qualification decision own behavior and test limitations.
The ordinary-scheduling integration run under apps/desktop/.desktop-build/qualification/electron-workspace-updates-oTp6fg/ reaches checking/current feedback and captures the download-error dialog, then hits the runner's 120-second deadline (timeout=true, SIGTERM). It has no success report. The deliberately stalled-screenshot negative control electron-workspace-updates-3cASkr/ also stalls its diagnostic frame wait in a hidden window; windowsHide: true in electron-workspace-updates-PpuQrK/ fails the visibility assertion. Concurrent visible-window run electron-workspace-updates-9JCS9h/ records an occluded page (visibility: hidden) with 200ms animations stopped at time zero. Its operation deadline exits with code 1, not the outer timeout. The original timeout lacks an operation trace, so its exact stalled call remains unknown. These failures are not passing evidence.
With the repository Host and client outputs already built, node --import tsx apps/desktop/scripts/test-host-updates.ts runs the Host scenario from the repository root. The 2026-09-11 concurrent run records .desktop-build/qualification/host-updates-kJ9MJm/result.json and host-updates-m5XkWN/result.json. Each invocation removes its private linked project after child exit and retains evidence under a fresh ignored directory. No installer, cloud credentials, or user's profile is used.
With Host, client, and Desktop outputs built, node --import tsx apps/desktop/scripts/test-workspace-updates.ts runs the compiled-main scenario from the repository root. Concurrent reports under apps/desktop/.desktop-build/qualification/electron-workspace-updates-FHCslk/ and electron-workspace-updates-brIire/ each pass ten scenarios, capture fifteen PNGs, and record no failed operation, including the ordinary polling changes. The runner refuses a hidden main window and temporarily disables background throttling only during owned observations, restoring the original setting afterward. It does not disable animations or change production configuration. Each run removes its private app after Electron exits and executes no installer; associated processes have exited. It copies TypeScript-emitted Desktop modules and built preloads, not the bundled main artifact or the development launcher's dependency projection.
The 2026-09-11 browser run uses PLAYWRIGHT_BROWSERS_PATH=apps/desktop/.desktop-build/playwright and DSH_SNAPSHOT=replay with node apps/desktop/node_modules/pnpm/bin/pnpm.mjs run test:web:built apps/web/tests/desktop-updates.e2e.ts. Reports and screenshots are under .desktop-build/qualification/workspace-updates-zh-CN-p9JWom/ and workspace-updates-en-US-czUF72/. These local paths are not committed; the scenario reproduces them under fresh names. The settings/sidebar run uses the same command with apps/web/tests/settings-chrome.e2e.ts apps/web/tests/sidebar-scrollbar.e2e.ts instead of the Desktop scenario.
Unlocked-host evidence on 2026-09-11 remains local under .desktop-build/qualification/: local-updater-E0dqFV/result.json records the 15-scenario rerun; interactive-Jds33D/interactive-result.json records download, verification, readiness, and deferred installation without an installer call; interactive-Jds33D/mandatory-policy-error.png captures the blocking error state. The interactive driver uses the real mandatory renderer, preload, policy client, HTTP executor, and coordinator, but a blank parent window and simulated task confirmation. The <b> text in its title is an intentional plain-text safety input, not product copy. The windows and listeners are closed after qualification. These ignored artifacts are inspection aids, not committed or CI-reproducible evidence.