fix(desktop,cli): bundle lane G — sidecar signing, restart warning, probe ceilings, hidden autostart, mise updates, Linux packaged E2E

.github/workflows/ci.yml

@@ -182,6 +182,7 @@ jobs:
       # step. A missing or malformed filter output must fail this job instead
       # of silently making every expensive job skip.
       ci: ${{ steps.scope.outputs.ci }}
+      desktop: ${{ steps.scope.outputs.desktop }}
       native: ${{ steps.matrices.outputs.native }}
       # Matrix include lists for keyring-smoke and npm-global-smoke, built and
       # shape-checked by the same validation step as `native`.
@@ -265,6 +266,20 @@ jobs:
               - '.github/workflows/ci.yml'
             gui:
               - 'gui/**'
+            # Building both Linux package formats and booting their real payloads is
+            # substantially heavier than the Rust-only desktop-shell check. Keep it
+            # scoped to inputs that can change the packaged shell, dashboard or
+            # standalone sidecar. The workflow names itself so edits to this lane
+            # cannot skip their own E2E.
+            desktop:
+              - 'desktop/**'
+              - 'gui/**'
+              - 'src/**'
+              - 'scripts/build-standalone.ts'
+              - 'scripts/standalone-targets.ts'
+              - 'package.json'
+              - 'bun.lock'
+              - '.github/workflows/ci.yml'
             # The docs site is built by nothing else on a pull request. `ci` above
             # deliberately omits `docs-site/**` -- a prose edit has no business
             # starting the cross-platform suite -- and `deploy-docs.yml` triggers
@@ -342,6 +357,7 @@ jobs:
         shell: bash
         env:
           CI_SCOPE: ${{ steps.filter.outputs.ci }}
+          DESKTOP_SCOPE: ${{ steps.filter.outputs.desktop }}
         run: |
           set -euo pipefail
           case "$CI_SCOPE" in
@@ -353,6 +369,15 @@ jobs:
               exit 1
               ;;
           esac
+          case "$DESKTOP_SCOPE" in
+            true|false)
+              printf 'desktop=%s\n' "$DESKTOP_SCOPE" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              printf '::error::changes.outputs.desktop was %q, expected true or false\n' "$DESKTOP_SCOPE"
+              exit 1
+              ;;
+          esac
 
       - name: Assert the native and matrix outputs are usable
         id: matrices
@@ -1345,11 +1370,11 @@ jobs:
   desktop-shell:
     name: desktop shell
     needs: [changes, gates]
-    # Native-gated like platform-macos: the Rust shell is formatted, linted
-    # and tested only when native-capable paths changed.
-    if: github.event_name != 'pull_request' || (needs.changes.outputs.ci == 'true' && needs.changes.outputs.native == 'true')
+    # Native shell changes run the Rust checks; package-affecting changes also run the real Linux
+    # bundle acceptance. The aggregate gate below mirrors this union exactly.
+    if: github.event_name != 'pull_request' || (needs.changes.outputs.ci == 'true' && (needs.changes.outputs.native == 'true' || needs.changes.outputs.desktop == 'true'))
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 45
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -1359,7 +1384,11 @@ jobs:
       - name: Install Tauri Linux dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf dbus-x11 xvfb xauth wmctrl xdotool openbox
+
+      - name: Setup Bun for packaged E2E
+        if: needs.changes.outputs.desktop == 'true'
+        uses: ./.github/actions/setup-project-bun
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
@@ -1385,6 +1414,79 @@ jobs:
       - name: Run Rust tests
         run: cargo test --manifest-path desktop/src-tauri/Cargo.toml
 
+      - name: Install packaged E2E dependencies
+        if: needs.changes.outputs.desktop == 'true'
+        run: |
+          bun install --frozen-lockfile
+          cd desktop
+          bun install --frozen-lockfile
+
+      - name: Build dashboard and bundled sidecar
+        if: needs.changes.outputs.desktop == 'true'
+        run: |
+          bun run build:gui
+          bun desktop/scripts/prepare-sidecar.ts --target x86_64-unknown-linux-gnu
+
+      # Build separately. One format failing must not delete or hide the other
+      # format's evidence, and neither verification artifact needs an updater key.
+      - name: Preserve the compiled Linux sidecar
+        if: needs.changes.outputs.desktop == 'true'
+        run: chmod +x desktop/scripts/appimage-patchelf.py
+
+      - name: Build Linux AppImage
+        if: needs.changes.outputs.desktop == 'true'
+        working-directory: desktop
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-appimage-target
+          PATCHELF: ${{ github.workspace }}/desktop/scripts/appimage-patchelf.py
+        run: bunx tauri build --ci --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
+
+      - name: Build Linux deb
+        if: needs.changes.outputs.desktop == 'true'
+        working-directory: desktop
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-deb-target
+        run: bunx tauri build --ci --bundles deb --config '{"bundle":{"createUpdaterArtifacts":false}}'
+
+      - name: Stage isolated Linux bundles
+        if: needs.changes.outputs.desktop == 'true'
+        env:
+          APPIMAGE_BUNDLE: ${{ runner.temp }}/opencodex-appimage-target/release/bundle/appimage
+          DEB_BUNDLE: ${{ runner.temp }}/opencodex-deb-target/release/bundle/deb
+          BUNDLE_ROOT: ${{ runner.temp }}/opencodex-linux-bundles
+        run: |
+          set -euo pipefail
+          mkdir -p "$BUNDLE_ROOT/appimage" "$BUNDLE_ROOT/deb"
+          cp -a "$APPIMAGE_BUNDLE/." "$BUNDLE_ROOT/appimage/"
+          cp -a "$DEB_BUNDLE/." "$BUNDLE_ROOT/deb/"
+          chmod -R a-w "$BUNDLE_ROOT"
+
+      - name: Run Linux packaged-shell E2E
+        if: needs.changes.outputs.desktop == 'true'
+        env:
+          REPORT_PATH: ${{ runner.temp }}/opencodex-linux-e2e/report.json
+        run: |
+          set -euo pipefail
+          mkdir -p "$(dirname "$REPORT_PATH")"
+          dbus-run-session -- xvfb-run -a -s '-screen 0 1440x900x24' bash -lc '
+            openbox >"$RUNNER_TEMP/opencodex-openbox.log" 2>&1 &
+            wm_pid=$!
+            trap '\''kill "$wm_pid" 2>/dev/null || true'\'' EXIT
+            bun desktop/scripts/linux-packaged-e2e.ts \
+              --bundle-root "$RUNNER_TEMP/opencodex-linux-bundles" \
+              --report "$REPORT_PATH" \
+              --version "$(jq -r .version package.json)"
+          '
+
+      - name: Upload Linux packaged-shell E2E report
+        if: always() && needs.changes.outputs.desktop == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-packaged-shell-e2e
+          path: ${{ runner.temp }}/opencodex-linux-e2e/report.json
+          if-no-files-found: warn
+          retention-days: 7
+
   ci:
     name: ci
     if: always()
@@ -1414,6 +1516,7 @@ jobs:
           CHANGES_SETUP_ACTION: ${{ needs.changes.outputs.setup_action }}
           CHANGES_REMOTE_HELPER: ${{ needs.changes.outputs.remote_helper }}
           CHANGES_NATIVE: ${{ needs.changes.outputs.native }}
+          CHANGES_DESKTOP: ${{ needs.changes.outputs.desktop }}
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
@@ -1434,15 +1537,19 @@ jobs:
           if [ "$EVENT_NAME" = "pull_request" ] && [ "$CHANGES_CI" != "true" ]; then
             scoped=not-requested
           fi
-          # platform-macos, widget and desktop-shell carry a compound
-          # condition: the ordinary scope gate AND the native path filter.
+          # platform-macos and widget carry the ordinary scope gate AND the native path filter.
+          # desktop-shell accepts that native set plus the package-E2E set.
           # This mirrors that expression exactly; where it disagrees with the
           # jobs' own `if:`, the gate fails by name instead of demanding
           # success from a job that was deliberately left unselected.
           native=not-requested
           if [ "$EVENT_NAME" != "pull_request" ] || { [ "$CHANGES_CI" = "true" ] && [ "$CHANGES_NATIVE" = "true" ]; }; then
             native=requested
           fi
+          desktop_shell=not-requested
+          if [ "$EVENT_NAME" != "pull_request" ] || { [ "$CHANGES_CI" = "true" ] && { [ "$CHANGES_NATIVE" = "true" ] || [ "$CHANGES_DESKTOP" = "true" ]; }; }; then
+            desktop_shell=requested
+          fi
           packaging=not-requested
           if [ "$CHANGES_PACKAGING" = "true" ]; then
             packaging=requested
@@ -1499,8 +1606,9 @@ jobs:
               changes|select-windows-runner) echo requested ;;
               test|storage-policy|api-usage|gates|keyring-smoke|docker-smoke)
                 echo "$scoped" ;;
-              platform-macos|widget|desktop-shell)
+              platform-macos|widget)
                 echo "$native" ;;
+              desktop-shell) echo "$desktop_shell" ;;
               npm-global-smoke) echo "$packaging" ;;
               docs-site-build) echo "$docs" ;;
               structure-gate) echo "$structure" ;;

.github/workflows/release.yml

@@ -414,6 +414,7 @@ jobs:
       # and updater signatures require maintainer-owned credentials; builds without
       # those secrets remain useful for local validation but are not release assets.
       - name: Build desktop bundles
+        if: runner.os != 'Linux'
         working-directory: desktop
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -429,20 +430,64 @@ jobs:
         # diagnostics on the first attempt; Apple signing commands stay non-verbose.
         run: bunx tauri ${{ runner.os == 'Linux' && '--verbose' || '' }} build --ci --target ${{ matrix.target }} --bundles ${{ matrix.bundles }} --config "${{ runner.os == 'Windows' && format('{0}/opencodex-msi.json', runner.temp) || '{}' }}"
 
+      # Tauri patches a bundle-type marker into the application binary for each Linux format.
+      # Keep each format in its own Cargo target so the deb cannot inherit the AppImage marker
+      # and linuxdeploy cannot mutate the binary later consumed by the deb build.
+      - name: Build Linux AppImage bundle
+        if: runner.os == 'Linux'
+        working-directory: desktop
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-appimage-target
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: bunx tauri build --ci --target ${{ matrix.target }} --bundles appimage
+
+      - name: Build Linux deb bundle
+        if: runner.os == 'Linux'
+        working-directory: desktop
+        env:
+          CARGO_TARGET_DIR: ${{ runner.temp }}/opencodex-deb-target
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: bunx tauri build --ci --target ${{ matrix.target }} --bundles deb
+
+      - name: Stage isolated Linux release bundles
+        if: runner.os == 'Linux'
+        shell: bash
+        env:
+          DESKTOP_TARGET: ${{ matrix.target }}
+          APPIMAGE_TARGET: ${{ runner.temp }}/opencodex-appimage-target
+          DEB_TARGET: ${{ runner.temp }}/opencodex-deb-target
+        run: |
+          set -euo pipefail
+          bundle_root="$RUNNER_TEMP/opencodex-linux-release-bundles"
+          mkdir -p "$bundle_root/appimage" "$bundle_root/deb"
+          cp -a "$APPIMAGE_TARGET/$DESKTOP_TARGET/release/bundle/appimage/." "$bundle_root/appimage/"
+          cp -a "$DEB_TARGET/$DESKTOP_TARGET/release/bundle/deb/." "$bundle_root/deb/"
+          chmod -R a-w "$bundle_root"
+          echo "DESKTOP_BUNDLE_ROOT=$bundle_root" >> "$GITHUB_ENV"
+
+      # After the isolated AppImage exists, and against that staged copy: the default Cargo target
+      # holds no Linux bundle any more, so verifying there would fail or check a stale artifact.
       - name: Verify the packaged Linux sidecar
         if: runner.os == 'Linux'
-        run: bash desktop/scripts/verify-linux-sidecar.sh
+        run: bash desktop/scripts/verify-linux-sidecar.sh "$DESKTOP_BUNDLE_ROOT/appimage"
 
       - name: Rename release assets
         shell: bash
         env:
           RELEASE_VERSION: ${{ inputs.version }}
           DESKTOP_TARGET: ${{ matrix.target }}
         run: |
-          bun desktop/scripts/collect-release-assets.ts \
+          args=( \
             --version "$RELEASE_VERSION" \
             --target "$DESKTOP_TARGET" \
-            --out dist/release
+            --out dist/release \
+          )
+          if [[ -n "${DESKTOP_BUNDLE_ROOT:-}" ]]; then
+            args+=(--bundle-root "$DESKTOP_BUNDLE_ROOT")
+          fi
+          bun desktop/scripts/collect-release-assets.ts "${args[@]}"
 
       # After the bundle exists, not before: a sweep that runs first passes by finding nothing.
       - name: Verify every Mach-O in the bundle carries the release identity

bin/ocx.mjs

@@ -36,7 +36,7 @@ import { fileURLToPath } from "node:url";
 import { isRealBunBinary } from "../src/lib/bun-binary-validator.mjs";
 import { npmInvocation } from "../src/update/npm-invocation.mjs";
 import { pnpmInvocationForPath, resolvePnpmCommands } from "../src/update/pnpm-invocation.mjs";
-import { detectInstallFromPath } from "../src/update/install-detection.mjs";
+import { detectInstallOwnershipFromPath } from "../src/update/install-detection.mjs";
 import {
   pnpmOwnerInvocation,
   resolvePnpmGlobalOwner,
@@ -71,7 +71,8 @@ try {
 }
 const require = createRequire(import.meta.url);
 const here = dirname(fileURLToPath(import.meta.url));
-const installMethod = detectInstallFromPath(here, { exists: existsSync });
+const installOwnership = detectInstallOwnershipFromPath(here, { exists: existsSync });
+const installMethod = installOwnership.installer;
 const cliPath = join(here, "..", "src", "cli", "index.ts");
 const NODE_LAUNCH_CONTEXT_ENV = "OCX_NODE_LAUNCH_CONTEXT";
 const NODE_LAUNCH_PROOF_PREFIX = "--ocx-internal-launch-proof=";
@@ -924,6 +925,19 @@ if (codexCliUpdateInspection && typeof process.versions.bun === "string") {
   process.exit(1);
 }
 
+if (process.argv[2] === "update" && installMethod === "mise") {
+  if (installOwnership.owner) {
+    console.error(
+      `opencodex: this installation is externally managed by mise; update it with: mise upgrade ${installOwnership.owner.tool}`,
+    );
+  } else {
+    console.error(
+      "opencodex: this installation appears to be managed by mise, but its ownership metadata is unreadable or inconsistent; repair the mise installation metadata before updating.",
+    );
+  }
+  process.exit(1);
+}
+
 if (process.argv[2] === "update" && isNodeModulesInstall() && !isBunGlobalInstall()) {
   if (installMethod === "npm") runNpmSelfUpdate();
   if (installMethod === "pnpm") runPnpmSelfUpdate();

desktop/package.json

@@ -5,6 +5,7 @@
     "dev": "tauri dev",
     "build": "tauri build",
     "build:local": "bun scripts/build-local.ts",
+    "e2e:linux-packaged": "bun scripts/linux-packaged-e2e.ts",
     "icons": "bun scripts/generate-icons.ts",
     "icons:check": "bun scripts/generate-icons.ts --check",
     "prepare-sidecar": "bun scripts/prepare-sidecar.ts",

desktop/scripts/appimage-patchelf.py

@@ -5,17 +5,51 @@
 import sys
 
 
+APPDIR_SIDECAR_TAIL = (
+    "release",
+    "bundle",
+    "appimage",
+    "OpenCodex.AppDir",
+    "usr",
+    "bin",
+    "ocx",
+)
+
+
+def prepared_sidecar(root, candidate, target_root):
+    """Return the one prepared Linux CLI that the AppDir sidecar exactly mirrors."""
+    try:
+        relative = candidate.resolve().relative_to(target_root.resolve())
+    except ValueError:
+        return None
+    if tuple(relative.parts[-len(APPDIR_SIDECAR_TAIL):]) != APPDIR_SIDECAR_TAIL:
+        return None
+    prefix = relative.parts[:-len(APPDIR_SIDECAR_TAIL)]
+    if len(prefix) > 1:
+        return None
+
+    binaries = root / "desktop/src-tauri/binaries"
+    candidates = sorted(path for path in binaries.glob("ocx-*-linux-gnu") if path.is_file())
+    if prefix:
+        candidates = [path for path in candidates if path.name == f"ocx-{prefix[0]}"]
+    matches = [path for path in candidates if path.read_bytes() == candidate.read_bytes()]
+    return matches[0] if len(matches) == 1 else None
+
+
 def main(args):
     root = Path(__file__).resolve().parents[2]
-    triple = "x86_64-unknown-linux-gnu"
-    original = root / "desktop/src-tauri/binaries" / f"ocx-{triple}"
-    sidecar = root / "desktop/src-tauri/target" / triple / "release/bundle/appimage/OpenCodex.AppDir/usr/bin/ocx"
-    if len(args) == 3 and args[:2] == ["--set-rpath", "$ORIGIN/../lib"] and Path(args[2]).resolve() == sidecar.resolve():
+    target_root = Path(os.environ.get("CARGO_TARGET_DIR", root / "desktop/src-tauri/target"))
+    sidecar = Path(args[2]) if len(args) == 3 else None
+    if (
+        sidecar is not None
+        and args[:2] == ["--set-rpath", "$ORIGIN/../lib"]
+        and prepared_sidecar(root, sidecar, target_root) is not None
+    ):
         # linuxdeploy's nested GTK pass runs ldd again after patching. Its
         # patchelf rewrite breaks the compiled Bun ELF. This sidecar depends
         # only on host glibc libraries; it needs no AppDir library search path.
         # Never bless an already-modified binary or a different executable.
-        if sidecar.is_symlink() or original.read_bytes() != sidecar.read_bytes():
+        if sidecar.is_symlink():
             raise RuntimeError("AppImage sidecar differs from the prepared CLI")
         print("Preserving compiled ocx bytes (no AppDir RPATH required)", file=sys.stderr)
         return