Prove packaged macOS and Windows startup before release

.github/workflows/ci.yml

@@ -205,6 +205,9 @@ jobs:
           bun run --cwd apps/desktop test src/desktopBackendSupervisor.test.ts src/backendProcessTree.test.ts
           bun run --cwd apps/server test src/desktopParentShutdown.test.ts
 
+      - name: Test packaged startup Windows launcher
+        run: bun x vitest run scripts/verify-packaged-desktop-startup.test.ts
+
       - name: Exercise Windows release staging
         run: bun run release:smoke
 

.github/workflows/release.yml

@@ -22,8 +22,7 @@ on:
         type: boolean
 
 permissions:
-  contents: write
-  id-token: write
+  contents: read
 
 concurrency:
   group: scient-desktop-release
@@ -208,6 +207,8 @@ jobs:
 
   build:
     name: Build ${{ matrix.label }}
+    permissions:
+      contents: read
     needs: preflight
     runs-on: ${{ matrix.runner }}
     timeout-minutes: ${{ matrix.timeout_minutes }}
@@ -245,6 +246,7 @@ jobs:
         with:
           ref: ${{ needs.preflight.outputs.ref }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -309,6 +311,7 @@ jobs:
             "${{ needs.preflight.outputs.version }}"
 
       - name: Build Windows desktop artifact
+        id: build_windows
         if: matrix.platform == 'win'
         shell: bash
         env:
@@ -386,6 +389,31 @@ jobs:
             fi
           fi
 
+      - name: Smoke exact packaged desktop startup
+        if: ${{ matrix.platform != 'linux' }}
+        shell: bash
+        env:
+          SCIENT_PACKAGED_STARTUP_DIAGNOSTICS_DIR: ${{ github.workspace }}/packaged-startup-diagnostics
+          SCIENT_WINDOWS_PUBLISHER_SUBJECT: ${{ vars.SCIENT_WINDOWS_PUBLISHER_SUBJECT }}
+        run: |
+          node scripts/verify-packaged-desktop-startup.ts \
+            --assets-dir release-publish \
+            --platform "${{ matrix.platform }}" \
+            --arch "${{ matrix.arch }}" \
+            --version "${{ needs.preflight.outputs.version }}" \
+            --commit "${{ github.sha }}" \
+            --allow-unsigned-windows "${{ steps.build_windows.outputs.windows_signed != 'true' }}" \
+            --windows-publisher-subject "$SCIENT_WINDOWS_PUBLISHER_SUBJECT"
+
+      - name: Upload packaged startup failure diagnostics
+        if: ${{ failure() && matrix.platform != 'linux' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: packaged-startup-diagnostics-${{ matrix.platform }}-${{ matrix.arch }}
+          path: packaged-startup-diagnostics/*
+          if-no-files-found: warn
+          retention-days: 7
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
@@ -395,6 +423,9 @@ jobs:
 
   publish_cli:
     name: Publish CLI to npm
+    permissions:
+      contents: read
+      id-token: write
     if: ${{ needs.preflight.outputs.publish_release == 'true' && vars.SCIENT_PUBLISH_CLI == '1' }}
     needs: [preflight, build]
     runs-on: ubuntu-24.04
@@ -432,6 +463,8 @@ jobs:
 
   release:
     name: Publish GitHub Release
+    permissions:
+      contents: write
     if: ${{ needs.preflight.outputs.publish_release == 'true' }}
     needs: [preflight, build]
     runs-on: ubuntu-24.04

apps/desktop/src/backendProcessTree.test.ts

@@ -21,6 +21,10 @@ describe("forceTerminateBackendProcessTree", () => {
       detached: false,
       stdio: ["ignore", "inherit", "inherit", "ipc"],
     });
+    expect(backendProcessContainmentOptions(false, "darwin", false)).toEqual({
+      detached: false,
+      stdio: ["ignore", "inherit", "inherit", "ipc"],
+    });
   });
 
   it("kills the detached POSIX process group", async () => {
@@ -74,6 +78,28 @@ describe("forceTerminateBackendProcessTree", () => {
     );
   });
 
+  it.each(["darwin", "win32"] as const)(
+    "never signals a backend PID when external containment owns cleanup on %s",
+    async (platform) => {
+      const killProcessGroup = vi.fn();
+      const spawnProcess = vi.fn();
+
+      await expect(
+        forceTerminateBackendProcessTree(
+          { pid: 4321 },
+          {
+            platform,
+            retainedByExternalContainment: true,
+            killProcessGroup,
+            spawnProcess: spawnProcess as never,
+          },
+        ),
+      ).rejects.toThrow("External packaged-startup containment retains cleanup authority");
+      expect(killProcessGroup).not.toHaveBeenCalled();
+      expect(spawnProcess).not.toHaveBeenCalled();
+    },
+  );
+
   it("does not treat a missing Windows root as successful descendant cleanup", async () => {
     const process = new EventEmitter();
     const spawnProcess = vi.fn(() => process);

apps/desktop/src/backendProcessTree.ts

@@ -7,16 +7,18 @@ import { resolveWindowsSystemRoot } from "@synara/shared/windowsProcess";
 export interface ForceTerminateBackendProcessTreeOptions {
   readonly platform?: NodeJS.Platform;
   readonly env?: NodeJS.ProcessEnv;
+  readonly retainedByExternalContainment?: boolean;
   readonly killProcessGroup?: (pid: number, signal: NodeJS.Signals) => void;
   readonly spawnProcess?: typeof spawn;
 }
 
 export function backendProcessContainmentOptions(
   captureLogs: boolean,
   platform: NodeJS.Platform = process.platform,
+  isolatePosixProcessGroup = true,
 ): Pick<SpawnOptions, "detached" | "stdio"> {
   return {
-    detached: platform !== "win32",
+    detached: platform !== "win32" && isolatePosixProcessGroup,
     stdio: captureLogs
       ? ["ignore", "pipe", "pipe", "ipc"]
       : ["ignore", "inherit", "inherit", "ipc"],
@@ -57,6 +59,11 @@ export async function forceTerminateBackendProcessTree(
   child: Pick<ChildProcess, "pid">,
   options: ForceTerminateBackendProcessTreeOptions = {},
 ): Promise<void> {
+  if (options.retainedByExternalContainment) {
+    throw new Error(
+      "External packaged-startup containment retains cleanup authority; refusing backend PID-tree signaling.",
+    );
+  }
   const pid = child.pid;
   if (!pid || pid <= 0) return;