Skip to content

Harden provider installation and sign-in#103

Merged
yaacovcorcos merged 9 commits into
mainfrom
fix/provider-onboarding-reliability
Jul 24, 2026
Merged

Harden provider installation and sign-in#103
yaacovcorcos merged 9 commits into
mainfrom
fix/provider-onboarding-reliability

Conversation

@yaacovcorcos

@yaacovcorcos yaacovcorcos commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What changed

  • Chain a managed provider installation into the provider's official sign-in only after the exact installation operation succeeds.
  • Refresh Windows user/system environment discovery without blocking the server event loop, and recognize the official standalone Codex location under %LOCALAPPDATA%.
  • Make cancellation and managed-runtime activation mutually exclusive, and wait for active provider operations before shutdown persistence completes.
  • Surface validated Codex browser authorization URLs, add the official device-code recovery path, and let users reopen the provider authorization page.
  • Persist bounded terminal installation failures so restart does not erase the useful diagnosis.
  • Keep recovery on the sign-in path when installation succeeded but the automatic sign-in handoff failed.
  • Add focused contract, server, browser, and hosted Windows runtime-discovery coverage.

Why

On Windows, Scient could launch a provider installer successfully but keep using the desktop process's stale launch-time PATH, so the newly installed CLI still appeared missing. Installation and account connection were separate operations, leaving users at a dead end after download. Browser-launch failure had no in-app recovery path, and installation errors disappeared after restart.

Authentication remains owned by each provider CLI. Scient only orchestrates allowlisted commands and exposes validated, transient progress; it does not receive or persist provider credentials.

Reliability and recovery behavior

  • Installation cancellation cannot race and win after runtime activation has begun.
  • App shutdown requests cancellation and waits for active provider operations before flushing installation state.
  • Windows persistent environment reads are asynchronous and refreshed after the bounded cache interval.
  • Terminal failed/cancelled installation state is restored for diagnosis; stale successful state is not.
  • A failed automatic post-install sign-in offers Try again, not another installation.
  • Cancellation, failure, retry, restart restoration, browser recovery, and managed install-to-sign-in handoff have focused automated coverage.

Relationship to #68

This PR is the focused provider runtime/install/sign-in reliability foundation and partially supersedes the overlapping lifecycle, browser-launch recovery, and native OpenAI OAuth work in #68. PR #68 remains a conflicted external-contributor branch with unresolved review concerns and should not merge as one broad change. After this foundation lands, its useful independent onboarding and provider-selection UI concepts can be rebased and split into focused follow-ups. Duplicate provider lifecycle code and native OpenAI OAuth should not be carried forward; Codex authentication remains owned by the official codex login flows. No changes were made to the contributor branch.

Validation on exact head

Head: 1209a77
Base: e6af16d

Local:

  • git diff --check
  • bun run fmt:check
  • bun run lint — 0 errors; repository baseline warnings only
  • bun run typecheck — all 9 packages
  • bun run test — complete 9-package suite passed
  • focused provider server tests — 58 passed, 2 platform-only skips on macOS
  • provider connection presentation tests — 22 passed
  • provider dialog Chromium tests — 28 passed
  • shared Windows shell/process tests — 22 passed

Hosted CI run 430:

  • Format, lint, typecheck, full test, stable browser tests, Linux geometry quarantine, and desktop build — passed
  • Windows Process Regression — passed, including provider runtime discovery, private-state initialization, backend lifecycle, and release staging
  • HTML preview platform smoke — passed on Linux and Windows
  • Release smoke — passed

Independent final read-only review on the exact head:

  • correctness/reliability — no P0-P2 findings
  • security/release safety — no P0-P2 findings
  • architecture/product/accessibility/test proof — no P0-P2 findings

Deferred native Windows acceptance

A fresh native Windows packaged-app walkthrough remains recommended before the next desktop release. The maintainer explicitly accepted deferring it beyond this PR's merge, so it is not a merge gate for this change.

The follow-up walkthrough should use an isolated user profile or resettable VM with no provider CLI, provider credentials, inherited provider PATH, or prior Scient state, and cover:

  1. managed install from Scient;
  2. discovery without restarting Scient;
  3. official provider browser sign-in, plus Codex device-code recovery;
  4. cancellation before activation;
  5. installation/sign-in failure, retry, and restart diagnosis recovery;
  6. confirmation that no provider secret or one-time code is persisted or exposed.

Hosted Windows CI proves the automated process and discovery behavior. The remaining packaged-app/account walkthrough is recorded as deferred acceptance rather than represented as completed.\n\n## Current-main final certification\n\n- Exact base: 0428e693417b031529befc2b7498a2635011becb.\n- Exact candidate: df4407d153d7db93b75656e100a06acd79aec698.\n- Current main was merged normally; the only overlapping path was CI workflow plumbing and it composed without conflict.\n- Resolved final-review findings: Codex device authorization now uses a provider-aligned 16-minute timeout with cleanup proof and matching UI countdown; its asynchronously delivered code is announced through a named polite atomic status and its copy transition is browser-tested; stale automatic-browser failures are fenced from successor operations.\n- Exact-head focused verification: provider lifecycle 52/52, provider runtime manager 8/8, presentation 22/22, browser 29/29, shared Windows shell 22/22, and web typecheck passed.\n- Exact-head bun run scient:upstream-check --intake passed: identity, format, lint with 0 errors, 9/9 typechecks, full tests, builds, release smoke, diff/clean-worktree checks.\n- Exactly three independent final-head reviews recertified correctness/reliability, security/release safety, and architecture/product/accessibility with P0=0, P1=0, P2=0, P3=0.\n- The maintainer-approved native packaged-Windows provider walkthrough remains a pre-release evidence follow-up, not a merge gate.\n

@github-actions github-actions Bot added vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. size:XL labels Jul 23, 2026
@yaacovcorcos
yaacovcorcos force-pushed the fix/provider-onboarding-reliability branch from 340164a to 8f1c6e4 Compare July 23, 2026 21:33
@yaacovcorcos yaacovcorcos mentioned this pull request Jul 24, 2026
Merged
@yaacovcorcos yaacovcorcos added the on-hold Work intentionally paused; do not merge until explicitly resumed. label Jul 24, 2026
@yaacovcorcos yaacovcorcos removed the on-hold Work intentionally paused; do not merge until explicitly resumed. label Jul 24, 2026
@yaacovcorcos
yaacovcorcos marked this pull request as ready for review July 24, 2026 17:06
@yaacovcorcos

yaacovcorcos commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Final current-main candidate pushed: df4407d153d7db93b75656e100a06acd79aec698 on exact base 0428e693417b031529befc2b7498a2635011becb. Full local intake certification passed; focused provider/browser tests passed; exactly three independent final-head reviews cleared P0-P3. Awaiting fresh hosted CI on this exact SHA before merge.

@yaacovcorcos
yaacovcorcos merged commit 65a6961 into main Jul 24, 2026
10 checks passed
@yaacovcorcos
yaacovcorcos deleted the fix/provider-onboarding-reliability branch July 24, 2026 19:15
This was referenced Jul 24, 2026
Merged
Merged
yaacovcorcos added a commit that referenced this pull request Jul 24, 2026
@yaacovcorcos
Promote Scient 0.5.13 candidate to release/stable (#122)
20c7721 
* Route telemetry through ScientFactory gateway (#43)

* Fix unsigned macOS release signatures (#44)

* Add consent-aware desktop analytics (#47)

* Fix Claude terminal auth and connection recovery (#52)

* fix provider status refresh invariants

* fix Claude auth recovery

* Use direct OAuth for Grok sign-in (#53)

* Use direct OAuth for Grok sign-in

* Expose safe Grok OAuth browser fallback

* Secure Scient state initialization (#48)

* Secure Scient state initialization

* Allow legacy migration state test

* fix(security): harden private state files

* test(security): lock private file boundaries

* fix(security): reject unsafe private file nodes

* Supervise the desktop backend lifecycle (#49)

* Supervise the desktop backend lifecycle

* fix(desktop): preserve backend lifecycle ownership

* fix(desktop): replace semantically unready backends

* fix(desktop): close backend lifecycle races

* Supervise desktop connection recovery (#50)

* Supervise desktop connection recovery

* Isolate provider dialog browser fixtures

* fix(desktop): bind activation readiness generation

* fix(web): enforce single-owner connection recovery

* style(web): format connection recovery

* fix(web): satisfy connection transport types

* fix(web): harden stream and terminal recovery

* fix(web): fail closed on stuck stream cancellation

* fix(web): preserve terminal recovery ordering

* fix(web): clamp reconnect jitter ceilings

* fix(desktop): preserve connection wake after restack

* Define safe RPC recovery policies (#51)

* Define safe RPC recovery policies

* test(web): cover RPC recovery integration

* fix(web): recover after uncertain mutation failures

* test(web): type RPC recovery harness precisely

* fix(web): recover a failed replay generation

* Surface connection recovery diagnostics (#55)

* Surface connection recovery diagnostics

* test(web): cover connection recovery experience

* style(web): format recovery browser coverage

* fix(web): keep recovery diagnostics current

* Recover Codex sessions after authentication loss (#56)

* fix: recover Codex sessions after auth loss

* fix(codex): gate auth recovery by provider mode

* fix: harden Codex authentication recovery

* Support Linux desktop development launch (#57)

* Secure Scient state initialization

* Allow legacy migration state test

* Supervise the desktop backend lifecycle

* Supervise desktop connection recovery

* Define safe RPC recovery policies

* Surface connection recovery diagnostics

* Support Linux desktop development launch

* Isolate provider dialog browser fixtures

* fix(desktop): fail closed on unsafe Linux sandbox

* style(desktop): format Linux launcher hardening

* fix(release): preserve AppImage sandbox

* revert(release): keep AppImage migration out of launcher hardening

* fix(desktop): honor Linux user namespace sandbox

* Fix Antigravity browser authentication (#59)

* Fix Antigravity browser authentication

* Harden Antigravity authentication lifecycle

* Close Antigravity code window deterministically

* Keep Antigravity code submission cancellable

* Scope desktop signing credentials by platform (#60)

* Fix managed Antigravity updates, authentication, and dialog UX (#62)

* Fix trusted Antigravity install and update routing

* Fix Antigravity browser authentication and models

* Refine provider connection dialog actions

* Harden managed provider update recovery

* Stabilize macOS release identity (#63)

* Reduce unintended macOS permission prompts (#64)

* Stabilize macOS release identity

* Reduce unintended macOS permission prompts

* Apply repository formatting

* Control macOS notarization lifecycle (#65)

* Add Evidence to Note as a latent built-in (#70)

* Harden bidirectional chat rendering (#71)

* feat(web): harden bidirectional chat rendering

* fix(web): close bidi review gaps

* Add Medical Exam Study built-in (#72)

* Fix YAML frontmatter in Markdown previews (#69)

* Add T3-inspired project source dialog (#76)

* Add project source dialog

* Harden project source cloning

* Add T3-style right dock surfaces (#77)

* Add T3-style right dock surfaces

* Fix right dock test formatting

* fix: remove AppSnap startup announcement (#80)

* Add artifact preview cards to chat (#81)

* fix: select providers after connection (#82)

* Add message-level conversation forks (#78)

* Add message-level conversation forks

* Stabilize hosted fork browser test

* Close message fork boundary gaps

* Close final fork review gaps

* Resolve final fork recertification blockers

* Avoid replaying completed fork bootstrap

* Harden fork lineage and restart recovery

* Stabilize cold browser geometry startup

* Repair legacy fork title families

* Preserve unrecorded fork rename boundaries

* Clear drifted fork title lineage

* Improve desktop contribution workflow (#75)

* Set default base font to 15px and fix numeric editing (#79)

* Increase default base font size to 15px

* Fix manual font size editing

* Preserve external font setting updates

* Use recommended provider model defaults (#83)

* Use recommended provider model defaults

* Apply repository formatting

* Update browser expectation for Codex default

* Preserve explicit drafts before model discovery

* Respect live provider model availability

* Align desktop approval policy (#85)

* Fix release-candidate regressions (#86)

* Fix release candidate regressions

* Fix long transcript fork validation

* fix(release): preserve Linux sandbox (#87)

* fix(release): preserve Linux sandbox

* test(release): resolve nested builder package

* test(release): follow Bun package symlinks

* fix: preserve whitespace in folder browsing (#90)

* Collapse long assistant artifact shelves (#91)

* Remove project setup confirmation card (#93)

* Build unified notification system (#96)

* Hide provider setup banner on empty chats (#94)

* Hide provider setup banner on empty chats

* Stabilize empty provider banner coverage

* Harden provider banner browser readiness

* Fix Droid model discovery lifecycle (#95)

* Add ChatGPT-first voice transcription with local Whisper fallback (#97)

* feat(voice): define transcription backend contract

* feat(voice): add verified local transcription core

* Fix ChatGPT voice account context

* feat(voice): add ChatGPT-first local Whisper fallback

* Default Git writing to GPT-5.6 Luna (#99)

* Apply updated settings defaults once (#101)

* Apply updated settings defaults once

* Enable Studio in its browser fixture

* Improve voice dictation and active-turn composer controls (#102)

* Improve voice recording controls

* Add live local voice previews

* Keep voice send locked through completion

* Keep active-turn composer actions available

* Pin Whisper runtime source revision

* Fix voice transition regressions

* Fix folder picker navigation and project opening (#98)

* Fix folder picker navigation and project opening

* Tighten project setup choices

* Prevent duplicate folder picker submissions

* Fix Whisper runtime packaging on Windows (#104)

* fix: make Whisper packaging cross-platform safe

* fix: verify signed Windows Whisper runtime

* Secure HTML artifact previews with isolated execution (#100)

* feat: add secure HTML artifact previews

* fix: enforce HTML preview ownership boundaries

* Document cross-platform manual verification

* Use trash icon for voice cancel action (#106)

* Fix browser pane close and runtime recovery (#113)

* Isolate temporary Claude discovery from MCP servers (#116)

* Respect reduced motion in thread spinner (#84)

Adapt the upstream accessibility concept while retaining Scient-owned spinner geometry.

* Harden upstream-derived release tooling (#109)

* Salvage safe PR 61 interaction improvements (#107)

* Salvage safe PR 61 interaction improvements

* Harden terminal selection copy handling

* Adapt Studio Git gating and folder access (#108)

* Adapt Studio folder controls from Synara

* Gate Studio review command on repository detection

* Improve changed-file accessibility and density (#110)

* Add compact previews for bulky changed-file cards (#117)

* Improve changed-file accessibility and density

* Add compact changed-file previews

* Ensure changed-file previews show every file

* feat: add curated in-app release notes (#112)

* feat: add curated release notes workflow

* fix: harden release note experience

* refactor: share release note footer layout

* test: keep release note diagnostics concise

* Reject developer-facing release note copy

* Revert "Reject developer-facing release note copy"

This reverts commit 1006003.

* Harden release note structural validation

* Harden release note asset validation

* Resolve release note certification findings

* Bound release note PNG chunk parsing

* Validate all release note PNG chunk CRCs

* Fix browser multi-tab controls and menu occlusion (#119)

* Fix browser multi-tab controls and menu occlusion

* Keep browser sessions alive under overlays

* Harden browser overlay lifecycle coverage

* Complete browser tab and overlay semantics

* Restore focus after final browser tab closes

* Synchronize split-pane browser focus

* Harden Electron overlay lifecycle runner

* Isolate macOS Electron test bundle state

* Keep Electron lifecycle tests fully hermetic

* Resolve Electron sandbox from workspace package

* Guarantee Electron test harness cleanup

* Register Electron fixture cleanup immediately

* Restore focus after browser close controls

* Complete browser close focus recovery

* Handle early Electron test interruptions

* Cover earliest Electron setup interruption

* Refine branch and automation workflow affordances (#111)

* Refine upstream-derived workflow affordances

* Respect resolved automation triage state

* Fix native branch clipboard acceptance

* Document native workflow UX acceptance

* Add universal local file viewer (#114)

* Add universal local file viewer

* Harden local HTML preview capabilities

* Resolve HTML preview review blockers

* Close final HTML preview review gaps

* Fail closed on truncated active HTML

* Preserve complex HTML preview dependencies

* Fail closed on SVG runtime link mutation

* Block alternate network egress in HTML previews

* Recover HTML preview network setup

* Serialize HTML preview retries

* Occlude native HTML previews under overlays

* Harden provider installation and sign-in (#103)

* Harden provider installation and sign-in

* Fix Windows provider runtime test fixtures

* Make Windows PATH test path-stable

* Close provider onboarding reliability gaps

* Keep post-install sign-in recovery on the correct path

* Canonicalize Windows runtime discovery test paths

* Harden provider device-code recovery

* Harden OpenCode and Kilo turn completion (#120)

* Harden OpenCode and Kilo turn completion

* fix(provider): isolate OpenCode turn completion ownership

* fix(provider): close OpenCode completion review races

* fix(provider): fence OpenCode reply and replay races

* fix(provider): clean interrupted OpenCode replies

* fix(provider): harden OpenCode interaction ownership

* fix(provider): fail closed on ambiguous replies

* Harden OpenCode lifecycle retirement

* Serialize OpenCode session retirement

* Make OpenCode retirement interruption safe

* Finalize confirmed OpenCode process exits

* Add native folder drop to Add Project (#115)

* feat(projects): add native folder drop intake

* fix(projects): harden folder drop feedback

* fix(projects): keep folder errors visible

* fix(projects): preserve compact folder dialog footer

* fix(projects): harden native folder intake

* docs(qa): align folder intake evidence

* fix(projects): scope folder drop to dialog

* test(projects): cover platform folder labels

* docs: correct folder drop verification evidence

* docs: qualify native drag evidence

* docs: refresh folder drop verification evidence

* docs: refresh folder drop certification evidence

* docs: recertify folder drop on latest main

* Neutralize project drops outside dialog

* Update folder drop acceptance evidence

* Make new thread workspace intent explicit (#118)

* fix(web): make new thread workspace intent explicit

* fix(web): serialize distinct new thread intents

* test(web): type exact workspace branch mocks

* fix(web): preserve new thread request ordering

* fix(web): preserve latest new thread intent

* fix(web): coordinate all new thread navigation

* fix(web): preserve latest navigation across preparation

* fix(web): close remaining navigation races

* chore: clean merged sidebar imports

* fix(web): close terminal and route ownership gaps

* fix(web): coordinate every new-thread route intent

* fix(web): enforce route ownership before history commits

* test(web): use typed routes in navigation guard proof

* fix(web): release committed navigation ownership

* docs: add Scient 0.5.13 release notes

* chore: keep promotion tree aligned with main

* chore: restore test cleanup in promotion tree

* chore: align promotion test tree
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

size:XL vouch:trusted PR author is trusted by repo permissions or the VOUCHED list.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@yaacovcorcos