feat(linux): bring desktop support up to date

[sambitcreate]

Summary

• bring the Linux desktop branch fully up to date with Aiden 0.36.1 and current main, including Bots, Web Search, diagnostics, Generative UI, Parakeet, Remote Access, subagents, Model Pad, Pi Ask User Question/Todo/BTW/Advisor, the current provider/model catalog, and chat-native Scheduled Tasks
• preserve revision-bound Scheduled Task mutations, idempotent run-now behavior, run history, paired-mobile approval/capability handling, onboarding coverage, and desktop/mobile scheduling parity
• ship Linux x64 and arm64 AppImage, deb, and rpm packages with all five portable native helpers, conventional Linux window/menu/editor behavior, Tailscale/Bonjour Remote support, and a strict glibc 2.34 compatibility floor
• centralize host capability gates so Apple-only features are neither advertised nor invoked on Linux
• document the Linux support matrix, release boundary, operational tradeoffs, and completed implementation plan

Intentional Linux tradeoffs

• Apple Foundation Models and Computer Use remain macOS-only
• Bots remain macOS-only because their independent anti-rollback authority is anchored in macOS Keychain; ordinary Telegram remains supported on Linux
• dictation is toggle-to-record and delivers through the clipboard because Accessibility-driven automatic paste is macOS-only
• native Share, Dock, and macOS menu integrations are replaced by conventional Linux window and menu behavior
• secure credential storage fails closed unless Electron is backed by a desktop keyring
• Scheduled Tasks use platform-neutral paired-desktop language while retaining the same revision, approval, run-history, and mobile capability contracts

Validation

Verification on the final branch included:

• npm run type-check
• npm run type-check:e2e
• npm run lint
• npm run build
• npm run test
• npm run test:scheduled (98 passing)
• npm run test:pi-extensions (127 passing)
• npm run test:bots (431 passing)
• npm run test:linux-contracts (94 passing; one expected host-only skip)
• npm run test:model-catalog
• 100 repeated Bot watcher regressions passed after draining the registration baseline
• focused Linux Electron Scheduled Tasks flow passed 3/3 with the accessible clear-search control
• React Doctor on the final changed scope reported no issues

Hosted verification:

• CI run 33341931470 passed the full verify job, deterministic Electron E2E, Linux x64, Linux arm64, Android, and downstream Fedora RPM acceptance
• Release consumer contract 33341931466 passed on the exact final head
• the Fedora consumer downloads the checksum-pinned RPM produced against the Ubuntu glibc 2.34 baseline, enforces exact artifact identity/cardinality, then verifies installability, package integrity, modes, linkage, version, and native helpers
• final fetch confirmed origin/main at f87e9e7f64400cbb7bee3335fb4f876e53efa970 is an ancestor of the PR head

[pullfrog]

Important

One definite bug in the Linux subagent cleanup path (an unbounded reap loop that can hang the helper), a registration gap that leaves six new policy-contract test suites never executed, and one Linux metadata limitation worth resolving before Fedora is declared fully supported. Details inline.

Reviewed changes

• Linux build, package, and release pipeline — new CI jobs build, install, verify, and smoke the AppImage/deb/rpm artifacts on x64/arm64 Ubuntu plus a Fedora container RPM job; the release workflow gains linux-release and the publisher now requires both architectures' Linux assets before publishing.
• Host capability gates — a main-owned hostPlatformCapabilities() policy (bots, Computer Use, Apple Foundation Models, accessibility paste, dock icon, native share) is projected to the renderer and enforced across IPC registration, chat/bot paths, remote pairing/state, and Telegram bindings so Apple-only surfaces neither advertise nor execute on Linux.
• Fail-closed Linux secret storage — a secure-storage wrapper refuses Electron's reversible basic_text backend with an actionable message, and keyless→keyless provider transitions no longer require a keyring; every former safeStorage consumer funnels through the wrapper.
• Offline models.dev policy — live-app model reads and provider handlers use only the bundled snapshot; the foreground catalog-refresh action and the device-local cache read path are removed.
• Native helper portability — shared aiden-platform.h (SHA-256, getrandom, renameat2 shims), Linux xattr and st_mtim identity handling in the file mutator, 7-field run-store tokens, subreaper cleanup, and /bin/sh subagent shells, each with Linux-native adversarial tests.
• Platform window, menu, and shortcut behavior — platform-split window options and menu templates, Ctrl-based accelerator projection, the Wayland GlobalShortcuts portal, clipboard-only dictation delivery, Linux editor/file-manager discovery, and background keep-alive for an enabled Remote Access listener.
• Docs and companion copy — docs/linux.md, the support plan, README/AGENTS updates, and a mechanical "Mac" → "desktop" copy sweep across the iOS/Android companions with matching native test updates.

ℹ️ Live models.dev refresh is removed cross-platform, not only on Linux

main/handlers/providers.ts's providers:updateCatalogs no longer refreshes models.dev, modelsCatalog reads only the bundled snapshot, and Settings → Providers loses the Update model catalogs action on macOS too, since the handlers and UI are shared. The Linux-focused PR description doesn't call out this macOS-facing removal, but AGENTS.md and the new models-dev-live-app-policy.test.ts were updated consistently, so it reads as a deliberate policy change — worth confirming that's the intent. Two follow-on effects: previously fetched device-local catalog data is now silently ignored, and main/services/models-dev-cache.ts has no remaining live importers (dead code that can be removed or kept for the refresh tooling).

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}

[pullfrog]

cleanup_group's Linux reap loop blocks with no deadline. waitpid(-group, …, 0) waits for every adopted descendant to change state, so a single D-state descendant (e.g. a subagent command touching a hung FUSE/NFS mount) or a grandchild that escaped the group before the SIGKILL and rejoined it afterwards hangs the helper forever — the 1000 ms confirmation deadline below is never reached and no response is ever sent. On macOS only the direct child is waited on, so this widens that bounded contract to every descendant; I reproduced the hang with a compiled harness (grandchild rejoin after the kill: timeout 3 … → exit 124).

Technical details

# Bound the Linux subreaper reap loop in cleanup_group

## Affected sites
- native/subagent-shell-runner/main.c:295-300 — the `for (;;)` `waitpid(-group, &status, 0)` loop runs before the 1000 ms `process_group_exists` confirmation (lines 303-305). A group member that survives `SIGKILL` (uninterruptible D-state, or a process that left the group before the kill and rejoined the still-existing pgid afterwards) blocks it indefinitely.
- main/services/subagents/subagent-shell-runner-io.ts:234 — the main-process watchdog (`timeoutMs + 2_500`) eventually SIGKILLs the hung helper, so the turn fails after the full command timeout instead of completing cleanup; the helper never sends its `OUTCOME_CLEANUP_UNCONFIRMED` response.

## Required outcome
- The reap phase must be bounded by the same deadline as the confirmation poll: reap with `WNOHANG` only while `monotonic_ms() < deadline`, then fall through to the existing `waitpid(direct_child)` + `process_group_exists` check so cleanup either confirms or reports unconfirmed within ~1 s, matching the macOS contract.

## Suggested approach (optional)
- Replace the loop with `while (monotonic_ms() < deadline) { pid_t r = waitpid(-group, &ignored_status, WNOHANG); if (r > 0) continue; if (r < 0 && errno == ECHILD) break; if (r < 0 && errno == EINTR) continue; usleep(10000); }` and keep the existing deadline poll. If practical, add a Linux-only regression fixture mirroring the compiled repro (escaped-then-rejoined grandchild or paused child).

[pullfrog]

Six of the new platform-policy contract tests are not registered in any npm script, so they never run in npm test or either CI job. main/services/host-platform-capabilities.test.ts, main/services/dictation-platform.test.ts, main/handlers/bots-platform-contract.test.ts, main/services/aiden-remote-platform-contract.test.ts, main/services/models-dev-live-app-policy.test.ts, and main/services/telegram/telegram-bot-binding-platform.test.ts pin load-bearing gates (bots IPC registration, remote Bot routes, the models.dev offline policy, Apple Foundation Models gates) via source matching — unregistered, a regression in any of those would go uncaught. Repo convention requires new test files to be registered in the relevant test/test:coverage scripts.

Technical details

# Register the unexecuted platform-policy test files

## Affected sites
- package.json:129 — `test:linux-contracts` omits the six files above (checked against the entire `scripts` object; each filename matches no script).
- package.json — `pretest` does not chain `test:linux-contracts`, so even the registered Linux policy tests only run in the new Linux CI job, never in the macOS `npm test` flow.

## Required outcome
- Add the six files to `test:linux-contracts` (they are platform-independent source-reading tests) so the Linux CI job executes them, and consider adding that script to the general test flow so macOS CI exercises the cross-platform policy contracts too.

[pullfrog]

On enforcing-SELinux systems this copy step makes the whole transaction fail: when the source carries a security.* xattr that differs from the staged file's default label, fsetxattr here returns EPERM for the unprivileged helper, linux_copy_xattrs returns -1, and every commit onto such a file (non-default chcon labels, security.capability setcap binaries) aborts with RESULT_IO. That's fail-closed — no silent drift — but it means file mutation is unavailable for exactly these files on Fedora/RHEL, which this PR lists as supported targets; the Fedora CI tests won't catch it because test files inherit their directory's default label.

Technical details

# Handle non-copyable security.* xattrs on SELinux hosts

## Affected sites
- native/subagent-file-mutator/main.c:404-419 — `linux_copy_xattrs` calls `fsetxattr(destination, name, value, value_length, 0)` for any mismatched xattr name, including `security.selinux`/`security.capability`, which requires `CAP_MAC_ADMIN`/`CAP_SETFCAP` and fails for the unprivileged helper.

## Required outcome
- File mutation keeps working on enforcing-SELinux hosts for files with non-default security labels, while the staged copy still preserves user-visible xattrs and never silently accepts drift.

## Suggested approach (optional)
- Treat `security.*` and `trusted.*` namespaces as non-copyable in the Linux path (skip them in copy and exclude them from the match set, mirroring how the macOS provenance field is handled), or document the limitation explicitly in `docs/linux.md` before declaring Fedora fully supported.

## Open questions for the human (optional)
- Is excluding the security namespace acceptable, given the destination file receives its own default security label anyway?

[pullfrog]

ℹ️ The incremental delta is clean — no new issues. The two blocking findings from the prior review (the unbounded subagent cleanup reap loop and the unregistered platform-policy test files) were re-verified against 2cc31db and still stand; the review comments remain open on the PR.

Reviewed changes (delta since the review of 09d5890)

• 0.36.1 Pi extension sync — the attended-chat Ask User Question composer, native todo, BTW, and Advisor extensions are merged in; registerBtwHandlers() and initializeAdvisorRuntime() are wired unconditionally in registerHandlers(), which matches their platform-neutral design.
• Linux CI extension gates — both Ubuntu and Fedora jobs now run npm run test:pi-extensions, pinned by a new check-ci-policy.test.mjs assertion (exactly two occurrences).
• Version and catalog sync — package version bumps to 0.36.1 and the bundled model catalog is refreshed.
• Linux test-seam fix — bot-inbox-writer.test.mjs now tolerates the intentional early-stdin-close EPIPE on Linux while still failing on any other stdin error.
• Plan bookkeeping — plan index rows for the rpiv integrations and the advisor plan moves to completed/.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}

[pullfrog]

ℹ️ The incremental delta is clean — no new issues. Commit 901110a is CI-only, so the two blocking findings and the SELinux note from the initial review remain open in their threads (no native/ or package.json paths changed since 2cc31db). The hosted Fedora acceptance job is still running as of this review — first live validation of the new handoff.

Reviewed changes (delta since the review of 2cc31db)

• Baseline-verified RPM handoff — the Ubuntu x64 leg now writes rpm.sha256 and uploads the RPM as a run-scoped artifact; the Fedora job gained needs: linux and downloads, checksums, installs, and re-verifies that RPM instead of rebuilding it (dropping rpm-build and libxcrypt-compat from the container).
• Force teardown GUI smokes — both ci.yml and release.yml smokes switched from timeout --kill-after=5s / exit 124 to timeout --signal=KILL / exit 137, removing the graceful-shutdown window inside the headless session; I verified on this runner that GNU timeout group-kills its process group and exits 137.
• CI policy coverage — scripts/check-ci-policy.test.mjs gained two source-pinning tests for the artifact handoff (checksum, artifact name, needs: linux, no-rebuild assertions) and the KILL smoke semantics; they run via test:branding and pass 5/5 locally.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}

[pullfrog]

ℹ️ The incremental delta is clean — no new issues. Commit f2916769 tightens one Playwright assertion to the exact shipped dictation fallback copy, which I verified against renderer/components/settings/dictation-shortcut-settings.tsx:246 (the Text span is a single text node, so exact: true matches). The two blocking findings and the SELinux note from the initial review remain open in their threads — re-verified unchanged at this head (package.json still registers none of the six policy-contract test files, and both native/ sites are byte-identical).

Reviewed changes (delta since the review of 901110a)

• Exact dictation-fallback e2e assertion — tests/e2e/settings-model-picker.spec.ts replaces the loose /copies the transcript to the clipboard/u regex (which never matched the shipped copy) with an exact-match assertion on "Completed transcripts are copied to the clipboard so you can paste them into any app.", so the Linux voice-settings smoke now both passes and fails loudly if the copy drifts.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}

[pullfrog]

ℹ️ The incremental delta is clean — no new issues. The merge of origin/main (the chat-native Scheduled Tasks line from PR #73) resolved without behavioral regressions: the two blocking findings and the SELinux note from the initial review remain open in their threads and were re-verified unchanged at this head.

Reviewed changes (delta since the review of f2916769)

• Main feature-line merge — origin/main is merged in; the reviewable surface is the conflict resolutions, which adapt copy and shared types rather than code paths.
• Android confirmation rename — requiresMacConfirmation is renamed to requiresDesktopConfirmation consistently across AidenChat.kt, AidenChatDetailScreen.kt, and AidenChatTest.kt; no stale callers remain.
• iOS desktop copy sweep completion — every scheduled-task and approval string now says "paired desktop" (a repo-wide grep finds zero remaining "your Mac" in either companion); scripts/check-ios-shipping-target.test.mjs pins the new copy and passes 12/12 locally.
• Remote approval gate reconciliation — main/services/aiden-remote-streams.ts adopts main's approvalIsHostOnly (scheduled-task approvals stay remotely allow-able when canAllow); the file's only divergence from main is the host-only error copy "from the Aiden desktop app.".
• Shared assistant union merge — renderer/shared/assistant.ts keeps the branch's /bin/sh SubagentShellApprovalShell union and its isSubagentShellApprovalShell guard alongside main's new ScheduledTaskApprovalDetails and isScheduledTaskApprovalDetails.
• Docs — the plans index gains the scheduled-tasks-experience row, and the archived Linux plan now notes Scheduled Tasks are platform-neutral on Linux.

Verification this run: npm run type-check is clean (after refreshing a stale node_modules missing bonjour-service, which is declared in package.json), npm run test:linux-contracts passes 20/20, scripts/check-ci-policy.test.mjs passes 5/5, no conflict markers exist anywhere in the tree, and the host capability gates in llm-client.ts and the remote handlers survive the merge.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}

[pullfrog]

ℹ️ The incremental delta is clean — no new issues. Commit 5b380a30 replaces the selectText() + press("Backspace") clearing sequence in the scheduled-tasks e2e smoke with a single fill("") — Playwright's canonical deterministic clear, independent of focus state and platform keyboard-selection semantics. The assertions that follow (toHaveValue("") and toHaveCount(0) on "No matching tasks") already pin the cleared state, and the same fill("") idiom is used earlier in the same spec. The two blocking findings and the SELinux note from the initial review remain open in their threads: this commit touches only tests/e2e/assistant-scheduled-profile.spec.ts, so the native/ and package.json sites are unchanged.

Reviewed changes (delta since the review of 0e414b4b)

• Deterministic e2e search clearing — tests/e2e/assistant-scheduled-profile.spec.ts swaps the select-text-and-backspace keystroke pair for fill("") when clearing the scheduled-task search box, removing a platform-dependent keyboard selection step from the Linux smoke path.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}

[pullfrog]

ℹ️ The incremental delta is clean — no new issues. Commit 6a397578 hardens two test flows and adds one small user-facing control. The two blocking findings and the SELinux note from the initial review remain open in their threads and were re-verified unchanged at this head (the commit touches no native/ or package.json paths).

Reviewed changes (delta since the review of 5b380a30)

• Watcher registration-race baseline — bot-skill-content-watcher.test.ts extracts waitForWatcherBaseline(), a 75 ms drain of Darwin's already-queued directory notification after fs.watch registration, and applies it before every observed mutation; watcher event timeouts rise from 1 s to a shared 5 s constant, and the assertions (lease aborted, unrelated-file count stays 0, warm snapshot refreshes to "After") remain exact and fail-able.
• Accessible clear action for scheduled-task search — scheduled-tasks-view.tsx replaces the plain search wrapper with a real "Clear scheduled task search" icon button that empties the query and restores focus to the input; the input keeps its aria-label and gains pr-9 clearance, and the button follows the house iconOnly/transparent idiom (same shape as providers-settings.tsx).
• Real-user-path e2e assertion — assistant-scheduled-profile.spec.ts clicks the new clear button instead of synthesizing keystrokes, pinning the cleared value, the restored input focus, and the button's unmount.
• Papercut records — two new entries document the Darwin watcher race and the fill("")/clear() select-and-delete limitation that motivated both fixes.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro ｜ 𝕏}