Ship isolated hosts and on-demand transcript recall

Author: gitcommit90

CHANGELOG.md

@@ -7,6 +7,54 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.6] - 2026-07-24
+
+### Added
+
+- Linux systemd hosts now give every ordinary channel a persistent
+  unprivileged LXC computer with private networking, subordinate UID/GID maps,
+  exact owner markers, managed CPU/RAM, host-mirrored files, and no host-home
+  mount. The installer pins and verifies the Ubuntu Noble image payloads and
+  installs a narrow root-owned lifecycle boundary.
+- The accepted Windows 11 implementation now has a native x64 desktop and one
+  private WSL 2 Ubuntu distribution per ordinary channel. Windows-drive
+  automount and process interop are disabled, Ubuntu root filesystems are
+  immutable-version and SHA-256 pinned for x64 and arm64, and setup/removal
+  verify exact ownership. Its public installer is withheld until Authenticode
+  signing is available.
+- Durable feedback is always visible, accepts optional attachments and
+  diagnostics, retries central delivery, and provides a Captain feedback inbox.
+- Residents can search their own authoritative raw channel transcripts by
+  meaning, exact text/date, or recency and hydrate a complete prior session on
+  demand. Each channel keeps a separate Mnemosyne index; guests and other
+  channel residents cannot access it.
+- SkillsMD discovery now queries the open registry directly and displays every
+  returned result. Revision pinning, bounds, scanning, hashing, and runtime
+  wrapping remain enforced when the user chooses to install.
+
+### Changed
+
+- Linux and Windows are production isolation backends; the in-process native
+  computer remains an explicit development/test seam rather than the default.
+- Linux update requests are executed entirely by the host. The verified root
+  updater migrates runtime files and systemd units transactionally, refuses
+  downgrades, health-checks for up to one minute, and reports rollback complete
+  only after the restored host answers its health endpoint.
+- The website and documentation describe the macOS, Linux/LXC, and Windows/WSL
+  product contracts without claiming an unsigned Windows artifact is public.
+
+### Fixed
+
+- Newly created and newly assigned skills now appear immediately in already
+  open Arsenal and Channel Settings views without a page refresh.
+- Linux upgrades migrate existing compatibility computer records to LXC while
+  retaining channels, workspaces, obligations, and durable application state.
+- Fresh/repeat Linux installs reject unsafe rollback symlinks and install
+  Python venv support required by long-term Mnemosyne memory.
+- App removal, fleet inspection, lifecycle commands, terminal execution,
+  workspace synchronization, and ownership refusal now cover Apple, LXC, and
+  WSL backends consistently.
+
 ## [0.0.5] - 2026-07-24
 
 ### Changed
@@ -133,7 +181,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   notarization, stapled tickets, Gatekeeper verification, persistent
   Application Support, and isolated Apple container machines.
 
-[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.5...HEAD
+[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.6...HEAD
+[0.0.6]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.6
 [0.0.5]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.5
 [0.0.4]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.4
 [0.0.3]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.3

README.md

@@ -29,7 +29,7 @@ release acceptance tests.
 <p align="center">
   <code>Apple Silicon native</code>&nbsp;&nbsp;
   <code>34 complete playbooks</code>&nbsp;&nbsp;
-  <code>Focused SkillsMD catalog</code>&nbsp;&nbsp;
+  <code>Open SkillsMD search</code>&nbsp;&nbsp;
   <code>Signed + notarized</code>
 </p>
 
@@ -102,7 +102,7 @@ The model receives a compact inventory of the arsenal—not all 34 procedures in
 every prompt. It can inspect metadata and load one complete skill when useful.
 It can also:
 
-- search the focused SkillsMD catalog of ready GitHub-backed repositories;
+- search SkillsMD directly without a 1Helm-curated subset, then inspect and install a selected GitHub-backed skill;
 - install ready skills only after immutable revision pinning, bounds,
   scanning, hashing, provenance storage, and runtime-authority wrapping;
 - route sources without a ready repository-specific procedure through the
@@ -154,6 +154,11 @@ does not run on the laptop or phone viewing the web UI.
 - Exactly one resident for every ordinary channel and one Skipper in `#main`.
 - A persistent Apple `container machine` Linux VM per ordinary channel, with
   `home-mount=none`, on supported Apple Silicon Macs.
+- A persistent unprivileged LXC per ordinary channel on supported Linux
+  systemd hosts, with subordinate UID/GID mapping and exact ownership checks.
+- A private WSL 2 Ubuntu distribution per ordinary channel in the accepted
+  Windows implementation, with Windows-drive mounts and interop disabled. Its
+  public installer remains withheld until Authenticode signing is available.
 - Shared channel `/workspace` for the agent command surface and human Terminal.
 - Durable files, threads, curated memory, Mnemosyne long-term recall,
   corrections, follow-ups, and recurring workflows.
@@ -176,12 +181,12 @@ does not run on the laptop or phone viewing the web UI.
 | Platform | Current contract |
 |---|---|
 | **Apple Silicon macOS 26** | Native desktop product and real isolated Linux computer per resident. |
-| **Linux / CI** | Durable headless compatibility backend; not per-resident VM isolation. |
-| **Windows + WSL** | Headless compatibility path; not a native Windows app. |
+| **Linux / CI** | Supported headless systemd host with one unprivileged LXC per resident; CI may select an explicit test backend. |
+| **Windows + WSL** | Native x64 Electron and private WSL 2 worlds have passed real-host acceptance; the public installer awaits Authenticode signing. |
 
-Not yet shipped: native Windows and Linux desktop packages, mobile clients,
-Linux resident VM isolation, a hosted control plane, rich Photon attachment
-fidelity, or blind execution of community skills.
+Not yet shipped: a signed public Windows installer, a native Linux desktop
+shell, mobile clients, a hosted control plane, rich Photon attachment fidelity,
+or blind execution of community skills.
 
 ## Install on Apple Silicon
 
@@ -212,8 +217,8 @@ checkouts remain operator-managed and never send a Mac installer to the browser.
 
 ## Run the source workspace
 
-The native Mac app is the complete consumer product. For development and
-headless compatibility deployments, use Node 22:
+For development or a source deployment outside the verified platform
+installers, use Node 22:
 
 ```bash
 PUPPETEER_SKIP_DOWNLOAD=1 npm install
@@ -230,8 +235,8 @@ A fresh data directory opens first-run setup. The source runtime defaults to
 |---|---|---|
 | `PORT` | `8123` | HTTP/WebSocket control-plane port. |
 | `CTRL_DATA_DIR` | `./data` | Databases, routing state, uploads, and narrow workspace mirrors. |
-| `HELM_CHANNEL_COMPUTER_BACKEND` | `apple` on macOS, `native` elsewhere | Explicit development/test backend override. |
-| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.5` | Versioned Apple channel-machine image. |
+| `HELM_CHANNEL_COMPUTER_BACKEND` | `apple` on macOS, `lxc` on Linux, `wsl` on Windows | Host isolation backend; `native` and `mock` are explicit development/test overrides. |
+| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.6` | Versioned channel-machine image contract. |
 
 ### Agent-first JSON CLI
 
@@ -249,20 +254,21 @@ npm run helm -- audit-verify
 
 ## Architecture
 
-1Helm is a compact Node/TypeScript control plane hosted by Electron on macOS.
-It does not need an external database or a server transpilation step.
+1Helm is a compact Node/TypeScript control plane hosted by Electron on macOS
+and in the accepted Windows implementation, or by systemd on Linux. It does not
+need an external database or a server transpilation step.
 
 | Layer | Implementation |
 |---|---|
 | Runtime | Official Node 22 with native TypeScript stripping. |
 | Control plane | `node:http`, WebSocket, additive SQLite migrations. |
 | Client | Vanilla TypeScript bundled with esbuild and Tailwind CSS. |
 | Model routing | Embedded ReRouted headless engine, private internal gateway, account pools, retries, routes, quotas, and logs. |
-| Computers | Defensive argv-only Apple `container machine` backend; explicit compatibility backend elsewhere. |
+| Computers | Defensive argv-only Apple `container machine`, narrow root-owned unprivileged LXC, and private WSL 2 backends; explicit `native`/`mock` test seams. |
 | Terminal | `node-pty`; ordinary terminals enter their channel VM while Skipper remains native. |
 | Memory | Curated records with provenance plus an isolated Mnemosyne SQLite store per identity. |
 | Scheduling | Durable obligations, wake reconciliation, lifecycle safety, repair, update, and pressure-aware sizing. |
-| Desktop | Sandboxed Electron renderer, ephemeral loopback server, persistent Application Support, native wake agent. |
+| Desktop | Sandboxed Electron renderer, ephemeral loopback server, persistent host data, and native wake/update integration on supported desktop hosts. |
 
 Start with [`docs/VISION.md`](docs/VISION.md) for the product record and
 [`docs/architecture`](https://1helm.com/docs/architecture) for the readable
@@ -286,7 +292,9 @@ or a complete security score.
 
 ## Security boundary
 
-- Resident Macs use separate Linux VMs with no native Mac home mount.
+- Residents use separate Linux worlds: Apple machines with no Mac home mount,
+  unprivileged LXC with subordinate host IDs, or private WSL 2 distributions
+  with Windows-drive mounts and interop disabled.
 - Skipper's host tools require Captain-authorized provenance.
 - Workspace file mirrors are channel-scoped, size-bounded, and symlink-contained.
 - Provider and connection credentials stay in host-owned storage.

cloudflare/migrations/0001_initial.sql

@@ -0,0 +1,39 @@
+CREATE TABLE IF NOT EXISTS workspaces (
+  slug TEXT PRIMARY KEY,
+  hostname TEXT NOT NULL UNIQUE,
+  installation_id TEXT NOT NULL UNIQUE,
+  workspace_name TEXT NOT NULL,
+  management_secret_hash TEXT NOT NULL,
+  tunnel_id TEXT NOT NULL DEFAULT '',
+  connector_secret_cipher TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'provisioning',
+  enabled INTEGER NOT NULL DEFAULT 1,
+  error TEXT NOT NULL DEFAULT '',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_workspaces_installation ON workspaces(installation_id);
+
+CREATE TABLE IF NOT EXISTS feedback_reports (
+  public_id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL,
+  workspace_name TEXT NOT NULL DEFAULT '',
+  comment TEXT NOT NULL,
+  diagnostics TEXT NOT NULL DEFAULT '{}',
+  attachment_count INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  received_at INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_feedback_received ON feedback_reports(received_at DESC);
+
+CREATE TABLE IF NOT EXISTS feedback_attachments (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  report_id TEXT NOT NULL REFERENCES feedback_reports(public_id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  mime TEXT NOT NULL,
+  size INTEGER NOT NULL,
+  data TEXT NOT NULL,
+  created_at INTEGER NOT NULL
+);

cloudflare/src/worker.ts

@@ -174,7 +174,11 @@ async function feedbackIntake(request: Request, env: Env): Promise<Response> {
   for (const attachment of attachments) {
     const size = Number(attachment.size || 0);
     const data = String(attachment.data || "");
-    if (size < 0 || size > 5 * 1024 * 1024 || data.length > 7 * 1024 * 1024) {
+    const validBase64 = data.length % 4 === 0 && /^[A-Za-z0-9+/]*={0,2}$/.test(data);
+    const padding = data.endsWith("==") ? 2 : data.endsWith("=") ? 1 : 0;
+    const decodedSize = data.length ? (data.length / 4) * 3 - padding : 0;
+    if (!Number.isSafeInteger(size) || !validBase64 || decodedSize !== size
+      || size < 0 || size > 5 * 1024 * 1024 || data.length > 7 * 1024 * 1024) {
       return json({ error: "A feedback attachment is too large." }, 413);
     }
     total += size;

deploy/1helm-lxc-unprivileged.conf

@@ -0,0 +1,14 @@
+# 1Helm channel computers are user-namespaced Ubuntu containers. Root inside a
+# channel maps to an unprivileged host subuid/subgid and each container receives
+# only the private LXC bridge—not a host directory or device passthrough.
+lxc.include = /usr/share/lxc/config/ubuntu.userns.conf
+lxc.idmap = u 0 100000 65536
+lxc.idmap = g 0 100000 65536
+lxc.apparmor.profile = generated
+lxc.apparmor.allow_nesting = 0
+lxc.mount.auto = proc:mixed sys:ro cgroup:mixed
+lxc.net.0.type = veth
+lxc.net.0.link = lxcbr0
+lxc.net.0.flags = up
+lxc.net.0.name = eth0
+lxc.start.auto = 0

desktop/main.cjs

@@ -17,6 +17,26 @@ let quitting = false;
 let hostUpdateService = null;
 const remoteWorkspacePath = () => path.join(app.getPath("userData"), "remote-workspace");
 
+function handleSquirrelEvent() {
+  if (process.platform !== "win32") return false;
+  const event = process.argv[1];
+  if (!["--squirrel-install", "--squirrel-updated", "--squirrel-uninstall", "--squirrel-obsolete"].includes(event)) return false;
+  const appFolder = path.resolve(process.execPath, "..");
+  const updateExe = path.resolve(appFolder, "..", "Update.exe");
+  const exe = path.basename(process.execPath);
+  if (event === "--squirrel-install" || event === "--squirrel-updated") {
+    spawnSync(updateExe, ["--createShortcut", exe], { stdio: "ignore", windowsHide: true });
+  } else if (event === "--squirrel-uninstall") {
+    const dataRoot = path.join(String(process.env.APPDATA || ""), "1Helm");
+    const wslRoot = path.join(path.dirname(dataRoot), "1Helm-WSL");
+    const cleanup = path.resolve(__dirname, "..", "scripts", "windows-removal.cjs");
+    spawnSync(process.execPath, [cleanup, dataRoot, wslRoot], { env: { ...process.env, ELECTRON_RUN_AS_NODE: "1" }, stdio: "ignore", windowsHide: true, timeout: 10 * 60_000 });
+    spawnSync(updateExe, ["--removeShortcut", exe], { stdio: "ignore", windowsHide: true });
+  }
+  setTimeout(() => app.quit(), 1000);
+  return true;
+}
+
 function preferredWorkspaceOrigin() {
   try {
     const value = fs.readFileSync(remoteWorkspacePath(), "utf8").trim();
@@ -74,7 +94,7 @@ async function startLocalRuntime() {
   process.env.HELM_HOST = LOOPBACK;
   process.env.PORT = String(port);
   process.env.CTRL_DATA_DIR = app.getPath("userData");
-  process.env.SHELL ||= "/bin/zsh";
+  if (process.platform !== "win32") process.env.SHELL ||= "/bin/zsh";
   process.env.HELM_INTERNAL_WAKE_TOKEN ||= crypto.randomBytes(32).toString("hex");
   process.chdir(appRoot);
   localOrigin = `http://${LOOPBACK}:${port}`;
@@ -97,6 +117,13 @@ function keepSkipperAvailable() {
   app.setLoginItemSettings({ openAtLogin: true, type: "mainAppService" });
 }
 
+function prepareWindowsWslDataRoot() {
+  if (process.platform !== "win32") return;
+  // Per-channel virtual disks stay outside the replaceable application
+  // directory and beside the durable Electron userData directory.
+  fs.mkdirSync(path.join(path.dirname(app.getPath("userData")), "1Helm-WSL"), { recursive: true });
+}
+
 function allowedLocalUrl(raw) {
   try {
     const url = new URL(raw);
@@ -181,7 +208,10 @@ function createWindow(showWhenReady = true) {
   mainWindow = window;
 }
 
-if (!app.requestSingleInstanceLock()) {
+if (handleSquirrelEvent()) {
+  // Squirrel install/update/uninstall work must exit before the application
+  // acquires its normal single-instance lock or starts the local server.
+} else if (!app.requestSingleInstanceLock()) {
   app.quit();
 } else {
   app.on("second-instance", (_event, argv) => {
@@ -193,6 +223,7 @@ if (!app.requestSingleInstanceLock()) {
   });
 
   app.whenReady().then(async () => {
+    if (process.platform === "win32") app.setAppUserModelId("com.squirrel.1Helm.1Helm");
     session.defaultSession.setPermissionRequestHandler((_webContents, _permission, callback) => callback(false));
     session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
       if (!allowedLocalUrl(details.url)) {
@@ -211,6 +242,7 @@ if (!app.requestSingleInstanceLock()) {
     try {
       removeLegacyWakeLaunchAgent();
       keepSkipperAvailable();
+      prepareWindowsWslDataRoot();
       hostUpdateService = createNativeUpdateService({ app, autoUpdater });
       hostUpdateService.initialize();
       globalThis[Symbol.for("1helm.nativeUpdater")] = {
@@ -227,7 +259,7 @@ if (!app.requestSingleInstanceLock()) {
       await dialog.showMessageBox({
         type: "error",
         title: "1Helm could not start",
-        message: "The local 1Helm runtime could not start on this Mac.",
+        message: `The local 1Helm runtime could not start on this ${process.platform === "win32" ? "Windows PC" : "Mac"}.`,
         detail: error instanceof Error ? error.stack || error.message : String(error),
       });
       app.quit();

desktop/updater.cjs

@@ -21,22 +21,24 @@ function createNativeUpdateService({ app, autoUpdater, platform = process.platfo
   let busy = false;
   let initialTimer = null;
   let intervalTimer = null;
+  const nativeMode = platform === "win32" ? "native-windows" : "native-macos";
   let state = {
-    mode: "native-macos",
+    mode: nativeMode,
     status: "idle",
     current_version: app.getVersion(),
     version: null,
     checked_at: null,
     error: null,
-    message: "Check for a signed 1Helm update on this Mac.",
+    message: `Check for a signed 1Helm update on this ${platform === "win32" ? "Windows PC" : "Mac"}.`,
   };
 
   let inApplications = true;
   if (platform === "darwin" && typeof app.isInApplicationsFolder === "function") {
     try { inApplications = app.isInApplicationsFolder(); } catch { inApplications = false; }
   }
-  const supported = platform === "darwin" && arch === "arm64" && app.isPackaged === true && inApplications;
-  const feedUrl = `https://update.electronjs.org/gitcommit90/1Helm/darwin-arm64/${encodeURIComponent(app.getVersion())}`;
+  const feedPlatform = platform === "win32" && arch === "x64" ? "win32-x64" : "darwin-arm64";
+  const supported = app.isPackaged === true && ((platform === "darwin" && arch === "arm64" && inApplications) || (platform === "win32" && arch === "x64"));
+  const feedUrl = `https://update.electronjs.org/gitcommit90/1Helm/${feedPlatform}/${encodeURIComponent(app.getVersion())}`;
 
   const snapshot = () => ({ ...state });
   const setState = (patch) => { state = { ...state, ...patch }; };
@@ -51,7 +53,7 @@ function createNativeUpdateService({ app, autoUpdater, platform = process.platfo
           ? "Move 1Helm to Applications to enable host updates."
           : null,
         message: app.isPackaged
-          ? "Signed automatic updates are available for Apple Silicon macOS hosts."
+          ? "Signed automatic updates are available for supported macOS and Windows hosts."
           : "Development builds are updated from their source checkout.",
       });
       return false;
@@ -120,7 +122,7 @@ function createNativeUpdateService({ app, autoUpdater, platform = process.platfo
     if (state.status !== "ready") {
       return { ...snapshot(), error: "No downloaded host update is ready." };
     }
-    setState({ status: "installing", error: null, message: "1Helm is restarting this Mac host to install the verified update…" });
+    setState({ status: "installing", error: null, message: `1Helm is restarting this ${platform === "win32" ? "Windows" : "Mac"} host to install the verified update…` });
     process.env.HELM_UPDATE_INSTALLING = "1";
     return snapshot();
   }

docs/RELIABILITY.md

@@ -23,6 +23,9 @@ ownership, recovery, and tests rather than depend on a prompt alone.
 - The prompt names the size and categories of the skill arsenal. Skill metadata
   is available through `list_skills`; a complete procedure enters context only
   when the model calls `read_skill` for that skill.
+- A resident can search its own raw prior-session transcripts and hydrate a
+  returned session in full. These are factual tools, not an injected rule about
+  when the model must recall history; cross-channel access is server-rejected.
 - Channel memory and agent recall are provenance-bearing reference data, never
   higher-priority instructions.
 - `ask_user` is a validated tool for evidenced human judgment, credentials,