Skynet Desktop 0.1.3 — portable first run and auditable cleanup

Skynet Desktop 0.1.3 — portable first run and auditable cleanup

Version 0.1.3 removes developer-machine assumptions from the normal first-run path and makes the home screen explain the product, providers, and observed availability before the user opens a lane.

What changed

• Normal chrome shows version 0.1.3, not a raw +dirty build identifier. The full content-derived identity remains available in hover/About diagnostics.
• First-run views hide empty and test-only session leftovers.
• Provider cards distinguish ready, unavailable, unknown, and sign-in-required state from live probes.
• Portable runtime discovery no longer depends on a machine-specific skynetMachine manifest.
• Real-time terminal frames and Audit mode are part of the public desktop contract.
• The installer still proves vision, port-0 attach, inherited-pipe transport, and both connector hashes on the installed payload.
• Uninstall cleanup now matches the exact Skynet-owned ChromeAttach/ChromePipe roots regardless of whether Chrome quotes --user-data-dir for child processes, and performs one bounded second pass.
• Build provenance now preserves Git porcelain's leading status column, so dirty-member paths are reported without losing their first character.
• The release-gate CLI now makes --help inert, rejects unknown arguments, and reserves empirical install-launch-uninstall execution for an empty argument list.

Empirical release proof

The first corrected-wrapper build exposed a real cleanup defect: install, UI launch, all capabilities, and shell uninstall passed, but the isolated attach profile and owned Chrome children remained. The gate returned ok=false; that artifact was not released.

After the wrapper correction and regression tests, the rebuilt artifact passed the complete gate:

release gate                 ok=true
silent installer return     0
installed UI launch         ok=true
required capabilities       5/5 present
silent uninstaller return   0
install root removed        true
shortcuts removed           true
uninstall registry removed  true
Start Apps removed          true
owned Chrome processes      0
owned profile roots         0

Fresh deterministic acceptance also passed 141 Python release/contract tests. The Node source suite passed 57 tests with one explicit Windows symlink-permission skip, and the live Electron/CDP home-screen suite passed 28 tests with one unpackaged-only process-count skip.

The final standalone public clone passed 170 Python tests with three explicit platform/fixture skips and 57 Node tests with one explicit Windows symlink-permission skip. A fresh script-disabled npm ci reproduced the lockfile, and npm audit reported zero vulnerabilities across all severities.

Verify this download

file                    Skynet-Desktop-Setup-0.1.3-x64.exe
bytes                   99,753,337
sha256                  4fd815622d6fc24c37bb46a611af340b094508ab66a897d3c5a0d5abfcbcf15f
appAsarSha256           a57dd3ad4f080eb647da1b8f3c505c407a1ca6d9bd39ccb2513ce2bfcd2de567
sourceDigest            0c5d6e828e7ad68a7e38f0107339658ca05c538eba7eeadd8a5f618cf0c33b5b
wrapperConfigDigest     eb523503911139e59a7cb3736728b1b1bc27f2d6d67f48ec592d57a415140205

Trust boundary

The installer is unsigned. Windows SmartScreen may warn. Verify the SHA-256 above or build from the complete MIT-licensed source in this repository.

The attach lane uses a disposable profile and an ephemeral port, but another process already running as the same Windows user can still poll the live DevTools endpoint. The owned pipe lane avoids a TCP listener. Both limits are documented and tested; neither is presented as stronger isolation than it is.