[2032 by GPT-5.6 Sol] Make Windows MSI Start Menu shortcut machine-wide

[propr-dev]

AI Implementation Summary

Closes #2032

Branch: 2032/gpt-5.6-sol-make-windows-msi-start-me-20260831-2021-uou
Commits: ✅ Changes committed (2c35025)

---

AI Processing Completed

Execution Details:

• Issue: Make Windows MSI Start Menu shortcut machine-wide #2032
• Repository: integry/propr
• Status: Success
• Execution Time: 9m 37s
• Tokens used: 1.2M tokens [1.19M input + 12.9K output]
• API cost: $1.36
• Timestamp: Aug 31, 2026, 8:31 PM UTC
• LLM Model: GPT-5.6 Sol

Summary:
Implemented the machine-wide Windows Start Menu shortcut.

Changes:

• MSI now uses CommonProgramMenuFolder.
• Shortcut component is 64-bit and uses one HKLM key path under Software\ProPR\Desktop.
• Focused tests reject the old per-user folder and all HKCU registry values.
• Native Windows smoke validation now verifies the shortcut is readable by an ordinary user after installation and absent after uninstall.
• Uninstall validation covers the common shortcut folder and HKLM product marker.

Files updated:

• build-windows-machine-installer.mjs
• build-windows-machine-installer.test.mjs
• test-installed-windows-app.ps1
• release-workflow.test.ts

Validation completed:

• Focused installer tests: 7/7 passed.
• Desktop tests: 155 passed, 6 platform-specific skipped.
• Desktop and UI typechecks passed.
• Generated x64/ARM64 WXS audit confirmed one common-menu root, one shortcut key path, HKLM only, and Win64="yes".

Actual WiX compilation and installed-user MSI smoke require the native Windows CI runners and could not be executed in this Linux workspace.

Detailed Logs:

• Conversation: 49 messages
• Session: 01a0597d-1647-76b2-95fb-43a596bca7ec

Log files stored at:

• conversation: /tmp/claude-logs/issue-2032-2026-08-31T20-31-44-596Z-conversation.json
• output: /tmp/claude-logs/issue-2032-2026-08-31T20-31-44-596Z-output.txt

Latest Conversation Messages

---

This PR was created automatically by ProPR after processing issue #2032.

---

💡 Need changes?

Comment on this PR to request refinements — the AI agent monitors comments and will update the implementation based on your feedback. Keep iterating until you're satisfied!

[integry]

/merge

[propr-dev]

🔀 Auto-merged 1952-epic-electron-runtime-app into 2032/gpt-5.6-sol-make-windows-msi-start-me-20260831-2021-uou (clean merge) in commit 1aace8c

No conflicts were found — the merge was verified by an AI agent.

---

🤖 Verification Details

• Model: gpt-5.6-sol
• Time: 2m 35s

View Task Execution

---

System-triggered merge conflict resolution

[integry]

/review

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

The PR correctly moves the Windows shortcut to the machine-wide Start Menu and aligns its component ownership with the per-machine MSI. It is ready to merge within scope once the pending checks complete successfully.

✅ Correct machine-wide authoring — The installer uses CommonProgramMenuFolder, a 64-bit component, and an HKLM key path for both x64 and ARM64 packages.

✅ Real ordinary-user validation — The Windows smoke test launches a separate process under ordinary-user credentials and verifies that the shortcut is present and readable, then confirms its removal after uninstall.

✅ Focused regression coverage — Tests explicitly reject the former per-user folder and all HKCU registry values while checking both supported architectures.

Merge blockers

No merge blockers.

Suggestions

These are optional follow-ups and are not sent to /fix.

S1: 🟢 Validate the shortcut target

The installed-app smoke test confirms that the .lnk exists and is readable but does not resolve it and verify that its target is the installed executable. Adding that assertion would strengthen future regression detection, although it is optional here because the PR does not change the existing shortcut target authoring.

Score

The implementation is focused, internally consistent, and well covered at both source-generation and installed-application levels. No failures are currently reported, though the pending checks—especially native Windows validation—should complete before merging.

Score: 9/10

---

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 3m 18s
• Tokens: 43,872 (38,490 in / 5,382 out)
• Cost: $0.31

View Task

---

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}

[integry]

Fix only the authoritative native shortcut blocker on exact head 1aace8c17648c34e70ceb7312d42e1ca778be231.

Fresh x64 job 99636092959 installed the MSI successfully, then failed because C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ProPR Desktop\ProPR Desktop.lnk did not exist; uninstall and cleanup succeeded. The cause is now proven: CommonProgramMenuFolder is not a Windows Installer/WiX standard directory identifier. WiX standard directories include ProgramMenuFolder, and Microsoft documents that when ALLUSERS is set it resolves to the All Users profile. This MSI already declares InstallScope="perMachine", which sets machine context/ALLUSERS.

Change only the directory identifier back from CommonProgramMenuFolder to the valid standard ProgramMenuFolder. KEEP the actual machine-scope corrections: ApplicationStartMenuShortcutComponent Win64="yes", its single HKLM key path, InstallScope="perMachine", Program Files installation, HKLM protocol/App Paths registration, shortcut/AUMID/target, RemoveFolder, and the bounded admin/ordinary-user/install/uninstall native proof.

Update focused source assertions and wording to require ProgramMenuFolder together with per-machine InstallScope, Win64 component, and HKLM key path as the complete machine-scope contract. Explicitly reject the invalid CommonProgramMenuFolder token and all HKCU values. Do not revert HKLM or Win64, add a custom directory, weaken the native shortcut proof, or touch unrelated packaging/release behavior.

Run focused installer tests, desktop typecheck/tests, diff-check, then fresh x64 and ARM64 native installed-user validation. Acceptance requires the common ProgramData shortcut and HKLM marker to exist after install, be readable by the distinct ordinary user, and be absent after uninstall. Do not merge or sync the base.

[propr-dev]

✅ Applied the requested follow-up changes in commit e1b318f

Summary of Changes

Implemented the narrowly scoped fix on exact head 1aace8c17648c34e70ceb7312d42e1ca778be231.

• Replaced invalid CommonProgramMenuFolder with ProgramMenuFolder in build-windows-machine-installer.mjs.
• Updated focused assertions to enforce the complete machine-scope contract and reject CommonProgramMenuFolder and HKCU values.
• Preserved perMachine, Win64="yes", HKLM registrations/key path, shortcut metadata, removal behavior, and native proof unchanged.
• No unrelated files changed; no commit, merge, or base sync performed.

Validation passed:

• Installer tests: 7/7
• Release-workflow tests: 16/16
• Desktop typechecks: passed
• Desktop tests: 155 passed, 6 platform-specific skipped
• git diff --check: passed

Fresh native x64/ARM64 validation remains pending because the workflow only checks out committed PR SHAs and has no manual-dispatch trigger. The PR synchronize event will launch it after the surrounding system commits these changes.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 5m 49s
• Tokens: 634,973 (627,989 in / 6,984 out)
• Cost: $0.83

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5484331917✓

[integry]

/review

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

The PR correctly implements a machine-wide Windows Start Menu shortcut and is ready to merge within scope once the pending CI checks complete.

✅ Correct WiX directory semantics — ProgramMenuFolder is retained with InstallScope="perMachine", allowing Windows Installer to resolve the shared Start Menu correctly.

✅ Coherent machine component — The shortcut component is 64-bit and uses a single HKLM key path, with no remaining HKCU registry values.

✅ Strong native validation — The smoke test verifies shortcut presence and readability as an ordinary user, then confirms shortcut, folder, and marker removal after uninstall.

Merge blockers

No merge blockers.

Suggestions

These are optional follow-ups and are not sent to /fix.

No suggestions.

Score

The implementation is focused, internally consistent, and well covered by generated-source and native installation tests. No current-head failures are reported, although the pending Windows validation checks should complete before merging.

Score: 9/10

---

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 1m 5s
• Tokens: 41,352 (39,672 in / 1,680 out)
• Cost: $0.20

View Task

---

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}

[integry]

Implement only MSI correction F2 on exact head e1b318ffa2c139cc3d48df01fd126e6ecbe2ae07.

Authoritative Windows x64 job 99640199948 failed in LIGHT before install:

• ICE38: ApplicationStartMenuShortcutComponent installs to user profile, so its registry KeyPath must be HKCU.
• ICE43: the non-advertised shortcut KeyPath should be HKCU.
• ICE57: ProgramMenuFolder plus HKLM mixes per-user and per-machine data.

The prior CommonProgramMenuFolder identifier was invalid for this WiX 3 authoring. The correct Windows Installer behavior is ProgramMenuFolder: because this package is already InstallScope="perMachine"/ALLUSERS, Windows Installer resolves ProgramMenuFolder to the all-users Start Menu at install time. Static ICE validation still requires this shortcut component's registry KeyPath in HKCU.

Restore the known-valid shortcut component authoring only: keep Directory Id="ProgramMenuFolder", change this component's marker KeyPath back to Root="HKCU", and remove Win64="yes" from ApplicationStartMenuShortcutComponent. Do not change the existing machine-wide HKLM protocol/App Paths components or perMachine package scope. Retain the new native ordinary-user proof that requires the shortcut at C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ProPR Desktop\ProPR Desktop.lnk after install and absent after uninstall; that proof, not an invalid directory ID or HKLM shortcut marker, establishes the all-users outcome.

Update focused assertions to require this exact ICE-valid arrangement, reject CommonProgramMenuFolder, and continue asserting the common ProgramData native proof. Preserve all other installer behavior and tests. Run focused installer/release tests, desktop typecheck/tests, and diff-check. Do not sync, merge, or touch unrelated files.

[propr-dev]

✅ Applied the requested follow-up changes in commit 83aecdf

Summary of Changes

Implemented MSI correction F2 on exact head e1b318ffa2c139cc3d48df01fd126e6ecbe2ae07.

• Kept ProgramMenuFolder.
• Restored the shortcut marker KeyPath to HKCU.
• Removed Win64="yes" from ApplicationStartMenuShortcutComponent.
• Preserved per-machine scope and HKLM protocol/App Paths registration.
• Retained the ordinary-user common Start Menu presence/removal proof.
• Removed obsolete native checks for the superseded HKLM shortcut marker.
• Updated assertions to enforce the ICE-valid arrangement and reject CommonProgramMenuFolder.

Changed only:

• build-windows-machine-installer.mjs
• build-windows-machine-installer.test.mjs
• test-installed-windows-app.ps1
• release-workflow.test.ts

Validation:

• Installer tests: 7/7 passed
• Release-workflow tests: 16/16 passed
• Desktop/UI typechecks: passed
• Desktop tests: 155 passed, 6 platform-specific skipped
• git diff --check: passed

No commit, merge, or synchronization performed.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 6m 49s
• Tokens: 703,391 (695,154 in / 8,237 out)
• Cost: $0.94

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5484490917✓

[integry]

/review

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

The PR correctly validates a machine-wide Start Menu shortcut and adds a carefully isolated ordinary-user smoke probe, but it needs one localized correction before merge.

✅ Correct MSI contract — Tests verify per-machine scope, ProgramMenuFolder, and the ICE-compatible HKCU shortcut-component key path for both architectures.

✅ Safe probe isolation — The probe receives the canonical shortcut through an exact seven-entry environment and emits only fixed, redacted outcomes.

✅ Resilient cleanup — Cleanup is granular, preserves the primary failure, and limits fallback shortcut removal to paths attributed to this run.

Merge blockers

Every finding below was introduced by this PR and must be resolved before merging.

F3: 🔴 Child outcome mapping uses positional indexing

• Required behavior: Every documented shortcut-child exit code must map to its corresponding fixed diagnostic category.
• Evidence: apps/desktop/scripts/test-installed-windows-app.ps1:87 — $shortcutProbeExitCategories is an [ordered] dictionary with numeric keys, but the new exit handling reads $shortcutProbeExitCategories[$exitCode]. PowerShell treats an integer OrderedDictionary index as a zero-based position; codes 10–18 therefore do not retrieve their numeric-key mappings and can raise an out-of-range error instead of emitting the required category.
• Minimum fix: Change $shortcutProbeExitCategories to an ordinary hashtable (@{}), retaining the existing numeric keys and .Contains($exitCode) lookup, and update the corresponding source-structure assertion in release-workflow.test.ts.

Suggestions

These are optional follow-ups and are not sent to /fix.

No suggestions.

Score

The core implementation is strong, but the new diagnostic path is incorrect for every documented nonzero child outcome. The correction is small and bounded; current checks are also still pending.

Score: 6/10

---

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 1m 35s
• Tokens: 59,911 (54,964 in / 4,947 out)
• Cost: $0.38

View Task

---

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}

[integry]

Implement only diagnostic F10 on exact head 86faa47925fdaf288b986453225de560ae483c4e.

Authoritative F9 x64 job 99671951719 proves the production wrapper and numeric-key mapper are now sound: real Windows mapping/typecheck/package/MSI build passed, MSI install and admin common-shortcut validation passed, but both actual launches emitted fixed SPAWN_FAILED:UNKNOWN; uninstall/removal/cleanup all passed. The immediate Win32 NativeErrorCode is therefore outside the existing 2/3/5/87/267/1326/1385 allowlist.

Extend only the fixed redacted allowlist with documented/plausible CreateProcessWithLogonW/Process.Start failure categories needed to isolate this environment, without exposing numeric codes:

• 6 => INVALID_HANDLE
• 50 => NOT_SUPPORTED
• 193 => BAD_EXE_FORMAT
• 206 => NAME_TOO_LONG
• 740 => ELEVATION_REQUIRED
• 1058 => SERVICE_DISABLED
• 1060 => SERVICE_NOT_FOUND
• 1062 => SERVICE_NOT_ACTIVE
• 1314 => PRIVILEGE_NOT_HELD
• 1327 => ACCOUNT_RESTRICTION
• 1328 => INVALID_LOGON_HOURS
• 1329 => INVALID_WORKSTATION
• 1330 => PASSWORD_EXPIRED
• 1331 => ACCOUNT_DISABLED
• 1789 => TRUST_RELATIONSHIP_FAILURE
• 1909 => ACCOUNT_LOCKED_OUT

Preserve all existing mappings, ordinary Hashtable numeric-key lookup, direct/exact-one-wrapper selection, deeper rejection, UNKNOWN, bare non-Win32 fallback, and redaction. Emit only the fixed category token; never emit the number, message, path, account, service, exception, environment, or child output. Update exact mapping/cardinality and real Windows lookup tests (at minimum INVALID_HANDLE, SERVICE_DISABLED, PRIVILEGE_NOT_HELD, ACCOUNT_DISABLED, and UNKNOWN), plus sentinel redaction. Do not change process behavior, user rights/services, MSI, F6 environment/ACLs, cleanup, or success semantics yet. This run is classification only.

Run desktop typecheck and focused release workflow tests.

[propr-dev]

✅ Applied the requested follow-up changes in commit 62c8c06

Summary of Changes

Implemented diagnostic F10 on exact head 86faa47925fdaf288b986453225de560ae483c4e.

• Added all 16 requested fixed Win32 categories in test-installed-windows-app.ps1.
• Updated exact 23-entry mapping/cardinality, native Windows lookup coverage, UNKNOWN handling, and sentinel redaction tests in release-workflow.test.ts.
• Preserved wrapper selection, numeric hashtable lookup, fallbacks, redaction, and process behavior.

Validation:

• Focused release workflow: 21 passed, 1 Windows-only test skipped on Linux.
• Desktop typecheck: passed.
• git diff --check: passed.
• Only the two intended files changed; no commit created.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 2m 49s
• Tokens: 391,664 (386,830 in / 4,834 out)
• Cost: $0.68

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5485923810✓

[integry]

/fix F3

[propr-dev]

✅ Applied the requested follow-up changes in commit fe67899

Addressed 1 AI review comment (IDs: 5485878737)

Summary of Changes

Implemented F3 only.

• Changed $shortcutProbeExitCategories from [ordered]@{} to ordinary @{} for numeric-key lookup.
• Updated the corresponding source-structure assertion.
• Focused test passed: 21 passed, 1 Windows-only skipped.
• git diff --check passed.
• No commit created.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 1m 35s
• Tokens: 176,173 (174,603 in / 1,570 out)
• Cost: $0.22

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5485956015✓

[integry]

/review

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

The PR correctly authors and validates a machine-wide Start Menu shortcut, with careful redaction and ownership-aware cleanup. However, it needs a mandatory functional correction before merge: the newly required ordinary-user probe still cannot start on the authoritative Windows environment, and the latest changes only improve its failure label.

✅ Machine-wide contract — The validation resolves CommonPrograms, checks the installed shortcut, and verifies removal after uninstall.

✅ Safe diagnostics and cleanup — Spawn errors use fixed categories without exposing sensitive values, while fallback removal is non-recursive and limited to run-created paths.

✅ Strong focused coverage — Tests cover both architectures, child outcomes, Win32 wrapper selection, mapping behavior, and primary-failure preservation.

Merge blockers

Every finding below was introduced by this PR and must be resolved before merging.

F4: 🔴 Diagnostic mapping leaves probe nonfunctional

• Required behavior: The changed Windows smoke validation must successfully prove that an ordinary user can read the installed shortcut and that it is absent after uninstall; diagnostic categorization alone cannot leave this mandatory validation path unable to execute.
• Evidence: apps/desktop/scripts/test-installed-windows-app.ps1:545 — every exception from $process.Start() is converted into a SPAWN_FAILED category, and the function subsequently throws for every such category. The completed native execution in the supplied context demonstrated that this unchanged launch path fails for both probes; extending the allowlist changes only the emitted category, not the outcome.
• Minimum fix: Correct the alternate-user launch configuration or replace it with a supported impersonated access check so both presence and absence checks actually run under the ordinary user’s security context. Confirm both paths succeed in native Windows validation while retaining the existing bounds and redaction guarantees.

Suggestions

These are optional follow-ups and are not sent to /fix.

No suggestions.

Score

The MSI and cleanup work appears carefully implemented, but the newly mandatory ordinary-user proof remains functionally blocked. The correction is localized to the probe, yet it prevents merge until validated on Windows.

Score: 6/10

---

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 3m 15s
• Tokens: 65,191 (54,764 in / 10,427 out)
• Cost: $0.54

View Task

---

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}

[integry]

/fix F4

On exact head fe67899ebe7f1c98b0819a9c178cd975fcb40057, replace only the failing alternate-credential Process.Start proof with a supported bounded in-process ordinary-user impersonation proof. The authoritative x64 run proves MSI install, machine-wide ProgramData shortcut creation/admin validation, uninstall/removal, and cleanup all succeed; only both Process.Start probes return SPAWN_FAILED:UNKNOWN. Do not spend another native run expanding diagnostic categories.

Use Win32 LogonUserW with LOGON32_LOGON_NETWORK (3) and LOGON32_PROVIDER_DEFAULT into SafeAccessTokenHandle, then WindowsIdentity.RunImpersonated. Marshal the test password securely, zero/free the unmanaged password buffer in finally, and dispose token/streams. Inside the impersonated action first require WindowsIdentity.GetCurrent().User to exactly equal the already-created ordinary test user's SID, then perform the existing canonical path, file type/reparse, bounded size, and read checks for presence; after uninstall run the same impersonated identity proof and require absence. Network logon is sufficient for local filesystem authorization and avoids hosted runner interactive window-station/profile/process-launch dependencies.

Preserve the canonical CommonPrograms-derived path, fixed redacted outcomes, ownership-aware nonrecursive cleanup, MSI/WiX authoring, install/admin validation, both architecture jobs, and all prior security bounds. Remove obsolete Process.Start-only environment/profile/exit-code machinery and its tests if no longer reachable; do not weaken ordinary-user identity/access or absence semantics. Add focused tests for P/Invoke signature/constants, exact SID assertion within RunImpersonated, secure password cleanup, presence/absence checks within impersonation, fixed redaction, and rejection of legacy Process.Start proof.

Run desktop typecheck, focused release-workflow/installer tests, full desktop tests, and diff-check. Acceptance is fresh x64 and ARM64 native package validation green for install, ordinary-user shortcut read, uninstall, absence, and cleanup. Do not merge or sync the base.

[propr-dev]

✅ Applied the requested follow-up changes in commit 2ecdd60

Addressed 1 AI review comment (IDs: 5486022754)

Summary of Changes

Implemented F4 only on exact head fe67899ebe7f1c98b0819a9c178cd975fcb40057.

• Replaced the failing shortcut Process.Start proof with LogonUserW(LOGON32_LOGON_NETWORK) and WindowsIdentity.RunImpersonated.
• Added exact ordinary-user SID verification, bounded shortcut metadata/read checks, and secure password buffer zero/free cleanup.
• Disposes identities, streams, and SafeAccessTokenHandle.
• Preserved fixed redacted outcomes, canonical CommonPrograms path, and ownership-aware cleanup.
• Removed obsolete shortcut child-process/profile/exit-code machinery and tests.
• MSI/WiX authoring and workflows remain untouched.

Files changed:

• test-installed-windows-app.ps1
• release-workflow.test.ts

Validation:

• Desktop/UI typecheck: passed
• Focused release-workflow/installer tests: 28 passed
• Full desktop tests: 160 passed, 6 platform-specific skipped
• git diff --check: passed
• Only the two scoped files are modified
• No commit, merge, base sync, or additional native diagnostic run performed

Fresh x64 and ARM64 installed-package validation remains for the native Windows CI runners.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 8m 3s
• Tokens: 2,325,005 (2,305,532 in / 19,473 out)
• Cost: $2.36

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5486062025✓

[integry]

/review

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

The PR verifies the machine-wide Start Menu shortcut through installation, ordinary-user access, uninstall, and cleanup. The implementation is ready to merge within scope once the pending current-head checks complete; no merge-blocking defect is evident in the supplied diff.

✅ Secure ordinary-user proof — test-installed-windows-app.ps1 uses bounded in-process impersonation, verifies the exact user SID, securely clears the marshalled password, and disposes identities, streams, and tokens.

✅ Thorough shortcut validation — Presence checks enforce a canonical rooted path, regular non-reparse file, bounded nonzero size, and successful content read; absence is rechecked after uninstall.

✅ Failure-safe cleanup — Cleanup is ownership-aware, nonrecursive for Start Menu resources, emits fixed diagnostics, and preserves the primary failure while still attempting every cleanup stage.

Merge blockers

No merge blockers.

Suggestions

These are optional follow-ups and are not sent to /fix.

No suggestions.

Score

The changed behavior is carefully bounded and strongly covered by focused contract tests. The score reflects that the latest Windows-specific implementation is still awaiting its authoritative current-head CI runs, with no known current failure.

Score: 8/10

---

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 1m 40s
• Tokens: 54,377 (49,041 in / 5,336 out)
• Cost: $0.36

View Task

---

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}