[2037 by GPT-5.6 Sol] Enforce Windows Installer ProductVersion numeric bounds

[propr-dev]

AI Implementation Summary

Closes #2037

Branch: 2037/gpt-5.6-sol-enforce-windows-installer-20260831-2347-o25
Commits: ✅ Changes committed (57bfef6)

---

AI Processing Completed

Execution Details:

• Issue: Enforce Windows Installer ProductVersion numeric bounds #2037
• Repository: integry/propr
• Status: Success
• Execution Time: 5m 39s
• Tokens used: 977.65K tokens [965.06K input + 12.6K output]
• API cost: $1.23
• Timestamp: Aug 31, 2026, 11:53 PM UTC
• LLM Model: GPT-5.6 Sol

Summary:
Implemented GitHub issue #2037.

Changes:

• Added shared MSI/WiX ProductVersion validation enforcing:
  • Three canonical numeric components
  • Major/minor ≤ 255
  • Patch ≤ 65535
• Applied validation at both Windows release configuration and direct installer builder entry points.
• Preserved existing macOS/Linux stable SemVer behavior.
• Added fixed, non-sensitive actionable diagnostics.
• Added boundary, overflow, huge-input, malformed, signed, extra-component, and prerelease tests.
• Verified generated WiX retains 255.255.65535, wildcard Product IDs, stable UpgradeCode, and major-upgrade behavior.

Validation completed:

• Desktop and renderer typecheck passed.
• Full desktop suite: 165 passed, 6 platform-specific skipped.
• Focused release-config, installer-builder, release-workflow, and release-validation tests passed.
• Changed-file syntax and whitespace checks passed.

Detailed Logs:

• Conversation: 41 messages
• Session: 01a05a39-b47b-74b1-8d33-dbc81bf27918

Log files stored at:

• conversation: /tmp/claude-logs/issue-2037-2026-08-31T23-53-36-495Z-conversation.json
• output: /tmp/claude-logs/issue-2037-2026-08-31T23-53-36-495Z-output.txt

Latest Conversation Messages

---

This PR was created automatically by ProPR after processing issue #2037.

---

💡 Need changes?

Comment on this PR to request refinements — the AI agent monitors comments and will update the implementation based on your feedback. Keep iterating until you're satisfied!

[integry]

/review

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

This PR correctly centralizes Windows MSI/WiX ProductVersion validation and applies it at both release configuration and direct installer construction boundaries. It is ready to merge within scope, conditional on the pending head checks completing successfully.

✅ Correct MSI boundaries — Validation enforces exactly three canonical numeric components with major/minor limited to 255 and patch limited to 65535.

✅ Defense at both entry points — Invalid versions are rejected in resolveDesktopVersion and buildWindowsMachineInstaller, while non-Windows stable SemVer behavior remains unchanged.

✅ Strong boundary coverage — Tests cover exact limits, overflows, malformed and signed values, leading zeros, prereleases, huge inputs, and generated WiX identity behavior.

Merge blockers

No merge blockers.

Suggestions

These are optional follow-ups and are not sent to /fix.

No suggestions.

Score

The implementation is focused, internally consistent, and well tested, with no verified code blockers or current check failures. Ten checks remain pending, so final merge should wait for their successful completion.

Score: 9/10

---

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 36s
• Tokens: 35,947 (34,172 in / 1,775 out)
• Cost: $0.17

View Task

---

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}

[integry]

Fix only the authoritative Windows test failure on exact head 57bfef695e4428611fcf7a152f344ac58f076d12.

x64 job 99685536166 failed in release-config.test.ts test "propagates an explicit independent desktop version": an existing prerelease/malformed SemVer assertion expected the stable-semver diagnostic, but resolveDesktopVersion now calls the Windows MSI bounds validator before the existing canonical stable SemVer validator and emits the MSI diagnostic first on Windows. Linux-focused tests did not expose the platform-dependent ordering.

Preserve both policies but make error behavior deterministic: at the release-configuration boundary, first validate the existing canonical stable three-component SemVer contract (including prerelease/build/format rejection and its existing fixed error), then apply assertWindowsInstallerProductVersion only for win32 to otherwise-valid stable versions. Keep the direct installer-builder guard strict and unchanged so direct calls remain protected. Update focused tests to prove prerelease/malformed spellings retain the stable-semver error on win32, while canonical stable out-of-range numeric versions receive the MSI bounds error; macOS/Linux behavior remains unchanged.

Run release-config tests explicitly under Windows-relevant platform injection/mocking, installer-builder tests, desktop typecheck/tests, and diff-check. Do not change numeric bounds, generated WiX identity, unrelated release behavior, merge, or sync the base.

[propr-dev]

✅ Applied the requested follow-up changes in commit 8ab9ae9

Summary of Changes

Implemented the Windows validation-order fix on exact head 57bfef695e4428611fcf7a152f344ac58f076d12.

• release-config.ts now validates canonical stable SemVer before applying Windows MSI bounds.
• release-config.test.ts explicitly covers Windows malformed/prerelease/build diagnostics, canonical numeric overflow, and unchanged macOS/Linux behavior.
• Direct installer-builder validation remains unchanged.

Validation passed:

• Focused release-config: 13 passed
• Installer-builder: 9 passed
• Desktop typecheck
• Full desktop suite: 166 passed, 6 platform-specific skipped
• git diff --check

Only the two release-config files were modified; no commit was created.

---

🤖 Implementation Details

• Model: GPT-5.6 Sol (high)
• Requested By: @integry
• Time: 3m 8s
• Tokens: 409,066 (403,447 in / 5,619 out)
• Cost: $0.57

Undo Changes • View Task Execution

---

💡 ProPR Slash Commands

Command	Description	Example
/merge	Merge target branch into this PR and resolve conflicts	/merge
/review	Request an AI code review	/review or /review claude-sonnet
/fix	Implement fixes for issues found by /review	/fix or /fix address the null check issue
/switch	Change the AI model for this PR	/switch claude-opus
/use	Override the model for a single follow-up run	/use claude-sonnet
/ultrafix	Loop review→fix cycles until score goal is met	/ultrafix or /ultrafix goal=8 max=10

_{🤖 Generated by ProPR}
Processing comment ID: 5486469236✓

[integry]

/review

[propr-dev]

✅ AI Code Review Complete requested by @integry

Posted 1 review:

• codex:gpt-5.6-sol

View Task Details

[propr-dev]

🔍 AI Code Review — codex:gpt-5.6-sol

Overall Evaluation

The PR correctly adds shared MSI/WiX ProductVersion validation at both release configuration and direct installer-builder boundaries. It is ready to merge within scope once the pending checks complete; no current-head failures are reported.

✅ Deterministic validation ordering — resolveDesktopVersion preserves the established stable-SemVer diagnostic before applying Windows-specific bounds.

✅ Correct MSI boundaries — The validator accepts 255.255.65535 while rejecting oversized, non-canonical, prerelease, and malformed versions.

✅ Strong focused coverage — Tests exercise platform-specific behavior, exact limits, huge inputs, diagnostic stability, and direct-builder enforcement.

Merge blockers

No merge blockers.

Suggestions

These are optional follow-ups and are not sent to /fix.

No suggestions.

Score

The implementation is focused, internally consistent, and thoroughly tested, with zero reported current-head failures. Several authoritative checks remain pending, so final merge should await their successful completion.

Score: 9/10

---

🤖 Review Details

• Model: GPT-5.6 Sol
• Time: 29s
• Tokens: 36,997 (35,593 in / 1,404 out)
• Cost: $0.18

View Task

---

💡 Next step: Comment /fix to address F# merge blockers only.
F# IDs increment across review comments and remain permanent, so selectors such as /fix F3 F5 stay unambiguous across cycles. Suggestions require a separate ordinary follow-up request.

_{🤖 Review by ProPR}