fix(release): bundle VC runtime dependencies

[vincentkoc]

Summary

• ship x64 VC runtime DLLs app-local next to libsodium in build/test/publish outputs
• add a release native-dependency verifier that checks libsodium loadability plus Microsoft Authenticode signatures for app-local runtime DLLs and VC redistributables
• bundle architecture-matching Microsoft VC redistributables for Inno installers, run them before tray launch, and skip launch if runtime install fails
• pause the ARM64 portable ZIP until we have a trusted app-local ARM64 VC runtime source; ARM64 installer still ships with the ARM64 redist
• improve startup/native dependency logging for device identity and background gateway connect failures

Validation

• Windows Crabbox cbx_c658ca6b0701: ./build.ps1 passed
• Windows Crabbox cbx_c658ca6b0701: shared tests warm passed: 2038 passed, 29 skipped, 0 failed
• Windows Crabbox cbx_c658ca6b0701: tray tests warm passed: 870 passed, 0 failed
• Windows Crabbox cbx_c658ca6b0701: shared tests --no-restore passed: 2038 passed, 29 skipped, 0 failed
• Windows Crabbox cbx_c658ca6b0701: tray tests --no-restore passed: 870 passed, 0 failed
• Windows Crabbox cbx_c658ca6b0701: release proof passed for x64 publish payload with SetupEngine, x64/ARM64 Microsoft redist signature checks, app-local VCRT signature checks, libsodium LoadLibrary probe, and ARM64-redist skip-probe path
• .agents/skills/autoreview/scripts/autoreview --mode local clean: no accepted/actionable findings

Notes

Draft because the signed prerelease recut plus full pond pairing / exec-approval validation are still pending.

[clawsweeper]

Codex review: found issues before merge. Reviewed May 29, 2026, 10:23 PM ET / 02:23 UTC.

Summary
The PR adds VC runtime packaging and release verification, bundles Microsoft VC redistributables into Inno installers, removes the ARM64 portable ZIP release asset, and improves native-dependency startup logging.

Reproducibility: yes. for the review blockers from source inspection: the PR shows the launch gate depends on VC redist success, and the release file list drops the ARM64 ZIP. I did not run installer or release jobs because the review contract is read-only.

Review metrics: 3 noteworthy metrics.

• Diff size: 10 files changed, +363/-14. The PR spans release automation, installer behavior, build targets, docs, and tests, so maintainer review should cover upgrade behavior as well as code correctness.
• Release asset change: 1 portable ZIP removed. Current main publishes an ARM64 portable ZIP, and the PR intentionally removes it from release output.
• Release executable inputs: 2 VC redists downloaded. The release workflow gains external executable downloads that are signature-checked but still need release-owner acceptance.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster
Patch quality: 🦐 gold shrimp
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Resolve or explicitly approve the VC redist elevation/non-admin install path with clean-host x64 and ARM64 evidence.
• Get maintainer approval and release communication for removing the ARM64 portable ZIP, or keep a compatible artifact.
• Complete the signed prerelease recut and pending pond pairing / exec-approval validation noted in the PR body.

Risk before merge

• [P2] The installer remains per-user while the PR runs a bundled VC redistributable and suppresses tray launch when that redist path fails; ARM64 has no app-local VC runtime fallback in the PR.
• [P1] Removing the ARM64 portable ZIP changes the release asset contract and may strand ARM64 portable or updater consumers unless maintainers explicitly accept and communicate the pause.
• [P1] The release pipeline now downloads mutable Microsoft redist executables during release; Authenticode checks reduce risk, but maintainers still need to accept the new executable supply path and reproducibility tradeoff.
• [P1] The PR body says the signed prerelease recut plus full pond pairing and exec-approval validation are still pending.

Maintainer options:

1. Fix redist install and launch gating (recommended)
   Before merge, make VC redist installation elevation-aware and avoid suppressing valid x64 launches, or provide clean-host x64 and ARM64 proof that the current silent path succeeds.
2. Approve ARM64 portable pause
   Maintainers can accept the temporary ARM64 ZIP removal only if updater and portable-user impact plus release communication are explicitly owned.
3. Record redist provenance
   If release reproducibility matters, pin or record the exact Microsoft-signed redist version/hash used by the release proof.

Next step before merge

• [P2] The remaining blockers are maintainer decisions about installer prerequisite policy, ARM64 release compatibility, and release proof rather than a safe automated repair.

Security
Cleared: No concrete credential, permission, or secret-handling regression was found; the new Microsoft redist downloads are Authenticode-checked, with remaining supply-path acceptance tracked as merge risk.

Review findings

• [P1] Handle VC redist failure before gating launch — installer.iss:133-145
• [P1] Preserve or explicitly approve the ARM64 ZIP pause — .github/workflows/ci.yml:674-677

Review details

Best possible solution:

Land this only after the redist elevation/failure path is safe, x64 launch is not blocked when app-local runtime is present, ARM64 artifact impact is explicitly accepted, and signed prerelease clean-host proof covers both architectures.

Do we have a high-confidence way to reproduce the issue?

Yes for the review blockers from source inspection: the PR shows the launch gate depends on VC redist success, and the release file list drops the ARM64 ZIP. I did not run installer or release jobs because the review contract is read-only.

Is this the best way to solve the issue?

Unclear. The app-local x64 runtime and verifier are a good direction, but the installer prerequisite and ARM64 artifact policy need a maintainer decision and clean-host proof before this is the safest fix.

Full review comments:

• [P1] Handle VC redist failure before gating launch — installer.iss:133-145
  The installer still runs with PrivilegesRequired=lowest, but the new flow runs vc_redist.exe /install /quiet /norestart and then launches the tray only when VCRuntimeInstallSucceeded is true. If the machine-wide redist path needs elevation or otherwise fails, x64 can suppress launch even though app-local runtime DLLs were copied, while ARM64 has no app-local fallback; make this path elevation-aware or prove both clean-host flows.
  Confidence: 0.78
• [P1] Preserve or explicitly approve the ARM64 ZIP pause — .github/workflows/ci.yml:674-677
  Current main publishes an ARM64 portable ZIP, but this release list now publishes only the x64 ZIP. That can break existing ARM64 portable or updater consumers at release time, so either keep a compatible ARM64 artifact or get explicit maintainer approval and release communication for the temporary pause.
  Confidence: 0.76

Overall correctness: patch is incorrect
Overall confidence: 0.83

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against f52b829a6f3c.

Label changes

Label changes:

• add merge-risk: 🚨 automation: The release workflow now depends on downloading and verifying external redist executables during release packaging.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.

Label justifications:

• P1: The PR affects installer startup and release artifacts for real Windows users, with upgrade/availability blockers before merge.
• merge-risk: 🚨 compatibility: Removing the ARM64 portable ZIP can break existing ARM64 portable or updater consumers.
• merge-risk: 🚨 availability: The new installer path can skip post-install tray launch when the VC redist path fails, and ARM64 has no app-local fallback.
• merge-risk: 🚨 automation: The release workflow now depends on downloading and verifying external redist executables during release packaging.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external-contributor proof gate does not apply to this member-authored PR, though the PR body reports Windows Crabbox build, test, and release-native-dependency proof.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; its required build/test validation policy informed the proof review, but this task is read-only so no build or tests were run locally. (AGENTS.md:1, f52b829a6f3c)
• Current release assets include ARM64 portable ZIP: Current main still creates and publishes both x64 and ARM64 portable ZIP assets in the release job. (.github/workflows/ci.yml:640, f52b829a6f3c)
• PR removes ARM64 portable ZIP from release assets: The PR release file list includes installers and only the x64 portable ZIP, so ARM64 portable/updater consumers lose the current artifact unless maintainers accept the pause. (.github/workflows/ci.yml:674, 5360e47b68c6)
• Installer gates tray launch on VC redist success: The PR runs vc_redist.exe during file installation and makes post-install launch depend on VCRuntimeInstallSucceeded, while the installer remains PrivilegesRequired=lowest. (installer.iss:141, 5360e47b68c6)
• x64-only app-local VC runtime copy: The new build targets copy app-local VC runtime DLLs only when RuntimeIdentifier is win-x64, leaving ARM64 installer success dependent on the bundled redist path. (src/Directory.Build.targets:4, 5360e47b68c6)
• Release and installer history: Recent history shows the release signing workflow, Inno installer path, and SetupEngine installer behavior were recently changed by Vincent Koc, Scott Hanselman, and Ranjesh, making them likely routing candidates. (.github/workflows/ci.yml:522, f52b829a6f3c)

Likely related people:

• vincentkoc: Authored current-main release signing migration and this branch touches the same release workflow and release-signing tests. (role: recent release workflow contributor; confidence: high; commits: 9e6f1caa76ad; files: .github/workflows/ci.yml, tests/OpenClaw.Tray.Tests/ReleaseSigningWorkflowTests.cs)
• Scott Hanselman: Recent current-main commits made Inno the primary installer path and added release executable signing policy tests around the area this PR extends. (role: release and installer path contributor; confidence: high; commits: 5a555abf9e4c, 528f625edc5b; files: installer.iss, .github/workflows/ci.yml, docs/RELEASING.md)
• ranjeshj: Introduced the out-of-process SetupEngine installer flow and recently maintained installer cleanup behavior that shares the same Inno script surface. (role: installer and SetupEngine contributor; confidence: high; commits: cefce3952ab1, 191f4d6f86cd, 8af4b70360a9; files: installer.iss, .github/workflows/ci.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.