Make helper activation and releases fail-safe

[dantraynor]

Summary

• Replace helper-version blocking with dismissible release notices and capability-gated controls.
• Classify native-helper failures once at the connection boundary, persist restart-safe discovery retries, promote evidence-based repair, and add bounded local diagnostics.
• Add architecture-aware package selection plus a version-pinned, checksum-verified macOS/Linux repair installer with Linux ARM64 coverage.
• Build immutable all-platform release candidates, verify final signatures and hashes, and publish only the reviewed candidate bytes through a protected resumable workflow.
• Route Windows Defender evidence through a protected, single-use Windows runner because the evaluated GitHub-hosted images keep Defender in passive mode.

User-visible behavior

An older or newer helper no longer takes over the popup. Tailchrome keeps every advertised feature usable and shows a non-blocking release notice. Missing, disallowed, failed, stopped, reported-error, and explicitly incompatible helpers now produce distinct recovery guidance. Registration repair is promoted only after unavailable/not-allowed evidence, and diagnostic reports are generated locally from a bounded allowlist with credential-like values redacted when the user chooses to copy or export one.

The setup view uses runtime.getPlatformInfo() for operating system and architecture selection:

Platform	Architecture	Primary helper path
macOS	amd64 / arm64	macOS package; signed raw helper selected by the verified repair script
Linux	amd64	DEB or RPM package; verified raw helper remains an explicit repair path
Linux	arm64	Version-pinned verified raw-helper installer
Windows	amd64 / arm64 host	Signed x64 MSI and embedded signed amd64 helper
Unknown	Any	Release information only; no guessed artifact or command

Failure taxonomy

• helper-unavailable: native host is absent.
• helper-not-allowed: the browser refuses this extension access to the registered host.
• helper-start-failed: the browser finds the host but cannot start it.
• helper-stopped: a previously healthy connection closes.
• helper-reported-error: the helper reports a startup/protocol error.
• helper-incompatible: reserved for explicit future protocol evidence; version text alone never sets it.

Review follow-up

• Repeated equivalent helper failures now reuse the prior failure and diagnostic objects, so reconnect backoff no longer tears down the install view or resets onboarding interactions.
• The Windows repair command resolves the downloaded MSI from the user's Downloads folder in a fresh PowerShell or Command Prompt session.
• Windows packaging and signature-verification scripts resolve relative output paths through PowerShell's current provider path.
• The release workflow binds the signed Windows artifact ID, digest, and hashes to a protected single-use Defender runner; it verifies the approved image identity, active protection, cloud settings, exclusions, detection history, post-scan state, and immutable publication metadata before candidate assembly.

Release and security gate

The candidate workflow now pins the source tag/SHA, assembles the complete asset allowlist before checksums, creates attestations, verifies macOS/Linux/Windows outputs, and retains one immutable candidate artifact. The separate publication workflow accepts only that candidate artifact ID, run attempt, tag, and checksum-manifest digest; it revalidates the bytes, refuses asset replacement, resumes a byte-identical draft, and publishes only after protected approval.

Current Windows gate status:

• Signing provider: not selected — blocking.
• Expected Authenticode signer subject: not configured — blocking.
• Provider test signature: not available — blocking.
• Production workflow result: verifier and fail-closed boundaries are implemented; candidate assembly cannot succeed until the selected provider produces the RFC 3161-timestamped signed EXE and outer MSI.
• windows-defender-validation: configured with required reviewer dantraynor, administrator bypass disabled, and an exact v* tag policy; the approved image ID remains unset until a clean image is provisioned.
• Controlled Defender runner: not provisioned — blocking.
• Final EXE/MSI SHA-256 values: not produced — blocking.
• Defender exact-hash static/behavioral result: pending final signed candidate.
• Malwarebytes exact-hash static/behavioral result: pending final signed candidate.
• windows-release-clearance: configured with required reviewer dantraynor and administrator bypass disabled; final-evidence approval remains pending.

Validation completed

• Frozen dependency install, extension-ID validation, and v0.1.13 release-tag validation.
• TypeScript typecheck and 568/568 unit tests.
• Installer tests: 23/23, including successful temporary-file cleanup.
• Production Chrome and Firefox builds.
• Full Chrome E2E: 26/26.
• Full Firefox E2E: 20/20.
• Firefox ZIP/publish review: zero errors and zero notices; one tooling warning remains because the Android minimum version predates support for the manifest disclosure field.
• Go race tests and go vet.
• Linux raw architecture/package ownership checks and macOS unsigned package payload smoke test.
• Windows Server 2025 Authenticode fixture suite: RFC 3161-timestamped EXE/MSI acceptance plus legacy /t, unsigned, untimestamped, signer-mismatch, tamper, multiple-signature, embedded-payload-mismatch, and missing-payload rejection.
• Workflow lint, ShellCheck, PowerShell syntax parsing, and git diff --check.
• Fresh CI at a99afe2: all 15 reported checks passed, including CodeQL, workflow static validation, and the Windows signature-verifier job.

Manual platform matrix

Platform	Status
macOS Intel	Pending clean-machine signed package/install/repair/uninstall test
macOS Apple Silicon	Local unsigned package/payload smoke passed; signed clean-machine lifecycle pending
Debian/Ubuntu amd64	Package structure passed; clean-machine browser discovery/repair/uninstall pending
Debian/Ubuntu arm64	Installer unit coverage passed; clean-machine installed-path lifecycle pending
Fedora/RHEL x86_64	Package structure passed; clean-machine browser discovery/repair/uninstall pending
Fedora/RHEL aarch64	Installer unit coverage passed; clean-machine installed-path lifecycle pending
Windows 11 x64 standard user	Pending selected publisher, signed candidate, security clearance, and full lifecycle test

Remaining blockers

• Provision the approved clean x64 Windows image as a repository-scoped ephemeral runner with the run-specific label, host-owned assignment hook, and machine image marker.
• Record that image's immutable ID in the environment-only WINDOWS_DEFENDER_IMAGE_ID value.
• Select and onboard exactly one Windows signing provider and record its exact stable signer subject.
• Add the selected production signing step and obtain a successful workflow test signature.
• Obtain protected windows-release-clearance approval after the final evidence is available.
• Build the final signed candidate and record raw EXE, embedded EXE, and MSI signature/hash evidence.
• Record current Defender and Malwarebytes static and behavioral results for those exact hashes.
• Complete every clean-machine row above.
• Merge only after the blocking evidence is attached, then create and publish one coordinated release from the same cleared bytes.

This pull request must remain a draft and must not merge while any blocker above is open.