Repository navigation
Title: Bug: KiCad path auto-detection, installation, and manual path resolution failing on Windows (String escaping issue) #927
Description
On Windows, the application fails to auto-detect the existing KiCad installation and the in-app installation mechanism does not work. Furthermore, providing a manual path fails due to a string escaping bug.
When entering a manual directory path like C:\backplane_kicad, the application does not accept it. This appears to be an issue with how Windows file paths are parsed; the \b in \backplane_kicad is likely being evaluated as a backspace escape character rather than a literal backslash followed by 'b', corrupting the path internally.
Activity
Merge pull request #930: Windows KiCad discovery and installation paths
i2cjak commentedon Nov 4, 2026
PR #930 merged as b96ec62.
Independently reproduced and corrected: native Windows PATH splitting at drive colons, runtime-root normalization and
.exeselection, standard Program Files discovery, and installer checksum filename escaping/staging path handling. Focused Boat regressions and module type-check passed; Claude/Opus independently approved the product diff. The final capped Boat pre-merge merged-tree guard also passed.The canonical proof retry hit the known whole-hub limit: memory.max/peak 3,699,998,720 bytes, swap0, one OOM kill, SIGKILL/-9 after 11.267s, no timeout and no proof verdict. The merge used the expressly authorized scoped-check plus independent-review bar; no full-proof pass is claimed and no proof was changed.
This issue remains open. I traced the manual field through DOM input, view.action/CBOR, shared setting.set, SettingSet/codec persistence, resolver and quoted argv launcher. I did not locate a stage that interprets literal
\bas backspace, and the actual JSON round trip preserves\b,\nand\t. The resolver's mixed separators/missing.exewas reproduced, but it does not establish the reported GUI corruption is resolved. GNU tar's separately reproduced-Cunquoting is an extraction issue, not evidence of Settings-field corruption.Still needed on the affected native Windows app: type
C:\backplane_kicad\, capture the DOM/submitted value and savedkicad.pathbytes, compare the resolved CLI and launch arguments, and verify the runtime folder layout and actual PowerShell installation. No native Windows or full packaged-app run was performed. No deployment, installation or restart occurred. Details and exact proof diagnostics: docs/reviews/kicad-windows-paths-927.md and extra/kicad-927-proof/RESULT.json.Fix Windows KiCad discovery and installer path handling (BackplaneWor…
i2cjak commentedon Nov 4, 2026
Native Windows acceptance is blocked before packaging, not passed. PR #930 is merged but the reported app-typing corruption is still unverified, and #927 must remain open.
I attempted to generate the genuine hub for current main
2a87e6526abfedda9378567642a9675660293b60(treeccd53c6ab6b0cc323b0ebc4349794b054732bc97) in normal/default Boat jobj20261104164046-3848506, using the canonicalsrc/server/main.bendentry. The compiler was killed with SIGKILL/-9 after 11.267 seconds. Kernel evidence: memory.max and memory.peak3,699,998,720bytes, memory.swap.max0, oneoomand oneoom_kill. The explicit 180-second timeout did not fire; sandbox deletion was verified. The diagnostic job returned 0 only because it saved the failure receipt.No usable hub emission or packaged current-main Windows artifact resulted. Web emission, Windows linking and packaging did not run. I did not substitute the published v0.14.1 package, which predates #930. Consequently no real Windows standard-user packaged-app test ran for Program Files/PATH auto-detection, manually entering
C:\backplane_kicad\, real in-app installation, or the reported\bcorruption. Those remain NOT VERIFIED.Pinned receipts and reproduction helper: current-main package blocker, kernel outcome, source/run provenance. The README explicitly preserves and corrects a command-label SHA transcription error; actual attempted source identity comes from the Boat provenance and production-source hashes.
The installer handoff keeps this acceptance gate blocked. This issue should close only after an exact-source package passes the real Windows checks and those verified changes ship. No user-machine test/build, cap increase, xlarge, proof weakening, deployment or release publication occurred.
i2cjak commentedon Nov 4, 2026
Native Windows verification is still pending. Consumer run 41888522683 downloaded the exact authenticated test package, then stopped before application launch at the resource gate: the 8 GiB Windows Job Object cap and no-breakaway membership were enforced, but the hosted Windows 2025 runner had an active
D:\pagefile.sys(2,944 MiB allocated; current and peak usage both 0), conflicting with the requested swap=0 constraint. No KiCad detection, path entry, install, or canonical #946 native check ran. This is a runner-resource blocker, not a reproduced application failure or a native PASS.The supplied application ZIP SHA256 is
de613310949b72b0a70bebf9a07aff021cdea98f894856fabdc42134d678cd22, frozen sourceafa9679273206b3e9b1da4c966c9b63fb6f57ab4, compiler modecomposite-settle-41262875from producer workw-t1792701529-415584-1614985. Its original TEST_ONLY / releaseQualified=false / releaseBuildApproved=false provenance is preserved. The original resource receipt is retained here.#927 remains open. A resource-compliant or explicitly authorized hosted Windows attempt is needed before claiming a native fix; release publication remains on hold.
i2cjak commentedon Nov 4, 2026
Real Windows qualification found one remaining #927 failure; this issue stays open.
On a GitHub Windows runner as a newly created standard local user, the exact packaged 0.14.2 test build was exercised through its real Electron UI and packaged service:
C:\backplane_kicad\andC:\bp927\new tools\test\survived DOM input, RPC-persisted SQLite settings, and a real page reload. The saved health-cache JSON was corrupted: the native Windows→Cygwinenv.exe/sh.exeargv boundary halves paired JSON backslashes, so later parsing interprets\b,\n, and\tas controls (and other paths become invalid JSON). Separate probes reproduced the same boundary with Node and the exact packaged Bun runtime. The field/JSON encoder itself did not unescape the path.23b81e721e0a38ec8c277837badf4507e5518c4f5ddc9f89ec3d83a7a9ae2d43; its bp.6 manifest matched and the native executable successfully printed10.99.0. The remaining final health check failed on that same malformed cache JSON. This is a partial installation/CLI pass, not full Title: Bug: KiCad path auto-detection, installation, and manual path resolution failing on Windows (String escaping issue) #927 acceptance.Package identity: source
afa9679273206b3e9b1da4c966c9b63fb6f57ab4, treeec6c85b4a8b62a0227f09151a9ec52a362b20ae2, ZIP SHA256de613310949b72b0a70bebf9a07aff021cdea98f894856fabdc42134d678cd22, authenticated producer run 41886983230/artifact 13352107148. Tested on explicitly authorized low-memory compiler outputcomposite-settle-41262875, producer workw-t1792701529-415584-1614985; historicalreleaseBuildApproved:falseis preserved. This is not a stock-compiler equivalence or release signoff.Both runs enforced an actual 8 GiB Job Object cap with no breakaway and recorded the user-authorized existing pagefile plus timestamped host-wide paging counters. Peak job memory was 3,629,793,280 B / 1,108,713,472 B respectively; observed pagefile peak was 379 MiB / 0 MiB. No user-machine execution or application build/package/relink was performed here.
A focused follow-up replaces
Rt.save's shell-argument JSON transport with a native atomic UTF-8 file write, with Windows-path and failed-write regression tests. Corrected packaged-build qualification remains outstanding. #927 must remain open until the verified fix ships; publication remains on hold.i2cjak commentedon Nov 4, 2026
Canonical proof status for follow-up PR #951: OOM-killed, NO RESULT, NOT PASSED.
The unchanged
bend PROOF.bendprocess was killed by the kernel cgroup limit after 13.529 seconds (exit_code:-9,exit_reason:cgroup_oom_kill,state:incomplete, memory limit 3,699,998,720 bytes, swap 0). It produced zero output and never printed “All terms check.” The outer Boat job's exit 0 means only that its diagnostic collector finished; it is not a proof pass.Scoped cache/discovery/installer tests and the structural guard passed separately. Independent review of regular PR #951 is in progress. #927 remains open pending corrected-package native acceptance and shipment. Merging #951 does not authorize a candidate rebuild, a 0.14.2 re-cut, or publication; those remain held for the person's decision.
i2cjak commentedon Nov 4, 2026
Nonblocking review follow-ups from PR #951:
Rt.savecurrently discards the native atomic writer's failure result, as it discarded the old shell result. Add bounded diagnostic logging so a failed temporary-directory creation, write or Windows rename can be distinguished from a stale cache during qualification. Do not log secret/user payload contents.Tk.appendinsrc/server/server.bendstill passes JSON through native Windows→Cygwin shell arguments for browser-task logs /.draft.jsonl. Move that payload off argv and add an actual Windows negative control. Include an audit of the analogous Pi/Omp/Agy writers; this PR makes no repository-wide shell-transport safety claim.Both independent reviews found no blockers for the health-cache source fix. The requested small merge-gate test and caller assertion are being added before merging. Corrected-package Windows tests, including Bun rename-over-existing and a negative control for the original argv corruption, remain outstanding. Long/UNC destination paths and held-open Windows readers are not verified.
The canonical proof remains OOM-killed with NO RESULT / NOT PASSED, explicitly separate from scoped test and structural-check passes. After merge this thread owns checking/reporting the next nightly
checkandproofjob results. This does not authorize triggering a candidate rebuild, re-cut or publication. #927 remains open.i2cjak commentedon Nov 4, 2026
The health-file fix remains in regular PR #951, reviewed with no blockers at
40b56de2. Its capped Boat KiCad regressions passed, and after the baseline remediations all preceding small-gate Python/Node checks passed (389/389 Node).The final unchanged stock
bend test/mailtriage_test.bendstep was kernel-confirmed OOM-killed with NO RESULT, so the complete stock small gate is not passed. Diagnosticj20261104210111-1791885records memory limit 3,699,998,720 bytes / swap 0, child exit -9,oom_killdelta 1, 19.594 seconds, zero output. Its outer exit 0 is diagnostic collection only. The canonicalPROOF.bendattempt separately remains OOM-killed, NO RESULT / NOT PASSED.A single explicitly authorized composite-compiler test on the exact tree is owned by compiler lane B; any substitution requires a reviewed disposition and will remain distinctly labeled. No cap increase, proof weakening or automatic gate waiver. Full stock diagnostic details.
#927 remains open pending the fix's merge, corrected source-bound packaged Windows acceptance and actual shipment. Old installation/CLI/#946 partial passes do not qualify the corrected candidate.
i2cjak commentedon Nov 4, 2026
Merge-owner concurrence on final head
40b56de2ee29ad3b3fbed4b46c66ad45a97f8777/ tree9f07ccb5e274187de26148b63f21d733ea9f71ab:I audited Lane B's composite execution receipt for
j20261104210315-1812403. Receipt checksums match. All 3,649 transported tracked files match this Git commit; no source, test or script file was omitted. The eight extra transport files are the compiler/job tools. The unchanged mailtriage test SHA is87395049843cd97bb9d6e70131d81b895b8c236048ae8ecde349bf0364f26941. The output contains exactly the 138 original assertion labels, once each, with no failure or error lines.The actual command compiled and ran the test IO main with composite compiler
41262875(archive SHAbe39bfb8c44da887702c51ef80dea07a6b0366c754f2eb15615e73a1f0d62581), pinned Bun 1.3.10 and frozen flags: rc 0, 150.636 seconds, peak RSS 1,519,348 KiB, cgroup peak 2,662,490,112 bytes under 3,699,998,720 bytes, swap 0, zero memory-max/OOM events. No check-only mode, cache, assertion change or stand-in was used.Root and Bub concur; I accept this as a scoped substitute for the unavailable stock mailtriage execution evidence for this PR's merge only. No repository guard changes or general compiler-equivalence approval follow. The existing
backplane/boat-small-gatefailure remains unchanged. Stock mailtriage was OOM-killed with NO RESULT, and canonical PROOF was OOM-killed with NO RESULT / NOT PASSED. This is neither a stock full-small pass nor a proof pass.The receipt is retained at
/home/h/Documents/i2cjak/bp-coord/mailtriage-receipt-40b56de2/(RECEIPT.md SHAe52ed55a20aa22aa6eabc1ea908740ea123a37281761db3a7cad95f5de5ac40e; raw test log SHA8b2a9af28aafa3448962af2fef661d063bb97b50faee427a48645eb2bb606a36). Root disposition SHA:0c35aae6e424adec09f7bf58aace3afac81fe55fe42268816cda8a1934a63707.Next: fresh exact-head capped Boat premerge guard, then normal merge without admin or branch-protection bypass. #927 stays open pending corrected-package native acceptance and shipment; no build or publication is authorized by this receipt alone.
i2cjak commentedon Nov 4, 2026
#951 merged normally as
044a62d6ee72765b1e49e277d8306fa0b9efe425at 2026-11-04 21:13:33 UTC. The actual merge tree9f07ccb5e274187de26148b63f21d733ea9f71abequals the reviewed/tested head40b56de2ee29ad3b3fbed4b46c66ad45a97f8777.Fresh premerge Boat job
j20261104211217-1884630passed merged LAWS/PROOF structural validation under 512 MiB / swap 0 (peak 40,648,704 bytes, zero OOM). This was a normal merge without admin or branch-protection bypass. The installer/root received the merge/head/tree receipt immediately for the authorized corrected-candidate freeze.The remaining Windows corruption was reproduced in health-cache saving: native Windows→Cygwin argv halved JSON backslashes. The native UTF-8 atomic writer removes that shell/argv round trip. Scoped cache/discovery/installer regressions passed. The actual mailtriage IO test passed 138/138 on the exact tree with the assigned composite compiler under the unchanged 3.7 GB / swap 0 cap, accepted by root/Bub/merge owner only for this merge's missing regression evidence.
The complete stock small gate did not pass: stock mailtriage was OOM-killed with no result. Canonical PROOF was also OOM-killed with NO RESULT / NOT PASSED. Neither status was rewritten; no proof or guard was weakened.
#927 remains OPEN. Corrected-package real Windows standard-user acceptance and shipment are still required; no new-package result or release signoff is claimed. Follow-ups remain
Rt.saveerror reporting and the pre-existingTk.appendJSON-through-shell path. No local tests/builds, duplicate app build, packaging, deployment or restart was performed here. This owner will check the next scheduled nightlycheckandproofresults when their run IDs arrive.i2cjak commentedon Nov 5, 2026
The new packaged Windows run 41958094050 failed overall. It used frozen
be904cd4/ tree1034e9dc, ZIP SHA25632a7685dc41c8647f19340f012e79e8e94fa2e08e338bdf1a756809feb78a563and service SHA256d0cb5b3b2d572a072cd41d639147ca93e9b1c1e981272ee7fce82735c5572bc4.23b81e721e0a38ec8c277837badf4507e5518c4f5ddc9f89ec3d83a7a9ae2d43and printed10.99.0.Install.done→Upgrade.done→UpdateReady→sys_exec, which unconditionally loads POSIX libc and callsexecve. This is a Windows post-install reexec failure; a Unicode-path defect was not established.Small ordinary-main fix: PR #961, replacing that install-success restart request with the existing forced runtime probe. Focused Boat production-IO and old-restart negative-control tests passed in
j20261105030718-2917373under 3.7 GB / swap 0; this is not a full-proof or complete-small-gate pass. Previous canonical proof OOM/no-result remains unchanged.Native evidence artifact
13383134838has digestsha256:bc799287ea320ab19d0816567ab2b595145c58b11a2df94eb7bccdbbacd6effb. Actual acceptance job limit was 8 GiB with verified membership/no-breakaway; peak job memory 1,199,804,416 bytes. Existing pagefile usage ended at 204 MiB, peak 206 MiB, with paging samples retained. The disposable account was removed.0.14.2 is paused. No Windows retry, diagnostic continuation, release rebuild, packaging, publication, transport cleanup or issue closure is underway. Packages, both drafts and raw evidence are preserved. #927 stays open.
i2cjak commentedon Nov 5, 2026
Independent review corrected the scope of PR #961: its changed legacy completion helper has no production caller on main, so I closed it as superseded without merging. The patch branch remains preserved.
The failing
be904cd4package explicitly excluded #932 and used the oldInstall.go→Install.saidcompletion chain. Main includes #932:Install.gonow callsCadJob.start, whose watcher finishes withCadJob.refreshand a forcedKProbewithout restart. The proposed legacy-helper patch therefore would not change main's active installation behavior.The native evidence still establishes a post-install POSIX reexec crash in that selected package, not a Unicode-path defect. Its real download/extraction/CLI success does not qualify main's different CadFx installer. PF/PATH/manual/packaged OMP phases remain unrun in the failed combined gate.
sys_execstill needs a separate audit/Windows failure guard for its other callers.No new test or runtime claim follows from this review. #927 stays open; 0.14.2 remains paused. Packages, both drafts, raw evidence and the unmerged patch are preserved. All owned work has ended and owned Boat capacity is freed.