Repository navigation
feat: set up a managed ZCode runtime and Node.js from the settings screen - #39
Merged
Merged
Conversation
Resynchronize the vendored RPC and V4 contracts from the public v3.14.3 tag (29628c9). The upstream changes are additive: an optional workflowRunDeltas capability gates the new workflowRun.* deltas, which the provider does not request, so it keeps receiving state.updated. Point CI, the source manifest and the documentation at the new baseline and the 3.14.3 integrated CLI archive.
The reviewed changelog release now matches the pinned public source tag. 3.14.4 is listed in the changelog but has no public source yet, so it remains a separate follow-up.
Record the build inputs, artifact hashes and results of the stdio runtime contract (passing) and the unsupported settings-free restore check (still failing upstream) on macOS arm64.
ADR 15 replaces the user-installed runtime premise of ADR 13 with a settings-screen setup that downloads a pinned integrated CLI archive from this repository's releases and official Node.js builds. It amends ADR 8 to allow setup actions and supersedes ADR 10's diagnostics-only screen.
Release tooling now reads pins from server/discovery/manifest.ts through one helper, so the runtime packaging script can reuse it.
Use the system temporary directory on Windows, keep the system variables Windows processes require and isolate the profile directories. POSIX keeps /tmp so Unix socket paths stay short.
Build the integrated CLI from the pinned unmodified source, add the upstream LICENSE, NOTICE.md, THIRD-PARTY-NOTICES.md and build provenance, and run the stdio runtime contract on darwin-arm64, linux-x64, linux-arm64, win-x64 and win-arm64. A zcode-runtime-v<version> tag publishes the verified archive with a build provenance attestation.
Pin Node.js 24.21.0 archives from nodejs.org (checksums from the signed SHASUMS256.txt) and the published zcode-runtime-v3.14.3 archive. The installer downloads into a staging directory, enforces the pinned size and SHA-256, extracts with the system tar, checks Node's version and the runtime layout, and renames the result into place behind a marker. A lock owned by a live process blocks concurrent setup; a stale lock is reclaimed. Older versions are removed after a successful setup.
Without PASEO_ZCODE_RUNTIME and PASEO_ZCODE_NODE, discovery uses the installed managed runtime or fails with RUNTIME_SETUP_REQUIRED pointing to the Setup screen. Setting only one variable is a configuration error. Diagnostics report which source is in use.
The screen lists each pinned download with its source, SHA-256, size and license, starts setup on request, shows progress and removal, and offers a quoted login command for the official CLI once both components are installed. The RPCs take no URLs, paths or versions from clients.
Install the pinned runtime with the plugin's installer and run the stdio runtime contract on darwin-arm64, linux-x64, linux-arm64, win-x64 and win-arm64, with the plugin on Node 22 like a real daemon. The real-model E2E job uses the managed runtime as well.
Describe the Setup screen, environment overrides, runtime releases and their licensing, local verification with XDG_DATA_HOME and the remaining checks.
Long explanatory values squeezed the label column. Split the overview into short rows and show the login command as a full-width monospace block. Found while checking the screen in a real Paseo daemon.
Paseo's client runtime returns a cleanup for every settings screen registration. The stub now does the same and checks that both the Setup and Diagnostics screens are registered and removed.
Record the published runtime archive, its attestation and Node.js checksum verification, the five-platform CI results, the local install and the real UI and model checks, plus what remains unverified.
Windows now installs under the non-roaming %LOCALAPPDATA% instead of creating .local in the user profile; macOS and Linux keep ~/.local/share. An absolute XDG_DATA_HOME still overrides the base on every OS for isolation, and relative values are ignored as the XDG specification requires. ADR 15 and the README describe the locations.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
ZCode does not publish its integrated CLI, so users had to build the upstream monorepo and install Node.js 24 themselves before this provider worked. Official artifacts are not enough: the Desktop packages contain the Agent (
glm/zcode.cjs) but not the stdio Services Server (zcode-server.cjs), and the CDN remote-component manifests list a server bundle whose archives return 404.Resulting behavior (ADR 15)
SHASUMS256.txt).zcode-runtime-v3.14.3release: an unofficial, attested build of the unmodified public source with the upstream LICENSE, NOTICE.md, THIRD-PARTY-NOTICES.md and BUILD-INFO.json added.tar, verified and renamed into$XDG_DATA_HOME/paseo-plugin-zcode-provider/runtimes(default~/.local/share/...).PATHis untouched; setup RPCs accept no URLs, paths or versions from clients. A lock prevents concurrent setup; stale versions are removed.zcode.mjs logincommand; Remove deletes the managed runtime.PASEO_ZCODE_RUNTIMEandPASEO_ZCODE_NODEare set (one alone is an error). Without either, sessions fail withRUNTIME_SETUP_REQUIREDpointing to the Setup screen. Diagnostics show which source is in use.v3.14.3tag (29628c9); vendored RPC/V4 changes are additive. Closes Support ZCode 3.14.1 #23, closes Support ZCode 3.14.3 #25. 3.14.4 has no public source yet (Support ZCode 3.14.4 #32 stays open).CI and release
zcode-runtime-release.ymlbuilds the official distribution from the pinned source, packages it, runstest:stdio-runtimeon all five platforms and, forzcode-runtime-v<version>tags, attests and publishes a non-latest release.check-stdio-runtime.mjsruns on Windows (isolated profile variables, system temp dir).Verification
test:stdio-runtimewithsource: "managed".test:native-restorestill fails upstream on 3.14.3 (yolo / falseinstead ofedit / true), outside the supported contract (ADR 14).Screenshots
Isolated Paseo 0.9.0-beta.2 daemon, headless Chrome. Paths point at the temporary data directory used for the check.
Compact width (420 px):
Not verified
Real account login through the displayed command, Paseo daemons running on Windows or Linux arm64 driving setup from the UI, proxy-only networks, Desktop and mobile clients.