Windows: Electron Node mode, loader packaging gate, and upstream sidebar collapse

[yaojin3616]

Summary

This is stage 1 of the roadmap in #589.

• Bring Run Windows Harness without standalone node.exe #583 into main. Run Windows Harness without standalone node.exe #583 was merged into v0.10.0 only. Its four commits are cherry-picked here without changes (git cherry-pick -x, no conflicts):
  • Windows Harness, Profile repair and the .desktop-bin node.cmd / pnpm.cmd shims run through the packaged DSH Desktop.exe with ELECTRON_RUN_AS_NODE=1.
  • The standalone node.exe is excluded from Windows packages.
  • The PPT verifier and the Windows koffi/pnpm smoke run in Electron Node mode.
• New packaging gate. Harness 0.1.7 reaches Node internals through node-addon-require-builtin. Its native binary accepts only the exact Electron fingerprints it was built for; for 0.1.6 these are 43.0.0, 44.0.0 and 45.0.0-alpha.6. An unsupported Electron used to pass every packaging step and fail only at Harness boot (Electron 43.4.0, CI run 35972303467). scripts/verify-target.mjs already runs before every mac and Windows package build, locally and in CI. It now also loads the same five internal modules Harness uses, under the packaging Electron in Node mode, and stops the build with the loader's own error.
• Caption menu in the upstream seat. The top-right WebContentsView dropdown is replaced by an in-page "应用" / "编辑" menubar beside the sidebar toggle (following --dsh-windows-menu-start when the sidebar collapses), opening native popup menus from main like the upstream Desktop. "应用" carries every former dropdown command (phone pairing, Harness restart, Safe Mode, log, session export, a View submenu with reload/devtools/zoom/full screen, updates, about, exit); "编辑" sends key events as upstream does. Harness pages drag through AppFrame's caption strip; Desktop's local pages keep their own strip; an open dialog releases both. The menu view, its preload, HTML and IPC channels are removed.
• Patch hunks dropped. Only-for-the-old-caption hunks are gone: the conversation header marker, and the sidebar's non-macOS padding and brand spacing. The sidebar patch now only adds the markers the mobile button and Safe Mode styling use.
• Harness boot probe in Windows CI. scripts/probe-electron-node-runtime.mjs, taken from the RunAsNode assessment worktree, starts Harness from the repository through Electron Node mode with a disposable DSH_HOME, exchanges the launch token and requires an authenticated HTTP 200. The loader gate only proves the resolver loads; this proves Harness boots. The Windows CI job runs it after typecheck.
• Docs. docs/architecture.md and docs/development.md describe the Windows runtime and the new gate.
• Windows sidebar collapse on the upstream titlebar contract. Cherry-picked from codex/windows-sidebar-collapse (4f023e87bc). Preload marks <html data-windows-titlebar> and sets --dsh-windows-titlebar-height before the first layout frame. Harness 0.1.7-rc.2 (dsh-client-ui-layout, dsh-client-ui-sidebar, dsh-client-ui-sidebar-right) reads that marker to reserve the caption row, so the sidebar collapses to zero width like upstream. The Desktop CSS that offset the right panel and conversation header is removed; the only override left keeps the drag area clear of the native caption buttons and the application menu view. Covered by the new test/windows-sidebar-collapse.test.ts. A follow-up commit aligns two remaining overrides with upstream: the caption row is now 40 DIP (was 36px; upstream windows-layout.ts uses 40 and Harness sizes the frame, toggle and right panels from it), and the expanded sidebar no longer gets the sidebar patch's non-macOS top padding once the Windows marker is set (test/windows-sidebar-padding.test.ts fails on the old 6px and passes with 0).

Why

The standalone node.exe running scripts under the user profile was one source of the antivirus flags, and it was a second Node runtime to ship and sign. Pinning Electron is now required for Harness to boot, so the pin should be enforced at build time, not discovered by users.

Validation

• npm ci with full postinstall patch replay.
• npm run typecheck, npm run build, npm test (157 files / 1,281 tests, including the caption menu template and menubar tests); clean npm ci replays the regenerated patches and git diff --check all pass.
• node scripts/probe-electron-node-runtime.mjs passes on macOS arm64 (HTTP 200); test/release.test.ts passes with the new workflow step.
• node scripts/verify-target.mjs darwin arm64 passes with the locked Electron 43.0.0 (Node 24.17.0).
• Negative check: running the probe with a real Electron 43.4.0 binary against the locked loader 0.1.6 fails with the same unsupported Electron runtime fingerprint … (supported Electron versions: 43.0.0, 44.0.0, 45.0.0-alpha.6) message CI hit at Harness boot.
• New test/electron-node-loader.test.ts covers four cases: the real pinned Electron passes, each of the five internal modules is requested from the loader Harness resolves, a loader rejection fails the probe, and an executable that cannot start fails the probe.
• The Run Windows Harness without standalone node.exe #583 commits were validated on v0.10.0 by Windows dev package smoke and signed installer + upgrade smoke.

Not yet verified

• Windows packaging of this branch on main. The PR's own Windows CI job will run the dev package smoke; the signed-installer smoke needs a signed dispatch.
• The Windows run of the new gate. The gate itself is platform-independent code, and so far it has only run on macOS.
• Real user Profiles with third-party plugins on Windows, and machines with Defender or enterprise antivirus.
• Windows visual check of the sidebar collapse, caption and new menubar (DPI, zoom, maximize, collapsed sidebar, caption buttons, popup placement, edit commands in the composer, local recovery page). The logic is covered by tests, but it has not been checked on a real Windows window.

Follow-ups (not in this PR)

• Check how far ELECTRON_RUN_AS_NODE propagates to Harness children such as Agent terminal commands. build/harness-node-entry.mjs sets it for all children on both platforms.
• Drop the bundled Node on macOS by switching the .desktop-bin shims to Electron Node mode.

🤖 Generated with Claude Code