fix(uninstall): Windows uninstall follow-ups — sweep gate, teardown-last, broker leave-cleanly - #502
Merged
Merged
Conversation
…tion On Windows, std::fs::canonicalize returns the \\?\ extended-length form, which never matches a bare C:\... PATH entry. The live v0.6.18 run showed every binary (including the active uffs) mislabeled 'off-path' and the install dir displayed as \\?\C:\Users\rnio\bin, and it means the PATH-safety gate can't recognize a PATH entry either. Add strip_verbatim_prefix and apply it at the canonicalize sites (detect's upsert_root, the uninstall PATH scan) and to the current-exe dir in search_dirs, so stored dirs match plain PATH entries and display cleanly. No-op off Windows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ing zero strays) The live v0.6.18 run surfaced no strays despite dozens of stray uffs.exe copies on disk. Root cause: the daemon delivers search results in four shapes — inline rows, a memory-mapped rows file, an inline pre-formatted blob, or a memory-mapped blob (chosen by size + output shape). A real multi-hit Windows sweep returns a CSV/path *blob*, but the old code walked the JSON for `"path"` object keys, which only exist in the inline-rows case — so every blob/shmem result was silently dropped. Switch to the typed `search_cli` + `--columns path` (single-column output) and decode all payload variants via the client's shmem/blob helpers (read_search_results / stream_paths_blob_into), parsing the path-per-line blob (header + CSV quotes stripped). Windows-only module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…a cache The live v0.6.18 dry-runs grew a ~4 GB index cache because each 'y' to the coverage offer indexed more drives. That is by design (indexing is non-destructive and the deep sweep needs it), but the prompt gave no hint that saying yes builds an on-disk cache that persists even under --dry-run. Spell it out so the choice is informed. Windows-only module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… not a blind wait A freshly load_drive_letters-requested shard starts parked/cold and only becomes searchable once its body is resident. The previous fixed await_ready(120s) could return while shards were still loading, so the deep sweep searched a not-yet-ready index and found nothing. Poll status_drives until every requested drive reports a loaded tier (hot/warm) or the deadline elapses — so the sweep waits exactly as long as needed and never searches a still-parked shard. Best-effort: RPC errors keep polling to the deadline, then proceed with whatever is loaded. Windows-only module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…unning build The live Windows test ran an OLD uffs.exe: the shell prompt said the fix/uninstall-windows-followups branch was checked out, but the output still showed the pre-fix behaviour (off-path, \\?\ paths) — a stale binary never rebuilt/redeployed. The CLI's --version printed only the crate version, so there was no way to tell which build was running. The daemon already stamps UFFS_GIT_SHA into its startup log to close exactly this 'ran the wrong/stale binary' trap; port the same build.rs stamp to the CLI and surface it: `uffs --version` now prints 'uffs <ver> (<sha>[-dirty])'. Match the sha against `git rev-parse --short HEAD` to confirm the build. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tring noise The live Windows sweep worked but listed non-binaries as removable strays: the daemon search matches `uffs.exe` as a *contains* query, so it also returned prefetch traces (UFFS.EXE-1234.pf), localized resources (uffs.exe.mui), checksums (uffs.exe.sha256), build recipes (uffs.exe.recipe), and NTFS alternate-data-stream entries (uffs.exe:com.dropbox.attrs). Add is_family_artifact: keep a hit only when its file name is exactly a family executable (uffs.exe / uffsd.exe / uffs-broker.exe / uffs-tui*.exe / …) or a cache file (*_compact.uffs / *_usn.cursor); drop anything ending in .pf/.mui/.sha256/.recipe or containing ':' (an ADS entry). Windows-only module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…uffs name) Audit of the `uffs` -> `uffs.com` concern: every actual spawn site already uses a full current-exe-relative path, and Rust's Command appends .exe (never .com) on Windows — which is why the uninstall run completed correctly. The only bare names were the $PATH fallbacks in find_uffs_exe / find_daemon_exe, hit only when current_exe + sibling lookup both fail. Harden those to the platform binary name (uffs.exe / uffsd.exe on Windows) so a bare `uffs` can never be resolved to a legacy uffs.com via PATHEXT (.COM precedes .EXE) if the path is ever handed to a shell, a registry entry, or a logged command rather than spawned directly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ystem check) On a machine that still has the predecessor C++ UFFS installed, the deep sweep listed its uffs.exe copies and — worse — version_strays ran each with --version, launching a GUI window per copy (the slow, 'CPP version keeps popping up' behaviour). The C++ product is a Windows GUI app; our Rust CLI is a console app. Read the PE Optional-Header Subsystem field (headers only, never executing the file): if a uffs.exe is a GUI-subsystem binary, drop it from the strays before probing. Only uffs.exe collides with the predecessor; the other family names are Rust-only and untouched. Windows-only module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…he top Add a 'uffs <ver> (<sha>) — uninstall' header to the dry-run and live output, so any captured run is unambiguously tied to the exact binary (the same stamp `uffs --version` shows). Makes a stale-binary run obvious at a glance. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ogress The live 7-drive load took ~2.5 min but the readiness poll capped at 120 s, so it returned at 6/7 drives and the sweep searched a not-yet-ready index — missing the still-loading drive (D:). Raise the cap to 600 s and print 'indexing for the sweep: N/M drives ready...' as drives come online, so the wait covers a real cold multi-drive index and never looks like a hang. Windows-only module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
#3/#4 from the Windows test. The load RPC blocks until the daemon finishes every drive (loaded sequentially), which overran the client timeout on a 7-drive system — so it returned at 6/7 (missed D:) and no progress ever showed. Fire the load on a background connection and poll status_drives on this thread, printing 'indexing for the sweep: N/M drives ready...' as drives come online — the poll, not the RPC return, decides when the drives are searchable, so a background timeout is harmless and the sweep no longer searches a partial index. Also reword the coverage prompt to be less repetitive. Windows-only module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…lish #1: from a non-elevated terminal the broker (its LocalSystem service + process) cannot be stopped/removed, but the old gate refused the WHOLE uninstall. Mark the broker process as admin-only too, and instead of bailing, offer to skip the admin-only items and remove everything else now (or abort to re-run elevated). Adds RemovalPlan::drop_elevation_required. #2: show 'legacy' instead of '-' for versionless (old) binaries. #5: blank line between the 'found elsewhere' heading and the file list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Indexing every NTFS drive is a non-elevated, non-destructive read that the deep sweep requires, so it should just happen — not be a [y/N] choice. Drop the prompt: ensure_drive_coverage now always loads any not-yet-indexed drives (with the live N/M progress) and no longer takes a confirm callback. This also removes the elevated-vs-non-elevated output divergence: the runs only differed because one had drives already loaded (no prompt) and the other didn't (prompt). Now both just index what's missing. Windows-only module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…the core The live run left ~15 dev/diagnostic binaries in ~/bin untouched (analyze-diff, dump-mft-records, gen-hooks, uffs-bench, uffs-ci-pipeline, …) — a from-source / cargo install build drops them next to the core set. Add them to EXTRA_BINARY_STEMS so the install-dir sweep removes them. Refactor the deep sweep to derive its search patterns + family filter from the shared family set (KNOWN_BINARIES + EXTRA_BINARY_STEMS) instead of a second hardcoded list — so adding a binary in one place now updates both the install-dir removal and the cross-drive sweep. None of these are managed by --update, so KNOWN_BINARIES (the update set) is untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… running binary Three fixes from the live runs: 1. Decisions up front, no post-removal prompts: the broker keep/skip (elevation gate) and the deep-sweep strays opt-in are both decided before the single 'Proceed with removal?' go, then everything executes once into one combined outcome — so the summary + retry hint print once, not per-phase. 2. Platform-correct failure hint: elevation only exists on Windows (the broker is a LocalSystem service); a non-Windows uninstall is all user-land, so it no longer suggests 'sudo' there — a failure is a file in use. 3. The chicken-and-egg self-delete: the OS locks a running image, so deleting uffs.exe / uffs-update.exe in place is the 'access denied' seen in the live run. SystemEffects now skips the running self-binaries (matched verbatim- stripped, case-insensitive) and the existing spawned-cmd schedule_self_delete removes them after exit — the same deferred-delete installers (NSIS/Inno) use. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… handles it) In the elevated run, 'broker (pid 9064)' failed with exit 128: it was a StopProcess item executed via taskkill /F, but the broker is a LocalSystem service — taskkill can't stop it (and even forced, the SCM restarts it). The RemoveService item already stops + deletes it the right way (uffs_winsvc::stop + sc delete). Filter the broker out of the Processes group so it is never taskkill'd. Only the user-owned daemon / MCP remain there (no admin needed); the broker is handled solely by RemoveService. Removes the guaranteed-failure line from the outcome. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… deep sweep A non-elevated run should be told immediately that the broker needs Administrator — not after sitting through a multi-minute drive index + sweep. Move the elevation decision to right after the plan is shown, before platform_stray_plan: - Not elevated + broker installed: flag it and offer to continue (uninstall everything except the broker) or abort to re-run from an elevated terminal. - Elevated: skipped entirely — just remove everything (incl. the broker), and the running binary is self-deleted at the end as before. - Dry-run: only previews (the plan already marks the broker 'needs Administrator'). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… anchor the query The deep sweep's post-query step ran `<bin> --version` sequentially with no timeout, once per family hit. On a dev box (hundreds of `uffs*.exe` under `target/`) that took minutes, and any binary that doesn't cleanly handle `--version` (half-written artifact, something waiting on stdin) hung the whole sweep indefinitely. version_strays: - probe in parallel via a bounded `std::thread::scope` worker pool (cursor-stealing; no new dependency) - `probe_version_bounded`: stdin nulled, piped output, poll `try_wait` to a 2s deadline then `kill` — a hung binary goes unversioned instead of stalling DaemonSearch::find: - anchor each `stem.exe` query with `--name-only --ext exe` instead of a bare full-path substring. Measured 158 -> 46 hits for `uffs.exe`; identical to the exact-regex count, so it's lossless. Drops `.mui`/prefetch/ADS/path-substring noise at the daemon before rows cross the wire. Glob cache patterns untouched. Plus temporary `[sweep]` diagnostics (per-pattern raw/kept counts, phase timings, timeout count) routed through one `dbg_line` helper, to verify the live Windows run. To be removed once signed off. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…, header, plain labels) The old output was two lines per binary (a `stem:` header + an indented row) with cryptic columns: ACTIVE/shadowed/off-path, a raw channel word (`unmanaged`), and a bare `-` scope. Redesign to a single aligned row per copy with a header and a STATUS legend: - ACTIVE -> `runs` (the copy a bare command executes, first on PATH); on-PATH-but-later -> `shadowed`; not-on-PATH -> `off PATH`. - Fold the channel + scope into one SOURCE column: `hand-placed` (was `unmanaged`), `dev build`, `winget (user)`/`winget (machine)` — scope only means something for winget, so the lone `-` is gone. - Columns are width-sized to header+cells; LOCATION is last / free-width. Display-only; resolution logic in resolve_order.rs is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…t a racing hot-load) The old coverage fired its own load_drive_letters for any not-yet-loaded drive, racing the daemon's background startup load over the single-instance Access Broker pipe (ERROR_PIPE_BUSY). That churned the registry (observed 2/6 -> 0/6), intermittently dropped a drive (6/7), and could spin to the wait cap. Replace it with the proven CLI flow, only when needed: - Managed set = every `status_drives` row (any tier — hot/warm/parked/cold; a search re-promotes a parked drive on demand). - If the daemon already covers every system drive: do nothing. - If ANY drive is missing: `uffs --daemon kill`, wait for full shutdown, then a clean `uffs --daemon start` (loads every drive with broker warm-up, returns only once Ready), then poll until coverage is complete. No `restart`, no hot-load, no competing loader thread. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…de gracefully Spawning `uffs --daemon start` as a child of the uninstall intermittently hangs the drive load (daemon stuck at 5/7, zero progress) even though a standalone `uffs --daemon start` loads all drives in seconds. Rather than chase that spawn-context bug, stop bringing the daemon up in-process: - Fully covered already (warm daemon): proceed silently — the common case. - Daemon up but mid-load: wait briefly (60s cap), then proceed with whatever loaded. Never blocks indefinitely. - No daemon reachable: print a one-line notice telling the user to run `uffs --daemon start` and re-run for a complete sweep; continue best-effort. No kill, no start, no restart, no competing loader — the deep sweep now covers whatever the daemon already has and never hangs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…(kill+start in-process)
Previous attempt shelled out to `uffs.exe --daemon start` as a subprocess, which
spawned the daemon as a grandchild and intermittently hung its drive load
(stuck at 5/7). A standalone `uffs --daemon start` loads all drives in seconds.
Reuse the exact handlers the CLI dispatches instead: call
`daemon_mgmt::daemon(&DaemonAction::Kill)` then `daemon(&Start{..})` in-process,
so the daemon is a DIRECT child of this process — identical topology to a shell
`uffs --daemon start`. When coverage is complete, no-op silently; when a drive
is missing, kill, wait for full shutdown, start (blocks until Ready = all drives
loaded), then proceed. Any handler error is best-effort: note it and sweep with
whatever is loaded.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…binaries Only uffs.exe and uffs-update.exe carried Windows PE resources; uffsd, uffsmcp, uffs-broker, and uffs-mft shipped bare. A metadata-less unsigned binary is both unbranded and a mild antivirus ML false-positive signal (all 7 tripped the same generic Defender heuristic on the 0.6.18 release). Add a per-crate build.rs to each (mirroring uffs-cli/uffs-update) that embeds via winresource on MSVC-Windows only: - the UFFS icon (shared assets/brand/icons/uffs.ico) - version info: ProductName, FileDescription, CompanyName, LegalCopyright, OriginalFilename (winresource auto-fills File/ProductVersion from the crate) - a new shared assets/brand/app.manifest (asInvoker, PerMonitorV2, longPathAware) winresource added as a build-dependency of each crate. No-op off Windows; the uffs-mft library target is unaffected. Validated with cargo xwin clippy for x86_64-pc-windows-msvc. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Branding consistency across the whole family: the diagnostic + CI tools shipped bare (no icon/version info). Add a per-crate build.rs embedding the shared UFFS icon + version info + app.manifest via winresource (MSVC-Windows only, no-op elsewhere) to the 6 crates that produce them: - uffs-diag (9 bins: analyze-diff, analyze-mft-parents, compare-raw-mft, compare-scan-parity, cross-check-mft-reference, dump-mft-extents, dump-mft-records, inspect-mft-record-flow, scan-mft-magic) - uffs-bench (uffs-bench) - scripts/ci/gen-hooks, scripts/ci/gen-workflow, scripts/ci/manifest-audit - scripts/ci-pipeline (uffs-ci-pipeline) winresource added as a build-dependency of each. Validated with cargo xwin clippy for x86_64-pc-windows-msvc. Completes the all-binaries icon-branding task. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…t (fixes fresh-load hang) Root cause of the daemon's fresh (no-cache) load hanging at 5/6-of-7 drives: after the main MFT read, each drive re-reads the $UpCase table via read_handle_at -> read_handle_at_once, which issued an overlapped ReadFile on the broker's FILE_FLAG_OVERLAPPED handle with a NULL-hEvent OVERLAPPED and then GetOverlappedResult(bWait=true). With no event, GetOverlappedResult waits on the file object itself; the broker vends duplicate handles to the same volume file object, so under a concurrent multi-drive load it cannot tell which read completed and blocks FOREVER (Microsoft's documented pitfall). Debug logs showed 1-2 drives stall right after "Adopted Access Broker volume handle", never reaching "Parsed $UpCase data runs" — a silent, error-less hang. This affected every fresh `uffs --daemon start`, not just the uninstall. Fix: bind each read to a dedicated manual-reset event and wait on the event (never the shared handle), bounded by IOCP_WAIT_COMPLETION_DEADLINE. On timeout, CancelIoEx + drain, then return a retryable ERROR_OPERATION_ABORTED so the existing read_handle_at retry loop reissues it. The event makes the wait specific to this operation (the documented fix); the bound guarantees the load can never hang forever again — a genuinely wedged read fails fast and the daemon reaches Ready instead of stalling. Validated with cargo xwin clippy (x86_64-pc-windows-msvc). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…y, -v for detail The interactive flow was noisy and the elevation choice confusing: the full binary table, inventory, and plan (broker item included, "(needs Administrator)") printed BEFORE a double-clause elevation question, and answering y echoed "Leaving the broker installed" mid-flow. Restructure to: decide -> gather -> summarize -> confirm. - Elevation is THE FIRST question (right after the header, before any analysis output): list what needs an Administrator terminal and why, then one clear choice — continue without it, or abort to re-run elevated. `--yes` continues without asking. Declined items are dropped from the plan entirely, so the summary never shows work that will not happen. - Default output is compact: a one-line scan summary replaces the resolution table + inventory; the `[sweep]` diagnostics are silent. New `-v/--verbose` restores the full tables and sweep detail (dbg_line now verbose-gated). - The removal plan prints ONCE, at the very end after the deep sweep, as the final "here is what this run will do" — followed by a "NOT removed in this run (needs Administrator)" note for anything skipped at the gate, then the strays opt-in and the single final confirmation. - Dry-run keeps the complete preview (admin markers intact) plus a note that a real non-elevated run asks up front. drop_elevation_required now returns the dropped items' descriptions for the summary note. Validated with cargo xwin clippy (prod + tests) and the uninstall unit tests (52 passed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…al time
The elevation gate previously offered only continue-without or abort. Windows
cannot elevate a running process in place, so add the middle path the user
actually wants: elevate exactly what needs it, exactly when it is needed.
- Gate becomes a 3-way choice on Windows (still the FIRST question):
e = elevate at removal time (one UAC prompt), c = continue without,
a = abort (default). Non-Windows keeps the binary continue/abort. `--yes`
still means continue-without — a scripted run must never pop a surprise UAC.
- Choosing `e` only records the decision: the admin items stay in the plan
(final summary notes "will show one Windows UAC prompt when removal starts"),
and the whole flow continues in the same window. Nothing elevates before the
final confirmation.
- At execution, SystemEffects::remove_service routes through a one-shot
elevated helper: PowerShell `Start-Process -Verb RunAs -Wait -PassThru`
relaunches uffs.exe in the hidden `--uninstall --remove-service-helper
<name>` mode (refuses to run non-elevated; performs the exact same
stop+delete as the elevated in-process path), then verifies the service is
actually gone. Keeps the crate unsafe-free per the module's shell-out design.
- A declined UAC prompt (catch -> exit 223) degrades gracefully: the item is
reported as skipped with the elevated re-run hint, everything else is still
removed, and no mid-execution question is asked (decisions stay up front).
- The helper never touches binaries, so there is no self-delete race with the
waiting parent process.
Validated with cargo clippy (host) + cargo xwin clippy (Windows, prod + tests);
uninstall unit tests pass (38), including the hidden-flag parse test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…y final choice
Three UX upgrades to the interactive flow (decide -> gather -> present -> confirm):
1. No wasted wall-clock: the drive-coverage reload + deep sweep start on a
background thread the instant `--uninstall` fires, overlapping the elevation
question. The daemon handlers gain a quiet mode (daemon_mgmt::daemon_quiet,
RAII-reset static) and coverage defers its narration as notes, so background
work never prints over the prompt. After the gate, a small spinner
("Gathering artifacts (indexing the drives / searching the drives)...")
runs until the gather finishes. `-v` keeps the sequential, live-printing
flow for diagnosis; a panicked gather degrades to "no strays".
2. Nothing is shown until everything is gathered, then the COMPLETE picture
prints at once as two aligned table sections: CORE (the install — binary
resolution table + data/cache inventory) and EXTRA (deep-sweep strays, now
a BINARY / VERSION / LOCATION table matching CORE's shape), followed by the
action plan and the gate notes.
3. The two trailing questions collapse into one 3-way tied to the sections:
a = ALL (CORE + EXTRA), c = CORE only, q/Enter = ABORT.
Without EXTRA files it stays the classic "Proceed with removal? [y/N]".
`--yes` still means ALL. Execution extracted into execute_all (no prompts
past consent).
The quiet-mode plumbing pushed daemon_mgmt.rs past the 800-LOC budget; fixed
at the root by decomposing, not excepting: the read-only status/stats rendering
(daemon_status, print_drive_line, tier_marker, print_not_running, daemon_stats,
compute_hit_rate_percent) moves to the new sibling commands/daemon_status.rs
(254 LOC), leaving daemon_mgmt.rs at 625 LOC with dispatch, the elevation gate,
and the mutating handlers. Display code unchanged byte-for-byte.
Validated with cargo clippy (host) + cargo xwin clippy (Windows, prod + tests);
44 unit tests pass; file-size gate passes with no new exception.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… the [diag] leak
Follow-ups from the live Windows dry-run of the new flow:
- Presentation order: the data/cache/config inventory + broker-service state
now print right after the coverage note, BEFORE the CORE binary table (was
sandwiched between CORE and EXTRA).
- The removal-plan summary now includes the deep-sweep findings instead of
silently omitting them: a "Found elsewhere (EXTRA)" group line ("N UFFS
file(s) outside the standard install locations (listed above; removed only
with ALL)") and a reclaim line that reads "~X across N CORE item(s), plus M
EXTRA file(s) with ALL" — alluding to the ALL/CORE/ABORT question the real
run asks. "Nothing to remove" now only prints when BOTH plans are empty.
- The daemon_start [diag] spawn-chain dump is also silenced in quiet mode: with
UFFS_LOG=debug set it printed from the background reload straight over the
spinner.
- Dry-run keeps its established gate behavior (no elevation question; markers +
the explanatory note), confirmed as the intended design.
Validated with cargo clippy (host) + cargo xwin clippy (Windows); 44 unit
tests pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… prompts Blank line between the elevation gate's intro and its item list, and before the "Choice [e/c/A]:" and "Choice [a/c/Q]:" lines, so the questions stand apart from their option lists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…LOG/Output The first real Windows run surfaced a cluster of execution bugs. All fixed at the root: 1. Teardown-last plan order (the user-prescribed sequence): tool binaries -> PATH -> "Shutdown (stopped last)" (daemon stop + broker service removal) -> data/cache/config (a running daemon holds handles inside them) -> "Runtime binaries (after shutdown)" (uffsd/uffs-broker/uffsmcp/uffs-mcp-http, whose images are locked while running) -> deferred self-delete of uffs.exe + uffs-update.exe. The working tools stay usable for the whole run. 2. One locked file no longer traps a whole directory: delete_binaries is now best-effort across the set (the original run lost 21 deletions to one lingering uffsd.exe), with a 750ms settle-and-retry pass, reporting exactly which files failed. 3. The daemon stop re-discovers the CURRENT daemon via the real `uffs --daemon kill` handler (pid file/socket) instead of the analyzed pid (stale after the deep sweep's coverage reload), then waits for IPC-down + image release before the runtime binaries are deleted. 4. Windows daemon-management elevation gate now mirrors the Unix owner gate: no elevation needed when there is no PID file (nothing to protect) or when the daemon's launch-state sidecar records a NON-elevated launch (the daemon now writes an "elevated" flag into daemon.state.json) — a user-level daemon is the user's to kill even with the broker gone. Falls back to the broker probe otherwise. 5. The deferred self-delete never actually deleted anything: std's Windows arg quoting backslash-escaped the `del "path"` quotes inside the `cmd /c` payload, which cmd.exe does not parse. Passed verbatim via raw_arg now. 6. Formatting: the coverage failure notes put "Continuing the deep sweep..." on its own line, and a blank separator precedes the `[sweep]` block (-v). 7. `uffs-broker --install` narrates its steps (sc create -> ok, sc start with a "can take a minute" note -> ok) instead of a silent minute-long wait. plan.rs crossed the 800-LOC budget with the reorder; fixed by decomposing (the established sibling-tests pattern): its unit tests moved to plan/tests.rs, leaving plan.rs at 513 LOC. Tests updated to the new order contract plus a regression test pinning the runtime-stem split. Validated with cargo clippy (host) + cargo xwin clippy (Windows, prod + tests); 38 uninstall tests pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ul daemon stop
Without the Access Broker a non-elevated daemon cannot read the MFT, so the
deep sweep silently came up empty ("could not start the daemon: Failed to
start daemon" -> 0 candidates). Now the sweep is an explicit up-front decision:
- New sweep gate (asked FIRST, before the gather starts) — only when it
matters: coverage incomplete AND not elevated AND no broker pipe serving.
d = deep sweep — start the daemon now (one UAC prompt)
s = skip the deep sweep (standard locations only)
Choosing d routes the coverage reload through the existing
`--daemon start --elevate` machinery (connect_with_elevation), so the UAC
prompt happens right then and there. `--yes` / `--dry-run` never pop a
surprise UAC: they skip with an explanatory note. Broker-serving, elevated,
or already-covered runs proceed silently as before.
- The daemon stop now tries the graceful shutdown RPC first: it needs no OS
privileges, so it also stops the ELEVATED daemon the sweep may have started
(which taskkill cannot touch), before falling back to the kill handler and
the recorded pid.
SweepDecision is threaded through start/finish_stray_gather and
ensure_drive_coverage(quiet, elevate_daemon); --no-deep-sweep folds into the
same decision. Validated with cargo clippy (host) + cargo xwin clippy
(Windows, prod + tests); 44 tests pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ess-denied)
The no-broker deep sweep can START the index daemon (its UAC start) AFTER the
removal plan was snapshotted with no daemon running. The plan's shutdown group
was therefore built from an empty `report.running` and carried no stop for that
daemon, so at teardown nothing stopped it — its (possibly elevated) image stayed
locked and the runtime-binary delete failed:
FAILED 4 binaries in C:\Users\rnio\bin
(C:\Users\rnio\bin\uffsd.exe: Access is denied. (os error 5))
Windows offers no way to retain/reuse the UAC elevation token in the
non-elevated parent — the prompt elevated a separate child (the daemon), not
us. But we do not need to: the executor already stops the daemon with a graceful
shutdown RPC, which needs no caller privilege and so stops even an elevated
daemon; once it exits, its user-owned binary deletes fine non-elevated. The only
missing piece was a stop item in the plan.
After the gather, re-discover the live daemon (running_daemon_pid) and fold it
into the plan via RemovalPlan::ensure_daemon_shutdown(pid): prepend a daemon
StopProcess to the "Shutdown (stopped last)" group, creating that group in the
correct position (before the data / runtime-binary groups) when it does not yet
exist. No-op when a daemon stop already exists. Group titles are now shared
consts so the find/recreate matches build_plan verbatim.
Two regression tests: injection lands the stop before the runtime binaries;
an existing stop is not duplicated. cargo clippy (host) + cargo xwin clippy
(Windows prod + tests) clean; 126 uffs-cli tests pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… quiet sweep
The deep-sweep coverage reload (kill + start) runs on a background thread under
a spinner, but the freshly-restarted daemon's start-wait went through the thin
client's auto-start connect loop, whose "[uffs] connect attempt N/M (socket:
missing)" retry line prints straight to stderr — a layer below the CLI's QUIET
flag — and bled onto the spinner:
⠼ Gathering artifacts (indexing the drives ...) [uffs] connect attempt 1/20 (socket: missing)
Give uffs-client its own suppression toggle (set_quiet_autostart) gating that
eprintln, and drive it from daemon_quiet alongside the existing CLI QUIET flag
(QuietGuard restores both on drop, so it never sticks past the reload). The
spinner line now stays clean.
cargo clippy (host) + cargo xwin clippy (Windows) clean; 332 tests pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… B") Binary-delete plan items carried bytes: 0, so a run removing only binaries + daemon + runtime (no data/cache dirs present) reported "Reclaims ~0 B across 3 CORE item(s)" while permanently deleting ~22 real binaries. Add RemovalPlan::size_binaries(size_of): the pure plan module stays IO-free and takes a caller-supplied sizer; analyze_and_plan (the IO layer that already pulls dir sizes from the inventory) stats each stem's file (uffsd -> uffsd.exe on Windows, best-effort — an absent file contributes 0) and folds the totals in. WinGet delegations and dir/process items are untouched. exe_file_name is now pub(crate) so the sizer reuses the executor's naming. Regression test: size_binaries fills only DeleteBinaries items and leaves the inventory's dir sizes alone. cargo clippy (host) + cargo xwin clippy (Windows, prod + tests) clean; rustdoc -Dwarnings clean; 127 uffs-cli tests pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
We hit this question live: -Dwarnings + --document-private-items reports 0 warnings, but bolting on -D rustdoc::private_intra_doc_links flips 2 valid internal //! links in uffs-cli/src/main.rs to errors. That looks like a gap and invites someone to "harden" the flag in — but the current posture is the desired one. Pin the rationale in the rustdoc gate's notes so it is not flipped by accident: --document-private-items documents the internals, so a public/crate-root link to a pub(crate) sibling is a valid internal cross-reference, not a downstream leak; private_intra_doc_links guards a *published* crate's public docs against dangling to items a consumer cannot see, which does not apply to our internal doc build. Enabling it would demote valid internal [symbol] links to dead code spans for zero correctness gain. The real failure class (broken / unresolved links) is already caught by broken-intra-doc-links under -Dwarnings. Notes-only manifest edit: gates-drift, hooks-drift, workflow-drift all clean (notes do not feed generated hooks/workflows). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two UX fixes from live Windows runs:
1. The consent surface split binaries into "Binaries" and "Runtime binaries
(after shutdown)" (17 + 4 in the same folder), plus group headers like
"Shutdown (stopped last)" — the internal teardown-ordering detail leaked to
the user, who just wants "21 binaries in <dir>". print_plan now coalesces
every DeleteBinaries item per directory into one line, drops the group
headings, folds EXTRA into the same numbered list, and simplifies the reclaim
footer ("Reclaims ~121.2 MB." / "…, plus N file(s) removed only with ALL.").
The plan's internal group order is unchanged — this is presentation only, so
the teardown still stops the daemon before deleting its locked image.
2. When the no-broker sweep's elevated daemon start was declined at the UAC
prompt, the note read:
"Note: the index daemon was reloaded (kill + start) ..."
" could not start the daemon: Failed to start daemon (with elevation)"
— it claimed success then contradicted itself. The optimistic "reloaded" note
was pushed up front, before the start was even attempted. It is now pushed
ONLY after start succeeds; a failed start emits one coherent note that names
the likely cause ("the UAC prompt was likely declined") and reassures the
sweep continues on the drives already indexed.
cargo clippy (host) + cargo xwin clippy (Windows, prod + tests) clean; rustdoc
-Dwarnings clean; 127 uffs-cli tests pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… honest verify
Three fixes from the broker-installed, non-elevated `e` (elevate-at-removal)
path — the one path never exercised before now.
1. Declining the UAC prompt used to attempt-and-fail the dependent broker work:
Removal finished: 2 removed, 2 failed.
FAILED Stop + delete service UffsAccessBroker (UAC declined ...)
FAILED 4 binaries in C:\Users\rnio\bin (uffs-broker.exe: Access is denied ...)
The second failure is a *consequence* of the first — the still-running broker
locks its own image. Now the declined UAC is a typed signal (ElevationDeclined)
the executor recognises: it records the service as LEFT (not FAILED), stops
attempting the doomed broker binary (deletes the other runtime binaries, leaves
uffs-broker.exe), and prints ONE clear next step. New ItemStatus::Skipped
distinguishes "deliberately left" from "failed to remove".
2. The final line claimed "Verified: all targeted UFFS locations are gone" while
the broker service + binary were still there (they are not among the
stat-checked paths). The upbeat claim is now gated on a clean run (nothing
failed, nothing left); a declined broker no longer reads as success.
3. The self-delete note listed uffs.exe + uffs-update.exe by full path — a
mechanism detail. Collapsed to one line: "The uffs command removes itself once
this process exits."
Also: one blank line between the sweep-decision prompt and the gather spinner
(it butted right up against "Choice [d/S]: d").
New unit test: a declined elevation leaves the broker service + binary as two
LEFT items with zero hard failures, and never attempts the broker image while
still removing the other runtime binaries. cargo clippy (host) + cargo xwin
clippy (Windows, prod + tests) clean; rustdoc -Dwarnings clean; 128 tests pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tinue" path
The prior fix cleaned the `e` (elevate-at-removal) decline, but the `c`
(continue-without-elevation) path still hit the same wall: the elevation gate
drops the broker SERVICE item up front, yet the broker BINARY stayed in the
plan and failed with a raw Access-denied because the left-behind service keeps
uffs-broker.exe locked:
NOT removed in this run (needs Administrator):
- Stop + delete service UffsAccessBroker <- clean, up front
...
Removal finished: 4 removed, 1 failed.
FAILED 4 binaries in C:\Users\rnio\bin (uffs-broker.exe: Access is denied)
Generalise the decline handling into one condition: the broker binary is LEFT
whenever the broker service REMAINS — computed up front (broker installed AND
the plan carries no RemoveService item, i.e. the `c` path dropped it) and also
flipped by an in-plan declined UAC (the `e` path). execute() takes a
`broker_remains` flag seeded from that, so both paths leave uffs-broker.exe
cleanly (recorded LEFT) while still deleting the other runtime binaries.
New test: broker_remains=true up front leaves only the broker binary, makes no
remove_service call, and still removes the non-broker runtime binary. cargo
clippy (host) + cargo xwin clippy (Windows, prod + tests) clean; rustdoc
-Dwarnings clean; 129 tests pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
githubrobbi
enabled auto-merge
July 2, 2026 23:07
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Jul 2, 2026
…e, no fix exists) RUSTSEC-2026-0195 (unbounded namespace-declaration allocation) and RUSTSEC-2026-0194 (quadratic duplicate-attribute check) both landed against quick-xml <0.41 and turned every CI run red, kicking #502 out of the merge queue. Why an ignore and not a fix: there is nothing to bump to. quick-xml is transitive-only (polars-io -> object_store 0.13 -> quick-xml ^0.39); the newest object_store on crates.io (0.14.0) still requires quick-xml ^0.40.1, below the fixed 0.41, and we are already on the latest polars (0.54.4). The vulnerable paths are object_store's cloud-store XML LIST parsing — UFFS reads the local NTFS MFT and local index files only, and never opens a cloud object path, so the NsReader code is unreachable in every UFFS binary. Both entries carry the removal condition in-line: drop them when object_store ships a quick-xml >=0.41 release AND polars adopts it. Validated locally: `cargo deny check advisories` -> ok. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows-first follow-ups to
uffs --uninstall, driven end-to-end by iterative real-Windows runs. Every path below is verified live (broker + no-broker, elevated + not, all consent branches).Highlights
Deep-sweep coverage & elevation
d= start the daemon now (one UAC prompt) /s= skip.--yes/--dry-runnever pop a surprise UAC.-vruns sequentially with live[sweep]diagnostics.uffsd.exeAccess-denied.Broker (LocalSystem service) — the untested path, now correct
eelevate-at-removal via UAC helper /ccontinue-without / abort).e) or dropped up front (c) — so no rawAccess is deniedonuffs-broker.exe. NewItemStatus::Skippeddistinguishes "deliberately left" from "failed".Teardown & self-delete
uffs.exe/uffs-update.exe(raw_arg fix); collapsed to one quiet line.Presentation
N binaries in <dir>line (no tools/runtime split, no internal group headers), reclaim total now counts the binaries, EXTRA folded in.Also in this branch
fix(mft): bound the overlapped$UpCase/FRS read with a dedicated event — fixes the fresh-load 5/7-drive hang.build(windows): embed the UFFS icon + version-info + manifest into all 22 binaries.docs(ci): record why the rustdoc gate intentionally omitsprivate_intra_doc_links.Validation
cargo clippy(host) +cargo xwin clippy(Windows, prod + tests) clean;rustdoc -Dwarningsclean; 129uffs-clitests pass. Live-run matrix (broker/no-broker × elevated/not × ALL/CORE/ABORT ×d/s/e/c, dry-run,-v, resumed, self-delete) signed off.