Fix Windows ARM64 installer payload corruption and modernize build

.github/workflows/ci.yml

@@ -12,6 +12,9 @@ concurrency:
 jobs:
   test:
     strategy:
+      # One platform's failure must not cancel the other's: the Windows leg is where the
+      # installer payload check runs, and it is worth seeing even when macOS is red.
+      fail-fast: false
       matrix:
         os: [xcode-27, windows-latest]
     runs-on: ${{ matrix.os }}
@@ -22,11 +25,61 @@ jobs:
           version: 11.19.0
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm typecheck
       - run: pnpm test
+      # Tests spawn real Electron binaries, and a process killed by a signal reports no
+      # message of its own. macOS writes the reason to a crash report instead, so decode it
+      # here rather than leaving a future failure as the bare word "SIGABRT".
+      - name: Report macOS crash logs
+        if: failure() && runner.os == 'macOS'
+        run: |
+          sleep 10
+          python3 - <<'PY'
+          import glob, json, os
+          paths = glob.glob(os.path.expanduser('~/Library/Logs/DiagnosticReports/*.ips'))
+          paths += glob.glob('/Library/Logs/DiagnosticReports/*.ips')
+          paths.sort(key=os.path.getmtime)
+          if not paths:
+              print('no crash reports found')
+          for path in paths[-3:]:
+              print('=' * 70)
+              print(path)
+              head, _, rest = open(path, errors='replace').read().partition('\n')
+              try:
+                  meta, body = json.loads(head), json.loads(rest)
+              except ValueError:
+                  print(head)
+                  print(rest[:4000])
+                  continue
+              print('process   ', meta.get('app_name'), meta.get('app_version'), meta.get('bug_type'))
+              print('exception ', body.get('exception'))
+              print('termination', body.get('termination'))
+              images = body.get('usedImages', [])
+              faulting = body.get('faultingThread')
+              for index, thread in enumerate(body.get('threads', [])):
+                  if faulting is not None and index != faulting:
+                      continue
+                  print('faulting thread', index, thread.get('name') or thread.get('queue') or '')
+                  for frame in thread.get('frames', [])[:30]:
+                      where = frame.get('imageIndex', -1)
+                      image = images[where] if 0 <= where < len(images) else {}
+                      print('   ', image.get('name', '?'), hex(frame.get('imageOffset', 0)), frame.get('symbol', ''))
+          PY
       - run: pnpm build
       - name: Package (without publishing)
-        run: pnpm exec electron-builder --dir
+        if: runner.os != 'Windows'
+        run: node scripts/electron-builder.cjs --dir
+      # Build the real installers on Windows rather than just the unpacked app: an app payload
+      # the NSIS extractor cannot unpack is invisible until an installer exists to inspect,
+      # which is what scripts/verify-windows-installer.cjs checks. arm64 is packaged here on an
+      # x64 runner on purpose — the payload is inspected, never executed, so no ARM runner is
+      # needed to catch a filter the installer could not decode.
+      - name: Package Windows x64 installer (without publishing)
+        if: runner.os == 'Windows'
+        run: node scripts/electron-builder.cjs --win nsis --x64 --publish never
+      - name: Package Windows arm64 installer (without publishing)
+        if: runner.os == 'Windows'
+        run: node scripts/electron-builder.cjs --win nsis --arm64 --publish never

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
           version: 11.19.0
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Verify tag
@@ -40,10 +40,10 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm test
       - run: pnpm build
-      # Native modules are rebuilt in-place. Building both architectures in one
-      # workspace can mutate a hard-linked module after the first app was signed.
+      # Each arch is signed in its own workspace, so one build can never touch an
+      # app another job already signed.
       - name: Package macOS (${{ matrix.electron_arch }})
-        run: pnpm exec electron-builder --mac dmg --${{ matrix.electron_arch }} --publish never
+        run: node scripts/electron-builder.cjs --mac dmg --${{ matrix.electron_arch }} --publish never
       - name: Verify packaged macOS app
         shell: bash
         env:
@@ -87,7 +87,7 @@ jobs:
           version: 11.19.0
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Verify tag
@@ -96,7 +96,7 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm test
       - run: pnpm build
-      - run: pnpm exec electron-builder --win nsis --x64 --publish never
+      - run: node scripts/electron-builder.cjs --win nsis --x64 --publish never
       - uses: actions/upload-artifact@v4
         with:
           name: windows-x64

CONTRIBUTING.md

@@ -10,7 +10,7 @@ Thanks for helping improve Clean My Codex. Bug reports, focused fixes and well-s
 
 ## Development
 
-The project requires Node.js 22 and pnpm 11.19.
+The project requires Node.js 24 and pnpm 11.19.
 
 ```bash
 pnpm install

README.md

@@ -152,7 +152,7 @@ Cleanup is written to a log — cache and leftover removals record the path and
 
 ## Development
 
-Requires Node.js 22 and pnpm 11.19.
+Requires Node.js 24 and pnpm 11.19. Built on Electron 43, which runs on macOS 12+ and Windows 10+.
 
 ```bash
 pnpm install
@@ -170,6 +170,7 @@ Packaging:
 ```bash
 pnpm build:mac
 pnpm build:win
+pnpm build:win-arm64
 ```
 
 ## Contributing and support

README_CN.md

@@ -152,7 +152,7 @@ Clean My Codex 跟随当前 Codex Desktop 的存储布局，建议同时使用
 
 ## 开发
 
-需要 Node.js 22 和 pnpm 11.19。
+需要 Node.js 24 和 pnpm 11.19。基于 Electron 43，运行环境为 macOS 12+ 与 Windows 10+。
 
 ```bash
 pnpm install
@@ -170,6 +170,7 @@ pnpm check
 ```bash
 pnpm build:mac
 pnpm build:win
+pnpm build:win-arm64
 ```
 
 ## 贡献与支持

RELEASE_NOTES.md

@@ -1,30 +1,28 @@
-# Clean My Codex 0.1.6
-
-## New
-
-- **Plan output is now tracked as a session asset.** Codex's plan mode writes revisions under `~/.codex/plans/<thread-id>/`; each conversation's revisions collapse into one row named by the H1 of its newest revision, tagged `Plan`, and removed with the conversation that owned it.
-- **Workspace cleanup can delete related conversations.** A workspace folder deletion now offers the same "also delete related conversations and their session assets" option that worktrees already had, so removing `~/Documents/Codex/xxx` can take the conversations that ran there with it. The rule is unchanged — session assets follow their session; the workspace does not.
-- **Windows is now supported end-to-end, not just packaged.** Releases publish a Windows NSIS installer (`.exe`) alongside the macOS `.dmg`, and the app now works there:
-  - **Desktop detection** recognizes the Codex/ChatGPT desktop app on Windows — the MSIX install under `Program Files\WindowsApps\OpenAI.Codex_<version>_\`, the legacy `Program Files\Codex` and `AppData\Local\Programs\Codex` layouts, including Electron helper processes — and excludes the crashpad handler the way macOS does. Because the Windows desktop app is tray-resident (the window × button does not quit it), the blocker now points to **File → Exit**; the auto-quit checkbox, which relies on macOS AppleScript, stays hidden off-darwin.
-  - **CLI location** finds `codex` inside the desktop app's versioned/hash install directories (newest copy first when an upgrade left several), then falls back to `where.exe` and `PATH`, with case-insensitive environment lookup. A failed lookup is no longer cached for the session — install or upgrade Codex while Clean My Codex is open and the next operation finds it.
-  - **Scheduled cleanup** on Windows moved off locale-dependent `schtasks /Query` output to PowerShell `Get-ScheduledTaskInfo`, which emits one invariant ISO timestamp for the next run. The repair pass that re-aligns an out-of-date launch agent on macOS now also reinstalls a Windows task whose executable, arguments, daily interval, or missed-run/battery settings no longer match this build.
-  - **Update checks** run on Windows too (previously macOS-only), with a Windows-specific prompt to download and run the x64 installer. The Software Update row is now shown on every platform.
-  - **Path identity** is handled through a shared layer that normalizes extended-length (`\\?\`) and UNC paths, resolves filesystem aliases through the nearest existing ancestor, and compares Windows paths case-insensitively — and is recognized on every host so the Windows behavior is regression-tested on macOS.
-- **Crash and exception logging.** Every IPC handler is wrapped to record failures before Electron serializes them, the main process observes fatal exceptions, and the renderer forwards uncaught errors, unhandled rejections, and React recoverable/uncaught errors to the main process. Worker errors now carry their stack. All of it lands in the existing `cleanup.log` alongside the normal operation record, so a submitted diagnostic log can explain both a wrong result and a failure that happened before one.
-- **Linux builds have been retired.** The AppImage target, bundled icon, `build:linux` script, and XDG fallback paths are gone; the location layer now refuses unsupported platforms explicitly rather than silently guessing.
-
-## Improvements
-
-- **Resource detail views are unified.** Sessions, Session Assets, Plugins, Workspace, and Worktrees now share one set of list controls:
-  - **Sortable columns** — click a header to sort by it, click again to flip direction; an arrow shows the active direction and a faint double-chevron marks every sortable column. The old sort dropdowns are gone.
-  - **Per-column funnel filters** replace the type/status `<select>` dropdowns. Each funnel opens a small popover with a count beside every option and fills in while a non-default filter is applied.
-  - **Shared selection** that retains valid choices across a rescan, keeps hidden choices across a filter, and bulk-toggles only the visible rows — so toggling a filter no longer silently drops what you had selected. A native indeterminate "select all" checkbox and a single bottom action bar (selection summary + delete button, with the unsafe-git warning inline) replace each page's hand-rolled footer.
-- **Plugins page splits origin from version status.** The single status filter is now two funnels: **Source** (Official / Personal, derived from the scanner's `builtin` signal) and **Version status** (current / outdated / orphaned / unconfirmed). Official plugins show an "Official" pill alongside a "current" version pill, and the summary card breaks the total into Official and Personal.
-- **Cleanup confirmation reflects the choice you actually made.** Implementation-level child operations — the related-conversation deletion that follows a worktree or workspace removal — collapse into their container row in the result list and item count, with a failed or skipped child winning over a successful parent so a related operation that needs attention is never hidden behind a success. A cleanup failure now surfaces inside the dialog instead of duplicating in the main pane.
-- **One deletion warning instead of two.** The worktree and workspace git reminders merged into a single permanent-deletion-with-git notice, and the session-asset local-copy warning is now part of one permanent-deletion line, so the confirmation reads as one warning rather than competing lines.
-- **Closing the main window on macOS hides it.** The renderer and its completed scan stay alive so a Dock click shows the same window instead of mounting a fresh renderer and scanning again; `before-quit` still lets Quit close it normally, and `activate` restores an existing window instead of creating a second one.
-- **Overview sessions row** now shows the per-session rollout total separately from the shared `thread_history_*.sqlite` projection, which gets its own protected row, so the two are no longer conflated in the chart or the total.
-- **Plan-only-copy warning.** Deleting a Plan whose source conversation is already gone now warns that it may be the only surviving copy of that plan.
-- **Scan animation redrawn** with orbiting rings and a tracer dot in place of the old scan-ring/beam, and the redundant "Initial storage analysis" kicker was dropped.
-- **Release pipeline** splits macOS arm64 and x64 into separate build jobs (building both in one workspace could mutate a hard-linked native module after the first app was signed) that verify codesign and the Mach-O arch of the app and every bundled `.node`, then a single release job collects the macOS and Windows artifacts and publishes them.
-- Tightened cleanup dialog copy and button labels; worktree modification times are rounded for stable display.
+# Clean My Codex 0.1.7
+
+A maintenance release. Nothing about how the app behaves has changed — no file under the main process, the renderer or the shared layer was touched — but the platform underneath it moved forward by ten Electron majors, and that raises the macOS version required to run it.
+
+## Before you update
+
+- **macOS 12 (Monterey) or later is now required.** 0.1.6 ran on macOS 11; Electron 43 does not. If you are on Big Sur, stay on 0.1.6.
+- **Windows 10 or later**, unchanged.
+- The Windows installer published here is x64, as before, and it is compressed exactly the way 0.1.6's was.
+
+## Under the hood
+
+- **Electron 33 → 43** (Chromium 150, Node 24.18.1), **better-sqlite3 11 → 13**, Node 24 for development and CI, and the build toolchain moved to Vite 7 with electron-vite 5.
+- **The native module no longer gets compiled at all.** better-sqlite3 13 is a Node-API addon that ships prebuilt binaries for every platform it supports, so the whole cross-rebuild apparatus is gone: no rebuild on install, no `electron-builder install-app-deps`, and no hand-written script for cross-building the Windows binary from macOS. Each artifact now carries only the one prebuilt binary it can actually load. This retires the failure mode where a macOS-built `.node` could end up inside the Windows installer.
+- **Compile targets are now written down.** electron-vite derives its target from a table of Electron versions that does not include 43, and its fallback quietly picks the *oldest* entry in that table — the app would have been compiled for a decade-old target without a word of warning. The config now names node24 and chrome150 outright.
+
+## Windows on ARM
+
+**A Windows arm64 installer built from this source now installs completely.** Releases still publish the x64 installer only, so this matters if you build your own with `pnpm build:win-arm64`.
+
+electron-builder 26 compresses the app payload with a 2024 build of 7-Zip, which inspects every executable and chooses a compression filter for it — for ARM64 binaries that is the ARM64 filter, added in 7-Zip 23.01. The NSIS installer still unpacks that payload with a plugin built in 2019, which has never heard of it. The result was an installer that ran to completion, reported success, and wrote everything except the nine files it could not decode: the application executable and its eight DLLs. x64 was never affected — it gets the BCJ2 filter, which that plugin does understand and which 0.1.6's installer already used.
+
+The build now pins the filter to one the installer can read, for Windows arm64 only; x64 and macOS are untouched. And because "the installer succeeds and silently omits the program" is not something a failed build would ever have reported, every Windows installer is now re-tested as it is built, using a 7-Zip decoder older than the one inside the installer: a payload that cannot be unpacked fails the build instead of reaching a release page. CI builds and checks both architectures on every push.
+
+## Tests
+
+- **A fresh clone no longer races the Electron download.** Electron 43 dropped its install script, so the binary is fetched on first use rather than at install time. Test files run in parallel, and several would start that download at once while another was already launching the half-written binary. The suite now fetches Electron once, before the first test file.
+- A test process killed by a signal now reports what the child actually printed instead of only the signal name, and CI decodes macOS crash reports when a job fails.

electron-builder.yml

@@ -9,9 +9,14 @@ files:
   - "!**/node_modules/*/{CHANGELOG.md,README.md,readme.md,readme}"
 asar: true
 afterPack: ./scripts/adhoc-sign.cjs
+# Catches an installer whose payload the NSIS extractor cannot unpack — the failure that
+# otherwise only shows up as a successfully installed app with no exe. See the script.
+afterAllArtifactBuild: ./scripts/verify-windows-installer.cjs
 asarUnpack:
   - "**/*.node"
-npmRebuild: true
+# better-sqlite3 is a Node-API addon that ships prebuilt binaries for every platform it supports,
+# so there is nothing to rebuild against Electron's headers.
+npmRebuild: false
 mac:
   category: public.app-category.utilities
   target:
@@ -21,11 +26,19 @@ mac:
   gatekeeperAssess: false
   artifactName: ${productName}-${version}-${arch}.${ext}
   icon: Support/AppIcon.icns
+  # Ship only the prebuilt binary this artifact can load; the other seven are dead weight
+  # (~17MB) and would break the Mach-O arch check in the release workflow. It has to be a
+  # single exclusion: for files under node_modules electron-builder honours "!" patterns
+  # only, so anything excluded can never be added back by a later positive pattern.
+  files:
+    - "!**/node_modules/better-sqlite3/prebuilds/!(darwin-${arch}).node"
 win:
   icon: Assets/AppIcon.ico
   target:
     - nsis
   artifactName: ${productName}-${version}-${arch}.${ext}
+  files:
+    - "!**/node_modules/better-sqlite3/prebuilds/!(win32-${arch}).node"
 nsis:
   oneClick: false
   perMachine: false

electron.vite.config.ts

@@ -6,6 +6,10 @@ export default defineConfig({
   main: {
     plugins: [externalizeDepsPlugin()],
     build: {
+      // electron-vite infers this from a lookup table that stops at Electron 39, and its
+      // fallback picks the *oldest* entry rather than the newest, so an unlisted Electron
+      // silently compiles down to a decade-old target. Electron 43 is Node 24.18 + Chromium 150.
+      target: 'node24',
       rollupOptions: {
         input: {
           index: resolve(__dirname, 'electron/main/index.ts'),
@@ -17,6 +21,7 @@ export default defineConfig({
   preload: {
     plugins: [externalizeDepsPlugin()],
     build: {
+      target: 'node24',
       rollupOptions: {
         input: { index: resolve(__dirname, 'electron/preload/index.ts') }
       }
@@ -25,6 +30,7 @@ export default defineConfig({
   renderer: {
     root: 'src',
     build: {
+      target: 'chrome150',
       rollupOptions: {
         input: { index: resolve(__dirname, 'src/index.html') }
       }