Launcher (#4)

* 激进的更新

* 试试

* fix.可爱的我一直在修CI（

* fix.启动器一定要能够启动

* feat.尝试弄了AOT的启动器。

* fix.修CI，好像是因为Linux那边有个问题，反正修就对了。

* fix.ci难修，为什么liunx跑不起来呢？

* Update build.yml

* Update LanMountainDesktop.csproj

* changed.调整了启动逻辑，优化了更新页面。

* changed.优化了更新体验

* feat.依旧试增量更新这一块，看看velopack

* fix.我们试验性地修复了启动器无法正常启动的问题，原因可能是这个画面没有启动，就GUI没显示。然后还把编译问题修了一下。

* fix.继续修ci，ci怎么天天炸

* changed.velopack，试试rust

* fix.修ci，修融合桌面，修启动器

* fix.GitHub Action工作流怎么天天出问题

* feat.引入velopack，不好，是rust（至少内存很安全了。

* chore: migrate release pipeline to signed filemap and wire rainyun s3

* fix: make optional s3 upload step workflow-parse safe

* fix: make delta pack generation robust for empty diffs and linux paths

* chore: rotate launcher update public key for pdc signing

* fix: restore stable launcher update public key

* fix: sync launcher public key with update signing secret

* fix: normalize PEM line endings in signing key validation

* fix: rotate launcher public key to match ci signing secret

* fix: compare signing keys by SPKI instead of PEM text

* refactor update backend to host-managed PDC pipeline

* fix release workflow env key collisions

* relax publish-pdc precheck to require S3 only

* set GH_TOKEN for PDCC installer step

* ci: add local pdc mock fallback for release publish

* ci: fix pdc mock process log redirection

* ci: fallback pdcc signing key to update private key

* ci: ensure pdcc signing passphrase env is always set

* ci: create pdcc publish root before invoking client

* ci: set pdcc version variable from release version

* ci: decouple pdcc installer version from publish config version

* ci: package pdcc subchannels with generated filemap and changelog

* ci: make local pdc mock diff return empty for fast fallback

* ci: fix pdcc variable mapping and pdc signing prechecks

* Update App.axaml.cs

* ci: wire aws cli credentials for rainyun s3

* ci: pin pdcc client version separately from app version

* ci: harden local pdc mock transport handling

* ci: publish pdcc subchannels in one pass

* ci: add pdcc publish heartbeat and timeout

* ci: fix pdcc publish workdir bootstrap

* feat.Penguin Logistics Online Network Distribution System

* ci: fix plonds s3 probe and signing fallback

* ci: validate signing key and quiet missing baselines

* ci: relax aws checksum mode for rainyun s3

* ci: avoid multipart uploads to rainyun s3

* ci: handle empty plonds baselines safely

* ci.plonds

* Rebuild release pipeline around PLONDS and DDSS

* Fix Windows installer script path in release workflow

.trae/specs/launcher-upgrade/checklist.md

@@ -0,0 +1,8 @@
+# Launcher Upgrade Checklist
+
+- [x] Build passes for `LanMountainDesktop.Launcher`.
+- [x] `update check` command returns structured JSON result.
+- [x] `plugin update` command returns structured JSON result.
+- [x] Legacy plugin install arguments still execute.
+- [x] OOBE and splash are implemented as separate windows.
+- [x] Update and rollback logic use version directory markers.

.trae/specs/launcher-upgrade/spec.md

@@ -0,0 +1,54 @@
+# Launcher Upgrade Spec
+
+## Goal
+
+Upgrade `LanMountainDesktop.Launcher` into the unified Launcher for:
+
+- OOBE first-run entry
+- startup splash window
+- silent/incremental/rollback update
+- plugin install/update
+
+## Scope (Phase 1)
+
+- Avalonia GUI launcher with two windows:
+  - `OOBEWindow` (first run only)
+  - `SplashWindow` (every launch)
+- Default command `launch`
+- CLI commands:
+  - `update check|download|apply|rollback`
+  - `plugin install|update`
+- Legacy compatibility:
+  - `--source --plugins-dir --result` still works for plugin install
+
+## Update Behavior
+
+- ClassIsland-style deployment folders:
+  - `app-<version>-<number>/`
+  - marker files `.current`, `.partial`, `.destroy`
+- Signed file map:
+  - `files.json`
+  - `files.json.sig`
+  - `public-key.pem`
+- Incremental update:
+  - `replace` from archive
+  - `reuse` from current deployment
+  - `delete` skip file in target deployment
+- Rollback:
+  - snapshot metadata is written before apply
+  - automatic rollback on apply failure
+  - manual rollback via command
+
+## OOBE and Splash
+
+- OOBE is independent from splash.
+- OOBE shows only:
+  - welcome text: `欢迎使用阑山桌面`
+  - arrow button for continue
+- Splash shows only:
+  - app name: `阑山桌面`
+
+## Extensibility
+
+- `IOobeStep` for future multi-step OOBE
+- `ISplashStageReporter` for future startup progress visualization

.trae/specs/launcher-upgrade/tasks.md

@@ -0,0 +1,12 @@
+# Launcher Upgrade Tasks
+
+- [x] Convert `LanMountainDesktop.Launcher` to Avalonia launcher entry.
+- [x] Add OOBE window with first-run marker handling.
+- [x] Add splash window for every startup.
+- [x] Implement unified command parsing with default `launch`.
+- [x] Keep legacy plugin install args compatibility.
+- [x] Add plugin pending upgrade queue processing.
+- [x] Implement incremental update apply with signed file map.
+- [x] Implement snapshot-based rollback and manual rollback command.
+- [x] Add update check/download/apply/rollback CLI commands.
+- [x] Add launcher spec files under `.trae/specs/launcher-upgrade/`.

.trae/specs/pdc-incremental-migration/checklist.md

@@ -0,0 +1,13 @@
+# Checklist
+
+- [ ] `release.yml` includes PDCC publish flow and does not invoke Velopack.
+- [ ] `release.yml` uploads app payload artifacts for PDCC.
+- [ ] S3 output path is rooted at `lanmountain/update/` (no system version prefix).
+- [ ] S3 has `repo/`, `meta/`, and `installers/` outputs after a release run.
+- [ ] Host update source default is `stcn` and old `pdc` values are auto-normalized.
+- [ ] Host can persist PDC payload into launcher incoming directory.
+- [ ] Launcher can apply PDC FileMap payload with signature/hash verification.
+- [ ] Legacy signed `files.json + update.zip` path still works as compatibility fallback.
+- [ ] CI run attached proving all release matrix jobs pass.
+- [ ] N-1 -> N incremental update verified on Windows x64/x86 and Linux x64.
+- [ ] Rollback verification report attached.

.trae/specs/pdc-incremental-migration/spec.md

@@ -0,0 +1,44 @@
+# PDC Incremental Update Migration
+
+## Goal
+
+Replace VeloPack-based incremental packaging with a unified PDC FileMap + object-repo pipeline, while keeping Launcher installation, rollback, and update orchestration ownership unchanged.
+
+## Stage 1 (Completed)
+
+- Release workflow removed VeloPack-based release packaging.
+- Signed FileMap path was restored as an interim release mechanism.
+- Host/Launcher fallback behavior stayed compatible with `files.json + files.json.sig + update.zip`.
+
+## Stage 2 (Current Implementation Target)
+
+- Move release publishing to PDCC + `phainon.yml` (ClassIsland-style).
+- Promote PDC-distributed FileMap/object-repo as the primary incremental path.
+- Keep GitHub Release installers and metadata as parallel distribution.
+- Keep Launcher state machine ownership (`.current/.partial/.destroy` + snapshots).
+- Update source defaults to `stcn` (S3/PDC), with GitHub fallback.
+- S3 object root is fixed to `lanmountain/update/` with no update-system version prefix.
+
+Expected S3 layout:
+  - `lanmountain/update/repo/<hash-prefix>/<hash-object>`
+  - `lanmountain/update/meta/channels/<channel>/<subchannel>/latest.json`
+  - `lanmountain/update/meta/distributions/<distributionId>/*.json`
+  - `lanmountain/update/installers/<platform>/<arch>/*`
+
+## Acceptance
+
+- `release.yml` includes PDCC publish steps and no Velopack steps.
+- Release jobs keep building installers for Windows x64/x86, Linux x64, and macOS.
+- PDC metadata + FileMap + object repo are published under `lanmountain/update/`.
+- Host can consume PDC payload (`stcn` source) and fallback to GitHub when unavailable.
+- Launcher can apply both:
+  - legacy signed `files.json + update.zip`
+  - PDC FileMap object-repo payload.
+- Rollback semantics remain unchanged.
+
+## Deprecated Notes
+
+- The following interim outputs are compatibility-only (not the long-term primary path):
+  - `files-windows-x64.json` / `.sig` / `update-windows-x64.zip`
+  - `files-windows-x86.json` / `.sig` / `update-windows-x86.zip`
+  - `files-linux-x64.json` / `.sig` / `update-linux-x64.zip`

.trae/specs/pdc-incremental-migration/tasks.md

@@ -0,0 +1,15 @@
+# Tasks
+
+- [x] Remove VeloPack packaging from release workflow.
+- [x] Keep signed FileMap path as interim compatibility fallback.
+- [x] Remove launcher/runtime Velopack branching.
+- [ ] Add `phainon.yml` for PDCC publish configuration.
+- [ ] Add PDCC installation + publish steps in `release.yml`.
+- [ ] Upload app payload artifacts for PDCC consumption in release build jobs.
+- [ ] Publish PDC metadata + object repo to S3 path root `lanmountain/update/`.
+- [ ] Mirror installers to `lanmountain/update/installers/<platform>/<arch>/`.
+- [ ] Replace update source canonical value with `stcn` (keep legacy `pdc` compatibility).
+- [ ] Add PDC payload model into host update check result.
+- [ ] Add host download path for PDC payload (`pdc-filemap.json` + signature + metadata).
+- [ ] Add launcher PDC FileMap apply path with rollback-compatible semantics.
+- [ ] Keep old `files.json + update.zip` path behind compatibility fallback.

.trae/specs/velopack-update-integration/checklist.md

@@ -0,0 +1,5 @@
+# Checklist (Deprecated)
+
+- [x] Spec marked as deprecated.
+- [x] Active implementation ownership moved to `pdc-incremental-migration`.
+- [x] No release workflow dependency remains on VeloPack.

.trae/specs/velopack-update-integration/spec.md

@@ -0,0 +1,15 @@
+# VeloPack Update Integration (Deprecated)
+
+## Status
+
+This spec is deprecated and superseded by `.trae/specs/pdc-incremental-migration/`.
+
+## Deprecation Reason
+
+- VeloPack native package generation introduced unstable release blocking (version format coupling and platform divergence).
+- The project has switched back to signed FileMap incremental assets as the primary update path.
+- Launcher remains the update installer/rollback authority; packaging and distribution are being migrated to PDC/S3-compatible flows.
+
+## Migration Note
+
+Use `.trae/specs/pdc-incremental-migration/spec.md` as the active authority for incremental update implementation and acceptance.

.trae/specs/velopack-update-integration/tasks.md

@@ -0,0 +1,6 @@
+# Tasks (Deprecated)
+
+- [x] Mark VeloPack integration spec as deprecated.
+- [x] Remove VeloPack runtime branches from launcher/host update path.
+- [x] Remove VeloPack release workflow packaging steps.
+- [ ] Keep archive for historical context only (no new implementation tasks here).