release: 0.0.38 with accurate Windows first-run documentation - #57
Conversation
Cuts 0.0.38 and corrects the public documentation for the Windows first-run experience that 0.0.37 and 0.0.38 actually fixed. A typical new Windows 11 PC has WSL and VirtualMachinePlatform disabled. 1Helm enables both itself, which requires one Windows restart partway through setup. The README, website manual, getting-started guide, and user guide now state that plainly: WSL is not a prerequisite, the single UAC prompt, the PowerShell progress window that must stay open, the restart as a normal step rather than an error, and resuming by reopening 1Helm as the same Windows user. SmartScreen on the unsigned Setup executable is disclosed honestly. Also adds the per-platform install and removal paths the repository front page never documented, first-run troubleshooting for all three platforms, and the two Settings sections (Notifications, Feedback) the user guide omitted. The website's disclosed Authenticode version is release-coupled, so test/site.mjs now derives it from package.json instead of pinning a literal that goes stale on every patch bump. Release pins: version, changelog, and local/1helm-channel-machine:0.0.38. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis release updates the package and channel-machine versions to 0.0.38. It adds Windows WSL 2 restart and setup-resumption guidance, expands cross-platform installation documentation, updates settings and state-preservation guidance, and synchronizes release references and tests. Changes0.0.38 Release and Installation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/USER_GUIDE.md`:
- Around line 441-446: Revise the macOS Gatekeeper guidance in the release
troubleshooting section to remove the “almost certainly” attribution to partial
downloads or re-hosted copies. Use neutral diagnostic wording that acknowledges
signing, notarization, policy, and system-state causes; retain re-downloading
the DMG as one troubleshooting step, and add a support or verification path for
persistent failures. Keep the warning against stripping quarantine attributes or
using ad-hoc re-signing.
- Around line 435-439: Update the Windows setup guidance in USER_GUIDE.md to
direct users to Settings → Skipper computers → Channel computers and use the
exact action label “Set up shared runtime”; remove the incorrect “Retry shared
runtime setup” wording while preserving the surrounding troubleshooting and
platform requirements.
In `@package.json`:
- Line 4: Update the website release fallback metadata used by the GitHub-fetch
failure path in site/server.mjs from v0.0.30 to v0.0.38, including its asset and
digest values, and update the corresponding test expectation. Add validation
that the fallback version matches the package.json version before publishing.
In `@README.md`:
- Around line 137-140: Update the Windows setup sentence in the Workspace step
to explicitly state that 1Helm enables WSL and VirtualMachinePlatform itself,
replacing the ambiguous “both” wording while preserving the surrounding
instructions.
In `@site/content.mjs`:
- Line 16: The gettingStarted content should qualify the Windows restart
requirement based on whether the required Windows features are already enabled.
Update the Windows setup wording to say a restart may be required for systems
needing WSL 2 or related feature enablement, while preserving the instruction to
reopen 1Helm and continue setup when a restart occurs.
In `@src/server/db.ts`:
- Line 942: Update the migration logic around the HELM_CHANNEL_MACHINE_IMAGE
value so existing channel_computers rows are reconciled to the configured image,
not only newly inserted rows. Ensure the update preserves existing records while
changing their image to the current value, and keep ensureChannelComputerRecord
and reconciler behavior consistent with this migration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 011d1638-0c44-4d27-85ca-d37ee70378fc
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (12)
CHANGELOG.mdREADME.mddocs/GOVERNANCE.mddocs/USER_GUIDE.mddocs/VISION.mdpackage.jsonsite/content.mjssite/manual.htmlsrc/server/channel-computers.tssrc/server/db.tstest/channel-computers.mjstest/site.mjs
| **Windows setup failed or stalled.** Check the PowerShell window for the error, | ||
| then use **Retry shared runtime setup** in onboarding or Settings → Channel | ||
| computers. Setup is idempotent — retrying resumes rather than starting over. | ||
| The runtime requires Windows 11 **x64**; arm64 Windows is not supported by this | ||
| build. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- USER_GUIDE.md around the reported section ---'
sed -n '390,455p' docs/USER_GUIDE.md
printf '%s\n' '--- Settings label references ---'
rg -n -i -C 3 'Skipper computers|Channel computers|Retry shared runtime setup|shared runtime setup|Settings.*computers|computers.*Settings' . \
-g '!node_modules' -g '!dist' -g '!build'Repository: gitcommit90/1Helm
Length of output: 50373
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- Settings navigation and section rendering ---'
sed -n '70,100p' src/client/settings.ts
sed -n '620,755p' src/client/settings.ts
printf '%s\n' '--- Retry-related settings labels and handlers ---'
rg -n -C 5 'Retry shared runtime setup|retry.*runtime|runtime.*retry|Channel computers' src/client/settings.ts src/client/onboarding.ts test
printf '%s\n' '--- Documentation index and computer section ---'
sed -n '195,220p' docs/USER_GUIDE.md
sed -n '330,348p' docs/USER_GUIDE.md
printf '%s\n' '--- Read-only label consistency check ---'
python3 - <<'PY'
from pathlib import Path
p = Path("src/client/settings.ts").read_text()
for label in ("Skipper computers", "Channel computers", "Retry shared runtime setup"):
print(f"{label!r}: {p.count(label)} occurrence(s)")
print("tab declaration:", '[["computers", "Skipper computers"]]' in p)
print("channel heading:", 'font-semibold text-fg" }, "Channel computers"' in p)
print("settings retry label:", "Retry shared runtime setup" in p)
PYRepository: gitcommit90/1Helm
Length of output: 22900
Use the actual Settings path and action label.
The sidebar label is Skipper computers. Inside it, the runtime panel is Channel computers, and the Windows button is Set up shared runtime, not Retry shared runtime setup. Update this step to match the UI.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/USER_GUIDE.md` around lines 435 - 439, Update the Windows setup guidance
in USER_GUIDE.md to direct users to Settings → Skipper computers → Channel
computers and use the exact action label “Set up shared runtime”; remove the
incorrect “Retry shared runtime setup” wording while preserving the surrounding
troubleshooting and platform requirements.
| **macOS blocks the app or reports it is damaged.** The Mac release is Developer | ||
| ID signed, notarized, and stapled, so Gatekeeper should accept it after you | ||
| drag it to Applications. If it does not, you are almost certainly running a | ||
| partially downloaded or re-hosted copy — download the DMG again from | ||
| [1helm.com](https://1helm.com/download/macos). Do not strip quarantine | ||
| attributes or re-sign an ad-hoc build to work around a failed verification. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Do not attribute every Gatekeeper failure to a bad download.
Gatekeeper can reject a complete official artifact for signing, notarization, policy, or system-state reasons. Replace “almost certainly” with neutral diagnostic guidance. Keep re-downloading as one troubleshooting step, and provide a support or verification path if the failure persists.
Proposed wording
-If it does not, you are almost certainly running a
-partially downloaded or re-hosted copy — download the DMG again from
+If it does not, verify the download source and download the DMG again from
[1helm.com](https://1helm.com/download/macos). If the failure persists,
+contact support instead of bypassing verification.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/USER_GUIDE.md` around lines 441 - 446, Revise the macOS Gatekeeper
guidance in the release troubleshooting section to remove the “almost certainly”
attribution to partial downloads or re-hosted copies. Use neutral diagnostic
wording that acknowledges signing, notarization, policy, and system-state
causes; retain re-downloading the DMG as one troubleshooting step, and add a
support or verification path for persistent failures. Keep the warning against
stripping quarantine attributes or using ad-hoc re-signing.
| "name": "1helm", | ||
| "productName": "1Helm", | ||
| "version": "0.0.37", | ||
| "version": "0.0.38", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "package.json version:"
python3 -c 'import json; print(json.load(open("package.json", encoding="utf-8"))["version"])'
echo "Website fallback release and digest references:"
rg -n -C 8 'fallback|release|artifact|digest|sha256|0\.0\.' site/server.mjsRepository: gitcommit90/1Helm
Length of output: 8059
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Relevant package metadata and scripts:"
sed -n '1,140p' package.json
echo "Release fallback references:"
rg -n -C 4 'RELEASE_FALLBACK|SITE_RELEASE_FETCH_DISABLED|SITE_RELEASE_METADATA_JSON|latestLinuxRelease|0\.0\.30|0\.0\.38' site test* .github 2>/dev/null || true
echo "Changed-file summary:"
git diff --statRepository: gitcommit90/1Helm
Length of output: 37716
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Website release routes and fallback test:"
sed -n '80,125p' test/site.mjs
sed -n '330,430p' site/server.mjs
echo "All release metadata consumers:"
rg -n -C 3 'latestAssetUrl|latestReleaseAssets|RELEASE_PAGE|/download/|sha256|digest' site/server.mjs test/site.mjs site/public/install.sh
echo "Standalone fallback invariant check:"
python3 - <<'PY'
import json, re
from pathlib import Path
package_version = json.loads(Path("package.json").read_text())["version"]
source = Path("site/server.mjs").read_text()
tag = re.search(r'tag_name:\s*"v([^"]+)"', source).group(1)
names = re.findall(r'\["([^"]+)",\s*"([0-9a-f]{64})"\]', source)
urls = re.findall(r'releases/download/v([^/]+)/\$\{name\}', source)
print({"package_version": package_version, "fallback_version": tag})
print("fallback_asset_versions:", sorted(set(re.findall(r"1Helm-([0-9]+\.[0-9]+\.[0-9]+)-", "\n".join(n for n, _ in names)))))
print("fallback_url_versions:", sorted(set(urls)))
print("version_matches:", package_version == tag)
PYRepository: gitcommit90/1Helm
Length of output: 24005
Update the website fallback metadata before publishing 0.0.38.
When GitHub release fetching fails, site/server.mjs serves v0.0.30 assets and digests. Update the fallback and its test expectation, then add a check that the fallback version matches package.json.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 4, Update the website release fallback metadata used by
the GitHub-fetch failure path in site/server.mjs from v0.0.30 to v0.0.38,
including its asset and digest values, and update the corresponding test
expectation. Add validation that the fallback version matches the package.json
version before publishing.
| 4. At the Workspace step, 1Helm builds its WSL 2 runtime. **You do not need WSL | ||
| installed beforehand.** A stock Windows 11 ships with WSL and | ||
| VirtualMachinePlatform turned off, and 1Helm enables both itself: | ||
| - Approve the one administrator (UAC) prompt. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Correct the Windows feature sentence.
Line 139 says 1Helm enables both itself. State the object explicitly.
Proposed fix
- VirtualMachinePlatform turned off, and 1Helm enables both itself:
+ VirtualMachinePlatform turned off, and 1Helm enables both features itself:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| 4. At the Workspace step, 1Helm builds its WSL 2 runtime. **You do not need WSL | |
| installed beforehand.** A stock Windows 11 ships with WSL and | |
| VirtualMachinePlatform turned off, and 1Helm enables both itself: | |
| - Approve the one administrator (UAC) prompt. | |
| 4. At the Workspace step, 1Helm builds its WSL 2 runtime. **You do not need WSL | |
| installed beforehand.** A stock Windows 11 ships with WSL and | |
| VirtualMachinePlatform turned off, and 1Helm enables both features itself: | |
| - Approve the one administrator (UAC) prompt. |
🧰 Tools
🪛 LanguageTool
[grammar] ~139-~139: Ensure spelling is correct
Context: ... VirtualMachinePlatform turned off, and 1Helm enables both itself: - Approve the o...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 137 - 140, Update the Windows setup sentence in the
Workspace step to explicitly state that 1Helm enables WSL and
VirtualMachinePlatform itself, replacing the ambiguous “both” wording while
preserving the surrounding instructions.
Source: Linters/SAST tools
| const security = doc("/manual/security-model", "Security model", "How 1Helm isolates residents, brokers credentials, audits actions, validates skills, and defines the human boundary.", `<p class="intro">Autonomy without architecture is just ambient authority. 1Helm makes routine action cheap inside a narrow world and makes boundary crossings explicit, attributable, and recoverable.</p><h2>Resident isolation</h2><p>Each ordinary channel receives a separate persistent Linux world: an Apple container machine with no Mac home mount, or a durable OCI container. Linux runs OCI natively. Windows hosts containers inside one managed WSL 2 runtime whose Windows-drive mounts and interop are disabled. Exact labels, storage mounts, and owner markers gate lifecycle operations. Other residents and the host home are not exposed.</p><h2>Authoritative files</h2><p>OCI workspace storage belongs to the runtime and is authoritative. Files and Cowork receive narrow direct access to that channel's storage; command and terminal paths do not copy the whole workspace. Apple's backend retains its bounded, symlink-contained mirror.</p><h2>Skipper boundary</h2><p>Skipper owns native host operations, fleet lifecycle, credential brokering, and cross-channel work. A resident calls Skipper directly with the invoking thread; a Captain-authored request is required for host-authorized operations. Skipper returns the result to the resident automatically.</p><h2>Credentials and connections</h2><p>Provider, Gmail, and Photon credentials stay in host-owned storage. Residents receive task-scoped tools and permission records, not raw access tokens or the native Messages database. Photon accepts only the configured Captain phone and keeps that direct Skipper conversation in the Captain's private <code>#main</code>.</p><h2>Skill supply chain</h2><p>The external catalog is discovery metadata, not executable trust. 1Helm shows the open registry's results without applying its own browse-time allowlist. A selected GitHub source is resolved to an immutable commit, bounded to 256 KiB, scanned for instruction override, exfiltration, remote-pipe execution, broad destructive commands, security disabling, private-host access, and prompt extraction, then hashed and wrapped beneath runtime authority.</p><h2>Audit and limits</h2><p>New activity, tool starts/results, and skill installation decisions enter an append-only SHA-256 chain. The chain is tamper-evident, not a remote transparency log: an administrator with database access can still delete or replace the entire database. Historical rows predating the chain are not backfilled.</p><h2>Known dependency debt</h2><p>The pinned Photon SDK currently carries moderate OpenTelemetry advisories upstream. It runs in a supervised loopback-only child process with telemetry disabled. 1Helm tracks the exact pin and will upgrade when the required Photon API remains compatible; this is not represented as a clean dependency audit.</p><h2>Report a vulnerability</h2><p>Use GitHub's private vulnerability reporting for the 1Helm repository. Do not open a public issue containing credentials, tokens, or an unpatched exploit.</p>`); | ||
|
|
||
| const gettingStarted = doc("/manual/getting-started", "Getting started", "Install 1Helm, connect providers, create the workspace, and give the first resident a real outcome.", `<p class="intro">The normal setup is three product decisions. 1Helm handles the infrastructure around them.</p><h2>1. Install or connect</h2><p>On Apple Silicon, download the signed, notarized, and stapled DMG. On Windows 11 x64, download the Setup executable; its Authenticode status is disclosed in the release notes and v0.0.31 is <code>NotSigned</code>. Ubuntu/Debian hosts use the digest-verified Linux systemd installer. A new desktop installation can host its own workspace or connect to an existing HTTPS 1Helm host. Native mobile apps connect only to an existing configured host. Starting a new host may request one administrator approval for its isolated Linux runtime.</p><h2>2. Captain</h2><p>Create the first account. This is the Captain: owner, final authority, and administrator. Public registration closes after the Captain exists.</p><h2>3. Providers</h2><p>Connect one or more subscription accounts or API keys. You can add more later, pool accounts, select exact models, and build fallback or round-robin routes. There is no required single “AI brain.”</p><h2>4. Workspace</h2><p>Name the workspace. Terminals default on. 1Helm creates <code>#main</code> with the one Skipper, then you create ordinary channels with plain-language purposes. Every ordinary channel gets a private Linux computer.</p><h2>5. Give an outcome</h2><p>Try: <em>“Audit this launch folder, turn the notes into a decision brief, resolve obvious gaps yourself, and give me the finished PDF with evidence.”</em> The resident should inspect, execute, create the artifact, and call Skipper itself if it crosses the channel boundary.</p>`); | ||
| const gettingStarted = doc("/manual/getting-started", "Getting started", "Install 1Helm, connect providers, create the workspace, and give the first resident a real outcome.", `<p class="intro">The normal setup is three product decisions. 1Helm handles the infrastructure around them.</p><h2>1. Install or connect</h2><p>On Apple Silicon, download the signed, notarized, and stapled DMG. On Windows 11 x64, download the Setup executable; it is not yet Authenticode signed, so SmartScreen warns once — choose More info → Run anyway. Its status is disclosed in the release notes and v0.0.38 is <code>NotSigned</code>. Ubuntu/Debian hosts use the digest-verified Linux systemd installer. A new desktop installation can host its own workspace or connect to an existing HTTPS 1Helm host. Native mobile apps connect only to an existing configured host. Starting a new host may request one administrator approval for its isolated Linux runtime. On Windows that step also enables WSL 2 for you, which requires <strong>one Windows restart</strong> partway through setup; reopen 1Helm afterwards and setup continues where it left off. See the <a href="/manual/install-windows">Windows guide</a>.</p><h2>2. Captain</h2><p>Create the first account. This is the Captain: owner, final authority, and administrator. Public registration closes after the Captain exists.</p><h2>3. Providers</h2><p>Connect one or more subscription accounts or API keys. You can add more later, pool accounts, select exact models, and build fallback or round-robin routes. There is no required single “AI brain.”</p><h2>4. Workspace</h2><p>Name the workspace. Terminals default on. 1Helm creates <code>#main</code> with the one Skipper, then you create ordinary channels with plain-language purposes. Every ordinary channel gets a private Linux computer.</p><h2>5. Give an outcome</h2><p>Try: <em>“Audit this launch folder, turn the notes into a decision brief, resolve obvious gaps yourself, and give me the finished PDF with evidence.”</em> The resident should inspect, execute, create the artifact, and call Skipper itself if it crosses the channel boundary.</p>`); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Qualify the Windows restart requirement.
The getting-started text says Windows setup “requires one Windows restart.” The Windows guide says first-run setup “includes one Windows restart.” The Requirements text limits the restart to systems where the required Windows features are not already enabled.
Use conditional wording so preconfigured WSL hosts are not told that a restart is mandatory.
Proposed wording
- On Windows that step also enables WSL 2 for you, which requires <strong>one Windows restart</strong> partway through setup;
+ On Windows that step can enable WSL 2 for you. If the required Windows features are not already enabled, setup requires <strong>one Windows restart</strong> partway through setup;
- 1Helm sets it up during first run, which includes one Windows restart.
+ 1Helm sets it up during first run. If the required Windows features are not already enabled, setup includes one Windows restart.Also applies to: 34-34
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@site/content.mjs` at line 16, The gettingStarted content should qualify the
Windows restart requirement based on whether the required Windows features are
already enabled. Update the Windows setup wording to say a restart may be
required for systems needing WSL 2 or related feature enablement, while
preserving the instruction to reopen 1Helm and continue setup when a restart
occurs.
| const configuredBackend = String(process.env.HELM_CHANNEL_COMPUTER_BACKEND || platformBackend); | ||
| const backend = ["apple", "oci", "native", "mock"].includes(configuredBackend) ? configuredBackend : platformBackend; | ||
| const image = String(process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.37"); | ||
| const image = String(process.env.HELM_CHANNEL_MACHINE_IMAGE || "local/1helm-channel-machine:0.0.38"); |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 8 \
'DEFAULT_CHANNEL_IMAGE|HELM_CHANNEL_MACHINE_IMAGE|INSERT OR IGNORE INTO channel_computers|UPDATE channel_computers|SET image' \
src testRepository: gitcommit90/1Helm
Length of output: 50373
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- image references and image-column writes ---'
rg -n 'DEFAULT_CHANNEL_IMAGE|HELM_CHANNEL_MACHINE_IMAGE|INSERT OR IGNORE INTO channel_computers|INSERT INTO channel_computers|UPDATE channel_computers[^"\n]*image|SET image' src test
printf '%s\n' '--- reconciliation entry points and callers ---'
rg -n -C 5 'reconcileChannelComputers|fleet.*recon|reconcile.*Computer|ensureChannelComputerRecord|provisionChannelComputer' src test
printf '%s\n' '--- database initialization callers ---'
rg -n -C 4 'initialize|migrate|ensure.*channel|channel_computers' src/server/db.ts src/server/index.ts src/server/*.tsRepository: gitcommit90/1Helm
Length of output: 50374
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1494,1563p' src/server/channel-computers.ts
sed -n '930,956p' src/server/db.ts
python3 - <<'PY'
from pathlib import Path
for path in ("src/server/db.ts", "src/server/channel-computers.ts"):
text = Path(path).read_text()
print(path, "image-column UPDATE statements:",
[line.strip() for line in text.splitlines()
if "UPDATE channel_computers" in line and "image" in line.lower()])
PYRepository: gitcommit90/1Helm
Length of output: 7252
Update existing channel computer images during migration.
INSERT OR IGNORE applies 0.0.38 only to new rows. The reconciler and ensureChannelComputerRecord do not update existing channel_computers.image values. Existing workspaces therefore retain the previous image unless an explicit migration and rollout updates them.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/server/db.ts` at line 942, Update the migration logic around the
HELM_CHANNEL_MACHINE_IMAGE value so existing channel_computers rows are
reconciled to the configured image, not only newly inserted rows. Ensure the
update preserves existing records while changing their image to the current
value, and keep ensureChannelComputerRecord and reconciler behavior consistent
with this migration.
Cuts 0.0.38 and corrects the public documentation for the Windows first-run experience that 0.0.37 and 0.0.38 actually fixed.
Why
A typical new Windows 11 PC has WSL and VirtualMachinePlatform disabled by default. 1Helm enables both itself, which requires one Windows restart partway through setup. None of the public docs said so — they implied a straight-through install, which is exactly what made a normal restart look like a broken product.
Documentation
site/content.mjs— rewritten/manual/install-windows: Requirements (x64 only, firmware virtualization), a dedicated "First run: the WSL 2 runtime and the restart" section, plus Updates / Removal / Troubleshooting./manual/getting-startedamended for SmartScreen and the restart.site/manual.html— five troubleshooting entries (Windows restart, SmartScreen, PowerShell window, macOS Gatekeeper, Linux prerequisites) and two FAQ entries ("Do I need to install WSL first?", "How do I uninstall 1Helm?").docs/USER_GUIDE.md— first-run troubleshooting; data-root now covers all three platforms; adds the Notifications and Feedback Settings sections that were missing (the guide listed 10 of 12).docs/GOVERNANCE.md— Windows release verification must be exercised on a host where WSL/VMP start disabled.Test hardening
The website's disclosed Authenticode version is release-coupled.
test/site.mjspinned it as a literal and broke on this bump, so it now derives the expected version frompackage.json— it cannot go stale again.Release pins
Version, changelog, and
local/1helm-channel-machine:0.0.38acrossdb.ts,channel-computers.ts,README.md, andtest/channel-computers.mjs.Verification
npm run ci: 118 tests, 0 failures.Known follow-up (blocks publish, not merge)
site/server.mjsRELEASE_FALLBACKis still pinned to v0.0.30 with hardcoded artifact digests. It is the fallback when the GitHub API is unreachable, so it must be updated with real 0.0.38 digests before publishing or the download links can serve 0.0.30. Digests do not exist until the artifacts are built.🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Improvements