Stabilize desktop and app integrations across startup, shutdown, and recovery

[EdamAme-x]

Goal

Make supported app integrations, including Codex App and Claude Desktop surfaces, as reliable as the CLI paths.

Problem

Desktop applications have longer lifetimes, multiple subprocesses, background requests, signed application bundles, and crash/restart behavior that differ from one-shot CLIs. A successful launcher smoke test is not enough to claim stable protection.

Acceptance criteria

• Test clean startup, failed startup, normal exit, forced termination, gateway crash, app crash, and machine restart recovery.
• Ensure temporary provider/settings changes are scoped to the protected session and restored atomically.
• Verify local conversations separately from remote/cloud tasks.
• Capture background, utility, file, image, tool, and streaming requests that belong to supported surfaces.
• Detect unprotected subprocesses or traffic and report them clearly.
• Prevent orphan gateways, stale backups, duplicated providers, and broken unprotected app startup.
• Add platform-specific release E2E for signed or packaged apps where automation permits.
• Publish an evidence-based support matrix and label unverified surfaces as unverified.

[EdamAme-x]

Decision: opt-in trust-store flow for Claude Desktop

For pentect claude app, use an explicit first-run confirmation before changing the current user trust store.

Planned flow:

1. Explain that Pentect must temporarily trust a session-specific local CA to protect Claude Desktop traffic.
2. If the user declines, make no system changes and exit with an actionable message.
3. If accepted, install only the public certificate into the current user trust store; keep the private key process-local.
4. Launch Claude Desktop with its accepted local proxy option, without certificate-validation bypass switches.
5. Remove the certificate on normal exit.
6. Journal the installation and clean stale Pentect certificates on the next startup and through pentect doctor after crashes.
7. Fail closed for unknown Claude request formats and verify chat, attachments, streaming, tools, login, updater, and background traffic with a real account.

The confirmation belongs specifically to pentect claude app; normal CLI clients must not prompt for or install a CA. The change must not silently install a machine-wide or permanent trust anchor.

[EdamAme-x]

Progress on the Windows Claude Desktop path:

• fix: pass gateway environment to Claude MSIX #1277 merged at b5cd6b4e56f8bfc216009b5b5c1e9e261f5926a2 and closed ANTHROPIC_BASE_URL cannot reach the app on the AUMID activation path #393.
• The MSIX/AUMID path no longer assumes that a shell-brokered app inherits Pentect's process environment.
• Pentect now uses the documented IPackageDebugSettings::EnableDebugging package environment block to deliver ANTHROPIC_BASE_URL and explicitly clear header-source variables before ActivateApplication.
• The temporary package debug setting is cleared immediately after activation. Error paths retry cleanup, and Pentect terminates the activated process if cleanup fails rather than leaving a partially protected session.
• Linux focused tests and the Windows Desktop app boundary Actions job passed.

This is code-level and Windows-CI evidence, not a real-account success claim. The broader acceptance criteria here remain open, especially a signed Claude Desktop/MSIX run with a real account covering login, chat, attachments, tools, background traffic, app/gateway crashes, and restart recovery.

[EdamAme-x]

Partial fix merged in #1280.

Verified behavior added:

• if the local Claude Desktop inspection gateway stops after launch, Pentect now terminates and reaps the Desktop process instead of leaving a broken session running;
• the existing cleanup guard then removes the temporary current-user Windows CA and cleanup journal;
• the CLI returns an actionable error and persists a value-free warning/claude-app reason=gateway-stopped diagnostic.

Evidence:

• focused Linux regression: passed;
• full claude_app_proxy module: 33 passed;
• GitHub Actions Desktop app boundary tests: Windows and macOS passed;
• Windows certificate-store lifecycle test passed;
• all required PR checks passed.

This issue remains open. Signed-in real-account verification for login, chat, attachments, tools, background behavior, crash recovery, and restart is still outstanding and is not claimed by this change.

[EdamAme-x]

Partial fix merged in #1296.

Root cause addressed:

• pentect claude app previously treated a live listener thread as proof that Claude Desktop was protected. It did not verify that Desktop used the injected proxy or accepted Pentect's session certificate, so a routing regression such as the former Windows AUMID failure could look healthy.

New behavior:

• gateway startup is reported as waiting, not yet active;
• protection becomes active only after a Claude-host CONNECT reaches the gateway and the session-certificate TLS handshake succeeds;
• if no such connection is observed within 30 seconds, Pentect emits one actionable warning and persists the value-free reason no-protected-connection;
• a later successful connection reports recovery;
• Pentect does not terminate the app for this warning because login and user-input waits can be legitimate idle states.

Evidence:

• focused claude_app_proxy tests: 35 passed;
• clippy and formatting passed;
• GitHub Actions CI gate passed;
• Desktop app boundaries passed on Windows and macOS;
• no unresolved review threads.

This proves route use and certificate acceptance at the protocol boundary. It is not a real-account model-request test, and #352 remains open for signed-in UI flows, background requests, app/machine crash recovery, and the other acceptance criteria.