refactor(uninstall): shared elevation gate + privilege-UX fixes#546
Merged
Conversation
Migrate `uffs --uninstall` onto the shared `commands::elevation` gate that `uffs --update` already uses, so both flows share one implementation of "surface admin-only work up front, decide once". Behavior-preserving. - Extend the shared gate with `offer_inflow_elevation`: uninstall passes `true` (it has a one-shot elevated helper → Windows 3-way elevate/continue/ abort, `action = "removal"`); update passes `false` (no in-flow UAC → binary continue/abort). `GateWording` regains `action`; `ElevationChoice` regains `ElevateLater` (was uninstall's `ElevateAtRemoval`). - `RemovalPlan` now implements `ElevatablePlan` (its inherent `requires_elevation` / `drop_elevation_required` moved into the trait impl to satisfy `same_name_method`; `render_elevation_needed` delegates to `render::print_elevation_gate`). Call sites import the trait. - Delete uninstall's local `ElevationChoice` + `elevation_gate` + `platform_elevation_choice` (both cfg); the thin wrapper delegates to the shared gate. uninstall/mod.rs drops ~90 lines. 147 uffs-cli tests green (incl. the 12 uninstall plan tests on the now-trait methods); native + windows-msvc clippy + rustdoc clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ed kill
The deep-sweep (`d`) reload shelled the policy-gated `daemon kill` to stop the
running daemon before restarting it with full drive coverage. A non-elevated
shell can't use that on an elevated daemon, so it failed loudly ("requires an
elevated shell"), bailed before the elevated start, and the UAC prompt the `d`
prompt promised never appeared.
Stop the daemon COOPERATIVELY first — an IPC shutdown the daemon honors
regardless of its own elevation (same-user pipe), the same stop
`winget::quiesce` uses — and fall back to the gated kill only if the daemon
ignores it. Then the reload reaches the elevated start and delivers the
promised UAC.
- New `stop_running_daemon` (cooperative shutdown -> poll down -> gated-kill
fallback -> re-check) + `daemon_is_down`; `wait_until_daemon_down` shares the
down-check.
- Narration "kill + start" -> "stop + start".
xwin (compiles this #[cfg(windows)] path) + native clippy + rustdoc clean;
147 uffs-cli tests pass.
`uffs-broker --uninstall` bailed on any `sc delete` failure, so removing a broker that was never installed screamed "[SC] OpenService FAILED 1060: The specified service does not exist" — even though "not installed" is exactly the requested end state. Treat ERROR_SERVICE_DOES_NOT_EXIST (1060) as success: the request is satisfied by doing nothing. New pure `absent_service_signal` classifier (exit code primary, sc text fallback) + Windows unit tests. native + windows-msvc clippy + rustdoc clean.
…he spinner The deep-sweep (`d`) reload starts the daemon, which on a cold cache can take ~90s. In loud mode that showed only raw "connect attempt N/20" chatter, which reads as a hang. Animate a spinner over the (quiet) start instead so the wait reads as "working". Extract the spinner into a shared `commands::spinner` (Windows-only for now, since both callers are `#[cfg(windows)]`) and point both the winget orchestration and the new coverage reload at it, removing winget's private copy (behavior-identical output). native + windows-msvc clippy + rustdoc clean; 147 uffs-cli tests pass.
Follow-up to the 1060 no-op: the existence check now runs BEFORE the Administrator gate. A non-elevated `uffs-broker --uninstall` with no broker installed prints "Broker service is not installed — nothing to remove." and exits 0, instead of demanding an elevated terminal for work that would not happen. Elevation is still required only when there is actually a service to delete. Existence is a non-elevated SCM query (`uffs_winsvc::is_installed`). native + windows-msvc clippy clean.
A label longer than 60 chars (the deep-sweep "starting the index daemon (a
cold cache can take up to ~90 s)") left a stale tail ("90 s)…") on screen after
the spinner finished, because the erase wiped a fixed 60 columns. Clear
`label.chars().count() + 11` columns — exactly the " <glyph> <label>… "
line drawn each frame.
native + windows-msvc clippy + rustdoc clean; 147 uffs-cli tests pass.
The per-pattern "kept=N" line prints after the name/known-dir filter but BEFORE the legacy-GUI exclusion (which happens in version_strays), so the count overstated what finally showed — e.g. kept=21 uffs.exe but only 3 in EXTRA, because 18 were the predecessor C++ GUI product. Count those exclusions and emit a -v line (mirroring the timeout counter), so the math reads found N candidate -> M legacy-GUI excluded -> versioned K stray. native + windows-msvc clippy clean; 147 uffs-cli tests pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates
uffs --uninstallonto the shared elevation gate and fixes a batch of privilege-UX rough edges surfaced during Windows testing. All commits Windows-validated by the maintainer.Commits
RemovalPlanimplementsElevatablePlan; uninstall drops its duplicatedElevationChoice/gate/platform_elevation_choiceand delegates tocommands::elevation. The shared gate gainsoffer_inflow_elevation(uninstall keeps its Windows 3-way one-UAC path; update stays binary).daemon kill, so the reload reaches the elevated start and delivers the promised UAC.--uninstallno-ops when the service is absent — treatsERROR_SERVICE_DOES_NOT_EXIST(1060) as success, and checks existence (a non-elevated query) before the Administrator gate, so removing a non-existent broker is a clean no-op on either terminal.commands::spinner(winget's private copy removed).label + 11columns so a long label no longer leaves a stale tail.-vsweep diagnostic — the sweep count now readsfound N → M legacy-GUI excluded → K stray, so the drop from the name-filter count to the final list is visible.Validation
Windows-tested end-to-end across multiple rounds (elevation gate 3-way, deep-sweep reload + UAC, broker no-op both terminals, winget/daemon update corners). native +
x86_64-pc-windows-msvcclippy + rustdoc clean; 147 uffs-cli tests pass.