[codex] Add Windows portable install location picker

src-tauri/Cargo.toml

@@ -28,6 +28,8 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 tauri = { version = "2.11.2", features = ["tray-icon", "image-png", "macos-private-api"] }
 tauri-plugin-autostart = "2"
+tauri-plugin-dialog = "2.7.1"
 tauri-plugin-process = "2"
 tauri-plugin-updater = "2"
 thiserror = "2.0"
+windows-sys = { version = "0.61.2", features = ["Win32_Storage_FileSystem"] }

src-tauri/capabilities/default.json

@@ -7,8 +7,8 @@
     "core:default",
     "core:window:allow-start-dragging",
     "core:window:allow-close",
+    "dialog:allow-open",
     "updater:default",
     "process:default"
   ]
 }
-

src-tauri/src/app/settings_store.rs

@@ -4,7 +4,10 @@
 //! Codex bundle), mirroring `provenance::ProvenanceStore`.
 
 use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
 
+use crate::adapters::host;
+use crate::domain::target::Target;
 use crate::errors::AppError;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -25,6 +28,10 @@ pub struct AppSettings {
     /// still fall back to portable when the machine blocks sideloading.
     #[serde(default = "default_windows_install_mode")]
     pub windows_install_mode: String,
+    /// Portable Windows install root. Kept across uninstall so the next fresh
+    /// portable install can default to the user's last chosen location.
+    #[serde(default = "default_install_root")]
+    pub install_root: String,
 }
 
 fn default_true() -> bool {
@@ -35,6 +42,10 @@ fn default_windows_install_mode() -> String {
     "msix".to_string()
 }
 
+pub fn default_install_root() -> String {
+    host::default_install_root(&Target::current())
+}
+
 impl Default for AppSettings {
     fn default() -> Self {
         Self {
@@ -45,6 +56,7 @@ impl Default for AppSettings {
             signed_only: true,
             confirm_close: true,
             windows_install_mode: default_windows_install_mode(),
+            install_root: default_install_root(),
         }
     }
 }
@@ -55,6 +67,20 @@ fn store_path() -> Option<std::path::PathBuf> {
 }
 
 impl AppSettings {
+    pub fn normalize(&mut self) {
+        self.signed_only = true; // enforce regardless of what is on disk
+        if !matches!(self.windows_install_mode.as_str(), "msix" | "portable") {
+            self.windows_install_mode = default_windows_install_mode();
+        }
+        if self.install_root.trim().is_empty()
+            || !PathBuf::from(self.install_root.trim()).is_absolute()
+        {
+            self.install_root = default_install_root();
+        } else {
+            self.install_root = self.install_root.trim().to_string();
+        }
+    }
+
     pub fn load() -> Self {
         let Some(path) = store_path() else {
             return Self::default();
@@ -63,10 +89,7 @@ impl AppSettings {
             .ok()
             .and_then(|bytes| serde_json::from_slice(&bytes).ok())
             .unwrap_or_default();
-        s.signed_only = true; // enforce regardless of what is on disk
-        if !matches!(s.windows_install_mode.as_str(), "msix" | "portable") {
-            s.windows_install_mode = default_windows_install_mode();
-        }
+        s.normalize();
         s
     }
 

src-tauri/src/app/win_update.rs

@@ -179,6 +179,13 @@ fn detect_managed_codex(
             return Some(portable);
         }
     }
+    for record in &store.managed {
+        if let Some(portable) = detect_portable_install(PathBuf::from(&record.path).as_path()) {
+            if store.is_managed(&portable.path) {
+                return Some(portable);
+            }
+        }
+    }
     detect_installed_codex(root.as_path())
 }
 
@@ -426,7 +433,8 @@ pub fn auto_stage_windows_update_with_install_mode(
         }
     }
 
-    let stage = stage_windows_update_with_install_mode(endpoints, settings, install_mode, &no_progress)?;
+    let stage =
+        stage_windows_update_with_install_mode(endpoints, settings, install_mode, &no_progress)?;
     let notes = if stage.install_ready {
         vec!["Windows package is staged and ready for user-confirmed installation.".to_string()]
     } else {
@@ -470,9 +478,11 @@ pub fn perform_windows_update_with_install_mode(
         ));
     }
 
-    let previous_installed =
-        detect_installed_codex(PathBuf::from(&settings.install_root).as_path());
-    let stage = stage_windows_update_with_install_mode(endpoints, settings, install_mode, progress)?;
+    let store = ProvenanceStore::load();
+    let previous_installed = detect_managed_codex(settings, &store)
+        .or_else(|| detect_installed_codex(PathBuf::from(&settings.install_root).as_path()));
+    let stage =
+        stage_windows_update_with_install_mode(endpoints, settings, install_mode, progress)?;
     if stage.up_to_date {
         return Ok(WinPerformReport {
             success: true,
@@ -503,6 +513,16 @@ pub fn perform_windows_update_with_install_mode(
                 .map_err(engine_err)?;
         }
     }
+    // A managed portable build (possibly under a previous install root) is not
+    // stopped by the MSIX sideload below, so close it first — otherwise it keeps
+    // running after we switch the user over to the MSIX package. `previous_installed`
+    // comes from the provenance-aware detect_managed_codex above.
+    if let Some(previous) = &previous_installed {
+        if previous.source == "portable" {
+            close_codex_gracefully_for_root(30, PathBuf::from(&previous.path).as_path())
+                .map_err(engine_err)?;
+        }
+    }
     let sideload =
         install_msix_sideload(PathBuf::from(staged_path).as_path()).map_err(engine_err)?;
 
@@ -551,9 +571,14 @@ fn install_portable_after_stage(
         .staged_path
         .as_ref()
         .ok_or_else(|| AppError::Engine("staged MSIX path missing".to_string()))?;
+    let install_root = previous_installed
+        .as_ref()
+        .filter(|installed| installed.source == "portable")
+        .map(|installed| installed.path.clone())
+        .unwrap_or_else(|| settings.install_root.clone());
     let portable = install_portable_from_msix(
         PathBuf::from(staged_path).as_path(),
-        PathBuf::from(&settings.install_root).as_path(),
+        PathBuf::from(&install_root).as_path(),
         true,
     )
     .map_err(engine_err)?;
@@ -562,7 +587,7 @@ fn install_portable_after_stage(
     // which prefers MSIX and would return a still-present older MSIX package
     // (e.g. when sideload was blocked by policy), recording the wrong target so
     // the user keeps seeing the same update and the portable build goes unmanaged.
-    let installed = detect_portable_install(PathBuf::from(&settings.install_root).as_path());
+    let installed = detect_portable_install(PathBuf::from(&install_root).as_path());
     if let Some(installed) = &installed {
         let mut store = ProvenanceStore::load();
         if let Some(previous) = &previous_installed {
@@ -608,7 +633,10 @@ pub fn win_install_status(settings: &AppSettings) -> WinInstallStatus {
     let installed = detect_managed_codex(settings, &store);
     let status = match &installed {
         None => "none",
-        Some(codex) if store.is_managed(&codex.path) => "managed",
+        // Build-aware (matching the macOS path): a self-updated or path-reused
+        // install no longer matches its record and reads as "external" so the
+        // user is prompted to re-adopt rather than silently treated as managed.
+        Some(codex) if store.is_managed_build(&codex.path, version_key(&codex.version)) => "managed",
         Some(_) => "external",
     }
     .to_string();
@@ -654,7 +682,11 @@ pub fn uninstall_windows_codex(
     };
 
     let mut store = ProvenanceStore::load();
-    if !store.is_managed(&installed_before.path) {
+    // Boundary (matching the macOS uninstall): refuse to delete anything that
+    // isn't an install we manage at this exact build. Path-only matching could
+    // delete a path-reused external install or one left by a stale record —
+    // more likely now that the install root is user-configurable.
+    if !store.is_managed_build(&installed_before.path, version_key(&installed_before.version)) {
         return Ok(WinUninstallReport {
             success: false,
             action: "external-not-managed".to_string(),
@@ -702,7 +734,7 @@ pub fn uninstall_windows_codex(
     }
 
     let portable = uninstall_portable(
-        PathBuf::from(&settings.install_root).as_path(),
+        PathBuf::from(&installed_before.path).as_path(),
         purge_user_data,
     )
     .map_err(engine_err)?;