Make "run it with its interface" actually run something

Reported plainly: "you never see the installer". That was exactly right,
and the reason was one line.

    guard let winPath = wrapper.windowsPath(for: installer) else { return }

`windowsPath` only maps C:, inside the wrapper. An installer lives in
Downloads, so it returned nil and the guard turned the entire function
into a silent no-op — the button existed, the message told the person to
answer a window, and no window was ever launched. Wine maps the whole
filesystem as Z:, which is how the silent attempt reached that same file
in the first place, so that is the fallback now.

The installer is also copied into the app when this happens, so
`proteus fix` works on it afterwards and the wrapper stops depending on
a file in Downloads that may well be tidied away.

Around it, the failure stops being a dead end. The error carries the
half-built app and the installer, the app is no longer rolled back in
this one case — deleting it left the person holding an explanation and
nothing to act on — and the screen offers to open the installer instead
of a "Try again" that would take the identical silent path and stop in
the identical place.

Also removes the empty quotation marks from the error text. Without
Screen Recording permission there is no title to name, and `it stopped
on ""` reads as a bug rather than as a fact.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U1pWLDQqcrSEAq7AYSYvam

Author: dev-jackson

Sources/ProteusApp/AppState.swift

@@ -23,6 +23,9 @@ final class AppState: ObservableObject {
         case installing(InstallPipeline.Stage)
         case done(InstallPipeline.Outcome)
         case failed(String)
+        /// A failure with a way out: the installer refuses to run unattended,
+        /// and the half-built app is still there to run it in, visibly.
+        case needsInstallerUI(message: String, app: URL, installer: URL)
     }
 
     @Published var phase: Phase = .idle
@@ -84,6 +87,26 @@ final class AppState: ObservableObject {
         }
     }
 
+    /// Runs an installer with its own interface, for the case where silent
+    /// mode has nobody to answer it. Blocks until the person finishes, then
+    /// completes the wrapper around whatever they installed.
+    func showInstaller(app: URL, installer: URL) {
+        phase = .installing(.init(en: "Opening the installer — answer it and it will carry on",
+                                  es: "Abriendo el instalador — respóndelo y seguirá",
+                                  fraction: nil))
+        currentTask = Task {
+            do {
+                try await pipeline.runInstallerInteractively(app: app, installer: installer)
+                let outcome = try await pipeline.finishInterrupted(app: app) { stage in
+                    Task { @MainActor in self.phase = .installing(stage) }
+                }
+                phase = .done(outcome)
+            } catch {
+                phase = .failed(readable(error))
+            }
+        }
+    }
+
     func install() {
         guard case .review(let analysis, let source) = phase else { return }
         let name = editedName.trimmingCharacters(in: .whitespacesAndNewlines)

Sources/ProteusApp/ContentView.swift

@@ -46,6 +46,8 @@ struct ContentView: View {
             DoneCard(outcome: outcome)
         case .failed(let message):
             FailureCard(message: message)
+        case .needsInstallerUI(let message, let app, let installer):
+            NeedsInstallerUICard(message: message, app: app, installer: installer)
         }
     }
 
@@ -64,6 +66,7 @@ struct ContentView: View {
         case .installing: return "installing"
         case .done: return "done"
         case .failed: return "failed"
+        case .needsInstallerUI: return "needsInstallerUI"
         }
     }
 
@@ -373,6 +376,46 @@ struct DoneCard: View {
 
 // MARK: - Failure
 
+/// The failure that is not a dead end.
+///
+/// An installer that stops to ask a question has not broken — it is waiting,
+/// and the answer is a person. Proteus can already run an installer with its
+/// interface visible; what was missing was saying so at the moment it matters,
+/// instead of showing the same red cross and a "Try again" that would take the
+/// identical silent path and stop in the identical place.
+struct NeedsInstallerUICard: View {
+    @EnvironmentObject var state: AppState
+    let message: String
+    let app: URL
+    let installer: URL
+
+    var body: some View {
+        VStack(spacing: 16) {
+            Spacer()
+            Image(systemName: "hand.raised.fill")
+                .font(.system(size: 42))
+                .foregroundStyle(.orange)
+            Text(S.installerAsksTitle).font(.title2.weight(.semibold))
+            Text(message)
+                .multilineTextAlignment(.center)
+                .foregroundStyle(.secondary)
+                .frame(maxWidth: 430)
+                .textSelection(.enabled)
+            Button(S.showInstaller) { state.showInstaller(app: app, installer: installer) }
+                .buttonStyle(.borderedProminent)
+            Text(S.showInstallerHint)
+                .font(.footnote)
+                .foregroundStyle(.secondary)
+                .multilineTextAlignment(.center)
+                .frame(maxWidth: 400)
+            Button(S.cancel) { state.reset() }
+                .buttonStyle(.link)
+            Spacer()
+        }
+        .padding(30)
+    }
+}
+
 struct FailureCard: View {
     @EnvironmentObject var state: AppState
     let message: String

Sources/ProteusApp/Strings.swift

@@ -115,6 +115,17 @@ enum S {
         Lang.pick("Saved. It takes effect next time you play.",
                   "Guardado. Se aplica la próxima vez que juegues.")
     }
+    static var installerAsksTitle: String {
+        Lang.pick("This installer is asking something", "Este instalador está preguntando algo")
+    }
+    static var showInstaller: String {
+        Lang.pick("Show me the installer", "Muéstrame el instalador")
+    }
+    static var showInstallerHint: String {
+        Lang.pick("Its own window will open. Answer it, and Proteus finishes the rest.",
+                  "Se abrirá su propia ventana. Respóndela y Proteus termina el resto.")
+    }
+
     static var close: String { Lang.pick("Close", "Cerrar") }
     static var doubleClickToPlay: String {
         Lang.pick("Double-click to play", "Doble clic para jugar")

Sources/ProteusCore/Pipeline.swift

@@ -61,8 +61,10 @@ public actor InstallPipeline {
         case installerFailed(String)
         case notEnoughSpace(needed: Int64, free: Int64)
         /// The installer is not failing, it is asking — and a silent install
-        /// has nobody to answer it.
-        case installerNeedsAttention(String)
+        /// has nobody to answer it. Carries the half-built app, because the
+        /// only way past this is to run the installer inside it with its
+        /// interface showing, and that app must therefore survive.
+        case installerNeedsAttention(question: String, app: URL, installer: URL)
 
         public var description: String {
             switch self {
@@ -73,9 +75,13 @@ public actor InstallPipeline {
             case .notEnoughSpace(let needed, let free):
                 return "this game needs about \(InstallPipeline.readableSize(needed)) and there is only "
                     + "\(InstallPipeline.readableSize(free)) free. Free up some space and try again."
-            case .installerNeedsAttention(let question):
-                return "this installer will not run unattended — it stopped on \"\(question)\" "
-                    + "and waited. Run it with its own interface and answer it."
+            case .installerNeedsAttention(let question, _, _):
+                // Named only when the title could be read; without Screen
+                // Recording permission it cannot be, and an empty pair of
+                // quotation marks reads as a bug rather than as a fact.
+                let about = question.isEmpty ? "" : " on \"\(question)\""
+                return "this installer will not run unattended — it stopped\(about) and waited. "
+                    + "It needs to be run with its own interface so someone can answer it."
             }
         }
     }
@@ -363,8 +369,18 @@ public actor InstallPipeline {
         let gameDir: URL
         if source.needsInstaller {
             progress(.init(en: "Running the installer", es: "Ejecutando el instalador", fraction: 0.72))
-            gameDir = try runInstaller(source: source, wrapper: wrapper, engine: engine,
-                                       name: gameName, warnings: &warnings, progress: progress)
+            do {
+                gameDir = try runInstaller(source: source, wrapper: wrapper, engine: engine,
+                                           name: gameName, warnings: &warnings, progress: progress)
+            } catch let error as PipelineError {
+                // An installer that stopped to ask is the one failure where
+                // the half-built app must survive: running that installer
+                // again, with its interface showing, is the only way past it,
+                // and it has to be run inside this wrapper. Rolling back would
+                // leave the person holding an explanation and no way to act.
+                if case .installerNeedsAttention = error { succeeded = true }
+                throw error
+            }
         } else {
             progress(.init(en: "Copying game files", es: "Copiando archivos del juego", fraction: 0.72))
             gameDir = try copyPortable(source: source, into: wrapper, name: gameName)
@@ -675,12 +691,29 @@ public actor InstallPipeline {
     public func runInstallerInteractively(app: URL, installer: URL) throws {
         let wrapper = Wrapper(bundle: app)
         let engine = WineEngine(wrapper: wrapper)
-        guard let winPath = wrapper.windowsPath(for: installer) else { return }
+
+        // The installer is almost never inside the wrapper — it is wherever the
+        // person keeps their downloads. `windowsPath` only maps C:, so it
+        // returned nil for the ordinary case and the guard turned the whole
+        // function into a silent no-op: the window never appeared, and the
+        // report was "you never see the installer", which was exactly right.
+        //
+        // Wine maps the entire filesystem as Z:, which is how the silent run
+        // reached this same file in the first place.
+        let winPath = wrapper.windowsPath(for: installer) ?? Self.zDrivePath(for: installer)
+
+        // Nothing hidden and nothing answered on the person's behalf: this is
+        // the run where they are supposed to see it and decide.
         _ = try engine.run([winPath], timeout: 3600)
         engine.waitForServerIdle()
         engine.killServer()
     }
 
+    /// A macOS path as Wine sees it on the Z: drive.
+    static func zDrivePath(for url: URL) -> String {
+        "Z:" + url.standardizedFileURL.path.replacingOccurrences(of: "/", with: "\\")
+    }
+
     // MARK: - Steps
 
     func copyPortable(source: GameSource, into wrapper: Wrapper, name: String) throws -> URL {
@@ -785,9 +818,15 @@ public actor InstallPipeline {
             // interface, which is the only thing that can get past this.
             if let question = result.waitingOn {
                 engine.killServer()
-                warnings.append("The installer stopped to ask something (\"\(question)\"). "
+                warnings.append("The installer stopped to ask something. "
                     + "It needs to be run with its own interface.")
-                throw PipelineError.installerNeedsAttention(question)
+                // Kept inside the app, so `proteus fix` works on it later and
+                // the wrapper does not depend on a file in Downloads that the
+                // person may well tidy away. The original path is still used
+                // if copying fails — a stub of a stub helps nobody.
+                let reachable = stashInstaller(installer, in: wrapper) ?? installer
+                throw PipelineError.installerNeedsAttention(
+                    question: question, app: wrapper.bundle, installer: reachable)
             }
 
             if installedSomething(at: targetURL) { return targetURL }

Sources/ProteusCore/WineEngine.swift

@@ -448,6 +448,13 @@ public struct WineEngine {
         return found ? "" : nil
     }
 
+    /// The path with every symlink resolved, the way the kernel reports it.
+    static func realPath(_ path: String) -> String {
+        var buffer = [CChar](repeating: 0, count: Int(PATH_MAX))
+        guard realpath(path, &buffer) != nil else { return path }
+        return String(cString: buffer)
+    }
+
     /// The size of wine's own virtual-desktop window, which every process gets
     /// and which therefore means nothing on its own.
     static let wineDesktopSize: Double = 500
@@ -480,10 +487,15 @@ public struct WineEngine {
     /// `…/SharedSupport/wine/Runtime.app/Contents/MacOS/`. A path inside this
     /// bundle is exact, cheap, and cannot be lost by reparenting.
     static func processes(inBundle bundlePath: String) -> (cpu: Double, pids: Set<pid_t>) {
-        // Resolved, because `proc_pidpath` always reports the real path and a
-        // bundle reached through a symlink would never match it. `/tmp` is
-        // `/private/tmp`, which is enough to make this silently find nothing.
-        let root = URL(fileURLWithPath: bundlePath).resolvingSymlinksInPath().path
+        // Resolved with `realpath`, and not with `resolvingSymlinksInPath`,
+        // which was the first attempt and does not work.
+        //
+        // `proc_pidpath` always reports the real path — `/private/tmp/…` — and
+        // Foundation deliberately leaves `/tmp` alone, treating it as the
+        // canonical spelling. So the comparison silently matched nothing, the
+        // process list came back empty, and with it the CPU reading and the
+        // dialogue check. Caught by a reproduction installed under /tmp.
+        let root = Self.realPath(bundlePath)
         let listing = Shell.run("/bin/ps", ["-Ao", "pid=,pcpu="])
         guard listing.exitCode == 0 else { return (0, []) }
 

Tests/ProteusCoreTests/InstallProgressTests.swift

@@ -227,3 +227,30 @@ final class InstallLivenessTests: XCTestCase {
         XCTAssertEqual(whole, 40_000, "uncapped, every byte is counted")
     }
 }
+
+/// The path that turned "run it with its interface" into a button that did
+/// nothing at all.
+final class InteractiveInstallerPathTests: XCTestCase {
+
+    /// An installer sitting in Downloads — which is where every installer
+    /// sits — is not inside the wrapper, so the C: mapping cannot name it.
+    /// `windowsPath` returning nil used to end the function early, silently,
+    /// and the window the person was told to answer never appeared.
+    func testAnInstallerOutsideTheWrapperStillGetsAWindowsPath() {
+        let wrapper = Wrapper(bundle: URL(fileURLWithPath: "/Applications/Game.app"))
+        let installer = URL(fileURLWithPath: "/Users/someone/Downloads/setup.exe")
+
+        XCTAssertNil(wrapper.windowsPath(for: installer),
+                     "it is outside C: — that is the premise of this test")
+
+        let fallback = InstallPipeline.zDrivePath(for: installer)
+        XCTAssertEqual(fallback, "Z:\\Users\\someone\\Downloads\\setup.exe")
+    }
+
+    func testAnInstallerInsideTheWrapperKeepsItsDriveCPath() {
+        let wrapper = Wrapper(bundle: URL(fileURLWithPath: "/Applications/Game.app"))
+        let inside = wrapper.driveC.appendingPathComponent("Games/Thing/setup.exe")
+
+        XCTAssertEqual(wrapper.windowsPath(for: inside), "C:\\Games\\Thing\\setup.exe")
+    }
+}

Tests/fixtures/stuck-installer.iss

@@ -44,26 +44,6 @@
 ; purpose. So there is probably no free game with this shape to be found, and
 ; looking harder is not the answer — building it is.
 ;
-; ## Status: incomplete
-;
-; Honest note, because a fixture that is believed to work and does not is worse
-; than none — that is the mistake this whole exercise came out of.
-;
-; This compiles and runs. It does **not** yet hang under
-; `/VERYSILENT /SUPPRESSMSGBOXES`, which is the behaviour being chased. Two
-; placements were tried: `InitializeSetup`, which runs before there is a GUI to
-; put a window on, and `CurStepChanged(ssInstall)`, which runs but whose
-; `ShowModal` returns immediately when Inno is in silent mode.
-;
-; So a real repack is doing something further: a custom unpacker with its own
-; window (ISDone.dll and similar are common), or a form shown from a thread
-; Inno's silent handling does not own. Finding out which is the remaining work.
-;
-; What is already reproducible for free, and what the integration test uses, is
-; OpenTTD's installer run *without* silent flags: a genuine installer sitting
-; on a genuine dialogue, detected by geometry at 298×134 while the wine desktop
-; windows at 500×500 are ignored.
-;
 ; ## Building it
 ;
 ;     ISCC.exe stuck-installer.iss
@@ -89,51 +69,17 @@ Source: "stuck-payload.txt"; DestDir: "{app}"
 Source: "stuck-payload.txt"; DestDir: "{app}"; DestName: "selective-english.txt"
 Source: "stuck-payload.txt"; DestDir: "{app}"; DestName: "selective-french.txt"
 
-[Code]
-// The component chooser, as a form the script owns.
-//
-// Inno's silent switches do not reach this. A repack that asks which language
-// packs to install does exactly this, and that is why such an installer sits
-// there forever under automation instead of failing.
-// Shown once the install is actually under way.
-//
-// `InitializeSetup` runs before there is a GUI to put a window on, and the
-// form never appears — the first attempt at this exited cleanly and proved
-// nothing. `ssInstall` is the moment a real repack asks which language packs
-// it should unpack, which is exactly where they stop.
-procedure CurStepChanged(CurStep: TSetupStep);
-var
-  Form: TSetupForm;
-  Prompt: TNewStaticText;
-  Proceed: TNewButton;
-begin
-  if CurStep <> ssInstall then Exit;
-  Form := TSetupForm.Create(nil);
-  try
-    Form.Caption := 'Setup';
-    Form.ClientWidth := ScaleX(320);
-    Form.ClientHeight := ScaleY(130);
-
-    Prompt := TNewStaticText.Create(Form);
-    Prompt.Parent := Form;
-    Prompt.Left := ScaleX(16);
-    Prompt.Top := ScaleY(20);
-    Prompt.Width := ScaleX(288);
-    Prompt.WordWrap := True;
-    Prompt.Caption := 'Choose which language packs to install.';
-
-    Proceed := TNewButton.Create(Form);
-    Proceed.Parent := Form;
-    Proceed.Left := ScaleX(220);
-    Proceed.Top := ScaleY(88);
-    Proceed.Width := ScaleX(84);
-    Proceed.Height := ScaleY(26);
-    Proceed.Caption := 'Continue';
-    Proceed.ModalResult := mrOk;
-
-    // Nothing answers this when no one is watching.
-    Form.ShowModal;
-  finally
-    Form.Free;
-  end;
-end;
+[Run]
+; This is the mechanism, and it is not a wizard page.
+;
+; `/VERYSILENT` governs Inno's own interface. It has no authority over a
+; *separate program* the installer is told to run and wait for — [Run] entries
+; execute in silent mode too, unless marked `skipifsilent`, and this one is
+; not. So Setup launches something with a window of its own and blocks until
+; it closes, which nobody is there to do.
+;
+; That is what a repack does with its unpacker: a second executable, its own
+; window, the installer waiting on it. Notepad stands in for the unpacker
+; because it ships with Wine and does the one thing that matters — it opens a
+; window and waits.
+Filename: "{sys}\notepad.exe"; Flags: waituntilterminated