replace daemon with request drop

.github/workflows/release.yml

@@ -38,53 +38,191 @@ jobs:
           (cd package && zip -r "../${archive}" LICENSE setup.ps1 PolicyDefinitions)
 
       - name: Create or update release
-        uses: actions/github-script@v7
+        shell: bash
         env:
-          SHORT_SHA: ${{ env.SHORT_SHA }}
+          ACTION_TOKEN: ${{ github.token }}
-          ARCHIVE: ${{ env.ARCHIVE }}
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-        with:
+        run: |
-          script: |
+          set -euo pipefail
-            const fs = require('fs');
-            const path = require('path');
 
-            const owner = context.repo.owner;
+          token="${RELEASE_TOKEN:-${ACTION_TOKEN:-}}"
-            const repo = context.repo.repo;
+          : "${token:?No release token available}"
-            const tag = process.env.SHORT_SHA;
+          : "${GITHUB_API_URL:?GITHUB_API_URL is required}"
-            const archive = process.env.ARCHIVE;
+          : "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
+          : "${GITHUB_SHA:?GITHUB_SHA is required}"
+          : "${SHORT_SHA:?SHORT_SHA is required}"
+          : "${ARCHIVE:?ARCHIVE is required}"
 
-            let release;
+          api="${GITHUB_API_URL}"
-            try {
+          repo="${GITHUB_REPOSITORY}"
-              const existing = await github.rest.repos.getReleaseByTag({ owner, repo, tag });
+          tag="${SHORT_SHA}"
-              release = existing.data;
+          archive="${ARCHIVE}"
-            } catch (error) {
+          asset_name="$(basename "${archive}")"
-              if (error.status !== 404) throw error;
+          encoded_asset_name="$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "${asset_name}")"
-              const created = await github.rest.repos.createRelease({
+
-                owner,
+          if [ "${GITEA_ACTIONS:-}" = "true" ]; then
-                repo,
+            platform="gitea"
-                tag_name: tag,
+            auth_header="Authorization: token ${token}"
-                target_commitish: context.sha,
+          else
-                name: tag,
+            platform="github"
-                body: `Automated build for ${context.sha}.`,
+            auth_header="Authorization: Bearer ${token}"
-              });
+          fi
-              release = created.data;
+
+          tmpdir="$(mktemp -d)"
+          trap 'rm -rf "${tmpdir}"' EXIT
+
+          curl_json() {
+            local method="$1"
+            local url="$2"
+            local out="$3"
+            shift 3
+
+            curl -sS -L \
+              -X "${method}" \
+              -H "Accept: application/json" \
+              -H "${auth_header}" \
+              "$@" \
+              -o "${out}" \
+              -w "%{http_code}" \
+              "${url}"
           }
 
-            const assetName = path.basename(archive);
+          python3 - <<'PY' > "${tmpdir}/create-release.json"
-            for (const asset of release.assets || []) {
+          import json
-              if (asset.name === assetName) {
+          import os
-                await github.rest.repos.deleteReleaseAsset({ owner, repo, asset_id: asset.id });
-              }
-            }
 
-            const data = fs.readFileSync(archive);
+          print(json.dumps({
-            await github.rest.repos.uploadReleaseAsset({
+              "tag_name": os.environ["SHORT_SHA"],
-              owner,
+              "target_commitish": os.environ["GITHUB_SHA"],
-              repo,
+              "name": os.environ["SHORT_SHA"],
-              release_id: release.id,
+              "body": f"Automated build for {os.environ['GITHUB_SHA']}.",
-              name: assetName,
+              "draft": False,
-              data,
+              "prerelease": False,
-              headers: {
+          }))
-                'content-type': 'application/zip',
+          PY
-                'content-length': data.length,
+
-              },
+          release_json="${tmpdir}/release.json"
-            });
+
+          status="$(
+            curl_json GET \
+              "${api}/repos/${repo}/releases/tags/${tag}" \
+              "${release_json}"
+          )"
+
+          if [ "${status}" = "404" ]; then
+            status="$(
+              curl_json POST \
+                "${api}/repos/${repo}/releases" \
+                "${release_json}" \
+                -H "Content-Type: application/json" \
+                --data-binary "@${tmpdir}/create-release.json"
+            )"
+
+            if [ "${status}" != "201" ]; then
+              echo "Failed to create release. HTTP ${status}"
+              cat "${release_json}"
+              exit 1
+            fi
+          elif [ "${status}" != "200" ]; then
+            echo "Failed to look up release. HTTP ${status}"
+            cat "${release_json}"
+            exit 1
+          fi
+
+          release_id="$(
+            python3 -c 'import json, sys; print(json.load(open(sys.argv[1]))["id"])' \
+              "${release_json}"
+          )"
+
+          assets_json="${tmpdir}/assets.json"
+
+          status="$(
+            curl_json GET \
+              "${api}/repos/${repo}/releases/${release_id}/assets" \
+              "${assets_json}"
+          )"
+
+          if [ "${status}" != "200" ]; then
+            echo "Failed to list release assets. HTTP ${status}"
+            cat "${assets_json}"
+            exit 1
+          fi
+
+          existing_asset_id="$(
+            python3 - "${assets_json}" "${asset_name}" <<'PY'
+          import json
+          import sys
+
+          assets = json.load(open(sys.argv[1]))
+          wanted = sys.argv[2]
+
+          for asset in assets:
+              if asset.get("name") == wanted:
+                  print(asset["id"])
+                  break
+          PY
+          )"
+
+          if [ -n "${existing_asset_id}" ]; then
+            delete_json="${tmpdir}/delete-asset.json"
+
+            if [ "${platform}" = "gitea" ]; then
+              delete_url="${api}/repos/${repo}/releases/${release_id}/assets/${existing_asset_id}"
+            else
+              delete_url="${api}/repos/${repo}/releases/assets/${existing_asset_id}"
+            fi
+
+            status="$(curl_json DELETE "${delete_url}" "${delete_json}")"
+
+            case "${status}" in
+              200|204) ;;
+              *)
+                echo "Failed to delete existing asset. HTTP ${status}"
+                cat "${delete_json}"
+                exit 1
+                ;;
+            esac
+          fi
+
+          upload_json="${tmpdir}/upload-asset.json"
+
+          if [ "${platform}" = "gitea" ]; then
+            status="$(
+              curl -sS -L \
+                -X POST \
+                -H "Accept: application/json" \
+                -H "${auth_header}" \
+                -F "attachment=@${archive};type=application/zip" \
+                -o "${upload_json}" \
+                -w "%{http_code}" \
+                "${api}/repos/${repo}/releases/${release_id}/assets?name=${encoded_asset_name}"
+            )"
+          else
+            upload_url="$(
+              python3 -c 'import json, sys; print(json.load(open(sys.argv[1]))["upload_url"].split("{", 1)[0])' \
+                "${release_json}"
+            )"
+
+            status="$(
+              curl -sS -L \
+                -X POST \
+                -H "Accept: application/vnd.github+json" \
+                -H "${auth_header}" \
+                -H "Content-Type: application/zip" \
+                --data-binary "@${archive}" \
+                -o "${upload_json}" \
+                -w "%{http_code}" \
+                "${upload_url}?name=${encoded_asset_name}"
+            )"
+          fi
+
+          case "${status}" in
+            200|201)
+              echo "Uploaded ${asset_name} to ${platform} release ${tag}."
+              ;;
+            *)
+              echo "Failed to upload release asset. HTTP ${status}"
+              cat "${upload_json}"
+              exit 1
+              ;;
+          esac

.gitignore

@@ -0,0 +1 @@
+dist/

README.md

@@ -2,15 +2,19 @@
 
 Windows self-service software catalog backed by `winget`.
 
-Users install approved software through a small GUI or request helper. A SYSTEM scheduled task runs a named-pipe daemon, authenticates the connecting Windows user, validates requests against Group Policy, then runs `winget install --scope machine`.
+Users install approved software through a small GUI or request helper. User tools write request files to a controlled drop directory. A SYSTEM scheduled task validates those requests against Group Policy, queues approved work, then runs a SYSTEM `winget` worker.
 
 ## What It Does
 
 - Reads allowed software from GPO registry policy.
 - Lets users install/uninstall only catalog entries allowed by policy.
 - Installs required software automatically.
+- Blocks user removal of required software.
+- Queues install, uninstall, and upgrade actions.
+- Shows current queue task and progress in the GUI.
 - Runs `winget upgrade --all` every 2 hours.
 - Tracks installed state from `winget export`, not from request history.
+- Polls user request files every minute; no long-lived user-facing daemon is required.
 
 ## Policy
 
@@ -68,8 +72,16 @@ Generated files are written to:
 C:\ProgramData\__Softwarekatalog\
 ```
 
+Runtime request files are written below:
+
+```text
+C:\ProgramData\__Softwarekatalog\Requests\
+C:\ProgramData\__Softwarekatalog\Processed\
+C:\ProgramData\__Softwarekatalog\Failed\
+```
+
 ## Notes
 
 - Requires Windows, Desktop App Installer, and `winget`.
-- The daemon runs as `LocalSystem`; keep catalog policy restricted to trusted admins.
+- SYSTEM scheduled tasks validate and execute requests; keep catalog policy restricted to trusted admins.
 - Package IDs and silent machine-scope support depend on upstream `winget` packages.

scripts/build-dist.sh

@@ -17,7 +17,7 @@ cat > "$out" <<EOF
 # ASCII-only bootstrap generated from setup.ps1. Do not edit.
 [CmdletBinding()]
 param(
-    [ValidateSet('Install','Daemon','UpgradeAll','ApplyPolicy','ProcessRequest')]
+    [ValidateSet('Install','UpgradeAll','ApplyPolicy','ProcessQueue','ProcessRequest','ProcessRequests')]
     [string]\$Mode = 'Install',
     [ValidateSet('Install','Uninstall')]
     [string]\$RequestAction = 'Install',