Maintain portable installation integrity and document exceptions

.github/workflows/build-release.yml

@@ -295,6 +295,7 @@ jobs:
 
           # Zip
           Compress-Archive -Path "unigetui_bin/*" -DestinationPath "output/UniGetUI.$Platform.zip" -CompressionLevel Optimal
+          Compress-Archive -Path "InstallerExtras/ForceUniGetUIPortable" -DestinationPath "output/UniGetUI.$Platform.zip" -Update
 
           # Installer is created in output during the previous step
 

README.md

@@ -67,6 +67,8 @@ UniGetUI is primarily built for Windows. The Microsoft Store is the recommended
 ![GitHub Release](https://img.shields.io/github/v/release/Devolutions/UniGetUI?style=for-the-badge)
 Use the installer for the best Windows experience. `UniGetUI.Installer.exe` is the legacy/default x64 installer alias; use the explicit architecture downloads if needed.
 
+The `.zip` is portable: it keeps settings and caches next to the executable rather than in your user profile. See [docs/PORTABLE.md](docs/PORTABLE.md).
+
 | Architecture | Installer | Portable `.zip` |
 |---|---|---|
 | x64 | [UniGetUI.Installer.x64.exe](https://github.com/Devolutions/UniGetUI/releases/latest/download/UniGetUI.Installer.x64.exe) ([default x64 alias](https://github.com/Devolutions/UniGetUI/releases/latest/download/UniGetUI.Installer.exe)) | [UniGetUI.x64.zip](https://github.com/Devolutions/UniGetUI/releases/latest/download/UniGetUI.x64.zip) |

docs/PORTABLE.md

@@ -10,6 +10,9 @@ outside the installation folder. Portable mode moves all of that next to the exe
 whole application, settings included, can live on a removable drive or be copied between
 machines. A few things deliberately stay outside that folder; see [What changes](#what-changes).
 
+The Windows `.zip` release ships in portable mode. The installer, and the macOS and Linux
+archives, do not.
+
 ## Enabling portable mode
 
 Portable mode is controlled by a single marker file named `ForceUniGetUIPortable`, placed in
@@ -50,9 +53,11 @@ New-Item -ItemType File -Path "C:\Path\To\UniGetUI\ForceUniGetUIPortable"
 touch /path/to/unigetui/ForceUniGetUIPortable
 ```
 
-This is how you make the portable `.zip` and `.tar.gz` release archives actually portable.
-They ship **without** the marker, so out of the box they still write to the per-user data
-directory like a regular install.
+The Windows `.zip` already ships with the marker, so it is portable out of the box; creating
+the file by hand is only needed for the macOS and Linux `.tar.gz` archives, which do not carry
+it. Deleting the marker is the supported way to turn portable mode back off in the `.zip`, and
+it is deliberately excluded from `IntegrityTree.json` so removing it cannot fail the integrity
+check.
 
 ### Where the marker goes
 
@@ -76,22 +81,54 @@ whenever the bundle is replaced by an update. Re-create it after upgrading.
 | Cached language files | `<data dir>\CachedLanguageFiles` | `<install dir>\Settings\CachedLanguageFiles` |
 | Stored secrets, macOS and Linux | `<data dir>/SecureStorage` | `<install dir>/Settings/SecureStorage` |
 | Stored secrets, Windows | Credential Manager | Credential Manager (**not** relocated) |
-| Default package-backup folder | `Documents\UniGetUI` | `Documents\UniGetUI` (**not** relocated) |
-
-Package backups are one exception: their default location stays in the user's Documents
-folder, and portable mode does not move it. Point it somewhere inside the portable folder from
-the Backup settings page if you want backups to travel with the app.
-
-The GitHub backup token is the other exception, and where it lives depends on the platform. On
-macOS and Linux it is written to `SecureStorage` inside the data directory, so it travels with a
-portable folder, as a plain file on disk. On Windows it is held in Credential Manager instead,
-so a portable copy does not carry the login, and every portable copy on one machine shares
-the same stored token unless `UNIGETUI_GITHUB_TOKEN_NAMESPACE` is set to separate them.
+| Session log, WebView2 profile, update logs | `%TEMP%\UniGetUI` on Windows; `$TMPDIR/UniGetUI` elsewhere | `<install dir>\Settings\Temp` |
+| Default package-backup folder | `Documents\UniGetUI` | `<install dir>\Settings\Backups` |
+| Elevated secure settings, Windows | `%ProgramFiles%\UniGetUI\SecureSettings` | `%ProgramFiles%\UniGetUI\SecureSettings` (**not** relocated) |
+
+Package backups follow the portable folder, so they travel with the app. A path chosen on the
+Backup settings page always wins over that default.
+
+Two things deliberately stay put. Elevated secure settings — the toggles that permit CLI
+arguments, custom manager paths and pre/post-operation commands — live under `%ProgramFiles%`
+precisely because writing there needs administrator rights. Moving them into a user-writable
+portable folder would let any process running as the user grant UniGetUI the right to execute
+arbitrary commands, so they stay where they are.
+
+The scratch directory holds files that are rebuilt on demand: the session log, the crash report
+left behind for the next launch, the per-attempt auto-updater log, the WebView2 profile, and the
+`%TEMP%` handed to package-manager subprocesses when UniGetUI runs elevated. Portable mode moves
+it inside the portable folder, so a portable copy leaves nothing behind in the system temporary
+directory. It is safe to delete while UniGetUI is not running.
+
+The GitHub backup token is the second, and where it lives depends on the platform. On Windows it
+is held in Credential Manager, which encrypts it per user and does not travel with the folder, so
+a portable copy asks you to sign in on each machine. On macOS and Linux it is written to
+`SecureStorage` inside the data directory **as a plain file**, so it does travel — treat a
+portable folder carrying one as you would the token itself. Relocating the Windows token into the
+portable folder would mean that same plaintext trade-off, on removable media, so it stays in
+Credential Manager. Every portable copy on one machine shares the same stored token unless
+`UNIGETUI_GITHUB_TOKEN_NAMESPACE` is set to separate them.
 
 Portable mode also does not relocate anything owned by the package managers themselves. WinGet,
 Scoop, Chocolatey, npm and the rest keep their own state in their usual per-user or system
 locations, and the packages they install are installed normally.
 
+## Importing settings from a per-user installation
+
+A portable folder starts empty, so an existing installation's settings are not picked up
+automatically — they stay in the per-user data directory, untouched.
+
+The first time UniGetUI runs portable and finds settings there, it offers a one-time
+**Import** action in a notification. Accepting copies `Configuration` and `InstallationOptions`
+into the portable folder; caches are skipped because they are rebuilt on demand and are far
+larger than the settings themselves. Nothing is overwritten and nothing is removed from the
+source, so a per-user installation on the same machine keeps working. Restart UniGetUI
+afterwards for the imported settings to take effect.
+
+Dismissing the notification, or importing once, stops it from appearing again. This matters for
+a portable copy carried between machines: it will never silently absorb the settings of a
+machine it happens to be plugged into.
+
 ## What a portable install does not register
 
 The Windows installer registers these only for a regular installation, so a portable install

src/Shared/AutoUpdater.InstallerArguments.cs

@@ -0,0 +1,24 @@
+namespace UniGetUI.Shared;
+
+internal static class AutoUpdaterInstallerArguments
+{
+    private const string CommonWindowsArguments =
+        "/SILENT /SUPPRESSMSGBOXES /NORESTART /SP- /NoVCRedist /NoEdgeWebView /NoWinGet /NoRedirectionGuard /NoDesktopShortcut";
+
+    /// <summary>
+    /// Arguments for the Windows installer when it is run to update an existing copy.
+    /// A portable copy is pinned to its own directory and re-selects the portable task,
+    /// because the installer would otherwise fall back to its default directory and
+    /// install a second, regular copy elsewhere.
+    /// </summary>
+    internal static string ForWindows(bool isPortable, string installationDirectory)
+    {
+        if (!isPortable || string.IsNullOrWhiteSpace(installationDirectory))
+        {
+            return CommonWindowsArguments;
+        }
+
+        string directory = installationDirectory.TrimEnd('\\', '/');
+        return $"{CommonWindowsArguments} /TASKS=\"portableinstall\" /DIR=\"{directory}\"";
+    }
+}

src/UniGetUI.Avalonia/App.axaml.cs

@@ -290,7 +290,7 @@ public static void ApplyTheme(string value)
     }
 
     public static string WebViewUserDataFolder { get; } =
-        Path.Join(Path.GetTempPath(), "UniGetUI", "WebView");
+        Path.Join(AppPaths.ScratchDirectory, "WebView");
 
     private static void SetUpWebViewUserDataFolder()
     {

src/UniGetUI.Avalonia/CrashHandler.cs

@@ -11,7 +11,7 @@ namespace UniGetUI.Avalonia;
 public static class CrashHandler
 {
     public static readonly string PendingCrashFile =
-        Path.Combine(Path.GetTempPath(), "UniGetUI_pending_crash.txt");
+        Path.Combine(AppPaths.ScratchDirectory, "pending_crash.txt");
 
     private const string NO_CORRUPT_DIALOG = "--no-corrupt-dialog";
 
@@ -223,6 +223,7 @@ Inner exception details (depth level: {{i}})
         // Persist crash data so the next normal app launch can show the report.
         try
         {
+            Directory.CreateDirectory(Path.GetDirectoryName(PendingCrashFile)!);
             File.WriteAllText(PendingCrashFile, Error_String, Encoding.UTF8);
         }
         catch

src/UniGetUI.Avalonia/Infrastructure/AvaloniaAppHost.cs

@@ -60,6 +60,8 @@ public static void Run(string[] args)
         AppDomain.CurrentDomain.UnhandledException += (_, e) =>
             CrashHandler.ReportFatalException((Exception)e.ExceptionObject);
 
+        ProcessEnvironmentConfigurator.ConfigurePingetStorage();
+
         if (ShouldPrepareCliConsole(args))
         {
             WindowsConsoleHost.PrepareCliIO();

src/UniGetUI.Avalonia/Infrastructure/AvaloniaAutoUpdater.cs

@@ -14,6 +14,7 @@
 using UniGetUI.Core.Logging;
 using UniGetUI.Core.SettingsEngine;
 using UniGetUI.Core.Tools;
+using UniGetUI.Shared;
 
 namespace UniGetUI.Avalonia.Infrastructure;
 
@@ -106,8 +107,7 @@ private static void RaiseStatus(
     private static readonly Lock _updateLogLock = new();
     private static StringBuilder? _updateLogBuilder;
     private static readonly string _updateLogPath = Path.Combine(
-        Path.GetTempPath(),
-        "UniGetUI",
+        AppPaths.ScratchDirectory,
         "last-update-attempt.log"
     );
 
@@ -669,13 +669,22 @@ private static async Task LaunchInstallerAsync(string installerLocation)
             return;
         }
 
+        string installerArguments = AutoUpdaterInstallerArguments.ForWindows(
+            CoreData.IsPortable,
+            CoreData.UniGetUIExecutableDirectory);
+
+        if (CoreData.IsPortable)
+        {
+            LogUpdateInfo($"Portable install: updating in place at {CoreData.UniGetUIExecutableDirectory}");
+        }
+
         LogUpdateInfo($"Launching installer: {installerLocation}");
         using Process p = new()
         {
             StartInfo = new ProcessStartInfo
             {
                 FileName = installerLocation,
-                Arguments = "/SILENT /SUPPRESSMSGBOXES /NORESTART /SP- /NoVCRedist /NoEdgeWebView /NoWinGet /NoRedirectionGuard /NoDesktopShortcut",
+                Arguments = installerArguments,
                 UseShellExecute = true,
                 CreateNoWindow = true,
             },

src/UniGetUI.Avalonia/Infrastructure/ProcessEnvironmentConfigurator.cs

@@ -1,4 +1,5 @@
 using System.Diagnostics;
+using UniGetUI.Core.Data;
 using UniGetUI.Core.Logging;
 using UniGetUI.Core.SettingsEngine;
 using UniGetUI.Core.Tools;
@@ -21,6 +22,42 @@ public static void PrepareForCurrentPlatform()
         ApplyProxySettingsToProcess();
     }
 
+    /// <summary>
+    /// Points Pinget at the portable folder so a portable copy leaves nothing in
+    /// %LOCALAPPDATA%\Devolutions\Pinget. The source mode has to be set alongside it:
+    /// an app-root override alone makes Pinget fall back to its own private source list
+    /// instead of the machine's real WinGet sources. An externally supplied value wins,
+    /// so an administrator can still place the store elsewhere.
+    /// </summary>
+    public static void ConfigurePingetStorage()
+    {
+        try
+        {
+            if (!CoreData.IsPortable)
+                return;
+
+            SetIfUnset("PINGET_APPROOT", Path.Join(CoreData.UniGetUIDataDirectory, "Pinget"));
+            SetIfUnset("PINGET_SOURCE_MODE", "auto");
+        }
+        catch (Exception ex)
+        {
+            Logger.Error("Could not point Pinget at the portable folder:");
+            Logger.Error(ex);
+        }
+    }
+
+    private static void SetIfUnset(string name, string value)
+    {
+        if (!string.IsNullOrEmpty(Environment.GetEnvironmentVariable(name)))
+        {
+            Logger.Info($"{name} is already set; leaving it untouched");
+            return;
+        }
+
+        Environment.SetEnvironmentVariable(name, value, EnvironmentVariableTarget.Process);
+        Logger.Info($"{name} set to {value}");
+    }
+
     public static void ApplyProxySettingsToProcess()
     {
         try

src/UniGetUI.Avalonia/UniGetUI.Avalonia.csproj

@@ -198,7 +198,7 @@
         <PackageReference Include="Avalonia.Controls.WebView" Version="12.0.0" />
         <PackageReference Include="Tmds.DBus.Protocol" Version="0.92.0" />
         <PackageReference Include="Devolutions.UniGetUI.Elevator" Version="2.6.1.3" GeneratePathProperty="true" ExcludeAssets="build;buildTransitive;native" Condition="$([MSBuild]::IsOSPlatform('Windows'))" />
-        <PackageReference Include="Devolutions.Pinget.Cli.Rust" Version="0.10.0" GeneratePathProperty="true" ExcludeAssets="build;buildTransitive;native" />
+        <PackageReference Include="Devolutions.Pinget.Cli.Rust" Version="0.11.0" GeneratePathProperty="true" ExcludeAssets="build;buildTransitive;native" />
     </ItemGroup>
 
     <ItemGroup>
@@ -218,6 +218,7 @@
       <Compile Include="..\SharedAssemblyInfo.cs" Link="SharedAssemblyInfo.cs" />
       <Compile Include="..\Shared\SharedPreUiCommandDispatcher.cs" Link="Shared\SharedPreUiCommandDispatcher.cs" />
       <Compile Include="..\Shared\StartupBundleArguments.cs" Link="Shared\StartupBundleArguments.cs" />
+      <Compile Include="..\Shared\AutoUpdater.InstallerArguments.cs" Link="Shared\AutoUpdater.InstallerArguments.cs" />
     </ItemGroup>
 
     <ItemGroup>

src/UniGetUI.Avalonia/ViewModels/MainWindowViewModel.cs

@@ -16,6 +16,7 @@
 using UniGetUI.Avalonia.Views.Pages.LogPages;
 using UniGetUI.Avalonia.Views.Pages.SettingsPages;
 using UniGetUI.Core.Data;
+using UniGetUI.Core.Logging;
 using UniGetUI.Core.SettingsEngine;
 using UniGetUI.Core.Tools;
 using UniGetUI.Interface.Enums;
@@ -160,16 +161,16 @@
     private void ToggleOperationsPanel() => OperationsPanelExpanded = !OperationsPanelExpanded;
 
     [RelayCommand]
     private void RetryFailedOperations() => AvaloniaOperationRegistry.RetryFailed();
 
     [RelayCommand]
     private void ClearSuccessfulOperations() => AvaloniaOperationRegistry.ClearSuccessful();
 
     [RelayCommand]
     private void ClearFinishedOperations() => AvaloniaOperationRegistry.ClearFinished();
 
     [RelayCommand]
     private void CancelAllOperations() => AvaloniaOperationRegistry.CancelAll();
 
     // ─── Sidebar ─────────────────────────────────────────────────────────────
     public SidebarViewModel Sidebar { get; } = new();
@@ -288,6 +289,7 @@
     public InfoBarViewModel UpdatesBanner { get; } = new() { Severity = InfoBarSeverity.Success };
     public InfoBarViewModel WinGetWarningBanner { get; } = new() { Severity = InfoBarSeverity.Warning };
     public InfoBarViewModel TelemetryWarner { get; } = new() { Severity = InfoBarSeverity.Informational };
+    public InfoBarViewModel PortableImportBanner { get; } = new() { Severity = InfoBarSeverity.Informational };
 
     // Oldest first (rendered bottom-up so the newest sits nearest the corner).
     public ObservableCollection<InfoBarViewModel> Toasts { get; } = new();
@@ -415,6 +417,7 @@
         RegisterBannerToast(UpdatesBanner);
         RegisterBannerToast(WinGetWarningBanner);
         RegisterBannerToast(TelemetryWarner);
+        RegisterBannerToast(PortableImportBanner);
 
         DiscoverPage = new DiscoverSoftwarePage();
         UpdatesPage = new SoftwareUpdatesPage();
@@ -538,6 +541,12 @@
             TelemetryWarner.IsOpen = true;
         }
 
+        if (!Settings.Get(Settings.K.ShownPortableImportBanner)
+            && PortableDataImport.FindImportableSource() is { } importableSource)
+        {
+            ShowPortableImportBanner(importableSource);
+        }
+
         if (WasUpdatedSinceLastRun() && !Settings.Get(Settings.K.DisableReleaseNotesOnUpdate))
         {
             NavigateTo(PageType.ReleaseNotes);
@@ -548,6 +557,46 @@
         }
     }
 
+    private void ShowPortableImportBanner(string importableSource)
+    {
+        PortableImportBanner.Title = CoreTools.Translate("Import your previous settings?");
+        PortableImportBanner.Message = CoreTools.Translate(
+            "UniGetUI is running in portable mode and started with empty settings. Settings from a previous installation were found at {0}.",
+            importableSource
+        );
+        PortableImportBanner.IsClosable = true;
+        PortableImportBanner.ActionButtonText = CoreTools.Translate("Import");
+        PortableImportBanner.ActionButtonCommand = new CommunityToolkit.Mvvm.Input.RelayCommand(() =>
+        {
+            Settings.Set(Settings.K.ShownPortableImportBanner, true);
+
+            try
+            {
+                int copied = PortableDataImport.Import(importableSource);
+                PortableImportBanner.Severity = InfoBarSeverity.Success;
+                PortableImportBanner.Title = CoreTools.Translate("Settings imported");
+                PortableImportBanner.Message = CoreTools.Translate(
+                    "{0} file(s) were copied. Restart UniGetUI to apply them.", copied);
+                PortableImportBanner.ActionButtonText = CoreTools.Translate("Restart");
+                PortableImportBanner.ActionButtonCommand = new CommunityToolkit.Mvvm.Input.RelayCommand(
+                    AppRestartHelper.Restart);
+            }
+            catch (Exception ex)
+            {
+                Logger.Error("Could not import settings into the portable folder");
+                Logger.Error(ex);
+                PortableImportBanner.Severity = InfoBarSeverity.Error;
+                PortableImportBanner.Title = CoreTools.Translate("Could not import settings");
+                PortableImportBanner.Message = ex.Message;
+                PortableImportBanner.ActionButtonText = CoreTools.Translate("View log");
+                PortableImportBanner.ActionButtonCommand = new CommunityToolkit.Mvvm.Input.RelayCommand(
+                    () => NavigateTo(PageType.OwnLog));
+            }
+        });
+        PortableImportBanner.OnClosed = () => Settings.Set(Settings.K.ShownPortableImportBanner, true);
+        PortableImportBanner.IsOpen = true;
+    }
+
     // Returns true the first time the app runs after being updated to a newer build
     private static bool WasUpdatedSinceLastRun()
     {