fix(release): self-contained WinAppSDK client + MSI-only installers

The v1.0.0-beta.1 client crashed on launch with "microsoft.windowsappruntime
.bootstrap.dll was not found" on any machine without the Windows App SDK runtime
installed. Two faults, both fixed:

- The stage step copied only app.exe, dropping the runtime DLLs the build places
  beside it. Now copy the whole client build output (minus Rust artifacts) and
  rename the exe.
- The client was framework-dependent (needs the runtime installed system-wide).
  Add a `self-contained` cargo feature: build.rs bundles the full WinAppSDK
  runtime next to the exe and main.rs skips the bootstrapper (which otherwise
  keeps a load-time dependency on the bootstrap shim). Release builds pass
  `--features self-contained`. Verified locally: the self-contained exe launches
  and opens its window with no runtime pre-installed; dumpbin confirms the
  bootstrap DLL is no longer a load-time import.

Also drop the MSIX output. mpdev wraps the package in its x64 Package Support
Framework launcher (to inject the Syncfusion env var), so the arm64 MSIX ships an
x64 PsfLauncher64.exe + a VFS\ProgramFilesX64 payload and fails to install with
0x80070005. Ship signed MSI + portable zip for both arches instead; revisit MSIX
later. The MSI's SmartScreen prompt is cert-reputation, not a signing fault.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: adamgell

.github/workflows/cmprojectx-codesign.yml

@@ -196,8 +196,8 @@ jobs:
           Start-Process msiexec.exe -ArgumentList "/i `"$msi`" /quiet /norestart" -Wait
           "C:\Program Files\Master Packager Ltd\Master Packager Dev" | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
 
-      - name: Build Rust client
-        run: cargo build --release --package app --target ${{ matrix.rust_target }}
+      - name: Build Rust client (self-contained Windows App SDK runtime)
+        run: cargo build --release --package app --target ${{ matrix.rust_target }} --features self-contained
 
       - name: Publish .NET sidecar (self-contained)
         run: >-
@@ -243,7 +243,18 @@ jobs:
         run: |
           $bundle = Join-Path $PWD "staging/IntuneCommander-$($env:VERSION)-${{ matrix.arch }}"
           New-Item -ItemType Directory -Force -Path $bundle | Out-Null
-          Copy-Item "target/${{ matrix.rust_target }}/release/app.exe" (Join-Path $bundle "IntuneCommander.exe") -Force
+          # Copy the ENTIRE self-contained client output — app.exe PLUS the bundled Windows App SDK
+          # runtime DLLs, the ~80 language folders, and resources.pri. Copying only app.exe ships a
+          # client that crashes on launch with "microsoft.windowsappruntime.bootstrap.dll not found"
+          # on any machine without the runtime. Exclude Rust build artifacts; rename exe to the product.
+          $rel = "target/${{ matrix.rust_target }}/release"
+          $skipDir = @('deps','build','.fingerprint','incremental','examples')
+          $skipExt = @('.pdb','.d','.rlib','.rmeta','.exp','.lib')
+          Get-ChildItem -LiteralPath $rel | Where-Object {
+            if ($_.PSIsContainer) { $skipDir -notcontains $_.Name }
+            else { ($skipExt -notcontains $_.Extension) -and ($_.Name -ne '.cargo-lock') }
+          } | Copy-Item -Destination $bundle -Recurse -Force
+          Rename-Item (Join-Path $bundle "app.exe") "IntuneCommander.exe" -Force
           Copy-Item "publish/service" (Join-Path $bundle "sidecar") -Recurse -Force
           New-Item -ItemType Directory -Force -Path (Join-Path $bundle "docs") | Out-Null
           Copy-Item "docs/RUNBOOK.md" (Join-Path $bundle "docs") -Force
@@ -264,7 +275,7 @@ jobs:
           Set-Content (Join-Path $bundle "Start-IntuneCommander.cmd") $launcher -Encoding ascii
           "bundle_dir=$bundle" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
 
-      - name: Build signed MSI + MSIX (mpdev)
+      - name: Build signed MSI (mpdev)
         shell: pwsh
         env:
           IC_BUNDLE_DIR: ${{ steps.stage.outputs.bundle_dir }}
@@ -288,17 +299,15 @@ jobs:
       - name: Verify installer output
         shell: pwsh
         run: |
-          foreach ($ext in 'msi','msix') {
+          foreach ($ext in @('msi')) {
             $f = "publish/installer/IntuneCommander-$($env:VERSION)-${{ matrix.arch }}.$ext"
             if (-not (Test-Path $f)) { Get-ChildItem publish/installer; throw "Expected installer not found: $f" }
           }
 
       - name: Attest build provenance
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
-          subject-path: |
-            publish/installer/IntuneCommander-${{ env.VERSION }}-${{ matrix.arch }}.msi
-            publish/installer/IntuneCommander-${{ env.VERSION }}-${{ matrix.arch }}.msix
+          subject-path: publish/installer/IntuneCommander-${{ env.VERSION }}-${{ matrix.arch }}.msi
 
       - name: Upload workflow artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -314,7 +323,6 @@ jobs:
         run: |
           $assets = @(
             "publish/installer/IntuneCommander-$($env:VERSION)-${{ matrix.arch }}.msi",
-            "publish/installer/IntuneCommander-$($env:VERSION)-${{ matrix.arch }}.msix",
             "publish/installer/IntuneCommander-$($env:VERSION)-win-${{ matrix.arch }}.zip"
           )
           gh release upload $env:TAG_NAME @assets --clobber

app/Cargo.toml

@@ -7,6 +7,13 @@ edition = "2024"
 license.workspace = true
 authors.workspace = true
 
+[features]
+# Release builds enable this to bundle the Windows App SDK runtime next to the
+# exe (self-contained — runs on a machine with no runtime installed). Dev builds
+# omit it and stay framework-dependent (faster; uses the installed runtime).
+# build.rs and main.rs both key off it and MUST stay in sync.
+self-contained = []
+
 [dependencies]
 api-types = { path = "../crates/api-types" }
 serde_json.workspace = true

app/build.rs

@@ -1,6 +1,12 @@
 fn main() {
-    // Link against the installed Windows App SDK runtime (2.0.1+) rather than
-    // bundling it. Mirrors crates/samples/reactor/framework-dependent and the
-    // Phase 0 reactor-gate.
-    windows_reactor_setup::as_framework_dependent();
+    // With `--features self-contained` (release builds), bundle the entire Windows
+    // App SDK runtime next to the exe so the client runs on a clean machine with no
+    // runtime pre-installed. main.rs must skip the bootstrapper in that mode.
+    // Without the feature (dev builds), stay framework-dependent: link against the
+    // installed Windows App SDK runtime (mirrors the Phase 0 reactor-gate).
+    if std::env::var_os("CARGO_FEATURE_SELF_CONTAINED").is_some() {
+        windows_reactor_setup::as_self_contained();
+    } else {
+        windows_reactor_setup::as_framework_dependent();
+    }
 }

app/src/main.rs

@@ -95,7 +95,11 @@ fn main() -> Result<()> {
     // Start (or reuse) the .NET sidecar — the app owns its lifecycle, so there's no
     // separate process to launch. Held for the app's lifetime; killed on exit.
     let _sidecar = sidecar::ensure_running();
-    // Initialize the Windows App SDK bootstrapper before touching any WinUI types.
+    // Framework-dependent builds must initialize the Windows App SDK bootstrapper to
+    // locate the installed runtime before touching any WinUI types. Self-contained
+    // builds bundle the runtime and MUST NOT call it (no bootstrap shim is shipped,
+    // and the call would re-introduce a load-time dependency on it) — see build.rs.
+    #[cfg(not(feature = "self-contained"))]
     let _bootstrap_handle = bootstrap()?;
     App::new()
         .title("IntuneCommander")

packaging/installer.mpdev.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://www.masterpackager.com/support-master-packager-dev/mpdev-schema.json",
-  "outputTypes": [ "msi", "msix" ],
+  "outputTypes": [ "msi" ],
   "outputDirectory": "publish\\installer",
   "outputFileName": "IntuneCommander-$.version-x64",
   "packageName": "IntuneCommander",