Workstation improvements

[ptone]

Add an improved onboarding flow for first time users

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request introduces a workstation onboarding wizard and supporting APIs to enable a guided, browser-based first-run setup for local Scion installations. It adds workstation-only security fences, configurable cosmetic identity, system status and diagnostic endpoints, Go-native image pulling and local building, and a server-side directory browser for linking local workspaces. The review feedback highlights several critical issues to address: Windows compatibility bugs in the directory browser (path separator normalization, drive letter breadcrumbs, and drive root parent navigation), an infinite spinner on early image pull failures, a potential silent failure in log scanning with bufio.Scanner, the need to gracefully handle context cancellation in the image pull loop, and a lack of concurrency control for local image builds.

[gemini-code-assist]

The frontend ignores pull error events that do not contain an image key (such as top-level errors published by the backend when PullImages fails early). This causes the UI spinner to spin indefinitely. Update the event listener to handle top-level error events.

        if (mode === 'pull') {
          if (d['image']) {
            const image = d['image'] as string;
            const status = d['status'] as string;
            const error = d['error'] as string | undefined;

            const harness = this.imageNameToHarness(image);
            if (harness) {
              const next = new Map(this.imageStatuses);
              const entry: { status: string; error?: string } = { status };
              if (error) entry.error = error;
              next.set(harness, entry);
              this.imageStatuses = next;
            }

            if (status === 'done' || status === 'exists' || status === 'error') {
              doneCount++;
              if (doneCount >= totalImages) {
                this.imagePulling = false;
                this.cleanupImageEvents();
              }
            }
          } else if (d['status'] === 'error') {
            this.error = (d['error'] as string) || 'An error occurred during image pull.';
            this.imagePulling = false;
            this.cleanupImageEvents();
          }
        }

[gemini-code-assist]

Windows path separators (\\) returned by the backend are not normalized on the frontend, which breaks path splitting, breadcrumbs, and navigation on Windows. Normalize the path separators to / upon receiving them from the API.

Suggested change

	this.currentPath = data.path;
	this.entries = data.entries ?? [];
	this.currentPath = data.path.replace(/\\/g, '/');
	this.entries = data.entries ?? [];

[gemini-code-assist]

When navigating to a breadcrumb on Windows, prepending / to a drive letter (e.g., /C:) produces an invalid path. Check if the first segment is a Windows drive letter and handle it accordingly.

Suggested change

	private navigateToBreadcrumb(index: number): void {
	const segments = this.currentPath.split('/').filter(Boolean);
	const path = '/' + segments.slice(0, index + 1).join('/');
	void this.navigate(path);
	}
	private navigateToBreadcrumb(index: number): void {
	const segments = this.currentPath.split('/').filter(Boolean);
	const subSegments = segments.slice(0, index + 1);
	let path = '';
	if (subSegments[0] && /^[a-zA-Z]:$/.test(subSegments[0])) {
	path = subSegments.join('/');
	if (subSegments.length === 1) {
	path += '/';
	}
	} else {
	path = '/' + subSegments.join('/');
	}
	void this.navigate(path);
	}

[gemini-code-assist]

On Windows, the root of a drive (e.g., C:/) has a segment length of 1, causing the browser to incorrectly show a .. navigation entry that leads to an invalid C: path. Avoid rendering the .. entry when at the root of a Windows drive.

Suggested change

	${segments.length > 0 ? html`
	<div class="entry" @click=${() => this.navigateUp()}>
	<sl-icon name="arrow-up"></sl-icon>
	<span class="name">..</span>
	</div>
	` : nothing}
	${!(segments.length === 0 || (segments.length === 1 && /^[a-zA-Z]:$/.test(segments[0]))) ? html`
	<div class=

[gemini-code-assist]

bufio.Scanner can silently fail and stop scanning if a log line exceeds its default 64KB buffer limit (returning bufio.ErrTooLong). Checking scanner.Err() is necessary to ensure any scan errors are reported to the user.

		scanner := bufio.NewScanner(stdout)
		for scanner.Scan() {
			s.events.PublishRaw(subject, imageBuildLogEvent{Type: "log", Line: scanner.Text()})
		}
		if err := scanner.Err(); err != nil {
			s.events.PublishRaw(subject, imageBuildLogEvent{Type: "log", Line: "error reading build log: " + err.Error()})
		}

[gemini-code-assist]

If the server context is cancelled (e.g., during shutdown), the image pull loop continues to iterate through all remaining images, triggering unnecessary error events. Checking ctx.Err() at the start of each iteration allows the loop to terminate gracefully.

	for _, img := range images {
		if err := ctx.Err(); err != nil {
			return err
		}
		exists, err := rt.ImageExists(ctx, img)

[gemini-code-assist]

There is no concurrency control or check for an active build job in handleSystemImagesBuild. Multiple concurrent POST requests will spawn multiple concurrent build-images.sh processes, which can easily overwhelm the workstation. Consider tracking whether a build job is currently active (e.g., using an atomic boolean or a mutex-protected flag on the Server struct) and returning 409 Conflict if a build is already in progress, as specified in the design document.