luajitos

init.lua (45488B)

---

 -- LuajitOS Installer
 -- Runs with global environment access for system-level operations
 
 if osprint then
     osprint("Installer: Starting...\n")
 end
 
 -- Available encryption algorithms
 local AVAILABLE_ALGORITHMS = {
     "AES-256-GCM",
     "Twofish-256-GCM",
     "Serpent-256-GCM",
     "XChaCha20-Poly1305"
 }
 
 -- Map encryption chain to FDE cipher mode
 -- FDE only supports: NONE (0), AES (1), XCHACHA (2), CASCADE (3)
 -- We map the chain to the best available FDE mode
 local function getCipherModeFromChain(chain)
     if not chain or #chain == 0 then
         return fde and fde.CIPHER_NONE or 0
     end
 
     local hasAES = false
     local hasXChaCha = false
 
     for _, algo in ipairs(chain) do
         if algo == "AES-256-GCM" then
             hasAES = true
         elseif algo == "XChaCha20-Poly1305" then
             hasXChaCha = true
         end
         -- Note: Twofish and Serpent are shown in UI but FDE doesn't support them yet
         -- They will be treated as AES for now (future: add support in fde.c)
     end
 
     if hasAES and hasXChaCha then
         return fde and fde.CIPHER_CASCADE or 3
     elseif hasXChaCha then
         return fde and fde.CIPHER_XCHACHA or 2
     elseif hasAES or #chain > 0 then
         -- Default to AES for any encryption
         return fde and fde.CIPHER_AES or 1
     else
         return fde and fde.CIPHER_NONE or 0
     end
 end
 
 -- State
 local state = {
     drives = {},
     selectedDrive = nil,
     step = 1,  -- 1 = drive selection, 2 = encryption selection, 3 = password, 4 = install
     -- Encryption chain (order matters for cascading encryption)
     encryptionChain = {"XChaCha20-Poly1305"},  -- Default to XChaCha (software-only, no AES-NI needed)
     -- Password for encryption
     password = "",
     passwordConfirm = "",
     passwordError = nil,
     passwordInputActive = false,  -- Which input is active (false = password, true = confirm)
     -- Installation progress
     installing = false,
     progress = 0,  -- 0 to 100
     statusText = "Ready to install",
     installError = nil
 }
 
 -- Get list of drives from diskfs
 local function refreshDrives()
     state.drives = {}
     if diskfs and diskfs.getMounts then
         local mounts = diskfs.getMounts()
         if mounts then
             for i, mount in ipairs(mounts) do
                 table.insert(state.drives, {
                     index = i,
                     bus = mount.bus,
                     drive = mount.drive,
                     model = mount.model or "Unknown",
                     sectors = mount.sectors or 0,
                     sizeMB = math.floor((mount.sectors or 0) * 512 / (1024 * 1024)),
                     formatted = mount.formatted,
                     volume_name = mount.volume_name
                 })
             end
         end
     end
 
     -- If no diskfs, try ata directly
     if #state.drives == 0 and ata and ata.listDrives then
         local drives = ata.listDrives()
         if drives then
             for i, drive in ipairs(drives) do
                 table.insert(state.drives, {
                     index = i,
                     bus = drive.bus,
                     drive = drive.drive,
                     model = drive.model or "Unknown",
                     sectors = drive.sectors or 0,
                     sizeMB = math.floor((drive.sectors or 0) * 512 / (1024 * 1024)),
                     formatted = false,
                     volume_name = nil
                 })
             end
         end
     end
 
     if osprint then
         osprint("Installer: Found " .. #state.drives .. " drive(s)\n")
     end
 end
 
 -- Create main window
 local screenWidth = 1024
 local screenHeight = 768
 local windowWidth = 500
 local windowHeight = 400
 
 local window = app:newWindow(
     math.floor((screenWidth - windowWidth) / 2),
     math.floor((screenHeight - windowHeight) / 2),
     windowWidth,
     windowHeight
 )
 window.title = "LuajitOS Installer"
 window.resizable = false
 
 -- Colors
 local COLOR_BG = 0xF0F0F0
 local COLOR_TEXT = 0x000000
 local COLOR_TITLE = 0x333333
 local COLOR_BUTTON = 0x4A90D9
 local COLOR_BUTTON_TEXT = 0xFFFFFF
 local COLOR_BUTTON_DISABLED = 0xAAAAAA
 local COLOR_RADIO_BG = 0xFFFFFF
 local COLOR_RADIO_BORDER = 0x888888
 local COLOR_RADIO_SELECTED = 0x4A90D9
 local COLOR_DRIVE_BG = 0xFFFFFF
 local COLOR_DRIVE_SELECTED = 0xE0E8F0
 local COLOR_ROW_BG = 0xFFFFFF
 local COLOR_ROW_BORDER = 0xCCCCCC
 local COLOR_SMALL_BTN = 0x666666
 local COLOR_SMALL_BTN_TEXT = 0xFFFFFF
 local COLOR_ADD_BTN = 0x5A9A5A
 local COLOR_PROGRESS_BG = 0xDDDDDD
 local COLOR_PROGRESS_FG = 0x4A90D9
 local COLOR_PROGRESS_BORDER = 0x888888
 local COLOR_ERROR = 0xCC4444
 local COLOR_SUCCESS = 0x44AA44
 
 -- Helper: Check if encryption is enabled
 local function isEncryptionEnabled()
     return #state.encryptionChain > 0
 end
 
 -- Helper: Get encryption chain summary string
 local function getEncryptionSummary()
     if #state.encryptionChain == 0 then
         return "None (No Encryption)"
     end
     return table.concat(state.encryptionChain, " + ")
 end
 
 -- Helper: Move item up in encryption chain
 local function moveUp(index)
     if index > 1 then
         local temp = state.encryptionChain[index]
         state.encryptionChain[index] = state.encryptionChain[index - 1]
         state.encryptionChain[index - 1] = temp
     end
 end
 
 -- Helper: Move item down in encryption chain
 local function moveDown(index)
     if index < #state.encryptionChain then
         local temp = state.encryptionChain[index]
         state.encryptionChain[index] = state.encryptionChain[index + 1]
         state.encryptionChain[index + 1] = temp
     end
 end
 
 -- Helper: Remove item from encryption chain
 local function removeAlgorithm(index)
     if #state.encryptionChain > 0 then
         table.remove(state.encryptionChain, index)
     end
 end
 
 -- Helper: Add algorithm to chain (duplicates allowed for stacking, max 5)
 local function addAlgorithm(algo)
     if #state.encryptionChain >= 5 then
         return false  -- Maximum reached
     end
     table.insert(state.encryptionChain, algo)
     return true
 end
 
 -- Directories to skip during installation
 local SKIP_DIRS = {
     ["/mnt"] = true,
     ["/proc"] = true,
     ["/tmp"] = true,
     ["/os/public/res"] = true,  -- Skip large resource files (background.bmp is 6MB)
     ["/home"] = true,           -- Skip user files
     ["/keys"] = true            -- Skip key files
 }
 
 -- Helper: Check if path should be skipped
 local function shouldSkip(path)
     for skipPath, _ in pairs(SKIP_DIRS) do
         if path == skipPath or path:sub(1, #skipPath + 1) == skipPath .. "/" then
             return true
         end
     end
     return false
 end
 
 -- Helper: Recursively list all files in ramdisk
 local function listAllFiles(path, files)
     files = files or {}
 
     if shouldSkip(path) then
         return files
     end
 
     local entries = CRamdiskList(path)
     if not entries then
         return files
     end
 
     for _, entry in ipairs(entries) do
         local fullPath = path == "/" and ("/" .. entry.name) or (path .. "/" .. entry.name)
 
         if not shouldSkip(fullPath) then
             if entry.type == "file" then
                 table.insert(files, fullPath)
             elseif entry.type == "directory" or entry.type == "dir" then
                 -- Add directory marker
                 table.insert(files, fullPath .. "/")
                 -- Recurse into directory
                 listAllFiles(fullPath, files)
             end
         end
     end
 
     return files
 end
 
 -- Installation state
 local installState = {
     files = nil,
     fileIndex = 0,
     totalFiles = 0,
     drive = nil,
     batchSize = 10
 }
 
 -- Helper functions for installation
 local function updateProgress(percent, text)
     state.progress = percent
     state.statusText = text
     window:markDirty()
 end
 
 local function installError(msg)
     state.installing = false
     state.installError = msg
     state.statusText = "Installation failed"
     window:markDirty()
     if osprint then
         osprint("Installer: Error - " .. msg .. "\n")
     end
 end
 
 local function installComplete()
     state.installing = false
     updateProgress(100, "Installation complete!")
     if osprint then
         osprint("Installer: Installation complete!\n")
     end
 end
 
 -- Forward declare step functions
 local copyFileBatch
 local startCopyPhase
 local startFormatPhase
 
 -- Time constants (workaround: LuaJIT hangs on decimal literals like 0.1)
 local DELAY_FAST = 1/20   -- 0.05 seconds
 local DELAY_NORMAL = 1/10 -- 0.1 seconds
 
 -- Timer counter for unique names
 local timerCounter = 0
 local function nextTimerName()
     timerCounter = timerCounter + 1
     return "install_" .. timerCounter
 end
 
 -- Helper to schedule timer (use sandboxed Timer API)
 local function scheduleTimer(name, delay, callback)
     if Timer and Timer.simple then
         Timer.simple(name, delay, callback)
     elseif osprint then
         osprint("Installer: Timer not available!\n")
     end
 end
 
 -- Copy files in batches using diskfs
 copyFileBatch = function()
     local copied = 0
     local driveIndex = state.selectedDrive - 1
     local mountPath = "/mnt/hd" .. driveIndex
 
     while copied < installState.batchSize and installState.fileIndex < installState.totalFiles do
         installState.fileIndex = installState.fileIndex + 1
         local filepath = installState.files[installState.fileIndex]
         if filepath then
             local destPath = mountPath .. filepath
             if filepath:sub(-1) == "/" then
                 -- Directory
                 local dirPath = destPath:sub(1, -2)
                 if osprint then
                     osprint("Installer: mkdir " .. dirPath .. "\n")
                 end
                 diskfs.mkdir(dirPath)
             else
                 -- File - read from ramdisk and write to disk
                 local srcHandle = CRamdiskOpen(filepath, "r")
                 if srcHandle then
                     local content = CRamdiskRead(srcHandle)
                     CRamdiskClose(srcHandle)
                     if content then
                         if osprint then
                             osprint("Installer: copy " .. filepath .. " -> " .. destPath .. " (" .. #content .. " bytes)\n")
                         end
                         local handle = diskfs.open(destPath, "w")
                         if handle then
                             local writeResult = diskfs.write(handle, content)
                             diskfs.close(handle)
                             if osprint and not writeResult then
                                 osprint("Installer: WRITE FAILED for " .. destPath .. "\n")
                             end
                         else
                             if osprint then
                                 osprint("Installer: OPEN FAILED for " .. destPath .. "\n")
                             end
                         end
                     else
                         if osprint then
                             osprint("Installer: READ FAILED for " .. filepath .. "\n")
                         end
                     end
                 else
                     if osprint then
                         osprint("Installer: OPEN SRC FAILED for " .. filepath .. "\n")
                     end
                 end
             end
             copied = copied + 1
         end
     end
     local percent = math.floor((installState.fileIndex / installState.totalFiles) * 80) + 15
     updateProgress(percent, "Copying " .. installState.fileIndex .. "/" .. installState.totalFiles)
     if installState.fileIndex >= installState.totalFiles then
         updateProgress(95, "Finalizing...")
         scheduleTimer(nextTimerName(), DELAY_NORMAL, function()
             installComplete()
         end)
     else
         scheduleTimer(nextTimerName(), DELAY_FAST, copyFileBatch)
     end
 end
 
 -- Start copy phase
 startCopyPhase = function()
     updateProgress(10, "Scanning filesystem...")
     if osprint then
         osprint("Installer: Scanning for files...\n")
     end
     installState.files = listAllFiles("/")
     installState.totalFiles = #installState.files
     installState.fileIndex = 0
     if osprint then
         osprint("Installer: Found " .. installState.totalFiles .. " files to copy\n")
         -- Print first 5 files for debugging
         for i = 1, math.min(5, installState.totalFiles) do
             osprint("  File " .. i .. ": " .. installState.files[i] .. "\n")
         end
     end
     if installState.totalFiles == 0 then
         if osprint then
             osprint("Installer: WARNING - No files found to copy!\n")
         end
         installComplete()
         return
     end
     updateProgress(15, "Copying files...")
     scheduleTimer(nextTimerName(), DELAY_FAST, copyFileBatch)
 end
 
 -- Forward declare boot partition setup
 local setupBootPartition
 
 -- Format phase - sets up partitions, FDE encryption layer, then formats filesystem
 startFormatPhase = function()
     local drive = installState.drive
 
     -- Step 1: Create partition layout if encryption is enabled
     if isEncryptionEnabled() then
         updateProgress(1, "Creating partition layout...")
         if osprint then
             osprint("Installer: Creating partition layout...\n")
         end
 
         if not partition then
             installError("Partition module not available")
             return
         end
 
         -- Create LuajitOS partition layout: 16MB boot + encrypted data
         -- partition.createLayout(bus, drive, bootSizeMb) -> boolean
         local ok = partition.createLayout(drive.bus, drive.drive, 16)
         if not ok then
             installError("Failed to create partition layout")
             return
         end
 
         if osprint then
             osprint("Installer: Partition layout created\n")
         end
 
         -- Get boot partition info (partition 1, index 0)
         local bootPartInfo = partition.getInfo(drive.bus, drive.drive, 0)
         if not bootPartInfo or not bootPartInfo.exists then
             installError("Failed to get boot partition info")
             return
         end
 
         -- Store boot partition info for later
         installState.bootPartStart = bootPartInfo.startLba
         installState.bootPartSize = bootPartInfo.sectorCount
 
         if osprint then
             osprint("Installer: Boot partition: start=" .. installState.bootPartStart .. " size=" .. installState.bootPartSize .. "\n")
         end
 
         -- Get encrypted partition info (partition 2, index 1)
         local partInfo = partition.getInfo(drive.bus, drive.drive, 1)
         if not partInfo or not partInfo.exists then
             installError("Failed to get encrypted partition info")
             return
         end
 
         local partStart = partInfo.startLba
         local partSize = partInfo.sectorCount
 
         if osprint then
             osprint("Installer: Encrypted partition: start=" .. partStart .. " size=" .. partSize .. "\n")
         end
 
         -- Step 2: Set up encryption on the data partition
         updateProgress(2, "Setting up encryption...")
         if osprint then
             osprint("Installer: Setting up encryption with " .. getEncryptionSummary() .. "...\n")
         end
 
         if not fde then
             installError("FDE module not available")
             return
         end
 
         -- Get cipher mode from chain
         local cipher = getCipherModeFromChain(state.encryptionChain)
         if osprint then
             osprint("Installer: Using cipher mode " .. cipher .. "\n")
         end
 
         -- Format the encrypted partition with FDE
         local ok, err = fde.formatPartition(drive.bus, drive.drive, partStart, partSize, state.password, cipher)
         if not ok then
             installError("Encryption setup failed: " .. tostring(err))
             return
         end
 
         updateProgress(4, "Opening encrypted volume...")
 
         -- Open the encrypted partition
         ok, err = fde.openPartition(drive.bus, drive.drive, partStart, state.password)
         if not ok then
             installError("Failed to open encrypted volume: " .. tostring(err))
             return
         end
 
         if osprint then
             osprint("Installer: Encrypted partition opened successfully\n")
         end
 
         -- Step 2.5: Format boot partition with FAT16 and install bootloader
         updateProgress(5, "Setting up boot partition...")
         scheduleTimer(nextTimerName(), DELAY_FAST, function()
             setupBootPartition(drive)
         end)
     else
         -- No encryption - skip boot partition setup
         scheduleTimer(nextTimerName(), DELAY_FAST, function()
             -- Step 3: Format filesystem (no encryption)
             updateProgress(6, "Creating filesystem...")
             if osprint then
                 osprint("Installer: Formatting drive hd" .. (state.selectedDrive - 1) .. "...\n")
             end
 
             local ok, err = diskfs.format(drive.bus, drive.drive, "LUAJITOS")
             if not ok then
                 installError("Format failed: " .. tostring(err))
                 return
             end
 
             updateProgress(8, "Filesystem created...")
             scheduleTimer(nextTimerName(), DELAY_NORMAL, startCopyPhase)
         end)
     end
 end
 
 -- Setup boot partition with FAT16 and copy kernel/GRUB files
 setupBootPartition = function(drive)
     if not fat16 then
         installError("FAT16 module not available")
         return
     end
 
     updateProgress(5, "Formatting boot partition (FAT16)...")
     if osprint then
         osprint("Installer: Formatting boot partition with FAT16...\n")
     end
 
     -- Format the boot partition with FAT16
     local ok, err = fat16.format(drive.bus, drive.drive, installState.bootPartStart, installState.bootPartSize, "BOOT")
     if not ok then
         installError("FAT16 format failed: " .. tostring(err))
         return
     end
 
     -- Mount the FAT16 partition
     ok, err = fat16.mount(drive.bus, drive.drive, installState.bootPartStart)
     if not ok then
         installError("FAT16 mount failed: " .. tostring(err))
         return
     end
 
     if osprint then
         osprint("Installer: FAT16 boot partition mounted\n")
     end
 
     updateProgress(6, "Creating boot directories...")
 
     -- Create /boot and /boot/grub directories
     fat16.mkdir("/boot")
     fat16.mkdir("/boot/grub")
 
     updateProgress(6, "Copying kernel to boot partition...")
 
     -- Read kernel from current boot location (ramdisk or iso)
     -- The kernel binary should be available at the path where we booted from
     -- For now, read from ramdisk if available
     local kernelData = nil
 
     -- Try to read kernel from the ramdisk (packed during build)
     -- The kernel is embedded in the ISO, we need to get it from the boot media
     -- Since we're running from ramdisk, we can try to read the kernel from the boot device
 
     -- Actually, we need to copy the running kernel. Let's read it from sector 0 of the CD-ROM
     -- or from wherever GRUB loaded it. For simplicity, embed a small marker.
 
     -- For now, create a placeholder - the kernel will need to be written by the user
     -- or we need a different approach to get the kernel binary
 
     -- Create GRUB configuration
     updateProgress(7, "Creating GRUB configuration...")
 
     local grubCfg = [[
 set timeout=5
 set default=0
 
 menuentry "LuajitOS" {
     multiboot /boot/kernel.bin
     boot
 }
 
 menuentry "LuajitOS (Safe Mode)" {
     multiboot /boot/kernel.bin safemode
     boot
 }
 ]]
 
     ok, err = fat16.writeFile("/boot/grub/grub.cfg", grubCfg)
     if not ok then
         if osprint then
             osprint("Installer: Warning - failed to write grub.cfg: " .. tostring(err) .. "\n")
         end
     else
         if osprint then
             osprint("Installer: GRUB config written to /boot/grub/grub.cfg\n")
         end
     end
 
     -- Try to read kernel from ramdisk at /os/boot/kernel.bin
     updateProgress(7, "Copying kernel to boot partition...")
 
     local kernelData = nil
     local kernelCopied = false
 
     -- Read kernel from ramdisk
     local kernelHandle = CRamdiskOpen("/os/boot/kernel.bin", "r")
     if kernelHandle then
         kernelData = CRamdiskRead(kernelHandle)
         CRamdiskClose(kernelHandle)
 
         if kernelData and #kernelData > 0 then
             if osprint then
                 osprint("Installer: Found kernel in ramdisk (" .. #kernelData .. " bytes)\n")
             end
 
             -- Write kernel to boot partition
             local ok, err = fat16.writeFile("/boot/kernel.bin", kernelData)
             if ok then
                 kernelCopied = true
                 if osprint then
                     osprint("Installer: Kernel copied to /boot/kernel.bin\n")
                 end
             else
                 if osprint then
                     osprint("Installer: Warning - failed to write kernel: " .. tostring(err) .. "\n")
                 end
             end
         else
             if osprint then
                 osprint("Installer: Warning - kernel data is empty\n")
             end
         end
     else
         if osprint then
             osprint("Installer: Warning - kernel not found in ramdisk at /os/boot/kernel.bin\n")
             osprint("Installer: Run build.sh twice to include kernel in ramdisk\n")
         end
     end
 
     -- Create README with installation status
     local bootReadme
     if kernelCopied then
         bootReadme = [[
 LuajitOS Boot Partition
 =======================
 
 This partition was created by the LuajitOS installer.
 Kernel has been installed successfully.
 
 To complete the installation, install GRUB from a Linux system:
   grub-install --boot-directory=/mnt/boot /dev/sdX
 
 Or boot from this drive using the installed GRUB.
 ]]
     else
         bootReadme = [[
 LuajitOS Boot Partition
 =======================
 
 This partition was created by the LuajitOS installer.
 
 WARNING: Kernel was not copied automatically!
 
 To complete the installation:
 1. Run build.sh twice (first builds kernel, second includes it in ramdisk)
 2. Re-run the installer
 
 Or manually copy the kernel:
   mount /dev/sdX1 /mnt
   cp /path/to/kernel.bin /mnt/boot/kernel.bin
 
 Then install GRUB:
   grub-install --boot-directory=/mnt/boot /dev/sdX
 ]]
     end
 
     fat16.writeFile("/README.TXT", bootReadme)
 
     -- Unmount FAT16 partition
     fat16.unmount()
 
     if osprint then
         osprint("Installer: Boot partition setup complete\n")
     end
 
     -- Install bootloader to MBR
     updateProgress(7, "Installing bootloader...")
     if grub and grub.install then
         if osprint then
             osprint("Installer: Installing bootloader to MBR...\n")
         end
         local ok, err = grub.install(drive.bus, drive.drive)
         if ok then
             if osprint then
                 osprint("Installer: Bootloader installed successfully\n")
             end
         else
             if osprint then
                 osprint("Installer: Warning - bootloader install failed: " .. tostring(err) .. "\n")
                 osprint("Installer: You may need to run grub-install manually from Linux\n")
             end
         end
     else
         if osprint then
             osprint("Installer: Warning - grub module not available\n")
             osprint("Installer: Run 'grub-install --boot-directory=/mnt/boot /dev/sdX' from Linux\n")
         end
     end
 
     -- Continue with main filesystem format
     updateProgress(8, "Creating encrypted filesystem...")
     if osprint then
         osprint("Installer: Formatting encrypted partition with DiskFS...\n")
     end
 
     local ok, err = diskfs.format(drive.bus, drive.drive, "LUAJITOS")
     if not ok then
         installError("Format failed: " .. tostring(err))
         return
     end
 
     updateProgress(9, "Filesystem created...")
     scheduleTimer(nextTimerName(), DELAY_NORMAL, startCopyPhase)
 end
 
 -- Start installation
 local function startInstall()
     if state.installing then
         return
     end
     state.installing = true
     state.progress = 0
     state.installError = nil
     state.statusText = "Starting installation..."
     window:markDirty()
     installState.drive = state.drives[state.selectedDrive]
     if osprint then
         osprint("Installer: Starting to hd" .. (state.selectedDrive - 1) .. "\n")
         osprint("Installer: Encryption: " .. getEncryptionSummary() .. "\n")
     end
     if not diskfs then
         installError("DiskFS module not available")
         return
     end
     if not Timer then
         installError("Timer not available")
         return
     end
     if isEncryptionEnabled() and not fde then
         installError("FDE module not available for encryption")
         return
     end
     scheduleTimer(nextTimerName(), DELAY_NORMAL, startFormatPhase)
 end
 
 -- Refresh drives on start
 refreshDrives()
 
 -- Draw callback
 window.onDraw = function(gfx)
     local width = window:getWidth()
     local height = window:getHeight()
 
     -- Background
     gfx:fillRect(0, 0, width, height, COLOR_BG)
 
     -- Title
     gfx:drawText(20, 20, "LuajitOS Installer", COLOR_TITLE)
 
     if state.step == 1 then
         -- Step 1: Drive Selection
         gfx:drawText(20, 60, "Select a drive to install LuajitOS:", COLOR_TEXT)
 
         local y = 100
         local itemHeight = 50
 
         if #state.drives == 0 then
             gfx:drawText(40, y, "No drives detected.", 0x888888)
         else
             for i, drive in ipairs(state.drives) do
                 local isSelected = (state.selectedDrive == i)
 
                 -- Drive item background
                 local bgColor = isSelected and COLOR_DRIVE_SELECTED or COLOR_DRIVE_BG
                 gfx:fillRect(20, y, width - 40, itemHeight - 5, bgColor)
                 gfx:drawRect(20, y, width - 40, itemHeight - 5, COLOR_RADIO_BORDER)
 
                 -- Radio button
                 local radioX = 35
                 local radioY = y + 17
                 local radioRadius = 8
 
                 -- Radio circle (outer)
                 gfx:fillRect(radioX - radioRadius, radioY - radioRadius, radioRadius * 2, radioRadius * 2, COLOR_RADIO_BG)
                 gfx:drawRect(radioX - radioRadius, radioY - radioRadius, radioRadius * 2, radioRadius * 2, COLOR_RADIO_BORDER)
 
                 -- Radio dot (if selected)
                 if isSelected then
                     gfx:fillRect(radioX - 4, radioY - 4, 8, 8, COLOR_RADIO_SELECTED)
                 end
 
                 -- Drive info
                 local driveLabel = "hd" .. (i - 1) .. ": " .. drive.model
                 local driveSize = drive.sizeMB .. " MB"
                 if drive.formatted and drive.volume_name then
                     driveSize = driveSize .. " (" .. drive.volume_name .. ")"
                 elseif drive.formatted then
                     driveSize = driveSize .. " (formatted)"
                 else
                     driveSize = driveSize .. " (unformatted)"
                 end
 
                 gfx:drawText(60, y + 8, driveLabel, COLOR_TEXT)
                 gfx:drawText(60, y + 26, driveSize, 0x666666)
 
                 y = y + itemHeight
             end
         end
 
         -- Next button
         local buttonWidth = 100
         local buttonHeight = 35
         local buttonX = width - buttonWidth - 20
         local buttonY = height - buttonHeight - 20
 
         local buttonColor = state.selectedDrive and COLOR_BUTTON or COLOR_BUTTON_DISABLED
         gfx:fillRect(buttonX, buttonY, buttonWidth, buttonHeight, buttonColor)
         gfx:drawText(buttonX + 35, buttonY + 10, "Next", COLOR_BUTTON_TEXT)
 
     elseif state.step == 2 then
         -- Step 2: Encryption Algorithm Selection (chain builder)
         gfx:drawText(20, 60, "Configure encryption chain:", COLOR_TEXT)
         gfx:drawText(20, 80, "(First algorithm is innermost layer)", 0x666666)
 
         -- Draw encryption chain table
         local tableY = 110
         local rowHeight = 30
         local tableWidth = width - 40
 
         -- Draw existing algorithms in chain
         for i, algo in ipairs(state.encryptionChain) do
             local rowY = tableY + (i - 1) * rowHeight
 
             -- Row background
             gfx:fillRect(20, rowY, tableWidth, rowHeight - 2, COLOR_ROW_BG)
             gfx:drawRect(20, rowY, tableWidth, rowHeight - 2, COLOR_ROW_BORDER)
 
             -- Index number and algorithm name
             gfx:drawText(30, rowY + 8, i .. ". " .. algo, COLOR_TEXT)
 
             -- Button positions (right side of row)
             local btnY = rowY + 3
             local btnH = rowHeight - 8
             local btnW = 50
             local removeX = width - 20 - btnW - 5
             local downX = removeX - btnW - 5
             local upX = downX - btnW - 5
 
             -- UP button
             local upColor = (i > 1) and COLOR_SMALL_BTN or COLOR_BUTTON_DISABLED
             gfx:fillRect(upX, btnY, btnW, btnH, upColor)
             gfx:drawText(upX + 17, btnY + 4, "UP", COLOR_SMALL_BTN_TEXT)
 
             -- DOWN button
             local downColor = (i < #state.encryptionChain) and COLOR_SMALL_BTN or COLOR_BUTTON_DISABLED
             gfx:fillRect(downX, btnY, btnW, btnH, downColor)
             gfx:drawText(downX + 10, btnY + 4, "DOWN", COLOR_SMALL_BTN_TEXT)
 
             -- REMOVE button
             gfx:fillRect(removeX, btnY, btnW, btnH, 0xCC4444)
             gfx:drawText(removeX + 8, btnY + 4, "DEL", COLOR_SMALL_BTN_TEXT)
         end
 
         -- "Add Algorithm" section
         local addSectionY = tableY + #state.encryptionChain * rowHeight + 20
         gfx:drawText(20, addSectionY, "Add algorithm:", COLOR_TEXT)
 
         -- Draw add buttons for each available algorithm
         local addBtnY = addSectionY + 25
         local addBtnHeight = 28
         local addBtnMargin = 5
 
         local maxReached = #state.encryptionChain >= 5
 
         for i, algo in ipairs(AVAILABLE_ALGORITHMS) do
             local btnWidth = 140
 
             -- Layout: 2 buttons per row
             local col = (i - 1) % 2
             local row = math.floor((i - 1) / 2)
             local btnX = 20 + col * (btnWidth + addBtnMargin)
             local btnY = addBtnY + row * (addBtnHeight + addBtnMargin)
 
             local btnColor = maxReached and COLOR_BUTTON_DISABLED or COLOR_ADD_BTN
             gfx:fillRect(btnX, btnY, btnWidth, addBtnHeight, btnColor)
             -- Center text in button (approximate)
             local textX = btnX + 10
             gfx:drawText(textX, btnY + 7, algo, COLOR_BUTTON_TEXT)
         end
 
         -- Next button
         local buttonWidth = 100
         local buttonHeight = 35
         local buttonX = width - buttonWidth - 20
         local buttonY = height - buttonHeight - 20
 
         gfx:fillRect(buttonX, buttonY, buttonWidth, buttonHeight, COLOR_BUTTON)
         gfx:drawText(buttonX + 35, buttonY + 10, "Next", COLOR_BUTTON_TEXT)
 
     elseif state.step == 3 then
         -- Step 3: Password Entry (if encryption enabled)
         if isEncryptionEnabled() then
             gfx:drawText(20, 60, "Enter encryption password:", COLOR_TEXT)
             gfx:drawText(20, 80, "This password will be required to boot.", 0x666666)
 
             -- Password input field
             local inputX = 20
             local inputY = 120
             local inputWidth = width - 40
             local inputHeight = 30
 
             -- First password field
             gfx:drawText(inputX, inputY - 18, "Password:", COLOR_TEXT)
             local pw1Color = (not state.passwordInputActive) and 0xDDEEFF or COLOR_ROW_BG
             gfx:fillRect(inputX, inputY, inputWidth, inputHeight, pw1Color)
             gfx:drawRect(inputX, inputY, inputWidth, inputHeight, COLOR_RADIO_BORDER)
             -- Show asterisks for password
             local pwDisplay = string.rep("*", #state.password)
             if #pwDisplay == 0 then pwDisplay = "(click to type)" end
             gfx:drawText(inputX + 10, inputY + 8, pwDisplay, #state.password > 0 and COLOR_TEXT or 0x888888)
 
             -- Confirm password field
             local confirmY = inputY + 60
             gfx:drawText(inputX, confirmY - 18, "Confirm Password:", COLOR_TEXT)
             local pw2Color = state.passwordInputActive and 0xDDEEFF or COLOR_ROW_BG
             gfx:fillRect(inputX, confirmY, inputWidth, inputHeight, pw2Color)
             gfx:drawRect(inputX, confirmY, inputWidth, inputHeight, COLOR_RADIO_BORDER)
             local pwConfirmDisplay = string.rep("*", #state.passwordConfirm)
             if #pwConfirmDisplay == 0 then pwConfirmDisplay = "(click to type)" end
             gfx:drawText(inputX + 10, confirmY + 8, pwConfirmDisplay, #state.passwordConfirm > 0 and COLOR_TEXT or 0x888888)
 
             -- Password error
             if state.passwordError then
                 gfx:drawText(inputX, confirmY + 45, state.passwordError, COLOR_ERROR)
             end
 
             -- Password requirements
             gfx:drawText(inputX, confirmY + 70, "Min 8 characters recommended", 0x666666)
         else
             gfx:drawText(20, 60, "No encryption selected.", COLOR_TEXT)
             gfx:drawText(20, 80, "Data will NOT be encrypted.", 0x666666)
             gfx:drawText(20, 110, "Click Next to continue with installation.", COLOR_TEXT)
         end
 
         -- Next button
         local buttonWidth = 100
         local buttonHeight = 35
         local buttonX = width - buttonWidth - 20
         local buttonY = height - buttonHeight - 20
 
         -- Can proceed if encryption disabled, or if passwords match and are long enough
         local canProceed = (not isEncryptionEnabled()) or
             (#state.password >= 1 and state.password == state.passwordConfirm)
         local buttonColor = canProceed and COLOR_BUTTON or COLOR_BUTTON_DISABLED
         gfx:fillRect(buttonX, buttonY, buttonWidth, buttonHeight, buttonColor)
         gfx:drawText(buttonX + 35, buttonY + 10, "Next", COLOR_BUTTON_TEXT)
 
     elseif state.step == 4 then
         -- Step 4: Installation
         local drive = state.drives[state.selectedDrive]
         local driveName = drive and ("hd" .. (state.selectedDrive - 1) .. ": " .. drive.model) or "Unknown"
 
         gfx:drawText(20, 60, "Install LuajitOS to:", COLOR_TEXT)
         gfx:drawText(20, 80, driveName, COLOR_TITLE)
 
         -- Show encryption summary
         gfx:drawText(20, 110, "Encryption: " .. getEncryptionSummary(), 0x666666)
 
         -- Progress bar
         local barX = 20
         local barY = 160
         local barWidth = width - 40
         local barHeight = 30
 
         -- Progress bar background
         gfx:fillRect(barX, barY, barWidth, barHeight, COLOR_PROGRESS_BG)
         gfx:drawRect(barX, barY, barWidth, barHeight, COLOR_PROGRESS_BORDER)
 
         -- Progress bar fill
         local fillWidth = math.floor((state.progress / 100) * (barWidth - 4))
         if fillWidth > 0 then
             gfx:fillRect(barX + 2, barY + 2, fillWidth, barHeight - 4, COLOR_PROGRESS_FG)
         end
 
         -- Progress percentage
         local percentText = state.progress .. "%"
         gfx:drawText(barX + barWidth / 2 - 15, barY + 8, percentText, COLOR_TEXT)
 
         -- Status text
         local statusY = barY + barHeight + 20
         if state.installError then
             gfx:drawText(20, statusY, "Error: " .. state.installError, COLOR_ERROR)
         else
             gfx:drawText(20, statusY, state.statusText, COLOR_TEXT)
         end
 
         -- Install button (or completion message)
         local buttonWidth = 100
         local buttonHeight = 35
         local buttonX = width - buttonWidth - 20
         local buttonY = height - buttonHeight - 20
 
         if state.progress == 100 then
             -- Installation complete
             gfx:fillRect(buttonX, buttonY, buttonWidth, buttonHeight, COLOR_SUCCESS)
             gfx:drawText(buttonX + 30, buttonY + 10, "Done", COLOR_BUTTON_TEXT)
         elseif state.installing then
             -- Installing - show disabled button
             gfx:fillRect(buttonX, buttonY, buttonWidth, buttonHeight, COLOR_BUTTON_DISABLED)
             gfx:drawText(buttonX + 15, buttonY + 10, "Installing...", COLOR_BUTTON_TEXT)
         elseif state.installError then
             -- Error - allow retry
             gfx:fillRect(buttonX, buttonY, buttonWidth, buttonHeight, COLOR_ERROR)
             gfx:drawText(buttonX + 30, buttonY + 10, "Retry", COLOR_BUTTON_TEXT)
         else
             -- Ready to install
             gfx:fillRect(buttonX, buttonY, buttonWidth, buttonHeight, COLOR_BUTTON)
             gfx:drawText(buttonX + 25, buttonY + 10, "Install", COLOR_BUTTON_TEXT)
         end
     end
 end
 
 -- Click handler
 window.onClick = function(mx, my)
     local width = window:getWidth()
     local height = window:getHeight()
 
     if state.step == 1 then
         -- Check drive selection
         local itemY = 100
         local itemHeight = 50
 
         for i, drive in ipairs(state.drives) do
             if mx >= 20 and mx < width - 20 and my >= itemY and my < itemY + itemHeight - 5 then
                 state.selectedDrive = i
                 if osprint then
                     osprint("Installer: Selected drive " .. i .. " (hd" .. (i-1) .. ")\n")
                 end
                 window:markDirty()
                 return
             end
             itemY = itemY + itemHeight
         end
 
         -- Check Next button
         local buttonWidth = 100
         local buttonHeight = 35
         local buttonX = width - buttonWidth - 20
         local buttonY = height - buttonHeight - 20
 
         if state.selectedDrive and mx >= buttonX and mx < buttonX + buttonWidth and my >= buttonY and my < buttonY + buttonHeight then
             if osprint then
                 local drive = state.drives[state.selectedDrive]
                 osprint("Installer: Next clicked, selected hd" .. (state.selectedDrive - 1) .. "\n")
                 osprint("Installer: Drive: " .. drive.model .. " (" .. drive.sizeMB .. " MB)\n")
             end
             state.step = 2
             window:markDirty()
         end
 
     elseif state.step == 2 then
         -- Step 2: Encryption Algorithm Selection (chain builder)
         local tableY = 110
         local rowHeight = 30
         local btnW = 50
         local btnH = rowHeight - 8
 
         -- Check clicks on existing algorithm rows (UP, DOWN, REMOVE buttons)
         for i, algo in ipairs(state.encryptionChain) do
             local rowY = tableY + (i - 1) * rowHeight
             local btnY = rowY + 3
 
             local removeX = width - 20 - btnW - 5
             local downX = removeX - btnW - 5
             local upX = downX - btnW - 5
 
             -- Check UP button
             if mx >= upX and mx < upX + btnW and my >= btnY and my < btnY + btnH then
                 if i > 1 then
                     moveUp(i)
                     if osprint then
                         osprint("Installer: Moved " .. algo .. " up\n")
                     end
                     window:markDirty()
                 end
                 return
             end
 
             -- Check DOWN button
             if mx >= downX and mx < downX + btnW and my >= btnY and my < btnY + btnH then
                 if i < #state.encryptionChain then
                     moveDown(i)
                     if osprint then
                         osprint("Installer: Moved " .. algo .. " down\n")
                     end
                     window:markDirty()
                 end
                 return
             end
 
             -- Check REMOVE button
             if mx >= removeX and mx < removeX + btnW and my >= btnY and my < btnY + btnH then
                 removeAlgorithm(i)
                 if osprint then
                     osprint("Installer: Removed " .. algo .. "\n")
                 end
                 window:markDirty()
                 return
             end
         end
 
         -- Check clicks on "Add Algorithm" buttons
         local addSectionY = tableY + #state.encryptionChain * rowHeight + 20
         local addBtnY = addSectionY + 25
         local addBtnHeight = 28
         local addBtnMargin = 5
         local addBtnWidth = 140
 
         for i, algo in ipairs(AVAILABLE_ALGORITHMS) do
             local col = (i - 1) % 2
             local row = math.floor((i - 1) / 2)
             local btnX = 20 + col * (addBtnWidth + addBtnMargin)
             local btnY = addBtnY + row * (addBtnHeight + addBtnMargin)
 
             if mx >= btnX and mx < btnX + addBtnWidth and my >= btnY and my < btnY + addBtnHeight then
                 if addAlgorithm(algo) then
                     if osprint then
                         osprint("Installer: Added " .. algo .. " to chain\n")
                     end
                     window:markDirty()
                 end
                 return
             end
         end
 
         -- Check Next button
         local buttonWidth = 100
         local buttonHeight = 35
         local buttonX = width - buttonWidth - 20
         local buttonY = height - buttonHeight - 20
 
         if mx >= buttonX and mx < buttonX + buttonWidth and my >= buttonY and my < buttonY + buttonHeight then
             if osprint then
                 osprint("Installer: Encryption chain configured:\n")
                 for i, algo in ipairs(state.encryptionChain) do
                     osprint("  " .. i .. ". " .. algo .. "\n")
                 end
             end
             state.step = 3
             window:markDirty()
         end
 
     elseif state.step == 3 then
         -- Step 3: Password Entry
         local inputX = 20
         local inputY = 120
         local inputWidth = width - 40
         local inputHeight = 30
         local confirmY = inputY + 60
 
         -- Check password field click
         if mx >= inputX and mx < inputX + inputWidth and my >= inputY and my < inputY + inputHeight then
             state.passwordInputActive = false  -- First field
             window:markDirty()
             return
         end
 
         -- Check confirm field click
         if mx >= inputX and mx < inputX + inputWidth and my >= confirmY and my < confirmY + inputHeight then
             state.passwordInputActive = true  -- Second field
             window:markDirty()
             return
         end
 
         -- Check Next button
         local buttonWidth = 100
         local buttonHeight = 35
         local buttonX = width - buttonWidth - 20
         local buttonY = height - buttonHeight - 20
 
         if mx >= buttonX and mx < buttonX + buttonWidth and my >= buttonY and my < buttonY + buttonHeight then
             -- Validate passwords if encryption enabled
             if isEncryptionEnabled() then
                 if #state.password < 1 then
                     state.passwordError = "Password cannot be empty"
                     window:markDirty()
                     return
                 end
                 if state.password ~= state.passwordConfirm then
                     state.passwordError = "Passwords do not match"
                     window:markDirty()
                     return
                 end
                 state.passwordError = nil
             end
             if osprint then
                 osprint("Installer: Password set, proceeding to install\n")
             end
             state.step = 4
             window:markDirty()
         end
 
     elseif state.step == 4 then
         -- Step 4: Installation
         local buttonWidth = 100
         local buttonHeight = 35
         local buttonX = width - buttonWidth - 20
         local buttonY = height - buttonHeight - 20
 
         if mx >= buttonX and mx < buttonX + buttonWidth and my >= buttonY and my < buttonY + buttonHeight then
             if state.progress == 100 then
                 -- Done - close window
                 if osprint then
                     osprint("Installer: Closing after successful installation\n")
                 end
                 app:terminate()
             elseif not state.installing then
                 -- Start or retry installation
                 if osprint then
                     osprint("Installer: Starting installation...\n")
                 end
                 startInstall()
             end
         end
     end
 end
 
 -- Keyboard handler for password input (uses onInput, not onKey)
 window.onInput = function(key, scancode)
     if state.step == 3 and isEncryptionEnabled() then
         -- Scancode 14 = backspace, 15 = tab, 28 = enter
         if scancode == 14 then
             -- Backspace
             if state.passwordInputActive then
                 if #state.passwordConfirm > 0 then
                     state.passwordConfirm = state.passwordConfirm:sub(1, -2)
                 end
             else
                 if #state.password > 0 then
                     state.password = state.password:sub(1, -2)
                 end
             end
             state.passwordError = nil
             window:markDirty()
         elseif scancode == 15 then
             -- Tab to switch fields
             state.passwordInputActive = not state.passwordInputActive
             window:markDirty()
         elseif scancode == 28 then
             -- Enter to proceed (if valid)
             if #state.password >= 1 and state.password == state.passwordConfirm then
                 state.step = 4
                 window:markDirty()
             elseif state.password ~= state.passwordConfirm then
                 state.passwordError = "Passwords do not match"
                 window:markDirty()
             end
         elseif key and #key == 1 and key:byte() >= 32 and key:byte() < 127 then
             -- Printable character
             if state.passwordInputActive then
                 state.passwordConfirm = state.passwordConfirm .. key
             else
                 state.password = state.password .. key
             end
             state.passwordError = nil
             window:markDirty()
         end
     end
 end
 
 if osprint then
     osprint("Installer: Window created\n")
 end