@aglit-ai/cli 0.1.2 → 0.1.5

package/README.md

@@ -87,3 +87,19 @@ identity. It never adopts a managed guest's key or changes its registration.
 
 See [architecture and acceptance](../../docs/computer-use.md). The source CLI can
 be inspected without installation using `node packages/cli/bin/aglit.cjs --help`.
+
+## Updates
+
+One CLI installation includes the correct signed Desktop runtime for this
+computer. The runtime assets are bundled internally through npm; no separate
+runtime package installation is needed.
+Downloads verify the npm package integrities, every runtime part, the complete
+Desktop archive and the native publisher before launch. GitHub delta downloads
+are not used by this installation.
+
+Automatic update checks run while Desktop is active. They preserve the computer's
+account, device identity and profile, and wait for an idle runtime before a native
+restart. Use `aglit update --check` to inspect available updates, `aglit update`
+to apply one, and `aglit updates off` or `aglit updates on` to change automatic
+checks. New installations follow `latest`; experimental installations can save
+an explicit channel with `aglit init --channel embedded`.

package/bin/aglit.cjs

@@ -5,6 +5,7 @@ const path = require('node:path');
 const os = require('node:os');
 const { parseArgs } = require('node:util');
 const installation = require('../src/installation.cjs');
+const updates = require('../src/updates.cjs');
 const { createUi, teamsFromRoles } = require('../src/ui.cjs');
 const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
 const help = `Aglit Computer Use
@@ -12,10 +13,13 @@ const help = `Aglit Computer Use
   aglit                         Interactive setup
   aglit init                    Install and register this computer
     [--name "Computer name"] [--provider codex|claude|auto]
-    [--account EMAIL] [--headed | --headless] [--team TEAM_ID] [--invite EMAIL]
+    [--account EMAIL] [--headed | --headless] [--channel latest|canary|embedded]
+    [--team TEAM_ID] [--invite EMAIL]
   aglit install                 Install the signed Desktop runtime
   aglit start [--headed | --headless]
   aglit status [--json]
+  aglit update [--check] [--channel latest|canary|embedded] [--json]
+  aglit updates on|off|status [--json]
   aglit enable | disable
   aglit teams
   aglit pipelines [--open]
@@ -44,19 +48,22 @@ async function finishUninstall(receipt) {
 }
 
 async function main() {
+  const delegated = updates.delegate(__filename); if (delegated !== null) { process.exitCode = delegated; return; }
   const { values, positionals } = parseArgs({ options: {
     name: { type: 'string' }, provider: { type: 'string' }, account: { type: 'string' },
     team: { type: 'string' }, invite: { type: 'string' }, headed: { type: 'boolean' },
-    headless: { type: 'boolean' }, open: { type: 'boolean' }, json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
+    headless: { type: 'boolean' }, check: { type: 'boolean' }, channel: { type: 'string' }, open: { type: 'boolean' }, json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
   }, allowPositionals: true, strict: true });
   const interactive = Boolean(process.stdin.isTTY && process.stderr.isTTY && !values.json && !process.env.CI);
   if (values.help || !positionals.length && !interactive) { process.stdout.write(help); return; }
   const [command = 'init', email] = positionals;
   const options = {
-    install: ['json'], init: ['name', 'provider', 'account', 'team', 'invite', 'headed', 'headless', 'json'],
-    start: ['headed', 'headless', 'json'], status: ['json'], enable: [], disable: [], teams: ['json'], pipelines: ['open', 'json'], providers: ['json'], invite: ['team'], uninstall: [],
+    install: ['json', 'channel'], init: ['name', 'provider', 'account', 'team', 'invite', 'headed', 'headless', 'json', 'channel'],
+    start: ['headed', 'headless', 'json', 'channel'], status: ['json'], update: ['check', 'channel', 'json'], updates: ['json'], enable: [], disable: [], teams: ['json'], pipelines: ['open', 'json'], providers: ['json'], invite: ['team'], uninstall: [],
   };
-  if (!Object.hasOwn(options, command) || Object.keys(values).some(key => !options[command].includes(key)) || positionals.length > (command === 'invite' ? 2 : 1)) throw Error('Invalid command or options. Run aglit --help.');
+  if (!Object.hasOwn(options, command) || Object.keys(values).some(key => !options[command].includes(key)) || positionals.length > (['invite', 'updates'].includes(command) ? 2 : 1)) throw Error('Invalid command or options. Run aglit --help.');
+  if (command === 'updates' && !['on', 'off', 'status'].includes(email)) throw Error('Use aglit updates on|off|status');
+  if (values.channel !== undefined && !['latest', 'canary', 'embedded'].includes(values.channel)) throw Error('Update channel must be latest, canary or embedded');
   if (values.headed && values.headless) throw Error('Choose either --headed or --headless');
   if (values.team && !/^[A-Za-z0-9._:-]{1,128}$/.test(values.team)) throw Error('Invalid team ID');
   if (values.provider && !['auto', 'codex', 'claude'].includes(values.provider)) throw Error('Provider must be auto, codex or claude');
@@ -68,8 +75,18 @@ async function main() {
   if (values.name !== undefined && (!values.name.trim() || values.name.length > 100 || /[\x00-\x1f\x7f-\x9f]/.test(values.name))) throw Error('Computer name must contain 1–100 printable characters');
   const ui = await createUi(interactive);
   const installed = () => fs.existsSync(path.join(installation.root, 'installation.json'));
+  if (command === 'update') {
+    ui.result(await ui.step(values.check ? 'Check npm updates' : 'Update Aglit from npm', () => updates.update({check: Boolean(values.check), channel: values.channel})));
+    ui.finish('Update check complete'); return;
+  }
+  if (command === 'updates') {
+    if (!installed()) throw Error('Run aglit init before configuring automatic updates');
+    ui.result(email === 'status' ? await updates.status() : await updates.automatic(email === 'on'));
+    ui.finish('Automatic updates'); return;
+  }
   if (command === 'install') {
-    const receipt = await ui.step('Download and verify Desktop', () => installation.install());
+    const receipt = await ui.step('Download and verify Desktop', () => installation.install(values.channel));
+    updates.initialize(values.channel);
     if (interactive) ui.info('Desktop installed. Run aglit init to register this computer.');
     else ui.result(receipt);
     ui.finish('Ready for setup'); return;
@@ -85,6 +102,7 @@ async function main() {
   if ((command === 'uninstall' || command === 'status') && installed()) {
     const pending = installation.readUninstall();
     if (pending) {
+      if (command === 'uninstall') await updates.stopWorker();
       ui.result(command === 'uninstall' ? await finishUninstall(pending) : { installed: true, uninstalling: true, enabled: false });
       ui.finish('Uninstall cleanup'); return;
     }
@@ -96,17 +114,33 @@ async function main() {
     if (interactive && values.headed === undefined && values.headless === undefined) mode = await ui.mode();
     if (!installed()) {
       if (!interactive && !name) throw Error('Provide --name for unattended setup');
-      await ui.step('Download and verify Desktop', () => installation.install());
+      await ui.step('Download and verify Desktop', () => installation.install(values.channel));
     }
   }
   if (!installed()) throw Error('Run aglit init to install and register this computer first.');
   installation.readInstallation();
+  if (['start', 'init'].includes(command)) {
+    const recovered = await updates.recoverActivation();
+    if (recovered.updating) { ui.result(recovered); ui.finish('Update in progress'); return; }
+  }
+  if (['start', 'init'].includes(command)) updates.initialize(values.channel);
   const configPath = path.join(installation.profile, 'ipc/sdk-ipc.json');
   const control = (action, fields = {}) => require('../src/control.cjs').control(configPath, action, fields);
   let state;
   try { state = await control('status'); } catch (error) {
     if (command === 'status') { ui.result({ product: 'Aglit Computer Use', installed: true, running: false, enabled: null, error: error.message }); ui.finish('Runtime stopped'); process.exitCode = 1; return; }
     state = await ui.step('Start Desktop in the background', async () => {
+      // A stopped legacy runtime can make its first npm migration here without
+      // terminating active work or relying on handoff commands it predates.
+      if (updates.state().automatic && updates.runtimeStopped(installation.readInstallation())) {
+        try { await updates.update(); } catch {
+          if (fs.existsSync(path.join(installation.root, 'update-transaction.json')) || fs.existsSync(path.join(installation.root, 'update-activation.json'))) {
+            const recovered = await updates.recoverActivation(); if (recovered.updating) throw Error('An update is still active; retry aglit start after it finishes');
+          }
+          ui.info('Automatic update deferred; starting the installed Desktop.');
+        }
+        try { const current = await control('status'); if (current.running) return current; } catch { /* No update started Desktop. */ }
+      }
       installation.start();
       const deadline = Date.now() + 60000;
       while (Date.now() < deadline) {
@@ -116,6 +150,8 @@ async function main() {
       throw Error('Computer Use did not become ready. See runtime.log in its installation directory.');
     });
   }
+  if (state.running && ['status', 'start', 'init'].includes(command)) updates.rememberStatus(state);
+  if (['start', 'init'].includes(command) && state.running) updates.ensureWorker(state.pid);
   if (command === 'status') { ui.result(state); ui.finish('Computer status'); return; }
   if (command === 'teams' || command === 'pipelines') {
     const result = await ui.step(command === 'teams' ? 'Load your teams' : 'Load authorized pipeline devices', () => control(command));
@@ -179,14 +215,18 @@ async function main() {
       throw Error('Anywhere Access is enabled but its connection is not ready. Check aglit status before retrying.');
     });
     if (values.invite) ui.result(await control('invite', { teamId: values.team, email: values.invite }));
+    updates.rememberStatus(state);
     ui.result(state); ui.finish('Computer ready · https://console.aglit.ai/'); return;
   }
   if (command === 'invite') { ui.result(await control('invite', { teamId: values.team, email })); ui.finish('Invitation sent'); return; }
   if (command === 'uninstall') {
-    const result = await control('uninstall');
-    if (!result?.revoked || !result?.quitting || !Number.isSafeInteger(result.pid) || result.pid <= 0) throw Error('Revocation was not confirmed; installation preserved');
-    ui.result(await ui.step('Remove this installation', () => finishUninstall(result)));
-    ui.finish('Uninstalled'); return;
+    const unlock = await updates.prepareUninstall();
+    try {
+      const result = await control('uninstall');
+      if (!result?.revoked || !result?.quitting || !Number.isSafeInteger(result.pid) || result.pid <= 0) throw Error('Revocation was not confirmed; installation preserved');
+      ui.result(await ui.step('Remove this installation', () => finishUninstall(result)));
+      ui.finish('Uninstalled'); return;
+    } finally { unlock(); }
   }
   ui.result(await control(command)); ui.finish('Done');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglit-ai/cli",
-  "version": "0.1.2",
+  "version": "0.1.5",
   "description": "Install and manage Aglit Computer Use",
   "license": "UNLICENSED",
   "type": "commonjs",

package/src/installation.cjs

@@ -5,7 +5,8 @@ const os = require('node:os');
 const crypto = require('node:crypto');
 const { spawn, execFileSync } = require('node:child_process');
 const { pipeline } = require('node:stream/promises');
-const { Readable, Transform } = require('node:stream');
+const { once } = require('node:events');
+const { createRequire } = require('node:module');
 
 const root = path.join(process.platform === 'darwin' ? path.join(os.homedir(), 'Library/Application Support') :
   process.platform === 'win32' ? process.env.APPDATA || path.join(os.homedir(), 'AppData/Roaming') : path.join(os.homedir(), '.config'), 'Aglit Computer Use');
@@ -56,48 +57,6 @@ function readInstallation(allowPartialCleanup = false) {
   if (!allowPartialCleanup) { canonical(value.executable); canonical(value.profile); }
   return value;
 }
-async function download(url) {
-  for (let hop = 0; hop < 6; hop++) {
-    const target = new URL(url);
-    if (target.protocol !== 'https:' || !['github.com', 'release-assets.githubusercontent.com', 'objects.githubusercontent.com'].includes(target.hostname)) throw Error('Untrusted release URL');
-    const response = await fetch(target, { redirect: 'manual', signal: AbortSignal.timeout(30 * 60 * 1000) });
-    if ([301, 302, 303, 307, 308].includes(response.status)) {
-      await response.body?.cancel();
-      url = new URL(response.headers.get('location'), target).href;
-      continue;
-    }
-    if (!response.ok || !response.body) throw Error(`Release download failed (${response.status})`);
-    return response;
-  }
-  throw Error('Too many release redirects');
-}
-async function json(url) {
-  const response = await download(url);
-  let size = 0;
-  const chunks = [];
-  for await (const chunk of response.body) {
-    size += chunk.length;
-    if (size > 65536) throw Error('Release metadata too large');
-    chunks.push(chunk);
-  }
-  return JSON.parse(Buffer.concat(chunks).toString('utf8'));
-}
-function parseRelease(value, platform) {
-  const fields = ['kind', 'package', 'platform', 'version', 'sourceCommit', 'assets', 'windowsSigningPolicy'];
-  if (!value || Object.keys(value).some(key => !fields.includes(key)) || value.kind !== 'aglit-github-release-v1' ||
-      value.package !== 'desktop-app' || value.platform !== platform || !/^\d+\.\d+\.\d+$/.test(value.version) ||
-      !/^[a-f0-9]{40}$/.test(value.sourceCommit) || !Array.isArray(value.assets) || value.assets.length !== 3 ||
-      value.windowsSigningPolicy !== undefined && (platform !== 'win' || value.windowsSigningPolicy !== 'unsigned-user-accepted')) throw Error('Invalid desktop release receipt');
-  const stem = `Aglit.AI-${value.version}-${platform === 'mac' ? 'mac-arm64' : 'win-x64'}`;
-  const names = platform === 'mac' ? [stem + '.dmg', stem + '.zip', stem + '.zip.blockmap'] : [stem + '.exe', stem + '.exe.blockmap', stem + '.zip'];
-  for (let index = 0; index < 3; index++) {
-    const asset = value.assets[index];
-    if (!asset || Object.keys(asset).sort().join(',') !== 'name,sha256,sha512,size' || asset.name !== names[index] ||
-        !Number.isSafeInteger(asset.size) || asset.size <= 0 || asset.size > 2 * 1024 ** 3 ||
-        !/^[a-f0-9]{64}$/.test(asset.sha256) || !/^[A-Za-z0-9+/]{86}==$/.test(asset.sha512)) throw Error('Invalid release asset');
-  }
-  return value;
-}
 function verifyPublisher(executable) {
   if (process.platform === 'darwin') {
     const bundle = path.resolve(executable, '../../..');
@@ -108,53 +67,131 @@ function verifyPublisher(executable) {
     run(powershell, ['-NoLogo', '-NoProfile', '-NonInteractive', '-WindowStyle', 'Hidden', '-Command', script], { env: { ...process.env, AGLIT_VERIFY_EXECUTABLE: executable } });
   }
 }
-async function install() {
+function embeddedRelease(platform, packageDirectory = path.resolve(__dirname, '..'), runtimeDirectory) {
+  const packageName = '@aglit-ai/desktop-runtime-' + (platform === 'mac' ? 'darwin-arm64' : 'win32-x64');
+  let directory = path.join(runtimeDirectory || packageDirectory, 'runtime');
+  if (!fs.existsSync(path.join(directory, 'desktop-runtime.json'))) {
+    try { directory = path.join(path.dirname(createRequire(path.join(packageDirectory, 'package.json')).resolve(packageName + '/package.json')), 'runtime'); }
+    catch (error) { if (error.code === 'MODULE_NOT_FOUND') return null; throw error; }
+  }
+  const metadata = path.join(directory, 'desktop-runtime.json');
+  canonical(metadata);
+  const stat = fs.statSync(metadata);
+  if (!stat.isFile() || stat.size > 65536) throw Error('Invalid bundled Desktop metadata');
+  const value = JSON.parse(fs.readFileSync(metadata, 'utf8'));
+  const aliased = value?.kind === 'aglit-cli-desktop-runtime-v3';
+  const chunked = aliased || value?.kind === 'aglit-cli-desktop-runtime-v2';
+  const keys = chunked ? 'archive,chunks,kind,platform,sourceCommit,version' : 'archive,kind,platform,sourceCommit,version';
+  if (!value || Object.keys(value).sort().join(',') !== keys ||
+      !['aglit-cli-desktop-runtime-v1', 'aglit-cli-desktop-runtime-v2', 'aglit-cli-desktop-runtime-v3'].includes(value.kind) || value.platform !== platform ||
+      !/^\d+\.\d+\.\d+$/.test(value.version) || !/^[a-f0-9]{40}$/.test(value.sourceCommit))
+    throw Error('Bundled Desktop identity differs');
+  const validAsset = asset => asset && Number.isSafeInteger(asset.size) && asset.size > 0 && asset.size <= 2 * 1024 ** 3 &&
+    /^[a-f0-9]{64}$/.test(asset.sha256) && /^[A-Za-z0-9+/]{86}==$/.test(asset.sha512);
+  const asset = value.archive;
+  if (!validAsset(asset) || Object.keys(asset).sort().join(',') !== 'name,sha256,sha512,size' || asset.name !== 'desktop.zip')
+    throw Error('Invalid bundled Desktop archive');
+  const chunks = [];
+  if (aliased) {
+    const descriptor = JSON.parse(fs.readFileSync(path.join(path.dirname(directory), 'package.json'), 'utf8'));
+    const descriptorVersion = value.version + '-runtime.' + (platform === 'mac' ? 'darwin-arm64' : 'win32-x64');
+    if (descriptor.name !== '@aglit-ai/cli' || descriptor.version !== descriptorVersion || !descriptor.dependencies ||
+        Object.keys(descriptor.dependencies).length !== value.chunks?.length) throw Error('Desktop descriptor package differs');
+    for (const part of value.chunks || []) if (descriptor.dependencies[part.installName] !== 'npm:@aglit-ai/cli@' + part.version)
+      throw Error('Desktop part dependency alias differs');
+  }
+  if (chunked) {
+    if (!Array.isArray(value.chunks) || !value.chunks.length || value.chunks.length > 64) throw Error('Invalid Desktop parts');
+    const resolver = createRequire(path.join(path.dirname(directory), 'package.json'));
+    for (let index = 0; index < value.chunks.length; index++) {
+      const part = value.chunks[index];
+      const name = packageName + '-part-' + String(index).padStart(2, '0');
+      const internalVersion = value.version + '-runtime.' + (platform === 'mac' ? 'darwin-arm64' : 'win32-x64') + '.part-' + String(index).padStart(2, '0');
+      const expectedFields = aliased ? 'file,installName,package,sha256,sha512,size,version' : 'file,package,sha256,sha512,size,version';
+      if (!validAsset(part) || Object.keys(part).sort().join(',') !== expectedFields ||
+          part.package !== (aliased ? '@aglit-ai/cli' : name) || part.version !== (aliased ? internalVersion : value.version) ||
+          aliased && part.installName !== name || part.file !== 'runtime/part.bin' || part.size > 64 * 1024 ** 2)
+        throw Error('Invalid Desktop part identity');
+      const manifest = resolver.resolve((aliased ? part.installName : part.package) + '/package.json'); canonical(manifest);
+      const identity = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+      if (identity.name !== part.package || identity.version !== part.version) throw Error('Desktop part package differs');
+      const archive = path.join(path.dirname(manifest), part.file); canonical(archive);
+      if (!fs.statSync(archive).isFile() || fs.statSync(archive).size !== part.size) throw Error('Desktop part size differs');
+      chunks.push({ ...part, archive });
+    }
+    if (chunks.reduce((sum, part) => sum + part.size, 0) !== asset.size) throw Error('Desktop parts do not cover archive');
+  } else {
+    const archive = path.join(directory, asset.name); canonical(archive);
+    if (!fs.statSync(archive).isFile() || fs.statSync(archive).size !== asset.size) throw Error('Bundled Desktop archive size differs');
+    chunks.push({ ...asset, archive });
+  }
+  return { release: value, asset, chunks };
+}
+async function copyArchive(bundle, archive) {
+  const output = fs.createWriteStream(archive, { flags: 'wx', mode: 0o600 });
+  const sha256 = crypto.createHash('sha256'), sha512 = crypto.createHash('sha512');
+  let received = 0;
+  try {
+    for (const part of bundle.chunks) {
+      const before = fs.statSync(part.archive);
+      const part256 = crypto.createHash('sha256'), part512 = crypto.createHash('sha512'); let size = 0;
+      for await (const chunk of fs.createReadStream(part.archive)) {
+        size += chunk.length; received += chunk.length;
+        if (size > part.size || received > bundle.asset.size) throw Error('Desktop archive exceeds declared size');
+        part256.update(chunk); part512.update(chunk); sha256.update(chunk); sha512.update(chunk);
+        if (!output.write(chunk)) await once(output, 'drain');
+      }
+      const after = fs.statSync(part.archive);
+      if (size !== part.size || part256.digest('hex') !== part.sha256 || part512.digest('base64') !== part.sha512 ||
+          ['dev', 'ino', 'size', 'mtimeMs', 'ctimeMs'].some(key => before[key] !== after[key])) throw Error('Desktop part checksum differs; archive was not executed');
+    }
+    output.end(); await once(output, 'finish');
+    if (received !== bundle.asset.size || sha256.digest('hex') !== bundle.asset.sha256 || sha512.digest('base64') !== bundle.asset.sha512)
+      throw Error('Desktop archive checksum differs; archive was not executed');
+  } catch (error) { output.destroy(); throw error; }
+}
+async function stageRuntime(bundle, runtime) {
+  const archive = path.join(path.dirname(runtime), 'runtime.zip');
+  await copyArchive(bundle, archive);
+  fs.mkdirSync(runtime, { mode: 0o700 });
+  await require('./extract.cjs').extract(archive, runtime);
+  const executable = process.platform === 'darwin' ? path.join(runtime, 'Aglit AI.app/Contents/MacOS/Aglit AI') : path.join(runtime, 'Aglit AI.exe');
+  verifyRuntime(executable, bundle.release);
+  fs.unlinkSync(archive);
+  return { executable, version: bundle.release.version, sourceCommit: bundle.release.sourceCommit, sha256: bundle.asset.sha256 };
+}
+function verifyRuntime(executable, release) {
+  canonical(executable); verifyPublisher(executable);
+  const resources = process.platform === 'darwin' ? path.resolve(path.dirname(executable), '../Resources') : path.join(path.dirname(executable), 'resources');
+  const buildInfoPath = path.join(resources, 'app.asar.unpacked/dist-electron/desktop-app/build-info.json'); canonical(buildInfoPath);
+  if (fs.statSync(buildInfoPath).size > 16 * 1024 * 1024) throw Error('Build metadata too large');
+  const info = JSON.parse(fs.readFileSync(buildInfoPath, 'utf8'));
+  if (info.version !== release.version || info.gitCommit !== release.sourceCommit || info.dirty !== false || info.runtimeMinified !== true || info.computerUseControlVersion !== 1)
+    throw Error('A published obfuscated desktop release with Computer Use CLI support is required; this archive was not launched');
+  return {version: info.version, sourceCommit: info.gitCommit};
+}
+async function install(channel) {
+  if (channel !== undefined && !['latest', 'canary', 'embedded'].includes(channel)) throw Error('Invalid npm channel');
   if (fs.existsSync(path.join(root, 'uninstalling.json'))) throw Error('Finish aglit uninstall before reinstalling');
   if (!(process.platform === 'darwin' && process.arch === 'arm64') && !(process.platform === 'win32' && process.arch === 'x64')) throw Error('Published Computer Use releases currently support Apple silicon Macs and Windows x64');
   if (fs.existsSync(receiptPath)) return { installed: true, ...readInstallation() };
   if (fs.existsSync(root)) throw Error(`Existing unowned installation directory preserved: ${root}`);
   const platform = process.platform === 'darwin' ? 'mac' : 'win';
-  const base = 'https://github.com/Aglit-AI/desktop-app-release/releases/download/';
-  const desired = parseRelease(await json(base + `updates-${platform}/github-release-${platform}.json`), platform);
-  const release = parseRelease(await json(base + `v${desired.version}/github-release-${platform}.json`), platform);
-  if (JSON.stringify(desired) !== JSON.stringify(release)) throw Error('Release pointer differs from immutable release');
-  // The product's unsigned Windows policy is not silently inherited by the CLI.
-  if (release.windowsSigningPolicy) throw Error('This Windows release is unsigned; Computer Use installation requires a signed release');
+  let bundled = embeddedRelease(platform), bootstrap;
+  if (!bundled) {
+    bootstrap = await require('./updates.cjs').bootstrap(channel);
+    bundled = embeddedRelease(platform, bootstrap.packageDirectory);
+    if (!bundled) throw Error('Published npm CLI has no runtime for this platform');
+  }
   canonical(path.dirname(root));
-  fs.mkdirSync(root, { mode: 0o700 });
-  privateRoot(true);
+  fs.mkdirSync(root, { mode: 0o700 }); privateRoot(true);
   fs.writeFileSync(path.join(root, 'installation-attempt.json'), JSON.stringify({ kind: 'aglit-computer-use-attempt-v1', root }) + '\n', { flag: 'wx', mode: 0o600 });
-  const asset = release.assets.find(item => item.name.endsWith('.zip'));
-  const archive = path.join(root, 'runtime.zip');
-  let received = 0;
-  const sha256 = crypto.createHash('sha256'), sha512 = crypto.createHash('sha512');
-  const meter = new Transform({ transform(chunk, _encoding, done) {
-    received += chunk.length;
-    if (received > asset.size) return done(Error('Release exceeds declared size'));
-    sha256.update(chunk); sha512.update(chunk); done(null, chunk);
-  } });
-  const response = await download(base + `v${release.version}/${asset.name}`);
-  await pipeline(Readable.fromWeb(response.body), meter, fs.createWriteStream(archive, { flags: 'wx', mode: 0o600 }));
-  if (received !== asset.size || sha256.digest('hex') !== asset.sha256 || sha512.digest('base64') !== asset.sha512) throw Error('Release checksum differs; archive was not executed');
-  const runtime = path.join(root, 'runtime');
-  fs.mkdirSync(runtime, { mode: 0o700 });
-  await require('./extract.cjs').extract(archive, runtime);
-  const executable = process.platform === 'darwin' ? path.join(runtime, 'Aglit AI.app/Contents/MacOS/Aglit AI') : path.join(runtime, 'Aglit AI.exe');
-  canonical(executable);
-  verifyPublisher(executable);
-  const resources = process.platform === 'darwin' ? path.join(runtime, 'Aglit AI.app/Contents/Resources') : path.join(runtime, 'resources');
-  const buildInfoPath = path.join(resources, 'app.asar.unpacked/dist-electron/desktop-app/build-info.json');
-  canonical(buildInfoPath);
-  if (fs.statSync(buildInfoPath).size > 16 * 1024 * 1024) throw Error('Build metadata too large');
-  const buildInfo = JSON.parse(fs.readFileSync(buildInfoPath, 'utf8'));
-  if (buildInfo.gitCommit !== release.sourceCommit || buildInfo.dirty !== false ||
-      buildInfo.runtimeMinified !== true || buildInfo.computerUseControlVersion !== 1)
-    throw Error('A published obfuscated desktop release with Computer Use CLI support is required; this archive was not launched');
+  const staged = await stageRuntime(bundled, path.join(root, 'runtime'));
   fs.mkdirSync(profile, { mode: 0o700 });
   fs.writeFileSync(path.join(profile, 'system-settings.json'), JSON.stringify({ settings: { enableAnywhereAccess: false, remoteAccessDeviceId: crypto.randomUUID() } }) + '\n', { flag: 'wx', mode: 0o600 });
-  const receipt = { kind: 'aglit-computer-use-installation-v1', root, profile, executable, version: release.version, sourceCommit: release.sourceCommit, sha256: asset.sha256 };
+  const receipt = { kind: 'aglit-computer-use-installation-v1', root, profile, ...staged };
   fs.writeFileSync(receiptPath, JSON.stringify(receipt) + '\n', { flag: 'wx', mode: 0o600 });
-  fs.unlinkSync(archive);
+  if (bootstrap) require('./updates.cjs').adoptBootstrap(bootstrap);
   return { installed: true, ...receipt };
 }
 function start() {
@@ -171,6 +208,8 @@ function start() {
   const child = spawn(installed.executable, ['--computer-use'], { detached: true, windowsHide: true, stdio: ['ignore', log, log], env });
   child.on('error', error => { process.stderr.write(`Computer Use failed to start: ${error.message}\n`); });
   child.unref(); fs.closeSync(log);
+  if (!Number.isSafeInteger(child.pid)) throw Error('Desktop process did not start');
+  return { pid: child.pid };
 }
 function purge() {
   readInstallation(true);
@@ -211,4 +250,4 @@ function readUninstall() {
       !Number.isSafeInteger(receipt.pid) || receipt.pid <= 0) throw Error('Invalid uninstall receipt');
   return receipt;
 }
-module.exports = { root, profile, readInstallation, install, start, purge, purgeIncomplete, readUninstall };
+module.exports = { root, profile, readInstallation, install, start, purge, purgeIncomplete, readUninstall, privateRoot, canonical, verifyPublisher, embeddedRelease, copyArchive, stageRuntime, verifyRuntime };

package/src/launcher.cjs

@@ -0,0 +1,30 @@
+'use strict';
+// Copied to the private installation root. It has no npm dependencies and its
+// filename remains fixed while versioned CLI/runtime generations are replaced.
+const fs = require('node:fs'), path = require('node:path'), crypto = require('node:crypto');
+const {spawnSync} = require('node:child_process');
+try {
+  const root = __dirname, record = path.join(root, 'cli-installation.json');
+  const stat = fs.lstatSync(record);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 65536 || stat.nlink !== 1 || fs.realpathSync(root) !== root ||
+      process.platform !== 'win32' && (stat.uid !== process.getuid() || stat.mode & 0o077)) throw Error();
+  const updating = path.join(root, 'updating.lock');
+  if (fs.existsSync(updating)) {
+    const lock = fs.lstatSync(updating);
+    if (!lock.isFile() || lock.isSymbolicLink() || lock.size > 65536 || process.platform !== 'win32' && (lock.uid !== process.getuid() || lock.mode & 0o077)) throw Error();
+    const owner = JSON.parse(fs.readFileSync(updating, 'utf8'));
+    if (!Number.isSafeInteger(owner.pid) || owner.pid <= 0) throw Error();
+    try { process.kill(owner.pid, 0); process.stdout.write('Aglit update is active; startup is deferred.\n'); process.exit(0); } catch (error) { if (error.code !== 'ESRCH') throw error; }
+  }
+  const value = JSON.parse(fs.readFileSync(record, 'utf8')), current = value.current;
+  if (value.kind !== 'aglit-cli-installation-v1' || !current || typeof current.directory !== 'string' ||
+      !current.directory.startsWith(path.join(root, 'cli') + path.sep) || !/^[a-f0-9]{64}$/.test(current.sha256)) throw Error();
+  const entry = path.join(current.directory, 'node_modules/@aglit-ai/cli/bin/aglit.cjs');
+  const file = fs.lstatSync(entry);
+  if (!file.isFile() || file.isSymbolicLink() || fs.realpathSync(entry) !== entry || file.size > 1024 * 1024 ||
+      crypto.createHash('sha256').update(fs.readFileSync(entry)).digest('hex') !== current.sha256) throw Error();
+  const result = spawnSync(process.execPath, [entry, ...process.argv.slice(2)], {stdio: 'inherit', windowsHide: true});
+  process.exitCode = result.status ?? 1;
+} catch {
+  process.stderr.write('Aglit private CLI launcher is unavailable. Reinstall @aglit-ai/cli to repair it.\n'); process.exitCode = 1;
+}

package/src/update-worker.cjs

@@ -0,0 +1,37 @@
+'use strict';
+const fs = require('node:fs'), path = require('node:path');
+const updates = require('./updates.cjs'), installation = require('./installation.cjs');
+const {control} = require('./control.cjs');
+const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
+const config = path.join(installation.profile, 'ipc/sdk-ipc.json');
+async function main() {
+  const expectedPid = Number(process.argv[2]);
+  if (process.argv.length !== 3 || !Number.isSafeInteger(expectedPid) || expectedPid <= 0) throw Error('Invalid updater runtime');
+  installation.readInstallation(); const unlock = updates.lock(path.join(installation.root, 'updater-worker.json'));
+  if (!unlock) return;
+  let replacement = null;
+  try {
+    let nextCheck = 0;
+    for (;;) {
+      if (fs.existsSync(path.join(installation.root, 'uninstalling.json')) || fs.existsSync(path.join(installation.root, 'updater-stop.json')) || !updates.state().automatic || !updates.live(expectedPid)) return;
+      let runtime; try { runtime = await control(config, 'status'); } catch { return; }
+      if (!runtime?.running || runtime.pid !== expectedPid) return;
+      updates.rememberStatus(runtime);
+      if (Date.now() >= nextCheck) {
+        nextCheck = Date.now() + 15 * 60000;
+        try {
+          const result = await updates.update();
+          if (result.runtimePid && result.runtimePid !== expectedPid) { replacement = result.runtimePid; return; }
+          if (result.updated) { replacement = expectedPid; return; }
+          if (result.deferred) nextCheck = Date.now() + 60000;
+        } catch {
+          process.stderr.write('Aglit automatic update deferred; current runtime and profile preserved.\n');
+        }
+      }
+      for (let i = 0; i < 30 && !fs.existsSync(path.join(installation.root, 'updater-stop.json')); i++) await delay(1000);
+    }
+  } finally {
+    unlock(); if (replacement && !fs.existsSync(path.join(installation.root, 'updater-stop.json'))) updates.ensureWorker(replacement);
+  }
+}
+main().catch(() => { process.stderr.write('Aglit updater stopped; run aglit update to inspect or retry.\n'); process.exitCode = 1; });

package/src/updates.cjs

@@ -0,0 +1,535 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+const { createRequire } = require('node:module');
+const { spawn, spawnSync, execFileSync } = require('node:child_process');
+const installation = require('./installation.cjs');
+const { control } = require('./control.cjs');
+const ownPackage = path.resolve(__dirname, '..');
+const identity = JSON.parse(fs.readFileSync(path.join(ownPackage, 'package.json'), 'utf8'));
+const channels = ['latest', 'canary', 'embedded'];
+const registry = 'https://registry.npmjs.org/';
+const stateFile = path.join(installation.root, 'cli-installation.json');
+const settingsFile = path.join(installation.root, 'cli-update-settings.json');
+const need = (value, message) => { if (!value) throw Error(message); };
+const sha = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
+const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
+function compareVersions(left, right) {
+  const parse = value => {
+    need(typeof value === 'string' && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[a-z0-9]+(?:[.-][a-z0-9]+)*)?$/.test(value), 'Invalid npm version');
+    const [core, ...suffix] = value.split('-'); const numbers = core.split('.').map(Number);
+    need(numbers.every(Number.isSafeInteger), 'Invalid npm version'); return { numbers, suffix: suffix.join('-') };
+  };
+  const a = parse(left), b = parse(right);
+  for (let index = 0; index < 3; index++) if (a.numbers[index] !== b.numbers[index]) return Math.sign(a.numbers[index] - b.numbers[index]);
+  if (!a.suffix || !b.suffix) return a.suffix === b.suffix ? 0 : a.suffix ? -1 : 1;
+  const x = a.suffix.split('.'), y = b.suffix.split('.');
+  for (let index = 0; index < Math.max(x.length, y.length); index++) {
+    if (x[index] === y[index]) continue;
+    if (x[index] === undefined || y[index] === undefined) return x[index] === undefined ? -1 : 1;
+    const xn = /^\d+$/.test(x[index]), yn = /^\d+$/.test(y[index]);
+    if (xn && yn) return BigInt(x[index]) > BigInt(y[index]) ? 1 : -1;
+    if (xn !== yn) return xn ? -1 : 1;
+    return x[index] > y[index] ? 1 : -1;
+  }
+  return 0;
+}
+function privateJson(file) {
+  installation.canonical(file); const stat = fs.statSync(file);
+  need(stat.isFile() && stat.nlink === 1 && stat.size <= 65536 &&
+    (process.platform === 'win32' || stat.uid === process.getuid() && !(stat.mode & 0o077)), 'Private updater record required');
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+function writeJson(file, value) {
+  const stage = file + '.' + crypto.randomUUID();
+  fs.writeFileSync(stage, JSON.stringify(value) + '\n', {flag: 'wx', mode: 0o600});
+  try { fs.renameSync(stage, file); } finally { if (fs.existsSync(stage)) fs.unlinkSync(stage); }
+}
+function packageDirectory(prefix) { return path.join(prefix, 'node_modules', '@aglit-ai', 'cli'); }
+function pointer(prefix, manifest, integrity = null) {
+  const entry = path.join(packageDirectory(prefix), 'bin/aglit.cjs'); installation.canonical(entry);
+  return { directory: prefix, version: manifest.version, integrity, sha256: sha(fs.readFileSync(entry)) };
+}
+function validatePointer(value) {
+  need(value && Object.keys(value).sort().join(',') === 'directory,integrity,sha256,version' &&
+    value.directory.startsWith(path.join(installation.root, 'cli') + path.sep) && /^[a-f0-9]{64}$/.test(value.sha256) &&
+    (value.integrity === null || /^sha512-[A-Za-z0-9+/]{86}==$/.test(value.integrity)), 'Invalid private CLI installation');
+  compareVersions(value.version, value.version);
+  const entry = path.join(packageDirectory(value.directory), 'bin/aglit.cjs'); installation.canonical(entry);
+  need(sha(fs.readFileSync(entry)) === value.sha256, 'Installed CLI entry changed'); return value;
+}
+function settings() {
+  if (!fs.existsSync(settingsFile)) return {channel: 'latest', automatic: true, revision: 0};
+  const value = privateJson(settingsFile);
+  need(value.kind === 'aglit-cli-update-settings-v1' && Object.keys(value).sort().join(',') === 'automatic,channel,kind,revision' && channels.includes(value.channel) &&
+    typeof value.automatic === 'boolean' && Number.isSafeInteger(value.revision) && value.revision >= 0, 'Invalid CLI update settings');
+  return {channel: value.channel, automatic: value.automatic, revision: value.revision};
+}
+function saveSettings(patch) {
+  const unlock = lock(path.join(installation.root, 'updater-settings.lock')); need(unlock, 'Update settings are busy; retry the command');
+  try { const value = {...settings(), ...patch}; writeJson(settingsFile, {kind: 'aglit-cli-update-settings-v1', ...value, revision: value.revision + 1}); }
+  finally { unlock(); }
+}
+function savePointer(value) { writeJson(stateFile, {kind: 'aglit-cli-installation-v1', current: value.current, previous: value.previous}); }
+function state() {
+  const policy = settings();
+  if (!fs.existsSync(stateFile)) return {kind: 'aglit-cli-installation-v1', ...policy, current: null, previous: null};
+  installation.privateRoot(); const value = privateJson(stateFile);
+  need(value && Object.keys(value).sort().join(',') === 'current,kind,previous' && value.kind === 'aglit-cli-installation-v1', 'Invalid private CLI state');
+  if (value.current) validatePointer(value.current);
+  if (value.previous) validatePointer(value.previous);
+  return {...value, ...policy};
+}
+function resolvePackage(name, from) {
+  const requireFrom = createRequire(path.join(from, 'package.json')); let entry;
+  try { return path.dirname(requireFrom.resolve(name + '/package.json')); } catch (error) { if (!['MODULE_NOT_FOUND', 'ERR_PACKAGE_PATH_NOT_EXPORTED'].includes(error.code)) throw error; }
+  entry = requireFrom.resolve(name);
+  for (let directory = path.dirname(entry), count = 0; count < 20; directory = path.dirname(directory), count++) {
+    const file = path.join(directory, 'package.json');
+    if (fs.existsSync(file) && JSON.parse(fs.readFileSync(file)).name === name) return directory;
+    if (path.dirname(directory) === directory) break;
+  }
+  throw Error('Installed CLI dependency is unavailable');
+}
+function copyPackage(source, target, cli = false, ancestors = []) {
+  const manifest = JSON.parse(fs.readFileSync(path.join(source, 'package.json')));
+  const key = manifest.name + '@' + manifest.version;
+  need(!ancestors.includes(key) && ancestors.length < 16, 'CLI dependency graph cannot be copied safely');
+  fs.mkdirSync(target, {recursive: true, mode: 0o700});
+  const names = cli ? ['package.json', 'README.md', 'bin', 'src'] : fs.readdirSync(source).filter(name => name !== 'node_modules');
+  for (const name of names) fs.cpSync(path.join(source, name), path.join(target, name), {recursive: true, dereference: false, errorOnExist: true, force: false});
+  for (const name of Object.keys(manifest.dependencies || {})) {
+    need(/^(@[a-z0-9-]+\/)?[a-z0-9][a-z0-9._-]*$/.test(name), 'Invalid CLI dependency');
+    copyPackage(resolvePackage(name, source), path.join(target, 'node_modules', name), false, [...ancestors, key]);
+  }
+}
+function writeStartup() {
+  const launcher = path.join(installation.root, 'cli-launcher.cjs');
+  const source = fs.readFileSync(path.join(__dirname, 'launcher.cjs'));
+  const staged = launcher + '.' + crypto.randomUUID(); fs.writeFileSync(staged, source, {flag: 'wx', mode: 0o600}); fs.renameSync(staged, launcher);
+  writeJson(path.join(installation.root, 'cli-startup.json'), {kind: 'aglit-computer-use-cli-startup-v1', nodeExecutable: fs.realpathSync(process.execPath), launcher});
+}
+function initialize(channel) {
+  need(channel === undefined || channels.includes(channel), 'Invalid update channel');
+  installation.readInstallation(); let value = state();
+  if (channel && channel !== value.channel) { saveSettings({channel}); value = state(); }
+  const updating = path.join(installation.root, 'updating.lock');
+  if (fs.existsSync(updating)) { const owner = privateJson(updating); if (owner.pid !== process.pid && live(owner.pid)) return value; }
+  if (!value.current || compareVersions(identity.version, value.current.version) > 0) {
+    const parent = path.join(installation.root, 'cli'); fs.mkdirSync(parent, {recursive: true, mode: 0o700});
+    const prefix = path.join(parent, identity.version + '-' + crypto.randomUUID());
+    copyPackage(ownPackage, packageDirectory(prefix), true);
+    const current = pointer(prefix, identity); value = {...value, previous: value.current, current}; savePointer(value);
+  }
+  writeStartup(); return value;
+}
+function delegate(entry) {
+  if (!fs.existsSync(stateFile)) return null;
+  const current = state().current;
+  if (!current || compareVersions(current.version, identity.version) <= 0) return null;
+  const target = path.join(packageDirectory(current.directory), 'bin/aglit.cjs');
+  if (fs.realpathSync(entry) === fs.realpathSync(target)) return null;
+  const result = spawnSync(process.execPath, [target, ...process.argv.slice(2)], {stdio: 'inherit', windowsHide: true});
+  if (result.error) throw Error('Updated CLI could not start'); return result.status ?? 1;
+}
+async function manifest(name, selector) {
+  need(/^@aglit-ai\/(?:cli|desktop-runtime-(?:darwin-arm64|win32-x64)(?:-part-\d{2})?)$/.test(name), 'Unexpected npm package');
+  if (!channels.includes(selector) && !/^runtime-(?:darwin-arm64|win32-x64)-(?:latest|canary|embedded)$/.test(selector)) compareVersions(selector, selector);
+  const url = new URL(encodeURIComponent(name) + '/' + encodeURIComponent(selector), registry);
+  const response = await fetch(url, {redirect: 'error', signal: AbortSignal.timeout(30000)});
+  if (response.status === 404) {
+    if (/^runtime-(?:darwin-arm64|win32-x64)-/.test(selector)) throw Error('No published signed Desktop runtime is available for ' + process.platform + ' ' + process.arch + ' in npm channel ' + selector);
+    if (name === '@aglit-ai/cli') throw Error('The Aglit CLI npm release ' + selector + ' has not been published yet');
+    if (name === runtimePackage()) throw Error('No published signed Desktop runtime is available for ' + process.platform + ' ' + process.arch + ' in npm channel/version ' + selector);
+    throw Error('A required verified Desktop runtime part is not published yet');
+  }
+  need(response.ok && response.body, 'Published npm release is unavailable');
+  let size = 0; const chunks = [];
+  for await (const chunk of response.body) { size += chunk.length; need(size <= 2 * 1024 ** 2, 'npm metadata is too large'); chunks.push(chunk); }
+  const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+  need(value.name === name && value._npmUser?.name === 'aglit-ai-dev' && value._npmUser?.email === 'developers@aglit.ai' &&
+    /^sha512-[A-Za-z0-9+/]{86}==$/.test(value.dist?.integrity), 'Company npm publisher and integrity required');
+  compareVersions(value.version, value.version);
+  const tarball = new URL(value.dist.tarball); need(tarball.protocol === 'https:' && tarball.hostname === 'registry.npmjs.org' && !tarball.username && !tarball.password, 'Untrusted npm archive');
+  return value;
+}
+function runtimePackage() {
+  need(process.platform === 'darwin' && process.arch === 'arm64' || process.platform === 'win32' && process.arch === 'x64', 'Published runtime does not support this platform');
+  return '@aglit-ai/desktop-runtime-' + process.platform + '-' + process.arch;
+}
+function runtimeVersion(value) {
+  if (value.name === runtimePackage()) { compareVersions(value.version, value.version); return value.version; }
+  const expected = process.platform + '-' + process.arch;
+  const match = /^(\d+\.\d+\.\d+)-runtime\.(darwin-arm64|win32-x64)$/.exec(value.version);
+  need(value.name === '@aglit-ai/cli' && match && match[2] === expected, 'Runtime npm version does not match this platform');
+  return match[1];
+}
+function runtimeTag(channel) { runtimePackage(); need(channels.includes(channel), 'Invalid update channel'); return 'runtime-' + process.platform + '-' + process.arch + '-' + channel; }
+async function releaseManifests(cli, offeredRuntime) {
+  const result = [{...cli, installName: '@aglit-ai/cli'}], name = runtimePackage();
+  const pin = cli.optionalDependencies?.[name];
+  let runtime = offeredRuntime;
+  if (!runtime) {
+    need(typeof pin === 'string', 'Published CLI has no runtime for this platform');
+    const alias = /^npm:@aglit-ai\/cli@(\d+\.\d+\.\d+-runtime\.(?:darwin-arm64|win32-x64))$/.exec(pin);
+    if (alias) runtime = await manifest('@aglit-ai/cli', alias[1]);
+    else { need(/^\d+\.\d+\.\d+$/.test(pin), 'Runtime bootstrap pin differs'); runtime = await manifest(name, pin); }
+  }
+  const nativeVersion = runtimeVersion(runtime), aliased = runtime.name === '@aglit-ai/cli';
+  result.push({...runtime, installName: name});
+  const entries = Object.entries(runtime.dependencies || {});
+  need(entries.length > 0 && entries.length <= 64, 'Runtime part dependencies are unavailable');
+  for (let index = 0; index < entries.length; index++) {
+    const installName = name + '-part-' + String(index).padStart(2, '0');
+    const version = aliased ? runtime.version + '.part-' + String(index).padStart(2, '0') : nativeVersion;
+    need(runtime.dependencies[installName] === (aliased ? 'npm:@aglit-ai/cli@' : '') + version, 'Runtime part alias or pin differs');
+    const part = await manifest(aliased ? '@aglit-ai/cli' : installName, version);
+    need(part.version === version && !Object.keys(part.dependencies || {}).length, 'Runtime part package differs');
+    result.push({...part, installName});
+  }
+  return result;
+}
+function npmEntry() {
+  const node = fs.realpathSync(process.execPath), directory = path.dirname(node);
+  const candidates = [path.join(directory, 'node_modules/npm/bin/npm-cli.js'), path.resolve(directory, '../lib/node_modules/npm/bin/npm-cli.js')];
+  for (const file of candidates) if (fs.existsSync(file)) return fs.realpathSync(file);
+  const nearby = path.join(path.dirname(process.execPath), process.platform === 'win32' ? 'npm.cmd' : 'npm');
+  if (process.platform !== 'win32' && fs.existsSync(nearby)) return fs.realpathSync(nearby);
+  throw Error('npm must be installed with Node.js to update Aglit');
+}
+async function stage(cli, parent, offeredRuntime, cliOnly = false) {
+  need(cli.name === '@aglit-ai/cli' && cli.bin?.aglit === 'bin/aglit.cjs' && !/-runtime\.(?:darwin-arm64|win32-x64)/.test(cli.version), 'Selected npm version is not the Aglit CLI launcher');
+  const manifests = cliOnly ? [{...cli, installName: '@aglit-ai/cli'}] : await releaseManifests(cli, offeredRuntime);
+  const runtime = manifests[1];
+  const directory = fs.mkdtempSync(path.join(parent, 'aglit-cli-')); fs.chmodSync(directory, 0o700);
+  fs.writeFileSync(path.join(directory, 'package.json'), '{"private":true}\n', {mode: 0o600});
+  const config = path.join(directory, 'npmrc'); fs.writeFileSync(config, 'registry=' + registry + '\n@aglit-ai:registry=' + registry + '\n', {mode: 0o600});
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^npm_config_|^node_auth_token$|^npm_token$|^node_options$|^node_path$/i.test(key)));
+  await new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [npmEntry(), 'install', '--ignore-scripts', '--omit=optional', '--no-audit', '--no-fund', '--save-exact', '--package-lock=true', '--registry=' + registry,
+      '--userconfig=' + config, '--globalconfig=' + (process.platform === 'win32' ? 'NUL' : '/dev/null'), cli.name + '@' + cli.version, ...(runtime ? [runtime.installName + '@' + (runtime.name === runtime.installName ? runtime.version : 'npm:' + runtime.name + '@' + runtime.version)] : [])], {cwd: directory, env, windowsHide: true, stdio: ['ignore', 'ignore', 'ignore']});
+    const timeout = setTimeout(() => { child.kill(); reject(Error('npm update download timed out; current runtime preserved')); }, 30 * 60000);
+    const cancellation = setInterval(() => { if (fs.existsSync(path.join(installation.root, 'updater-stop.json'))) child.kill(); }, 1000);
+    child.on('error', () => { clearInterval(cancellation); clearTimeout(timeout); reject(Error('npm update could not start')); });
+    child.on('exit', code => { clearInterval(cancellation); clearTimeout(timeout); code === 0 ? resolve() : reject(Error('npm update download failed; current runtime preserved')); });
+  });
+  validateInstalledGraph(directory, manifests);
+  fs.unlinkSync(config); return {directory, packageDirectory: packageDirectory(directory), runtimeDirectory: runtime ? path.join(directory, 'node_modules', runtime.installName) : null, cli};
+}
+function validateInstalledGraph(directory, manifests) {
+  const lock = JSON.parse(fs.readFileSync(path.join(directory, 'package-lock.json'), 'utf8'));
+  for (const expected of manifests) {
+    const entry = lock.packages?.['node_modules/' + expected.installName];
+    need(entry?.version === expected.version && entry.integrity === expected.dist.integrity, 'Downloaded npm package integrity differs');
+    const installed = JSON.parse(fs.readFileSync(path.join(directory, 'node_modules', expected.installName, 'package.json')));
+    need(installed.name === expected.name && installed.version === expected.version, 'Installed npm package identity differs');
+  }
+  return true;
+}
+async function bootstrap(channel) {
+  const selected = channel || state().channel;
+  need(channels.includes(selected), 'Invalid update channel');
+  const offered = await offers(selected);
+  return {...await stage(offered.cli, fs.realpathSync(os.tmpdir()), offered.runtime), channel: selected};
+}
+function adoptBootstrap(value) {
+  const parent = path.join(installation.root, 'cli'); fs.mkdirSync(parent, {recursive: true, mode: 0o700});
+  const target = path.join(parent, value.cli.version + '-' + crypto.randomUUID());
+  try { fs.renameSync(value.directory, target); } catch (error) { if (error.code !== 'EXDEV') throw error; fs.cpSync(value.directory, target, {recursive: true}); fs.rmSync(value.directory, {recursive: true}); }
+  const prior = state(); saveSettings({channel: value.channel}); savePointer({...prior, current: pointer(target, value.cli, value.cli.dist.integrity), previous: prior.current}); writeStartup();
+}
+function live(pid) { try { process.kill(pid, 0); return true; } catch (error) { if (error.code === 'ESRCH') return false; throw error; } }
+function lock(file) {
+  if (fs.existsSync(file)) {
+    const value = privateJson(file); need(Number.isSafeInteger(value.pid) && value.pid > 0, 'Invalid updater lock');
+    if (live(value.pid)) return null; fs.unlinkSync(file);
+  }
+  const nonce = crypto.randomUUID();
+  try { fs.writeFileSync(file, JSON.stringify({pid: process.pid, nonce}) + '\n', {flag: 'wx', mode: 0o600}); }
+  catch (error) { if (error.code === 'EEXIST') return null; throw error; }
+  return () => { if (fs.existsSync(file) && privateJson(file).nonce === nonce) fs.unlinkSync(file); };
+}
+async function offers(selected) {
+  const cli = await manifest('@aglit-ai/cli', selected);
+  need(cli.bin?.aglit === 'bin/aglit.cjs' && !/-runtime\.(?:darwin-arm64|win32-x64)/.test(cli.version), 'Selected channel does not identify the CLI launcher');
+  const runtime = await manifest('@aglit-ai/cli', runtimeTag(selected));
+  runtimeVersion(runtime);
+  return {cli, runtime};
+}
+async function status() {
+  const value = state(), latest = await offers(value.channel);
+  const version = value.current?.version || identity.version;
+  const installedRuntimeVersion = fs.existsSync(path.join(installation.root, 'installation.json')) ? installation.readInstallation().version : null;
+  return {channel: value.channel, automatic: value.automatic, version, availableVersion: latest.cli.version,
+    runtimeVersion: installedRuntimeVersion, availableRuntimeVersion: runtimeVersion(latest.runtime),
+    updateAvailable: compareVersions(latest.cli.version, version) > 0 || installedRuntimeVersion !== null && compareVersions(runtimeVersion(latest.runtime), installedRuntimeVersion) > 0};
+}
+function runtimeStopped(installed) {
+  installation.canonical(installed.executable);
+  if (process.platform === 'darwin') {
+    const output = execFileSync('/bin/ps', ['-axo', 'pid=,uid=,comm='], {encoding: 'utf8', timeout: 15000, maxBuffer: 8 * 1024 ** 2});
+    const lines = output.trim().split('\n'); need(lines.length > 1, 'Native process inventory unavailable');
+    return !lines.some(line => {
+      const found = /^\s*(\d+)\s+(-?\d+)\s+(.+)$/.exec(line); need(found, 'Native process inventory is incomplete');
+      return found[3].trim() === installed.executable;
+    });
+  }
+  if (process.platform === 'win32') {
+    const powershell = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe');
+    const script = '$ErrorActionPreference="Stop";$rows=@(Get-CimInstance Win32_Process -Filter "Name=\'Aglit AI.exe\'");$unknown=@($rows|Where-Object{![bool]$_.ExecutablePath});$matches=@($rows|Where-Object{$_.ExecutablePath -eq $env:AGLIT_EXPECTED_RUNTIME});@{stopped=($unknown.Count -eq 0 -and $matches.Count -eq 0)}|ConvertTo-Json -Compress';
+    const output = execFileSync(powershell, ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script], {encoding: 'utf8', timeout: 15000, maxBuffer: 65536, windowsHide: true, env: {...process.env, AGLIT_EXPECTED_RUNTIME: installed.executable}});
+    return JSON.parse(output).stopped === true;
+  }
+  throw Error('Native process ownership proof unavailable');
+}
+function rememberStatus(value) {
+  need(value?.running && Number.isSafeInteger(value.pid) && typeof value.deviceId === 'string' && value.deviceId.length > 0 &&
+    (value.email === null || typeof value.email === 'string') && typeof value.enabled === 'boolean', 'Current runtime identity is incomplete');
+  const saved = {kind: 'aglit-cli-runtime-status-v1', version: value.version, deviceId: value.deviceId, email: value.email,
+    enabled: value.enabled, provider: value.provider, mode: value.mode, pid: value.pid};
+  writeJson(path.join(installation.root, 'last-runtime-status.json'), saved); return saved;
+}
+function offlineStatus(installed) {
+  const previous = path.join(installation.root, 'last-runtime-status.json');
+  if (fs.existsSync(previous)) { const value = privateJson(previous); need(value.kind === 'aglit-cli-runtime-status-v1' && value.version === installed.version, 'Previous runtime identity is unavailable'); return value; }
+  // A never-enrolled legacy installation can migrate without reading any auth
+  // files. Existing registered profiles require an authenticated prior status.
+  const file = path.join(installation.profile, 'system-settings.json');
+  const value = privateJson(file).settings;
+  need(value && value.enableAnywhereAccess === false && typeof value.remoteAccessDeviceId === 'string' && !value.providerSettings?.chatProvider,
+    'Start the existing Desktop and run aglit status, then quit it normally before the first npm update');
+  return {deviceId: value.remoteAccessDeviceId, email: null, enabled: false, provider: null, mode: 'headless'};
+}
+function continuity(value, original, runtime) {
+  return value?.running && value.version === runtime.version && value.deviceId === original.deviceId && value.email === original.email &&
+    value.enabled === original.enabled && value.provider === original.provider;
+}
+function activationHold(runtime, original) {
+  return {kind: 'aglit-computer-use-update-activation-v1', root: installation.root, profile: installation.profile,
+    ...runtime, deviceId: original.deviceId, email: original.email, enabled: original.enabled, provider: original.provider};
+}
+function removeHold(runtime) {
+  const file = path.join(installation.root, 'update-activation.json'); if (!fs.existsSync(file)) return;
+  const hold = privateJson(file);
+  need(hold.kind === 'aglit-computer-use-update-activation-v1' && hold.executable === runtime.executable && hold.version === runtime.version &&
+    hold.sha256 === runtime.sha256 && hold.sourceCommit === runtime.sourceCommit && hold.root === installation.root && hold.profile === installation.profile, 'Candidate activation hold changed');
+  fs.unlinkSync(file);
+}
+async function acceptCandidate(config, pid, version) {
+  // The native contract makes this action idempotent for one running occurrence.
+  // Retry only this explicit acknowledgement, never general mutation commands.
+  let result;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try { result = await control(config, 'update-accept'); break; }
+    catch (error) { if (attempt === 1) throw error; await delay(250); }
+  }
+  need(result?.accepted === true && result.pid === pid && result.version === version, 'Updated runtime did not accept its continuity hold');
+  return result;
+}
+async function recoverActivation(ownedLock = false) {
+  const file = path.join(installation.root, 'update-transaction.json'); if (!fs.existsSync(file)) return {recovered: false};
+  const unlock = ownedLock ? () => {} : lock(path.join(installation.root, 'updating.lock')); if (!unlock) return {recovered: false, updating: true};
+  try {
+    const tx = privateJson(file), current = installation.readInstallation();
+    need(tx.kind === 'aglit-cli-activation-recovery-v1' && tx.previous.root === installation.root && tx.previous.profile === installation.profile &&
+      tx.runtime.executable.startsWith(path.join(installation.root, 'runtimes') + path.sep), 'Interrupted update recovery binding differs');
+    validatePointer(tx.candidate); if (tx.previousCli.current) validatePointer(tx.previousCli.current);
+    const holdFile = path.join(installation.root, 'update-activation.json');
+    if (current.sha256 === tx.runtime.sha256 && current.executable === tx.runtime.executable) {
+      const policy = settings();
+      const cancelled = tx.policy && (policy.channel !== tx.policy.channel || policy.revision !== tx.policy.revision && !policy.automatic);
+      let launched = null, measured = null;
+      if (!cancelled && runtimeStopped(current)) { writeJson(holdFile, activationHold(tx.runtime, tx.original)); launched = installation.start(); }
+      const deadline = Date.now() + 120000, config = path.join(installation.profile, 'ipc/sdk-ipc.json');
+      if (!cancelled) do {
+        try { const value = await control(config, 'status'); if (continuity(value, tx.original, tx.runtime) && (!launched || value.pid === launched.pid)) { measured = value; break; } }
+        catch { /* Account/provider restore may still be in flight. */ }
+        await delay(1000);
+      } while (Date.now() < deadline && !runtimeStopped(current));
+      if (measured) {
+        if (fs.existsSync(holdFile)) { await acceptCandidate(config, measured.pid, tx.runtime.version); }
+        fs.unlinkSync(file); const pending = path.join(installation.root, 'pending-update.json'); if (fs.existsSync(pending)) fs.unlinkSync(pending);
+        return {recovered: true, accepted: true, runtimePid: measured.pid};
+      }
+      if (!runtimeStopped(current)) {
+        const result = await control(config, 'update-prepare'); need(result.quitting && Number.isSafeInteger(result.pid), 'Candidate cannot safely retire for recovery');
+        const deadline = Date.now() + 30000; while (live(result.pid) && Date.now() < deadline) await delay(250);
+      }
+      need(runtimeStopped(current), 'Candidate process remains active; recovery preserved');
+    } else {
+      need(current.sha256 === tx.previous.sha256 && current.executable === tx.previous.executable, 'Installation changed outside interrupted update');
+      if (!fs.existsSync(holdFile)) {
+        if (tx.retirementRequested) {
+          if (!runtimeStopped(tx.previous)) {
+            try { await control(path.join(installation.profile, 'ipc/sdk-ipc.json'), 'status'); }
+            catch {
+              const deadline = Date.now() + 30000; while (!runtimeStopped(tx.previous) && Date.now() < deadline) await delay(500);
+              need(runtimeStopped(tx.previous), 'Previous runtime is still retiring; profile preserved');
+            }
+          }
+          if (runtimeStopped(tx.previous)) installation.start();
+        }
+        fs.unlinkSync(file); return {recovered: true, activated: false};
+      }
+      need(runtimeStopped({...current, ...tx.runtime}), 'Interrupted candidate process is still active');
+    }
+    removeHold(tx.runtime);
+    writeJson(path.join(installation.root, 'installation.json'), tx.previous); savePointer(tx.previousCli); writeStartup();
+    if (runtimeStopped(tx.previous)) installation.start(); fs.unlinkSync(file);
+    return {recovered: true, rolledBack: true};
+  } finally { unlock(); }
+}
+async function update({check = false, channel} = {}) {
+  need(channel === undefined || channels.includes(channel), 'Update channel must be latest, canary or embedded');
+  if (check) {
+    const current = state(), latest = await offers(channel || current.channel);
+    const installed = fs.existsSync(path.join(installation.root, 'installation.json')) ? installation.readInstallation() : null;
+    return {channel: channel || current.channel, version: current.current?.version || identity.version, availableVersion: latest.cli.version,
+      runtimeVersion: installed?.version || null, availableRuntimeVersion: runtimeVersion(latest.runtime),
+      updateAvailable: compareVersions(latest.cli.version, current.current?.version || identity.version) > 0 || Boolean(installed && compareVersions(runtimeVersion(latest.runtime), installed.version) > 0), automatic: current.automatic};
+  }
+  installation.readInstallation();
+  const unlock = lock(path.join(installation.root, 'updating.lock')); if (!unlock) return {updated: false, updating: true};
+  try {
+    await recoverActivation(true);
+    initialize(channel);
+    const value = state(), policy = settings(), installed = installation.readInstallation();
+    const selected = value.channel, latest = await offers(selected), currentVersion = value.current?.version || identity.version;
+    const cancelled = () => {
+      const current = settings();
+      need(!fs.existsSync(path.join(installation.root, 'updater-stop.json')) && current.channel === selected &&
+        !(current.revision !== policy.revision && !current.automatic), 'Update cancelled before activation; current profile preserved');
+    };
+    cancelled();
+    const cliAvailable = compareVersions(latest.cli.version, currentVersion) > 0;
+    const runtimeAvailable = compareVersions(runtimeVersion(latest.runtime), installed.version) > 0;
+    if (!cliAvailable && !runtimeAvailable) return {updated: false, version: currentVersion, runtimeVersion: installed.version};
+    const cli = cliAvailable || latest.cli.version === currentVersion ? latest.cli : await manifest('@aglit-ai/cli', currentVersion);
+    if (!runtimeAvailable) {
+      const pending = await stage(cli, path.join(installation.root, 'cli'), null, true); cancelled();
+      savePointer({...state(), current: pointer(pending.directory, cli, cli.dist.integrity), previous: state().current}); writeStartup();
+      return {updated: true, version: cli.version, runtimeUpdated: false};
+    }
+    const pendingFile = path.join(installation.root, 'pending-update.json');
+    let prepared = fs.existsSync(pendingFile) ? privateJson(pendingFile) : null;
+    if (prepared && (prepared.kind !== 'aglit-cli-pending-update-v1' || prepared.cliVersion !== cli.version || prepared.runtimeVersion !== runtimeVersion(latest.runtime) || prepared.previousArchive !== installed.sha256)) prepared = null;
+    if (!prepared) {
+      const pending = await stage(cli, path.join(installation.root, 'cli'), latest.runtime); cancelled();
+      const candidate = pointer(pending.directory, cli, cli.dist.integrity);
+      const bundle = installation.embeddedRelease(process.platform === 'darwin' ? 'mac' : 'win', pending.packageDirectory, pending.runtimeDirectory);
+      need(bundle && compareVersions(bundle.release.version, installed.version) > 0, 'Desktop update would not advance this computer');
+      const generations = path.join(installation.root, 'runtimes'); fs.mkdirSync(generations, {recursive: true, mode: 0o700});
+      const generation = fs.mkdtempSync(path.join(generations, bundle.release.version + '-')); fs.chmodSync(generation, 0o700);
+      const runtime = await installation.stageRuntime(bundle, path.join(generation, 'runtime')); cancelled();
+      prepared = {kind: 'aglit-cli-pending-update-v1', cliVersion: cli.version, runtimeVersion: runtime.version, previousArchive: installed.sha256, candidate, runtime};
+      writeJson(pendingFile, prepared);
+    }
+    const {candidate, runtime} = prepared; validatePointer(candidate);
+    need(runtime.executable.startsWith(path.join(installation.root, 'runtimes') + path.sep), 'Invalid staged Desktop generation');
+    installation.canonical(runtime.executable); installation.verifyRuntime(runtime.executable, runtime); cancelled();
+    const config = path.join(installation.profile, 'ipc/sdk-ipc.json');
+    let original, retiring = null;
+    try { original = rememberStatus(await control(config, 'status')); }
+    catch { need(runtimeStopped(installed), 'Desktop is running but unavailable; stop it normally before updating'); original = offlineStatus(installed); }
+    if (original.enabled) need(original.email, 'Restore the current Desktop sign-in before applying an update');
+    const transaction = path.join(installation.root, 'update-transaction.json');
+    const activation = path.join(installation.root, 'update-activation.json');
+    const before = {kind: 'aglit-cli-activation-recovery-v1', previous: installed, previousCli: {current: state().current, previous: state().previous}, candidate, runtime, original, policy: {channel: selected, revision: policy.revision, automatic: policy.automatic}};
+    writeJson(transaction, before);
+    let launched = null, switched = false, oldRetired = false, accepted = false;
+    try {
+      cancelled();
+      if (!runtimeStopped(installed)) {
+        let ready; try { ready = await control(config, 'update-status'); }
+        catch { return {updated: false, deferred: true, reason: 'legacy-runtime-needs-normal-exit', availableVersion: cli.version}; }
+        if (!ready?.supported || ready.busy) return {updated: false, deferred: true, reason: 'active-work', availableVersion: cli.version};
+        cancelled(); writeJson(transaction, {...before, retirementRequested: true}); retiring = await control(config, 'update-prepare');
+        if (!retiring?.quitting || retiring.busy) return {updated: false, deferred: true, reason: 'active-work', availableVersion: cli.version};
+        need(Number.isSafeInteger(retiring.pid) && retiring.pid > 0 && retiring.pid === original.pid, 'Runtime retirement acknowledgement required');
+        const deadline = Date.now() + 30000;
+        while (live(retiring.pid) && Date.now() < deadline) await delay(250);
+        need(!live(retiring.pid), 'Runtime is still closing; update remains staged');
+      }
+      oldRetired = true; cancelled();
+      need(runtimeStopped(installed), 'A legacy Desktop started during activation; update remains staged');
+      const authoritative = installation.readInstallation(); need(authoritative.sha256 === installed.sha256 && authoritative.executable === installed.executable, 'Installation changed during update');
+      writeJson(path.join(installation.root, 'installation.previous.json'), installed);
+      writeJson(activation, activationHold(runtime, original));
+      writeJson(path.join(installation.root, 'installation.json'), {...installed, ...runtime}); switched = true;
+      savePointer({...state(), current: candidate, previous: before.previousCli.current}); writeStartup();
+      cancelled(); launched = installation.start();
+      let replacement; const deadline = Date.now() + 120000;
+      do {
+        await delay(1000);
+        try { const current = await control(config, 'status');
+          if (current.pid === launched.pid && continuity(current, original, runtime)) { replacement = current; break; }
+        } catch { /* Allow the replacement account/provider settings to restore. */ }
+      } while (live(launched.pid) && Date.now() < deadline);
+      need(replacement, 'Updated Desktop continuity did not match before its readiness deadline'); cancelled();
+      await acceptCandidate(config, launched.pid, runtime.version);
+      accepted = true;
+      let windowRestored = true;
+      if ((retiring?.mode || original.mode) === 'headed') { try { await control(config, 'window', {mode: 'headed'}); } catch { windowRestored = false; } }
+      try { fs.unlinkSync(pendingFile); fs.unlinkSync(transaction); } catch { /* Accepted runtime stays active; next start settles only metadata. */ }
+      return {updated: true, version: cli.version, runtimeUpdated: true, runtimeVersion: runtime.version, runtimePid: replacement.pid, windowRestored};
+    } catch (error) {
+      if (accepted) return {updated: true, version: cli.version, runtimeUpdated: true, runtimeVersion: runtime.version, runtimePid: launched.pid, recoveryMetadataPending: true};
+      // A candidate can be retired only through its own authenticated idle
+      // handoff. Never kill an unproven process or start two profile owners.
+      let candidateStopped = !launched || !live(launched.pid);
+      if (launched && !candidateStopped) {
+        try { const closing = await control(config, 'update-prepare'); if (closing.quitting && closing.pid === launched.pid) {
+          const deadline = Date.now() + 30000; while (live(launched.pid) && Date.now() < deadline) await delay(250); candidateStopped = !live(launched.pid);
+        } } catch { /* Preserve any busy or uncertain candidate for recovery. */ }
+      }
+      let restored = false;
+      if (candidateStopped && (oldRetired || switched || retiring?.quitting)) {
+        try {
+          removeHold(runtime);
+          writeJson(path.join(installation.root, 'installation.json'), installed); savePointer(before.previousCli); writeStartup();
+          if (runtimeStopped(installed)) installation.start();
+          restored = true; if (fs.existsSync(transaction)) fs.unlinkSync(transaction);
+        } catch { /* Durable recovery record retains original receipt and CLI. */ }
+      }
+      writeJson(path.join(installation.root, 'update-recovery.json'), {...before, rolledBack: restored});
+      throw Error(restored ? 'Updated Desktop failed; previous runtime restored with the original profile' : 'Update stopped; previous runtime and recovery receipt preserved');
+    }
+  } finally { unlock(); }
+}
+async function stopWorker() {
+  if (!fs.existsSync(installation.root)) return;
+  installation.privateRoot(); const marker = path.join(installation.root, 'updater-stop.json');
+  writeJson(marker, {kind: 'aglit-cli-updater-stop-v1'});
+  const file = path.join(installation.root, 'updater-worker.json');
+  const deadline = Date.now() + 30000;
+  while (fs.existsSync(file) && Date.now() < deadline) {
+    const worker = privateJson(file);
+    if (!Number.isSafeInteger(worker.pid) || !live(worker.pid)) { fs.unlinkSync(file); break; }
+    await delay(250);
+  }
+  need(!fs.existsSync(file), 'Updater is closing; installation preserved. Retry aglit uninstall.');
+  if (fs.existsSync(marker)) fs.unlinkSync(marker);
+}
+async function automatic(enabled) {
+  need(typeof enabled === 'boolean', 'Automatic update setting required'); installation.readInstallation(); saveSettings({automatic: enabled});
+  if (!enabled) await stopWorker();
+  else { try { const running = await control(path.join(installation.profile, 'ipc/sdk-ipc.json'), 'status'); if (running.running) ensureWorker(running.pid); } catch { /* Next start resumes automatic updates. */ } }
+  return {automatic: enabled, channel: state().channel};
+}
+async function prepareUninstall() {
+  await stopWorker(); const unlock = lock(path.join(installation.root, 'updating.lock'));
+  need(unlock, 'An update is still active; installation preserved. Retry uninstall after it finishes.'); return unlock;
+}
+function ensureWorker(runtimePid) {
+  const value = initialize(); if (!value.automatic) return;
+  const stop = path.join(installation.root, 'updater-stop.json'); if (fs.existsSync(stop)) { privateJson(stop); fs.unlinkSync(stop); }
+  const file = path.join(installation.root, 'updater-worker.json');
+  if (fs.existsSync(file)) { const previous = privateJson(file); if (Number.isSafeInteger(previous.pid) && live(previous.pid)) return; fs.unlinkSync(file); }
+  const script = path.join(packageDirectory(value.current.directory), 'src/update-worker.cjs'); installation.canonical(script);
+  const log = fs.openSync(path.join(installation.root, 'updater.log'), 'a', 0o600);
+  const env = {...process.env}; for (const key of Object.keys(env)) if (/^AGLIT_|^VITE_|^NODE_OPTIONS$|^NODE_PATH$|^ELECTRON_RUN_AS_NODE$/.test(key)) delete env[key];
+  const child = spawn(process.execPath, [script, String(runtimePid)], {detached: true, windowsHide: true, env, stdio: ['ignore', log, log]}); child.on('error', () => {}); child.unref(); fs.closeSync(log);
+}
+module.exports = {compareVersions, state, initialize, delegate, manifest, bootstrap, adoptBootstrap, status, update, automatic, ensureWorker, stopWorker, prepareUninstall, lock, writeJson, privateJson, live, stage, settings, runtimeStopped, rememberStatus, recoverActivation, runtimeVersion, runtimeTag, releaseManifests, validateInstalledGraph};