@astrale-os/cli 1.0.0-beta.19 → 1.0.0-beta.20

package/dist/public/connect-core.js

@@ -24476,6 +24476,18 @@ class AdminInstanceNotFoundError extends AstraleError {
 }
 
 // src/lib/update.ts
+import {
+  chmod,
+  copyFile,
+  mkdir as mkdir5,
+  mkdtemp,
+  readFile as readFile6,
+  realpath,
+  rename as rename2,
+  rm,
+  writeFile as writeFile2
+} from "node:fs/promises";
+import { dirname as dirname5, join as join4 } from "node:path";
 var DEFAULT_REPO = "astrale-os/cli";
 var DEFAULT_UPDATE_CHANNEL = "beta";
 var InstallMetadataSchema = exports_external.object({
@@ -24501,6 +24513,135 @@ var UpdateManifestSchema = exports_external.object({
   ]))
 });
 var admittedScriptInstall = Symbol("admittedScriptInstall");
+function isMissingFile(error51) {
+  return error51 instanceof Error && "code" in error51 && error51.code === "ENOENT";
+}
+async function writeInstallMetadata(meta3, path = INSTALL_PATH, filesystem = { mkdir: mkdir5, rename: rename2, rm, writeFile: writeFile2 }) {
+  const staged = `${path}.next`;
+  const previous = `${path}.previous`;
+  await filesystem.mkdir(dirname5(path), { recursive: true });
+  await filesystem.rm(staged, { force: true });
+  await filesystem.rm(previous, { force: true });
+  await filesystem.writeFile(staged, JSON.stringify(meta3, null, 2) + `
+`);
+  let backedUp = false;
+  try {
+    try {
+      await filesystem.rename(path, previous);
+      backedUp = true;
+    } catch (error51) {
+      if (!isMissingFile(error51))
+        throw error51;
+    }
+    await filesystem.rename(staged, path);
+    await filesystem.rm(previous, { force: true });
+  } catch (error51) {
+    const rollback = [];
+    if (backedUp) {
+      await filesystem.rename(previous, path).catch((failure) => rollback.push(failure));
+    }
+    await filesystem.rm(staged, { force: true }).catch((failure) => rollback.push(failure));
+    if (rollback.length > 0) {
+      throw new AggregateError([error51, ...rollback], "Install metadata update and rollback both failed.");
+    }
+    throw error51;
+  }
+}
+var defaultCohortFilesystem = { chmod, copyFile, mkdir: mkdir5, rename: rename2, rm };
+async function replaceStandaloneCohort(installedBinary, nextBinary, nextViewerDist, filesystem = {}) {
+  const fs = { ...defaultCohortFilesystem, ...filesystem };
+  const binDirectory = dirname5(installedBinary);
+  const previousBinary = `${installedBinary}.previous`;
+  const stagedBinary = `${installedBinary}.next`;
+  const viewer = join4(binDirectory, "viewer");
+  const previousViewer = join4(binDirectory, "viewer.previous");
+  const stagedViewer = join4(binDirectory, "viewer.next");
+  const stagedViewerDist = join4(stagedViewer, "dist");
+  try {
+    await fs.rm(stagedViewer, { recursive: true, force: true });
+    await fs.mkdir(stagedViewerDist, { recursive: true });
+    await fs.copyFile(join4(nextViewerDist, "main.js"), join4(stagedViewerDist, "main.js"));
+    await fs.copyFile(join4(nextViewerDist, "index.html"), join4(stagedViewerDist, "index.html"));
+    await fs.copyFile(installedBinary, previousBinary);
+    await fs.copyFile(nextBinary, stagedBinary);
+    await fs.chmod(stagedBinary, 493);
+  } catch (error51) {
+    await fs.rm(stagedViewer, { recursive: true, force: true }).catch(() => {
+      return;
+    });
+    await fs.rm(stagedBinary, { force: true }).catch(() => {
+      return;
+    });
+    throw error51;
+  }
+  await fs.rm(previousViewer, { recursive: true, force: true });
+  let viewerBackedUp = false;
+  let viewerCommitted = false;
+  let binaryCommitted = false;
+  try {
+    try {
+      await fs.rename(viewer, previousViewer);
+      viewerBackedUp = true;
+    } catch (error51) {
+      if (error51.code !== "ENOENT")
+        throw error51;
+    }
+    await fs.rename(stagedViewer, viewer);
+    viewerCommitted = true;
+    await fs.rename(stagedBinary, installedBinary);
+    binaryCommitted = true;
+  } catch (error51) {
+    const rollback = [];
+    if (binaryCommitted) {
+      await fs.copyFile(previousBinary, installedBinary).catch((failure) => rollback.push(failure));
+      await fs.chmod(installedBinary, 493).catch((failure) => rollback.push(failure));
+    }
+    if (viewerCommitted) {
+      await fs.rm(viewer, { recursive: true, force: true }).catch((failure) => rollback.push(failure));
+    }
+    if (viewerBackedUp) {
+      await fs.rename(previousViewer, viewer).catch((failure) => rollback.push(failure));
+    }
+    if (rollback.length > 0) {
+      throw new AggregateError([error51, ...rollback], "Standalone update and rollback both failed.");
+    }
+    throw error51;
+  } finally {
+    await fs.rm(stagedViewer, { recursive: true, force: true }).catch(() => {
+      return;
+    });
+    await fs.rm(stagedBinary, { force: true }).catch(() => {
+      return;
+    });
+  }
+  let settled = false;
+  return Object.freeze({
+    finalize: async () => {
+      if (settled)
+        return;
+      settled = true;
+      await fs.rm(previousViewer, { recursive: true, force: true }).catch(() => {
+        return;
+      });
+    },
+    rollback: async () => {
+      if (settled)
+        return;
+      settled = true;
+      const rollback = [];
+      await fs.copyFile(previousBinary, installedBinary).catch((failure) => rollback.push(failure));
+      await fs.chmod(installedBinary, 493).catch((failure) => rollback.push(failure));
+      await fs.rm(viewer, { recursive: true, force: true }).catch((failure) => rollback.push(failure));
+      if (viewerBackedUp) {
+        await fs.rename(previousViewer, viewer).catch((failure) => rollback.push(failure));
+      }
+      if (rollback.length > 0) {
+        throw new AggregateError(rollback, "Standalone update rollback failed.");
+      }
+    }
+  });
+}
+var defaultUpdateDependencies = Object.freeze({ replaceStandaloneCohort, writeInstallMetadata });
 
 // src/lib/admin-target.ts
 var DEFAULT_ADMIN_TARGET_NAME = "admin";
@@ -24783,7 +24924,7 @@ function isManagedInstanceNotFound(error51) {
   return error51 instanceof AdminInstanceNotFoundError || error51 instanceof AstraleError && error51.code === "INSTANCE_NOT_FOUND";
 }
 // src/lib/config.ts
-import { readFile as readFile6, writeFile as writeFile2, mkdir as mkdir5 } from "node:fs/promises";
+import { readFile as readFile7, writeFile as writeFile3, mkdir as mkdir6 } from "node:fs/promises";
 var AstraleConfigSchema = exports_external.object({
   issuer: exports_external.string().url().default("https://unregistered.invalid"),
   admin: AdminTargetConfigSchema.default(DEFAULT_ADMIN_TARGET_CONFIG),
@@ -24792,7 +24933,7 @@ var AstraleConfigSchema = exports_external.object({
 var DEFAULT_CONFIG = AstraleConfigSchema.parse({});
 async function readConfig() {
   try {
-    const raw = await readFile6(CONFIG_PATH, "utf-8");
+    const raw = await readFile7(CONFIG_PATH, "utf-8");
     return AstraleConfigSchema.parse(JSON.parse(raw));
   } catch (e) {
     if (e instanceof exports_external.ZodError || e instanceof SyntaxError) {

package/dist/types/lib/update.d.ts

@@ -1,3 +1,4 @@
+import { chmod, copyFile, mkdir, rename, rm } from 'node:fs/promises';
 import { z } from 'zod';
 import { AstraleError } from '../errors';
 export declare const DEFAULT_UPDATE_CHANNEL = "beta";
@@ -83,9 +84,26 @@ export declare function readInstallMetadata(path?: string): Promise<InstallMetad
 export declare function admitScriptInstall(meta: InstallMetadata, execution: Extract<UpdateExecution, {
     kind: 'standalone';
 }>): Promise<AdmittedScriptInstall>;
-export declare function writeInstallMetadata(meta: InstallMetadata, path?: string): Promise<void>;
+export declare function writeInstallMetadata(meta: InstallMetadata, path?: string, filesystem?: Pick<CohortFilesystem, 'mkdir' | 'rename' | 'rm'> & Pick<typeof import('node:fs/promises'), 'writeFile'>): Promise<void>;
 export declare function releaseBase(meta: InstallMetadata, req: Pick<UpdateRequest, 'channel' | 'version'>): string;
 export declare function fetchManifest(base: string): Promise<UpdateManifest>;
 export declare function shouldUpdate(currentVersion: string, manifestVersion: string): boolean;
-export declare function updateAstrale(req: UpdateRequest): Promise<UpdateResult>;
+interface CohortFilesystem {
+    readonly chmod: typeof chmod;
+    readonly copyFile: typeof copyFile;
+    readonly mkdir: typeof mkdir;
+    readonly rename: typeof rename;
+    readonly rm: typeof rm;
+}
+export interface StandaloneCohortReplacement {
+    readonly finalize: () => Promise<void>;
+    readonly rollback: () => Promise<void>;
+}
+/** Replace the standalone executable and its Viewer as one rollback-safe cohort. */
+export declare function replaceStandaloneCohort(installedBinary: string, nextBinary: string, nextViewerDist: string, filesystem?: Partial<CohortFilesystem>): Promise<StandaloneCohortReplacement>;
+interface UpdateDependencies {
+    readonly replaceStandaloneCohort: typeof replaceStandaloneCohort;
+    readonly writeInstallMetadata: typeof writeInstallMetadata;
+}
+export declare function updateAstrale(req: UpdateRequest, dependencies?: Partial<UpdateDependencies>): Promise<UpdateResult>;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.19",
+  "version": "1.0.0-beta.20",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -62,8 +62,8 @@
   },
   "devDependencies": {
     "@astrale-os/ox": ">=0.1.3 <1.0.0",
-    "@astrale-os/sdk": "0.5.0-beta.49",
-    "@astrale-os/shell": "0.4.2-beta.3",
+    "@astrale-os/sdk": "0.5.0-beta.50",
+    "@astrale-os/shell": "0.4.2-beta.5",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@commitlint/cli": "21.2.2",
     "@commitlint/config-conventional": "21.2.2",

package/src/commands/__tests__/view.test.ts

@@ -147,3 +147,52 @@ describe('view capture timing', () => {
     expect(commands.length).toBeGreaterThan(2)
   })
 })
+
+describe('view session runtime', () => {
+  test('builds one serve config with the admitted operator origin grant', async () => {
+    const { createViewServeConfig } = await import('../view')
+    const record = {
+      id: 'v-proof',
+      pid: 0,
+      port: 4419,
+      nonce: 'proof',
+      pageUrl: 'http://127.0.0.1:4419/s/proof/',
+      view: { target: Path.parse('/:ai-gateway.astrale.ai').raw, route: resolved[0] },
+      createdAt: '2026-08-26T00:00:00.000Z',
+    }
+
+    const config = createViewServeConfig(
+      record,
+      { allowExternalOrigin: ['https://connect.nango.dev/'] },
+      { url: 'https://kernel.test', kernelIssuer: 'https://kernel.test' },
+    )
+
+    expect(config.session).toBe(record)
+    expect(config.externalOrigins).toEqual(['https://connect.nango.dev'])
+    expect(config.proxy).toEqual({
+      kernelUrl: 'https://kernel.test',
+      issuer: 'https://kernel.test',
+      caFile: undefined,
+      direct: true,
+    })
+  })
+
+  test('spawns the detached server from a compiled executable without its virtual Bun entry', async () => {
+    const { resolveServeRuntime, viewServeInvocation } = await import('../view')
+
+    const runtime = await resolveServeRuntime({
+      executable: '/opt/astrale/bin/astrale',
+      entry: '/$bunfs/root/astrale',
+      exists: () => true,
+      find: async () => '/usr/bin/node',
+    })
+    expect(runtime).toEqual({
+      file: '/opt/astrale/bin/astrale',
+      args: [],
+    })
+    expect(viewServeInvocation(runtime, '/tmp/view.config.json')).toEqual({
+      file: '/opt/astrale/bin/astrale',
+      args: ['__view-serve', '--config', '/tmp/view.config.json'],
+    })
+  })
+})

package/src/commands/view.ts

@@ -19,6 +19,7 @@ import { fatal, log } from '../lib/log'
 import { isMachine, output, type RawOutputOpts } from '../lib/output'
 import { findFreePort } from '../lib/port'
 import { run, spawnHandle } from '../lib/proc'
+import { admitExternalOpenOrigins } from '../lib/view/external-open-origins'
 import { withViewPortAllocationLock } from '../lib/view/port-allocation'
 import {
   candidateSlug,
@@ -62,6 +63,7 @@ type ViewOpts = KernelCommandOpts &
     sessions?: boolean
     close?: string | boolean
     all?: boolean
+    allowExternalOrigin?: string[]
   }
 
 const VIEW_PORT_BASE = 4419
@@ -151,16 +153,47 @@ async function chooseCandidate(
  * die once the CLI exits. The published CLI entry is node-runnable; a dev
  * checkout builds `dist/astrale.js` on demand (Bun is present there).
  */
-async function resolveServeRuntime(): Promise<{ file: string; args: string[] }> {
-  const entry = process.argv[1]
-  const node = await findOnPath('node')
-  if (node && entry?.endsWith('.js') && existsSync(entry)) return { file: node, args: [entry] }
+interface ServeRuntimeEnvironment {
+  readonly entry: string | undefined
+  readonly executable: string
+  readonly exists: typeof existsSync
+  readonly find: typeof findOnPath
+}
+
+export async function resolveServeRuntime(
+  environment: Partial<ServeRuntimeEnvironment> = {},
+): Promise<{ file: string; args: string[] }> {
+  const entry = environment.entry ?? process.argv[1]
+  const executable = environment.executable ?? process.execPath
+  const exists = environment.exists ?? existsSync
+  const find = environment.find ?? findOnPath
+  const node = await find('node')
+  if (node && entry?.endsWith('.js') && exists(entry)) return { file: node, args: [entry] }
   if (node && entry?.endsWith('.ts')) {
     const dist = join(dirname(entry), '..', 'dist', 'astrale.js')
     await ensureDevDist(entry, dist)
-    if (existsSync(dist)) return { file: node, args: [dist] }
+    if (exists(dist)) return { file: node, args: [dist] }
   }
-  return { file: process.execPath, args: entry && existsSync(entry) ? [entry] : [] }
+  return directServeRuntime(executable, entry, entry !== undefined && exists(entry))
+}
+
+/** Reinvoke a compiled executable without its virtual Bun filesystem entry. */
+export function directServeRuntime(
+  executable: string,
+  entry: string | undefined,
+  entryExists = entry !== undefined && existsSync(entry),
+): { file: string; args: string[] } {
+  return {
+    file: executable,
+    args: entry && !entry.startsWith('/$bunfs/') && entryExists ? [entry] : [],
+  }
+}
+
+export function viewServeInvocation(
+  runtime: { file: string; args: string[] },
+  config: string,
+): { file: string; args: string[] } {
+  return { file: runtime.file, args: [...runtime.args, '__view-serve', '--config', config] }
 }
 
 async function findOnPath(name: string): Promise<string | null> {
@@ -229,6 +262,31 @@ async function startSession(view: ResolvedView, opts: ViewOpts): Promise<ViewSes
   )
 }
 
+export function createViewServeConfig(
+  record: ViewSessionRecord,
+  opts: Pick<ViewOpts, 'allowExternalOrigin' | 'as' | 'creds' | 'instance' | 'timeout' | 'url'>,
+  kernelTarget: { url: string; kernelIssuer: string; caFile?: string },
+): ViewServeConfig {
+  return {
+    session: record,
+    kernel: {
+      url: opts.url,
+      instance: opts.instance,
+      as: opts.as,
+      creds: opts.creds,
+      timeout: opts.timeout,
+    },
+    proxy: {
+      kernelUrl: kernelTarget.url,
+      issuer: kernelTarget.kernelIssuer,
+      caFile: kernelTarget.caFile,
+      direct: isPublicHttps(kernelTarget.url) && !kernelTarget.caFile,
+    },
+    externalOrigins: admitExternalOpenOrigins(opts.allowExternalOrigin),
+    idleMs: IDLE_MS,
+  }
+}
+
 /**
  * Called under the cross-process port-allocation lock. Keep the lock until the
  * detached child answers its readiness probe: only then is the selected port
@@ -262,34 +320,15 @@ async function startSessionLocked(
     identity: opts.creds ? '(pre-signed creds)' : (opts.as ?? defaultIdentity),
     createdAt: new Date().toISOString(),
   }
-  const serveConfig: ViewServeConfig = {
-    session: record,
-    kernel: {
-      url: opts.url,
-      instance: opts.instance,
-      as: opts.as,
-      creds: opts.creds,
-      timeout: opts.timeout,
-    },
-    proxy: {
-      kernelUrl: kernelTarget.url,
-      issuer: kernelTarget.kernelIssuer,
-      caFile: kernelTarget.caFile,
-      direct: isPublicHttps(kernelTarget.url) && !kernelTarget.caFile,
-    },
-    idleMs: IDLE_MS,
-  }
+  const serveConfig = createViewServeConfig(record, opts, kernelTarget)
 
   await saveServeConfig(serveConfig)
   const logFd = await openSessionLog(id)
-  const child = spawnHandle(
-    runtime.file,
-    [...runtime.args, '__view-serve', '--config', configPath(id)],
-    {
-      detached: true,
-      stdio: ['ignore', logFd, logFd],
-    },
-  )
+  const invocation = viewServeInvocation(runtime, configPath(id))
+  const child = spawnHandle(invocation.file, invocation.args, {
+    detached: true,
+    stdio: ['ignore', logFd, logFd],
+  })
   child.unref()
   closeSync(logFd)
   if (!child.pid) throw new Error('Failed to spawn the view session server')
@@ -521,6 +560,10 @@ export default {
       description: 'Close a view session (bare: the only open one; with --all: every session)',
     },
     { flags: '--all', description: 'With --close: close every session' },
+    {
+      flags: '--allow-external-origin <origin...>',
+      description: 'Grant this View exact HTTPS origins it may open in a new browser context',
+    },
   ],
   afterHelpText: `
 What it does:
@@ -539,6 +582,7 @@ Examples:
   $ astrale view /:crm.example.dev:view.dashboard
   $ astrale view /:agents.astrale.ai:view.agent --target @f00d1234 --as alice
   $ astrale view @customer --snapshot
+  $ astrale view /:integrations.astrale.ai:view.application --allow-external-origin https://connect.nango.dev https://connect.composio.dev
   $ astrale view --list
   $ astrale view --sessions ; astrale view --close --all
 `,

package/src/lib/__tests__/update.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from 'bun:test'
-import { chmod, mkdir, mkdtemp, readFile, symlink, writeFile } from 'node:fs/promises'
+import { chmod, mkdir, mkdtemp, readFile, rename, rm, symlink, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 
 import {
   admitScriptInstall,
@@ -10,6 +10,7 @@ import {
   InstallMetadataSchema,
   readInstallMetadata,
   releaseBase,
+  replaceStandaloneCohort,
   shouldUpdate,
   updateAstrale,
   writeInstallMetadata,
@@ -20,7 +21,7 @@ import {
 async function makeFakeRelease(
   root: string,
   version: string,
-  options: { binaryVersion?: string; legacyManifest?: boolean } = {},
+  options: { binaryVersion?: string; legacyManifest?: boolean; omitViewerIndex?: boolean } = {},
 ): Promise<string> {
   const release = join(root, 'release')
   const payload = join(root, 'payload')
@@ -32,9 +33,14 @@ async function makeFakeRelease(
     `#!/usr/bin/env sh\nif [ "$1" = "--version" ]; then echo "${binaryVersion}"; exit 0; fi\necho astrale\n`,
   )
   await chmod(join(payload, 'astrale'), 0o755)
+  await mkdir(join(payload, 'viewer', 'dist'), { recursive: true })
+  await writeFile(join(payload, 'viewer', 'dist', 'main.js'), 'viewer main\n')
+  if (!options.omitViewerIndex) {
+    await writeFile(join(payload, 'viewer', 'dist', 'index.html'), '<!doctype html>\n')
+  }
 
   const asset = join(release, 'astrale-darwin-arm64.tar.gz')
-  const tar = Bun.spawn(['tar', '-C', payload, '-czf', asset, 'astrale'])
+  const tar = Bun.spawn(['tar', '-C', payload, '-czf', asset, 'astrale', 'viewer'])
   expect(await tar.exited).toBe(0)
   const shaProc = Bun.spawn(['shasum', '-a', '256', asset], { stdout: 'pipe' })
   const sha = (await new Response(shaProc.stdout).text()).trim().split(/\s+/)[0]
@@ -77,6 +83,9 @@ async function makeInstall(
     `#!/usr/bin/env sh\nif [ "$1" = "--version" ]; then echo "${version}"; exit 0; fi\necho old\n`,
   )
   await chmod(bin, 0o755)
+  await mkdir(join(root, 'bin', 'viewer', 'dist'), { recursive: true })
+  await writeFile(join(root, 'bin', 'viewer', 'dist', 'main.js'), 'old viewer main\n')
+  await writeFile(join(root, 'bin', 'viewer', 'dist', 'index.html'), 'old viewer html\n')
   const path = join(root, 'home', 'install.json')
   const meta: InstallMetadata = {
     method: 'script',
@@ -146,6 +155,39 @@ describe('update helpers', () => {
 })
 
 describe('script install admission', () => {
+  test('a metadata commit failure restores the exact previous file', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'astrale-update-test-'))
+    const path = join(root, 'install.json')
+    const original = '{"exact":"previous metadata"}\n'
+    await writeFile(path, original)
+
+    await expect(
+      writeInstallMetadata(
+        {
+          method: 'script',
+          channel: 'beta',
+          version: '1.1.0',
+          repo: 'astrale-os/cli',
+          bin: '/tmp/astrale',
+        },
+        path,
+        {
+          mkdir,
+          rm,
+          writeFile,
+          rename: async (from, to) => {
+            if (String(from).endsWith('.next')) throw new Error('injected metadata commit failure')
+            await rename(from, to)
+          },
+        },
+      ),
+    ).rejects.toThrow('injected metadata commit failure')
+
+    expect(await readFile(path, 'utf8')).toBe(original)
+    await expect(readFile(`${path}.next`, 'utf8')).rejects.toMatchObject({ code: 'ENOENT' })
+    await expect(readFile(`${path}.previous`, 'utf8')).rejects.toMatchObject({ code: 'ENOENT' })
+  })
+
   test('rejects malformed JSON with the stable metadata error', async () => {
     const root = await mkdtemp(join(tmpdir(), 'astrale-update-test-'))
     const path = join(root, 'install.json')
@@ -316,6 +358,124 @@ describe('updateAstrale', () => {
       expect(await versionProc.exited).toBe(0)
       const updatedMeta = JSON.parse(await readFile(path, 'utf8')) as InstallMetadata
       expect(updatedMeta.version).toBe('1.1.0')
+      expect(await readFile(join(dirname(meta.bin), 'viewer', 'dist', 'main.js'), 'utf8')).toBe(
+        'viewer main\n',
+      )
+      expect(await readFile(join(dirname(meta.bin), 'viewer', 'dist', 'index.html'), 'utf8')).toBe(
+        '<!doctype html>\n',
+      )
+    } finally {
+      delete process.env.ASTRALE_UPDATE_BASE
+    }
+  })
+
+  test('a partial Viewer archive leaves the installed cohort and metadata unchanged', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'astrale-update-test-'))
+    const { path, meta, execution } = await makeInstall(root, '1.0.0')
+    const release = await makeFakeRelease(root, '1.1.0', { omitViewerIndex: true })
+    process.env.ASTRALE_UPDATE_BASE = `file://${release}`
+    const beforeBinary = await readFile(meta.bin, 'utf8')
+    const beforeMetadata = await readFile(path, 'utf8')
+    try {
+      await expect(
+        updateAstrale({
+          currentVersion: '1.0.0',
+          platform: { os: 'darwin', arch: 'arm64' },
+          installPath: path,
+          execution,
+        }),
+      ).rejects.toThrow()
+
+      expect(await readFile(meta.bin, 'utf8')).toBe(beforeBinary)
+      expect(await readFile(join(dirname(meta.bin), 'viewer', 'dist', 'main.js'), 'utf8')).toBe(
+        'old viewer main\n',
+      )
+      expect(await readFile(join(dirname(meta.bin), 'viewer', 'dist', 'index.html'), 'utf8')).toBe(
+        'old viewer html\n',
+      )
+      expect(await readFile(path, 'utf8')).toBe(beforeMetadata)
+    } finally {
+      delete process.env.ASTRALE_UPDATE_BASE
+    }
+  })
+
+  test('a Viewer commit failure rolls back binary, Viewer, and metadata', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'astrale-update-test-'))
+    const { path, meta, execution } = await makeInstall(root, '1.0.0')
+    const release = await makeFakeRelease(root, '1.1.0')
+    process.env.ASTRALE_UPDATE_BASE = `file://${release}`
+    const beforeBinary = await readFile(meta.bin, 'utf8')
+    const beforeMetadata = await readFile(path, 'utf8')
+    try {
+      await expect(
+        updateAstrale(
+          {
+            currentVersion: '1.0.0',
+            platform: { os: 'darwin', arch: 'arm64' },
+            installPath: path,
+            execution,
+          },
+          {
+            replaceStandaloneCohort: (installed, next, viewer) =>
+              replaceStandaloneCohort(installed, next, viewer, {
+                rename: async (from, to) => {
+                  if (String(from).endsWith('viewer.next')) {
+                    throw Object.assign(new Error('injected Viewer commit failure'), {
+                      code: 'EIO',
+                    })
+                  }
+                  await rename(from, to)
+                },
+              }),
+          },
+        ),
+      ).rejects.toThrow('injected Viewer commit failure')
+
+      expect(await readFile(meta.bin, 'utf8')).toBe(beforeBinary)
+      expect(await readFile(join(dirname(meta.bin), 'viewer', 'dist', 'main.js'), 'utf8')).toBe(
+        'old viewer main\n',
+      )
+      expect(await readFile(join(dirname(meta.bin), 'viewer', 'dist', 'index.html'), 'utf8')).toBe(
+        'old viewer html\n',
+      )
+      expect(await readFile(path, 'utf8')).toBe(beforeMetadata)
+    } finally {
+      delete process.env.ASTRALE_UPDATE_BASE
+    }
+  })
+
+  test('a metadata failure after cohort commit restores binary, Viewer, and metadata', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'astrale-update-test-'))
+    const { path, meta, execution } = await makeInstall(root, '1.0.0')
+    const release = await makeFakeRelease(root, '1.1.0')
+    process.env.ASTRALE_UPDATE_BASE = `file://${release}`
+    const beforeBinary = await readFile(meta.bin, 'utf8')
+    const beforeMetadata = await readFile(path, 'utf8')
+    try {
+      await expect(
+        updateAstrale(
+          {
+            currentVersion: '1.0.0',
+            platform: { os: 'darwin', arch: 'arm64' },
+            installPath: path,
+            execution,
+          },
+          {
+            writeInstallMetadata: async () => {
+              throw new Error('injected metadata write failure')
+            },
+          },
+        ),
+      ).rejects.toThrow('injected metadata write failure')
+
+      expect(await readFile(meta.bin, 'utf8')).toBe(beforeBinary)
+      expect(await readFile(join(dirname(meta.bin), 'viewer', 'dist', 'main.js'), 'utf8')).toBe(
+        'old viewer main\n',
+      )
+      expect(await readFile(join(dirname(meta.bin), 'viewer', 'dist', 'index.html'), 'utf8')).toBe(
+        'old viewer html\n',
+      )
+      expect(await readFile(path, 'utf8')).toBe(beforeMetadata)
     } finally {
       delete process.env.ASTRALE_UPDATE_BASE
     }

package/src/lib/__tests__/view-assets.test.ts

@@ -143,4 +143,18 @@ describe('viewer asset resolution', () => {
     expect(stderr).toBe('')
     expect(stdout.trim()).toBe(await realpath(viewer))
   })
+
+  test('resolves assets shipped beside a Bun-compiled standalone executable', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'astrale-view-standalone-'))
+    temporaryDirectories.push(root)
+    const executable = join(root, 'bin', 'astrale')
+    const viewer = join(root, 'bin', 'viewer', 'dist')
+    await mkdir(viewer, { recursive: true })
+    await writeFile(join(viewer, 'main.js'), '')
+    await writeFile(join(viewer, 'index.html'), '')
+
+    expect(viewerDistDir('file:///$bunfs/root/assets.ts', '/$bunfs/root/astrale', executable)).toBe(
+      viewer,
+    )
+  })
 })