@awak-app/simy-cli 0.5.7 → 0.5.10

package/src/auto-update.js

@@ -15,6 +15,12 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 
+import { openExternalUrl } from "./browser.js";
+import {
+  installMacosInstallerRelease,
+  readCurrentInstallerVersion,
+} from "./install-update.js";
+
 const execFileAsync = promisify(execFile);
 
 export const CLI_PACKAGE_NAME = "@awak-app/simy-cli";
@@ -26,6 +32,8 @@ const AUTO_UPDATE_IDLE_RETRY_MS = 30_000;
 const UPDATE_LOCK_STALE_MS = 30 * 60 * 1_000;
 const RESTART_HANDOFF_TIMEOUT_MS = 30_000;
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const INSTALLATION_MARKER_FILE = "installation.json";
+const MACOS_INSTALLER_MODE = "macos_installer";
 const NON_IDLE_STATES = new Set([
   "queued",
   "risk_classifying",
@@ -73,7 +81,8 @@ export class CliAutoUpdater extends EventEmitter {
       automatic: Boolean(
         !options.disabled &&
           options.daemon &&
-          options.installMode === "global_npm" &&
+          (options.installMode === "global_npm" ||
+            (options.installMode === MACOS_INSTALLER_MODE && options.installerMarker?.teamId)) &&
           options.requestedPort === 0
       ),
       checked_at: null,
@@ -89,6 +98,17 @@ export class CliAutoUpdater extends EventEmitter {
     return structuredClone(this.#snapshot);
   }
 
+  async performAction() {
+    const action = this.#snapshot.action;
+    if (action?.id === "download_macos_installer" && action.url) {
+      return this.#options.openUrl(action.url);
+    }
+    if (action?.command) {
+      throw new Error(`Run this command after leaving SIMY: ${action.command}`);
+    }
+    throw new Error("No SIMY CLI update action is currently available.");
+  }
+
   acceptsNewWork() {
     return !["updating", "restarting"].includes(this.#snapshot.state);
   }
@@ -151,9 +171,10 @@ export class CliAutoUpdater extends EventEmitter {
     });
     try {
       const release = await this.#options.checkLatestVersion();
+      this.#options.lastRelease = release;
       const targetVersion = String(release?.version || "").trim();
       if (!parseStableVersion(targetVersion)) {
-        throw new Error("The npm registry returned an invalid stable CLI version.");
+        throw new Error("The update service returned an invalid stable CLI version.");
       }
       const checkedAt = new Date(this.#options.now()).toISOString();
       if (compareStableVersions(targetVersion, this.#options.currentVersion) <= 0) {
@@ -169,8 +190,11 @@ export class CliAutoUpdater extends EventEmitter {
       }
 
       const change = classifyVersionChange(this.#options.currentVersion, targetVersion);
-      const automatic = this.#snapshot.automatic && ["patch", "minor"].includes(change);
-      const action = updateAction(targetVersion);
+      const automatic =
+        this.#snapshot.automatic &&
+        ["patch", "minor"].includes(change) &&
+        (this.#options.installMode !== MACOS_INSTALLER_MODE || Boolean(release?.artifact?.updater));
+      const action = updateAction(targetVersion, this.#options);
       if (!automatic) {
         this.#clearIdleTimer();
         this.#setState("update_available", {
@@ -241,6 +265,7 @@ export class CliAutoUpdater extends EventEmitter {
     }
 
     let releaseLock = null;
+    let installation = null;
     try {
       releaseLock = await this.#options.acquireUpdateLock();
       if (!releaseLock) {
@@ -256,9 +281,10 @@ export class CliAutoUpdater extends EventEmitter {
         return this.snapshot();
       }
 
-      await installAndVerifyVersion({
+      installation = await installAndVerifyVersion({
         currentVersion: this.#options.currentVersion,
         targetVersion,
+        release: this.#options.lastRelease,
         installVersion: this.#options.installVersion,
         readInstalledVersion: this.#options.readInstalledVersion,
       });
@@ -269,7 +295,7 @@ export class CliAutoUpdater extends EventEmitter {
         message: `SIMY CLI ${targetVersion} is installed. Verifying the restarted daemon...`,
       });
       this.#announce();
-      await this.#restartDaemon?.(targetVersion);
+      await this.#restartDaemon?.(targetVersion, installation);
       this.#clearIdleTimer();
       this.#setState("updated", {
         message: `SIMY CLI ${targetVersion} is running.`,
@@ -278,10 +304,19 @@ export class CliAutoUpdater extends EventEmitter {
       });
       return this.snapshot();
     } catch (error) {
+      if (installation?.rollback) {
+        try {
+          await installation.rollback();
+        } catch (rollbackError) {
+          error = new Error(
+            `${errorMessage(error)} Automatic rollback failed (${errorMessage(rollbackError)}).`,
+          );
+        }
+      }
       this.#clearIdleTimer();
       this.#setState("failed", {
         message: `Automatic update failed. SIMY ${this.#options.currentVersion} is still running.`,
-        action: updateAction(targetVersion),
+        action: updateAction(targetVersion, this.#options),
         error: errorMessage(error),
       });
       this.#announce();
@@ -315,9 +350,11 @@ export class CliAutoUpdater extends EventEmitter {
     if (this.#options.quiet) return;
     const suffix =
       ["update_available", "failed"].includes(this.#snapshot.state) &&
-      this.#snapshot.action?.command
-      ? ` Run manually: ${this.#snapshot.action.command}`
-      : "";
+      (this.#snapshot.action?.command || this.#snapshot.action?.url)
+        ? this.#snapshot.action.url
+          ? ` Open: ${this.#snapshot.action.url}`
+          : ` Run manually: ${this.#snapshot.action.command}`
+        : "";
     const detail = this.#snapshot.error ? ` (${this.#snapshot.error})` : "";
     this.#options.logger(`${this.#snapshot.message}${suffix}${detail}`);
   }
@@ -329,6 +366,7 @@ export async function createCliAutoUpdater({
   requestedPort = 0,
   disabled = false,
   packageRoot = PACKAGE_ROOT,
+  webOrigin,
   dependencies = {},
 } = {}) {
   const packageInfo = dependencies.packageInfo || (await readCliPackageInfo(packageRoot));
@@ -337,6 +375,14 @@ export async function createCliAutoUpdater({
     execFileCommand: dependencies.execFileCommand,
   }));
   const stateRoot = dependencies.stateRoot || defaultStateRoot();
+  const installerMarker = installMode === MACOS_INSTALLER_MODE
+    ? dependencies.installerMarker || (await readInstallerMarker(packageRoot))
+    : null;
+  const checkRelease = dependencies.checkLatestVersion || (
+    installMode === MACOS_INSTALLER_MODE
+      ? () => checkInstallerRelease({ webOrigin, fetchImpl: dependencies.fetchImpl })
+      : checkLatestVersion
+  );
   return new CliAutoUpdater({
     daemon: Boolean(daemon),
     interactive: Boolean(interactive),
@@ -344,15 +390,37 @@ export async function createCliAutoUpdater({
     disabled,
     currentVersion: packageInfo.version,
     installMode,
-    checkLatestVersion: dependencies.checkLatestVersion || checkLatestVersion,
+    installerMarker,
+    webOrigin,
+    checkLatestVersion: checkRelease,
     installVersion:
       dependencies.installVersion ||
-      ((version) => installGlobalNpmVersion(version, { execFileCommand: dependencies.execFileCommand })),
+      (installMode === MACOS_INSTALLER_MODE
+        ? ((version, release) => installMacosInstallerRelease({
+            version,
+            release,
+            marker: installerMarker,
+            stateRoot,
+            fetchImpl: dependencies.fetchImpl,
+            execFileCommand: dependencies.execFileCommand,
+          }))
+        : ((version) => installGlobalNpmVersion(version, { execFileCommand: dependencies.execFileCommand }))),
     readInstalledVersion:
       dependencies.readInstalledVersion ||
-      (() => readGlobalNpmVersion({ execFileCommand: dependencies.execFileCommand })),
+      (installMode === MACOS_INSTALLER_MODE
+        ? (() => readCurrentInstallerVersion({ stateRoot }))
+        : (() => readGlobalNpmVersion({ execFileCommand: dependencies.execFileCommand }))),
     acquireUpdateLock:
-      dependencies.acquireUpdateLock || (() => acquireGlobalUpdateLock(stateRoot, dependencies)),
+      dependencies.acquireUpdateLock || (() => acquireGlobalUpdateLock(stateRoot, {
+        ...dependencies,
+        installMode,
+      })),
+    openUrl:
+      dependencies.openUrl ||
+      ((url) => openExternalUrl(url, {
+        description: "SIMY installer download page",
+        logger: { log() {}, error() {} },
+      })),
     logger: dependencies.logger || console.log,
     quiet: Boolean(interactive),
     now: dependencies.now || Date.now,
@@ -372,8 +440,13 @@ export async function readCliPackageInfo(packageRoot = PACKAGE_ROOT) {
 export async function detectInstallMode({
   packageRoot = PACKAGE_ROOT,
   execFileCommand = execFileAsync,
+  platform = process.platform,
+  arch = process.arch,
 } = {}) {
   const resolvedRoot = await realpathOrResolve(packageRoot);
+  if (await readInstallerMarker(resolvedRoot, { platform, arch })) {
+    return MACOS_INSTALLER_MODE;
+  }
   if (resolvedRoot.split(path.sep).includes("_npx")) return "npx";
 
   try {
@@ -390,6 +463,38 @@ export async function detectInstallMode({
   return resolvedRoot.split(path.sep).includes("node_modules") ? "package" : "source";
 }
 
+export async function readInstallerMarker(
+  packageRoot = PACKAGE_ROOT,
+  { platform = process.platform, arch = process.arch } = {},
+) {
+  if (platform !== "darwin" || arch !== "arm64") return null;
+  let payload;
+  try {
+    payload = JSON.parse(
+      await readFile(path.join(packageRoot, INSTALLATION_MARKER_FILE), "utf8"),
+    );
+  } catch (error) {
+    if (error?.code === "ENOENT" || error instanceof SyntaxError) return null;
+    throw error;
+  }
+  if (
+    !payload ||
+    typeof payload !== "object" ||
+    Array.isArray(payload) ||
+    payload.schemaVersion !== 1 ||
+    payload.channel !== "macos-installer" ||
+    payload.platform !== "darwin" ||
+    payload.arch !== "arm64" ||
+    !(payload.teamId === null || /^[A-Z0-9]{10}$/.test(payload.teamId)) ||
+    payload.bundleId !== "com.awak.simy.cli" ||
+    Object.keys(payload).sort().join(",") !==
+      "arch,bundleId,channel,platform,schemaVersion,teamId"
+  ) {
+    return null;
+  }
+  return payload;
+}
+
 export async function checkLatestVersion({ fetchImpl = fetch } = {}) {
   const response = await fetchImpl(
     "https://registry.npmjs.org/@awak-app%2fsimy-cli/latest",
@@ -407,6 +512,74 @@ export async function checkLatestVersion({ fetchImpl = fetch } = {}) {
   };
 }
 
+export async function checkInstallerRelease({ webOrigin, fetchImpl = fetch } = {}) {
+  const origin = new URL(webOrigin).origin;
+  const response = await fetchImpl(new URL("/api/local-cli/release", origin), {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(10_000),
+  });
+  if (!response.ok) {
+    throw new Error(`SIMY Web installer release endpoint returned HTTP ${response.status}`);
+  }
+  const payload = await response.json();
+  return validateInstallerRelease(payload);
+}
+
+export function validateInstallerRelease(payload) {
+  if (
+    !payload ||
+    typeof payload !== "object" ||
+    Array.isArray(payload) ||
+    payload.schemaVersion !== 1 ||
+    !parseStableVersion(payload.version) ||
+    typeof payload.publishedAt !== "string" ||
+    !Number.isFinite(Date.parse(payload.publishedAt)) ||
+    !Array.isArray(payload.artifacts)
+  ) {
+    throw new Error("SIMY Web returned an invalid installer release manifest.");
+  }
+  const artifacts = payload.artifacts.filter(
+    (artifact) => artifact?.platform === "darwin" && artifact?.arch === "arm64",
+  );
+  if (artifacts.length !== 1) {
+    throw new Error("SIMY Web returned an invalid Apple Silicon installer artifact.");
+  }
+  const artifact = artifacts[0];
+  let artifactUrl;
+  try {
+    artifactUrl = new URL(artifact.url);
+  } catch {
+    throw new Error("SIMY Web returned an invalid Apple Silicon installer artifact.");
+  }
+  if (
+    artifactUrl.protocol !== "https:" ||
+    !/^[a-f0-9]{64}$/.test(String(artifact.sha256 || "")) ||
+    !Number.isSafeInteger(artifact.size) ||
+    artifact.size <= 0 ||
+    artifact.signed !== true ||
+    artifact.notarized !== true
+  ) {
+    throw new Error("SIMY Web returned an invalid Apple Silicon installer artifact.");
+  }
+  if (artifact.updater != null) {
+    let updaterUrl;
+    try {
+      updaterUrl = new URL(artifact.updater.url);
+    } catch {
+      throw new Error("SIMY Web returned an invalid automatic updater artifact.");
+    }
+    if (
+      updaterUrl.protocol !== "https:" ||
+      !/^[a-f0-9]{64}$/.test(String(artifact.updater.sha256 || "")) ||
+      !Number.isSafeInteger(artifact.updater.size) ||
+      artifact.updater.size <= 0
+    ) {
+      throw new Error("SIMY Web returned an invalid automatic updater artifact.");
+    }
+  }
+  return { version: payload.version, publishedAt: payload.publishedAt, artifact };
+}
+
 export async function installGlobalNpmVersion(
   version,
   { execFileCommand = execFileAsync } = {},
@@ -437,20 +610,25 @@ export async function readGlobalNpmVersion({ execFileCommand = execFileAsync } =
 export async function installAndVerifyVersion({
   currentVersion,
   targetVersion,
+  release,
   installVersion = installGlobalNpmVersion,
   readInstalledVersion = readGlobalNpmVersion,
 }) {
+  let installation = null;
   try {
-    await installVersion(targetVersion);
+    installation = await installVersion(targetVersion, release);
     const installedVersion = await readInstalledVersion();
     if (installedVersion !== targetVersion) {
-      throw new Error(`npm reported success, but installed SIMY ${installedVersion}; expected ${targetVersion}.`);
+      throw new Error(`The updater selected SIMY ${installedVersion}; expected ${targetVersion}.`);
     }
-    return installedVersion;
+    return installation && typeof installation === "object"
+      ? { ...installation, installedVersion }
+      : installedVersion;
   } catch (error) {
     let recoveryError = null;
     try {
-      await installVersion(currentVersion);
+      if (installation?.rollback) await installation.rollback();
+      else await installVersion(currentVersion);
       const restoredVersion = await readInstalledVersion();
       if (restoredVersion !== currentVersion) {
         throw new Error(`restored version is ${restoredVersion || "unknown"}`);
@@ -475,6 +653,7 @@ export async function runCliUpdateGate({
   incompatibleRetry = false,
   packageRoot = PACKAGE_ROOT,
   entryPath,
+  webOrigin,
   env = process.env,
   logger = console.log,
   errorLogger = console.error,
@@ -513,10 +692,18 @@ export async function runCliUpdateGate({
   }
 
   let release;
+  let releaseInfo;
   try {
-    const releaseInfo = await (dependencies.checkLatestVersion || checkLatestVersion)();
+    const checkRelease = dependencies.checkLatestVersion || (
+      installMode === MACOS_INSTALLER_MODE
+        ? () => checkInstallerRelease({ webOrigin, fetchImpl: dependencies.fetchImpl })
+        : checkLatestVersion
+    );
+    releaseInfo = await checkRelease();
     release = String(releaseInfo?.version || "").trim();
-    if (!parseStableVersion(release)) throw new Error("The npm registry returned an invalid stable CLI version.");
+    if (!parseStableVersion(release)) {
+      throw new Error("The update service returned an invalid stable CLI version.");
+    }
   } catch (error) {
     if (mode !== "startup") errorLogger(`Update check failed: ${errorMessage(error)}`);
     result.error = errorMessage(error);
@@ -525,8 +712,31 @@ export async function runCliUpdateGate({
 
   if (compareStableVersions(release, info.version) <= 0) return report("up_to_date", release);
   const change = classifyVersionChange(info.version, release);
-  const action = updateAction(release);
-  result.recoveryCommand = action.command;
+  const action = updateAction(release, { installMode, webOrigin });
+  result.action = action;
+  if (action.command) result.recoveryCommand = action.command;
+  if (action.url) result.recoveryUrl = action.url;
+
+  const stateRoot = dependencies.stateRoot || defaultStateRoot();
+  const installerMarker = installMode === MACOS_INSTALLER_MODE
+    ? dependencies.installerMarker || (await readInstallerMarker(packageRoot))
+    : null;
+  const installerAutomatic = Boolean(installerMarker?.teamId && releaseInfo?.artifact?.updater);
+  if (installMode === MACOS_INSTALLER_MODE) {
+    logger(`SIMY CLI ${release} is available for Apple Silicon.`);
+    logger(
+      change === "major"
+        ? "Major installer updates require a manual signed installer download."
+        : installerAutomatic
+        ? "The background agent will install it after active work is finished."
+        : "This release requires a manual installer download.",
+    );
+    logger(`Installer download: ${action.url}`);
+    return report(
+      mode === "update" ? "installer_update_deferred" : "update_available",
+      release,
+    );
+  }
 
   if (installMode !== "global_npm") {
     logger(`SIMY CLI ${release} is available. This ${installMode} installation is read-only; run: ${action.command}`);
@@ -548,12 +758,15 @@ export async function runCliUpdateGate({
 
   if (change === "minor") logger(`Updating SIMY CLI ${info.version} → ${release}...`);
   if (change === "major") logger(`Installing confirmed major SIMY CLI update ${info.version} → ${release}...`);
-  const stateRoot = dependencies.stateRoot || defaultStateRoot();
   const acquire = dependencies.acquireUpdateLock || (() => acquireGlobalUpdateLock(stateRoot, dependencies));
+  const installVersion = dependencies.installVersion ||
+    ((version) => installGlobalNpmVersion(version, { execFileCommand: dependencies.execFileCommand }));
+  const readInstalledVersion = dependencies.readInstalledVersion ||
+    (() => readGlobalNpmVersion({ execFileCommand: dependencies.execFileCommand }));
   let releaseLock = await acquire();
   if (!releaseLock) {
     const installed = await waitForInstalledVersion(release, {
-      readInstalledVersion: dependencies.readInstalledVersion || (() => readGlobalNpmVersion({ execFileCommand: dependencies.execFileCommand })),
+      readInstalledVersion,
       timeoutMs: dependencies.lockWaitTimeoutMs,
       pollMs: dependencies.lockPollMs,
     });
@@ -566,8 +779,8 @@ export async function runCliUpdateGate({
       await installAndVerifyVersion({
         currentVersion: info.version,
         targetVersion: release,
-        installVersion: dependencies.installVersion || ((version) => installGlobalNpmVersion(version, { execFileCommand: dependencies.execFileCommand })),
-        readInstalledVersion: dependencies.readInstalledVersion || (() => readGlobalNpmVersion({ execFileCommand: dependencies.execFileCommand })),
+        installVersion,
+        readInstalledVersion,
       });
     } catch (error) {
       errorLogger(`SIMY update failed: ${errorMessage(error)}`);
@@ -589,12 +802,15 @@ export async function runCliUpdateGate({
   if (incompatibleRetry) childEnv[INCOMPATIBLE_RETRY_ENV] = "1";
   let exitCode;
   try {
-    exitCode = await reexecute({ entryPath, argv, env: childEnv, spawnProcess: dependencies.spawnProcess });
+    exitCode = await reexecute({
+      entryPath,
+      argv,
+      env: childEnv,
+      spawnProcess: dependencies.spawnProcess,
+    });
   } catch (error) {
     let rollbackDetail = `Recovery: npm install -g ${CLI_PACKAGE_NAME}@${info.version}`;
     try {
-      const installVersion = dependencies.installVersion || ((version) => installGlobalNpmVersion(version, { execFileCommand: dependencies.execFileCommand }));
-      const readInstalledVersion = dependencies.readInstalledVersion || (() => readGlobalNpmVersion({ execFileCommand: dependencies.execFileCommand }));
       await installVersion(info.version);
       const restored = await readInstalledVersion();
       if (restored !== info.version) throw new Error(`installed version is ${restored || "unknown"}`);
@@ -616,12 +832,13 @@ export async function runCliUpdateGate({
 
 export async function reexecuteCliCommand({
   entryPath,
+  executablePath = process.execPath,
   argv,
   env = process.env,
   spawnProcess = spawn,
 } = {}) {
   return new Promise((resolve, reject) => {
-    const child = spawnProcess(process.execPath, [entryPath, ...argv], {
+    const child = spawnProcess(executablePath, [entryPath, ...argv], {
       env,
       stdio: "inherit",
     });
@@ -683,8 +900,11 @@ export function shouldRetryIncompatibleCli(error, env = process.env) {
 
 export async function restartDaemonProcess({
   entryPath,
+  executablePath = process.execPath,
   argv,
   targetVersion,
+  expectedWebOrigin = null,
+  expectedInstallMode = null,
   stateRoot = defaultStateRoot(),
   spawnProcess = spawn,
   timeoutMs = RESTART_HANDOFF_TIMEOUT_MS,
@@ -694,7 +914,7 @@ export async function restartDaemonProcess({
   await mkdir(handoffDirectory, { recursive: true, mode: 0o700 });
   const nonce = randomBytes(24).toString("hex");
   const handoffPath = path.join(handoffDirectory, `${process.pid}-${nonce}.json`);
-  const child = spawnProcess(process.execPath, [entryPath, ...argv], {
+  const child = spawnProcess(executablePath, [entryPath, ...argv], {
     detached: true,
     stdio: "ignore",
     env: {
@@ -719,7 +939,16 @@ export async function restartDaemonProcess({
         `Restarted SIMY reported version ${handoff.version || "unknown"}, expected ${targetVersion}.`,
       );
     }
+    if (expectedWebOrigin && handoff.web_origin !== expectedWebOrigin) {
+      throw new Error("Restarted SIMY reported a different Web origin.");
+    }
+    if (expectedInstallMode && handoff.install_mode !== expectedInstallMode) {
+      throw new Error("Restarted SIMY reported a different installation channel.");
+    }
     return handoff;
+  } catch (error) {
+    await terminateCandidate(child);
+    throw error;
   } finally {
     await rm(handoffPath, { force: true });
   }
@@ -728,6 +957,8 @@ export async function restartDaemonProcess({
 export async function writeUpdateHandoffFromEnvironment({
   version,
   port,
+  webOrigin = null,
+  installMode = null,
   env = process.env,
   stateRoot = defaultStateRoot(),
 } = {}) {
@@ -741,13 +972,28 @@ export async function writeUpdateHandoffFromEnvironment({
   await mkdir(handoffDirectory, { recursive: true, mode: 0o700 });
   await writeFile(
     handoffPath,
-    `${JSON.stringify({ nonce, version, port, pid: process.pid, ready_at: new Date().toISOString() })}\n`,
+    `${JSON.stringify({
+      nonce,
+      version,
+      port,
+      pid: process.pid,
+      web_origin: webOrigin,
+      install_mode: installMode,
+      ready_at: new Date().toISOString(),
+    })}\n`,
     { encoding: "utf8", mode: 0o600 },
   );
   return true;
 }
 
-export function autoUpdateHelpText() {
+export function autoUpdateHelpText({ installMode = null, webOrigin = null } = {}) {
+  if (installMode === MACOS_INSTALLER_MODE) {
+    return [
+      "Apple Silicon installer updates:",
+      "  Signed patch and minor updates install in the background after active work finishes.",
+      `  Major updates use the signed installer: ${new URL("/local-cli/download", webOrigin)}`,
+    ].join("\n");
+  }
   return [
     "Recommended installation (enables verified CLI auto-update):",
     `  npm install -g ${CLI_PACKAGE_NAME}`,
@@ -762,6 +1008,9 @@ function manualUpdateMessage({
   daemon,
   requestedPort,
 }) {
+  if (installMode === MACOS_INSTALLER_MODE) {
+    return `SIMY CLI ${targetVersion} is available. Download the signed Apple Silicon installer; your tasks and settings will be preserved.`;
+  }
   if (installMode !== "global_npm") {
     return `SIMY CLI ${targetVersion} is available. Install the global version to enable automatic updates.`;
   }
@@ -774,7 +1023,14 @@ function manualUpdateMessage({
   return `SIMY CLI ${targetVersion} is available. This version change requires manual confirmation.`;
 }
 
-export function updateAction(version) {
+export function updateAction(version, { installMode = "global_npm", webOrigin } = {}) {
+  if (installMode === MACOS_INSTALLER_MODE) {
+    return {
+      id: "download_macos_installer",
+      label: "Download the Apple Silicon installer",
+      url: new URL("/local-cli/download", webOrigin).toString(),
+    };
+  }
   return {
     id: "install_global_cli",
     label: "Install and restart SIMY",
@@ -790,7 +1046,10 @@ function parseStableVersion(value) {
 export async function acquireGlobalUpdateLock(stateRoot = defaultStateRoot(), dependencies = {}) {
   const now = dependencies.now || Date.now;
   const lockDirectory = path.join(stateRoot, "updates");
-  const lockPath = path.join(lockDirectory, "global-npm-update.lock");
+  const lockName = dependencies.installMode === MACOS_INSTALLER_MODE
+    ? "macos-installer-update.lock"
+    : "global-npm-update.lock";
+  const lockPath = path.join(lockDirectory, lockName);
   await mkdir(lockDirectory, { recursive: true, mode: 0o700 });
 
   for (let attempt = 0; attempt < 2; attempt += 1) {
@@ -857,6 +1116,24 @@ async function waitForHandoff(handoffPath, nonce, timeoutMs) {
   throw new Error("The updated SIMY daemon did not become healthy in time.");
 }
 
+async function terminateCandidate(child) {
+  if (!child?.pid || child.exitCode != null || child.signalCode != null) return;
+  let resolveExit;
+  const exited = new Promise((resolve) => {
+    resolveExit = resolve;
+    child.once?.("exit", resolve);
+  });
+  child.kill?.("SIGTERM");
+  if (await Promise.race([exited.then(() => true), delay(2_000, false)])) return;
+  child.kill?.("SIGKILL");
+  await Promise.race([exited, delay(2_000)]);
+  resolveExit?.();
+}
+
+function delay(milliseconds, value = undefined) {
+  return new Promise((resolve) => setTimeout(() => resolve(value), milliseconds));
+}
+
 async function realpathOrResolve(value) {
   try {
     return await realpath(value);

package/src/browser.js

@@ -8,14 +8,31 @@ export async function openAuthorizationUrl(
     logger = console,
   } = {},
 ) {
-  if (!authorizationUrl) return { opened: false, reason: "not_required" };
+  return openExternalUrl(authorizationUrl, {
+    platform,
+    spawn,
+    logger,
+    description: "SIMY CLI authorization page",
+  });
+}
+
+export async function openExternalUrl(
+  url,
+  {
+    platform = process.platform,
+    spawn = spawnProcess,
+    logger = console,
+    description = "page",
+  } = {},
+) {
+  if (!url) return { opened: false, reason: "not_required" };
 
-  const target = browserCommand(platform, authorizationUrl);
-  logger.log(`Authorize SIMY CLI: ${authorizationUrl}`);
+  const target = browserCommand(platform, url);
+  logger.log(`Open ${description}: ${url}`);
 
   if (!target) {
     logger.error(`SIMY could not open a browser on platform ${platform}.`);
-    logger.error(`Open this URL manually: ${authorizationUrl}`);
+    logger.error(`Open this URL manually: ${url}`);
     return { opened: false, reason: "unsupported_platform" };
   }
 
@@ -26,11 +43,11 @@ export async function openAuthorizationUrl(
     });
     await waitForSpawn(child);
     child.unref();
-    logger.log("Opened the SIMY CLI authorization page in your browser.");
+    logger.log(`Opened the ${description} in your browser.`);
     return { opened: true };
   } catch (error) {
-    logger.error(`SIMY could not open the authorization page: ${errorMessage(error)}`);
-    logger.error(`Open this URL manually: ${authorizationUrl}`);
+    logger.error(`SIMY could not open the ${description}: ${errorMessage(error)}`);
+    logger.error(`Open this URL manually: ${url}`);
     return { opened: false, reason: "launch_failed", error };
   }
 }

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.7";
+export const CLI_VERSION = "0.5.10";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(