@awak-app/simy-cli 0.5.7 → 0.5.10

package/src/desktop-process-lock.js

@@ -0,0 +1,231 @@
+import { mkdir, readFile, realpath, rm, writeFile, stat } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { normalizeWebOrigin } from "./web-origin.js";
+
+export const PROCESS_CONFLICT_CODE = "process_conflict";
+export const PROCESS_CONFLICT_MESSAGE =
+  "Another SIMY background service is already running for this Web address. Stop the existing CLI daemon, then reopen SIMY CLI.";
+
+export class SimyProcessConflictError extends Error {
+  constructor(message = PROCESS_CONFLICT_MESSAGE) {
+    super(message);
+    this.name = "SimyProcessConflictError";
+    this.code = PROCESS_CONFLICT_CODE;
+  }
+}
+
+export async function acquireDesktopProcessLock(root, { pid = process.pid, alive = processAlive, identity = processStart, graceMs = 30_000, webOrigin = null } = {}) {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const directory = join(root, "desktop-app.lock");
+  const ownerFile = join(directory, "owner.json");
+  try {
+    await mkdir(directory, { mode: 0o700 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    let owner;
+    try { owner = JSON.parse(await readFile(ownerFile, "utf8")); } catch { owner = {}; }
+    if (!Number.isSafeInteger(owner.pid) && Date.now() - (await stat(directory)).mtimeMs < graceMs) {
+      throw new SimyProcessConflictError("Another SIMY window is starting. Try opening it again shortly.");
+    }
+    if (Number.isSafeInteger(owner.pid) && alive(owner.pid) && (!owner.startedAt || owner.startedAt === await identity(owner.pid))) {
+      throw new SimyProcessConflictError("SIMY is already running. Open its menu bar icon.");
+    }
+    // Only one process may reclaim a dead owner; other contenders must retry.
+    const recovery = join(directory, "recovery");
+    try { await mkdir(recovery, { mode: 0o700 }); } catch {
+      const age = Date.now() - (await stat(recovery)).mtimeMs;
+      if (age < graceMs) throw new SimyProcessConflictError("SIMY is recovering a previous session. Try again shortly.");
+      await rm(recovery, { recursive: true });
+      await mkdir(recovery, { mode: 0o700 });
+    }
+    const latest = await readFile(ownerFile, "utf8").catch(() => "{}");
+    let current; try { current = JSON.parse(latest); } catch { current = {}; }
+    if (current.nonce !== owner.nonce) {
+      throw new SimyProcessConflictError("SIMY is starting in another window.");
+    }
+    await rm(directory, { recursive: true });
+    return acquireDesktopProcessLock(root, { pid, alive, identity, graceMs, webOrigin });
+  }
+  const nonce = randomBytes(32).toString("hex");
+  await writeFile(ownerFile, JSON.stringify({
+    pid,
+    nonce,
+    startedAt: await identity(pid),
+    webOrigin: normalizedOriginOrNull(webOrigin),
+  }), { mode: 0o600 });
+  return {
+    nonce,
+    async release() {
+      const owner = JSON.parse(await readFile(ownerFile, "utf8").catch(() => "{}"));
+      if (owner.pid === pid && owner.nonce === nonce) await rm(directory, { recursive: true, force: true });
+    },
+  };
+}
+
+export async function assertNoDesktopHostForOrigin(
+  root,
+  webOrigin,
+  { alive = processAlive, identity = processStart, graceMs = 30_000, now = Date.now } = {},
+) {
+  const directory = join(root, "desktop-app.lock");
+  const ownerFile = join(directory, "owner.json");
+  let owner;
+  try {
+    owner = JSON.parse(await readFile(ownerFile, "utf8"));
+  } catch (error) {
+    const metadata = await stat(directory).catch(() => null);
+    if (metadata && now() - metadata.mtimeMs < graceMs) throw new SimyProcessConflictError();
+    return;
+  }
+  if (!Number.isSafeInteger(owner?.pid) || !alive(owner.pid)) return;
+  if (owner.startedAt) {
+    let startedAt;
+    try {
+      startedAt = await identity(owner.pid);
+    } catch {
+      throw new SimyProcessConflictError();
+    }
+    if (startedAt !== owner.startedAt) return;
+  }
+  const ownerOrigin = normalizedOriginOrNull(owner.webOrigin);
+  const requestedOrigin = normalizedOriginOrNull(webOrigin);
+  if (ownerOrigin && requestedOrigin && ownerOrigin !== requestedOrigin) return;
+  throw new SimyProcessConflictError();
+}
+
+export async function assertNoLegacyCliDaemon(
+  webOrigin,
+  {
+    processes = listSameUserProcesses,
+    verifyEntry = verifySimyCliEntry,
+    currentPid = process.pid,
+  } = {},
+) {
+  const requestedOrigin = normalizeWebOrigin(webOrigin);
+  let candidates;
+  try {
+    candidates = await processes();
+  } catch {
+    throw new SimyProcessConflictError(
+      "SIMY could not verify whether another CLI service is running. Stop the existing CLI daemon, then reopen SIMY CLI.",
+    );
+  }
+  for (const processInfo of candidates) {
+    if (processInfo.pid === currentPid) continue;
+    const parsed = parseLegacyAgentArguments(processInfo.command ?? processInfo.args);
+    if (!parsed || !(await verifyEntry(parsed.entryPath))) continue;
+    if (parsed.webOrigin && parsed.webOrigin !== requestedOrigin) continue;
+    throw new SimyProcessConflictError();
+  }
+}
+
+export function parseLegacyAgentArguments(args) {
+  const argv = Array.isArray(args) ? args : recoverProcessArguments(args);
+  if (argv.length < 2 || !["node", "nodejs"].includes(basename(argv[0]))) return null;
+  const entryIndex = argv.findIndex((value, index) => index > 0 && /(?:^|\/)src\/index\.js$/.test(value));
+  if (entryIndex < 1) return null;
+  const agentArgs = argv.slice(entryIndex + 1);
+  if (agentArgs.includes("--help") || agentArgs.includes("-h")) return null;
+  const subcommand = agentArgs.find((value, index) => {
+    if (value.startsWith("-")) return false;
+    const previous = agentArgs[index - 1];
+    return previous !== "--host" && previous !== "--port";
+  });
+  if (subcommand === "sqm" || subcommand === "update") return null;
+  let webOrigin = null;
+  const hostIndex = argv.indexOf("--host", entryIndex + 1);
+  const inlineHost = argv.slice(entryIndex + 1).find((value) => value.startsWith("--host="));
+  const explicitHost = hostIndex >= 0 ? argv[hostIndex + 1] : inlineHost?.slice("--host=".length);
+  if (explicitHost) webOrigin = normalizedOriginOrNull(explicitHost);
+  return { entryPath: argv[entryIndex], webOrigin };
+}
+
+function recoverProcessArguments(command) {
+  const raw = String(command || "");
+  // macOS ps does not retain shell quoting. Packaged app paths contain spaces, so
+  // recover the two known absolute path suffixes before tokenizing CLI flags.
+  const packaged = raw.match(/^\s*(\/.*?\/(?:node|nodejs))\s+(\/.*?\/src\/index\.js)(?=\s|$)(.*)$/);
+  if (packaged) return [packaged[1], packaged[2], ...splitProcessArguments(packaged[3])];
+  return splitProcessArguments(raw);
+}
+
+export function splitProcessArguments(command) {
+  const values = [];
+  let value = "";
+  let quote = null;
+  let escaped = false;
+  for (const character of String(command || "")) {
+    if (escaped) {
+      value += character;
+      escaped = false;
+    } else if (character === "\\" && quote !== "'") {
+      escaped = true;
+    } else if (quote) {
+      if (character === quote) quote = null;
+      else value += character;
+    } else if (character === "'" || character === '"') {
+      quote = character;
+    } else if (/\s/.test(character)) {
+      if (value) values.push(value);
+      value = "";
+    } else {
+      value += character;
+    }
+  }
+  if (escaped) value += "\\";
+  if (value) values.push(value);
+  return values;
+}
+
+export async function validateDesktopSupervisor(root, nonce) {
+  if (!nonce) return false;
+  const owner = JSON.parse(await readFile(join(root, "desktop-app.lock", "owner.json"), "utf8").catch(() => "{}"));
+  return owner.nonce === nonce && Number.isSafeInteger(owner.pid) && processAlive(owner.pid) && owner.startedAt === await processStart(owner.pid);
+}
+
+async function processStart(pid) {
+  const { stdout } = await promisify(execFile)("/bin/ps", ["-p", String(pid), "-o", "lstart="], { timeout: 2_000 });
+  return stdout.trim();
+}
+
+function processAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch (error) { return error.code !== "ESRCH"; }
+}
+
+async function listSameUserProcesses() {
+  const uid = process.getuid?.();
+  if (!Number.isSafeInteger(uid)) return [];
+  const { stdout } = await promisify(execFile)("/bin/ps", ["-ww", "-axo", "pid=,uid=,command="], {
+    timeout: 2_000,
+    maxBuffer: 2 * 1024 * 1024,
+  });
+  const processes = [];
+  for (const line of stdout.split("\n")) {
+    const match = line.match(/^\s*(\d+)\s+(\d+)\s+(.+)$/);
+    if (!match || Number(match[2]) !== uid) continue;
+    processes.push({ pid: Number(match[1]), command: match[3] });
+  }
+  return processes;
+}
+
+async function verifySimyCliEntry(entryPath) {
+  try {
+    const resolved = await realpath(entryPath);
+    const packageJson = JSON.parse(await readFile(join(dirname(dirname(resolved)), "package.json"), "utf8"));
+    return packageJson?.name === "@awak-app/simy-cli";
+  } catch {
+    return false;
+  }
+}
+
+function normalizedOriginOrNull(value) {
+  if (typeof value !== "string" || !value.trim()) return null;
+  try {
+    return normalizeWebOrigin(value);
+  } catch {
+    return null;
+  }
+}

package/src/desktop-status.js

@@ -0,0 +1,263 @@
+import { spawn } from "node:child_process";
+
+import { inspectBackendExecutable } from "./backend-executable.js";
+import { isSessionValid } from "./session-store.js";
+
+const CODEX_STATUS_CACHE_MS = 30_000;
+const MAX_DETAIL_LENGTH = 240;
+const MAX_LABEL_LENGTH = 120;
+const MAX_STATUS_ITEMS = 50;
+const MAX_PROBE_OUTPUT = 4_096;
+const INACTIVE_STATES = new Set([
+  "succeeded",
+  "failed",
+  "stopped",
+  "cancelled",
+  "canceled",
+  "complete",
+  "completed",
+  "merge_ready",
+  "pr_ready_for_review",
+]);
+
+export function createConnectionStatusTracker({ now = () => new Date() } = {}) {
+  let lastSuccessAt = null;
+  let lastAttemptAt = null;
+  let state = "unknown";
+  let error = null;
+
+  return {
+    attempt() {
+      lastAttemptAt = isoNow(now);
+      state = state === "online" ? "online" : "connecting";
+      error = null;
+    },
+    success() {
+      lastSuccessAt = isoNow(now);
+      state = "online";
+      error = null;
+    },
+    failure(cause) {
+      state = isUnauthorizedError(cause) ? "unauthorized" : "offline";
+      error = safeStatusDetail(cause);
+      return state;
+    },
+    snapshot({ authenticated = false } = {}) {
+      const visibleState = authenticated
+        ? state === "unknown"
+          ? "connecting"
+          : state
+        : state === "unauthorized"
+          ? "unauthorized"
+          : "unknown";
+      return {
+        state: visibleState,
+        lastSuccessAt,
+        lastAttemptAt,
+        error: visibleState === "unknown" ? null : error,
+      };
+    },
+  };
+}
+
+export function desktopAuthStatus(session, { now = Date.now(), webOrigin = null } = {}) {
+  const exists = Boolean(session);
+  const valid = isSessionValid(session, now, webOrigin);
+  return {
+    state: valid ? "signed_in" : exists ? "expired" : "signed_out",
+    expiresAt: typeof session?.expires_at === "string" ? session.expires_at : null,
+    userLabel: sessionUserLabel(session),
+  };
+}
+
+export function desktopTaskStatus(registries, { maxItems = MAX_STATUS_ITEMS } = {}) {
+  const tasks = registries.flatMap((registry, registryIndex) =>
+    typeof registry?.list === "function"
+      ? registry.list().map((task) => taskStatusItem(task, registryIndex))
+      : [],
+  );
+  tasks.sort((left, right) => right.updatedAt - left.updatedAt || left.id.localeCompare(right.id));
+  return {
+    activeCount: tasks.filter((task) => !INACTIVE_STATES.has(task.state)).length,
+    items: tasks.slice(0, maxItems).map(({ updatedAt: _updatedAt, ...item }) => item),
+  };
+}
+
+export function createCodexStatusInspector({
+  cacheMs = CODEX_STATUS_CACHE_MS,
+  inspect = inspectCodexStatus,
+  now = () => Date.now(),
+  inspectOptions = {},
+} = {}) {
+  let cached = null;
+  let cachedAt = 0;
+  let inFlight = null;
+  return async ({ force = false } = {}) => {
+    const current = now();
+    if (!force && cached && current - cachedAt < cacheMs) return structuredClone(cached);
+    if (inFlight) return structuredClone(await inFlight);
+    inFlight = Promise.resolve(inspect({ ...inspectOptions, now: () => new Date(now()) }))
+      .then((result) => {
+        cached = result;
+        cachedAt = now();
+        return result;
+      })
+      .finally(() => {
+        inFlight = null;
+      });
+    return structuredClone(await inFlight);
+  };
+}
+
+export async function inspectCodexStatus({
+  inspectExecutable = inspectBackendExecutable,
+  spawnImpl = spawn,
+  timeoutMs = 2_000,
+  now = () => new Date(),
+} = {}) {
+  const checkedAt = isoNow(now);
+  let executable;
+  try {
+    executable = await inspectExecutable("codex", { spawnImpl, timeoutMs });
+  } catch {
+    return codexStatus("unknown", null, checkedAt, "Codex availability could not be checked.");
+  }
+  const version = executable?.installed_version ?? null;
+  if (!executable?.available) {
+    return codexStatus("missing", version, checkedAt, "Codex is not installed or cannot be started.");
+  }
+  if (!executable.compatible) {
+    return codexStatus(
+      executable.status === "outdated" ? "outdated" : "unknown",
+      version,
+      checkedAt,
+      executable.status === "outdated"
+        ? `Codex ${version || "installed version"} is older than the supported minimum.`
+        : "The installed Codex version could not be verified.",
+    );
+  }
+
+  const probe = await runLoginStatus(executable.executable, { spawnImpl, timeoutMs });
+  if (probe.kind === "signed_in") {
+    return codexStatus("ready", version, checkedAt, "Codex is installed and signed in.");
+  }
+  if (probe.kind === "signed_out") {
+    return codexStatus("signed_out", version, checkedAt, "Codex is installed but signed out.");
+  }
+  return codexStatus("unknown", version, checkedAt, "Codex login status could not be verified.");
+}
+
+export function safeStatusDetail(cause) {
+  const source = cause instanceof Error ? cause.message : String(cause || "Connection failed.");
+  if (isUnauthorizedError(cause)) return "SIMY authorization was rejected.";
+  if (/\b(?:abort|timed? ?out|timeout)\b/i.test(source)) return "SIMY connection timed out.";
+  if (/\b(?:fetch failed|network|ENOTFOUND|ECONNREFUSED|ECONNRESET|EAI_AGAIN)\b/i.test(source)) {
+    return "SIMY Web could not be reached.";
+  }
+  return bounded("SIMY connection failed.", MAX_DETAIL_LENGTH);
+}
+
+export function isUnauthorizedError(error) {
+  const status = Number(error?.status ?? error?.statusCode);
+  if (status === 401 || status === 403) return true;
+  return /\b(?:401|403|unauthori[sz]ed|forbidden|session expired|invalid token|token expired)\b/i.test(
+    error instanceof Error ? error.message : String(error || ""),
+  );
+}
+
+function taskStatusItem(task, registryIndex) {
+  const state = bounded(
+    String(
+      task?.status ||
+        task?.snapshot?.state ||
+        task?.state ||
+        task?.control_state ||
+        task?.controlState ||
+        "unknown",
+    ),
+    48,
+  );
+  return {
+    id: bounded(String(task?.id || `unknown-${registryIndex}`), MAX_LABEL_LENGTH),
+    label: bounded(
+      String(
+        task?.request?.requirement ||
+          task?.instruction ||
+          task?.snapshot?.charter?.requirement ||
+          task?.id ||
+          "Task",
+      ),
+      MAX_LABEL_LENGTH,
+    ),
+    state,
+    updatedAt:
+      Date.parse(task?.updated_at || task?.snapshot?.updated_at || task?.startedAt || 0) || 0,
+  };
+}
+
+function sessionUserLabel(session) {
+  if (!session) return null;
+  for (const key of ["user_label", "display_name", "email", "account_id", "auth_user_id"]) {
+    if (typeof session[key] === "string" && session[key].trim()) {
+      return bounded(session[key].trim(), MAX_LABEL_LENGTH);
+    }
+  }
+  return null;
+}
+
+function runLoginStatus(command, { spawnImpl, timeoutMs }) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let output = "";
+    let timeout;
+    let child;
+    const finish = (kind) => {
+      if (settled) return;
+      settled = true;
+      if (timeout) clearTimeout(timeout);
+      resolve({ kind });
+    };
+    try {
+      child = spawnImpl(command, ["login", "status"], {
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch {
+      finish("unknown");
+      return;
+    }
+    const append = (chunk) => {
+      if (output.length >= MAX_PROBE_OUTPUT) return;
+      output += String(chunk).slice(0, MAX_PROBE_OUTPUT - output.length);
+    };
+    child.stdout?.on?.("data", append);
+    child.stderr?.on?.("data", append);
+    timeout = setTimeout(() => {
+      child.kill?.("SIGTERM");
+      finish("unknown");
+    }, timeoutMs);
+    child.on?.("error", () => finish("unknown"));
+    child.on?.("close", (code) => {
+      if (/not logged in|signed out|login required|please log in/i.test(output)) {
+        finish("signed_out");
+      } else if (code === 0 && /logged in|signed in/i.test(output)) {
+        finish("signed_in");
+      } else {
+        finish("unknown");
+      }
+    });
+  });
+}
+
+function codexStatus(state, version, checkedAt, detail) {
+  return { state, version, checkedAt, detail };
+}
+
+function isoNow(now) {
+  const value = now();
+  return (value instanceof Date ? value : new Date(value)).toISOString();
+}
+
+function bounded(value, limit) {
+  const clean = String(value || "").replace(/[\r\n\t]+/g, " ").replace(/\s+/g, " ").trim();
+  return clean.length <= limit ? clean : `${clean.slice(0, limit - 1)}…`;
+}

package/src/direct-executor.js

@@ -17,6 +17,12 @@ export class DirectTaskRegistry {
   get(taskId) {
     return this.#tasks.get(taskId) ?? null;
   }
+
+  list() {
+    return [...this.#tasks.values()].sort(
+      (left, right) => Date.parse(right.updated_at || 0) - Date.parse(left.updated_at || 0),
+    );
+  }
 }
 
 export function createDirectTask({

package/src/index.js

@@ -3,6 +3,8 @@
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
 
 import { startAgent } from "./agent.js";
 import {
@@ -22,6 +24,7 @@ import {
 import { prepareDaemonWorkflows } from "./sqm/workflow-onboarding.js";
 import { startWorkflowUpdates } from "./sqm/workflow-update.js";
 import { DEFAULT_WEB_ORIGIN, resolveWebOrigin } from "./web-origin.js";
+import { assertNoDesktopHostForOrigin } from "./desktop-process-lock.js";
 
 const argv = process.argv.slice(2);
 const args = new Set(argv);
@@ -29,12 +32,22 @@ const dispatchArgv = argv.filter((value) => value !== "--no-auto-update");
 const entryPath = fileURLToPath(import.meta.url);
 const packageInfo = await readCliPackageInfo();
 const updatesDisabled = args.has("--no-auto-update") || process.env.SIMY_AUTO_UPDATE === "0";
+let configuredWebOrigin;
+try {
+  configuredWebOrigin = resolveWebOrigin(readOption(argv, "--host"));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 2;
+}
 
-if (dispatchArgv[0] === "update") {
+if (!configuredWebOrigin) {
+  // Invalid host input is reported above before update discovery or startup.
+} else if (dispatchArgv[0] === "update") {
   const checkOnly = args.has("--check");
   const result = await runCliUpdateGate({
     argv,
     packageInfo,
+    webOrigin: configuredWebOrigin,
     mode: checkOnly ? "check" : "update",
     disabled: updatesDisabled,
     allowMajor: args.has("--yes"),
@@ -46,16 +59,17 @@ if (dispatchArgv[0] === "update") {
     argv,
     packageInfo,
     entryPath,
+    webOrigin: configuredWebOrigin,
     disabled: updatesDisabled,
   });
   if (startupUpdate.reexecuted) {
     process.exitCode = startupUpdate.exitCode;
   } else {
-    await runCommand();
+    await runCommand(startupUpdate.installMode);
   }
 }
 
-async function runCommand() {
+async function runCommand(installMode) {
   if (dispatchArgv[0] === "sqm") {
     try {
       const { runSqmCommand } = await import("./sqm/command.js");
@@ -66,6 +80,7 @@ async function runCommand() {
           argv,
           packageInfo,
           entryPath,
+          webOrigin: configuredWebOrigin,
           mode: "incompatible",
           disabled: updatesDisabled,
           allowMajor: args.has("--yes"),
@@ -95,7 +110,7 @@ async function runCommand() {
   simy sqm lint       Validate module reliability before publication
   simy sqm replay     Replay modules against labelled historical snapshots
   simy update --check Check the installed and latest stable CLI versions
-  simy update         Install an eligible stable CLI update
+  simy update         ${installMode === "macos_installer" ? "Show Apple Silicon update status and installer action" : "Install an eligible stable CLI update"}
 
 Options:
   --daemon, --deamon  Run detached in the background
@@ -103,11 +118,11 @@ Options:
   --no-open           Do not open the browser when authorization is required
   --port <port>       Bind a specific localhost port
   --host <url>        Connect to a SIMY Web origin (default: ${DEFAULT_WEB_ORIGIN})
-  --install-workflows Install or update SIMY Codex/Claude skills and PR hooks
+  --install-workflows Install or update SIMY Codex/Claude opt-in SQM skills
   --no-workflow-prompt Skip the daemon startup workflow-installation prompt
   --no-auto-update    Disable update checks and automatic installation
 
-${autoUpdateHelpText()}
+${autoUpdateHelpText({ installMode, webOrigin: configuredWebOrigin })}
 `);
     return;
   }
@@ -119,9 +134,11 @@ async function runLocalAgent() {
   const daemon = args.has("--daemon") || args.has("--deamon");
   const interactive = !daemon && !args.has("--no-tui") && process.stdin.isTTY && process.stdout.isTTY;
   const port = readPort(argv);
-  let webOrigin;
+  const webOrigin = configuredWebOrigin;
+  const sessionRoot = process.env.SIMY_HOME?.trim() || join(homedir(), ".simy");
+
   try {
-    webOrigin = resolveWebOrigin(readOption(argv, "--host"));
+    await prepareDaemonWorkflows({ argv, daemon });
   } catch (error) {
     console.error(error instanceof Error ? error.message : String(error));
     process.exitCode = 2;
@@ -129,7 +146,7 @@ async function runLocalAgent() {
   }
 
   try {
-    await prepareDaemonWorkflows({ argv, daemon });
+    await assertNoDesktopHostForOrigin(sessionRoot, webOrigin);
   } catch (error) {
     console.error(error instanceof Error ? error.message : String(error));
     process.exitCode = 2;
@@ -151,6 +168,7 @@ async function runLocalAgent() {
     daemon,
     interactive,
     requestedPort: port,
+    webOrigin,
     disabled: args.has("--no-auto-update") || process.env.SIMY_AUTO_UPDATE === "0",
     dependencies: { packageInfo },
   });
@@ -168,15 +186,23 @@ async function runLocalAgent() {
     await closeAgent();
   };
   installAgentShutdownSignalHandlers({ shutdown: shutdownAgent });
-  await writeUpdateHandoffFromEnvironment({ version: packageInfo.version, port: agent.port });
+  await writeUpdateHandoffFromEnvironment({
+    version: packageInfo.version,
+    port: agent.port,
+    webOrigin,
+    installMode: updateManager.snapshot().install_mode,
+  });
   stopWorkflowUpdates = startWorkflowUpdates({ enabled: daemon && !updatesDisabled });
   updateManager.start({
     registry: agent.registry,
-    restartDaemon: async (targetVersion) => {
+    restartDaemon: async (targetVersion, installation) => {
       await restartDaemonProcess({
-        entryPath: fileURLToPath(import.meta.url),
+        entryPath: installation?.entryPath || fileURLToPath(import.meta.url),
+        executablePath: installation?.executablePath,
         argv: process.argv.slice(2),
         targetVersion,
+        expectedWebOrigin: webOrigin,
+        expectedInstallMode: updateManager.snapshot().install_mode,
       });
       await shutdownAgent();
     },