@bitkyc08/opencodex 2.49.0 → 2.51.0

package/src/update/index.ts

@@ -3,13 +3,23 @@ import { STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "./stop-contract.mjs";
 import { proxyIdentityAt } from "../server/proxy-liveness";
 import { probeProxyLiveness } from "./proxy-liveness-probe.mjs";
 import { decidePostStopUpdate } from "./stop-decision.mjs";
-import { readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { getConfigDir, loadConfig } from "../config";
 import { readPid, readRuntimePort } from "../config/process-state";
 import { pendingTeardownOutstanding } from "../config/pending-teardown";
 import { npmInvocation } from "./npm-invocation.mjs";
+import { pnpmInvocation, pnpmInvocationForPath, resolvePnpmCommands } from "./pnpm-invocation.mjs";
+import { detectInstallFromPath } from "./install-detection.mjs";
+import {
+  pnpmOwnerInvocation,
+  readPnpmGlobalPackage,
+  resolvePnpmGlobalOwner,
+  runPnpmGlobalUpdate,
+} from "./pnpm-global-install.mjs";
+import type { PnpmGlobalOwner, PnpmGlobalOwnerResult } from "./pnpm-global-install.mjs";
+import { checkRegistryPackageIntegrity } from "./registry-integrity.mjs";
 import {
   npmCachePreflightFailureMessage,
   runNpmCachePreflight,
@@ -35,13 +45,101 @@ export function historyRestoreIncomplete(configDir = getConfigDir()): boolean {
 export const PKG = "@bitkyc08/opencodex";
 const HERE = dirname(fileURLToPath(import.meta.url)); // .../opencodex/src/update
 
-export type Installer = "bun" | "npm" | "source";
+export type Installer = "bun" | "npm" | "pnpm" | "source";
 export type Channel = "latest" | "preview";
 
 /** Infer how opencodex is installed from the running module's path. */
 export function detectInstall(): Installer {
-  if (!HERE.includes("node_modules")) return "source"; // a git checkout, not a global install
-  return HERE.includes(".bun") ? "bun" : "npm";
+  return detectInstallFromPath(HERE, { exists: existsSync });
+}
+
+function packageRoot(): string {
+  return resolve(HERE, "..", "..");
+}
+
+function runningPnpmShimPath(): string | undefined {
+  const invoked = process.argv[1];
+  if (!invoked) return undefined;
+  const name = invoked.replaceAll("\\", "/").split("/").at(-1)?.toLowerCase();
+  if (!new Set(["ocx", "opencodex", "ocx.cmd", "opencodex.cmd", "ocx.ps1", "opencodex.ps1"]).has(name ?? "")) {
+    return undefined;
+  }
+  return resolve(invoked);
+}
+
+function runPnpmCandidate(
+  commandPath: string,
+  args: readonly string[],
+  capture = false,
+): { status: number | null; stdout?: string | null; stderr?: string | null } {
+  const invocation = pnpmInvocationForPath(commandPath, args);
+  if (!invocation) return { status: 1 };
+  return spawnSync(invocation.file, invocation.args, {
+    stdio: capture ? "pipe" : "ignore",
+    encoding: "utf8",
+    timeout: 20_000,
+    windowsHide: true,
+    ...invocation.options,
+  });
+}
+
+/** Resolve the exact pnpm executable/group/bin that own this package. */
+export function resolveCurrentPnpmGlobalOwner(): PnpmGlobalOwnerResult {
+  return resolvePnpmGlobalOwner({
+    packageName: PKG,
+    packagePath: packageRoot(),
+    commandPaths: resolvePnpmCommands(),
+    runningShimPath: runningPnpmShimPath(),
+    runPnpm: runPnpmCandidate,
+  });
+}
+
+function ownerPnpmTarget(
+  owner: PnpmGlobalOwner,
+  args: readonly string[],
+): { bin: string; args: string[]; options: { windowsVerbatimArguments?: boolean }; env: Record<string, string | undefined> } | null {
+  const invocation = pnpmOwnerInvocation(owner, args);
+  if (!invocation) return null;
+  return {
+    bin: invocation.file,
+    args: invocation.args,
+    options: invocation.options,
+    env: invocation.env,
+  };
+}
+
+function runOwnedPnpm(
+  owner: PnpmGlobalOwner,
+  args: readonly string[],
+  capture: boolean,
+  stdio: "inherit" | "pipe" | "ignore" = capture ? "pipe" : "inherit",
+): { status: number | null; stdout?: string | null; stderr?: string | null } {
+  const target = ownerPnpmTarget(owner, args);
+  if (!target) return { status: 1 };
+  return spawnSync(target.bin, target.args, {
+    stdio,
+    encoding: "utf8",
+    timeout: 180_000,
+    windowsHide: true,
+    env: target.env,
+    ...target.options,
+  });
+}
+
+/** Re-read the owning group's active package and return its verified launcher. */
+export function resolvePnpmActiveLauncher(owner: PnpmGlobalOwner): string | null {
+  const active = readPnpmGlobalPackage(
+    PKG,
+    (args, capture = false) => runOwnedPnpm(owner, args, capture),
+    undefined,
+    {
+      owner,
+      expectedGlobalDir: owner.globalDir,
+      expectedGlobalRoot: owner.globalRoot,
+      globalBinDir: owner.globalBinDir,
+    },
+  );
+  return active.ok ? join(active.path, "bin", "ocx.mjs") : null;
 }
 
 export function currentVersion(): string {
@@ -63,14 +161,57 @@ export function updateTag(current: string): Channel {
   return defaultUpdateTag(current);
 }
 
-function npmSpawnTarget(args: readonly string[]): { bin: string; args: string[]; options: { windowsVerbatimArguments?: boolean } } | null {
+type SpawnTarget = {
+  bin: string;
+  args: string[];
+  options: { windowsVerbatimArguments?: boolean };
+  env?: Record<string, string | undefined>;
+};
+
+function npmSpawnTarget(args: readonly string[]): SpawnTarget | null {
   const invocation = npmInvocation(args);
   if (!invocation) return null;
   return { bin: invocation.file, args: invocation.args, options: invocation.options };
 }
 
-function updateSpawnTarget(bin: string, args: readonly string[]): { bin: string; args: string[]; options: { windowsVerbatimArguments?: boolean } } | null {
+function pnpmSpawnTarget(args: readonly string[], owner?: PnpmGlobalOwner): SpawnTarget | null {
+  if (owner) {
+    const invocation = pnpmOwnerInvocation(owner, args);
+    if (!invocation) return null;
+    return {
+      bin: invocation.file,
+      args: invocation.args,
+      options: invocation.options,
+      env: invocation.env,
+    };
+  }
+  const invocation = pnpmInvocation(args);
+  if (!invocation) return null;
+  return { bin: invocation.file, args: invocation.args, options: invocation.options };
+}
+
+function registrySpawnTarget(
+  installer: Installer,
+  args: readonly string[],
+  owner?: PnpmGlobalOwner,
+): SpawnTarget | null {
+  // A pnpm command without an owner would silently fall back to the first PATH
+  // candidate. That is unsafe when multiple PNPM_HOME installations expose the
+  // same version, so registry queries use the same hard binding as mutation.
+  return installer === "pnpm"
+    ? owner ? pnpmSpawnTarget(args, owner) : null
+    : npmSpawnTarget(args);
+}
+
+function selectedPnpmOwner(owner?: PnpmGlobalOwner): PnpmGlobalOwner | undefined {
+  if (owner) return owner;
+  const result = resolveCurrentPnpmGlobalOwner();
+  return result.ok ? result.owner : undefined;
+}
+
+function updateSpawnTarget(bin: string, args: readonly string[]): SpawnTarget | null {
   if (bin === "npm") return npmSpawnTarget(args);
+  if (bin === "pnpm") return pnpmSpawnTarget(args);
   if (process.platform === "win32" && bin === "bun") {
     return { bin: process.execPath, args: [...args], options: {} };
   }
@@ -95,28 +236,46 @@ function logSpawnOutput(label: string, result: { stdout?: string | Buffer | null
   if (stderr) console.error(stderr.length > 4000 ? `${label}${stderr.slice(-4000)}` : stderr);
 }
 
-/** Latest published version from the registry (best-effort; null if npm isn't available). */
-export function latestVersion(tag: string): string | null {
-  const npm = npmSpawnTarget(["view", `${PKG}@${tag}`, "version"]);
-  if (!npm) return null;
-  const r = spawnSync(npm.bin, npm.args, {
+function shellQuote(value: string): string {
+  if (process.platform === "win32") return `"${value.replaceAll("\"", "\\\"")}"`;
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function launcherStartHint(launcher: string, port: number): string {
+  return `${shellQuote(process.execPath)} ${shellQuote(launcher)} start --port ${Math.trunc(port)}`;
+}
+
+/** Latest published version from the registry (best-effort; null if the manager isn't available). */
+export function latestVersion(
+  tag: string,
+  installer: Installer = detectInstall(),
+  owner?: PnpmGlobalOwner,
+): string | null {
+  const resolvedOwner = installer === "pnpm" ? selectedPnpmOwner(owner) : undefined;
+  if (installer === "pnpm" && !resolvedOwner) return null;
+  const manager = registrySpawnTarget(installer, ["view", `${PKG}@${tag}`, "version"], resolvedOwner);
+  if (!manager) return null;
+  const r = spawnSync(manager.bin, manager.args, {
     encoding: "utf8",
     timeout: 12000,
     windowsHide: true,
-    ...npm.options,
+    ...(manager.env ? { env: manager.env } : {}),
+    ...manager.options,
   });
-  return r.status === 0 ? (r.stdout.trim() || null) : null;
+  return r.status === 0 && typeof r.stdout === "string" ? (r.stdout.trim() || null) : null;
 }
 
 /** The global-install command opencodex would run to update on this channel. */
 export function updateCommand(installer: Installer, tag: Channel, resolvedVersion?: string | null): { bin: string; args: string[] } {
-  const bin = installer === "bun" ? "bun" : "npm";
   // Immutable target: when the registry resolved a concrete version, install exactly
   // that version — the dist-tag can move between resolution and install (TOCTOU).
   const target = resolvedVersion || tag;
-  const args = installer === "bun"
-    ? ["add", "-g", `${PKG}@${target}`]
-    : ["install", "-g", `${PKG}@${target}`];
+  if (installer === "bun") return { bin: "bun", args: ["add", "-g", `${PKG}@${target}`] };
+  if (installer === "pnpm") {
+    return { bin: "pnpm", args: ["add", "-g", "--allow-build=bun", `${PKG}@${target}`] };
+  }
+  const bin = "npm";
+  const args = ["install", "-g", `${PKG}@${target}`];
   return { bin, args };
 }
 
@@ -138,26 +297,33 @@ export function updateCommandStr(installer: Installer, tag: Channel, resolvedVer
 export function checkUpdatePackageIntegrity(
   version: string | null,
   spawn: typeof spawnSync = spawnSync,
+  installer: Installer = detectInstall(),
+  owner?: PnpmGlobalOwner,
 ): { ok: true; integrity: string } | { ok: false; reason: string } | { ok: "skipped"; reason: string } {
-  if (!version) return { ok: "skipped", reason: "no resolved version (registry unavailable)" };
-  const npm = npmSpawnTarget(["view", `${PKG}@${version}`, "dist.integrity"]);
-  if (!npm) return { ok: "skipped", reason: "npm executable was not found on a trusted PATH entry" };
-  const r = spawn(
-    npm.bin,
-    npm.args,
-    { encoding: "utf8", timeout: 12000, windowsHide: true, ...npm.options },
-  );
-  // status !== 0 covers nonzero exits AND timeouts (status === null).
-  if (r.status !== 0) return { ok: "skipped", reason: `registry integrity query failed (status ${r.status ?? "timeout"})` };
-  const tokens = (r.stdout ?? "").replace(/["']/g, "").trim().split(/\s+/).filter(Boolean);
-  const match = tokens.find(token => /^sha512-[A-Za-z0-9+/=]+$/.test(token));
-  if (!match) return { ok: false, reason: `registry returned no sha512 integrity for ${PKG}@${version}` };
-  return { ok: true, integrity: match };
+  const resolvedOwner = installer === "pnpm" ? selectedPnpmOwner(owner) : undefined;
+  if (installer === "pnpm" && !resolvedOwner) {
+    return { ok: false, reason: "could not identify pnpm's owning global installation" };
+  }
+  const manager = registrySpawnTarget(installer, ["view", `${PKG}@${version}`, "dist.integrity"], resolvedOwner);
+  if (!manager) return { ok: "skipped", reason: `${installer} executable was not found on a trusted PATH entry` };
+  const result = checkRegistryPackageIntegrity(PKG, version, args => {
+    const target = registrySpawnTarget(installer, args, resolvedOwner);
+    if (!target) return { status: 1 };
+    return spawn(target.bin, target.args, {
+      encoding: "utf8",
+      timeout: 12000,
+      windowsHide: true,
+      ...(target.env ? { env: target.env } : {}),
+      ...target.options,
+    });
+  });
+  return result;
 }
 
 /**
- * `ocx update` fallback for source checkouts and Bun global installs. npm global installs are updated
- * in the Node bin launcher before Bun starts, so Windows does not replace the running Bun binary.
+ * `ocx update` fallback for source checkouts and Bun global installs. npm and pnpm global installs
+ * are updated in the Node bin launcher before Bun starts, so Windows does not replace the running
+ * Bun binary.
  */
 export async function runUpdate(): Promise<void> {
   const installer = detectInstall();
@@ -170,7 +336,13 @@ export async function runUpdate(): Promise<void> {
     return;
   }
 
-  const latest = latestVersion(tag);
+  const ownerResult = installer === "pnpm" ? resolveCurrentPnpmGlobalOwner() : undefined;
+  if (installer === "pnpm" && (!ownerResult || !ownerResult.ok)) {
+    console.error(`⚠️  ${ownerResult?.reason ?? "Could not identify pnpm's owning global installation"}. Aborting before stopping the proxy.`);
+    process.exit(1);
+  }
+  const owner = ownerResult?.ok ? ownerResult.owner : undefined;
+  const latest = latestVersion(tag, installer, owner);
   if (latest && latest === current) {
     console.log(`Already on the latest ${tag} version (v${latest}).`);
     return;
@@ -178,7 +350,7 @@ export async function runUpdate(): Promise<void> {
 
   // Pre-flight integrity metadata check — runs BEFORE the proxy is stopped so an
   // anomalous registry entry aborts without unloading the running service.
-  const integrity = checkUpdatePackageIntegrity(latest);
+  const integrity = checkUpdatePackageIntegrity(latest, spawnSync, installer, owner);
   if (integrity.ok === false) {
     console.error(`⚠️  ${integrity.reason} — aborting the update before stopping the proxy.`);
     process.exit(1);
@@ -198,9 +370,11 @@ export async function runUpdate(): Promise<void> {
   }
 
   const { bin, args: cmdArgs } = updateCommand(installer, tag, latest);
-  const target = updateSpawnTarget(bin, cmdArgs);
+  const target = installer === "pnpm" && owner
+    ? pnpmSpawnTarget(cmdArgs, owner)
+    : updateSpawnTarget(bin, cmdArgs);
   if (!target) {
-    console.error("⚠️  Could not resolve npm from a trusted absolute PATH entry; aborting before stopping the proxy.");
+    console.error(`⚠️  Could not resolve ${bin} from a trusted absolute PATH entry; aborting before stopping the proxy.`);
     process.exit(1);
   }
 
@@ -257,7 +431,9 @@ export async function runUpdate(): Promise<void> {
   // shared client config still points at a proxy that is gone; installing over that
   // silently skips the recovery the receipt was written to trigger (#3008).
   // Full `ocx stop` semantics (drain, service stop, restore).
+  let stopAttempted = false;
   if (serviceWasInstalled || readPid() || readRuntimePort() || pendingTeardownOutstanding()) {
+    stopAttempted = true;
     console.log("⏹  Stopping the running proxy before updating...");
     const stopStdio = updateChildStdio();
     const stop = spawnSync(process.execPath, selfLaunchArgv(["stop"]), {
@@ -266,7 +442,7 @@ export async function runUpdate(): Promise<void> {
       windowsHide: true,
     });
     if (stopStdio === "pipe") logSpawnOutput("", stop);
-    // One decision, shared with the npm launcher (#3008). The two lanes disagreeing about
+    // One decision, shared with the package launcher (#3008). The two lanes disagreeing about
     // the same situation is how this shipped fixed on one side only. Absent PID and runtime
     // files are weak evidence - a crashed-but-listening proxy leaves none - so the captured
     // endpoint is asked, and `null` from proxyIdentityAt covers refusal AND timeout alike.
@@ -310,35 +486,96 @@ export async function runUpdate(): Promise<void> {
   console.log(`Updating${latest ? ` to v${latest}` : ""}…\n$ ${bin} ${cmdArgs.join(" ")}`);
 
   const installStdio = updateChildStdio();
-  const r = spawnSync(target.bin, target.args, {
-    stdio: installStdio,
-    encoding: installStdio === "pipe" ? "utf8" : undefined,
-    timeout: 180000,
-    windowsHide: true,
-    ...target.options,
-  });
+  // Every post-update action below receives this path. For pnpm it is replaced only
+  // by a path returned after tree+shim verification; on rollback, activePath is
+  // likewise returned only after the old group has been verified again.
+  let postUpdateLauncher = join(packageRoot(), "bin", "ocx.mjs");
+  // The pnpm owner preflight has verified this package tree and global group. Keep that exact
+  // package path as the recovery starting point; the path returned by the update transaction
+  // replaces it only after post-update tree+shim verification succeeds.
+  if (installer === "pnpm" && owner) {
+    postUpdateLauncher = join(owner.packagePath, "bin", "ocx.mjs");
+  }
+  let postUpdateLauncherUsable = true;
+  let r: {
+    status: number | null;
+    signal?: NodeJS.Signals | null;
+    stdout?: string | Buffer | null;
+    stderr?: string | Buffer | null;
+  };
+  if (installer === "pnpm") {
+    let update: ReturnType<typeof runPnpmGlobalUpdate>;
+    try {
+      update = runPnpmGlobalUpdate({
+        packageName: PKG,
+        currentVersion: current,
+        targetVersion: latest || undefined,
+        tag,
+        owner: owner!,
+        runningPackagePath: packageRoot(),
+        runPnpm: (args, capture = false) => runOwnedPnpm(
+          owner!,
+          args,
+          capture,
+          capture ? "pipe" : installStdio,
+        ),
+        log: line => console.log(line),
+      });
+    } catch {
+      // A thrown verifier/runner error means the active group is unknown. Mark the
+      // launcher unusable and let the failure lane report a manual recovery path.
+      update = {
+        ok: false,
+        phase: "rollback",
+        rolledBack: false,
+        error: "pnpm update failed unexpectedly; active package could not be verified",
+      };
+    }
+    if (update.ok) {
+      postUpdateLauncher = join(update.path, "bin", "ocx.mjs");
+      postUpdateLauncherUsable = true;
+      r = { status: 0, signal: null, stdout: "", stderr: "" };
+    } else {
+      postUpdateLauncherUsable = Boolean(update.activePath);
+      if (update.activePath) postUpdateLauncher = join(update.activePath, "bin", "ocx.mjs");
+      console.error(`⚠️  ${update.error}${update.rolledBack ? "." : " Manual recovery may be required."}`);
+      r = { status: 1, signal: null, stdout: "", stderr: "" };
+    }
+  } else {
+    r = spawnSync(target.bin, target.args, {
+      stdio: installStdio,
+      encoding: installStdio === "pipe" ? "utf8" : undefined,
+      timeout: 180000,
+      windowsHide: true,
+      ...target.options,
+    });
+  }
   if (installStdio === "pipe") logSpawnOutput("", r);
   if (r.status === 0) {
     console.log(`\n✅ Updated${latest ? ` to v${latest}` : ""}.`);
-    // Re-bake the bundled Bun path into the Codex autostart shim on every
-    // platform when one is installed (refresh-only; never installs fresh).
+    // Re-enter through the verified active package launcher. This keeps the Codex
+    // shim, tray, service and proxy recovery paths on the same package/group that
+    // pnpm selected, including when the update changed the global link target.
     try {
-      const { isCodexShimInstalled, installCodexShim } = await import("../codex/shim");
+      const { isCodexShimInstalled } = await import("../codex/shim");
       if (isCodexShimInstalled()) {
-        const result = installCodexShim();
-        if (result.installed) console.log(`🔧 ${result.message}`);
+        const shim = spawnSync(process.execPath, [postUpdateLauncher, "codex-shim", "install"], {
+          stdio: "inherit",
+          windowsHide: true,
+        });
+        if (shim.status !== 0) console.warn("⚠️  Shim repair skipped: run 'ocx codex-shim install'.");
       }
-    } catch (e) {
-      console.warn(`⚠️  Shim repair skipped: ${e instanceof Error ? e.message : e}`);
+    } catch {
+      console.warn("⚠️  Shim repair skipped; run 'ocx codex-shim install'.");
     }
     if (trayWasInstalled) {
-      const trayArgs = selfLaunchArgv(planWindowsTrayUpdate({ installed: trayWasInstalled, running: trayWasRunning }).installArgs);
-      const tray = spawnSync(process.execPath, trayArgs, { stdio: "inherit", windowsHide: true });
+      const trayArgs = planWindowsTrayUpdate({ installed: trayWasInstalled, running: trayWasRunning }).installArgs;
+      const tray = spawnSync(process.execPath, [postUpdateLauncher, ...trayArgs], { stdio: "inherit", windowsHide: true });
       if (tray.status === 0) {
         console.log("🔧 Refreshed Windows tray startup paths.");
       } else {
         console.warn("⚠️  Windows tray refresh failed. Run 'ocx tray install'.");
-        if (trayWasRunning) spawnSync(process.execPath, selfLaunchArgv(["tray", "start"]), { stdio: "ignore", windowsHide: true });
+        if (trayWasRunning) spawnSync(process.execPath, [postUpdateLauncher, "tray", "start"], { stdio: "ignore", windowsHide: true });
       }
     }
     // The stop above unloaded any managed service; repair it with the NEW files
@@ -362,7 +599,7 @@ export async function runUpdate(): Promise<void> {
       process.env.OCX_BAKE_PORT = String(capturedListen.port);
       try {
         const svcStdio = updateChildStdio();
-        const svc = spawnSync(process.execPath, selfLaunchArgv(serviceReinstallArgs()), {
+        const svc = spawnSync(process.execPath, [postUpdateLauncher, ...serviceReinstallArgs()], {
           stdio: svcStdio,
           encoding: svcStdio === "pipe" ? "utf8" : undefined,
           windowsHide: true,
@@ -407,7 +644,7 @@ export async function runUpdate(): Promise<void> {
               : "   Run 'ocx service repair' to refresh the background service and see why it failed.");
             const env = { ...process.env };
             delete env.OCX_SERVICE;
-            const child = spawn(process.execPath, selfLaunchArgv(["start", "--port", String(capturedListen.port)]), {
+            const child = spawn(process.execPath, [postUpdateLauncher, "start", "--port", String(capturedListen.port)], {
               detached: true,
               stdio: "ignore",
               windowsHide: true,
@@ -422,14 +659,30 @@ export async function runUpdate(): Promise<void> {
         else process.env.OCX_BAKE_PORT = prevBake;
       }
     } else {
-      console.log(`Restart the proxy:  ocx start --port ${capturedListen.port}`);
+      console.log(`Restart the proxy:  ${launcherStartHint(postUpdateLauncher, capturedListen.port)}`);
     }
   } else {
-    if (trayWasRunning) {
-      try {
-        const { startWindowsTray } = await import("../tray/windows");
-        startWindowsTray();
-      } catch { /* keep the primary update failure */ }
+    if (stopAttempted && trayWasRunning && postUpdateLauncherUsable) {
+      spawnSync(process.execPath, [postUpdateLauncher, "tray", "start"], { stdio: "ignore", windowsHide: true });
+    }
+    if (stopAttempted && serviceWasInstalled && postUpdateLauncherUsable) {
+      const service = spawnSync(process.execPath, [postUpdateLauncher, "service", "repair"], {
+        stdio: "inherit",
+        windowsHide: true,
+      });
+      if (service.status !== 0) console.warn("⚠️  Previous background service could not be restored; run 'ocx service repair'.");
+    } else if (stopAttempted && postUpdateLauncherUsable) {
+      const env = { ...process.env };
+      delete env.OCX_SERVICE;
+      const child = spawn(process.execPath, [postUpdateLauncher, "start", "--port", String(capturedListen.port)], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        env: withProcessRuntimeProvenance(env),
+      });
+      child.unref();
+    } else if (stopAttempted) {
+      console.error("opencodex: no verified active launcher remains for automatic recovery; reinstall opencodex manually.");
     }
     console.error(`\n⚠️  Update failed (${bin} exit ${r.status ?? "?"}). Try manually:  ${bin} ${cmdArgs.join(" ")}`);
     process.exit(1);

package/src/update/install-detection.d.mts

@@ -0,0 +1,6 @@
+export type DetectedInstall = "bun" | "npm" | "pnpm" | "source";
+
+export declare function detectInstallFromPath(
+  packagePath: string,
+  deps?: { exists?: (path: string) => boolean; realpath?: (path: string) => string },
+): DetectedInstall;

package/src/update/install-detection.mjs

@@ -0,0 +1,73 @@
+import { realpathSync } from "node:fs";
+
+/**
+ * Infer the package manager from the path of the running package.
+ *
+ * PATH is deliberately not consulted here. A machine can have npm, pnpm, and Bun
+ * installed at the same time; the package layout is the evidence of which manager owns
+ * the files that the updater must change. The legacy `global/<version>` spelling is only
+ * accepted when the adjacent filesystem metadata also looks like a pnpm global group.
+ *
+ * The real path is considered in addition to the spelling visible to the module loader.
+ * This matters when Node is launched with preserved symlinks: a pnpm package can be
+ * exposed through an npm-looking prefix while its target is still under pnpm's global
+ * virtual store.
+ */
+export function detectInstallFromPath(packagePath, deps = {}) {
+  const exists = deps.exists;
+  const candidates = [String(packagePath)];
+  try {
+    const resolved = (deps.realpath ?? realpathSync)(String(packagePath));
+    if (resolved && !candidates.includes(resolved)) candidates.push(resolved);
+  } catch {
+    // Synthetic paths in source-level checks, and a partially removed install, have no
+    // realpath. The lexical path still carries the evidence when it is available.
+  }
+
+  let sawNodeModules = false;
+  for (const candidate of candidates) {
+    const detected = detectInstallCandidate(candidate, exists);
+    if (detected === "pnpm" || detected === "bun") return detected;
+    if (detected === "npm") sawNodeModules = true;
+  }
+  return sawNodeModules ? "npm" : "source";
+}
+
+function detectInstallCandidate(packagePath, exists) {
+  const normalized = String(packagePath).replaceAll("\\", "/");
+  const segments = normalized.split("/").filter(Boolean);
+  // Windows paths are case-insensitive. Treating the structural marker this way also
+  // keeps a preserved-symlink path from being downgraded merely because its casing came
+  // from a Windows API or a user-created junction.
+  if (!segments.some(segment => segment.toLowerCase() === "node_modules")) return "source";
+
+  // Strong signatures survive normal symlink resolution: the v10 isolated virtual store
+  // and v11 global virtual store are both manager-owned paths. Do not classify an arbitrary
+  // npm prefix such as `/opt/global/v11` from its directory name alone.
+  if (
+    /(?:^|\/)node_modules\/\.pnpm(?:\/|$)/i.test(normalized)
+    || /(?:^|\/)store\/v\d+\/links(?:\/|$)/i.test(normalized)
+  ) return "pnpm";
+
+  // `--preserve-symlinks` can leave a v10/v11 group path visible. Corroborate it with the
+  // group's virtual store or the v11 global store before selecting pnpm.
+  const globalMatch = normalized.match(/^(.*\/global\/(?:v)?\d+)(?:\/[^/]+)*\/node_modules(?:\/|$)/i);
+  if (globalMatch && exists) {
+    const globalRoot = globalMatch[1];
+    const groupRoot = normalized.slice(0, normalized.toLowerCase().indexOf("/node_modules"));
+    if (
+      exists(`${groupRoot}/node_modules/.pnpm`)
+      || exists(`${groupRoot}/node_modules/.modules.yaml`)
+      || exists(`${groupRoot}/node_modules/.pnpm/lock.yaml`)
+      || exists(`${globalRoot}/store`)
+      || exists(`${globalRoot}/pnpm-lock.yaml`)
+    ) return "pnpm";
+  }
+
+  // Bun's global layout is specifically `.bun/install/global/node_modules`. A bare `.bun`
+  // directory is not enough: npm projects can quite legitimately live under a dot-directory
+  // with that name, especially on Windows where package paths are often user-selected.
+  if (/(?:^|\/)\.bun\/install\/global\/node_modules(?:\/|$)/i.test(normalized)) return "bun";
+
+  return "npm";
+}