@bitkyc08/opencodex 2.77.0 → 2.78.0

package/src/cli/system-restart-client.ts

@@ -26,6 +26,8 @@ import {
 import type { ProxyRestartRequestOutcome } from "./tray-proxy";
 import { packageVersion } from "./help";
 import { computeVersionSkew } from "./version-skew";
+import { readUpdateRestartHome } from "./update-restart-home";
+import { UpdateRestartRequired } from "./update-restart-candidate";
 
 export const SYSTEM_RESTART_REQUEST_TIMEOUT_MS = 5_000;
 export const SYSTEM_RESTART_ATTESTATION_TIMEOUT_MS = 4_000;
@@ -38,6 +40,7 @@ export interface BoundSystemRestartDeps {
   now?: () => number;
   /** Invoking CLI version for the skew guard; defaults to this bundle's package version. */
   cliVersion?: string;
+  readUpdateHome?: typeof readUpdateRestartHome;
 }
 
 function rejected(code: string): ProxyRestartRequestOutcome {
@@ -90,6 +93,8 @@ export async function requestBoundSystemRestart(
     return rejected("restart_target_runtime_mismatch");
   }
 
+  let updateHome: ReturnType<typeof readUpdateRestartHome> | undefined;
+  try { updateHome = (deps.readUpdateHome ?? readUpdateRestartHome)(); } catch { /* normal in-place restart remains available */ }
   const attestationBudget = remaining(deadlineAt, now, SYSTEM_RESTART_ATTESTATION_TIMEOUT_MS);
   if (attestationBudget <= 0) return rejected("restart_deadline_expired");
 
@@ -143,9 +148,9 @@ export async function requestBoundSystemRestart(
   const proxyVersion = fenced
     ? body.installedVersion as string
     : typeof body.version === "string" ? body.version : undefined;
-  if (computeVersionSkew(deps.cliVersion ?? ownCliVersion(), proxyVersion).skewed) {
-    return rejected("restart_version_skew");
-  }
+  const cliVersion = deps.cliVersion ?? ownCliVersion();
+  const skew = computeVersionSkew(cliVersion, proxyVersion);
+  if (skew.skewed && skew.relation !== "cli-newer") return rejected("restart_version_skew");
 
   let observed: LiveProxy | null;
   try {
@@ -154,6 +159,18 @@ export async function requestBoundSystemRestart(
     return rejected("restart_target_recheck_failed");
   }
   if (!sameRestartTarget(target, observed)) return rejected("restart_target_changed");
+  if (skew.relation === "cli-newer") {
+    if (!updateHome) return rejected("update_restart_home_unverified");
+    const current = readRuntime(target.pid);
+    if (!current || current.pid !== runtime.pid || current.port !== runtime.port
+      || current.hostname !== runtime.hostname || current.attestationSecret !== runtime.attestationSecret) {
+      return rejected("restart_target_changed");
+    }
+    return { accepted: false, uncertain: false, error: new UpdateRestartRequired({
+      target: { ...target, pid: target.pid, version: proxyVersion },
+      runtime: { ...runtime, attestationSecret: runtime.attestationSecret }, cliVersion, home: updateHome,
+    }) };
+  }
 
   const capability = createSystemRestartCapability(
     runtime.attestationSecret,

package/src/cli/system-settings-parity.ts

@@ -0,0 +1,83 @@
+import { runCatalogAction } from "./catalog-command-result";
+import { serializeManagementJson } from "./json-input";
+import { printSettingsResult, projectSettingsApply } from "./settings-result";
+import { CliUsageError, runtimeBaseUrl, runtimeRequest, takeFlag, takeOptionWithSyntax, type RuntimeApiDeps } from "./runtime-api";
+
+export const SYSTEM_PARITY_OPTIONS = ["--show-codex-credits", "--account-picker", "--main-account-hard-lock", "--ultra-fast-tier", "--fast-rows"] as const;
+const BOOLEAN_FIELDS: Readonly<Record<string, string>> = {
+  "--show-codex-credits": "showCodexCredits", "--account-picker": "codexAccountPickerEnabled",
+  "--main-account-hard-lock": "codexMainAccountHardLock", "--ultra-fast-tier": "ultraFastTier", "--fast-rows": "fastRows",
+  "--auto-start": "codexAutoStart", "--desktop-authless": "codexDesktopAuthless", "--client-compaction": "codexClientCompaction",
+};
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function boolean(raw: string, option: string): boolean {
+  if (["on", "true", "yes", "1", "enabled"].includes(raw.toLowerCase())) return true;
+  if (["off", "false", "no", "0", "disabled"].includes(raw.toLowerCase())) return false;
+  throw new CliUsageError(`${option} must be on or off`);
+}
+function desktopState(value: unknown): Record<string, unknown> | null {
+  if (!record(value) || typeof value.stored !== "boolean" || (value.effective !== null && typeof value.effective !== "boolean")
+    || (value.inertReason !== undefined && value.inertReason !== "client_role" && value.inertReason !== "non_loopback_bind_requires_admission_token")) return null;
+  return { stored: value.stored, effective: value.effective, ...(value.inertReason ? { inertReason: value.inertReason } : {}) };
+}
+
+/** New-option writes; the original no-new-option settings output remains compatible. */
+export async function handleSystemSettingsParity(argsInput: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  return runCatalogAction(async () => {
+    const args = [...argsInput], wantsJson = takeFlag(args, "--json");
+    const body: Record<string, unknown> = {};
+    for (const [option, field] of Object.entries(BOOLEAN_FIELDS)) {
+      const value = takeOptionWithSyntax(args, option)?.value;
+      if (value !== undefined) body[field] = boolean(value, option);
+    }
+    const mode = takeOptionWithSyntax(args, "--stream-mode")?.value;
+    if (mode !== undefined) {
+      if (!["auto", "legacy-tee", "eager-relay"].includes(mode)) throw new CliUsageError("Invalid --stream-mode");
+      body.streamMode = mode;
+    }
+    if (args.length || !Object.keys(body).length) throw new CliUsageError("Provide supported system setting options and optional --json");
+    const pinned = { ...deps, baseUrl: await runtimeBaseUrl(deps) };
+    const response = await runtimeRequest("/api/settings", { method: "PUT", redirect: "error", body: serializeManagementJson(body) }, pinned);
+    if (!record(response) || response.ok !== true) throw new Error("Invalid settings receipt");
+    const observed: Record<string, unknown> = {};
+    const unverified: string[] = [];
+    for (const [key, requested] of Object.entries(body)) {
+      if (key === "ultraFastTier") continue;
+      const actual = response[key];
+      if (typeof actual === typeof requested && (key !== "streamMode" || ["auto", "legacy-tee", "eager-relay"].includes(actual as string))) observed[key] = actual;
+      if (actual !== requested) unverified.push(key);
+    }
+    if (Object.hasOwn(body, "ultraFastTier")) {
+      try {
+        const readBack = await runtimeRequest("/api/settings", { redirect: "error" }, pinned);
+        if (record(readBack) && typeof readBack.ultraFastTier === "boolean") observed.ultraFastTier = readBack.ultraFastTier;
+      } catch { /* Acceptance already happened; retain safe unknown verification, not raw error. */ }
+      if (observed.ultraFastTier !== body.ultraFastTier) unverified.push("ultraFastTier");
+    }
+    const data: Record<string, unknown> = { ok: true, settings: observed };
+    let nativePending = false;
+    if (Object.hasOwn(body, "codexDesktopAuthless") || Object.hasOwn(body, "codexClientCompaction")) {
+      const switches = record(response.codexDesktopSwitches) ? response.codexDesktopSwitches : {};
+      const report: Record<string, unknown> = {};
+      for (const key of ["codexDesktopAuthless", "codexClientCompaction"]) {
+        if (!Object.hasOwn(body, key)) continue;
+        const state = desktopState(switches[key]);
+        if (state) report[key] = state; else unverified.push(`${key}.effective`);
+      }
+      const apply = projectSettingsApply(switches.apply);
+      if (apply) {
+        report.apply = apply;
+        nativePending = !apply.applied && apply.reason !== "not_requested";
+      } else unverified.push("desktopApply");
+      data.desktop = report;
+    }
+    if (unverified.length) { data.verification = "unverified"; data.unverifiedFields = unverified; }
+    const lines = ["System settings accepted.", ...Object.entries(observed).map(([key, value]) => `${key}: ${value}`)];
+    if (unverified.length) lines.push(`Read-back is unverified for: ${unverified.join(", ")}.`);
+    if (nativePending) lines.push("Native client application is deferred or refused; the settings remain saved.");
+    const pendingCode = printSettingsResult(data, response.catalogRefreshPending, wantsJson, lines);
+    return unverified.length || nativePending ? 1 : pendingCode;
+  });
+}

package/src/cli/update-restart-candidate.ts

@@ -0,0 +1,21 @@
+import type { RuntimePortState } from "../config/process-state";
+import type { LiveProxy } from "../server/proxy-liveness";
+
+import type { UpdateRestartHome } from "./update-restart-home";
+
+export interface UpdateRestartCandidate {
+  home: UpdateRestartHome;
+  target: LiveProxy & { pid: number };
+  runtime: RuntimePortState & { attestationSecret: string };
+  cliVersion: string;
+}
+
+/** Private in-process evidence; diagnostics and JSON never expose the proof key. */
+export class UpdateRestartRequired extends Error {
+  #candidate: UpdateRestartCandidate;
+  constructor(candidate: UpdateRestartCandidate) {
+    super("restart_version_skew_cli_newer");
+    this.#candidate = candidate;
+  }
+  candidate(): UpdateRestartCandidate { return this.#candidate; }
+}

package/src/cli/update-restart-child.ts

@@ -0,0 +1,81 @@
+import { existsSync } from "node:fs";
+import { getRuntimePortPath, readRuntimePort } from "../config/process-state";
+import { packageVersion } from "../lib/package-version";
+import { parseStrictSemver } from "../lib/strict-semver";
+import { acquireOwnershipMutationLease, OWNERSHIP_MUTATION_LEASE_TOKEN_ENV } from "../service/ownership-mutation-lease.mjs";
+import { serviceStatePaths } from "../service/state";
+import { assertUpdateRestartConfiguration, assertUpdateRestartHome, type UpdateRestartHome } from "./update-restart-home";
+
+export const UPDATE_RESTART_CHILD_ENV = "OCX_UPDATE_RESTART_CHILD";
+export interface UpdateRestartChildMarker { home: UpdateRestartHome; version: string; port: number; hostname: string; deadlineAt: number }
+export interface UpdateRestartChildGuard { check(port?: number, hostname?: string): void; complete(): void }
+
+function parseMarker(raw: string): UpdateRestartChildMarker {
+  if (raw.length > 8192) throw new Error("update_restart_child_marker_invalid");
+  const value = JSON.parse(raw) as UpdateRestartChildMarker;
+  if (!value || !Number.isSafeInteger(value.deadlineAt) || !Number.isInteger(value.port)
+    || typeof value.hostname !== "string" || value.port < 1 || value.port > 65535 || typeof value.version !== "string"
+    || value.version === "0.0.0" || !parseStrictSemver(value.version) || !value.home
+    || !Number.isSafeInteger(value.home.revision)) throw new Error("update_restart_child_marker_invalid");
+  for (const directory of [value.home.config, value.home.codex]) {
+    if (!directory || typeof directory.path !== "string" || !directory.path
+      || !Number.isSafeInteger(directory.dev) || !Number.isSafeInteger(directory.ino)) {
+      throw new Error("update_restart_child_marker_invalid");
+    }
+  }
+  return value;
+}
+
+export interface UpdateRestartChildIo {
+  env?: NodeJS.ProcessEnv;
+  now?: () => number;
+  version?: () => string;
+  checkHome?: (home: UpdateRestartHome) => void;
+  acquire?: (waitMs: number) => { release(): void };
+  onExit?: (release: () => void) => void;
+  checkState?: (marker: UpdateRestartChildMarker) => void;
+  armDeadline?: (remainingMs: number) => () => void;
+}
+
+/** Admit the replacement before CLI preflight; custody belongs to this child PID. */
+export function admitUpdateRestartChild(argv: string[], io: UpdateRestartChildIo = {}): UpdateRestartChildGuard | undefined {
+  const env = io.env ?? process.env;
+  const raw = env[UPDATE_RESTART_CHILD_ENV];
+  if (raw === undefined) return undefined;
+  delete env[UPDATE_RESTART_CHILD_ENV];
+  delete env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV];
+  const marker = parseMarker(raw);
+  if (argv.length !== 3 || argv[0] !== "start" || argv[1] !== "--port" || argv[2] !== String(marker.port)) {
+    throw new Error("update_restart_child_command_changed");
+  }
+  const now = io.now ?? Date.now;
+  const check = (port = marker.port, hostname = marker.hostname) => {
+    if (now() >= marker.deadlineAt) throw new Error("update_restart_deadline_expired");
+    const bindHost = (host: string) => !host.trim() || /^localhost\.?$/i.test(host.trim()) ? "127.0.0.1" : host.trim();
+    if (port !== marker.port || bindHost(hostname) !== bindHost(marker.hostname) || (io.version ?? packageVersion)() !== marker.version) throw new Error("update_restart_child_identity_changed");
+    (io.checkHome ?? assertUpdateRestartHome)(marker.home);
+    (io.checkState ?? (expected => {
+      assertUpdateRestartConfiguration(expected.hostname);
+      const current = readRuntimePort();
+      if (existsSync(getRuntimePortPath()) && (!current || current.pid !== process.pid
+        || current.port !== expected.port || current.siblingOfPort !== undefined)) {
+        throw new Error("update_restart_competing_runtime");
+      }
+    }))(marker);
+  };
+  check();
+  const lease = (io.acquire ?? (waitMs => acquireOwnershipMutationLease(serviceStatePaths(), { waitMs })))(Math.min(2000, marker.deadlineAt - now()));
+  let released = false;
+  let cancelDeadline: (() => void) | undefined;
+  const release = () => { if (!released) { released = true; cancelDeadline?.(); lease.release(); } };
+  try {
+    check();
+    cancelDeadline = (io.armDeadline ?? (remainingMs => {
+      const timer = setTimeout(() => process.exit(1), remainingMs);
+      timer.unref();
+      return () => clearTimeout(timer);
+    }))(marker.deadlineAt - now());
+    (io.onExit ?? (callback => { process.once("exit", callback); }))(release);
+    return { check, complete: () => { check(); release(); } };
+  } catch (error) { release(); throw error; }
+}

package/src/cli/update-restart-home.ts

@@ -0,0 +1,38 @@
+import { realpathSync, statSync } from "node:fs";
+import { readClientConnectionState } from "../client/state";
+import { readConfigDiagnostics } from "../config/diagnostics";
+import { getConfigDir } from "../config/paths";
+import { currentCodexHome, resolveServiceOwnership, resolveServiceState } from "../service/state";
+
+export interface UpdateRestartHome {
+  config: { path: string; dev: number; ino: number };
+  codex: { path: string; dev: number; ino: number };
+  revision: number;
+}
+
+function physicalDirectory(path: string): UpdateRestartHome["config"] {
+  const canonical = realpathSync.native(path);
+  const stat = statSync(canonical);
+  if (!stat.isDirectory()) throw new Error("update_restart_home_unverified");
+  return { path: canonical, dev: stat.dev, ino: stat.ino };
+}
+
+/** Only an unclaimed standalone home is eligible for this narrow update path. */
+export function readUpdateRestartHome(): UpdateRestartHome {
+  const state = resolveServiceState();
+  const owner = resolveServiceOwnership();
+  if (state.kind !== "none" || owner.kind !== "none") throw new Error("update_restart_owner_unverified");
+  return { config: physicalDirectory(getConfigDir()), codex: physicalDirectory(currentCodexHome()), revision: owner.revision };
+}
+
+export function assertUpdateRestartHome(expected: UpdateRestartHome): void {
+  const current = readUpdateRestartHome();
+  if (JSON.stringify(current) !== JSON.stringify(expected)) throw new Error("update_restart_home_changed");
+}
+
+/** Read-only eligibility shared by parent pre-stop and child admission. */
+export function assertUpdateRestartConfiguration(hostname: string): void {
+  const diagnostics = readConfigDiagnostics();
+  if (readClientConnectionState().kind !== "disconnected" || diagnostics.error
+    || (diagnostics.config.hostname ?? "") !== hostname) throw new Error("update_restart_configuration_changed");
+}

package/src/cli/update-restart-transport.ts

@@ -0,0 +1,193 @@
+import { Agent, request, type ClientRequest, type IncomingMessage } from "node:http";
+import { connect, type Socket } from "node:net";
+import type { Duplex } from "node:stream";
+import {
+  LOCAL_ATTESTATION_CHALLENGE_HEADER,
+  LOCAL_ATTESTATION_PROOF_HEADER,
+  createLocalAttestationChallenge,
+  isLocalAttestationSecret,
+  verifyLocalAttestationProof,
+} from "../lib/local-management-attestation";
+import { SYSTEM_RESTART_CAPABILITY_VERSION } from "../lib/system-restart-contract";
+import { isOpencodexHealthz, probeHostname, type LiveProxy } from "../server/proxy-liveness";
+import { computeVersionSkew } from "./version-skew";
+
+const FAILURE = "update_restart_stop_failed";
+const MAX_RESPONSE_BYTES = 64 * 1024;
+
+/** This agent owns exactly one direct TCP connection, including on Bun's HTTP layer. */
+class AttestedAgent extends Agent {
+  socket?: Socket;
+  private connected = false;
+
+  constructor(private readonly hostname: string, private readonly port: number) {
+    super({ keepAlive: true, maxSockets: 1, maxTotalSockets: 1, maxFreeSockets: 1 });
+  }
+
+  override createConnection(
+    _options: unknown,
+    callback?: (error: Error | null, stream: Duplex) => void,
+  ): Socket | undefined {
+    if (this.connected) {
+      // Returning no socket with an error also refuses queued reconnect attempts.
+      callback?.(new Error(FAILURE), this.socket!);
+      return undefined;
+    }
+    this.connected = true;
+    this.socket = connect({ host: this.hostname, port: this.port, autoSelectFamily: false });
+    return this.socket;
+  }
+}
+
+function checkDeadline(deadlineAt: number): void {
+  if (!Number.isFinite(deadlineAt) || Date.now() >= deadlineAt) throw new Error(FAILURE);
+}
+
+function readJson(response: IncomingMessage): Promise<Record<string, unknown>> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    let size = 0;
+    const fail = () => { reject(new Error(FAILURE)); response.destroy(); };
+    response.on("error", fail);
+    response.on("aborted", fail);
+    response.on("data", (chunk: Buffer) => {
+      size += chunk.length;
+      if (size > MAX_RESPONSE_BYTES) { fail(); return; }
+      chunks.push(chunk);
+    });
+    response.on("end", () => {
+      try {
+        const value: unknown = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!response.complete || value === null || typeof value !== "object" || Array.isArray(value)) {
+          throw new Error(FAILURE);
+        }
+        resolve(value as Record<string, unknown>);
+      } catch { reject(new Error(FAILURE)); }
+    });
+  });
+}
+
+type AttestedTarget = { target: LiveProxy & { pid: number }; secret: string; deadlineAt: number };
+type JsonReply = { response: IncomingMessage; body: Record<string, unknown> };
+
+class AttestedSession {
+  readonly agent: AttestedAgent;
+  readonly challenge = createLocalAttestationChallenge();
+  private readonly hostname: string;
+  private readonly timer: ReturnType<typeof setTimeout>;
+  private current?: ClientRequest;
+
+  constructor(private readonly options: AttestedTarget) {
+    const { target, secret, deadlineAt } = options;
+    checkDeadline(deadlineAt);
+    if (target.source !== "runtime" || target.role !== undefined || target.packageTreeFenced
+      || !Number.isSafeInteger(target.pid) || target.pid <= 0
+      || !Number.isInteger(target.port) || target.port < 1 || target.port > 65535
+      || !isLocalAttestationSecret(secret)) throw new Error(FAILURE);
+    const host = probeHostname(target.hostname);
+    this.hostname = host.startsWith("[") ? host.slice(1, -1) : host;
+    this.agent = new AttestedAgent(this.hostname, target.port);
+    this.timer = setTimeout(() => {
+      this.current?.destroy(new Error(FAILURE));
+      this.agent.socket?.destroy(new Error(FAILURE));
+    }, Math.min(deadlineAt - Date.now(), 2_147_483_647));
+  }
+
+  exchange(adminToken?: string): Promise<JsonReply> {
+    const stop = adminToken !== undefined;
+    return new Promise((resolve, reject) => {
+      const req = request({
+        hostname: this.hostname, port: this.options.target.port, agent: this.agent,
+        method: stop ? "POST" : "GET", path: stop ? "/api/stop" : "/healthz",
+        maxHeaderSize: MAX_RESPONSE_BYTES,
+        headers: stop ? { "content-length": "0" } : { [LOCAL_ATTESTATION_CHALLENGE_HEADER]: this.challenge },
+      });
+      this.current = req;
+      req.on("error", reject);
+      req.on("response", response => {
+        readJson(response).then(body => resolve({ response, body }), reject);
+      });
+      req.once("socket", (socket: Socket) => {
+        try {
+          checkDeadline(this.options.deadlineAt);
+          if (socket !== this.agent.socket || socket.destroyed || !socket.writable
+            || (stop && (socket.connecting || socket.readableEnded || socket.writableEnded))) {
+            throw new Error(FAILURE);
+          }
+          // No end/flushHeaders/write, or credential header, before this socket check.
+          if (adminToken !== undefined) req.setHeader("X-OpenCodex-API-Key", adminToken);
+          req.end();
+        } catch { req.destroy(new Error(FAILURE)); }
+      });
+    });
+  }
+
+  validateHealth(health: JsonReply): void {
+    const { target, secret, deadlineAt } = this.options;
+    const proof = health.response.headers[LOCAL_ATTESTATION_PROOF_HEADER];
+    checkDeadline(deadlineAt);
+    if (health.response.statusCode !== 200 || !isOpencodexHealthz(health.body)
+      || health.body.status !== "ok" || health.body.role !== undefined
+      || health.body.pid !== target.pid || health.body.port !== target.port
+      || !verifyLocalAttestationProof(secret, this.challenge, target.pid, target.port, typeof proof === "string" ? proof : null)) {
+      throw new Error(FAILURE);
+    }
+  }
+
+  close(): void {
+    clearTimeout(this.timer);
+    this.current?.destroy();
+    this.agent.destroy();
+    this.agent.socket?.destroy();
+  }
+}
+
+/** Proof and credential delivery must remain on one established channel; never retry. */
+export async function stopAttestedUpdateTarget(options: AttestedTarget & {
+  cliVersion: string;
+  beforeStop: () => void;
+  adminToken: string;
+}): Promise<void> {
+  let session: AttestedSession | undefined;
+  try {
+    const { cliVersion, deadlineAt, beforeStop, adminToken } = options;
+    if (!adminToken) throw new Error(FAILURE);
+    session = new AttestedSession(options);
+    const health = await session.exchange();
+    session.validateHealth(health);
+    if (health.body.restartCapability !== SYSTEM_RESTART_CAPABILITY_VERSION
+      || computeVersionSkew(cliVersion, typeof health.body.version === "string" ? health.body.version : undefined).relation !== "cli-newer"
+      || /\bclose\b/i.test(health.response.headers.connection ?? "")) throw new Error(FAILURE);
+    checkDeadline(deadlineAt);
+    beforeStop();
+    // Synchronous candidate revalidation and POST enqueue: no intervening await.
+    const stopped = await session.exchange(adminToken);
+    checkDeadline(deadlineAt);
+    if (stopped.response.statusCode !== 200 || stopped.body.success !== true
+      || stopped.body.sharedTeardown !== "performed") throw new Error(FAILURE);
+  } catch {
+    // Never expose parser/network/callback errors (which may contain credentials).
+    throw new Error(FAILURE);
+  } finally {
+    session?.close();
+  }
+}
+
+/** Observe only the caller's exact newly started runtime; ordinary liveness is not proof. */
+export async function observeAttestedUpdateReplacement(options: AttestedTarget & {
+  version: string;
+}): Promise<LiveProxy> {
+  let session: AttestedSession | undefined;
+  try {
+    session = new AttestedSession(options);
+    const health = await session.exchange();
+    session.validateHealth(health);
+    if (health.body.version !== options.version) throw new Error(FAILURE);
+    return { pid: options.target.pid, port: options.target.port, hostname: options.target.hostname,
+      source: "runtime", version: options.version };
+  } catch {
+    throw new Error("update_restart_replacement_observation_failed");
+  } finally {
+    session?.close();
+  }
+}