@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/update/index.ts

@@ -17,13 +17,10 @@ import { unprivilegedOwnershipMutationEnvironment } from "../service/ownership-m
 import { withUpdateOwnershipLease, readUpdateRuntimeTarget } from "./ownership-transaction";
 import { npmInvocation } from "./npm-invocation.mjs";
 import { pnpmInvocation, pnpmInvocationForPath, resolvePnpmCommands } from "./pnpm-invocation.mjs";
-import {
-  detectInstallFromPath,
-  detectInstallOwnershipFromPath,
-} from "./install-detection.mjs";
+import { detectInstallOwnershipFromPath } from "./install-detection.mjs";
 import type {
   DetectedInstall,
-  InstallOwnership,
+  InstallOwnership as PackageInstallOwnership,
   MiseInstallOwner,
 } from "./install-detection.d.mts";
 import {
@@ -42,8 +39,13 @@ import { handoffWindowsTrayForUpdate, planWindowsTrayUpdate } from "./tray-updat
 import { withProcessRuntimeProvenance } from "../lib/bun-runtime";
 import { withoutSiblingMarker } from "../codex/sibling-start";
 import { packageVersion } from "../lib/package-version";
+import { isStandaloneModuleUrl } from "../lib/standalone";
 import { selfLaunchArgv } from "../lib/self-launch-argv";
 import { PNPM_READ_CWD, withPnpmCommandCwd, pnpmReadEnvironment } from "./pnpm-read-policy.mjs";
+import {
+  freshServingPid, hasRestartableServiceManager, readParentPid, readServiceManagerPid, restartServiceManagerJob,
+  supervisionVerdict, unsettledManagerWarning, unsupervisedRuntimeWarning,
+} from "./supervised-recovery.mjs";
 
 /**
  * A `codex-history-backup-*.json` surviving a stop means the native-history restore was
@@ -62,18 +64,21 @@ export function historyRestoreIncomplete(configDir = getConfigDir()): boolean {
 export const PKG = "@bitkyc08/opencodex";
 const HERE = dirname(fileURLToPath(import.meta.url)); // .../opencodex/src/update
 
-export type Installer = DetectedInstall;
+export type Installer = DetectedInstall | "standalone";
+export const STANDALONE_UPDATE_HINT = "Update via OpenCodex Desktop (Check for Updates…) or reinstall the standalone binary from GitHub Releases.";
 export type Channel = "latest" | "preview";
-export type { InstallOwnership, MiseInstallOwner };
+export type InstallOwnership = PackageInstallOwnership | { installer: "standalone" };
+export type { MiseInstallOwner };
 
 /** Infer how opencodex is installed from the running module's path. */
-export function detectInstall(): Installer {
-  return detectInstallFromPath(HERE, { exists: existsSync });
+export function detectInstall(moduleUrl = import.meta.url): Installer {
+  return detectInstallOwnership(moduleUrl).installer;
 }
 
 /** Resolve installer ownership and verified mise update guidance for this package. */
-export function detectInstallOwnership(): InstallOwnership {
-  return detectInstallOwnershipFromPath(HERE, { exists: existsSync });
+export function detectInstallOwnership(moduleUrl = import.meta.url): InstallOwnership {
+  if (isStandaloneModuleUrl(moduleUrl)) return { installer: "standalone" };
+  return detectInstallOwnershipFromPath(dirname(fileURLToPath(moduleUrl)), { exists: existsSync });
 }
 
 export function miseUpdateCommand(
@@ -234,6 +239,7 @@ export function registrySpawnTarget(
   args: readonly string[],
   owner?: PnpmGlobalOwner,
 ): SpawnTarget | null {
+  if (installer === "standalone") return null;
   // A pnpm command without an owner would silently fall back to the first PATH
   // candidate. That is unsafe when multiple PNPM_HOME installations expose the
   // same version, so registry queries use the same hard binding as mutation.
@@ -310,6 +316,7 @@ export function latestVersion(
 
 /** The global-install command opencodex would run to update on this channel. */
 export function updateCommand(installer: Installer, tag: Channel, resolvedVersion?: string | null): { bin: string; args: string[] } {
+  if (installer === "standalone") throw new Error(STANDALONE_UPDATE_HINT);
   if (installer === "mise") {
     throw new Error("mise-owned installations must be upgraded through mise");
   }
@@ -427,6 +434,12 @@ export async function runUpdate(): Promise<void> {
     return;
   }
 
+  if (installer === "standalone") {
+    console.error(STANDALONE_UPDATE_HINT);
+    process.exitCode = 1;
+    return;
+  }
+
   if (installer === "source") {
     console.log("Running from a source checkout — update with:  git pull && bun install");
     return;
@@ -551,7 +564,8 @@ export async function runUpdate(): Promise<void> {
     return before?.owner === after?.owner && before?.installId === after?.installId
       && before?.consentGeneration === after?.consentGeneration;
   };
-  const startProxyDirectly = async (): Promise<boolean> => {
+  /** `"vetoed"`: another owner holds the runtime, so not starting is the correct outcome. */
+  const startProxyDirectly = async (): Promise<boolean | "vetoed"> => {
     const ownership = await resolvedRuntimeOwnership();
     const supervision = observeSupervision();
     const plan = planUpdateRuntimeHandling({ ...ownership, serviceInstalled: false, supervision });
@@ -559,7 +573,7 @@ export async function runUpdate(): Promise<void> {
       console.warn(supervision
         ? "OpenCodex Desktop supervises the proxy; no CLI runtime was restored."
         : plan.notice);
-      return false;
+      return "vetoed";
     }
     if (!postUpdateLauncherUsable || !existsSync(postUpdateLauncher)) return false;
     // An ordinary owner: a stray sibling marker would otherwise mark it before any probe.
@@ -582,6 +596,51 @@ export async function runUpdate(): Promise<void> {
     console.warn("⚠️  Recovery did not report a healthy proxy before its deadline; run 'ocx service repair' or 'ocx start'.");
     return false;
   };
+  // #7043: before any detached start, ask launchd/systemd to restart the job it already holds,
+  // and count it only when the serving proxy is that job. Runs unleased: the manager's child
+  // cannot join this lease (#5760). `"unsettled"` means the manager may still finish the restart,
+  // so no competing proxy may be started.
+  const restartThroughServiceManager = async (): Promise<"supervised" | "failed" | "unsettled"> => {
+    if (!hasRestartableServiceManager()) return "failed";
+    console.log("🔁 Asking the service manager to restart the background service...");
+    const before = readUpdateRuntimeTarget(getRuntimePortPath(), capturedListen.hostname);
+    const staleRecordPid = before.kind === "target" ? before.target.pid : null;
+    const restarted = restartServiceManagerJob();
+    const unsettled = !restarted.ok && restarted.unsettled === true;
+    let verdict: ReturnType<typeof supervisionVerdict> | { kind: "failed"; reason: string };
+    if (!restarted.ok && !unsettled) {
+      verdict = { kind: "failed", reason: restarted.reason };
+    } else {
+      let servingPid: number | null = null;
+      const deadline = Date.now() + 30_000;
+      while (servingPid === null && Date.now() < deadline) {
+        const current = readUpdateRuntimeTarget(getRuntimePortPath(), capturedListen.hostname);
+        if (current.kind === "target" && current.target.port === capturedListen.port
+          && freshServingPid(current.target.pid, staleRecordPid) !== null
+          && await proxyIdentityAt(current.target.port, { hostname: current.target.hostname, expectedPid: current.target.pid },
+            { timeoutMs: 1500, deadlineAt: deadline, attempts: 1 })) servingPid = current.target.pid;
+        else await Bun.sleep(Math.min(100, Math.max(0, deadline - Date.now())));
+      }
+      verdict = supervisionVerdict({ servingPid, managerPid: readServiceManagerPid(), parentPid: pid => readParentPid(pid) });
+    }
+    if (verdict.kind === "supervised") {
+      console.log(`✅ Proxy is healthy on port ${capturedListen.port} under the service manager (pid ${verdict.managerPid}).`);
+      return "supervised";
+    }
+    if (unsettled) {
+      console.warn(unsettledManagerWarning(capturedListen.port));
+      return "unsettled";
+    }
+    console.warn(`⚠️  The service manager did not recover a supervised proxy: ${verdict.reason}.`);
+    return "failed";
+  };
+  /** Direct start as the last resort for a managed install: never reported as full recovery. */
+  const startUnsupervisedFallback = async (): Promise<"vetoed" | "started" | "failed"> => {
+    const started = await startProxyDirectly();
+    if (started === "vetoed") return "vetoed";
+    if (started) console.warn(unsupervisedRuntimeWarning(capturedListen.port));
+    return started ? "started" : "failed";
+  };
   const recoverStoppedRuntime = async (reason: string): Promise<void> => {
     try {
       const planRecovery = async () => {
@@ -617,6 +676,12 @@ export async function runUpdate(): Promise<void> {
           env: mutation.controlEnvironment({ ...process.env, OCX_BAKE_PORT: String(capturedListen.port) }),
         });
         if (service.status !== 0 || !isServiceViable()) {
+          // Ownership may have moved while the refresh ran unleased; only a recovery plan that
+          // still names the service may restart the manager's job.
+          if ((await planRecovery()).action === "service") {
+            const managed = await restartThroughServiceManager();
+            if (managed !== "failed") return;
+          }
           // The refresh ran unleased; a claim could have landed meanwhile, so take
           // the lease back before re-reading ownership and authorizing a direct start.
           mutation.reacquire();
@@ -626,7 +691,7 @@ export async function runUpdate(): Promise<void> {
             liveness: currentPackageRuntimeLiveness(), serviceInstalled: false,
             launcherUsable: postUpdateLauncherUsable && existsSync(postUpdateLauncher), hadRuntimeState,
           });
-          if (fallback.action === "direct") await startProxyDirectly();
+          if (fallback.action === "direct") await startUnsupervisedFallback();
           else console.warn("⚠️  Service recovery was not confirmed; no second proxy was started.");
         }
       } else if (recovery.action === "direct") {
@@ -902,6 +967,12 @@ export async function runUpdate(): Promise<void> {
           }
         }
         if (!serviceRefreshed || !serviceViable) {
+          // #7043: the manager first. Only a proxy it owns counts as recovered; everything
+          // below this line leaves an unsupervised runtime and exits non-zero.
+          if (!await mayRefresh()) return;
+          const managed = await restartThroughServiceManager();
+          if (managed === "supervised") return;
+          if (managed === "unsettled") return 1;
           // Repair normally avoids elevation for a healthy scheduler task, but a stale
           // definition may require guarded create/elevation. It can also fail — or exit 0
           // while leaving stale/missing assets that never start
@@ -956,7 +1027,9 @@ export async function runUpdate(): Promise<void> {
             console.warn(process.platform === "win32"
               ? "   Run 'ocx service repair' to refresh the background service."
               : "   Run 'ocx service repair' to refresh the background service and see why it failed.");
-            if (await startProxyDirectly()) console.log(`✅ Proxy is healthy on port ${capturedListen.port}.`);
+            // An ownership veto is the correct outcome, not a degraded one.
+            if (await startUnsupervisedFallback() === "vetoed") return;
+            return 1;
           }
         }
       } finally {

package/src/update/job-supervised-restart.ts

@@ -0,0 +1,107 @@
+import { readRuntimePort } from "../config/process-state";
+import { proxyIdentityAt } from "../server/proxy-liveness";
+import {
+  freshServingPid, hasRestartableServiceManager, readParentPid, readServiceManagerPid, restartServiceManagerJob,
+  supervisionVerdict, unsettledManagerWarning, unsupervisedRuntimeWarning,
+} from "./supervised-recovery.mjs";
+
+/**
+ * Manager-first recovery for the dashboard update worker (#7043), the `src/update/job.ts` side of
+ * what #7074 did for `ocx update`. When the post-update service refresh fails, is not viable, or
+ * never serves, the worker asks launchd/systemd to restart the job it already holds before any
+ * detached `ocx start`, and counts it only when the serving proxy is that job. It lives beside the
+ * worker because `src/update/job.ts` sits at the repository's size cap.
+ */
+export type ManagerRestartOutcome = "supervised" | "failed" | "unsettled";
+
+export interface ManagerRestartDeps {
+  hasManager?: () => boolean;
+  restartJob?: () => { ok: true } | { ok: false; reason: string; unsettled?: true };
+  managerPid?: () => number | null;
+  parentPid?: (pid: number) => number | null;
+  readRecord?: () => { pid: number; port: number; hostname?: string } | null;
+  probeServing?: (port: number, hostname: string, pid: number, deadlineAt: number) => Promise<boolean>;
+  now?: () => number;
+  sleepMs?: (ms: number) => Promise<void>;
+  deadlineMs?: number;
+}
+
+export type ManagerRestartFn = (
+  target: { port: number; hostname: string; release?: () => void },
+  log: (line: string) => void,
+) => Promise<ManagerRestartOutcome>;
+
+/**
+ * Ask the manager to restart its job and prove the serving proxy is that job. Never throws.
+ * `release` frees the update lease first: the manager's child cannot join it (#5760), and the
+ * worker reaches this point without a release when it skipped the service repair.
+ */
+export async function restartServiceManagerAfterUpdate(
+  target: { port: number; hostname: string; release?: () => void },
+  log: (line: string) => void,
+  deps: ManagerRestartDeps = {},
+): Promise<ManagerRestartOutcome> {
+  if (!(deps.hasManager ?? hasRestartableServiceManager)()) return "failed";
+  target.release?.();
+  log("Asking the service manager to restart the background service...");
+  const readRecord = deps.readRecord ?? (() => readRuntimePort());
+  const probe = deps.probeServing ?? (async (port: number, hostname: string, pid: number, deadlineAt: number) => (
+    !!(await proxyIdentityAt(port, { hostname, expectedPid: pid }, { timeoutMs: 1500, deadlineAt, attempts: 1 }))
+  ));
+  const now = deps.now ?? (() => Date.now());
+  const sleep = deps.sleepMs ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)));
+  const staleRecordPid = readRecord()?.pid ?? null;
+  const restarted = (deps.restartJob ?? restartServiceManagerJob)();
+  const unsettled = !restarted.ok && restarted.unsettled === true;
+  let verdict: ReturnType<typeof supervisionVerdict>;
+  if (!restarted.ok && !unsettled) {
+    // The refusal reason is the manager's stderr: external text, so it never reaches the persisted job.
+    verdict = { kind: "failed", reason: "the service manager refused the restart" };
+  } else {
+    let servingPid: number | null = null;
+    const deadline = now() + (deps.deadlineMs ?? 30_000);
+    while (servingPid === null && now() < deadline) {
+      const current = readRecord();
+      if (current && current.port === target.port && freshServingPid(current.pid, staleRecordPid) !== null
+        && await probe(current.port, current.hostname ?? target.hostname, current.pid, deadline)) servingPid = current.pid;
+      else await sleep(Math.min(100, Math.max(0, deadline - now())));
+    }
+    verdict = supervisionVerdict({
+      servingPid,
+      managerPid: (deps.managerPid ?? readServiceManagerPid)(),
+      parentPid: deps.parentPid ?? (pid => readParentPid(pid)),
+    });
+  }
+  if (verdict.kind === "supervised") {
+    log(`Proxy is healthy on port ${target.port} under the service manager (pid ${verdict.managerPid}).`);
+    return "supervised";
+  }
+  if (unsettled) return "unsettled";
+  log(`The service manager did not recover a supervised proxy: ${verdict.reason}.`);
+  return "failed";
+}
+
+/** Job patch and log line when the manager may still finish its restart: no second proxy is started. */
+export function unsettledManagerRestartFailure(port: number) {
+  const patch = {
+    status: "failed" as const,
+    restarted: false,
+    error: "the service manager did not finish restarting the proxy; no second proxy was started",
+  };
+  return [patch, oneLine(unsettledManagerWarning(port))] as const;
+}
+
+/** Job patch and log line when only a detached fallback ran for a service-managed install. */
+export function unsupervisedRestartFailure(port: number) {
+  const patch = {
+    status: "failed" as const,
+    restarted: false,
+    error: `the proxy on port ${port} is running UNSUPERVISED after the update; run 'ocx service repair'`,
+  };
+  return [patch, oneLine(unsupervisedRuntimeWarning(port))] as const;
+}
+
+/** The job store withholds multi-line text as possible vendor output, so join the shared warning. */
+function oneLine(text: string): string {
+  return text.split("\n").map(line => line.trim()).join(" ");
+}

package/src/update/job.ts

@@ -2,18 +2,8 @@ import { spawn, spawnSync, type ChildProcess } from "node:child_process";
 import { existsSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
 import { dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import {
-  atomicWriteFile,
-  getConfigDir,
-  loadConfig,
-} from "../config";
-import {
-  readPid,
-  readRuntimePort,
-  removePid,
-  removeRuntimePort,
-  verifyPidIdentity,
-} from "../config/process-state";
+import { atomicWriteFile, getConfigDir, loadConfig } from "../config";
+import { readPid, readRuntimePort, removePid, removeRuntimePort, verifyPidIdentity } from "../config/process-state";
 import { isProcessAlive, killProxy } from "../lib/process-control";
 import { selfLaunchArgv } from "../lib/self-launch-argv";
 import { killWindowsSchedulerWrappers } from "../lib/windows-service-wrappers";
@@ -33,9 +23,10 @@ import {
 } from "../server/proxy-liveness";
 import { isServiceInstalled, isServiceViable, readServiceBackend, stopWindows } from "../service";
 import { runUpdateRestartWithOwnershipLease, type ServiceOwnershipResolution } from "./restart-ownership";
+import { restartServiceManagerAfterUpdate, unsettledManagerRestartFailure, unsupervisedRestartFailure, type ManagerRestartFn } from "./job-supervised-restart";
 import {
   type Channel, type Installer,
-  PKG,
+  PKG, STANDALONE_UPDATE_HINT,
   checkUpdatePackageIntegrity,
   currentVersion,
   defaultUpdateTag,
@@ -492,17 +483,17 @@ export function checkForUpdate(
   const ownership = deps.detectInstallOwnership?.();
   const installer = ownership?.installer ?? deps.detectInstall();
   const channel = requestedChannel ?? normalizeUpdateChannel(null, current);
-  const latest = installer === "source" ? null : deps.latestVersion(channel);
+  const latest = installer === "source" || installer === "standalone" ? null : deps.latestVersion(channel);
   const updateAvailable = !!latest && isNewer(latest, current, channel);
   let reason: string | undefined;
-  let command = installer === "source"
+  let command = installer === "standalone" ? STANDALONE_UPDATE_HINT : installer === "source"
     ? manualSourceCommand()
     : installer === "mise"
       ? (ownership && deps.miseUpdateCommand?.(ownership)) ?? ""
       : updateExecutionCommand(installer, channel).display;
 
-  if (installer === "source") {
-    reason = "source_checkout";
+  if (installer === "source" || installer === "standalone") {
+    reason = installer === "source" ? "source_checkout" : "standalone_install";
   } else if (installer === "mise") {
     reason = command ? "externally_managed" : "external_ownership_invalid";
   } else if (!latest) {
@@ -517,7 +508,7 @@ export function checkForUpdate(
     channel,
     installer,
     updateAvailable,
-    canUpdate: installer !== "source" && installer !== "mise" && updateAvailable,
+    canUpdate: installer !== "source" && installer !== "standalone" && installer !== "mise" && updateAvailable,
     command,
     releaseNotesUrl: RELEASE_NOTES_URL,
     ...(reason ? { reason } : {}),
@@ -1005,6 +996,7 @@ export interface RestartIo {
   releaseForServiceManagerFn?: () => void;
   /** Re-acquire the lease for the direct-start fallthrough, then re-run the veto; a notice stops the restart. */
   reacquireForDirectStartFn?: () => { readonly notice: string; readonly failed: boolean } | null;
+  restartServiceManagerFn?: ManagerRestartFn; // launchd/systemd restart before a managed direct fallback (#7043)
   probeProxy?: (port: number, hostname?: string) => Promise<boolean>;
   /** Richer /healthz read for update-correlated restart evidence (pid + version). */
   probeProxyIdentity?: (port: number, hostname?: string) => Promise<RestartProxyIdentity | null>;
@@ -1035,7 +1027,7 @@ export interface RestartIo {
     job: UpdateJobState,
     captured?: { port: number; hostname: string; oldPid?: number },
     io?: RestartIo,
-  ) => Promise<false | void>;
+  ) => Promise<false | void | "unsupervised">;
   /**
    * PIDs currently LISTENing on the captured port. Used to widen the post-update
    * kill allowlist beyond the pre-update PID (Windows often leaves a respawned
@@ -1098,7 +1090,7 @@ async function restartAfterUpdate(
   job: UpdateJobState,
   captured?: { port: number; hostname: string; oldPid?: number },
   io: RestartIo = {},
-): Promise<false | void> {
+): Promise<false | void | "unsupervised"> {
   const serviceInstalled = (io.serviceInstalledFn ?? isServiceInstalled)();
   const config = loadConfig();
   // Stop-first update already cleared pid/runtime state, so the pre-update capture is
@@ -1250,6 +1242,12 @@ async function restartAfterUpdate(
     }
   }
 
+  // #7043: a managed install asks launchd/systemd first; only the manager's own job counts as recovered.
+  const managed = !serviceInstalled ? "failed" : await (io.restartServiceManagerFn ?? restartServiceManagerAfterUpdate)(
+    { port, hostname, release: io.releaseForServiceManagerFn }, line => updateJob(job, {}, line));
+  if (managed === "supervised") return;
+  if (managed === "unsettled") { updateJob(job, ...unsettledManagerRestartFailure(port)); return false; }
+  const fallback = serviceInstalled ? "unsupervised" as const : undefined; // every exit below is unproven ownership
   // The service refresh ran outside the lease; take it back so the veto and the kills/start below stay serialized.
   const restartVeto = io.reacquireForDirectStartFn?.();
   if (restartVeto) {
@@ -1282,7 +1280,7 @@ async function restartAfterUpdate(
     );
     if (liveHolders.length > 0) {
       updateJob(job, {}, `Live holder(s) remain on port ${port}; not starting on another port. Retry 'ocx start --port ${port}'.`);
-      return;
+      return fallback;
     }
     // Dead PIDs can still own LISTEN rows. SetTcpEntry needs elevation (rc 317 on a
     // normal update worker), so poll until netstat is empty and the start runtime can bind.
@@ -1306,7 +1304,7 @@ async function restartAfterUpdate(
             + `${formatPortHolders(port, listPids, verifyOcx, directAllow)} `
             + `Retry 'ocx start --port ${port}'.`,
         );
-        return;
+        return fallback;
       }
     }
   }
@@ -1314,7 +1312,7 @@ async function restartAfterUpdate(
   // retries on missing /healthz after prepare + ghost-LISTEN clear.
   if (io.spawnStart) {
     io.spawnStart(job, job.installer, port, launcher);
-    return;
+    return fallback;
   }
   const sleep = io.sleepMs ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)));
   const probe = io.probeProxy ?? (async (p: number, host?: string) => (
@@ -1334,7 +1332,7 @@ async function restartAfterUpdate(
         {},
         `Proxy already healthy on ${hostname}:${port} at ${expectedVersion}; skipping pinned start.`,
       );
-      return;
+      return fallback;
     }
   }
   const attempts = 3;
@@ -1393,12 +1391,13 @@ async function restartAfterUpdate(
     child.once("close", retireChild);
     const healthDeadline = now() + perAttemptHealthMs;
     while (now() < healthDeadline) {
-      if (await probe(port, hostname)) return;
+      if (await probe(port, hostname)) return fallback;
       await sleep(500);
     }
   }
   // Exhausted retries: do not leave a hung pinned-start child owning the port.
   killSpawnAttempt(lastChild);
+  return fallback;
 }
 
 /** Compact listen-holder summary for update-job logs when reclaim fails. */
@@ -1454,7 +1453,7 @@ export function restartAfterUpdateForTests(
   job: UpdateJobState,
   captured: { port: number; hostname: string; oldPid?: number },
   io: RestartIo,
-): Promise<false | void> {
+): Promise<false | void | "unsupervised"> {
   return restartAfterUpdate(job, captured, io);
 }
 
@@ -1729,12 +1728,13 @@ export async function finishGuiUpdateRestart(
     }
   }
   const restartFn = io.restartAfterUpdateFn ?? restartAfterUpdate;
-  if ((await restartFn(job, captured, io)) === false) return false;
-  if (!usesNodeLauncher(installer)) {
-    // Bun/source: health alone remains enough unless a richer identity probe is supplied.
-    if (!io.probeProxyIdentity) return confirmRestartedProxy(job, captured, io);
-  }
-  return confirmPackageManagerExplicitRestart(job, captured, io);
+  const restarted = await restartFn(job, captured, io);
+  if (restarted === false) return false;
+  // Bun/source: health alone remains enough unless a richer identity probe is supplied.
+  const confirm = !usesNodeLauncher(installer) && !io.probeProxyIdentity ? confirmRestartedProxy : confirmPackageManagerExplicitRestart;
+  const confirmed = await confirm(job, captured, io);
+  if (confirmed && restarted === "unsupervised") updateJob(job, ...unsupervisedRestartFailure(captured.port)); // #7043
+  return confirmed && restarted !== "unsupervised";
 }
 
 /**

package/src/update/notify.ts

@@ -152,7 +152,7 @@ export function interactiveGuardOk(): boolean {
  */
 export function shouldConsider(): { channel: Channel; current: string } | null {
   const installer = detectInstall();
-  if (installer === "source" || installer === "mise") return null;
+  if (installer === "source" || installer === "standalone" || installer === "mise") return null;
   const current = currentVersion();
   if (current === "?" || isSourceBuildVersion(current)) return null;
   if (!interactiveGuardOk()) return null;

package/src/update/npm-invocation.mjs

@@ -95,12 +95,22 @@ export function resolveNpmCommand(
   return null;
 }
 
+function shellEnvValue(env, name) {
+  // Copying process.env loses Windows' case-insensitive property access. Keep
+  // the existing exact-key precedence; do not choose between conflicting aliases.
+  if (env[name] !== undefined) return env[name];
+  const values = new Set(Object.entries(env)
+    .filter(([key, value]) => key.toLowerCase() === name.toLowerCase() && value !== undefined)
+    .map(([, value]) => value));
+  return values.size === 1 ? values.values().next().value : undefined;
+}
+
 function systemCommandProcessor(env) {
-  const systemRoot = env.SystemRoot ?? env.windir;
+  const systemRoot = shellEnvValue(env, "SystemRoot") ?? shellEnvValue(env, "windir");
   if (systemRoot && win32.isAbsolute(systemRoot)) {
     return win32.join(systemRoot, "System32", "cmd.exe");
   }
-  const comSpec = env.ComSpec;
+  const comSpec = shellEnvValue(env, "ComSpec");
   return comSpec && win32.isAbsolute(comSpec) ? win32.resolve(comSpec) : null;
 }
 

package/src/update/refresh-scheduler.ts

@@ -53,7 +53,7 @@ export function createRefreshScheduler(deps: RefreshDeps = defaults) {
     const version = deps.current();
     const installer = deps.install();
     return !deps.disabled() && version !== "?" && !isSourceBuildVersion(version)
-      && installer !== "source" && installer !== "mise";
+      && installer !== "source" && installer !== "standalone" && installer !== "mise";
   };
   const channel = () => defaultUpdateTag(deps.current());
   const stale = (tag: Channel) => {
@@ -123,7 +123,7 @@ export function createRefreshScheduler(deps: RefreshDeps = defaults) {
     },
     async check(tag: Channel): Promise<UpdateCheckResult> {
       const installer = deps.install();
-      const latest = installer === "source" || installer === "mise" ? null : await lookup(tag, false);
+      const latest = installer === "source" || installer === "standalone" || installer === "mise" ? null : await lookup(tag, false);
       return checkForUpdate(tag, {
         currentVersion: deps.current,
         detectInstall: deps.install,

package/src/update/supervised-recovery.d.mts

@@ -0,0 +1,27 @@
+/** Declarations for the plain-ESM manager recovery shared with `bin/ocx.mjs` (#7043). */
+export type ServiceManagerRun = (file: string, args: string[]) => { ok: boolean; stdout: string; stderr: string; timedOut?: boolean };
+export interface ServiceManagerDeps {
+  platform?: NodeJS.Platform;
+  uid?: number;
+  run?: ServiceManagerRun;
+}
+export type SupervisionVerdict =
+  | { kind: "supervised"; managerPid: number; servingPid: number }
+  | { kind: "failed"; reason: string };
+export declare const LAUNCHD_SERVICE_LABEL: string;
+export declare const SYSTEMD_SERVICE_UNIT: string;
+export declare function parseLaunchdJobPid(printOutput: string): number | null;
+export declare function parseSystemdMainPid(showOutput: string): number | null;
+export declare function hasRestartableServiceManager(deps?: ServiceManagerDeps): boolean;
+export declare function restartServiceManagerJob(deps?: ServiceManagerDeps):
+  { ok: true } | { ok: false; reason: string; unsettled?: true };
+export declare function freshServingPid(recordPid: number, staleRecordPid: number | null): number | null;
+export declare function unsettledManagerWarning(port: number): string;
+export declare function readServiceManagerPid(deps?: ServiceManagerDeps): number | null;
+export declare function readParentPid(pid: number, deps?: ServiceManagerDeps): number | null;
+export declare function supervisionVerdict(input: {
+  servingPid: number | null;
+  managerPid: number | null;
+  parentPid: (pid: number) => number | null;
+}): SupervisionVerdict;
+export declare function unsupervisedRuntimeWarning(port: number): string;