@c4roa0/agentpay-user 0.3.8 → 0.3.10

package/doc/TODO.md

@@ -1,5 +1,14 @@
 # User TODO
 
+- [x] Fix switching back from setup cancelled before Wallet creation; retain stop/listener and established-data checks.
+- [ ] Deliver the fix and verify participant switch-back to the original installation.
+- [ ] Improve unconfigured installation status/info: direct to setup, not service start or missing-key recovery.
+
+- [x] Verify local official Skill files before downloading and stream update repair progress (2026-11-12; targeted checks).
+- [x] Publish local official-Skill verification and streaming update progress in User 0.3.9; tag and npm integrity verified (2026-11-12).
+
+- [x] Publish User 0.3.8 with matching v0.3.8 tag; full CI, standalone package and public registry integrity passed (2026-11-12).
+
 - [x] Recover failed service start/stop without blocking repair; incomplete target unit replacement remains protected (2026-11-12, controlled service-manager verification).
 
 - [x] Fix shared-data switch client relocation and retry without a repair deadlock; isolated selection/connection checks pass (2026-11-11).
@@ -18,13 +27,13 @@
 - [x] Implement and check storage-choice module (reuse/new/cancel); public installer selection now connects through a service-switch gate (2026-11-11).
 - [x] Connect installer selection and service-start switching with confirmation, stopped-state/listener checks and Runtime lifetime exclusion; focused checks passed (2026-11-11; systemd results simulated).
 - [x] Correct shared-directory purge, mixed-unit retry, manual setup regression, first-start preparation and startup-preference inheritance; 37 targeted checks pass (2026-11-11).
-- [ ] Verify complete switch-crash recovery and real systemd switching/login before release; preserve historical request scope across switches. Inactive maintenance isolation is implemented with scoped verification.
+- [ ] Complete remaining switch-crash recovery and desktop login acceptance; real A/B/A systemd switching passed; preserve historical request scope across switches. Inactive maintenance isolation is implemented with scoped verification.
 
 
 
 - [x] Isolated public npm fresh install, registry failure/retry and disposable-data uninstall (2026-11-11; no real systemd or financial acceptance).
 - [x] Replace existence-only locking for new operations: inherited native lock survives caller death while writers live, then permits retry. Old unknown locks require review; they are not automatically removed.
-- [ ] Publish folder-local npm uninstall completion guidance after review.
+- [x] Publish reviewed folder-local npm uninstall completion guidance in User 0.3.8.
 
 
 - [x] Participant directory-local update to User 0.3.6 / Wallet 0.3.3: running versions, original Orders in CLI/Market and available result cache verified (2026-11-11).

package/doc/usage.md

@@ -52,3 +52,11 @@ to that business example. An interrupted test retains its original request.
 [Background service guide](runbooks/local-autostart.md) explains Linux user services,
 login reminders and manual startup. A local lock or process stop does not revoke
 permission; follow [emergency stop](runbooks/emergency-payment-stop.md) when needed.
+
+### Official test Skill checks during updates
+
+Update and repair verify the official test ZIP against the version pinned by User,
+then compare its installed files. Matching local files need no download. Missing
+archives trigger a download; changed or incomplete extracted files are kept and
+reported for review. These checks do not start a payment or select a newer Skill
+from Market. Software updates display repair progress while it runs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c4roa0/agentpay-user",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "type": "module",
   "dependencies": {
     "@c4roa0/agentpay-protocol": "0.14.3",

package/progress.md

@@ -1,5 +1,40 @@
 # AgentPay User progress
 
+## Participant incomplete-setup switch — 2026-11-12
+
+Participant A-to-B setup cancellation exposed a switch-back failure: B had no
+Wallet directory, but selection required complete service settings. User 0.3.10 candidate
+allows demonstrably unconfigured B to release selection after confirmed systemd
+stop and socket checks. Existing key/Policy/connection or invalid directories still
+block missing-configuration bypass. Original participant A remains stopped until
+the corrected switch is run. Full two-running-installation acceptance is pending.
+
+## Official Skill local verification — 2026-11-12
+
+Published as `v0.3.9` at `8fbae4e`. Full GitHub behavior and standalone package
+checks passed; npm latest and archive integrity independently verified. Wallet stays
+0.3.3, Protocol 0.14.3 and official test Skill 1.2.1.
+[Release workflow](https://github.com/c4rO-0/agentpay-user/actions/runs/43162494802).
+
+User 0.3.9: update/repair verifies the release-pinned local ZIP and its extracted
+files before using the network. Matching files skip download; edited or incomplete
+extracted files are preserved with guidance. Software-update repair progress streams
+as it happens. Targeted update/package regressions passed; the actual pinned 1.2.1
+archive was installed in temporary storage and verified with network access forbidden.
+Child output streaming was checked with a real process. No live services or payments changed.
+
+## User 0.3.8 published — 2026-11-12
+
+User `0.3.8` and tag `v0.3.8` identify release commit `727e547`.
+[Publication workflow](https://github.com/c4rO-0/agentpay-user/actions/runs/43148236738)
+passed the complete behavior suite, standalone package installation and publication.
+The public npm `latest` version and archive integrity were independently verified.
+Dependencies remain Wallet 0.3.3 and Protocol 0.14.3; official test Skill remains 1.2.1.
+The release includes multiple installations with one active Runtime/Wallet pair.
+Real A/B/A switching passed; desktop login/reboot, full guided installation and
+complete interrupted-switch acceptance remain separate pending checks.
+Agent's candidate template is not published by this release.
+
 ## Real two-installation switch passed — 2026-11-12
 
 Actual user-systemd switching A → B → A passed using source and folder-local npm

package/src/installation-operation.mjs

@@ -91,7 +91,7 @@ export function installationChildOptions({env = process.env, stdio = ['ignore','
 
 // Wait for close even on timeout/error: returning on a timer while npm still writes
 // would release the caller's lock too early. Writer children retain the descriptor.
-export async function runInstallationCommand(file, args, {env = process.env, timeout = 120000, maxBuffer = 2 * 1024 * 1024, cwd} = {}) {
+export async function runInstallationCommand(file, args, {env = process.env, timeout = 120000, maxBuffer = 2 * 1024 * 1024, cwd, onStdout} = {}) {
   const {spawn} = await import('node:child_process');
   return new Promise((resolve,reject) => {
     const child = spawn(file,args,{cwd,...installationChildOptions({env})});
@@ -102,7 +102,7 @@ export async function runInstallationCommand(file, args, {env = process.env, tim
       killTimer ||= setTimeout(()=>child.kill('SIGKILL'),1000);
     };
     const timer = setTimeout(()=>stop(Error('Command timed out.')),timeout);
-    child.stdout.on('data',chunk=>{if(failure)return;stdout+=chunk;if(Buffer.byteLength(stdout)>maxBuffer)stop(Error('Command output exceeded its limit.'));});
+    child.stdout.on('data',chunk=>{if(failure)return;stdout+=chunk;if(onStdout)onStdout(chunk.toString());if(Buffer.byteLength(stdout)>maxBuffer)stop(Error('Command output exceeded its limit.'));});
     child.stderr.on('data',chunk=>{if(failure)return;stderr+=chunk;if(Buffer.byteLength(stderr)>maxBuffer)stop(Error('Command output exceeded its limit.'));});
     child.once('error',error=>{failure=error;});
     child.once('close',(code,signal)=>{

package/src/npm-update.mjs

@@ -21,12 +21,12 @@ function newer(next, current) {
   for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
   return false;
 }
-async function command(file, args, { logPath, timeout = 120000, env = process.env, cwd = process.cwd() } = {}) {
+async function command(file, args, { logPath, timeout = 120000, env = process.env, cwd = process.cwd(), onStdout } = {}) {
   try {
-    const result = await execute(file, args, { timeout, cwd, maxBuffer: 2 * 1024 * 1024,
+    const result = await execute(file, args, { timeout, cwd, onStdout, maxBuffer: 2 * 1024 * 1024,
       env: { ...env, PATH: dirname(process.execPath) + ':' + (env.PATH || '') } });
     if (logPath) await appendFile(logPath, result.stdout + result.stderr, {mode:0o600});
-    return result.stdout.trim();
+    return onStdout ? '' : result.stdout.trim();
   } catch (error) {
     if (logPath) await appendFile(logPath, String(error.stdout || '') + String(error.stderr || ''), {mode:0o600});
     throw Error(logPath ? 'The command did not complete. Check the update log.' : 'Could not query npm. Check your network and npm configuration, then retry.');
@@ -75,7 +75,14 @@ async function updateUnderLock({
   ask = askConfirmation,
   npm = (args, options) => command('npm', args, options),
   service = (action, options) => command(process.execPath, [join(userDir,'scripts/autostart.mjs'), action], options),
-  repair = options => command(process.execPath, [join(userDir,'scripts/repair.mjs'), '-f'], options),
+  repair = options => {
+    let pending = '';
+    return command(process.execPath, [join(userDir,'scripts/repair.mjs'), '-f'], {...options, onStdout(chunk) {
+      pending += chunk;
+      const lines = pending.split('\n'); pending = lines.pop();
+      for (const line of lines) write(line);
+    }}).finally(() => { if (pending) write(pending); });
+  },
   officialTest = prepareOfficialTestUpdate,
   serviceScope = maintenanceServiceScope,
 } = {}) {

package/src/official-test-update.mjs

@@ -70,6 +70,19 @@ export async function prepareOfficialTestUpdate({
 } = {}) {
   write("\n> Official test Skill");
   try {
+    // Only the release-pinned archive can establish the expected installed files.
+    // Never trust installation.json or a Market-provided digest for this shortcut.
+    const { inspectSavedSkillBundle } = await import("./skill-bundle.mjs");
+    const local = await inspectSavedSkillBundle(dataDir, OFFICIAL_TEST_PACKAGE);
+    if (local.status === "ready") {
+      write(`Version ${OFFICIAL_TEST_PACKAGE.version} verified locally. No download needed.`);
+      return local;
+    }
+    if (local.status === "local_edits") {
+      write("Local test Skill files are changed or incomplete. Existing files were kept; review them before testing.");
+      return local;
+    }
+    write("Downloading the official test Skill…");
     let source;
     for (const name of ["anvil-onboarding.json", "user-deployment.json"]) {
       const saved = await readJson(await deploymentFilePath(dataDir, userDir, name));

package/src/service-selection.mjs

@@ -45,6 +45,26 @@ async function targetUnitsPrepared(unitDir, target) {
   } catch { return false; }
 }
 
+// A cancelled first setup can own generated units before it has a Wallet or
+// runtime address. Only that demonstrably unconfigured state may omit settings;
+// missing settings in an established installation still require review.
+async function previousServiceSettings(dataDir) {
+  try { return await readServiceSettings(dataDir); }
+  catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    for (const directory of [dataDir, join(dataDir,'wallet'), join(dataDir,'runtime')]) {
+      const info = await lstat(directory).catch(e => { if(e.code==='ENOENT' && directory!==dataDir)return null;throw e; });
+      if (info && (!info.isDirectory() || info.isSymbolicLink() || info.uid!==process.getuid() || info.mode & 0o077))
+        throw Error('Previous installation directories need ownership review before switching.');
+    }
+    for (const name of ['wallet/session.keystore.json','wallet/policy.json','runtime/local-services.json','runtime/connection.json']) {
+      const exists = await lstat(join(dataDir,name)).then(()=>true,e=>{if(e.code==='ENOENT')return false;throw e;});
+      if (exists) throw Error('Previous installation has saved Wallet or Runtime settings, but its service configuration is incomplete. Keep its files and repair it before switching.');
+    }
+    return null;
+  }
+}
+
 // The caller holds this lock through unit replacement and start/stop. No prompts
 // can grant approval to a different target while the current transition writes.
 export async function withServiceSelection({target, action, ask, write = console.log, ctl, unitDir, operation, verifyReady = waitForServiceReadiness}) {
@@ -104,9 +124,9 @@ export async function withServiceSelection({target, action, ask, write = console
       }
     }
     if (different) {
-      const settings = await readServiceSettings(previous.dataDir);
+      const settings = await previousServiceSettings(previous.dataDir);
       if (await listenerPresent(join(previous.dataDir,'wallet/wallet.sock')) ||
-          await listenerPresent({host:'127.0.0.1',port:Number(new URL(settings.runtimeUrl).port)}))
+          (settings && await listenerPresent({host:'127.0.0.1',port:Number(new URL(settings.runtimeUrl).port)})))
         throw Error('An original Wallet or Runtime listener is still running. Stop it before switching; no new service was started.');
     }
     if (different) {

package/src/skill-bundle.mjs

@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: MPL-2.0
 // This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
 // If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import { constants } from "node:fs";
 import { currentTimeMs } from "./local-time.mjs";
 import { readSkillZip } from "./skill-zip.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import {
+  open,
   mkdir,
   lstat,
   readFile,
@@ -140,3 +142,39 @@ export async function installSkillBundle({
     await rm(staging, { recursive: true, force: true });
   }
 }
+
+// Read-only fast path for a release-pinned package. A matching ZIP alone is not
+// enough: compare every installed file with its authenticated archive content.
+export async function inspectSavedSkillBundle(dataDir, pin) {
+  const parent = join(dataDir, "runtime", "skill-bundles");
+  const directory = join(parent, `${pin.name}-${pin.version}-${pin.sha256}`);
+  async function readBounded(file, max) {
+    const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+      const stat = await handle.stat();
+      if (!stat.isFile() || stat.size > max) throw Error("Invalid saved Skill file");
+      return await handle.readFile();
+    } finally { await handle.close(); }
+  }
+  try {
+    for (const path of [dataDir, join(dataDir, "runtime"), parent, directory]) await privateDir(path);
+    const bytes = await readBounded(join(directory, "publisher.zip"), skillArchiveLimits.compressed);
+    if (bundleDigest(bytes) !== pin.sha256) return {status: "download_required"};
+    const parsed = parseSkillBundle(bytes);
+    if (parsed.manifest.packageName !== pin.name || parsed.manifest.packageVersion !== pin.version)
+      return {status: "download_required"};
+    try {
+      for (const [name, expected] of Object.entries(parsed.files)) {
+        // Refuse symlinked intermediate directories as well as symlinked files.
+        let ancestor = dirname(join(directory, name));
+        while (ancestor !== directory) {
+          await privateDir(ancestor);
+          ancestor = dirname(ancestor);
+        }
+        const actual = await readBounded(join(directory, name), skillArchiveLimits.file);
+        if (!actual.equals(expected)) return {status: "local_edits", directory};
+      }
+    } catch { return {status: "local_edits", directory}; }
+    return {status: "ready", directory};
+  } catch { return {status: "download_required"}; }
+}

package/update-pair.json

@@ -1,6 +1,6 @@
 {
   "format": "agentpay.local-update-pair.v1",
-  "userVersion": "0.3.8",
+  "userVersion": "0.3.10",
   "walletVersion": "0.3.3",
   "typesDependency": "0.14.3"
 }