@cydm/happy-elves 0.1.0-beta.501 → 0.1.0-beta.502

package/README.md

@@ -6,8 +6,8 @@ Public beta CLI for Happy Elves.
 
 Run once in the existing user account; it detects %USERPROFILE%\.happy-elves\hosted, keeps the current daemon and sessions running, installs the independent updater, and registers per-user startup.
 
-    npm.cmd install --prefix $HOME\.happy-elves\management-entry --ignore-scripts --no-audit --no-fund --package-lock=false @cydm/happy-elves@0.1.0-beta.501
-    npm.cmd exec --yes --package @cydm/happy-elves@0.1.0-beta.501 -- happy-elves-updater install --state-root $HOME\.happy-elves\hosted --autostart
+    npm.cmd install --prefix $HOME\.happy-elves\management-entry --ignore-scripts --no-audit --no-fund --package-lock=false @cydm/happy-elves@0.1.0-beta.502
+    npm.cmd exec --yes --package @cydm/happy-elves@0.1.0-beta.502 -- happy-elves-updater install --state-root $HOME\.happy-elves\hosted --autostart
 
 The same updater entrypoint works on macOS after selecting a permanent user prefix.
 

package/apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-cli",
-  "version": "0.1.0-beta.501",
+  "version": "0.1.0-beta.502",
   "private": true,
   "type": "module"
 }

package/apps/daemon/dist/orchestration/watcher.d.ts

@@ -22,7 +22,6 @@ export declare function catchUpSubscriptionEvents(input: {
     config: DaemonConfig;
     subscription: OrchestrationSubscriptionRecord;
 }): Promise<SubscriptionCatchUpResult>;
-export declare function remoteEventCursorForSubscription(crewMachineId: string, subscription: Pick<OrchestrationSubscriptionRecord, "remoteEventCursor" | "remoteEventSeq">): string | undefined;
 export declare function attentionFromReconcile(result: TurnReconcileResult): {
     eventType: TaskAttentionEventType;
     reason: string;

package/apps/daemon/dist/orchestration/watcher.js

@@ -6,11 +6,7 @@ import { activeSubscriptionsForTurn, appendAttention, closeSubscriptionForTurn,
 import { scheduleRemoteOrchestrationWork } from "./remote-work-budget.js";
 import { relayMachineRegistry } from "../state.js";
 const remoteCatchupsInFlight = new Map();
-const legacyRemoteCursorFallbackUntil = new Map();
-const remoteForwardCursorConfirmed = new Set();
-const legacyRemoteCursorFallbackMs = 5 * 60 * 1000;
 const initialRemoteEventCursor = "event_000000000000";
-const forwardEventCursorSinceBeta = 495;
 export async function observeSessionEvent(input) {
     const attention = attentionFromEvent(input.payload);
     if (!attention) {
@@ -134,8 +130,10 @@ async function catchUpSubscriptionEventsInternal(input) {
     const remoteCursor = crewMachineId !== input.config.machineId
         ? remoteEventCursorForSubscription(crewMachineId, input.subscription)
         : undefined;
-    const remoteCursorEnabled = remoteCursor !== undefined;
     try {
+        if (crewMachineId !== input.config.machineId && remotePeerForwardCursorSupport(crewMachineId) !== true) {
+            throw new RemoteCommandError(`Remote Crew ${crewMachineId} does not advertise the required forward event cursor protocol`, "REMOTE_FORWARD_CURSOR_UNSUPPORTED", false);
+        }
         const result = crewMachineId === input.config.machineId
             ? await runtimeRead(input.config, {
                 requestId: randomId("orch_catchup_events"),
@@ -158,8 +156,7 @@ async function catchUpSubscriptionEventsInternal(input) {
                     action: "turn.eventsPage",
                     sessionId: input.subscription.crewSessionId,
                     turnId: input.subscription.turnId,
-                    ...(remoteCursor ? { after: remoteCursor } : {}),
-                    ...(input.subscription.remoteEventItemId && !remoteCursor ? { afterItemId: input.subscription.remoteEventItemId } : {}),
+                    after: remoteCursor,
                     ...(input.subscription.runtimeTurnId ?? input.subscription.providerTurnId
                         ? { runtimeTurnId: input.subscription.runtimeTurnId ?? input.subscription.providerTurnId }
                         : {}),
@@ -181,19 +178,8 @@ async function catchUpSubscriptionEventsInternal(input) {
             });
             return { status: "unreachable" };
         }
-        // A rolling-upgrade peer may accept the old runtimeRead command but omit
-        // the forward cursor in its response. Treat that as the legacy path for
-        // this machine; in particular, never advance a durable cursor from a
-        // page whose peer cannot prove append-only progress.
-        if (crewMachineId !== input.config.machineId && result.cursorSupported === true) {
-            remoteForwardCursorConfirmed.add(crewMachineId);
-        }
-        else if (crewMachineId !== input.config.machineId && remoteCursorEnabled && !result.nextAfter) {
-            // A peer that accepted the forward request but cannot prove the cursor
-            // contract is no longer trusted. Remove the positive handshake so the
-            // next safe, legacy-compatible request can renegotiate it.
-            remoteForwardCursorConfirmed.delete(crewMachineId);
-            legacyRemoteCursorFallbackUntil.set(crewMachineId, Date.now() + legacyRemoteCursorFallbackMs);
+        if (crewMachineId !== input.config.machineId && result.cursorSupported !== true) {
+            throw new RemoteCommandError(`Remote Crew ${crewMachineId} returned a response without forward cursor support`, "REMOTE_FORWARD_CURSOR_UNSUPPORTED", false);
         }
         const observed = await observeSubscriptionRuntimeEvents({
             config: input.config,
@@ -203,7 +189,7 @@ async function catchUpSubscriptionEventsInternal(input) {
             skipThroughSeq: crewMachineId === input.config.machineId ? 0 : input.subscription.remoteEventSeq ?? 0,
         });
         if (crewMachineId !== input.config.machineId) {
-            const canAdvance = Boolean(result.nextAfter);
+            const canAdvance = result.cursorSupported === true;
             await markSubscriptionRemoteScan(input.subscription.taskId, {
                 crewMachineId,
                 crewSessionId: input.subscription.crewSessionId,
@@ -221,86 +207,32 @@ async function catchUpSubscriptionEventsInternal(input) {
         };
     }
     catch (error) {
-        if (crewMachineId !== input.config.machineId && remoteCursorEnabled && isRemoteEventCursorCompatibilityFailure(error)) {
-            remoteForwardCursorConfirmed.delete(crewMachineId);
-            legacyRemoteCursorFallbackUntil.set(crewMachineId, Date.now() + legacyRemoteCursorFallbackMs);
-        }
         await appendOrchestrationAudit(input.config, "orchestration.subscription.catchup_failed", `Subscription catch-up failed for ${input.subscription.taskId}`, {
             taskId: input.subscription.taskId,
             crewMachineId,
             crewSessionId: input.subscription.crewSessionId,
             turnId: input.subscription.turnId,
+            errorCode: error instanceof RemoteCommandError ? error.code : undefined,
             error: error instanceof Error ? error.message : String(error),
         });
         return { status: "failed" };
     }
 }
-function canUseRemoteEventCursor(crewMachineId) {
-    const until = legacyRemoteCursorFallbackUntil.get(crewMachineId);
-    if (until === undefined)
-        return remotePeerAdvertisesForwardCursor(crewMachineId);
-    if (until <= Date.now()) {
-        legacyRemoteCursorFallbackUntil.delete(crewMachineId);
-        return remotePeerAdvertisesForwardCursor(crewMachineId);
-    }
-    return false;
-}
-export function remoteEventCursorForSubscription(crewMachineId, subscription) {
-    const fallbackUntil = legacyRemoteCursorFallbackUntil.get(crewMachineId);
-    if (fallbackUntil !== undefined && fallbackUntil > Date.now())
-        return undefined;
-    if (fallbackUntil !== undefined)
-        legacyRemoteCursorFallbackUntil.delete(crewMachineId);
-    const advertised = remotePeerForwardCursorSupport(crewMachineId);
-    // An explicit old version wins over a stale persisted cursor (for example,
-    // after a peer downgrade). Unknown manifests are different: a persisted
-    // cursor is still positive evidence until the peer identity is refreshed.
-    if (advertised === false)
-        return undefined;
-    // A persisted cursor is positive evidence from a previous successful
-    // forward-page response. It remains usable even when the peer's manifest is
-    // temporarily unavailable during reconnect.
+function remoteEventCursorForSubscription(crewMachineId, subscription) {
+    // Every current daemon speaks the append-only forward cursor protocol. The
+    // capability gate lives in catchUpSubscriptionEventsInternal so an
+    // unavailable/old peer fails with a structured protocol error rather than
+    // silently switching to an unsafe legacy page.
+    void crewMachineId;
     if (subscription.remoteEventCursor)
         return subscription.remoteEventCursor;
-    if (advertised !== true || !canUseRemoteEventCursor(crewMachineId))
-        return undefined;
     return subscription.remoteEventSeq
         ? `event_${String(subscription.remoteEventSeq).padStart(12, "0")}`
         : initialRemoteEventCursor;
 }
-function remotePeerAdvertisesForwardCursor(crewMachineId) {
-    return remotePeerForwardCursorSupport(crewMachineId) === true;
-}
 function remotePeerForwardCursorSupport(crewMachineId) {
     const machine = relayMachineRegistry.get(crewMachineId);
-    const daemonVersion = machine?.capabilities.daemonVersion?.trim();
-    const advertisedFeature = machine?.capabilities.runtimeEvents?.forwardCursor;
-    if (advertisedFeature === false)
-        return false;
-    if (!daemonVersion) {
-        if (advertisedFeature === true || remoteForwardCursorConfirmed.has(crewMachineId))
-            return true;
-        return undefined;
-    }
-    // Published beta495 introduced the append-only eventsPage `after` field.
-    // Workspace daemons also publish an explicit feature bit. The historical
-    // package version 0.1.0 alone is not evidence: older development daemons
-    // used that same version while rejecting `after`.
-    const match = /^0\.1\.0-beta\.(\d+)$/.exec(daemonVersion);
-    if (match && Number(match[1]) < forwardEventCursorSinceBeta)
-        return false;
-    if (advertisedFeature === true || remoteForwardCursorConfirmed.has(crewMachineId))
-        return true;
-    if (match)
-        return Number(match[1]) >= forwardEventCursorSinceBeta;
-    return undefined;
-}
-function isRemoteEventCursorCompatibilityFailure(error) {
-    if (!(error instanceof RemoteCommandError))
-        return false;
-    return error.code === "REMOTE_COMMAND_TIMEOUT" ||
-        error.code === "REMOTE_MACHINE_ERROR" ||
-        /INVALID|UNKNOWN|UNRECOGNIZED|SCHEMA|PROTOCOL|CURSOR|AFTER/u.test(error.code);
+    return machine?.capabilities.runtimeEvents?.forwardCursor;
 }
 async function observeSubscriptionRuntimeEvents(input) {
     const crewMachineId = input.crewMachineId ?? input.subscription.crewMachineId ?? input.config.machineId;

package/apps/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-daemon",
-  "version": "0.1.0-beta.501",
+  "version": "0.1.0-beta.502",
   "private": true,
   "type": "module"
 }

package/apps/updater/dist/launcher.d.ts

@@ -1,9 +1,17 @@
 /**
- * Install a stable, state-root-local launcher. The launcher deliberately resolves
- * the active slot at invocation time so an update never leaves a shell shim
- * pointing at a removed staging directory.
+ * Select the Node runtime used by stable launchers. An explicit executable is
+ * always authoritative (the `--node` escape hatch); otherwise retain the
+ * previously verified launcher runtime across upgrades, rollback and recovery.
+ * A stale/broken launcher record is not trusted and falls back to the runtime
+ * currently executing the updater.
  */
-export declare function writeStableLaunchers(stateRoot: string, nodeExecutable: string): Promise<{
+export declare function resolveStableNodeExecutable(stateRoot: string, explicitNodeExecutable?: string): Promise<string>;
+/**
+ * Install a stable, state-root-local launcher. The launcher deliberately
+ * resolves the active slot at invocation time so an update never leaves a
+ * shell shim pointing at a removed staging directory.
+ */
+export declare function writeStableLaunchers(stateRoot: string, nodeExecutable?: string): Promise<{
     cliPath: string;
     updaterPath: string;
 }>;

package/apps/updater/dist/launcher.js

@@ -3,36 +3,61 @@ import path from "node:path";
 import { updaterPaths } from "./paths.js";
 import { readCurrentSlot } from "./slots.js";
 import { atomicWriteJson } from "./state.js";
+import { inspectNodeRuntime } from "./node-runtime.js";
 /**
- * Install a stable, state-root-local launcher. The launcher deliberately resolves
- * the active slot at invocation time so an update never leaves a shell shim
- * pointing at a removed staging directory.
+ * Select the Node runtime used by stable launchers. An explicit executable is
+ * always authoritative (the `--node` escape hatch); otherwise retain the
+ * previously verified launcher runtime across upgrades, rollback and recovery.
+ * A stale/broken launcher record is not trusted and falls back to the runtime
+ * currently executing the updater.
+ */
+export async function resolveStableNodeExecutable(stateRoot, explicitNodeExecutable) {
+    if (explicitNodeExecutable !== undefined)
+        return (await inspectNodeRuntime(explicitNodeExecutable)).executable;
+    const manifestPath = path.join(updaterPaths(stateRoot).launcherDir, "launcher.json");
+    try {
+        const parsed = JSON.parse(await fs.readFile(manifestPath, "utf8"));
+        if (typeof parsed.nodeExecutable === "string" && parsed.nodeExecutable.trim()) {
+            return (await inspectNodeRuntime(parsed.nodeExecutable)).executable;
+        }
+    }
+    catch {
+        // The launcher may not exist during the first install, or its old runtime
+        // may have been removed. In either case use the updater's current Node.
+    }
+    return (await inspectNodeRuntime(process.execPath)).executable;
+}
+/**
+ * Install a stable, state-root-local launcher. The launcher deliberately
+ * resolves the active slot at invocation time so an update never leaves a
+ * shell shim pointing at a removed staging directory.
  */
 export async function writeStableLaunchers(stateRoot, nodeExecutable) {
     const current = await readCurrentSlot(stateRoot);
     if (!current)
         throw Object.assign(new Error("Cannot create launcher before a current slot exists"), { code: "UPDATE_SLOT_MISSING" });
+    const selectedNodeExecutable = await resolveStableNodeExecutable(stateRoot, nodeExecutable);
     const paths = updaterPaths(stateRoot);
     await fs.mkdir(paths.launcherDir, { recursive: true, mode: 0o700 });
     const runtimeScript = path.join(paths.launcherDir, "launcher-runtime.cjs");
-    await fs.writeFile(runtimeScript, runtimeScriptSource(stateRoot, nodeExecutable), { mode: 0o700 });
+    await fs.writeFile(runtimeScript, runtimeScriptSource(stateRoot, selectedNodeExecutable), { mode: 0o700 });
     const cliEntry = path.join(current.slotPath, "node_modules", "@cydm", "happy-elves", "apps", "cli", "dist", "index.js");
     const updaterEntry = path.join(current.slotPath, "node_modules", "@cydm", "happy-elves", "apps", "updater", "dist", "cli.js");
     await fs.access(cliEntry);
     await fs.access(updaterEntry);
     if (process.platform === "win32") {
-        await atomicWriteText(paths.launcherPath, windowsLauncher(nodeExecutable, runtimeScript, "cli"));
-        await atomicWriteText(paths.updaterLauncherPath, windowsLauncher(nodeExecutable, runtimeScript, "updater"));
+        await atomicWriteText(paths.launcherPath, windowsLauncher(selectedNodeExecutable, runtimeScript, "cli"));
+        await atomicWriteText(paths.updaterLauncherPath, windowsLauncher(selectedNodeExecutable, runtimeScript, "updater"));
     }
     else {
-        await atomicWriteText(paths.launcherPath, posixLauncher(nodeExecutable, runtimeScript, "cli"));
-        await atomicWriteText(paths.updaterLauncherPath, posixLauncher(nodeExecutable, runtimeScript, "updater"));
+        await atomicWriteText(paths.launcherPath, posixLauncher(selectedNodeExecutable, runtimeScript, "cli"));
+        await atomicWriteText(paths.updaterLauncherPath, posixLauncher(selectedNodeExecutable, runtimeScript, "updater"));
         await fs.chmod(paths.launcherPath, 0o700);
         await fs.chmod(paths.updaterLauncherPath, 0o700);
     }
     await atomicWriteJson(path.join(paths.launcherDir, "launcher.json"), {
         schema: 1,
-        nodeExecutable,
+        nodeExecutable: selectedNodeExecutable,
         runtimeScript,
         version: current.version,
         cliPath: cliEntry,

package/apps/updater/dist/run.js

@@ -7,7 +7,7 @@ import { startUpdaterRelay } from "./relay.js";
 import fs from "node:fs/promises";
 import { cancelHostJob, readHostJob, readHostJobByOperation, recoverHostJobs, startHostJob } from "./host-jobs.js";
 import { daemonEntrypoint, localDaemonStatus, spawnUpdaterFromStableLauncher, startDaemon, stopLocalDaemon, waitForUpdaterReady } from "./daemon.js";
-import { writeStableLaunchers } from "./launcher.js";
+import { resolveStableNodeExecutable, writeStableLaunchers } from "./launcher.js";
 import { clearStaleUpdaterMarkers, claimUpdaterOwner, markUpdaterHandoff, readUpdaterOwner, removeUpdaterPidIfOwned, restoreUpdaterOwner, writeUpdaterPid, writeUpdaterReady } from "./ownership.js";
 import { randomUUID } from "node:crypto";
 let daemonLifecycleTail = Promise.resolve();
@@ -132,13 +132,14 @@ async function recoverStaleUpdate(stateRoot) {
     const targetWasActivated = Boolean(current?.version && current.version === operation.targetVersion && operation.fromVersion);
     if (targetWasActivated && operation.fromVersion) {
         try {
+            const nodeExecutable = await resolveStableNodeExecutable(stateRoot);
             if (operation.daemonWasRunning !== false)
                 await stopLocalDaemon(stateRoot, 15_000);
             const packageJson = await readSlotPackage(stateRoot, operation.fromVersion);
             const restored = await activateSlot(stateRoot, { version: operation.fromVersion, digest: operation.fromDigest, buildId: operation.fromBuildId ?? (typeof packageJson?.buildId === "string" ? packageJson.buildId : undefined) });
-            await writeStableLaunchers(stateRoot, process.execPath);
+            await writeStableLaunchers(stateRoot, nodeExecutable);
             if (operation.daemonWasRunning !== false) {
-                const pid = await startDaemon({ stateRoot, nodeExecutable: process.execPath, daemonEntrypoint: daemonEntrypoint(restored.slotPath), generation: `recovery-${Date.now()}` });
+                const pid = await startDaemon({ stateRoot, nodeExecutable, daemonEntrypoint: daemonEntrypoint(restored.slotPath), generation: `recovery-${Date.now()}` });
                 if (!(await waitForDaemonPid(stateRoot, pid, 20_000)))
                     throw new Error("Recovered daemon did not become ready");
             }
@@ -170,7 +171,8 @@ async function handoffToCurrentSlot(stateRoot, owner) {
         // replacement can therefore restore the old marker without a duplicate
         // entrypoint deleting it.
         await fs.rm(readyPath, { force: true }).catch(() => undefined);
-        const nextPid = spawnUpdaterFromStableLauncher({ stateRoot, nodeExecutable: process.execPath, handoffFromPid: process.pid, handoffToken: token });
+        const nodeExecutable = await resolveStableNodeExecutable(stateRoot);
+        const nextPid = spawnUpdaterFromStableLauncher({ stateRoot, nodeExecutable, handoffFromPid: process.pid, handoffToken: token });
         if (await waitForUpdaterReady(stateRoot, nextPid, 10_000, { handoffToken: token }))
             return { ok: true };
         await recoverFailedHandoff(stateRoot, owner, token, previousReady);
@@ -264,7 +266,8 @@ async function handleDaemonCommand(command, input) {
                 const current = await readCurrentSlot(input.stateRoot);
                 if (!current)
                     return daemonError(command, input.machineId, "BOOTSTRAP_REQUIRED", "No installed daemon slot is available", action);
-                const pid = await startDaemon({ stateRoot: input.stateRoot, nodeExecutable: process.execPath, daemonEntrypoint: daemonEntrypoint(current.slotPath), generation: `host-${Date.now()}` });
+                const nodeExecutable = await resolveStableNodeExecutable(input.stateRoot);
+                const pid = await startDaemon({ stateRoot: input.stateRoot, nodeExecutable, daemonEntrypoint: daemonEntrypoint(current.slotPath), generation: `host-${Date.now()}` });
                 const status = await waitForDaemonPid(input.stateRoot, pid, 5_000);
                 if (!status)
                     throw Object.assign(new Error("Daemon exited before becoming ready"), { code: "DAEMON_START_FAILED" });

package/apps/updater/dist/supervisor.js

@@ -11,7 +11,7 @@ import { resolveOfficialRelease, downloadAndVerifyRelease, installOfficialPackag
 import { daemonControlRequest } from "./control.js";
 import { daemonEntrypoint, localDaemonStatus, startDaemon, startUpdater, stopLocalDaemon, waitForUpdaterReady } from "./daemon.js";
 import { activeHostJobCount } from "./host-jobs.js";
-import { writeStableLaunchers } from "./launcher.js";
+import { resolveStableNodeExecutable, writeStableLaunchers } from "./launcher.js";
 import { installAutostart } from "./autostart.js";
 import { readDaemonConfig } from "./daemon-config.js";
 export async function supervisorStatus(options) {
@@ -19,7 +19,14 @@ export async function supervisorStatus(options) {
     const operation = await readOperation(stateRoot);
     const current = await readCurrentSlot(stateRoot);
     const daemon = await localDaemonStatus(stateRoot);
-    const node = await inspectNodeRuntime(options.nodeExecutable ?? process.execPath).catch((error) => ({ errorCode: errorCode(error), error: error instanceof Error ? error.message : String(error) }));
+    let node;
+    try {
+        const selectedNode = await resolveStableNodeExecutable(stateRoot, options.nodeExecutable);
+        node = await inspectNodeRuntime(selectedNode);
+    }
+    catch (error) {
+        node = { errorCode: errorCode(error), error: error instanceof Error ? error.message : String(error) };
+    }
     return {
         stateRoot,
         updaterVersion: options.updaterVersion ?? "0.1.0",
@@ -35,7 +42,7 @@ export async function bootstrapFromTarball(input) {
     const daemon = await localDaemonStatus(stateRoot);
     if (daemon.running)
         throw Object.assign(new Error("Bootstrap requires a local maintenance window; stop the existing daemon after confirming it is idle"), { code: "BOOTSTRAP_MAINTENANCE_REQUIRED" });
-    const node = await inspectNodeRuntime(input.nodeExecutable ?? process.execPath);
+    const node = await inspectNodeRuntime(await resolveStableNodeExecutable(stateRoot, input.nodeExecutable));
     const existingCurrent = await readCurrentSlot(stateRoot);
     if (existingCurrent?.version === input.version)
         throw Object.assign(new Error("The requested bootstrap version is already active"), { code: "UPDATE_ALREADY_CURRENT" });
@@ -93,7 +100,7 @@ export async function bootstrapFromTarball(input) {
 export async function installCurrentPackage(input) {
     const stateRoot = resolveStateRoot(input.stateRoot);
     const config = await readDaemonConfig(stateRoot);
-    const node = await inspectNodeRuntime(input.nodeExecutable ?? process.execPath);
+    const node = await inspectNodeRuntime(await resolveStableNodeExecutable(stateRoot, input.nodeExecutable));
     const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");
     const manifest = JSON.parse(await fs.readFile(path.join(packageRoot, "package.json"), "utf8"));
     const version = typeof manifest.version === "string" && manifest.version ? manifest.version : undefined;
@@ -150,7 +157,7 @@ async function waitForDaemonPid(stateRoot, pid, timeoutMs) {
 }
 export async function applyOfficialUpdate(input) {
     const stateRoot = resolveStateRoot(input.stateRoot);
-    const node = await inspectNodeRuntime(input.nodeExecutable ?? process.execPath);
+    const node = await inspectNodeRuntime(await resolveStableNodeExecutable(stateRoot, input.nodeExecutable));
     const existing = await readOperation(stateRoot);
     const operationId = input.operationId ?? randomId("upd");
     if (existing && existing.operationId === operationId) {
@@ -269,6 +276,7 @@ export async function commitDeferredUpdate(input) {
 }
 /** Restore the previous slot after a replacement updater fails its handoff. */
 export async function recoverDeferredUpdate(input) {
+    const nodeExecutable = await resolveStableNodeExecutable(input.stateRoot, input.nodeExecutable);
     const operation = await readOperation(input.stateRoot);
     if (!operation || operation.operationId !== input.operationId)
         throw Object.assign(new Error("Deferred update operation was not found"), { code: "UPDATE_OPERATION_MISSING" });
@@ -281,9 +289,9 @@ export async function recoverDeferredUpdate(input) {
             await stopLocalDaemon(input.stateRoot, 15_000).catch(() => undefined);
         await activateSlot(input.stateRoot, { version: previous.version, digest: operation.fromDigest ?? previous.digest, buildId: operation.fromBuildId ?? previous.buildId });
         if (operation.daemonWasRunning !== false) {
-            await startAndVerify({ stateRoot: input.stateRoot, machineId: input.machineId, nodeExecutable: input.nodeExecutable ?? process.execPath, version: previous.version, generation: operation.barrierGeneration ?? randomId("rollback") });
+            await startAndVerify({ stateRoot: input.stateRoot, machineId: input.machineId, nodeExecutable, version: previous.version, generation: operation.barrierGeneration ?? randomId("rollback") });
         }
-        await writeStableLaunchers(input.stateRoot, input.nodeExecutable ?? process.execPath);
+        await writeStableLaunchers(input.stateRoot, nodeExecutable);
         await clearBarrier(input.stateRoot, input.machineId, input.operationId).catch(() => undefined);
         return await updateOperation(input.stateRoot, { phase: "recovered", errorCode: input.errorCode ?? "UPDATE_HANDOFF_FAILED", error: input.error ?? "Replacement updater failed; the previous slot was restored.", recoveredFrom: operation.targetVersion, targetVersion: previous.version });
     }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cydm/happy-elves",
-  "version": "0.1.0-beta.501",
+  "version": "0.1.0-beta.502",
   "description": "Remote controller for local coding agents with hosted or self-hosted relay support.",
-  "buildId": "4edbb3ee3e6735ee0abb55e9b0612b17",
+  "buildId": "9ee7dcc44e6e7465aaa011b2c13085c8",
   "type": "module",
   "bin": {
     "happy-elves": "./apps/cli/dist/index.js",

package/packages/headless-runtime/dist/codex-provider.js

@@ -594,6 +594,16 @@ class CodexHeadlessRuntimeProvider {
                 if (codexTurnId && !active.settled && !active.terminalObserved) {
                     active.codexTurnId = codexTurnId;
                     this.activeTurnsByCodexTurn.set(codexTurnId, active);
+                    // Persist ownership as soon as the provider materialises the native
+                    // turn. A failed/interrupted HE turn is still an HE-owned append;
+                    // waiting until `turn/completed` made a restart misclassify that
+                    // failed turn as an external native handoff.
+                    // Serialize the durable metadata write with provider event handling,
+                    // but do not await it here: app-servers may issue a tool/approval
+                    // request immediately after the `turn/start` response and before
+                    // the first notification. Blocking that response would let a fast
+                    // terminal notification fence the still-active request.
+                    this.enqueueActive(active, () => this.bindStartedCodexTurn(active, codexTurnId));
                 }
             };
             startProviderTurn(codexThreadId).catch(async (error) => {
@@ -1127,6 +1137,27 @@ class CodexHeadlessRuntimeProvider {
             providerMetadata,
         });
     }
+    async bindStartedCodexTurn(active, codexTurnId) {
+        const priorIds = Array.isArray(active.providerMetadata?.nativeHistoryTurnIds)
+            ? active.providerMetadata.nativeHistoryTurnIds.filter((value) => typeof value === "string")
+            : [];
+        const nativeHistoryTurnIds = priorIds.includes(codexTurnId) ? priorIds : [...priorIds, codexTurnId];
+        const ownedPriorIds = Array.isArray(active.providerMetadata?.headlessOwnedNativeTurnIds)
+            ? active.providerMetadata.headlessOwnedNativeTurnIds.filter((value) => typeof value === "string")
+            : [];
+        const headlessOwnedNativeTurnIds = ownedPriorIds.includes(codexTurnId) ? ownedPriorIds : [...ownedPriorIds, codexTurnId];
+        const providerMetadata = {
+            ...active.providerMetadata,
+            nativeHistoryTurnIds,
+            headlessOwnedNativeTurnIds,
+            nativeHistoryVersion: nativeHistoryVersionForTurnIds(nativeHistoryTurnIds),
+        };
+        active.providerMetadata = providerMetadata;
+        await active.context.bindThreadProvider({
+            providerSessionId: active.codexThreadId,
+            providerMetadata,
+        });
+    }
     enqueueActive(active, task) {
         if (active.settled)
             return;