@foxden-app/foxclaw 0.13.0 → 0.13.1

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable FoxClaw changes are listed here. Each release note is bilingual so GitHub Releases and the npm package are useful to both Chinese and English readers.
 
+## 0.13.1 - 2026-10-06
+
+### 中文
+
+- **修复 `/update` 意外降级**：pnpm 10 与 pnpm 11 安装并存时，以本次安装的全局目录选择启动入口，禁止误用另一目录中的旧启动脚本。
+- 修复升级完成卡片丢失 Antigravity CLI 实际版本、回退显示升级前版本的问题。
+- **升级前后双重版本校验**：从官方仓库获取目标版本并按精确版本安装；拒绝降级，安装版本必须与目标一致才允许更新其他 CLI 和重启服务。校验失败不会发送升级成功或集群升级广播。
+
+### English
+
+- **Fixed accidental downgrades during `/update`**: when pnpm 10 and pnpm 11 installations coexist, resolve the entry point from the installer's global root instead of an older launcher from another layout.
+- Preserve the actual Antigravity CLI update versions in completion cards instead of falling back to the pre-update version.
+- **Verify versions before installation and restart**: fetch the target from the official registry and install that exact version. Reject downgrades and require the installed version to match before updating other CLIs or restarting. Failed checks never report success or broadcast a cluster update.
+
 ## 0.13.0 - 2026-10-06
 
 ### 中文

package/dist/bridge/unified_bridge.js

@@ -382,9 +382,9 @@ export class UnifiedBridgeCore {
             const title = isZh ? '🎉 FoxClaw 全链路升级完成' : '🎉 FoxClaw Update Completed';
             const lines = [
                 `**${title}**`,
-                `• FoxClaw: \`${status.fromVersion}\` ➔ \`${status.toVersion ?? '0.11.0'}\``,
-                `• Codex CLI: \`${status.codexFromVersion ?? '0.157.1'}\` ➔ \`${status.codexToVersion ?? '0.159.2'}\``,
-                `• Antigravity CLI: \`${status.agyFromVersion ?? '1.2.14'}\` (最新)`,
+                `• FoxClaw: \`${status.fromVersion}\` ➔ \`${status.toVersion ?? 'unknown'}\``,
+                `• Codex CLI: \`${status.codexFromVersion ?? 'unknown'}\` ➔ \`${status.codexToVersion ?? 'unknown'}\``,
+                `• Antigravity CLI: \`${status.agyFromVersion ?? 'unknown'}\` ➔ \`${status.agyToVersion ?? 'unknown'}\``,
             ];
             if (notes.length > 0) {
                 lines.push('', isZh ? '**更新日志**:' : '**Release Notes**:');

package/dist/update.d.ts

@@ -68,6 +68,11 @@ export interface PendingClusterUpdateBroadcast {
     fromVersion: string;
     updatedAt: string;
 }
+interface CodexCliUpdateResult {
+    message: string;
+    fromVersion: string | null;
+    toVersion: string | null;
+}
 export declare function selfUpdateStatusPath(statusPath: string): string;
 export declare function inferPnpmHomeFromEntryPoint(entryPoint: string): string | null;
 export declare function inferPnpmFallbackPackageFromEntryPoint(entryPoint: string): string;
@@ -88,11 +93,31 @@ export declare function buildSelfUpdateLaunchCommand(options: {
     systemdRunPath?: string | null;
     unitName?: string;
 }): SelfUpdateLaunchCommand;
-export declare function performSelfUpdate(options: PerformSelfUpdateOptions): SelfUpdateOutcome;
+export declare function assertSelfUpdateVersion(current: string, candidate: string, expected?: string): void;
+interface SelfUpdateOperations {
+    latestVersion: (installer: SelfUpdateInstaller, env: NodeJS.ProcessEnv) => string;
+    run: typeof runInherited;
+    entryPoint: typeof resolveUpdatedEntryPoint;
+    readVersion: typeof readInstalledPackageVersion;
+    updateCodex: typeof updateManagedCodexCli;
+    updateAgy: typeof updateManagedAgyCli;
+}
+export declare function performSelfUpdate(options: PerformSelfUpdateOptions, overrides?: Partial<SelfUpdateOperations>): SelfUpdateOutcome;
 export declare function readPendingClusterUpdateBroadcast(filePath: string): PendingClusterUpdateBroadcast | null;
 export declare function writePendingClusterUpdateBroadcast(filePath: string, value: PendingClusterUpdateBroadcast): void;
 export declare function clearPendingClusterUpdateBroadcast(filePath: string): void;
+declare function updateManagedCodexCli(codexCliBin: string, nodePath: string, env: NodeJS.ProcessEnv): CodexCliUpdateResult;
+interface AgyCliUpdateResult {
+    message: string;
+    fromVersion: string | null;
+    toVersion: string | null;
+}
+declare function updateManagedAgyCli(agyCliBin: string, env: NodeJS.ProcessEnv): AgyCliUpdateResult;
+declare function runInherited(command: string, args: string[], env: NodeJS.ProcessEnv): void;
 export declare function resolveFoxclawEntryPointFromGlobalRoot(globalRoot: string, exists?: (target: string) => boolean): string | null;
-export declare function resolveFoxclawEntryPointFromPnpmHome(pnpmHome: string, preferBin?: boolean, exists?: (target: string) => boolean, readText?: (target: string) => string): string | null;
+export declare function resolveFoxclawEntryPointFromPnpmHome(pnpmHome: string, preferBin?: boolean, exists?: (target: string) => boolean, readText?: (target: string) => string, installationRoot?: string): string | null;
+export declare function resolveFoxclawEntryPointFromInstallation(globalRoot: string, pnpmHome?: string, exists?: (target: string) => boolean, readText?: (target: string) => string): string | null;
+declare function resolveUpdatedEntryPoint(installer: SelfUpdateInstaller, env: NodeJS.ProcessEnv): string;
+declare function readInstalledPackageVersion(updatedEntryPoint: string): string;
 export declare function extractReleaseNotes(changelog: string, version: string, locale: AppLocale): string[] | null;
 export {};

package/dist/update.js

@@ -3,7 +3,10 @@ import path from 'node:path';
 import os from 'node:os';
 import process from 'node:process';
 import { spawn, spawnSync } from 'node:child_process';
-const PACKAGE_SPEC = '@foxden-app/foxclaw@latest';
+import { valid, lt } from 'semver';
+const PACKAGE_NAME = '@foxden-app/foxclaw';
+const PACKAGE_SPEC = `${PACKAGE_NAME}@latest`;
+const PACKAGE_REGISTRY = 'https://registry.npmjs.org';
 const CODEX_PACKAGE_SPEC = '@openai/codex@latest';
 const UPDATE_STATUS_FILENAME = 'self-update.json';
 export const SELF_UPDATE_PENDING_TIMEOUT_MS = 15 * 60_000;
@@ -153,6 +156,9 @@ export function readSelfUpdateStatus(statusFile) {
             ...(typeof parsed.codexUpdate === 'string' ? { codexUpdate: parsed.codexUpdate } : {}),
             ...(typeof parsed.codexFromVersion === 'string' ? { codexFromVersion: parsed.codexFromVersion } : {}),
             ...(typeof parsed.codexToVersion === 'string' ? { codexToVersion: parsed.codexToVersion } : {}),
+            ...(typeof parsed.agyUpdate === 'string' ? { agyUpdate: parsed.agyUpdate } : {}),
+            ...(typeof parsed.agyFromVersion === 'string' ? { agyFromVersion: parsed.agyFromVersion } : {}),
+            ...(typeof parsed.agyToVersion === 'string' ? { agyToVersion: parsed.agyToVersion } : {}),
             error: typeof parsed.error === 'string' ? parsed.error : null,
             updatedAt: parsed.updatedAt,
         };
@@ -311,25 +317,73 @@ export function buildSelfUpdateLaunchCommand(options) {
         viaSystemdRun: false,
     };
 }
-export function performSelfUpdate(options) {
+export function assertSelfUpdateVersion(current, candidate, expected) {
+    const from = valid(current);
+    const to = valid(candidate);
+    if (!from || !to) {
+        throw new Error(`Cannot verify FoxClaw update versions: ${current} -> ${candidate}.`);
+    }
+    if (lt(to, from)) {
+        throw new Error(`Refusing FoxClaw downgrade: ${current} -> ${candidate}.`);
+    }
+    if (expected && to !== valid(expected)) {
+        throw new Error(`Installed FoxClaw ${candidate} does not match requested ${expected}; service restart refused.`);
+    }
+}
+function readLatestFoxclawVersion(installer, env) {
+    // Read the same registry used by the exact-version install, bypassing stale local metadata.
+    const result = spawnSync(installer.command, ['view', PACKAGE_SPEC, 'version', '--json', `--registry=${PACKAGE_REGISTRY}`, '--prefer-online'], { encoding: 'utf8', env, timeout: 30_000 });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error('Could not read the latest FoxClaw version from the npm registry.');
+    let version;
+    try {
+        version = JSON.parse(result.stdout.trim());
+    }
+    catch {
+        throw new Error('Invalid latest FoxClaw version response.');
+    }
+    if (typeof version !== 'string' || !valid(version))
+        throw new Error('Invalid latest FoxClaw version response.');
+    return valid(version);
+}
+export function performSelfUpdate(options, overrides = {}) {
     const env = options.env ?? process.env;
+    const operations = {
+        latestVersion: readLatestFoxclawVersion,
+        run: runInherited,
+        entryPoint: resolveUpdatedEntryPoint,
+        readVersion: readInstalledPackageVersion,
+        updateCodex: updateManagedCodexCli,
+        updateAgy: updateManagedAgyCli,
+        ...overrides,
+    };
     let toVersion = null;
     let codexUpdate = null;
     let agyUpdate = null;
     try {
-        codexUpdate = updateManagedCodexCli(options.codexCliBin ?? env.CODEX_CLI_BIN ?? '', options.nodePath, env);
-        console.log(`[UPDATE] ${codexUpdate.message}`);
-        agyUpdate = updateManagedAgyCli(options.agyCliBin ?? env.AGY_CLI_BIN ?? '', env);
-        console.log(`[UPDATE] ${agyUpdate.message}`);
         const installer = resolveSelfUpdateInstaller(options.entryPoint, options.nodePath, fs.existsSync, env);
         const installerEnv = buildInstallerEnv(options.entryPoint, installer, env);
-        console.log(`[UPDATE] Installing ${PACKAGE_SPEC} with ${installer.manager}...`);
-        runInherited(installer.command, installer.installArgs, installerEnv);
-        const updatedEntryPoint = resolveUpdatedEntryPoint(installer, installerEnv);
-        toVersion = readInstalledPackageVersion(updatedEntryPoint);
+        const targetVersion = operations.latestVersion(installer, installerEnv);
+        assertSelfUpdateVersion(options.version, targetVersion);
+        const spec = `${PACKAGE_NAME}@${targetVersion}`;
+        const installArgs = [
+            ...installer.installArgs.map(arg => arg === PACKAGE_SPEC ? spec : arg),
+            `--registry=${PACKAGE_REGISTRY}`,
+        ];
+        console.log(`[UPDATE] Installing ${spec} with ${installer.manager}...`);
+        operations.run(installer.command, installArgs, installerEnv);
+        const updatedEntryPoint = operations.entryPoint(installer, installerEnv);
+        toVersion = operations.readVersion(updatedEntryPoint);
+        assertSelfUpdateVersion(options.version, toVersion, targetVersion);
+        codexUpdate = operations.updateCodex(options.codexCliBin ?? env.CODEX_CLI_BIN ?? '', options.nodePath, env);
+        console.log(`[UPDATE] ${codexUpdate.message}`);
+        agyUpdate = operations.updateAgy(options.agyCliBin ?? env.AGY_CLI_BIN ?? '', env);
+        console.log(`[UPDATE] ${agyUpdate.message}`);
         const releaseNotes = readInstalledReleaseNotes(updatedEntryPoint, toVersion, options.notificationFile);
         console.log('[UPDATE] Running checks and restarting the FoxClaw service...');
-        runInherited(options.nodePath, [updatedEntryPoint, 'start'], installerEnv);
+        operations.run(options.nodePath, [updatedEntryPoint, 'start'], installerEnv);
         completeNotification(options.notificationFile, 'succeeded', toVersion, codexUpdate, null, releaseNotes, agyUpdate);
         if (options.clusterBroadcastFile && env.FOXCLAW_SUPPRESS_UPDATE_BROADCAST !== '1') {
             writePendingClusterUpdateBroadcast(options.clusterBroadcastFile, {
@@ -339,23 +393,13 @@ export function performSelfUpdate(options) {
             });
         }
         console.log(`[OK] FoxClaw updated and restarted: ${options.version} -> ${toVersion}`);
-        return {
-            ok: true,
-            fromVersion: options.version,
-            toVersion,
-            error: null,
-        };
+        return { ok: true, fromVersion: options.version, toVersion, error: null };
     }
     catch (error) {
         const message = formatError(error);
         completeNotification(options.notificationFile, 'failed', toVersion, codexUpdate, message, null, agyUpdate);
         console.error(`[FAIL] FoxClaw update failed: ${message}`);
-        return {
-            ok: false,
-            fromVersion: options.version,
-            toVersion,
-            error: message,
-        };
+        return { ok: false, fromVersion: options.version, toVersion, error: message };
     }
 }
 export function readPendingClusterUpdateBroadcast(filePath) {
@@ -563,7 +607,7 @@ export function resolveFoxclawEntryPointFromGlobalRoot(globalRoot, exists = fs.e
     ];
     return candidates.find(candidate => exists(candidate)) ?? null;
 }
-export function resolveFoxclawEntryPointFromPnpmHome(pnpmHome, preferBin = false, exists = fs.existsSync, readText = (target) => fs.readFileSync(target, 'utf8')) {
+export function resolveFoxclawEntryPointFromPnpmHome(pnpmHome, preferBin = false, exists = fs.existsSync, readText = (target) => fs.readFileSync(target, 'utf8'), installationRoot) {
     const commandName = process.platform === 'win32' ? 'foxclaw.cmd' : 'foxclaw';
     const rootShim = path.join(pnpmHome, commandName);
     const binShim = path.join(pnpmHome, 'bin', commandName);
@@ -581,11 +625,23 @@ export function resolveFoxclawEntryPointFromPnpmHome(pnpmHome, preferBin = false
         const matches = contents.match(/(?:[A-Za-z]:[\\/]|\/)[^\r\n"']*?[\\/]node_modules[\\/]@foxden-app[\\/]foxclaw[\\/]dist[\\/]main\.js/g);
         const entryPoint = matches?.at(-1) ?? null;
         if (entryPoint && exists(entryPoint)) {
+            const relative = installationRoot ? path.relative(path.resolve(installationRoot), path.resolve(entryPoint)) : null;
+            if (relative !== null && (path.isAbsolute(relative) || relative === '..' || relative.startsWith(`..${path.sep}`))) {
+                continue;
+            }
             return entryPoint;
         }
     }
     return null;
 }
+export function resolveFoxclawEntryPointFromInstallation(globalRoot, pnpmHome, exists = fs.existsSync, readText = target => fs.readFileSync(target, 'utf8')) {
+    // The installer-owned root is authoritative. Another pnpm layout may have a stale shim.
+    const direct = resolveFoxclawEntryPointFromGlobalRoot(globalRoot, exists);
+    if (direct || !pnpmHome)
+        return direct;
+    const installationRoot = path.basename(globalRoot) === 'node_modules' ? path.dirname(globalRoot) : globalRoot;
+    return resolveFoxclawEntryPointFromPnpmHome(pnpmHome, /^v\d+$/.test(path.basename(globalRoot)), exists, readText, installationRoot);
+}
 function resolveUpdatedEntryPoint(installer, env) {
     const result = spawnSync(installer.command, installer.rootArgs, { encoding: 'utf8', env });
     if (result.error) {
@@ -598,10 +654,7 @@ function resolveUpdatedEntryPoint(installer, env) {
     if (!globalRoot) {
         throw new Error(`Could not locate the updated global package root using ${installer.manager}.`);
     }
-    const updatedEntryPoint = (installer.pnpmHome
-        ? resolveFoxclawEntryPointFromPnpmHome(installer.pnpmHome, /^v\d+$/.test(path.basename(globalRoot)))
-        : null)
-        ?? resolveFoxclawEntryPointFromGlobalRoot(globalRoot);
+    const updatedEntryPoint = resolveFoxclawEntryPointFromInstallation(globalRoot, installer.pnpmHome);
     if (!updatedEntryPoint) {
         throw new Error(`Updated FoxClaw entry point was not found below ${globalRoot} (checked direct and node_modules layouts).`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxden-app/foxclaw",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Foxden local execution claw for controlling Codex, OpenCode, Antigravity, and DeepSeek Harness from trusted chat interfaces.",
   "type": "module",
   "main": "dist/main.js",
@@ -58,11 +58,13 @@
     "@agentclientprotocol/sdk": "1.4.0",
     "@opencode-ai/sdk": "1.18.15",
     "dotenv": "^16.6.1",
-    "qrcode-terminal": "^0.12.0"
+    "qrcode-terminal": "^0.12.0",
+    "semver": "7.7.4"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.0",
     "@types/node": "^24.12.0",
+    "@types/semver": "7.7.1",
     "eslint": "^9.39.0",
     "tsx": "^4.19.3",
     "typescript": "5.9.3",