@jungjaehoon/mama-os 0.78.0 → 0.79.0

package/dist/cli/commands/update.js

@@ -0,0 +1,948 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.npmEnvironment = npmEnvironment;
+exports.runUpdate = runUpdate;
+exports.takeLock = takeLock;
+exports.doctorFailures = doctorFailures;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_util_1 = require("node:util");
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const db_manager_1 = require("@jungjaehoon/mama-core/db-manager");
+const viewer_server_js_1 = require("../../api/viewer-server.js");
+const package_version_js_1 = require("../../package-version.js");
+const backend_security_js_1 = require("../../runtime/backend-security.js");
+const config_js_1 = require("../../runtime/config.js");
+const migrations_source_js_1 = require("../../storage/migrations-source.js");
+const toolkit_state_js_1 = require("../../tools/toolkit-state.js");
+const launch_files_js_1 = require("../launch-files.js");
+const prompt_js_1 = require("../prompt.js");
+const daemon_control_js_1 = require("../runtime/daemon-control.js");
+const diagnostics_js_1 = require("../runtime/diagnostics.js");
+const backend_probe_js_1 = require("../runtime/backend-probe.js");
+const node_move_journal_js_1 = require("../runtime/node-move-journal.js");
+const install_kind_js_1 = require("../runtime/install-kind.js");
+const release_check_js_1 = require("../runtime/release-check.js");
+const backup_js_1 = require("../runtime/backup.js");
+const update_journal_js_1 = require("../runtime/update-journal.js");
+const update_progress_js_1 = require("../runtime/update-progress.js");
+const backup_js_2 = require("./backup.js");
+const node_move_js_1 = require("./node-move.js");
+const control_js_1 = require("./control.js");
+const init_js_1 = require("./init.js");
+const restore_js_1 = require("./restore.js");
+const service_js_1 = require("./service.js");
+const tools_js_1 = require("./tools.js");
+/*
+ * `mama update` (docs/development/work/update.md, PR 3) runs as two programs. The parent is the
+ * old code: everything it uses is imported above, statically, because the CLI's commands load
+ * lazily and from step 8 on its own files are renamed; from then it runs loaded code and Node's
+ * built-ins only (better-sqlite3's binding is loaded when step 1 takes update.lock). The child,
+ * `update --continue`, is the new code; a rollback finishes in the previous version's
+ * `update --rollback --continue`.
+ */
+const USAGE = 'Usage: mama update [<version>] [--dry-run] | mama update --rollback | mama update --node <folder>';
+/** How long the new version may take to boot, as `mama init` waits (init.ts). */
+const BOOT_WAIT_MS = 600_000;
+/** `npm install` and `npm rebuild` download or build the native modules; the rest answer quickly. */
+const NPM_INSTALL_TIMEOUT_MS = 15 * 60_000;
+const NPM_TIMEOUT_MS = 60_000;
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** The npm beside the pinned Node, run with that Node first on PATH: npm's `#!/usr/bin/env node`
+ * and the install scripts that pick native binaries then use the Node the daemon runs. */
+async function defaultNpm(args, nodePath, env) {
+    const { stdout } = await (0, node_util_1.promisify)(node_child_process_1.execFile)((0, node_path_1.join)((0, node_path_1.dirname)(nodePath), 'npm'), args, {
+        env: npmEnvironment(env, nodePath),
+        // A rebuild (the Node move's step 2) downloads or builds the native modules as an install does.
+        timeout: args[0] === 'install' || args[0] === 'rebuild' ? NPM_INSTALL_TIMEOUT_MS : NPM_TIMEOUT_MS,
+        maxBuffer: 16 * 1024 * 1024,
+        encoding: 'utf8',
+    });
+    return stdout;
+}
+/** npm's environment: already scrubbed, with the pinned Node's folder first on PATH. */
+function npmEnvironment(env, nodePath) {
+    return {
+        ...env,
+        PATH: [(0, node_path_1.dirname)(nodePath), ...(env.PATH ?? '').split(node_path_1.delimiter).filter(Boolean)].join(node_path_1.delimiter),
+    };
+}
+function defaultRunCli(nodePath, cliPath, args, env) {
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)(nodePath, [cliPath, ...args], { stdio: 'inherit', env });
+        // A Ctrl-C reaches the child as well; the child's end is what decides, and this side then
+        // rolls back, so the parent does not die with it.
+        const ignore = () => { };
+        process.on('SIGINT', ignore);
+        process.on('SIGTERM', ignore);
+        const done = () => {
+            process.off('SIGINT', ignore);
+            process.off('SIGTERM', ignore);
+        };
+        child.once('error', (error) => {
+            done();
+            reject(error);
+        });
+        child.once('exit', (code, signal) => {
+            done();
+            resolve({ code, signal });
+        });
+    });
+}
+async function defaultNodeVersion(nodePath) {
+    const { stdout } = await (0, node_util_1.promisify)(node_child_process_1.execFile)(nodePath, ['--version'], {
+        timeout: NPM_TIMEOUT_MS,
+        encoding: 'utf8',
+    });
+    const version = /^v(\d+\.\d+\.\d+)$/.exec(stdout.trim())?.[1];
+    if (version === undefined) {
+        throw new Error(`${nodePath} --version printed ${JSON.stringify(stdout.trim().slice(0, 80))}`);
+    }
+    return version;
+}
+function defaultDeps(options, home, configPath) {
+    const service = { ...options, home, configPath };
+    const write = options.write;
+    const env = options.env ?? process.env;
+    const waitSetting = env.MAMA_UPDATE_WAIT_MS;
+    const wait = waitSetting === undefined ? BOOT_WAIT_MS : Number(waitSetting);
+    if (!Number.isSafeInteger(wait) || wait <= 0) {
+        throw new prompt_js_1.CliInputError(`MAMA_UPDATE_WAIT_MS must be a whole number of milliseconds above 0, not ${JSON.stringify(waitSetting)}`);
+    }
+    return {
+        npm: defaultNpm,
+        stop: async (now) => await (0, control_js_1.runStop)(now ? ['--now'] : [], service),
+        start: async () => {
+            await (0, service_js_1.startService)(service);
+        },
+        installService: async (nodePath, cliPath) => {
+            await (0, service_js_1.installService)([], { ...service, nodePath, cliPath });
+        },
+        backup: async (prefix, now) => await (0, backup_js_2.runBackup)(['--include-secrets'], {
+            ...service,
+            archivePrefix: prefix,
+            now: () => now,
+        }),
+        serviceRuns: () => (0, service_js_1.serviceRuns)(service),
+        restore: async (archive) => await (0, restore_js_1.runRestore)([archive], { home, configPath, write, updateRollback: true }),
+        toolsInstall: async () => await (0, tools_js_1.runTools)(['install'], { home, configPath, write }),
+        diagnostics: async () => await (0, diagnostics_js_1.runDiagnostics)({ home, configPath, offline: true }),
+        control: async (op) => await (0, daemon_control_js_1.requestDaemonControl)((0, daemon_control_js_1.daemonControlPaths)((0, node_path_1.dirname)(configPath)), op, 10_000),
+        health: init_js_1.viewerHealth,
+        runCli: defaultRunCli,
+        lock: takeLock,
+        nodeVersion: defaultNodeVersion,
+        nodeCheck: async (nodePath, cliPath) => (0, diagnostics_js_1.nodeCheck)(nodePath, cliPath, backend_probe_js_1.defaultProbeRun, (0, node_path_1.dirname)(configPath)),
+        version: package_version_js_1.resolvePackageVersion,
+        runningPackage: install_kind_js_1.runningPackageRoot,
+        telegramCall: diagnostics_js_1.defaultTelegramCall,
+        // The release checks shorten the wait so a candidate that never boots fails in minutes.
+        bootWaitMs: wait,
+        pollMs: 1_000,
+    };
+}
+function parse(args) {
+    const flags = new Set(args.filter((arg) => arg.startsWith('--')));
+    const words = args.filter((arg) => !arg.startsWith('--'));
+    const only = (...names) => flags.size === names.length && names.every((name) => flags.has(name)) && words.length === 0;
+    if (only('--continue'))
+        return { kind: 'continue' };
+    if (only('--rollback'))
+        return { kind: 'rollback' };
+    if (only('--rollback', '--continue'))
+        return { kind: 'rollback-continue' };
+    if (args.length === 2 && args[0] === '--node' && !args[1].startsWith('--')) {
+        return { kind: 'node', folder: args[1] };
+    }
+    if ([...flags].every((flag) => flag === '--dry-run') && flags.size <= 1 && words.length <= 1) {
+        const version = words[0] ?? null;
+        if (version !== null && !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+            throw new prompt_js_1.CliInputError(`${USAGE} (a version such as 0.79.0)`);
+        }
+        return { kind: 'update', version, dryRun: flags.has('--dry-run') };
+    }
+    throw new prompt_js_1.CliInputError(USAGE);
+}
+async function runUpdate(args, options = {}) {
+    const mode = parse(args);
+    const home = options.home ?? (0, node_os_1.homedir)();
+    const configPath = options.configPath ?? (0, config_js_1.defaultConfigPath)(home);
+    const root = (0, node_path_1.dirname)(configPath);
+    const write = options.write ?? ((line) => console.log(line));
+    const deps = { ...defaultDeps(options, home, configPath), ...options.deps };
+    const env = (0, backend_security_js_1.backendEnvironment)(options.env ?? process.env);
+    const context = {
+        home,
+        configPath,
+        root,
+        paths: (0, update_journal_js_1.updatePaths)(root),
+        write,
+        deps,
+        env,
+        progress: progressSink(env, root, write, deps.telegramCall),
+    };
+    try {
+        if (mode.kind === 'continue')
+            return await continueUpdate(context);
+        if (mode.kind === 'rollback-continue')
+            return await finishRollback(context);
+        if (mode.kind === 'rollback')
+            return await resolveJournal(context);
+        if (mode.kind === 'node')
+            return await (0, node_move_js_1.moveNode)(context, mode.folder, options);
+        return await update(context, mode.version, mode.dryRun, options);
+    }
+    catch (error) {
+        context.progress.send({ kind: 'error', code: errorCode(error) });
+        throw error;
+    }
+    finally {
+        await context.progress.flush();
+    }
+}
+/**
+ * An /update's job sets `MAMA_UPDATE_PROGRESS=telegram` (runtime/update.sh); the children it runs
+ * inherit it, so the new version's steps and a rollback report to the same chat.
+ */
+function progressSink(env, root, write, call) {
+    const setting = env.MAMA_UPDATE_PROGRESS;
+    if (setting === undefined)
+        return update_progress_js_1.NO_PROGRESS;
+    if (setting !== 'telegram') {
+        throw new prompt_js_1.CliInputError(`MAMA_UPDATE_PROGRESS must be telegram or unset, not ${JSON.stringify(setting)}`);
+    }
+    return (0, update_progress_js_1.telegramProgress)({ root, log: write, call });
+}
+/** A refusal with the stable code an /update's progress carries instead of its text. */
+function refusal(code, text) {
+    return Object.assign(new prompt_js_1.CliInputError(text), { code });
+}
+/** What the chat is told of an error: its code, or whether it was a refusal. */
+function errorCode(error) {
+    return ((0, update_progress_js_1.progressCode)(error?.code) ??
+        (error instanceof prompt_js_1.CliInputError ? 'refused' : 'error'));
+}
+/**
+ * One updater per install: `update.lock` (which `/update`, PR 4, reads before it starts one), and
+ * the continuation's own lock for the child's life.
+ */
+function takeLock(paths, command) {
+    try {
+        return (0, daemon_control_js_1.acquireInstallLock)(paths, command);
+    }
+    catch (error) {
+        if (!(error instanceof daemon_control_js_1.InstallBusyError))
+            throw error;
+        const holder = error.holder;
+        throw refusal('update.busy', holder === null
+            ? `Another mama update holds ${paths.lockPath}`
+            : `Already updating since ${new Date(holder.startedAt).toLocaleString('sv-SE')} (${holder.command}, pid ${holder.pid})`);
+    }
+}
+/**
+ * The continuation child's lock, for as long as it writes the journal. Its parent holds
+ * update.lock; a parent killed meanwhile frees that one, and `--rollback` then finds this one held
+ * and waits, instead of a second writer acting on the same journal.
+ */
+function takeContinuation(context, command) {
+    return context.deps.lock(context.paths.continuation, command);
+}
+/** Refuse while a continuation child (a killed parent's) still runs. */
+function refuseWhileContinuing(paths) {
+    const child = (0, daemon_control_js_1.lockHolder)(paths.continuation);
+    if (child !== null) {
+        throw new prompt_js_1.CliInputError(`The update's ${child.command} (pid ${child.pid}) still runs and writes the journal; wait for it to end, then run this again`);
+    }
+}
+function packageManifest(packageRoot) {
+    const manifest = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(packageRoot, 'package.json'), 'utf8'));
+    const bin = typeof manifest.bin === 'string'
+        ? [String(manifest.name).split('/').pop()]
+        : Object.keys((manifest.bin ?? {}));
+    return { version: String(manifest.version), bin: bin.sort() };
+}
+/** Failures as `mama update` compares them: name and code, or name and detail without one. */
+function doctorFailures(checks) {
+    return checks
+        .filter((check) => check.status === 'fail')
+        .map((check) => ({ name: check.name, code: check.code ?? check.detail }));
+}
+function schemaStored(databasePath) {
+    return (0, db_manager_1.readSchemaState)(databasePath, [
+        { name: db_manager_1.CORE_MIGRATION_SOURCE, dir: db_manager_1.MIGRATIONS_DIR },
+        migrations_source_js_1.STANDALONE_MIGRATION_SOURCE,
+    ]).map(({ name, stored }) => ({ name, stored }));
+}
+function readOnly(databasePath, read) {
+    const db = new better_sqlite3_1.default(databasePath, { readonly: true, fileMustExist: true });
+    try {
+        return read(db);
+    }
+    finally {
+        db.close();
+    }
+}
+function lastInputId(databasePath) {
+    return readOnly(databasePath, (db) => db.prepare('SELECT MAX(id) AS id FROM mailbox_inputs').get().id ??
+        0);
+}
+function inputsAfter(databasePath, id) {
+    return readOnly(databasePath, (db) => db.prepare('SELECT COUNT(*) AS count FROM mailbox_inputs WHERE id > ?').get(id).count);
+}
+function sha256(path) {
+    return (0, node_crypto_1.createHash)('sha256').update((0, node_fs_1.readFileSync)(path)).digest('hex');
+}
+/** The installed toolkit's requirements hash, or null when none is installed. */
+function toolkitHash(toolsRoot) {
+    const toolkit = (0, toolkit_state_js_1.readDocumentToolkit)(toolsRoot);
+    if (toolkit === null)
+        return null;
+    return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(toolkit.versionDir, 'manifest.json'), 'utf8')).requirementsSha256;
+}
+/** Copy a file over another by a rename, so a reader sees the old one or the new one. */
+function copyOver(from, to) {
+    const staged = `${to}.${process.pid}.update`;
+    (0, node_fs_1.copyFileSync)(from, staged);
+    (0, node_fs_1.renameSync)(staged, to);
+}
+/** Write the journal; a step it begins is the step an /update's progress reports. */
+function save(context, journal) {
+    (0, update_journal_js_1.writeUpdateJournal)(context.paths.journal, journal);
+    if (journal.phase === 'prepare' || journal.phase === 'candidate') {
+        context.progress.send({ kind: 'step', from: journal.from, to: journal.to, step: journal.step });
+    }
+}
+function statusSummary(reply) {
+    if (reply === null)
+        return 'the daemon does not answer its control socket';
+    if (reply.state === 'stopped')
+        return 'the daemon is stopped';
+    if (reply.reply.ok !== true)
+        return `the daemon refused status: ${String(reply.reply.error)}`;
+    const status = reply.reply.status;
+    const turns = (status.runningTurns ?? []).reduce((sum, turn) => sum + turn.count, 0);
+    const waiting = (status.inputs ?? []).map((input) => `${input.count} ${input.status}`);
+    return `the daemon runs ${String(status.version)} (${String(status.stage)}); ${turns} turn${turns === 1 ? '' : 's'} running; inputs ${waiting.length === 0 ? 'none waiting' : waiting.join(', ')}`;
+}
+/** Steps 1-9, the parent: the old code. */
+async function update(context, version, dryRun, options) {
+    const { home, root, write, deps, env, paths } = context;
+    // Step 1: the kind and the package.
+    const install = (0, install_kind_js_1.installKind)(root, home);
+    if (install.kind === 'checkout') {
+        write(`mama update serves npm installs; the service runs the checkout ${install.workspaceRoot}, which updates by git:`);
+        for (const step of (0, install_kind_js_1.updateSteps)(install))
+            write(`  ${step}`);
+        return 1;
+    }
+    (0, install_kind_js_1.requireServicePackage)(install, deps.runningPackage());
+    // Nothing else would start the daemon again after the stop (decision 7), and only start.sh
+    // reads the hold file.
+    (0, node_move_js_1.requireHoldingService)(root, options);
+    (0, daemon_control_js_1.refuseWhileRestoring)(root);
+    const lock = deps.lock(paths.lock, 'update');
+    try {
+        const open = (0, update_journal_js_1.readUpdateJournal)(paths.journal);
+        if (open !== null) {
+            throw refusal('update.open', `An earlier update (${open.from} → ${open.to}) is unfinished; resolve it first: ${(0, update_journal_js_1.rollbackCommand)(open)}`);
+        }
+        const move = (0, node_move_journal_js_1.readNodeMoveJournal)((0, node_move_journal_js_1.nodeMovePlaces)(root).journal);
+        if (move !== null) {
+            throw refusal('node_move.open', `A move of the managed Node (${move.from} → ${move.to}) is unfinished; run the install command again, which finishes or undoes it: ${node_move_journal_js_1.INSTALL_COMMAND}`);
+        }
+        // Read now: from step 8 on, this package's own files are elsewhere.
+        const old = packageManifest(install.packageRoot);
+        const from = old.version;
+        const packageCli = (0, node_path_1.relative)(install.packageRoot, (0, node_fs_1.realpathSync)(install.cliPath));
+        const leftovers = (0, update_journal_js_1.leftoverStaging)((0, node_path_1.dirname)(install.packageRoot));
+        // Step 2: the target.
+        const npm = (args) => deps.npm(args, install.nodePath, env);
+        const prefixArgs = ['--prefix', install.prefix, '--no-update-notifier'];
+        let registry = '';
+        let target;
+        try {
+            registry = (await npm(['config', 'get', 'registry', ...prefixArgs])).trim();
+            target = (await npm([
+                'view',
+                `${install_kind_js_1.PACKAGE_NAME}@${version ?? 'latest'}`,
+                'version',
+                '--registry',
+                registry,
+                ...prefixArgs,
+            ])).trim();
+        }
+        catch (error) {
+            throw refusal(`npm.${(0, release_check_js_1.npmErrorCode)(error)}`, `Could not ask ${registry || 'the registry'} for ${install_kind_js_1.PACKAGE_NAME}@${version ?? 'latest'}: npm ${(0, release_check_js_1.npmErrorCode)(error)}; nothing changed`);
+        }
+        if (!/^\d+\.\d+\.\d+\S*$/.test(target)) {
+            throw refusal('npm.no_version', `${registry} has no single ${install_kind_js_1.PACKAGE_NAME}@${version ?? 'latest'} (npm printed ${JSON.stringify(target.slice(0, 80))}); nothing changed`);
+        }
+        const order = (0, release_check_js_1.compareReleases)(target, from);
+        if (order === 0) {
+            write(`already on ${from}`);
+            context.progress.send({ kind: 'current', version: from });
+            return 0;
+        }
+        if (order < 0) {
+            // R5: the newer version may have migrated the database past what the older one reads.
+            throw refusal('update.older', `Refused: ${target} is older than ${from}, which runs now; mama update does not go back a version`);
+        }
+        // The target runs on start.sh's Node, which the update does not change.
+        let engines;
+        try {
+            engines = (await npm([
+                'view',
+                `${install_kind_js_1.PACKAGE_NAME}@${target}`,
+                'engines.node',
+                '--registry',
+                registry,
+                ...prefixArgs,
+            ])).trim();
+        }
+        catch (error) {
+            throw refusal(`npm.${(0, release_check_js_1.npmErrorCode)(error)}`, `Could not ask ${registry} for ${install_kind_js_1.PACKAGE_NAME}@${target}'s engines: npm ${(0, release_check_js_1.npmErrorCode)(error)}; nothing changed`);
+        }
+        if (engines !== '') {
+            const running = await deps.nodeVersion(install.nodePath);
+            let fits;
+            try {
+                fits = (0, release_check_js_1.nodeSatisfies)(engines, running);
+            }
+            catch (error) {
+                throw refusal('update.engines', `Refused: ${target}'s ${message(error)}; nothing changed`);
+            }
+            if (!fits) {
+                throw refusal('update.engines', `Refused: ${target} needs Node.js ${engines} (its engines), and start.sh runs ${running}; nothing changed. ${install.nodePath === (0, node_move_journal_js_1.managedNodePath)(root)
+                    ? `Run the install command again, which moves the managed Node: ${node_move_journal_js_1.INSTALL_COMMAND}`
+                    : 'Install a Node in that range, run mama service install with it, then mama update'}`);
+            }
+        }
+        // Step 3: what doctor fails on already is not held against the new version.
+        const failuresBefore = doctorFailures(await deps.diagnostics());
+        // Step 4: the plan.
+        const places = (0, update_journal_js_1.packagePlaces)(install.prefix, from, target);
+        const now = await deps.control('status').catch(() => null);
+        write(`update: ${install_kind_js_1.PACKAGE_NAME} ${from} → ${target} (npm install, prefix ${install.prefix})`);
+        write(`registry: ${registry}`);
+        write(`now: ${statusSummary(now)}`);
+        if (failuresBefore.length > 0) {
+            write(`doctor fails already on: ${failuresBefore.map((failure) => failure.name).join(', ')} (not held against ${target})`);
+        }
+        for (const leftover of leftovers) {
+            write(`${dryRun ? 'would remove' : 'removing'} ${leftover}, left by an interrupted update`);
+        }
+        write('steps:');
+        for (const line of [
+            `stage ${target} in ${places.staging}; a failure changes nothing`,
+            'drain: new inputs wait, running turns finish; then stop the service',
+            `snapshot the install to ${(0, node_path_1.join)(root, 'backups', `mama-update-${from}-<time>.tar.gz`)} (credentials included)`,
+            `swap: ${places.package} goes to ${places.aside}, ${target} takes its place`,
+            `${target} rewrites start.sh and the service file, runs doctor, starts with its claims held, and is confirmed once it runs and its viewer answers`,
+            `on any failure, ${from} is put back and started; the database is restored only if ${target} migrated it`,
+        ]) {
+            write(`  ${line}`);
+        }
+        if (dryRun)
+            return 0;
+        context.progress.send({ kind: 'plan', from, to: target });
+        for (const leftover of leftovers)
+            (0, node_fs_1.rmSync)(leftover, { recursive: true, force: true });
+        // Step 5: stage.
+        write(`staging ${target}`);
+        context.progress.send({ kind: 'step', from, to: target, step: 5 });
+        try {
+            await npm([
+                'install',
+                '-g',
+                '--prefix',
+                places.staging,
+                `${install_kind_js_1.PACKAGE_NAME}@${target}`,
+                '--registry',
+                registry,
+                '--no-update-notifier',
+                '--no-audit',
+                '--no-fund',
+            ]);
+        }
+        catch (error) {
+            (0, node_fs_1.rmSync)(places.staging, { recursive: true, force: true });
+            throw refusal(`npm.${(0, release_check_js_1.npmErrorCode)(error)}`, `Staging ${target} failed: npm ${(0, release_check_js_1.npmErrorCode)(error)}; nothing else changed`);
+        }
+        const staged = (0, node_fs_1.existsSync)(places.staged) ? packageManifest(places.staged) : null;
+        // The links in <prefix>/bin name the old package's commands, and the swap keeps them.
+        if (staged?.version !== target || staged.bin.join(' ') !== old.bin.join(' ')) {
+            (0, node_fs_1.rmSync)(places.staging, { recursive: true, force: true });
+            throw refusal(staged === null || staged.version !== target ? 'update.not_staged' : 'update.bin_changed', staged === null || staged.version !== target
+                ? `npm did not stage ${target} at ${places.staged}; nothing else changed`
+                : `${target}'s commands (${staged.bin.join(', ')}) are not ${from}'s (${old.bin.join(', ')}); the swap would leave its links wrong, so install it with npm install -g ${install_kind_js_1.PACKAGE_NAME}@${target}`);
+        }
+        // Step 6: the journal, the drain, the stop.
+        const journal = {
+            format: 'mama-update',
+            phase: 'prepare',
+            step: 6,
+            from,
+            to: target,
+            prefix: install.prefix,
+            registry,
+            nodePath: install.nodePath,
+            packageCli,
+            previousCli: (0, node_path_1.join)(places.aside, packageCli),
+            failuresBefore,
+            snapshot: null,
+            snapshotStaging: null,
+            schemaBefore: null,
+            lastInputId: null,
+            toolkitBefore: null,
+            toolkitInstalled: false,
+            copies: [],
+            failure: null,
+            startedAt: new Date().toISOString(),
+        };
+        save(context, journal);
+        if ((await deps.stop(false)) !== 0) {
+            (0, update_journal_js_1.removeUpdateJournal)(paths.journal);
+            (0, node_fs_1.rmSync)(places.staging, { recursive: true, force: true });
+            context.progress.send({
+                kind: 'not_updated',
+                from,
+                to: target,
+                step: 6,
+                code: 'stop.failed',
+            });
+            // A stop can fail after the service manager took it (a release that took too long), so the
+            // install may be down now; this names which, as mama backup --restart does.
+            write(deps.serviceRuns()
+                ? `not updated: the stop did not finish (above); ${from} stays installed and still runs`
+                : `not updated: the stop did not finish cleanly (above) and the service is not running; ${from} stays installed, and mama service start starts it again`);
+            return 1;
+        }
+        // From the stop on, a start (a reboot, an owner's mama service start) finds the hold and
+        // exits: a parent that dies after the stop leaves the install stopped, not half-changed.
+        (0, node_fs_1.writeFileSync)(paths.hold, `${process.pid}\n`, { mode: 0o600 });
+        // Step 7: the snapshot, what the rollback compares with, and the launch files. Its files are
+        // named first, so an update cut off mid-backup removes what that backup left.
+        const startedBackup = new Date();
+        const planned = (0, backup_js_1.backupFiles)((0, node_path_1.join)((0, node_fs_1.realpathSync)(root), 'backups'), startedBackup, `mama-update-${from}`);
+        journal.step = 7;
+        journal.snapshot = planned.final;
+        journal.snapshotStaging = planned.staging;
+        save(context, journal);
+        try {
+            // Named by the same backupFiles as the journal's planned paths; the rollback restores and
+            // removes the journal's path, so any other one is an error, not a snapshot.
+            const archive = await deps.backup(`mama-update-${from}`, startedBackup);
+            if (archive !== planned.final) {
+                (0, node_fs_1.rmSync)(archive, { force: true });
+                throw new Error(`the snapshot was written to ${archive}, not ${planned.final}`);
+            }
+            const config = (0, config_js_1.loadConfig)({ home, path: context.configPath, onIgnored: () => { } });
+            journal.schemaBefore = schemaStored(config.database.path);
+            journal.lastInputId = lastInputId(config.database.path);
+            journal.toolkitBefore = toolkitHash(config.tools_root);
+            (0, node_fs_1.mkdirSync)(paths.copies, { recursive: true, mode: 0o700 });
+            journal.copies = [(0, node_path_1.join)(root, 'start.sh'), (0, service_js_1.serviceFile)(options)].map((path) => {
+                const copy = (0, node_path_1.join)(paths.copies, path.split('/').pop());
+                (0, node_fs_1.copyFileSync)(path, copy);
+                return { path, copy };
+            });
+            save(context, journal);
+        }
+        catch (error) {
+            write(`not updated: ${message(error)}`);
+            context.progress.send({
+                kind: 'not_updated',
+                from,
+                to: target,
+                step: 7,
+                code: (0, update_progress_js_1.progressCode)(error.code) ?? 'snapshot.failed',
+            });
+            (0, update_journal_js_1.removeSnapshot)(journal);
+            (0, node_fs_1.rmSync)(paths.copies, { recursive: true, force: true });
+            (0, node_fs_1.rmSync)(places.staging, { recursive: true, force: true });
+            // The hold goes before the journal: a cut here leaves a journal, which names its fix.
+            (0, node_fs_1.rmSync)(paths.hold, { force: true });
+            (0, update_journal_js_1.removeUpdateJournal)(paths.journal);
+            try {
+                await deps.start();
+                write(`${from} started again`);
+            }
+            catch (startError) {
+                write(`${from} did not start again either: ${message(startError)} (mama service start)`);
+            }
+            return 1;
+        }
+        // Step 8: the swap, on the hold written after the stop. From here a failure rolls back.
+        try {
+            journal.step = 8;
+            save(context, journal);
+            (0, node_fs_1.renameSync)(places.package, places.aside);
+            (0, node_fs_1.renameSync)(places.staged, places.package);
+        }
+        catch (error) {
+            journal.failure = { step: 8, message: message(error) };
+            await rollBack(context, journal);
+            return 1;
+        }
+        // Step 9: the new version carries on.
+        journal.step = 9;
+        save(context, journal);
+        // The new version's own reports come after this one's.
+        await context.progress.flush();
+        let result;
+        try {
+            result = await deps.runCli(journal.nodePath, (0, node_path_1.join)(places.package, packageCli), ['update', '--continue'], env);
+        }
+        catch (error) {
+            result = { code: null, signal: null };
+            journal.failure = { step: 9, message: `the new version did not start: ${message(error)}` };
+            save(context, journal);
+        }
+        const after = (0, update_journal_js_1.readUpdateJournal)(paths.journal);
+        if (after === null)
+            return result.code === 0 ? 0 : 1;
+        // Committed: the candidate may have run inputs, so it is finished, never rolled back.
+        if (after.phase === 'committed')
+            return await finishCommitted(context, after);
+        after.failure ??= {
+            step: after.step,
+            message: result.signal !== null
+                ? `the new version's update ended on ${result.signal}`
+                : `the new version's update exited ${String(result.code)} at step ${after.step}`,
+        };
+        await rollBack(context, after);
+        return 1;
+    }
+    finally {
+        lock.release();
+    }
+}
+/**
+ * Steps 10-14, the child: the new code, under the parent's update.lock. A failure records its
+ * step and exits non-zero; the parent rolls back.
+ */
+async function continueUpdate(context) {
+    const own = takeContinuation(context, 'update --continue');
+    try {
+        return await continueUpdateHeld(context);
+    }
+    finally {
+        own.release();
+    }
+}
+/** What to print when the parent that would roll back is gone. */
+function orphanNote(context, journal) {
+    return (0, daemon_control_js_1.lockHolder)(context.paths.lock) === null
+        ? `; the updater that started this is gone, so roll back with: ${(0, update_journal_js_1.rollbackCommand)(journal)}`
+        : '';
+}
+async function continueUpdateHeld(context) {
+    const { home, root, write, deps, paths } = context;
+    const journal = (0, update_journal_js_1.readUpdateJournal)(paths.journal);
+    if (journal === null || journal.phase !== 'prepare' || journal.step < 9) {
+        throw new prompt_js_1.CliInputError('mama update --continue runs only under mama update');
+    }
+    if (deps.version() !== journal.to) {
+        throw new prompt_js_1.CliInputError(`This is ${deps.version()}; the update continues in ${journal.to}`);
+    }
+    const places = (0, update_journal_js_1.packagePlaces)(journal.prefix, journal.from, journal.to);
+    const step = (number) => {
+        journal.step = number;
+        save(context, journal);
+    };
+    try {
+        // Step 10: start.sh and the service file from this version's templates.
+        step(10);
+        await deps.installService(journal.nodePath, (0, node_path_1.join)(places.package, journal.packageCli));
+        // Step 11: nothing doctor did not fail on before; this update's own journal does not count.
+        step(11);
+        const fresh = doctorFailures(await deps.diagnostics()).filter((failure) => failure.code !== 'update.open' &&
+            !journal.failuresBefore.some((before) => before.name === failure.name && before.code === failure.code));
+        if (fresh.length > 0) {
+            throw Object.assign(new Error(`mama doctor --offline fails where it did not before: ${fresh.map((failure) => `${failure.name} (${failure.code})`).join(', ')}`), 
+            // The first new failure's stable code, for an /update's chat; a detail is not a code.
+            { code: (0, update_progress_js_1.progressCode)(fresh[0].code) ?? 'doctor.failed' });
+        }
+        // Step 12: the toolkit, when this version locks other requirements.
+        step(12);
+        const lock = sha256((0, node_path_1.join)(toolkit_state_js_1.TOOLKIT_ASSETS, 'requirements.lock'));
+        if (journal.toolkitBefore !== null && journal.toolkitBefore !== lock) {
+            journal.toolkitInstalled = true;
+            save(context, journal);
+            await deps.toolsInstall();
+        }
+        // Step 13: the candidate boots with its claims held, so its recovery runs nothing.
+        journal.phase = 'candidate';
+        step(13);
+        (0, node_fs_1.rmSync)(paths.hold, { force: true });
+        await deps.start();
+        // Step 14: running at this version, and its viewer answers.
+        step(14);
+        const port = (0, viewer_server_js_1.resolveApiPort)((0, launch_files_js_1.startExports)((0, launch_files_js_1.readStartScript)((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'start.sh'), 'utf8'), home))
+            .MAMA_API_PORT);
+        await (0, init_js_1.waitForBoot)({
+            status: () => deps.control('status'),
+            health: () => deps.health(port),
+            timeoutMs: deps.bootWaitMs,
+            pollMs: deps.pollMs,
+            write,
+            version: journal.to,
+            next: `the update rolls back to ${journal.from}`,
+        });
+    }
+    catch (error) {
+        journal.failure = { step: journal.step, message: message(error) };
+        save(context, journal);
+        write(`update step ${journal.step} failed: ${message(error)}${orphanNote(context, journal)}`);
+        context.progress.send({
+            kind: 'failed',
+            from: journal.from,
+            to: journal.to,
+            step: journal.step,
+            code: (0, update_progress_js_1.progressCode)(error?.code),
+        });
+        return 1;
+    }
+    // On disk before the release: from here the candidate claims, and nothing rolls it back.
+    journal.phase = 'committed';
+    save(context, journal);
+    return await finishCommitted(context, journal);
+}
+/** Step 14's end: release the candidate's claims, delete what the rollback would have needed. */
+async function finishCommitted(context, journal) {
+    const { paths, write, deps } = context;
+    const reply = await deps.control('release');
+    if (reply.state === 'running' && reply.reply.ok !== true) {
+        throw new prompt_js_1.CliInputError(`${journal.to} refused the release: ${String(reply.reply.error)}; ${(0, update_journal_js_1.rollbackCommand)(journal)} finishes it`);
+    }
+    const places = (0, update_journal_js_1.packagePlaces)(journal.prefix, journal.from, journal.to);
+    (0, update_journal_js_1.removeSnapshot)(journal);
+    (0, node_fs_1.rmSync)(paths.copies, { recursive: true, force: true });
+    (0, node_fs_1.rmSync)(places.aside, { recursive: true, force: true });
+    (0, node_fs_1.rmSync)(places.staging, { recursive: true, force: true });
+    (0, node_fs_1.rmSync)(paths.hold, { force: true });
+    // Last: a cleanup cut off leaves a committed journal, which --rollback finishes.
+    (0, update_journal_js_1.removeUpdateJournal)(paths.journal);
+    context.progress.send({
+        kind: 'updated',
+        from: journal.from,
+        to: journal.to,
+        running: reply.state === 'running',
+    });
+    write(reply.state === 'running'
+        ? `updated: ${journal.from} → ${journal.to}; it runs and claims again`
+        : `updated: ${journal.from} → ${journal.to}; the daemon is not running now (mama service start)`);
+    // An install the install command made: the new release's Node pin, which only that command
+    // moves to (install.md, "Moving the managed Node").
+    if (journal.nodePath === (0, node_move_journal_js_1.managedNodePath)(context.root)) {
+        const pin = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(places.package, 'install', 'node.json'), 'utf8')).version;
+        const running = await deps.nodeVersion(journal.nodePath);
+        if (pin !== running) {
+            write(`  ${journal.to} pins Node.js ${pin}, and MAMA runs on ${running}: run the install command again to move it: ${node_move_journal_js_1.INSTALL_COMMAND}`);
+        }
+    }
+    return 0;
+}
+/** `mama update --rollback`: resolve the journal a killed updater left. */
+async function resolveJournal(context) {
+    const lock = context.deps.lock(context.paths.lock, 'update --rollback');
+    try {
+        refuseWhileContinuing(context.paths);
+        const journal = (0, update_journal_js_1.readUpdateJournal)(context.paths.journal);
+        if (journal === null) {
+            context.write('no update is unfinished');
+            return 0;
+        }
+        if (journal.phase === 'committed')
+            return await finishCommitted(context, journal);
+        journal.failure ??= {
+            step: journal.step,
+            message: `the updater ended at step ${journal.step}`,
+        };
+        return (await rollBack(context, journal)) ? 0 : 1;
+    }
+    finally {
+        lock.release();
+    }
+}
+/**
+ * The rollback's stop. A daemon that answers as the held candidate runs nothing, and one that does
+ * not answer has nothing to drain: `--now`. One that answers without a hold claims work (the old
+ * version a rollback already started, or a daemon the stop at step 6 never reached), so it drains.
+ */
+async function stopForRollback(context, journal) {
+    const reply = await context.deps.control('status').catch(() => null);
+    const status = reply?.state === 'running' && reply.reply.ok === true
+        ? reply.reply.status
+        : null;
+    // The control socket answers before boot reads the journal, so a candidate restarted under
+    // KeepAlive can answer without its hold yet: at `candidate`, running at <to> is the candidate.
+    const heldCandidate = journal.phase === 'candidate' &&
+        (status?.update?.to === journal.to || status?.version === journal.to);
+    return await context.deps.stop(status === null || heldCandidate);
+}
+/**
+ * Rollback steps 1-3, in whichever CLI runs (the parent, or `--rollback`): stop, hold, put the
+ * previous package back, and hand the rest to it. Only renames and the service manager's stop,
+ * so it runs from loaded code. True when the previous version runs again.
+ */
+async function rollBack(context, journal) {
+    const { paths, write, deps, env } = context;
+    const places = (0, update_journal_js_1.packagePlaces)(journal.prefix, journal.from, journal.to);
+    write(`rolling back to ${journal.from}: step ${journal.failure?.step ?? journal.step} failed: ${journal.failure?.message ?? 'unknown'}`);
+    context.progress.send({ kind: 'rolling_back', from: journal.from, to: journal.to });
+    try {
+        if ((await stopForRollback(context, journal)) !== 0)
+            throw new Error('the service did not stop');
+        (0, node_fs_1.writeFileSync)(paths.hold, `${process.pid}\n`, { mode: 0o600 });
+        // The previous version boots without a hold from here.
+        journal.phase = 'rollback';
+        save(context, journal);
+        if ((0, node_fs_1.existsSync)(places.aside)) {
+            if ((0, node_fs_1.existsSync)(places.package)) {
+                (0, node_fs_1.rmSync)(places.staged, { recursive: true, force: true });
+                (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(places.staged), { recursive: true });
+                (0, node_fs_1.renameSync)(places.package, places.staged);
+            }
+            (0, node_fs_1.renameSync)(places.aside, places.package);
+        }
+        await context.progress.flush();
+        const result = await deps.runCli(journal.nodePath, (0, node_path_1.join)(places.package, journal.packageCli), ['update', '--rollback', '--continue'], env);
+        if (result.code === 0)
+            return true;
+        context.progress.send({ kind: 'rollback_stopped', from: journal.from, to: journal.to });
+        // What it printed may be cut off (a signal); the failed step and the command are said here.
+        (0, node_fs_1.writeFileSync)(paths.hold, `${process.pid}\n`, { mode: 0o600 });
+        const current = (0, update_journal_js_1.readUpdateJournal)(paths.journal) ?? journal;
+        write(`rollback did not finish: ${journal.from}'s update --rollback --continue ${result.signal === null ? `exited ${String(result.code)}` : `ended on ${result.signal}`}; the update had failed at step ${current.failure?.step ?? current.step}: ${current.failure?.message ?? 'unknown'}. The hold file is in place. Resolve it with: ${(0, update_journal_js_1.rollbackCommand)(current)}`);
+        return false;
+    }
+    catch (error) {
+        (0, node_fs_1.writeFileSync)(paths.hold, `${process.pid}\n`, { mode: 0o600 });
+        context.progress.send({ kind: 'rollback_stopped', from: journal.from, to: journal.to });
+        const current = (0, update_journal_js_1.readUpdateJournal)(paths.journal) ?? journal;
+        write(`rollback stopped: ${message(error)}. The install stays stopped on its hold file; the journal, the snapshot and both package folders are kept. Resolve it with: ${(0, update_journal_js_1.rollbackCommand)(current)}`);
+        return false;
+    }
+}
+/** Rollback steps 4-7, in the previous version's CLI with its package back in place. */
+async function finishRollback(context) {
+    const own = takeContinuation(context, 'update --rollback --continue');
+    try {
+        return await finishRollbackHeld(context);
+    }
+    finally {
+        own.release();
+    }
+}
+/**
+ * `npm ls -g --json`'s answer for MAMA OS. npm exits 1 for problems elsewhere in the prefix
+ * (ELSPROBLEMS) and still prints the tree, so the tree decides, not the exit.
+ */
+async function installedVersion(context, journal) {
+    let text;
+    try {
+        text = await context.deps.npm(['ls', '-g', '--prefix', journal.prefix, '--depth=0', '--json', '--no-update-notifier'], journal.nodePath, context.env);
+    }
+    catch (error) {
+        const stdout = error.stdout;
+        if (typeof stdout !== 'string' || stdout.trim() === '')
+            throw error;
+        text = stdout;
+    }
+    const listed = JSON.parse(text);
+    return listed.dependencies?.[install_kind_js_1.PACKAGE_NAME]?.version;
+}
+async function finishRollbackHeld(context) {
+    const { home, root, write, deps, paths } = context;
+    const journal = (0, update_journal_js_1.readUpdateJournal)(paths.journal);
+    if (journal === null || journal.phase !== 'rollback') {
+        throw new prompt_js_1.CliInputError('mama update --rollback --continue runs only under a rollback');
+    }
+    if (deps.version() !== journal.from) {
+        throw new prompt_js_1.CliInputError(`This is ${deps.version()}; the rollback continues in ${journal.from}: ${(0, update_journal_js_1.rollbackCommand)(journal)}`);
+    }
+    const places = (0, update_journal_js_1.packagePlaces)(journal.prefix, journal.from, journal.to);
+    try {
+        // 4: the saved launch files, not regenerated ones: a missing backend cannot block this.
+        for (const { path, copy } of journal.copies) {
+            if ((0, node_fs_1.existsSync)(copy))
+                copyOver(copy, path);
+        }
+        // 5: the database only if the candidate migrated it; a held candidate ran no turn.
+        let dropped = null;
+        if (journal.snapshot !== null && journal.schemaBefore !== null) {
+            const config = (0, config_js_1.loadConfig)({ home, path: context.configPath, onIgnored: () => { } });
+            const now = schemaStored(config.database.path);
+            const before = new Map(journal.schemaBefore.map((source) => [source.name, source.stored]));
+            const moved = now.some((source) => source.stored !== (before.get(source.name) ?? 0));
+            if (moved) {
+                dropped = inputsAfter(config.database.path, journal.lastInputId ?? 0);
+                await deps.restore(journal.snapshot);
+            }
+        }
+        // 6: tools_root is outside the backup; this version's toolkit again.
+        if (journal.toolkitInstalled)
+            await deps.toolsInstall();
+        // 7: start the previous version and check it.
+        (0, node_fs_1.rmSync)(paths.hold, { force: true });
+        await deps.start();
+        const port = (0, viewer_server_js_1.resolveApiPort)((0, launch_files_js_1.startExports)((0, launch_files_js_1.readStartScript)((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'start.sh'), 'utf8'), home))
+            .MAMA_API_PORT);
+        await (0, init_js_1.waitForBoot)({
+            status: () => deps.control('status'),
+            health: () => deps.health(port),
+            timeoutMs: deps.bootWaitMs,
+            pollMs: deps.pollMs,
+            write,
+            version: journal.from,
+            next: 'the rollback stops here',
+        });
+        const installed = await installedVersion(context, journal);
+        if (installed !== journal.from) {
+            throw new Error(`npm ls -g shows ${install_kind_js_1.PACKAGE_NAME} ${String(installed)}, not ${journal.from}`);
+        }
+        (0, update_journal_js_1.removeSnapshot)(journal);
+        (0, node_fs_1.rmSync)(paths.copies, { recursive: true, force: true });
+        (0, node_fs_1.rmSync)(places.staging, { recursive: true, force: true });
+        (0, update_journal_js_1.removeUpdateJournal)(paths.journal);
+        context.progress.send({
+            kind: 'rolled_back',
+            from: journal.from,
+            to: journal.to,
+            step: journal.failure?.step ?? journal.step,
+        });
+        write(`rolled back: ${journal.from} runs again; step ${journal.failure?.step ?? journal.step} of the update to ${journal.to} failed: ${journal.failure?.message ?? 'unknown'}`);
+        write(dropped === null
+            ? `  the database was kept: ${journal.to} did not migrate it`
+            : `  ${journal.to} migrated the database, so the snapshot was restored: ${dropped} input(s) accepted after it were dropped, and Codex sessions start over`);
+        return 0;
+    }
+    catch (error) {
+        // Stopped on the hold file, everything kept, so this can be run again.
+        let stopped;
+        try {
+            // The previous version may have started and run turns: it drains (stopForRollback).
+            stopped =
+                (await stopForRollback(context, journal)) === 0
+                    ? 'The install stays stopped on its hold file'
+                    : 'The hold file is in place, but the daemon did not stop (above) and may still run';
+        }
+        catch (stopError) {
+            stopped = `The hold file is in place, but stopping the daemon failed (${message(stopError)}) and it may still run`;
+        }
+        (0, node_fs_1.writeFileSync)(paths.hold, `${process.pid}\n`, { mode: 0o600 });
+        context.progress.send({ kind: 'rollback_stopped', from: journal.from, to: journal.to });
+        write(`rollback stopped: ${message(error)}. ${stopped}; the journal, the snapshot and both package folders are kept. Run again: ${(0, update_journal_js_1.rollbackCommand)(journal)}`);
+        return 1;
+    }
+}
+//# sourceMappingURL=update.js.map